diff --git a/.gitignore b/.gitignore index b223a2d6..e6efae0d 100644 --- a/.gitignore +++ b/.gitignore @@ -23,7 +23,7 @@ packages/ Thumbs.db # Reference repos and retail client (large, not our code, separate licenses) -# WorldBuilder is exempt — it's a load-bearing dependency tracked as a git +# WorldBuilder is exempt ? it's a load-bearing dependency tracked as a git # submodule pointing at our fork (Phase N, see docs/architecture/worldbuilder-inventory.md). references/* !references/WorldBuilder @@ -39,7 +39,7 @@ proveout*.log launch.utf8.log n4-verify*.log -# A6.P5 (2026-05-25) — door-stuck reproduction captures (multi-MB); +# A6.P5 (2026-05-25) ? door-stuck reproduction captures (multi-MB); # the 3-record fixture extracted from these lives at # tests/AcDream.Core.Tests/Fixtures/door-bug/over-penetration-capture.jsonl door-stuck-capture.jsonl @@ -55,7 +55,7 @@ imgui.ini # User-only download cache (per-developer, not source) refs/ -# Python tooling (under tools/) — bytecode caches +# Python tooling (under tools/) ? bytecode caches __pycache__/ *.pyc @@ -72,11 +72,12 @@ logs/ # Git worktrees for isolated feature work .worktrees/ -# Per-session retail-debugger scratch — cdb scripts, logs, analysis helpers. +# Per-session retail-debugger scratch ? cdb scripts, logs, analysis helpers. # The committed reference workflow lives in CLAUDE.md "Retail debugger toolchain"; # session-specific traces should not pollute the repo. *.cdb -# tools/cdb/ holds committed reference scripts — exempt them from the blanket rule above. +!tools/walk-oracle/*.cdb +# tools/cdb/ holds committed reference scripts ? exempt them from the blanket rule above. !tools/cdb/*.cdb launch_*.log launch_*.err @@ -95,7 +96,7 @@ steep_roof_trace* substep_trace* sg_built.txt # Stray bash-mangled path artifacts from PowerShell-via-bash escaping -C[€-￿]* +C[?-?]* # Obsidian vault config (personal, not project-wide) .obsidian/ @@ -104,7 +105,7 @@ C[€- claude-memory studio-shots/ -# MP1b acdream-bake output — user-machine artifact, never committed +# MP1b acdream-bake output ? user-machine artifact, never committed # (docs/superpowers/plans/2026-07-05-mp1b-pak-and-bake.md, Task 5). *.pak diff --git a/docs/architecture/retail-divergence-register.md b/docs/architecture/retail-divergence-register.md index a7716216..bafd4099 100644 --- a/docs/architecture/retail-divergence-register.md +++ b/docs/architecture/retail-divergence-register.md @@ -325,7 +325,6 @@ research and is no longer active. | AP-27 | PlayerDescription trailer: GameplayOptions skipped by a 4-byte-aligned heuristic scan for a valid inventory parse; options blob captured opaque, never decoded (retail decodes + applies UI options) | `src/AcDream.Core.Net/Messages/PlayerDescriptionParser.cs:69` | Variable-length opaque blobs; mirrors holtburger's heuristics; follow-up issue extends when panels consume those sections | An options blob that coincidentally parses as a valid inventory (or inventory not landing at EOF) yields wrong/empty inventory+equipped at login; retail-persisted UI options silently ignored | ACE GameEventPlayerDescription.WriteEventBody; holtburger events.rs:195-218 | | ~~AP-28~~ | **RETIRED 2026-08-08 (Campaign A slice A2).** The three picked AL parameters and the gain-driven eviction are both gone. `RetailSoundMixer` now carries the byte-decoded retail curve — `g = dist < 5 ? vol : 25·vol/dist²`, clamped to 1, ONE master multiply, `db = ceil(20·log10 g)`, and a hard −50 dB no-allocate floor (audible radius ≈94.2 m at unity) — with pan as retail's `−15·sin(Δbearing)` in whole decibels and a 5-metre integer deadzone. Every AL source is source-relative with `AL_ROLLOFF_FACTOR = 0` and the global distance model is `None`, so AL contributes no attenuation of its own; the old `InverseDistanceClamped` ref-2 m curve was inverse FIRST power (`2/d`), quieter than retail up close and far louder at range with no cutoff at all. Voice eviction now compares the DAT-authored float priority strictly-less in ring order per `SoundManager::PlaySoundInternal` @ `0x0054FEC0` (the row's old `FUN_00550ad0` citation was wrong — that address is inside an `IntrusiveHashTable` constructor). The residual pan-LAW approximation is AP-173; retail's own `s_bPlaySoundOnlyWhenActive` gate is TS-64. | retired | — | — | `SoundManager::GetAttenuation @ 0x00550020`; `SoundManager::PlaySoundInternal @ 0x00550170` and `@ 0x0054FEC0`; `docs/research/2026-08-08-audio-retail-soundmanager-core.md` | | AP-31 | Scenery placement drift + the 0xA9B1 road-edge tree — WB-upstream divergences from retail, ACCEPTED (**#49/#50**, 2026-05-11) | `src/AcDream.Core/World/SceneryGenerator.cs` (via `WbSceneryAdapter`) | Piecemeal patching against WB upstream is net-negative (the `e279c46` road-check attempt over-suppressed scenery elsewhere, reverted `677a726`); visible impact = a handful of trees a few meters off | The same WB-upstream class could hide a *larger* placement divergence elsewhere; revisit only via a coherent ACME-style per-vertex filter port | `CLandBlock::get_land_scenes`; ACME GameScene.cs:1074 per-vertex road filter | -| AP-32 | Cell shells DRAW +0.02 m above the dat EnvCell origin (`ShellDrawLiftZ`, z-fight vs coplanar terrain); retail draws at the origin verbatim. Split invariant: PHYSICS + visibility graph UNLIFTED (f35cb8b, **#119**-residual), every DRAW-space consumer of portal/cell geometry LIFTED (OutsideView color gate via `Build(drawLiftZ)`, seal/punch fans — **#130**) | `src/AcDream.App/Rendering/PortalVisibilityBuilder.cs` (`ShellDrawLiftZ`); `src/AcDream.App/Rendering/RetailPViewPassExecutor.cs` (`DrawPortalDepthWrite`) | Shell floors coplanar with terrain z-fight in our z-buffered frame; the 2 cm lift is the documented stand-in | A new draw-space consumer of portal/cell polygons that forgets the lift re-opens a 2 cm seam at horizontal aperture edges (the #130 top-edge strip, ~7 px at 2.4 m); a visibility consumer that picks up the LIFTED transform re-opens the #119-residual horizontal-portal side-cull | retail draws cell geometry at the dat EnvCell origin (no lift) | | AP-33 | Interior-root look-in cells (**#124** sub-pass) draw their statics + DYNAMICS + emitters WHOLE — no per-part/per-object viewcone check; retail viewconeCheck's each vs the installed view (the **#131** portal closure: a server object in a look-in cell drew nowhere — dynamics-last culls cells absent from the main cone, and post-seal it z-fails anyway) | `src/AcDream.App/Rendering/RetailPViewRenderer.cs` (`DrawBuildingLookIns`) | The main viewcone has no entries for look-in cells; over-include is the safe direction (z-correct, repainted outside apertures by the root's shells); look-in cell counts are small (~1-3 cells) | A few wasted draws on content outside the doorway region (repainted); no under-draw direction remains | `viewconeCheck` 0x0054c250; nested `DrawCells` objects pc:432878 | | AP-34 | The world now shares one delayed alpha queue across Wb GfxObj/Setup entities and scene particles and drains it at retail's landscape/final boundaries. Residual: the modern reconstruction uses one stable scope-global CYpt sort rather than retail's per-`CPartCell` `CShadowPart` sort followed by cell traversal; `EnvCellRenderer` transparent shell batches also remain immediate and outside this queue | `src/AcDream.App/Rendering/RetailAlphaQueue.cs`; `RetailPViewPassExecutor.cs` (`FlushLandscapeAlpha`); `Rendering/Wb/WbDrawDispatcher.cs`; `ParticleRenderer.cs` | The mandatory modern renderer no longer owns retail `CPartCell` shadow lists. The shared queue restores the material consequence that motivated the port—particles and ordinary translucent parts can interleave—without rebuilding a second scene graph; stable sequence retains authored order on equal CYpt | Transparent objects from different cells can exchange order at a narrow overlap compared with retail cell traversal; an alpha-blended EnvCell shell cannot interleave with a particle or Wb entity, so those rare overlaps can still overpaint differently | `RenderDeviceD3D::DrawObjCellForDummies` 0x005A0760; `CShadowPart::insertion_sort` 0x006B5130; `D3DPolyRender::FlushAlphaList` 0x0059D2E0; `PView::DrawCells` 0x005A4840 | | AP-36 | Dungeon streaming gate triggers on the player's CURRENT cell being a sealed EnvCell (`CurrCell.IsEnv && !SeenOutside`), an approximation of ACE's full landblock `IsDungeon` (all-heights-zero + NumCells>0 + Buildings.Count==0). The retail BEHAVIOR (a dungeon loads no adjacent landblocks) is faithful — only the runtime TRIGGER is the cheap cell predicate instead of classifying the center landblock. **#135 pre-collapse:** at login/teleport the same collapse is triggered EARLY (the instant the streaming center is recentered onto the spawn/dest cell) via `IsSealedDungeonCell` reading the EnvCell **dat** `SeenOutside` flag — because the physics `CurrCell` is null until placement, which waits for hydration; without the early trigger the full 25×25 ocean-grid window loads then unloads (the ~30 s login FPS ramp). **#215 cell identity:** the pre-collapse/recenter decision compares the player's current `Position.objcell_id` landblock with the received destination `objcell_id`; it never reconstructs the source from XYZ because dungeon frame origins may be negative. **#145/#138 teleport-hold suppression:** during a teleport arrival HOLD the player is unplaced, so `CurrCell` is the frozen SOURCE cell, not the destination; the gate is suppressed for the hold (`DungeonStreamingGate.Compute(isTeleportHold:true)` → not-inside-dungeon) so a teleport OUT of a dungeon follows the destination (the PortalSpace observer pin) and `ExitDungeonExpand`s, instead of re-pinning streaming onto the source dungeon (which left the outdoor destination un-hydrated → 600-frame readiness timeout → force-snap to ocean — the #145 "second teleport does nothing" + #138 incomplete-world) | `src/AcDream.App/Streaming/TeleportLandblockTransition.cs` (source/destination cell-ID classification) + `src/AcDream.App/Streaming/DungeonStreamingGate.cs` (`Compute` — per-frame predicate + teleport-hold suppression) + `src/AcDream.App/World/LiveEntityHydrationPorts.cs` (`LiveEntityWorldOriginCoordinator.TryInitialize` — login pre-collapse) + `src/AcDream.App/Physics/LiveEntityNetworkUpdateController.cs` (`OnPosition` — first accepted canonical Position) + `GameWindow:AimTeleportDestination`/`IsSealedDungeonCell` (teleport pre-collapse and DAT predicate) + `src/AcDream.App/Streaming/StreamingController.cs` (collapse/expand/`PreCollapseToDungeon`) | The predicate is already computed for sun/sky gating (playerInsideCell) and exactly matches for sealed dungeons vs windowed building interiors (SeenOutside=true → not gated); no landblock re-classification needed. The dat-flag read is the same `EnvCellFlags.SeenOutside` the hydrated `ObjCell.SeenOutside` is built from (`EnvCell.cs:72`/`PhysicsDataCache.cs:224`), so the pre-collapse decision matches the eventual per-frame gate exactly. The cell-ID comparison matches retail's complete `Position` flow. | A dungeon cell that reports SeenOutside (an entrance cell open to the surface) briefly un-collapses and re-streams the window; a hypothetical windowless building back-room (IsEnv && !SeenOutside but HasBuildings) would wrongly collapse its outdoor neighbors; a sealed-dungeon entrance cell that is itself SeenOutside is simply MISSED by the early trigger and falls back to the existing late collapse (no worse than before #135) | ACE `LandblockManager.GetAdjacentIDs` (dungeons→empty) Landblock.cs:577-582; `IsDungeon` Landblock.cs:1264-1277; retail `SmartBox::TeleportPlayer` 0x00453910 | diff --git a/docs/launch-options.md b/docs/launch-options.md index 9decd203..5da416f0 100644 --- a/docs/launch-options.md +++ b/docs/launch-options.md @@ -314,6 +314,8 @@ issue is closed, the strip was missed; delete both. | `ACDREAM_PROBE_CELL_CACHE` | indoor walking phase d | `=1` | gates one `[cell-cache]` line per EnvCell first-cached in `PhysicsDataCache.CacheCellStruct` (poly counts, BSP root structure) | print-only; fires at most once per EnvCell (cache is no-op after first population); no DebugPanel mirror | `PhysicsDiagnostics.ProbeCellCacheEnabled` | | `ACDREAM_PROBE_CHILD_CELL` | c4 route 7 | `=1` | gates one `[child-cell]` line per Runtime committed-child canonical-cell write in `RuntimeLiveEntitySessionController`, `RuntimeEntityObjectLifetime`, `RuntimeEntityDirectory` (parent/child guid, old/new cell, cause tag) | print-only | `PhysicsDiagnostics.ProbeChildCellEnabled` | | `ACDREAM_PROBE_CLIPROUTE` | "throwaway apparatus — strip once §4 ships" | `=1` | print-on-change `[clip-route]` / `[clip-route-disp]` / `[clip-route-scis]` lines: outside-slice clip routing, region-SSBO bytes, terrain-UBO head, actual GL/RHI scissor state | print-only | `RenderingDiagnostics.ProbeClipRouteEnabled` | +| `ACDREAM_PROBE_WALK_SHADOW` | Campaign FW3.2b-2 flip apparatus — dies with the flip commit | `=1` | runs the PRODUCTION retail frame walk per frame in SHADOW (no draws change) and prints one `[walk-shadow]` line per frame whose visited cell/building sets diverge from the old visibility path (the I5 dual-shadow pattern applied to the FW3 static cutover) | print-only; adds the per-frame CPU cost of the shadow walk while set | `RenderingDiagnostics.ProbeWalkShadowEnabled` | +| `ACDREAM_PROBE_WALK_ROOT` | the cathedral Phase I instrumentation (synthesis doc `docs/research/2026-08-30-cathedral-synthesis.md`) — dies with that investigation | `=1` | prints `[walk-root]` rooting lines every ~30th frame AND for 8 frames after each interior/outdoor root flip (viewer/root cell, camera-cell resolution, slice count, the walk's OWN exit-view count, the TRUE root flood separated from the visited union, eye + forward); `[walk-cam]` replayable camera dumps (eye, viewport, full view-projection) every ~300 frames and at flips; `[falls]` lines on EVERY particle submission carrying a real falls owner (0xCF418000-13) with route + phase; `[falls-adm]` admission verdicts for F418 emitters (~every 120th ApplyRetailView); plus the earlier family — `[walk-part]` per-route submissions, `[walk-alpha]` drains, `[walk-dyn]` outside-stage verdicts (~120th product frame), `[walk-portal]` per-portal side/clip decisions (~90th frame), and `[dyn-route]` per-entity ON-CHANGE DynamicLast admission traces (parent cell, look-in exclusion, viewcone verdict, the cell's lifted-plane shape — "0" marks a pass-all zero-plane slice) | print-only; chatty near particle-heavy scenes while set | `RenderingDiagnostics.ProbeWalkRootEnabled` | | `ACDREAM_PROBE_CONTACT_PLANE` | spike-only, 2026-05-20 | `=1` | gates one `[cp-write]` line per write to `CollisionInfo.ContactPlane*`/`LastKnownContactPlane*` fields (field, old→new, caller method via stack walk, source line); only logs on actual value changes | print-only, but performs a stack walk to identify the caller method when firing — real CPU cost per write while on (not just a string format); suppresses no-op writes to bound volume | `PhysicsDiagnostics.ProbeContactPlaneEnabled` | | `ACDREAM_PROBE_ENT` | #138 | `="1"` | Traces the persistent player entity across teleport streaming churn: presence in the render draw-set flat view vs. survival of the dynamics cull, to distinguish "missing from draw set" vs "present but culled" | print-only, "Observation-only — emits no behavior change" (doc comment). `LogPlayerDynOnChange` dedupes by transition to avoid per-frame spam. Marked STRIP-once-root-caused (like the dense-town FPS apparatus). | `EntityVanishProbe.Enabled` (`EntityVanishProbe.cs:23-24`), issue #138-B | | `ACDREAM_PROBE_FLAP` | "throwaway apparatus — strip once the flap mechanism is confirmed" | `=1` | EVERY FRAME (unthrottled, not change-gated) while the camera root is indoor: `[flap]` from `PortalVisibilityBuilder.Build` (portal side-test/traverse/cull/projection) + paired `[flap-cam]` from `PhysicsCameraCollisionProbe`/`[flap-sweep]` (FindCameraCell resolution, eye positions) | print-only, but unthrottled per-frame `StringBuilder` allocation + `Console.WriteLine` on multiple call sites while indoor — heavy log volume/allocation under sustained indoor play; does not alter rendered output | `RenderingDiagnostics.ProbeFlapEnabled` | diff --git a/docs/plans/2026-04-11-roadmap.md b/docs/plans/2026-04-11-roadmap.md index ea586a03..16306685 100644 --- a/docs/plans/2026-04-11-roadmap.md +++ b/docs/plans/2026-04-11-roadmap.md @@ -518,6 +518,26 @@ Plus polish that doesn't get its own phase number: ## Phases ahead — agreed order +### Campaign FW — the retail frame walk (ACTIVE 2026-08-30) + +**Tagline:** retail owns every frame decision; modern code only moves bytes. + +**Filed:** 2026-08-30 after Campaign PV's halt (the PView graft onto the +gather/regroup renderer failed; owner verdict). Replaces the ~4.7K-line +accumulated visibility/composition layer (`PortalVisibilityBuilder`, +`RetailPViewRenderer`/`PassExecutor`, `CellVisibility` BFS, `ClipPlaneSet` +gating) and the dispatcher's material regrouping with a verbatim port of +retail's frame walk (`SmartBox::RenderNormalMode` rooting, +`PView::DrawCells` recursion, `LScape::draw`, building look-ins, stage +interleave, depth semantics, camera incl. the retail zoom envelope). The +WB-derived asset/residency layer is untouched. Gated by a cdb walk oracle +(retail's captured per-frame draw sequence as replayable fixtures), a +standing transition checklist, and a dense-Arwic perf stop-rule at FW3. +Stages FW0–FW6; no long-lived dual path. + +**Spec:** [`docs/superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md`](../superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md). +**Plan + ledger:** [`docs/plans/2026-08-30-campaign-fw-frame-walk.md`](2026-08-30-campaign-fw-frame-walk.md). + ### Phase O — DatPath Unification — SHIPPED 2026-05-21 **Tagline:** ONE thing touches the DATs. diff --git a/docs/plans/2026-08-30-campaign-fw-frame-walk.md b/docs/plans/2026-08-30-campaign-fw-frame-walk.md new file mode 100644 index 00000000..9ffa2f5d --- /dev/null +++ b/docs/plans/2026-08-30-campaign-fw-frame-walk.md @@ -0,0 +1,626 @@ +# Campaign FW — the retail frame walk (implementation plan) + +**Status:** ACTIVE (opened 2026-08-30; spec approved by owner 2026-08-30). +**Spec (approved):** +[`docs/superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md`](../superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md) +— note: the campaign letter is **FW** (frame walk); the spec predates the +rename (the roadmap already owns "Phase W" for the historical Unified Cell +Graph program). +**Branch:** `claude/campaign-w-retail-frame-walk` off main `e102fb36`. +**Predecessor:** Campaign PV, halted 2026-08-30 +(`docs/plans/2026-08-30-pview-visibility-campaign.md`); its back half is +quarantined on `claude/cathedral-rendering-debug-47a417` and nothing merges +from it. + +**One-sentence goal:** retail owns every frame decision (rooting, portal +views, cone gating, landscape walk, buildings, stage order, depth +semantics, degrade, particles, camera); modern code owns only pixel-neutral +GPU mechanics; the ~4.7K-line accumulated visibility layer and its patch +apparatus are deleted at their stages. + +--- + +## Binding rules (all stages, binding on subagents) + +1. **The ownership line is the campaign invariant.** If a modern component + makes a decision retail did not make, that is a campaign bug regardless + of pixels. Every ported function cites its named retail symbol. +2. **Grep named first.** `docs/research/named-retail/acclient_2013_pseudo_c.txt` + by `class::method` before any fresh decompilation; pseudocode notes in + `docs/research/` before C# (the mandatory workflow). +3. **Fail loud, never silently drop.** The PV3 post-mortem rule: any + admission/seeding/ordering filter that rejects work must log the + rejection under a diagnostic flag or fall open — silent drops produced + this week's hollow-world regressions. +4. **The transition checklist is a standing self-run gate.** Every + candidate build gets, before the owner sees it: portal-in arrival + frames, a Holtburg house exit, a teleport-to-Holtburg stopwatch, and a + steady-state fps read (drive.ps1 + screenshots). No terrace-only + verification, ever again. +5. **No long-lived dual path.** Campaign V precedent: a stage that cuts + over deletes the code it replaces in the same stage. Short-lived + scaffolding inside one stage is fine; a toggle that survives a stage + boundary is not. +6. **Register discipline.** Deviations add their row in the same commit; + ported mechanisms delete rows in the same commit + (`docs/architecture/retail-divergence-register.md`). +7. **Suites green at every stage close** (hermetic filter + `Lane!=InstalledDat&Lane!=Linux&Lane!=Manual&Lane!=Timing&Lane!=Live&Lane!=PreparedPackage`), + plus the stage's own gates. Sonnet implements; Opus reviews stage + boundaries (architectural + retail-faithfulness lenses). + +## Verified seam map (recon 2026-08-30; cite these, do not re-derive) + +**Frame chain today:** `GameWindow.OnRender` (GameWindow.cs:1785/1809) → +`GameFrameGraphSlot.Render` → `RenderFrameOrchestrator.Render` +(RenderFrameOrchestrator.cs:206/226) → `VulkanWorldScenePhase` +(VulkanCompositionFramePhases.cs:113, owns the backbuffer pass) → +`WorldSceneRenderer.Render` (WorldSceneRenderer.cs:128) → +`RetailPViewRenderer.DrawInside` (RetailPViewRenderer.cs:112), which builds +`PortalVisibilityFrame` internally (line 122) and drives +`RetailPViewPassExecutor` through the packed route contract +(`RenderFrameCandidateRoute`: LandscapeOutdoorStatic → LandscapeBuildingShell +→ LookInObject → LandscapeOutsideDynamic → CellStatic → DynamicLast; +`WbDrawDispatcher.PackedOracle.cs:108/171` enforces in-order consumption). + +**What the walk-order submitter REPLACES:** `GroupKey` material bucketing +(`ClassifyBatches` WbDrawDispatcher.cs:3292, `ClassifyPackedBatches` +PackedOracle.cs:610, `_groups`/`_packedGroups`), `PartitionInstanceGroups` +(:2232), and the two distance sorts (`CompareOpaqueSubmissionOrder` :2865, +`CompareTransparentSubmissionOrder` :2871). Note: the deferred-alpha path +(`DeferTransparentGroups` :2619 → `RetailAlphaQueue`) already reconstructs +draw-local order per instance — the transparent side is half-way to +walk-order today and is the SSBO-layout pattern to follow. + +**What is REUSED unchanged:** `GlobalMeshBuffer` arena (GlobalMeshBuffer.cs:84), +`WbMeshAdapter`/`ObjectMeshManager` mesh prep + self-heal +(WbMeshAdapter.cs:328/435), `TextureCache` GpuTextureSlot resolution +(WbDrawDispatcher.cs:3421), the ring-section SSBO writers + shared +`WorldTransformFrameArena` (Rhi.cs:913/945), `MeshPipelineSet` (Rhi.cs:49), +and the terminal MDI recorder `DrawIndirectRangeRhi` (Rhi.cs:798). + +**Caveats that shaped the stages:** three parallel classifiers exist +(classic, packed, directional-shadow — WbDrawDispatcher.DirectionalShadows.cs:1021) +and must agree until each is cut over; `EntityClassificationCache` and +`PackedProjectionClassificationCache` assume group-bucketed submission and +retire with their routes; `StageImmediateGroup` lays per-instance SSBOs by +group-order cursor, so the walk submitter re-derives layout from stream +order (start per-instance like deferred alpha; merge adjacent runs after +correctness). + +**Visibility consumers to re-point at the walk output** (the complete +production list — radar, audio, and picking do NOT consume visibility): +- Particles: `WorldSceneRenderer.cs:263` → `ParticleVisibilityController` + → `ParticleSystem.ApplyRetailView` (Core/Vfx/ParticleSystem.cs:313), fed + outdoors by `TerrainModernRenderer.VisibleCellIds`. +- Lights: `WorldSceneRenderer.cs:264` → `RuntimeWorldFrameEnvironmentPreparation` + (WorldRenderFrameBuilder.cs:543) → `LightManager.BuildPointLightSnapshot` + (Core/Lighting/LightManager.cs:284). +- EnvCell prepare filter: `RetailPViewPassExecutor.cs:276` → + `EnvCellRenderer.PrepareRenderBatches` (EnvCellRenderer.cs:456). +- Entity routes: `RenderScenePViewFrameProduct.cs:1330-1587`. +- Gated diagnostics only beyond that. + +**Streaming atomicity (what already holds vs what FW adds):** per-cell +publication is ALREADY atomic — one dictionary swap of a complete +immutable `EnvCellLandblock` (EnvCellRenderer.CommitPublication:347); +outdoor terrain commits at LandblockRenderPublisher.AdvanceBeginOne:267. +The real partial states are (a) landblock-stage terrain-before-interiors +across yielded publication stages (LandblockPresentationPipeline.cs:711/757 +— deliberate walking pop-in, hidden by the reveal hold during +portal/login), and (b) committed cells drawing before every contained +static mesh is resident (skip-if-missing, EnvCellRenderer.cs:720). FW keeps +both as EXPLICIT, register-rowed adaptations; the walk consumes only the +committed registry (`CellVisibility.TryGetCell` — production role is the +registry; its BFS is already dead code). + +**The patch apparatus to delete (exact sites):** +- `ShellDrawLiftZ` +0.02 lift, three consumers: PortalVisibilityBuilder.cs:353 + (const + Build's drawLiftZ), RetailPViewPassExecutor.cs:697 (depth fans), + LandblockBuildFactory.cs:523 (baked into draw cellTransform). +- Punch stencils (#117 adaptation): PortalDepthMaskRenderer.Rhi.cs:59-125. +- Look-in seeding heuristics: PortalVisibilityBuilder.BuildFromExterior:713-923 + + callers MergeNearbyBuildingFloods (RetailPViewRenderer.cs:411), + BuildInteriorRootLookIns (:471), DrawBuildingLookIns (:600-860), and the + barrier math (:515-559). +- The InViewCells side-channel (RetailPViewRenderer.cs:2187) once consumers + read the walk output. + +**Camera facts:** `RetailChaseCamera.cs` — `Distance` default 2.61 m, +clamps DistanceMin=2/DistanceMax=40 (:110-113); collision probe + slope +align + chase already default-on retail behaviors +(Core/Rendering/CameraDiagnostics.cs:28-50). Retail envelope (from the +d71f5ef1 diff, which lives ONLY on the quarantined branch — this branch has +no AD-116 row): `CameraSet::Farther` @0x00458890 scales the viewer offset +multiplicatively and REFUSES the write once |offset.y| ≥ 10 (gates |x|<10, +|y|<10, z<450, z>-1.8); the standard arc saturates near offset +(0, −10, +8.33) ≈ a 13.0 m boom. `CameraSet::Raise` @0x00457980 rotates at +preserved length. TS-56 records the non-retail adjustment scalars +(CameraAdjustmentSpeed=40/s etc.). + +**Retail anchors already established:** `SmartBox::RenderNormalMode` +@0x00453aa0 (frame rooting), `PView::DrawCells` @0x005A4840, +`LScape::draw` @0x00506330, `LScape::grab_visible_cells` @0x00504EC0, +`DrawBuilding` pre-punch flush @0x0059F2A0, `ShouldDrawParticles` +@0x0050FE60, the untextured skip in `D3DPolyRender::DrawMesh` @0x0059d4a0, +`ACRender::polyClipFinish` (two call sites: `PView::GetClip` + debug), +`Render::viewconeCheck`. + +--- + +## Stages + +### FW0 — the walk oracle (tooling + fixtures) + +**STATUS: COMPLETE 2026-08-30.** Ten trace fixtures + README +(`docs/research/2026-08-30-fw-walk-oracle/`, commit `71b11817`), the +replay helper + 19 fixture goldens (`9f4c0f95`), and the port-ready +pseudocode model + full decomp appendix +(`docs/research/2026-08-30-fw-walk-pseudocode.md`, `a6885aa2`). Findings +that reshaped the campaign: the frame roots at the CAMERA's cell; +outdoor frames draw the #456 far building every frame and bury it by +depth (no hiding mechanism exists to port); retail DOES draw depth-only +invisible portal-polygon panels (`DrawPortalPolyInternal` — punch far-Z +/ seal own-depth) — the AD-117 stamps re-invented a real mechanism at +the wrong site. **Known gap:** the first capture round did not record +the camera pose; exact FW1 replay needs pose-stamped traces. A prepared +template (`tools/walk-oracle/fw0-capture-pose.cdb.template`) makes the +re-capture a short owner-assisted session; scheduled for when FW1's walk +is ready to gate (structural conformance proceeds meanwhile on the +existing traces). + +**Goal:** retail's actual per-frame draw walk, captured and replayable, +BEFORE any port is judged. + +- Build the cdb capture harness (`tools/walk-oracle/`): breakpoint script + logging, per frame, the sequence of cell/building draw entries with + stage boundaries — hook `PView::DrawCells`, `CEnvCell` draw, + `CLandBlock`/`LScape::draw`, `DrawBuilding`; dump cell ids (`this` + offsets verified with one-shot `dt` first). cdb safety rules from the PV + campaign are binding: never inline `-c` attach to a client that matters, + every `j` branch ends in `gc`, `qd` threshold auto-detach, watch hit-rate + lag. +- Capture positions (owner assists — retail sessions): Sanctuary terrace + center + terrace EDGE (normal camera — the #456 acceptance pose), + cathedral portal-in arrival, a Holtburg doorway (the flap scene), a + Holtburg street + house exit, one deep dungeon corridor. Record camera + pose per capture. +- Also capture the same positions in acdream (world state: cell registry + contents) so W1 replays are apples-to-apples. +- Pin the port function list as a research note with pseudocode stubs: + `docs/research/2026-08-30-fw-walk-pseudocode.md` (grow it through FW1). +- **Deliverable/gate:** trace fixtures checked into + `docs/research/2026-08-30-fw-walk-oracle/`, replayable by a test + helper; harness scripts committed; no production code touched. + +### FW1 — `RetailFrameWalk` + `PViewSet` (pure CPU, conformant) + +**Goal:** the ported walk as a standalone module that reproduces the +oracle traces exactly. + +- New `src/AcDream.App/Rendering/Walk/`: `RetailFrameWalk` (rooting per + `SmartBox::RenderNormalMode`; EnvCell recursion per `PView::DrawCells`; + landscape walk per `LScape::draw`/`grab_visible_cells`; building + look-ins per `DrawBuilding` + `ConstructView(CBldPortal)`), + `PViewSet` (`ConstructView`/`set_view`/`PView::GetClip` — the chain + polygon is the only CPU-clipped geometry; one view per chain, never + merged), `IWalkWorldView` (the read seam: committed cells via the + registry, buildings via `BuildingRegistry`, camera pose). +- Output: an ordered walk event stream (cell id, view, stage) matching the + oracle trace format, plus the frame's visible-cell set. +- Pseudocode first (workflow step 3), C# port line-by-line (step 4), named + symbols in comments. +- **Gates:** oracle-trace replay tests pass position-for-position; + synthetic-world unit tests for rooting/recursion/cone edge cases; the + existing replay fixture suite (Issue95/113/120/124/127/130/131/176-177/ + 181, SanctuaryPortalSeam, HouseExitWalkReplay, TowerAscentReplay, + CornerFloodReplay) re-expressed against the walk — behavior differences + vs the old builder are adjudicated against the ORACLE, not against the + old builder. No production wiring; hermetic suites green. + +**FW1 STATUS (2026-08-30, @`77f5342b`):** NINE of the ten pose-stamped +fixtures reproduce retail frame-exactly (foundry-deep all 39 frames, +doorway-still, street-outdoor, terrace-center, terrace-edge — the #456 +acceptance pose — cathedral-arrival, holtburg-walkout, -transitions, +-walkabout); foundry-entry is exact through F66 with the F67–F79 +standing segment parked on ONE live number (building 0036's root-plane +viewpoint — probe `tools/walk-oracle/fw1-f67-viewpoint-probe.cdb`, +goal-sanctioned retail-session stop filed with the user). Load-bearing +adjudications, all decomp-cited: the two-arm `get_degrade` threshold +rule (ideal→max at the live `deg_mul≈+0.99`), deg_mul's DYNAMIC swing +under capture load (doorway-still pins mul=0 — an environment pin like +the viewport), znear=0.1 confirmed, and the Ghidra-arbitrated portal +walker truth table (BN FPU pseudo-C mis-renders branch sense — three +separate misreads this stage; Ghidra first, always). +**Gate amendment:** the old-replay-fixture re-expression is retired as +an FW1 gate — the ten traces are direct retail evidence and strictly +supersede fixtures that encode the OLD builder's behavior; the old +suite's scenario classes (doorway flap, dungeon seams, tower ascent, +corner flood) are covered by the traces and re-verified live at the +FW3/FW4 connected gates, where the old fixtures retire with the old +builder. Production classes: `RetailFrameWalk`, `WalkPView` (the +PViewSet role), `WalkBuildingPortals`, `WalkLandscape`, +`WalkVisibilityMath`, `WalkScreenClip`, `WalkCopyView` under +`src/AcDream.App/Rendering/Walk/`. + +### FW2 — `OrderedDrawStream` + `OrderPreservingSubmitter` + +**Goal:** walk-order submission through the existing RHI, proven +pixel-equivalent on static content. + +- `OrderedDrawStream`: append-only (mesh ref, transform, material state, + stage, cell) commands in walk order. `OrderPreservingSubmitter`: binds + `GlobalMeshBuffer` once, reuses ring-section writers + `MeshPipelineSet` + + `DrawIndirectRangeRhi`; emits per-instance first (the deferred-alpha + SSBO pattern), then merges ADJACENT same-state commands into MDI runs — + a merge across a state or stage boundary is forbidden by construction + (assert it). +- Depth semantics: port retail's depth compare/write configuration for the + world passes verbatim in this stage (current set uses Less — verify + against retail's raster state and document the finding either way). +- Diagnostic harness: a dev scene (offscreen target) drawn twice — old + path vs walk path — framebuffer-compared (the Slice-7 comparison + pattern, with the pixel-diff repeat floor from + `feedback_pixel_diff_needs_repeat_floor`). +- **Gates:** submitter unit tests (order preservation, merge legality); + framebuffer equivalence on static-content scenes; hermetic suites green. + +**FW2 STATUS (2026-08-30, @`e65644cb`):** `OrderedDrawStream` + +`WbDrawDispatcher.OrderedStream` (the submitter partial — per-instance- +first emission, pure-CPU merge-run builder, fail-loud stage/pipeline/ +cull boundary validation) and `WorldDepthContract` are landed with 27 +RecordingGpuDevice gates; hermetic 6,714/0. Depth verified verbatim +from the decomp (`zfuncVal` 0x2 = D3DCMP_LESS via `SetDepthBufferMode` +@0x005a2d10; LESSEQUAL is GameSky-local). **Gate adjudication:** the +offscreen pixel A/B rides FW3's cutover toggle — a walk-driven scene +first exists there, `IGpuRenderTarget` has no readback verb today, and +opaque content under Less is order-independent, so the RecordingGpuDevice +order/merge referees are FW2's automated gate and the pixel proof joins +FW3's (offline pixel gate + owner visual gate). Deferred to FW3 and +recorded in the code: the building-detail overlay replay, portal-punch +emission, and the `_drawCullModes`/alpha-scope sequencing constraint. + +### FW3 — static world cutover + THE perf checkpoint + +**Goal:** terrain, EnvCell shells, and buildings draw via the walk in +production; the statics gather path is deleted; perf is measured before +deeper commitment. + +- Root the production frame at the walk: `WorldSceneRenderer` drives + `RetailFrameWalk` + submitter for the static routes + (LandscapeOutdoorStatic, LandscapeBuildingShell, CellStatic); dynamic + routes (LookInObject, LandscapeOutsideDynamic, DynamicLast) stay on the + packed path within this stage only (the route-contract split makes the + seam clean). +- Retire the three `ShellDrawLiftZ` sites in this stage — walk order + + retail depth semantics replace the tie-break; prove it at the #130 + doorway-strip scene before deleting, and delete the register row in the + same commit. +- Terrain/sky/weather draw at their walk turns (the stage interleave from + `RetailPViewPassExecutor`'s ported knowledge moves inward). +- **Perf checkpoint (the spec's stop rule):** dense Arwic uncapped, + Release, exact binary: CPU/GPU p50/p99 + fps vs the current production + profile (519.7 fps / 1.869 / 1.096 ms baseline). Within 20% → proceed; + worse → STOP, owner decision with numbers on the table. +- **Gates:** transition checklist self-run; hermetic suites; owner visual + gate (statics look right indoors + outdoors, no seam strip at the + doorway, no z-fighting at shells); perf numbers recorded in this plan. + +**FW3 SLICE PLAN (2026-08-30, from the cutover-surface survey):** + +- **FW3.1 — production walk world data.** Materialize the walk's world + model at landblock commit time, registry-owned, through the LEGAL + `IDatReaderWriter` seam (never raw `DatCollection` — + `RuntimeDatAccessArchitectureTests`): (a) `WalkCell` fields onto/beside + `LoadedCell` (portal side/exact from the RAW `Flags` already preserved + on `CellPortalInfo`; plane from the existing `ClipPlanes` parallel + list; the 0xFFFF→0xFFFFFFFF exit-sentinel widening); (b) a production + `WalkBuilding` build in `LandblockBuildFactory`/`BuildingLoader` — the + BIGGEST gap: today's `Building` drops ModelId/Frame/portal + flags/stab lists at load; (c) the walk landscape assembly (retail + z-slabs from the height table, the SideCellCount LOD pyramid, + `CellBuildings[]`, viewer-centred grid) fed from landblock residency; + (d) the production frame context: camera/rays/CyPlane/ObjectToClip + derived from the LIVE `WorldCameraFrame` + real viewport (the capture + client's 1024×720 constants are fixture pins, not production values). + Conformance: the ten oracle fixtures re-run against the PRODUCTION + builders (same DATs → identical walk output as the test adapter). +- **FW3.2 — walk-driven static routes.** `WorldSceneRenderer` drives + `RetailFrameWalk` → `OrderedDrawStream` + (Terrain/BuildingShell/CellStatic/LookInStatic/PortalPunch stages) → + `SubmitOrderedStream` for static content; the old builder STOPS + EMITTING `LandscapeOutdoorStatic`/`LandscapeBuildingShell`/`CellStatic` + ranges (the `CompletePackedProductionFrame` count assertion forbids + emit-but-skip); dynamic routes (`LookInObject`, + `LandscapeOutsideDynamic`, `DynamicLast`) stay packed — which requires + `ClipFrameAssembler` + `ViewconeCuller` to SURVIVE this stage (their + slices key the dynamic routes). Walk-path SELECTION publication + (static picking today rides `publishSelection: true` in the packed + classifier — an unlisted consumer; the walk submitter must feed + `RetailSelectionScene` or statics go un-clickable). Portal-punch + emission via `PortalDepthMaskRenderer` at walk turns; building-detail + overlay replay; sky/weather move from per-slice to the walk's + landscape turn; the `_drawCullModes`/alpha-scope sequencing constraint + resolved (own cull scratch or strict sequencing). Route-keyed particle + owners re-sourced from the walk. +- **FW3.2b-2 — the production rooting (DESIGN, 2026-08-30; execute + INLINE, not via subagent — the integration-slice rule).** The + dual-compute split for this stage: the OLD visibility + (`PortalVisibilityBuilder` + look-in frames + clip assembly + + viewcone) KEEPS RUNNING to feed everything dynamic; the WALK draws + everything static. No old static DRAWS remain (no double draw): + 1. `RetailPViewRenderer.DrawInside` keeps steps 1–8 and 10–11 + (visibility, merge/look-in seeding, clip frame, prepare — with + `prepareCells` UNIONED with the walk's flood/look-in cells — + viewcone, route build) but `RenderScenePViewFrameProduct` STOPS + emitting `LandscapeOutdoorStatic`, `LandscapeBuildingShell`, and + `CellStatic` ranges. Per the plan's route split, LOOK-IN OBJECTS + (`LookInObject`) are dynamic-side and STAY PACKED this stage — + the old look-in machinery keeps drawing look-in cell content and + its punches; the WALK's building turns therefore draw shell + content + punches for NON-look-in... NO — resolve the overlap the + other way: the walk's building turns run their punch+look-in + machinery ONLY for the walk's own conformance events; production + look-in DRAWS (punch fans + content) stay entirely on the old + path this stage, and the walk's `BuildingShell` stage content + + `OnPunchGeometry`/look-in DC draws are SUPPRESSED in the driver's + production wiring for look-in-owned buildings… REJECTED — that is + a dual path. FINAL: the walk owns ALL of it — building shells, + punches, look-in STATIC content (stage LookInStatic) — and the + `LookInObject` route survives ONLY for the DYNAMICS inside + look-in cells (`BuildLookInRoutes` filtered to dynamic + classifications). The old `DrawBuildingLookIns` static half and + `DrawLookInPortalPunch` retire with the static routes. + 2. `WalkFrameDriver`'s leaf renderer maps to: + sky → `RetailPViewPassExecutor` sky call; terrain slice → + `_terrain.Draw(camera, frustum, clipPlanes: slice.Planes, + ndcClipAabb: slice.NdcAabb)`; cell shell → + `EnvCellRenderer.Render(pass, singleCellSet)` (+ transparent + ordered per cell); punch fan → `PortalDepthMaskRenderer. + DrawDepthFan(worldVerts, viewProjection, slicePlanes, + forceFarZ: true)`; `ClearInteriorDepth` → + `IWorldPassScope.ClearInteriorDepth` (keep production's + slices>0 gate); `DrawExitSeals` → the existing seal-fan loop + (`DrawPortalDepthWrite` seal flavor over the root flood's exit + portals); alpha barrier → `RetailAlphaQueue.FlushFartherThan`. + 3. Static records: cell statics via `RenderSceneQuery. + CopyCellStaticsTo(cellId)`; outdoor statics via a per-landscape- + cell index built once per frame from + `CopyIndexTo(OutdoorStatic)`; building shells via the + `IsBuildingShell` entities keyed by anchor cell. + 4. Consumers re-pointed: particle owners + (`RenderFrameRouteOwnerSelector.Replace(LandscapeOutdoorStatic…)` + sites) re-source from the walk's populated cells; diagnostics + source counts tolerate the route removal; `EmitRenderSignature`'s + terrain/scenery counts re-source or annotate. + 5. Sky/weather: sky moves into the walk's LS turn (once); weather + stays in the old late-dynamics slice loop this stage (it is + dynamic-adjacent and the plan's FW4 moves it fully). + 6. Gates before the owner sees a build: hermetic + InstalledDat + suites; the connected lifecycle route; the offline pixel gate + (outdoor statics); dense-Arwic pre/post pair (physical display). + +**FW3.2b-2 STATUS (2026-08-30, @`4918677b`): THE STATIC CUTOVER IS +COMMITTED.** The walk drives every production static draw +(`DrawWalkDrivenStatics` + the dynamics-remainder phases); the three +static routes are deleted from the product builder; particle owners +re-source from the walk's per-cell-turn visited sets (retail's own +gate — `ShouldDrawParticles` @0x0050FE60). Landed evidence: the walk +shadow probe ran 11k+ live frames faultless with walkCells ⊂ oldCells +every frame. The old static path survives ONLY behind `!walkActive` +for the executor-fake test path (15 retail-ordering regression tests; +unreachable by production) — **its deletion is FW4 scope**. +Transitional risks recorded in code: two-pass walk cost (FW3.4 +measures), interior slice-count reconciliation between the old clip +assembly and the walk's exit-view survival, outdoor merged-flood +punch coverage now riding the walk's building-BSP punches (owner +visual gate verifies). Suites: hermetic 6,750/0; Walk 201/1; +InstalledDat conformance 40/1 untouched. + +- **FW3.3 — ShellDrawLiftZ retirement.** THREE sites (the register row + AP-32 lists only two — `LandblockBuildFactory.cs` bakes the lift into + the drawn cell transform and is unlisted): delete all three, flip the + #130 proof (`UnliftedGate_LeavesTheStripAtTheDrawnTopEdge` is + explicitly written to fail-by-gap until the lift is gone), delete + AP-32 in the same commit. +**FW3.3 STATUS (2026-08-30, @`05240d2c`): RETIRED + connected-PASSED.** +ShellDrawLiftZ deleted at every site (AP-32 deleted same commit); the +#130 proof flipped as authored (strip test deleted, the 147-combo +coverage sweep passes in the one dat space, unchanged tolerances). +Three lifecycle-gate PASSES today on exact binaries; owner-confirmed +live: no seams at the doorway class. PERF FLAG for FW3.4: Holtburg +town 19-22 ms CPU p50 / ~1.8 MB-frame alloc on the walk path (capped +diagnostic read; interiors 3.3 ms) - candidates: collapse the +two-pass walk, batch per-cell shells, cache the outdoor-statics +index, cut per-segment rebinds. + +**FW3.4 PERF PAIR (2026-08-30, same session/conditions, exact +binaries):** dense Arwic uncapped, PRE (@87853359, old static path) +vs POST (@3a05d659, walk-driven): CPU p50 23.6 -> 31.6 ms (+33.5%), +p95 36.3 -> 44.3 ms (+21.9%), alloc p50 133 KB -> 1,920 KB/frame +(14x). THE +/-20% STOP RULE TRIGGERS. Sources are the flagged known +costs (two walk passes/frame, per-cell single-segment submissions +with full section rebinds, per-cell record-array copies in the world +data). FW3.4a fixes them (single walk pass; prepare-once/draw-ranges +- the deferred-alpha architecture; pooled record segments), then the +pair re-measures against the SAME baseline; the owner decision only +triggers if it still exceeds 20% after the known fixes. + +**FW3.4a RESULT (2026-08-30, @`1da178d9`): THE STOP RULE CLEARS.** +Post-refactor dense Arwic uncapped vs the SAME baseline: CPU p50 +23.6 -> 22.9 ms (-3.2%), p95 36.3 -> 34.7 ms (-4.5%) - the walk path +is now FASTER than the old static path. The refactor's own crash +round (VK_ERROR_DEVICE_LOST) taught the binding contract: leaf draws +and alpha flushes rebind set-0 between ranges, so DrawOrderedRange +rebinds per call; only the ring WRITES are once-per-frame. FOLLOW-UP +FILED: alloc p50 still ~1.5 MB/frame on the walk path (baseline +133 KB) - the per-frame driver/leaf/populator object graph in +DrawWalkDrivenStatics; hoist to renderer fields with per-frame +Reset (FW3.4 closeout or FW6 polish; CPU-neutral today, GC-hitch +hygiene). + +- **FW3.4 — perf checkpoint + gates.** BASELINE CORRECTION: the + 519.7 fps / 1.869 / 1.096 ms numbers are the Aerlinthe + ordinary-production profile, NOT dense Arwic. Before the cutover + lands, capture a fresh dense-Arwic pre-cutover baseline with the same + harness (`tools/run-connected-r6-soak.ps1 -Uncapped -DenseTown`), and + apply the ±20% stop rule to THAT pair. Transition checklist: the + lifecycle gate + dense-town soak exist; a Holtburg house-exit stop and + a teleport stopwatch metric must be ADDED to the lifecycle route + (`drive.ps1` from the spec does not exist — the checklist runs on the + existing gate scripts). + +### FW4 — entities, particles, dynamics into walk turns; delete the apparatus + +**Goal:** everything draws at its walk turn; the patch apparatus and the +old visibility layer are gone. + +**THE CATHEDRAL FALLS — FIXED, USER-VERIFIED 2026-08-30 (`280c0549`).** +After six failed staging rounds, a seven-report independent review +(corpus + synthesis: `docs/research/2026-08-30-cathedral-*.md`), the +reverts of slices 4+5 (`7f500b97` — the straddle rule was invented and +slice 5 had misidentified cell-0x106 TORCHES as the falls, causing the +in-cathedral particle regression), and Phase I instrumentation proving +every submission datum healthy (route/phase/admission/flood all +retail-correct), the OWNER's pointer to the old pipeline's user-verified +#132 fix (`e102fb36`) supplied the missing mechanism: retail's falls +containment is POSITIONAL — an outdoor emitter's polys join the one +alpha list AT ITS OWNER CELL'S TURN in the far-to-near landscape walk, +so each nearer building's pre-punch FlushAlphaList drains the farther +content against still-true depth BEFORE the punch stamps far-Z. The walk +path had the barriers but batched all static-owner submission after +every punch. `WalkFrameEventKind.StaticParticles` now submits each +landscape cell's and building shell's owners at that turn (meshes +marked/flushed first); the batched path is deleted for both root kinds. +Torches confirmed unregressed. CARRIED from the same gate: indoor RAIN +(our weather confined by the slice scissor AABB instead of retail's +polygon-exact view planes — diagnosed, unfixed) and the STALKS (drawn +never-drawn marker anchors — the degrade admission re-land, synthesis +plan step 10). + +**FW4 SLICE 1 — the interior outside-view source cutover (2026-08-30, +pulled forward from the FW3 visual gate).** The owner's stairwell/grass +transition report (grass briefly covering floor openings at doorway +crossings, intermittent — the #119 family) probe-pinned to the FW3 dual +path: the walk decided WHETHER terrain draws (`_interiorPView.OutsideView. +ViewCount > 0`) while the old `PortalVisibilityBuilder` assembly decided +WHERE (slice clip planes + count + scissor), and the walk's punch fans +indexed the OLD slice array with WALK view indices. At boundary frames +(`ACDREAM_PROBE_WALK_ROOT` captures: the slices=2 short-flood family at +OUT→IN, a 1-frame outdoor blip mid-crossing) the old builder's exit views +went fat/degenerate, terrain splashed over interior pixels, and the +depth-clear preserves COLOR — any cell absent from the walk's flood never +repainted its pixels. Retail cannot produce this: it has ONE visibility +structure. The cutover: `ClipFrameAssembler.ReassembleOutsideViewFromWalk` +materializes the walk's own `outside_view` (pixel points → standard NDC → +the existing `ClipPlaneSet.From` machinery) into the assembly's +outside-view block right after Collect, before the single +`PrepareClipFrame` publication (moved below the walk block); the +`Landscape` event now carries the walk's active-view count (rides the +record's existing `OutsideViewCount` field — trace mapping compares kind +only, ZERO oracle-fixture churn) and the driver fans exactly that many +terrain slices — `activeTerrainSliceCount` is deleted end to end. Outdoor +roots keep the assembler's single full-screen slice (asserted ==1; +identical content by construction). Suites: hermetic 6,762/0 (4 new +materializer tests pinning the y-flip + plane-sign conventions), Walk +lane 209/1, InstalledDat walk conformance 40/1 — all unchanged or grown. +Remaining desync surfaces deliberately left for the rest of FW4: exit +SEALS + cell slices still assemble from the old per-cell views (identical +dat portal polygons; only the visible SET can differ), and interior-root +look-in seeding still reads the old outside view. + +**FW4 SLICE 2 — the walk-flood seal cutover (2026-08-30, pulled forward +from the FW3 visual gate's cathedral round).** The owner's cathedral +report (waterfall particles shining through from the terrace — toggling +with which side of the #456 seam the CAMERA resolves to) probe-pinned via +the `[walk-part]`/`[walk-alpha]` phase tags: the falls emitters ride the +cell-owners route and submit POST-depth-clear on interior-rooted frames +(retail's own timing — cell-scope alpha drains at the end-of-frame flush +against seal-owned depth), but our seal SET still came from the old +apparatus's flood, which misses exit portals at the #456 seam band (its +never-drawn panel family) — unsealed aperture depth let the end-of-frame +drain z-pass across the whole opening. `DrawWalkExitPortalMasks` now +stamps THE WALK'S OWN ordered interior flood +(`WalkFrameDriver.InteriorFloodCells`, captured at +`OnInteriorFloodDrawTurn` — retail pc:432785-432786's reverse +cell_draw_list), with the old assembly's per-cell slice clips where +present and unclipped seals (benign: exact dat aperture polygon, +z-tested) where the old apparatus had no entry. The legacy !walkActive +path keeps the old seal draw. Suites: hermetic 6,762/0, Walk lane 213/1, +InstalledDat walk conformance 40/1. + +- Entities gate per view via `Render::viewconeCheck` at their cell's walk + turn; dynamics-last and alpha interleave per the walk's stages + (`RetailAlphaQueue` becomes the stream's alpha stage or is absorbed — + decide at implementation with the retail stage list as the arbiter); + particles draw at their owner cell's turn (`ShouldDrawParticles`), + unclipped. +- Re-point the consumers at the walk's visible-cell output: particles + (`ParticleVisibilityController`), lights (`BuildPointLightSnapshot` + filter), EnvCell prepare filter. Directional-shadow caster selection + consumes the same set. +- DELETE in this stage (registry rows updated in the same commits): + look-in seeding + callers + barrier math; punch stencils + (`PortalDepthMaskRenderer` #117); the InViewCells side-channel; + `PortalVisibilityBuilder`'s production role; `RetailPViewRenderer` / + `RetailPViewPassExecutor` shells (their stage knowledge now lives in the + walk); the packed route machinery + `PackedOracle` + both + classification caches; `CellVisibility`'s dead BFS. +- **Gates:** the full re-expressed replay suite; transition checklist; + hermetic suites; the owner visual matrix — cathedral #456 acceptance + (far building, monsters, stalks hidden at the terrace edge at NORMAL + camera; no seam strip; no z-fighting; candle/falls/lake/portal-flood + intact), doorway flap, dungeon wall/floor seams, portal-in, house exit, + teleport timing. + +### FW5 — camera completion + +**Goal:** the camera is retail's, end to end. + +- Port `CameraSet::Farther`/`CameraSet::Raise` verbatim into + `RetailChaseCamera`: the multiplicative offset scaling with the + write-refusal gates (|x|<10, |y|<10, z<450, z>−1.8 — NOT a simple + distance clamp), the preserved-length pitch. The 40 m dev zoom goes + away with it (owner-approved in the spec round). +- Port retail's zoom/pitch adjustment rates if recoverable from decomp + (retires TS-56); if not recoverable, TS-56 stays with a note. +- **Gates:** camera unit tests against ported constants; owner + side-by-side feel gate vs retail (chase, zoom saturation ≈13 m boom, + collision, slope align). + +### FW6 — closeout + +- Divergence-register reconciliation (added: landblock-stage streaming + exposure rows if not already rowed, order-preserving MDI merging as + intentional architecture; retired: lift, #117 stencils, look-in-era + rows, TS-56 if ported). +- Docs: architecture doc render section rewritten around the walk; + `worldbuilder-inventory.md` updated (WB = asset layer only); + `launch-options.md` rows for any probes added/removed (probes die with + their investigations). +- Memory: `project_render_pipeline_digest.md` rewritten current-truth-on-top + around the walk; campaign memory closed out. +- Roadmap + milestones updated; the quarantined PV branch gets a + disposition note (kept as archive; nothing merges). +- Final gates: full hermetic suites, both standard connected routes, + the complete owner visual matrix, merge to main. + +## Rollbacks + +Each stage lands as its own commit series; record `git revert` anchors +here as stages close (the Modern Runtime plan's convention). FW3 and FW4 +are the cutover stages — their revert anchors are mandatory entries. + +## Risks (tracked, from the spec) + +- **Perf** — decided by FW3's checkpoint, numbers over hope. +- **Streaming scope creep** — only the two register-rowed exposure + adaptations may be touched; anything more is out of scope. +- **Oracle fidelity** — traces need owner-assisted retail sessions (FW0); + captured once, checked in. +- **Classifier drift during staging** — FW3's split runs walk statics + beside packed dynamics for one stage; the route contract seam is the + guard, and FW4 deletes the duality. +- **Camera ergonomics** — the dev zoom disappears at FW5; a separate dev + flycam is deliberately deferred (the Fly camera in `CameraController` + already exists for development framing). diff --git a/docs/research/2026-08-30-cathedral-handover.md b/docs/research/2026-08-30-cathedral-handover.md new file mode 100644 index 00000000..29b5ae19 --- /dev/null +++ b/docs/research/2026-08-30-cathedral-handover.md @@ -0,0 +1,173 @@ +# HANDOVER — Campaign FW / cathedral defects (2026-08-30, end of session) + +For the next session taking over. Read this top to bottom, then the +campaign memory (`claude-memory/project_frame_walk_campaign.md`), then the +synthesis (`docs/research/2026-08-30-cathedral-synthesis.md`). + +## Where you are + +- **Worktree:** `C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0` +- **Branch:** `claude/campaign-w-retail-frame-walk` (pushed; NOT merged to main) +- **HEAD at handover:** the commit after `4686a1ac` — `git log --oneline -15` + shows tonight's chain. Suites at HEAD: hermetic App 6,762/0, InstalledDat + walk conformance 40/1, walk lane green. +- **Launch (owner-gated visual checks):** PowerShell, env + `ACDREAM_DAT_DIR="$env:USERPROFILE\Documents\Asheron's Call"`, + `ACDREAM_LIVE=1`, `ACDREAM_TEST_HOST=127.0.0.1`, `ACDREAM_TEST_PORT=9000`, + `ACDREAM_TEST_USER=testaccount`, `ACDREAM_TEST_PASS=testpassword`, probe + `ACDREAM_PROBE_WALK_ROOT=1`, then + `dotnet run --project src\AcDream.App\AcDream.App.csproj --no-build -c Release`. + ALWAYS build first; the owner closes the client for you (never + Stop-Process — graceful-close rules in CLAUDE.md). +- **The defect scene:** cathedral, landblock `0xF418`. Owner telelocs: + terrace `0xF4180104 [31.9 57.3 169.8]`; the seam pair 0x0104↔0x0101 at + y≈72; remote player parked at `0xF4180112 [36.3 18.6 169.8]` (south + hall). The remote player is a second account/client the owner runs. + +## Campaign status (FW stages) + +- FW0–FW3 landed (see the plan `docs/plans/2026-08-30-campaign-fw-frame-walk.md` + status blocks). FW1 residue: foundry F67–79 (probe script + `tools/walk-oracle/fw1-f67-viewpoint-probe.cdb`, needs an owner retail + session). FW4 is ACTIVE and partially executed via tonight's slices. + FW5/FW6 not started. +- The production renderer is still a HYBRID: the walk owns statics, + terrain, sky, seals-set, punch fans, and (as of tonight) static-owner + particle turns; the LEGACY `PortalVisibilityBuilder` still builds + `pvFrame` every frame and feeds per-cell clip slices, the look-in + frames + look-in dynamics, the DynamicLast per-cell viewcone, and the + outside-dynamics slice loop. FW4's goal is deleting that duality — the + through-wall defect below is a direct consequence of it. + +## Tonight's ledger (chronological, all pushed) + +USER-VERIFIED WINS: +1. **Cathedral falls bleed FIXED** (`280c0549`) — the #132 positional + invariant ported walk-natively: `WalkFrameEventKind.StaticParticles` + submits each landscape cell's / building shell's emitter owners AT ITS + WALK TURN; the batched pre-clear submission is deleted. Mechanism + credit: the OWNER's pointer to the old pipeline's `e102fb36` fix. +2. **Indoor/seam rain FIXED** (`75eab42f`) — retail gates the weather pass + on `SmartBox::is_player_outside` @0x00451e80 (Ghidra: + `(player objcell & 0xFFFF) < 0x100`); one boolean at the executor's + weather site. GameSky draws at DEPTHTEST_ALWAYS (pc 0x00507063) — the + depth-disabled weather port was correct. +3. **In-cathedral torch regression FIXED** by reverting slices 4+5 + (`7f500b97`). +4. Earlier same-day: FW4 slices 1/2/3/6 (`37febd1f`,`c40aecfc`,`5f7ccdea`, + `bb9212c7`) — kept per the tri-review verdicts, with reworks listed in + the synthesis. + +THE REVIEW CORPUS (read before ANY new cathedral theory): +`docs/research/2026-08-30-cathedral-review-{prompt,fable,opus,audit, +datformat,datgeometry,decomp}.md` + `2026-08-30-cathedral-synthesis.md`. +The decomp report is the retail frame SSOT (one-frame seal latch; TWO +PViews; FIFO no-sort alpha lists; full 0f DrawBuilding flush; +ShouldDrawParticles update-time; CEnvCell::IsInView = constant +PARTIALLY_INSIDE). The DAT-geometry report is the F418 ground truth +(falls = landblock stabs 0xCF418000-13; exits are FULL-SIZE, no "thin +bands"; the seam = COINCIDENT double exit-to-outside planes at y=48 and +the 0x104/0x101 boundary at y=72). + +## THE OPEN DEFECT — through-wall remote player (NOT FIXED) + +**Symptom:** a remote player parented at `0xF4180112` renders through +opaque walls when the observer stands in `0xF4180101` AND from outdoors. +From `0xF4180104` he is correctly hidden. Retail never shows him (no +sightline chain exists through the complex). Owner-reported ~21:46; two +fix attempts tonight; still visible after both. + +**Attempt 1 (context):** slice 3 (`5f7ccdea`) had already moved the +outside-stage predicate's flood to walk VisitedCells — related plumbing, +not aimed at this. + +**Attempt 2 (the [dyn-route] trace + the root-flood gate — latest +commit):** the trace (`[dyn-route]` lines, probe `ACDREAM_PROBE_WALK_ROOT`) +proved: the LEGACY builder manufactures REAL 3–5-plane cell views for +0x112 from sightline-less roots (`vis=1 cone=3+4 / 3+5` — NOT the +zero-plane pass-all trapdoor), and routing flip-flops between +`lookin-excluded` and DynamicLast as the observer moves. Fix shipped: +`RenderScenePViewBuildInput.RootFloodCells` (the walk's +`InteriorFloodCells` as a set) — an interior-parented dynamic rides +DynamicLast ONLY if its parent is in the walk's own root flood; non-walk +frames fall back to the legacy drawableCells meaning +(`BuildAndCompare` default likewise). Verified working in the post-fix +log: every 0x112 dynamic now logs `rootflood-excluded`. + +**AND THE PLAYER STILL RENDERS.** Post-fix log +(`%LOCALAPPDATA%\Temp\fw4-rootflood-gate.log`): 0x112 dynamics show BOTH +`rootflood-excluded` AND `lookin-excluded` states — meaning the remaining +draw path is the **LookInObject route**: `DrawBuildingLookInDynamics` +(RetailPViewRenderer, runs inside `DrawLandscapeDynamicsPhase`, which for +interior roots runs in the pre-clear closure) draws look-in-cell dynamics +from the OLD apparatus's look-in frames (`_lookInFrames`, built by +`BuildInteriorRootLookIns` / `MergeNearbyBuildingFloods`) — **the very +frames whose invented visibility the trace exposed**. Two doors let him +through; only DynamicLast was closed. + +**Leading hypothesis for the next session (UNVERIFIED — trace first):** +the old look-in machinery not only draws him with invented clip regions, +it also PUNCHES far-Z apertures for its invented frames +(`DrawLookInPortalPunch`, forceFarZ) — erasing true wall depth exactly +where the invented aperture sits, so the pre-clear-drawn player passes +depth there. Check also whether look-in DYNAMICS draw before/after wall +shells and with which clip slots. + +**The retail-shaped fix direction (synthesis steps 4+7 completed +properly):** look-in dynamics must be keyed to THE WALK's look-in cells +(the walk's `VisitedCells − InteriorFloodCells` per frame, or better: a +per-look-in walk turn like `StaticParticles`), and the old apparatus's +look-in frames/punches must lose their production role (FW4's deletion +list). An interim honest gate: `DrawBuildingLookInDynamics` skips cells +the WALK did not visit as look-ins this frame — that alone should kill +the invented-frame draws while keeping legitimate look-ins. Do NOT +band-aid at the symptom (no-workarounds rule); the trace must first +confirm the punch/route hypothesis: extend `[dyn-route]`-style logging +into `DrawBuildingLookInDynamics` (which cells, which frames, whether +0x112 appears, and whether look-in punches fire for it). + +## Also open (diagnosed, unfixed, in priority order after the above) + +1. **The stalks** — dark shapes at the east cliff = DRAWN never-drawn + marker anchors (GfxObj 0x010001EC, DIDDegrade 0x1100002E). The retail + degrade-admission port exists as `fce250ec` on the QUARANTINED branch + `claude/cathedral-rendering-debug-47a417` — NOT an ancestor of this + branch. Re-land it (synthesis step 10). +2. FW1 foundry F67–79 residue (needs an owner retail cdb session). +3. Remaining synthesis Phase II items: seals from walk views (step 6), + full-flush DrawBuilding barrier + FIFO no-sort alpha queue (step 8), + terrain in_view culling for interior roots (step 9 — slice 6 currently + uses the full camera frustum), then FW4's deletions, FW5 camera, FW6. +4. Walk-path alloc tail ~1.5 MB/frame (FW6 hygiene). + +## Instrumentation available (all under ACDREAM_PROBE_WALK_ROOT=1) + +`[walk-root]` (continuous rooting: root flood vs visited split, walk ov), +`[walk-cam]` (replayable cameras), `[walk-portal]` (per-portal side/clip), +`[walk-part]`/`[walk-alpha]` (submission routes + drains with pre/post +phase tags), `[walk-dyn]` (outside-stage verdicts), `[dyn-route]` +(DynamicLast admission, on-change), `[falls]`/`[falls-adm]` (falls owner +watch 0xCF418000-13 + admission). Documented in `docs/launch-options.md`. +RenderDoc 1.45 is at `%LOCALAPPDATA%\Programs\RenderDoc_1.45_64\` +(key-triggered capture does NOT work over this RDP session — use the +target-control python API to trigger, or the in-app overlay locally; an +old acdream capture exists at `%LOCALAPPDATA%\Temp\RenderDoc\`). + +## Binding rules for the successor (hard-learned tonight) + +1. **Never identify render content from aggregate owner sets** — trace + ids to the DAT (`0x4…`=interior allocator, `0xC…`=landblock statics, + `0x8…`=scenery, raw=server entities). +2. **Phase-level probes cannot see position-within-phase** — order inside + a stage is its own dimension. +3. **The owner's old-pipeline fix history is an oracle** — check + `e102fb36`-era work (`C:\Users\erikn\.codex\worktrees\16ee\acdream`, + `docs/research/2026-08-29-cathedral-seam-progress.md`) before + re-deriving. +4. **Ghidra arbitration is mandatory for BN branch senses** (multiple + misreads; MCP on port 8081, patchmem.gpr must be open). +5. The oracle traces (`docs/research/2026-08-30-fw-walk-oracle/`, + `posed/` = the fixture set) are frame truth; `posed/terrace-center` = + DI f4180104, flood n=1, ov=1. +6. One fix at a time, trace-pinned first, owner-gated after — six blind + rounds preceded tonight's three verified fixes. diff --git a/docs/research/2026-08-30-cathedral-review-audit.md b/docs/research/2026-08-30-cathedral-review-audit.md new file mode 100644 index 00000000..47af0286 --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-audit.md @@ -0,0 +1,157 @@ +# Cathedral review — code + probe-log audit (companion report) + +Delivered 2026-08-30 by the code/log audit agent (separate from the +fable/opus mechanism reviews; this one audited the six commits, the exact +HEAD frame flow, and every `fw3-*`/`fw4-*` probe log of the day). The full +text below is verbatim from the agent's report. + +## Executive synthesis + +1. All six FW4 slices behave as written on frames where the walk yields + exit views — the post-slice-6 log shows the falls emitting pre-clear + and draining over full-screen terrain depth on those frames. +2. Two defect mechanisms visible in the FINAL log are untouched by all + six commits: + - **Anomaly 1 — `ov==0` frames:** 66 of 26,601 interior frames at the + terrace produced ZERO walk exit views → `RetailFrameWalk.DrawInside` + skips `DrawLandscape` entirely → no terrain color, no terrain depth, + no sky that frame. Everything drawn that frame (pre-clear alpha + included — 17 frames had the falls straddler set drain against an + EMPTY depth buffer) composites over stale color. These are the seam + frames. Slices 1–5 fixed staging; slice 6 fixed clipping WHEN the + landscape turn runs; nothing addressed the no-views case. + - **Anomaly 2 — cell `0xF418010D` never floods:** the connecting + portal from `f418010c` classifies `inview=1` (a FACING SURFACE, not + an armed opening) at the terrace viewpoint (`[walk-portal] init + cell=f418010c i=1 dest=f418010d d=-23..-50 pside=0 inview=1`), so + the walk never traverses into it: never sealed, always fails the + outside-stage flood gate (`outside=0` in every sampled `[walk-dyn]` + line since the probe existed), and its r≈10 m weenies (the STALKS: + f428a/f428b etc.) ride DynamicLast — post-clear meshes that z-pass + over every vista pixel no seal covers, on EVERY interior frame. +3. Combined with the fable review's oracle-trace finding (retail has ZERO + interior-rooted frames at the terrace — `terrace-center.log` and + `terrace-edge.log` contain no `DI` lines at all; the whole cathedral + arrives as `ov=0 n=1` building look-ins under an OUTDOOR root), the + remaining user-visible defects reduce to: + - ROOT DIVERGENCE A: our camera-cell resolution roots INTERIOR at the + terrace where retail roots OUTDOOR. An outdoor root has no clear, no + seals, no ov==0 case — the entire problem class does not exist in + retail's frame shape at these poses. + - ROOT DIVERGENCE B: the walk's portal side classification at + `f418010c → f418010d` (facing-surface vs opening — `PortalSide` vs + the sign of `d`, `WalkPView.cs:103-120`) — the same family as the + FW1 foundry F67–79 residue. +4. UNVERIFIED (flagged, not papered over): whether the old apparatus's + flood contains f418010d (needed for the stalk meshes' DynamicLast + viewcone admission); the exact dat portal/panel geometry behind the 66 + `ov==0` frames; the color-attachment load behavior behind slice 6's + "stale color" claim. + +## Full audit text + +### PART 1 — The six same-day commits (times: 18:21 / 19:22 / 19:28 / 19:37 / 19:58 / 20:06) + +- `37febd1f` slice 1: interior outside-view slices from the walk + (`ClipFrameAssembler.ReassembleOutsideViewFromWalk`; PrepareClipFrame + moved below the walk block; Landscape event carries ViewCount; the + per-view TerrainSlice fan; `activeTerrainSliceCount` deleted; + `ACDREAM_PROBE_WALK_ROOT` added). 4 new materializer tests. +- `c40aecfc` slice 2: exit seals stamp the walk's own flood + (`WalkFrameDriver.InteriorFloodCells`; `DrawWalkExitPortalMasks` — the + walk decides WHICH cells seal, the OLD assembly still decides the + per-cell CLIP, unclipped fallback). Phase-tag probe apparatus added. + No test changes. +- `5f7ccdea` slice 3: `outsideStageFlood = walkDriver.VisitedCells` + passed to BOTH `DynamicDrawsInOutsideStage` call sites (renderer + + frame product). `[walk-dyn]` probe. No test changes. +- `f3a03efc` slice 4: interior roots keep outside-stage owners + (straddlers included) in the pre-clear union, record them in + `_preClearParticleOwnerScratch`, both DrawDynamicsLast arms subtract. + Outdoor keeps ExceptRoute(DynamicLast). No test changes. +- `0d6cd5c0` slice 5: the falls re-identified as EnvCell stab statics; + `SphereStraddlesExitPlane` extracted; straddling flood-cell statics' + owners submit pre-clear, post-replay cell union subtracts. + `[walk-emit]`/`[walk-portal]` probes. No test changes. +- `bb9212c7` slice 6: one TerrainSlice(0) fan; interior roots draw + terrain+sky UNCLIPPED (view-culled only); outdoor keeps the sliced + path. Latent: the bounds check at `WalkLeaf.cs:81-86` still throws if + the reassembly yields 0 slices while a Landscape turn fired. No test + changes. + +Test posture: slice 1 shipped tests; slices 2–6 shipped zero test +changes (probe + production only). + +### PART 2 — HEAD frame flow for an interior-rooted production frame + +Setup: BeginFrame (phase:=pre) → OLD PortalVisibilityBuilder.Build → +BuildInteriorRootLookIns (old apparatus) → AssembleClipFrame + +AppendLookInClipFrames (old per-cell slices) → walk Collect (no GPU; +flood → optional Landscape turn iff `OutsideView.ViewCount > 0` → +building turns → OnInteriorFloodDrawTurn: Clear/Seals events + +InteriorFloodCells + flood cell turns) → ReassembleOutsideViewFromWalk → +the ONE PrepareClipFrame → prepareCells = old ∪ look-in ∪ walk → +ViewconeCuller.Build (outside planes = walk-derived; per-cell planes = +OLD) → BuildAndBorrow with outsideStageFlood = walk VisitedCells → +routes: LookInObject (old-assembly slices), LandscapeOutsideDynamic +(walk slices + cone), DynamicLast (indoor dynamics; viewcone from OLD +per-cell planes — a cell with NO plane set returns false). + +Replay (pre-clear only when a Landscape turn recorded): Sky (unclipped, +interior) → TerrainSlice(0) (unclipped, depth write ON) → interleaved +static/building/look-in mesh ranges + AlphaBarrier partial drains + +punch fans (stencil far-Z, clipped by the walk view pinned at emission) +→ ClearInteriorDepth event → closure: [static-owner particles + +slice-5 straddler statics + DrawLandscapeDynamicsPhase (EARLY-OUTS +ENTIRELY if OutsideViewSlices.Length == 0) ] → FlushLandscapeAlpha (the +pre-clear drain, full far→near over true landscape depth) → +ClearInteriorDepth (depth aspect only, color preserved; phase:=post) → +ExitSeals (walk InteriorFloodCells × old-assembly clips; TRUE depth, +ALWAYS+write, no color; cells not in the walk flood never seal) → +flood CellShell + statics (the interior repaint). + +Post-replay: cell-owner particles (walk flood minus look-ins minus +straddlers; post, deferred) → DrawDynamicsLast (post-clear meshes, +old-plane viewcone; particles minus pre-set) → unattached-interior → +MarkVisibleCells(old ∪ look-in ∪ walk) → final alpha EndFrame drain +(far→near, depth LESS/no write vs clear+seal+repaint depth) → +ParticleVisibilityController admission = the union of both apparatuses. + +Structural observations: the walk decides the seal CELL SET, the OLD +assembly still decides seal clips, look-in slices, and the DynamicLast +per-cell viewcone; the walk's thin exit views still gate all dynamics +staging; if ViewCount == 0 no Landscape turn fires at all while clear + +seals + repaint still run. + +### PART 3 — Probe-log findings + +Log-era map: `fw3-walk-root-probe.log` 18:09 = pre-slice-1 AND NOT the +cathedral (all roots 0xA9B4… — the stairwell investigation); +`fw3-falls-probe.log` 19:23 ≈ slice-2; `fw4-seal-gate` 19:27; +`fw4-slice3-gate` 19:32; `fw4-slice4-gate` 19:44; `fw4-portal-probe` +19:50 (slice-4 + uncommitted slice-5 probes); `fw4-slice5-gate` ≈19:59; +`fw4-slice6-gate` 20:23 = the ONLY post-slice-6 run. + +- The falls emitters are `4f418012..15` + `f4180106` (InteriorEntityId- + Allocator statics of cell 0xF4180106), riding a per-look-in-cell + `DrawCellParticles` union; `viewer=0xF4180106` appears in ZERO + [walk-root] lines (the 8-frame post-flip sampler never caught it). +- Post-slice-6 frames WITH exit views: falls pre-clear, no + cell-owners/dyn-owners post — the staging repairs work as written. +- ANOMALY 1: 66/26,601 interior frames with NO landscape turn (no + SkyPreScene, no outdoor static-owners, no unattached-outdoor) — the + ov==0 shape; all 66 carry `dyn-owners n=2 ids=[f4243,f4287] + phase=post`, and 17 carry a pre-clear falls drain against EMPTY depth. +- ANOMALY 2: cell f418010d in ZERO walkCells lists across all 7 + cathedral logs; `init cell=f418010c i=1 dest=f418010d d=-23..-50 + pside=0 inview=1`; its dynamics f428a/f428b always `outside=0`; their + particles appear in NO dyn-owners set — the visible stalks are the + MESHES, drawn post-clear. +- ANOMALY 3: 17 seam FLIPs at nearly identical eye positions + (interior 0xF4180104 eye=(31.09,61.34,172.05) vs outdoor 0xF418000B + eye=(30.90,63.04,172.05)). +- ANOMALY 4: `[walk-emit]` empty in ALL logs — the interior-unattached + route carried no emitters (the falls are attached statics). +- ANOMALY 5: the surviving exit views are thin (n=4 clips on portals + j=1/2/4; j=0 often n=0) — consistent with the authored polys being + narrow bands. diff --git a/docs/research/2026-08-30-cathedral-review-datformat.md b/docs/research/2026-08-30-cathedral-review-datformat.md new file mode 100644 index 00000000..7290fcdd --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-datformat.md @@ -0,0 +1,93 @@ +# Cathedral review — DAT-format facts (companion report) + +Delivered 2026-08-30 by the DAT-format verification agent (decompiled the +actual `Chorizite.DatReaderWriter 2.1.7` NuGet binary with ilspycmd and +cross-checked against `docs/research/named-retail/acclient.h`). Key facts +for the cathedral synthesis; flagged caveats preserved. + +## Sourcing caveats + +- Our DAT parser is the CONSUMED NuGet `Chorizite.DatReaderWriter 2.1.7` + (no vendored source; facts below come from decompiling the exact linked + DLL). +- `references/WorldBuilder` is an uninitialized submodule in THIS worktree + (read from the main worktree at a different SHA — flagged). +- `references/ACViewer` does not exist in either worktree (claims about + ACViewer: UNVERIFIED). + +## EnvCell record (read order, decompiled Unpack) + +Flags (int) → self-Id (uint, duplicate) → NumSurfaces (byte) → NumPortals +(byte) → NumVisibleCells (ushort) → Surfaces[]（ushort) → EnvironmentId +(ushort) → CellStructure (ushort) → Position (Frame) → CellPortals[] → +VisibleCells[] (ushort) → [HasStaticObjs 0x2] StaticObjects (count + +Stab{Id,Frame}[]) → [HasRestrictionObj 0x8] RestrictionObj. + +`EnvCellFlags`: SeenOutside=0x1, HasStaticObjs=0x2, HasRestrictionObj=0x8. +**0x4 is unclaimed.** + +Retail cross-check: `CEnvCell : CObjCell` (acclient.h:32072-32091) maps +1:1; retail's `stab_list` lives on the BASE `CObjCell` +(acclient.h:30914-30932) and is the **PVS list of CELL IDS** — NOT placed +objects. The DatReaderWriter `Stab{Id,Frame}` placed-object struct is a +coincidental homonym (zero matches for `Stab` in the named-retail header). + +## CellPortal / BuildingPortal + +`CellPortal { PortalFlags Flags; ushort PolygonId; ushort OtherCellId; +ushort OtherPortalId; }` — `PortalFlags: ExactMatch=1, PortalSide=2`. +**No 0x4 member anywhere** (package, our code, WorldBuilder, and retail's +own `CCellPortal` decode exactly two semantic fields: portal_side, +exact_match). NOTE: this contradicts the earlier campaign note +"CCellPortal DAT flag 0x4 = leads outside" — the outside link is the +`OtherCellId == 0xFFFF` sentinel, not a flag bit. + +- ExactMatch consumers: `PortalVisibilityBuilder.cs:1168-1183` (skips + reciprocal clip — decomp:433689), Walk factories + (`WalkBuildingFactory.cs:76`, `WalkCellFactory.cs:94`). +- PortalSide convention: `(Flags & 0x2) == 0 → normal points INTO the + owning cell` (`CellPortal.cs:23-24`, `PortalInfo.cs:22-44`); + `WalkCellFactory.cs:93`: `PortalSide = (Flags & 0x2) != 0 ? 0 : 1`. +- `OtherCellId == 0xFFFF` = the outdoor-exit sentinel (18+ consumers); + the walk world remaps it to `0xFFFFFFFFu`. + +`BuildingPortal` (BuildingInfo.Portals) is a DISTINCT dat type — carries +its own **packed StabList of cell ids** (retail `CBldPortal` with +num_stabs/stab_list + `sidedness`). The walk's `WalkBuildingFactory.cs:81` +reads it directly; the older `Wb.BuildingLoader` path DISCARDS it and +recomputes by BFS. + +## LandBlockInfo + +`NumCells → Objects[Stab] → Buildings[BuildingInfo{ModelId, Frame, +NumLeaves, Portals[BuildingPortal]}] → [flag] RestrictionTable`. +Confirmed field-for-field; consumer `LandblockLoader.cs:69-103`. + +## Water / waterfall (part d) + +- `LandDefs::WaterType` is COMPUTED client-side from terrain paint (types + 0x10-0x14 WaterRunning..WaterDeepSea); AcDream already computes it for + physics (`TerrainSurface.cs:92-128`). It is NOT packed in the records. +- `SurfaceTexture.Textures` is a multi-frame list (the structural shape of + a flip-book animation) but EVERY consumer in both repos freezes one + fixed index (`Textures[0]`, WB `[^1]`) — **no water/texture animation is + implemented anywhere**; whether retail animates via this list is + UNVERIFIED. +- Which object IS "the waterfall" near the cathedral: UNVERIFIED from + source — two old bug comments treat it as OUTDOOR landscape-alpha + content (`PortalVisibilityBuilder.cs:730-736`, + `RetailPViewRenderer.cs:714-726`), consistent with a translucent stab — + but note the live probes identified the terrace falls PARTICLE owners as + EnvCell StaticObjects of cell 0xF4180106 (ids 4f418012-15), which is + the `HasStaticObjs` list above; both can be true (mesh stab outdoors + + emitter stabs in cells). + +## Notable corrections this report makes to campaign lore + +1. "DAT flag 0x4 = leads outside" (PV campaign memory) — REFUTED: no 0x4 + exists; outside = OtherCellId 0xFFFF. +2. "stab list" ambiguity — retail stab_list = PVS cell ids on CObjCell; + placed objects are a different structure; docs/comments conflating the + two should be read carefully. +3. Building portals carry authored per-portal cell StabLists in the dat — + the old Wb path recomputes what the dat already provides. diff --git a/docs/research/2026-08-30-cathedral-review-datgeometry.md b/docs/research/2026-08-30-cathedral-review-datgeometry.md new file mode 100644 index 00000000..56b63c4f --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-datgeometry.md @@ -0,0 +1,111 @@ +# Cathedral review — F418 authored DAT geometry (companion report) + +Delivered 2026-08-30 by the DAT-geometry agent: fresh byte-exact parsers +over the installed `client_cell_1.dat`/`client_portal.dat` (every record +parsed with 0 bytes left over). Ground truth for the synthesis. Condensed; +citations and caveats preserved from the agent's full text. + +## The landblock (LandblockInfo 0xF418FFFE) + +24 EnvCells (0xF4180100–0x0117), 88 objects, 9 buildings. The cathedral +complex is authored in the BUILDINGS list: 0x01001FB0 (north hall, cells +0x100–0x102), 0x01001FB2 (the 0x103–0x105 colonnade block), 0x01001FB3 +(the main cathedral, cells 0x106–0x111, 13 building portals), 0x01001FB7 +(south hall 0x112–0x115), 0x01001FD3 (sealed annex 0x116–0x117), plus +four portal-less shells. + +## THE FALLS — identity corrected (slices 4/5 chased the wrong owners) + +The waterfall emitters are **LANDBLOCK OBJECT-LIST STABS** (outdoor), not +EnvCell statics and not weenies: +- Objects[0..6]: Setup **0x0200085A** ×7 — EAST falls jets (x≈169–170, + z=158.6), script 0x330008A6 → emitter 0x320004A4 (v=22.5 m/s jets). +- Objects[7..13]: Setup **0x02000859** ×7 — NORTH falls jets (y≈120.8), + script 0x330008A5 → emitters 0x320004A3/A2 (arc + plunge, accel −40). +- Objects[14..19]: Setup **0x020003C5** ×6 — lake-base mist at z=99.9 + (incl. an authored exact-duplicate pair). +Their runtime ids live in the **0xC namespace** +(`LandblockStaticEntityIdAllocator`): east 0xCF418000–06, north +0xCF418007–0D, mist 0xCF41800E–13. + +**The probe-observed `0x4F418012–15` owners are NOT the falls** — the 0x4 +namespace is `InteriorEntityIdAllocator`; simulating the hydration filter +maps them to cell 0xF4180106's OWN stabs: **two 0x020005C1 TORCHES** +(flame emitters 0x320003AB/0x320003A5), one bare prop (0x01000DF0), one +plant (0x020007A3). Slice 5's "the falls are EnvCell stab statics" was a +misidentification; the `cell-owners n=5` submissions were the torches. + +The falls billboards' degrade tables keep them visible to **392 m** — +they are authored to be seen across the whole vista. + +## THE "STALKS" — premise corrected + +Setup 0x0200085A (the PV campaign's "monster stalks") is **not a visible +stalk**: its sole part GfxObj 0x010001EC is retail's runtime-hidden +marker (GfxObj flags 0xA; DIDDegrade 0x1100002E = never drawn at any +distance), shared as the invisible anchor by 13 of this landblock's +setups (falls jets, torch/sound anchors). The visible dark shapes at the +east cliff are these anchors DRAWN — i.e., a never-drawn-degrade skip +missing on the path that renders them (the marker-degrade port fce250ec +is stranded on the quarantined PV branch per the audit report). Cell +0xF418010D (the audit's stalk suspect) is actually a fully-interior +undercroft/crypt with 81 candle-prop stabs and NO exit portals — its +non-flooding is CORRECT behavior, not the stalk mechanism. + +## EXIT-PORTAL GEOMETRY — the "thin seam bands" claim REFUTED + +All exit portals at the defect cells are FULL-SIZE authored openings with +sills at the cell floor (z=169.80): +- 0xF4180104: four exits — two 10.72 × 10.20 m facade trapezoids (y=48 + south, y=72 north) and two 24.0 × 9.2 m side ARCHES (x≈31 west, x≈41 + east; the 0.57 m X-thickness in an AABB is just the arch bow, the polys + stand in the Y-Z plane). One interior ceiling portal → 0x105. +- 0xF4180106: one 10.72 × 10.20 m exit (y=48 north) + two 1.67 × 5.89 m + door arches (→0x10F, →0x110). + +Slice 6's "authored polys are thin bands far narrower than the real +opening" is therefore WRONG about the authoring — if the walk's exit +views come out thin or empty (the ov==0 frames), the loss happens in OUR +clipping/traversal, not in the dat. + +**Two real seam facts to carry instead:** +1. **0x104's south exit poly and 0x106's north exit poly are COINCIDENT** + — the same 10.72 × 10.20 m rectangle in the same y=48 plane (buildings + 01001FB2 and 01001FB3 abut), EACH marked exit-to-outside (0xFFFF) + rather than cell-to-cell. This shared double-exit plane at y=48 is + "the seam". +2. The openings' sills sit ~9.8 m above the outdoor terrace (floor 169.8 + vs terrain 160): the lake (z≈100) only becomes visible within ~2–3 m + of an opening — the downward vista is sill-clipped by geometry, not by + portal truncation. + +## Portal flags (from all 24 cells) + +Bit 0x1=ExactMatch, 0x2=PortalSide, and **0x4 co-occurs always and only +with other_cell==0xFFFF** (observed flags 0x5/0x7 on exits) — so the old +"flag 0x4 = leads outside" lore is observationally right as a CORRELATE +in this landblock even though the DatReaderWriter enum doesn't name it +(the datformat report found no 0x4 member; semantic asserted from perfect +correlation, not decomp). + +## Water + +The lake/falls SURFACES are outdoor TERRAIN paint: WaterShallowSea +(type 18) in the north basin (z 96–108) and terrace water court (z=160), +FauxWaterRunning (type 22) on the cliff faces. No water objects besides +the six mist emitters. + +## Cell 0xF4180104 / 0x0106 contents + +- 0x104: 16 stabs — plants + FOUR looping ambient-SOUND anchors + (0x0200093D/3E/3F/09AF — how the falls' roar is heard indoors; no + particles) + prop. +- 0x106: 5 stabs — the two torches, sound marker, prop, plant. +- 0x105: a ceiling-linked upper cell (horizontal portals only). + +## Caveats (the agent's own) + +The 0x4F418012–15 mapping mirrors `LandblockBuildFactory`'s hydration +filter in Python (high confidence, not executed C#); flag-0x4 semantics +asserted from correlation; terrain-name indices aligned against ACE's +LandDefs enum. diff --git a/docs/research/2026-08-30-cathedral-review-decomp.md b/docs/research/2026-08-30-cathedral-review-decomp.md new file mode 100644 index 00000000..a7c53c19 --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-decomp.md @@ -0,0 +1,141 @@ +# Cathedral review — retail interior-root frame reconstruction (companion report) + +Delivered 2026-08-30 by the decomp-reconstruction agent (BN pseudo-C + +live Ghidra arbitration on 8081 + acclient.h + symbols.json). THE retail +mechanism reference for the synthesis. Condensed; all pc:/address +citations preserved. + +## Frame skeleton (interior root) + +1. `SceneTool::BeginScene` @0x0043dad0: **full Clear(7) — COLOR+depth+ + stencil — every frame** (pc:68673-68686). `Flip` bumps m_nFrameStamp + at frame end (pc:428642). +2. `RenderNormalMode` @0x00453aa0: interior camera → optional + LScape::update_viewpoint (only when viewer_cell->seen_outside, + pc:92667-71) → DrawInside(viewer_cell) → **unconditional final drain + FlushAlphaList(0f)** (pc:92687). +3. TWO PView singletons (pc:427800/427813): `indoor_pview` (draw_landscape + =1) for the root; `outdoor_pview` (0) for building look-ins — look-in + floods can never re-trigger landscape/clear/seals (their + outside_view.view_count is always 0; ClipPortals never raises it when + draw_landscape=0, pc:433666-84). +4. `PView::DrawInside` @0x005a5860: push root view (full viewport) → + `ConstructView(root, 0xffff)` — PURE CPU flood, draws nothing; exit + portals merge clipped apertures into outside_view (pc:433662-76, + cliplandscape=1 @0x00820f4c). + +## PView::DrawCells @0x005a4840 — ALL of this inside `ov > 0` (pc:432715): + +1. `Render::PortalList = &outside_view`; `LScape::draw` (pc:432718-19). +2. **Full outdoor alpha drain** FlushAlphaList(0f) (pc:432720). +3. `m_nFrameStamp += 1` (pc:432722) — re-arms part dedupe so a part can + draw in BOTH the outdoor and interior passes of one frame (straddlers + draw twice; "emit once" is anti-retail). +4. **Gated z-only clear** (pc:432725-32, Ghidra-verified): + `forceClear(const 0) || portalsDrawnCount != 0` — the counter is + incremented ONLY by own-depth portal stamps (seals, arg2==0, + pc:424569-70) → **a ONE-FRAME LATCH: last frame's seals arm this + frame's clear.** Steady-state vista frames clear every frame; the + FIRST such frame does not. +5. **Exit seals** (pc:432737-807): per flooded cell (far→near), per view, + EVERY portal with other_cell 0xffffffff: + `DrawPortalPolyInternal(poly, 0)` — REAL projected depth, + DEPTHTEST_ALWAYS + z-write ON (pc:424584), invisible (vertex alpha 0, + pc:424686), CULL_NONE, CPU-clipped to the current view (pc:424577). + (Sibling mode arg2==1 = the far-Z PUNCH z≈0.999999, look-ins only; + does not increment the counter.) + +Then UNCONDITIONALLY (even when ov==0): +6. Lighting restore (pc:432811-12). +7. **Cell shells** far→near: DrawEnvCell dedupes per frame stamp — the + shell draws ONCE, WHOLE; the per-view loop is vestigial for it; no + view planes applied; correctness = pure z-test (pc:427885-88). +8. **Cell objects** far→near: PortalList = the cell's views → + DrawObjCellForDummies → shadow parts sorted by CYpt (viewer distance + to scaled sort_center, insertion_sort @pc:701156-75) → + CPhysicsPart::Draw — statics, dynamics, AND particle-emitter parts + through ONE machinery. +9. Final drain (pc:92687) vs interior depth + seal-stamped apertures. + +## Clip vs cull (the definitive table) + +- CPU polygon-clipped: ONLY portal-chain polys during the flood + (GetClip @0x005a4320) and seal/punch fans at draw (their own + polyClipFinish vs the current view, pc:424577, + a ±12 local-XY trivial + reject pc:424506-50). +- Sphere-vs-view CULLED, whole-drawn: all meshes (statics, dynamics, + particles' parts) — DrawMesh per view: viewconeCheck(sphere) + (pc:429295-96); PARTIAL draws WHOLE under that view; a mesh in N views + submits N times. Building PORTAL pass is cone-exempt (punches always + attempted; GetClip <3 points is the real stop, pc:429302-10). +- Cached-flag culled: terrain cells via in_view stamped by + draw_check_blocks @0x00505f80 iterating EVERY view of PortalList + (blocks wholly outside every exit view skip at pc:267936). Terrain + polys then draw whole + immediate (landPolysDraw @0x006b7040 — no view + clip, no alpha list). +- No test at all: EnvCell shell geometry; seal z-behavior (ALWAYS). +- `alwaysDrawObjects = 1` (@0x00820ed4): DrawSortCell runs for EVERY cell + of a drawn block — the per-part per-view cone check is the real object + gate (no pixel leak, just CPU). + +## The alpha lists (retail) + +TWO static FIFO lists, 3000 entries each (Clip @0x00871b10, Alpha +@0x008af370). NO depth key stored, NO sort at flush — order = submission +order; far-to-near correctness comes from the cell walk + per-cell CYpt +insertion sort. Overflow DROPS the subset (pc:424983). Entry routing: +s_AlphaDelayMask (default 0xE) vs the surface mask; bit3 → Clip list. + +Flush sites (grep-complete): +| # | Site | Arg | Depth in place | +|---|------|-----|----------------| +| 1 | DrawBuilding @0x0059f30b | 0f FULL | outdoor-so-far (pre-punch) | +| 2 | DrawBlock @0x005a1a07 | 0.75 valve, fires per outdoor cell (BN's `flush>1` guard is a MISREAD — Ghidra: fires when flush<=1.0) | mid-landscape | +| 3 | DrawCells @0x005a4872 | 0f FULL | complete outdoor depth (pre-clear) | +| 4 | RenderNormalMode @0x00453b8b | 0f FULL (final) | interior + seals | +| 5 | CreatureMode::Render (chargen only) | 0f | its own viewport | + +## Depth at final drain (interior root) + +- Aperture/vista pixels: the SEAL's portal-plane depth (outdoor per-pixel + depth NO LONGER EXISTS — cleared; outdoor COLOR survives under the + stamp). Interior alpha fragments behind the portal plane FAIL there. +- Outdoor particles (falls): drawn in the landscape pass, drained at + site #3 vs outdoor depth. Cone-PARTIAL spill outside the aperture is + buried because EVERY interior pixel paints after every outdoor drain + point — protection is pure ORDERING, not depth. + +## ShouldDrawParticles @0x0050fe60 — an UPDATE-time gate + +Called per emitter from ParticleEmitter::UpdateParticles (physics-side), +NOT during rendering: `ExaminationObject → 1; CYpt > degrade_distance → +0; cell NULL → 0; cell->IsInView()==0 → 0`. On false: SetNoDraw(1), +degraded_out=1 (particles stop updating AND drawing). +- CLandCell::IsInView @0x00532cb0 = the PREVIOUS frame's stamped in_view + (one-frame-stale gate). +- **CEnvCell does NOT override it** — the slot resolves to the ICF-folded + constant @0x005269f0 `return 1` (PARTIALLY_INSIDE, PDB-verified): for + interior emitters the cell test is VACUOUS; distance is the only + update-time gate; their draw is flood-gated instead. + +## Can content outside the flood/exit views draw? NO. + +Interior: pure flood membership. Outdoor blocks/cells: in_view under ≥1 +exit view. Outdoor parts: per-exit-view sphere-cone in DrawMesh. Building +portal pass cone-exempt but clip-stopped. No distance bypass exists. + +## Corrections to campaign docs + +1. DrawBlock per-cell flush polarity RESOLVED (fires; 0.75 pressure + valve) — BN misread. +2. The m_nFrameStamp bump separates the landscape and interior passes of + ONE interior-root frame; look-ins NEVER bump (outdoor_pview ov==0). +3. NEW: CEnvCell::IsInView = constant PARTIALLY_INSIDE (ICF fold, + symbols.json 19-name cluster) — not in any FW doc. + +## UNVERIFIED (the agent's own list) + +The 0xF418 falls emitters' owner (land cell vs EnvCell static — dat +question; note the DAT-geometry companion resolves this: landblock +object-list stabs); z-write during alpha drains; insertion_sort +direction byte-proof; the ±12 reject polarity; GameSky depth behavior. diff --git a/docs/research/2026-08-30-cathedral-review-fable.md b/docs/research/2026-08-30-cathedral-review-fable.md new file mode 100644 index 00000000..12ee5911 --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-fable.md @@ -0,0 +1,436 @@ +# Cathedral rendering review — FABLE (2026-08-30) + +Independent report-only review of the cathedral-terrace defect (falls +particles + marker stalks over terrain; landblock `0xF418`, camera in +`0xF4180104`/`0xF4180106`), baseline `37febd1f`, HEAD `bb9212c7`, branch +`claude/campaign-w-retail-frame-walk`. + +**Evidence basis and honesty note.** Everything below marked with a citation +was read directly by this reviewer (oracle trace files, decomp pseudocode +docs + their byte-verification notes, commit messages/diffs, git topology, +ISSUES/register/memory docs, id-allocator source). Three deeper evidence +threads (fresh decomp re-reads of the alpha/particle path, a raw DAT parse +of `0xF418`, and the HEAD code-flow + probe-log audit) were dispatched but +had not returned when this report was due; every claim that depended on +them is explicitly marked **unverified**. Per the prompt's rule, unverified +is stated as unverified — nothing below is a plausible guess dressed as +fact. + +--- + +## 1. Executive verdict (≤10 lines) + +The six fixes failed because they accepted a false premise about WHERE this +scene's content sits in retail's frame. The posed oracle traces show that at +both defect poses retail's interior flood is EXACTLY ONE cell (`DC ov=1 n=1: +f4180104` / `f4180106`) — every other cathedral cell, including the falls' +stab-owner cells, draws as a *building look-in inside the landscape scope*, +pre-depth-clear, its alpha drained against full landscape depth +(`posed/terrace-center.log` F5, `posed/cathedral-arrival.log` F1-2; +`PView::DrawCells` @0x005a4840 model §5). Our pipeline instead treats the +whole complex as interior-flood content drawing post-clear, then tried to +rescue it with seals (slice 2) and a non-retail exit-plane-straddle +classifier (slices 4/5) that under-covers exactly the fully-outside falls +emitters. Fix = route every object's particles to its owner cell's actual +walk turn (look-in ⇒ landscape scope ⇒ pre-clear drain), delete the straddle +classifier, and re-land the quarantined marker-degrade port for the stalks. + +--- + +## 2. Retail frame reconstruction (for an interior root with exit portals) + +### 2.1 The frame skeleton — verified from the FW0 model + live traces + +Source of truth used: `docs/research/2026-08-30-fw-walk-pseudocode.md` +(§1, §2, §3, §5, §9 — its seal loop, deferred z-clear, DEPTHTEST_ALWAYS, +punch-Z constants are recorded there as byte-verified against the raw +pseudo-C at `@0059a49af`, `@005a48a9`, `@0059be02`, `@0059bf4b`), the +extraction appendix `2026-08-30-fw-walk-pseudocode-appendix.md` (notably +the DrawBuilding/DrawMeshInternal full-sequence note at appendix line 811), +and the live cdb traces in `docs/research/2026-08-30-fw-walk-oracle/posed/`. + +Order of one interior-rooted frame (`SmartBox::RenderNormalMode` +@0x00453aa0 → `PView::DrawInside` @0x005a5860 → `ConstructView` → +`PView::DrawCells` @0x005a4840): + +1. **Flood** (`ConstructView(CEnvCell)` @0x005a57b0): view-driven — a + neighbor cell enters `cell_draw_list` only if its portal polygon + survives `PView::GetClip` @0x005a4320 against the current view (the ONLY + CPU polygon clip in the frame). Exit portals + (`other_cell_id == 0xFFFFFFFF`) raise `outside_view`. +2. **If `outside_view.view_count > 0`** (the traces' `ov`): + a. `Render::PortalList = &outside_view`; **`LScape::draw`** @0x00506330 + — the whole landscape walk THROUGH the exit views: sky, terrain + blocks far-to-near (view-CULLED per cell/block by + `draw_check_blocks`' in_view union — **never view-clipped, never + scissored**; `set_view` installs NO GPU state), buildings far-to-near, + and — per building — the **look-in machinery**: + `DrawBuilding` @0x0059f2a0 → BSP portal pass 1 punches apertures + (`DrawPortalPolyInternal` flag=1: far-Z 0.999998987, DEPTHTEST_ALWAYS, + z-write ON, alpha 0) → pass 2 recurses `ConstructView(CEnvCell)` + + `DrawCells` (**`ov=0` — no landscape, no clear, no seals**) drawing + look-in EnvCells + their objects into the punched aperture + (appendix line 811). `DrawBuilding` itself calls + **`FlushAlphaList(0f)`** before each building; `DrawBlock` + @0x005a17c0 has the mid-walk pressure valve + `FlushAlphaList(flush=0.75)` (appendix lines 700, 1027). + b. **`FlushAlphaList(0f)`** — the pre-clear boundary drain: EVERYTHING + queued during the landscape scope (terrain alpha, building alpha, + look-in cell content alpha — and the particle polys of objects drawn + in that scope) drains against **full landscape depth**. This is the + drain that occludes the falls with terrain/water/trees. + c. **Gated depth clear** (`if (forceClear || portalsDrawnCount != 0) + Clear(z)`, model §5; `portalsDrawnCount` counts ONLY flag-0 seals — + appendix line 811). Color is preserved; only depth clears. + d. **Exit seals**: for the FLOODED cells' exit portals only, + `DrawPortalPolyInternal(poly, 0)` — the portal's own projected depth, + DEPTHTEST_ALWAYS, z-write ON, invisible (model §2, §5; byte-verified + per model §9). +3. **Interior passes** (post-clear): `DrawEnvCell` far-to-near (BSP shells), + then `DrawObjCellForDummies` (the flooded cells' objects) — depth + accumulates fresh. +4. **Final drain**: `FlushAlphaList(0f)` back in `RenderNormalMode` — the + flooded cells' alpha/particles drain against interior depth + the seals. + +### 2.2 The four prompt questions + +**(a) clipped vs culled vs whole.** CPU-clipped: ONLY the portal chain's own +polygon (`GetClip` @0x005a4320 — the model calls it "the only CPU polygon +clip in the frame"). View-culled (coarse sphere-vs-cone, +`Render::viewconeCheck` @0x0054c250, PARTIAL draws whole): objects. +Cell/block-granular culled (in_view interval grids): terrain blocks/cells. +Drawn whole with no per-view test: everything that passes those gates — +shells, meshes, particles. No GPU clip planes/scissor exist anywhere in this +frame (`set_view` = CPU globals only, model §6). + +**(b) order relative to clear and seals.** PRE-clear: sky, terrain, water +(terrain-hosted — see §3, unverified detail), building shells, building +punches, **look-in EnvCell shells + look-in cell objects + their +emitters**, and all their alpha via the boundary drain. POST-clear: seals +first, then ONLY the root flood's EnvCell shells + objects + their +emitters, drained at the final flush. Seals draw exactly the flooded +cells' exit-portal polygons at own depth, color-write effectively off +(alpha 0), depth ALWAYS + write ON. + +**(c) alpha list.** ONE list. Flush sites established from the docs: +per-building `FlushAlphaList(0f)` in `DrawBuilding` (appendix 811); the +`DrawBlock` pressure valve at `flush=0.75` (~2250 meshes, appendix 1032); +the `DrawCells` pre-clear boundary `FlushAlphaList(0f)` (model §5); the +`RenderNormalMode` end-of-frame `FlushAlphaList(0f)` (model §1). Depth in +place: landscape depth at the first three; interior + seal depth at the +final one. **Unverified:** an exhaustive caller enumeration of +`D3DPolyRender::FlushAlphaList` @0x0059d2e0 from the decomp itself, and +the exact particle-poly insertion path (the dispatched decomp read had not +returned; the MP2-era digest additionally records +`CPhysicsObj::ShouldDrawParticles` @0x0050FE60 = authored degrade range + +`cell->IsInView()`, from `claude-memory/project_render_pipeline_digest.md`). + +**(d) depth at final-drain time.** Aperture pixels: the seal's own depth +(near the camera) — anything beyond the exits z-fails, so interior +particles cannot repaint the vista. Vista pixels visible through the +aperture ARE aperture pixels (the opening's polys); pixels covered by +interior geometry hold that geometry's depth. The falls are never in this +drain in retail at these poses — they drained pre-clear with the landscape. +**Unverified residual:** whether any visible vista pixel can lie OUTSIDE +the union of authored exit-portal polygons at the live chase camera (slice +6's observation implies yes for the WALK's clipped views; whether that +reflects portal-poly authoring or our clip is open — §8 Q1). + +### 2.3 The live traces at the defect poses (decisive, read directly) + +`posed/terrace-center.log` F5 (camera cell `f4180104` — the owner's +teleloc cell): + +``` +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 ← the interior flood is ONE cell +LS +BLD f518002e … BLD f4180014 BLD f418000a BLD f418000c BLD f418000b (14 buildings) +``` + +`posed/cathedral-arrival.log` F1-2 (camera cell `f4180106`): + +``` +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 ← flood = root cell only +LS +BLD f3180020 … BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 ← look-in punch during LS +… BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 ← 0xF4180104 IS A LOOK-IN +BLD f418000a +``` + +`posed/terrace-edge.log` F5 (outdoor root, camera cell `f418000b`): look-in +punches `n=1: f4180106`, `n=1: f4180101`, `n=1: f4180104` interleaved with +the building walk — no clear, no seals, everything drains against full +depth (why the owner sees a correct scene outdoors). + +**Conclusion:** at the defect poses, `0xF4180104` and `0xF4180106` are in +DIFFERENT buildings' interiors (`f418000b` vs the `f418000a/c` group — +consistent with the "seam" being a building boundary), retail's interior +flood never crosses it, and ALL non-root cathedral cells + their stabs +compose in the landscape scope, pre-clear. The "toggles with which side of +the seam the camera is on" symptom is the root flip between these two +one-cell floods (and outdoor). + +--- + +## 3. DAT geometry findings + +**Verified:** + +- The falls' observed particle owners `0x4F418012`–`0x4F418015` decode per + `src/AcDream.Core/World/InteriorEntityIdAllocator.cs:48` + (`0x40000000 | X<<20 | Y<<12 | counter`) to **interior EnvCell-stab + statics of landblock F418**, counters 0x12–0x15 — NOT landblock objects + (0xC0000000+ namespace) and NOT scenery (0x80000000+). The slice-5 commit + message (`0d6cd5c0`) reached the same identification ("EnvCell STAB-LIST + statics … ids minted by InteriorEntityIdAllocator"). +- Retail cell topology at the poses (from the traces, §2.3): `0xF4180104` + belongs to building `f418000b`'s look-in set; `0xF4180100/0101` to + `f418000c`'s; `0xF4180106` is punched separately (arrival trace); + interior floods do not cross between them at the captured camera states. +- The prior campaign's offline sightline probe (recorded in + `claude-memory/project_pview_visibility_campaign.md` and the PV plan) + established: the exit portal of the terrace cell and the building's + never-drawn panel are the SAME surface, and the "#456 seam band" IS the + terrace cell's portal[4] polygon — i.e. at least one exit aperture is a + thin band, corroborating slice 6's live finding that scissoring terrain + to the walk's exit views starves most of the vista of depth/color. + +**Unverified (the DAT parse thread had not returned):** the per-cell portal +tables (flags/0x4 exits/other_cell ids) for `0x0104/0x0105/0x0106/0x010D/ +0x010F`; WHICH EnvCell's stab list carries counters 0x12–0x15 (the counter +is allocated in ascending cell order in `LandblockBuildFactory` +`src/AcDream.App/Streaming/LandblockBuildFactory.cs:494-503`, so the DAT +stab tables resolve it mechanically); the exit-portal polygon vertex +extents vs the visible opening; whether the lake water is terrain-hosted; +the cathedral shell GfxObj roster (`0x01001FB2/B0/B3` — asserted by the +owner's prior analysis and consistent with the PV panel model +(`0x01001FB0/B2/B3/B7` panels, PV plan §"established model" item 3), but +not independently re-read here). + +--- + +## 4. Divergence table (ranked by causal weight for THIS defect) + +| # | Divergence | Ours | Retail | Evidence | +|---|---|---|---|---| +| D1 | **Particle emission site for cell statics/dynamics** | flood-membership + `SphereStraddlesExitPlane` classifier decides pre- vs post-clear emission (slices 4/5) | the owner object's actual walk turn decides: drawn during LS (shadow-cell overlap or look-in) ⇒ landscape scope ⇒ pre-clear drain; drawn in the root flood ⇒ final drain | traces §2.3; model §5; appendix 811; commit msgs `f3a03efc`/`0d6cd5c0` | +| D2 | **Interior "flood" membership for the cell-owners route** | the production cell set treats the connected cathedral complex as interior content (slice-2/3 messages: "the cell-owners route", "the OLD apparatus flood"); walk conformance proves the WALK floods n=1, but consumers were still being cut over one at a time | flood = what survives GetClip from the root; at these poses exactly ONE cell; everything else is landscape-scope | traces §2.3; commit msgs `c40aecfc`/`5f7ccdea`; plan FW3.2b-2 "prepareCells UNIONED" | +| D3 | **Dynamics-last** (register row AD-19, `docs/architecture/retail-divergence-register.md:147`): ALL dynamics in one z-buffered final pass | per-landcell painter-ordered draws inside the landscape pass; interior per cell turn | register row (self-declared); `DrawBlock` 0x005a17c0 / DrawSortCell pc:430124 | +| D4 | **No degrade/LOD admission on this branch** — the marker stalks (Setup `0x0200085A` → GfxObj `0x010001EC`, ladder `0x1100002E` = {self at MaxDist 0, id 0 to ∞}) are DRAWN | retail selects `gfxobj[deg_level]` via `get_degrade` @0x0051E4B0 and **never draws** this model at any distance (gates in `DrawBuilding` @0x0059F2A0 and `CPhysicsPart::Draw` @0x0050D7A0) | `fce250ec` exists ONLY on `claude/cathedral-rendering-debug-47a417` (`git branch -a --contains`; `git merge-base --is-ancestor fce250ec HEAD` = false; `git grep IsNeverDrawnByDegrade -- src` = empty at HEAD) | +| D5 | **Seal/vista coverage geometry**: post-clear alpha can z-pass wherever the visible vista is not covered by a stamped seal; slice 6 proved the walk's exit views at this seam are "thin BANDS far narrower than the real opening" | retail is not exposed to this because the leaking content class isn't post-clear in the first place (D1/D2) | commit msg `bb9212c7`; PV sightline probe (campaign memory) | +| D6 | (regression candidate) straddle-classified emitters now emit pre-clear on interior roots — an interior emitter drained at the landscape flush is subsequently over-painted by the post-clear interior repaint | retail: root-cell emitters drain at the final flush, after interior geometry | mechanism prediction from `f3a03efc`/`0d6cd5c0` + model §5; matches the owner's new "particles WITHIN the cathedral are wrong" report — **unverified until probed** | + +The pre-existing #451 fix (owner-accepted 2026-08-27, `docs/ISSUES.md:249-289`) +had already implemented the D1-correct contract for exterior particles +("submits attached and ownerless exterior particles inside `LScape::draw` +for every PView root"). The FW2/FW3 window (`git diff --stat +e102fb36..37febd1f -- src/AcDream.App/Rendering` = ~7,081 insertions: +the whole `Walk/` tree, `WalkFrameDriver`, the static cutover) is the +regression window that displaced it. + +--- + +## 5. Per-commit verdicts + +**`37febd1f` (slice 1 — interior outside-view slices from the walk): KEEP.** +Correct single-source-of-truth move (retail has ONE visibility structure); +fixed a real dual-path desync (the #119-family grass flash) with a real +mechanism (old-apparatus fat/degenerate exit views + walk-indexed punch +fans). Not causal for the cathedral defect either way. Its per-view terrain +slice FAN was still non-retail — superseded by slice 6, which it should be +read together with. + +**`c40aecfc` (slice 2 — exit seals stamp the walk's flood): KEEP the code, +REJECT the diagnosis (wrong-mechanism).** Stamping the walk's own flood's +exit portals is exactly retail (model §5 seal loop, pc:432785-6, and the +walk flood is conformance-proven against the traces). But the commit's +premise — falls emitters submitting POST-clear is "retail's own timing" — +is refuted by the traces: retail composes those cells pre-clear as +look-ins. Seals could never fix an over-draw whose correct rendering is +"drawn pre-clear with landscape depth"; at best they would z-reject the +falls and make them wrongly INVISIBLE through the aperture. The plan's +slice-2 paragraph (`docs/plans/2026-08-30-campaign-fw-frame-walk.md` +FW4 slice 2) carries the same false premise and should be corrected. + +**`5f7ccdea` (slice 3 — outside-stage predicate reads the walk flood): +KEEP.** Feeding predicates from the walk's VisitedCells (root flood + +look-in floods — "all of whose objects retail draws inside LScape::draw, +pre-clear") is the correct retail-shaped direction and removed one more +old-apparatus consumer. Insufficient alone: it gates the DYNAMIC split, +and the falls turned out to be cell statics (slice 5's own finding). + +**`f3a03efc` (slice 4 — straddler dynamics' particles pre-clear, once): +WRONG-MECHANISM — revert once D1 lands.** Retail has no exit-plane-straddle +classifier for emission timing; the cited rule ("retail submits an +emitter's polys at its object's FIRST draw — the landscape stage for +anything overlapping outdoor shadow cells") is right, but the +implementation substitutes a plane-straddle test for draw-site membership. +It under-covers emitters wholly OUTSIDE the exit plane (they never +"straddle" ⇒ stay post-clear ⇒ still leak) and over-covers interior +straddlers into the pre-clear drain where the interior repaint erases them +(divergence D6 — the likely source of the new in-cathedral particle +wrongness). Drawn-once bookkeeping (each owner emits exactly once) is worth +preserving in whatever replaces it. + +**`0d6cd5c0` (slice 5 — straddling cell-statics' particles pre-clear): +WRONG-MECHANISM — revert once D1 lands.** Its identification work is the +best of the six (falls = EnvCell stab statics; the shadow-cell rule +correctly cited at `DrawBlock` pc:430056-430064), but it ports the rule as +the same geometric straddle test instead of the actual membership question +("is this object drawn during the landscape scope this frame?" — for the +falls cells at these poses: yes, as building look-ins, regardless of any +plane test). Same under/over-coverage failure modes as slice 4. + +**`bb9212c7` (slice 6 — interior roots draw landscape unclipped): KEEP.** +Matches retail exactly: landscape content is view-CULLED, never +view-CLIPPED (model §3: the views feed only `draw_check_blocks`' in_view +union; `set_view` installs no GPU state; no scissor exists). Its probe +finding — falls submitted pre-clear with depth LESS still passed because +the scissored terrain had left the vista without depth — is the +load-bearing discovery of the round and independently confirms the thin-band +aperture geometry. It cannot, by itself, fix emitters that still submit +post-clear on other frames/poses, and it does not address D6. + +--- + +## 6. Why the symptom survived all six fixes + +1. **A wrong premise was locked in at slice 2 and never re-examined against + the traces the campaign itself captured.** "The falls submit post-clear — + retail's own timing" is contradicted by `posed/terrace-center.log` / + `posed/cathedral-arrival.log`: retail's interior flood at these poses is + ONE cell and the falls' owner cells are landscape-scope look-ins. Every + subsequent fix (seals, predicates, straddle emission) tried to make a + post-clear world safe instead of putting the content in the pre-clear + world where retail has it. +2. **The corrective classifier is not retail's rule.** The straddle test + (slices 4/5) approximates "overlaps outdoor shadow cells" with "sphere + crosses the exit plane" — a strictly narrower predicate that misses + fully-outside emitters (the falls hang OVER the lake) and wrongly + captures interior straddlers. +3. **Mixed visibility sources during the staged cutover.** Slices 2 and 3 + each discovered another consumer still reading the OLD apparatus's flood + (seal set, outside-stage predicate). The FW3.2b-2 design explicitly runs + old visibility for dynamics beside the walk for statics + (`docs/plans/2026-08-30-campaign-fw-frame-walk.md`); every such seam is + a place where the walk's correct n=1 flood is not what production + consumes. AD-19 (dynamics-last) keeps the weenie stalks post-clear + regardless. +4. **Two of the leaking content classes cannot be fixed by ANY + ordering/seal work:** the marker stalks should never be drawn at all + (D4 — the degrade admission port is quarantined off-branch), and + pre-slice-6 the vista had no depth to occlude against (D5) — so even + correct pre-clear emission "passed" its z-test into stale color. +5. **Each fix was validated against the previous fix's failure, not against + a falsifiable retail prediction.** The probes pinned real facts + (phase=pre/post, straddler classification) but the acceptance question + was "did the leak stop" rather than "does the frame now match §2.1's + shape at this pose" — so five plausible partial mechanisms shipped in + one day without any landing the frame-shape divergence (D1/D2). + +--- + +## 7. Recommended fix plan (mechanism-first) + +**Step 0 — probes before code (falsifiable predictions):** + +- **P1:** With `ACDREAM_PROBE_WALK_ROOT` at the terrace pose on HEAD, the + falls owners `0x4F418012-15` will log submission OUTSIDE the landscape + scope (post-clear route or final drain) on defect frames, while the + walk's own event stream visits their owner cells at BUILDING LOOK-IN + turns (not in the interior flood, which stays n=1). If instead they + already log landscape-scope submission + pre-clear drain on defect + frames, D1 is falsified — investigate the drain's depth state + (attachment, compare op) instead. +- **P2:** The DAT stab tables will place stabs #0x12-0x15 in cell(s) OTHER + than the frame's root cell at the defect poses (look-in-reached cells). + If they are stabs of the root cell itself, the look-in theory is + falsified. +- **P3:** Forcing the falls emitters to submit at their owner cell's + look-in turn (landscape scope, drained at the pre-clear boundary flush) + removes the over-draw at EVERY camera on interior roots, while the falls + stay visible through the opening and terrain-occluded exactly as on + outdoor roots. +- **P4:** Reverting slices 4/5's straddle emission (in favor of the + walk-turn rule) makes the new "particles within the cathedral are wrong" + report disappear (root-cell emitters return to the final drain). +- **P5 (optional, owner-assisted):** a cdb capture at the terrace with a + breakpoint on the particle-poly alpha-list insertion will show falls + polys entering the list BEFORE `DrawCells`' depth clear on + interior-rooted retail frames. + +**Step 1 — the emission-site port (fixes the falls).** An object's +particles submit when and where the object itself draws in the walk: +look-in cell content and outdoor shadow-cell content submit during the +landscape turn and drain at the pre-clear boundary flush; root-flood cell +content submits at its cell turn and drains at the final flush. Retail +pins: appendix 811 (look-in `DrawCells` inside the landscape scope), +`DrawBlock` pc:430056-430064 (shadow-cell object draw), model §5 (the two +drain sites). Delete `SphereStraddlesExitPlane`-based emission (slices +4/5) in the same commit; keep the emit-once ledger. + +**Step 2 — finish the flood-consumer cutover (fixes the class).** Every +remaining consumer of the old apparatus's cell set (cell-statics particle +owners, dynamics routes, prepare unions) reads the walk's per-turn visited +sets. AD-19's interior-root half retires when dynamics draw at their +cell's walk turn; if that is deferred, dynamics must at minimum gate on +the walk's visited set so a non-visited cell's weenies cannot draw at all. + +**Step 3 — re-land the marker-degrade admission (fixes the stalks being +visible at all).** `fce250ec`'s mechanism (never-drawn degrade ladders: +`get_degrade` @0x0051E4B0; `gfxobj[deg_level] != 0` gates) is a retail +port stranded on the quarantined branch. Re-land it cleanly on this branch +(fresh commit, not a cross-merge from quarantine), covering static AND +dynamic classifiers. If stalk-like shapes remain afterwards, identify by +guid before theorizing (they'd be weenies with a different model — +campaign-memory rule). + +**Step 4 — verification gates.** The ten oracle fixtures stay green (the +walk itself is already conformant); add a fixture-level assertion that the +DRIVER's submission stream places look-in-cell content in the landscape +scope (the current conformance compares walk events, not submission +scope — that gap is how D1 shipped); then the owner matrix: terrace both +cells, seam crossing, outdoor falls, interior candles, doorway flap, +Holtburg exit. + +--- + +## 8. Open questions + +- **Q1:** Why are the walk's exit views at this seam thin bands — is the + full visible opening authored as multiple portals (0/1/2/4) of which + only portal 4 survives GetClip at these camera states, or is our + clip/winding at fault, or does the chase camera sit outside the cell + volume? (Slice 6 measured the symptom; the cause is unestablished. The + PV probe's "panel ∪ solid covers every sightline" was measured at ≤6 m + camera rises only.) +- **Q2:** Which EnvCell(s) own falls stabs #0x12-0x15, and do the falls + additionally exist as dynamics (slice 3 probed entities "f4243/f4285" + as [walk-dyn] — the relationship between those ids and the stab owners + is unestablished). **DAT parse owed.** +- **Q3:** The exact HEAD drain/depth state of `ParticleRenderer` under + Vulkan (depth attachment, compare op, write mask) at each drain site — + required to close P1's alternative branch. **Code audit owed.** +- **Q4:** Whether `ShouldDrawParticles` (@0x0050FE60) is evaluated + per-frame or per-view in our port, and against which cell set at HEAD. +- **Q5:** The gated clear's `portalsDrawnCount` semantics across frames + (seals increment it AFTER the clear check — does the first interior + frame after an outdoor frame skip the clear in retail?), and whether our + `slices>0` production gate is equivalent. +- **Q6:** Whether the seal fans at HEAD still apply the old assembly's + per-cell slice clips ("where present", slice 2) and whether that can + shrink a seal below its authored polygon. +- **Q7:** The uncharacterized in-cathedral particle wrongness (owner + report #3) — D6 is a prediction, not a diagnosis; one probe frame with + `[walk-part]`/`[walk-alpha]` at a candle would settle it. + +--- + +*Reviewer: Fable. All decomp addresses cite the named 2013 build +(`docs/research/named-retail/`); trace lines cite files under +`docs/research/2026-08-30-fw-walk-oracle/posed/`; commit claims cite the +SHAs in §5; everything not directly read is marked unverified above.* diff --git a/docs/research/2026-08-30-cathedral-review-opus.md b/docs/research/2026-08-30-cathedral-review-opus.md new file mode 100644 index 00000000..0b0d5ad0 --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-opus.md @@ -0,0 +1,673 @@ +# Cathedral rendering review — independent report (Opus) + +**Reviewer:** Opus 5, independent. **Mode:** report-only (no edits, no builds, +no client launches, no commits). **Reviewed:** `37febd1f` (baseline) → +`bb9212c7` (HEAD), branch `claude/campaign-w-retail-frame-walk`, worktree +`peaceful-blackburn-5333f0`. +**Date:** 2026-08-30. + +Evidence classes used, in order of authority: (1) the named retail decomp +(`docs/research/named-retail/acclient_2013_pseudo_c.txt` + Ghidra MCP at +`127.0.0.1:8081`); (2) the installed DATs, read with the already-built +`tools/A8CellAudit/bin/Release/net10.0/A8CellAudit.exe`; (3) the live probe +logs in `%LOCALAPPDATA%\Temp\fw3-*.log` / `fw4-*.log`; (4) our source at both +SHAs. Everything I could not verify is labelled **UNVERIFIED** inline. + +--- + +## 1. Executive verdict + +1. **The ordering fix the last three slices were chasing already landed.** On + HEAD the falls' four emitters submit *and drain* pre-clear + (`fw4-slice6-gate.log:12786-12801`). Phase is no longer the binding + constraint, so slices 4–6 were repairing an already-repaired axis. +2. **The falls are `{4f418012..4f418015}` — four STAB STATICS of EnvCell + `0xF4180106`**, reached on the failing frames as a **building look-in**, + not as a root-flood cell. Slices 3 and 4 named the wrong objects + (`f4243`/`f4285` are ~9.8 m-radius *dynamics*). +3. **Slice 6's factual premise is refuted by the DAT.** `0xF4180104`'s exit + portals are the cell's **full side faces** (4-vert rectangles at ±12.00 m, + 7-vert arches at ≈±5.03 m) — not "thin bands". +4. **The only depth-destroying operation in the pre-clear scope is the + portal PUNCH** (far-Z, `ALWAYS`+write). Retail bounds it with an + unconditional **full** `FlushAlphaList(0f)` at *every* building + (@0x0059f30b); ours is a distance-filtered *partial* flush. That is the + highest-ranked unexamined suspect — but I could not prove it offline. +5. **Four other decomp-provable divergences** are live at HEAD: unconditional + clear+seals (retail gates both on `ov>0`), a clipped punch (retail punches + the *unclipped* polygon), terrain drawn with no per-landcell `in_view` + cull, and a sorted alpha drain (retail's has **no sort**). +6. **The "stalks" have a completed, decomp-cited fix that is simply not on + this branch**: `fce250ec` (marker-class degrade admission) is **not an + ancestor of `bb9212c7`**. Nothing on this branch suppresses them. +7. **Why six fixes failed:** three different object identities, zero depth + measurements, two false retail citations, six commits in 105 minutes with + no gate between them. The failure is a *method* failure, not a + *mechanism-knowledge* failure. +8. **Recommendation:** stop shipping fixes. Instrument the depth buffer and + the punch census first (§7 Stage 0). Then land R1–R7, each gated. +9. **Commit verdicts:** keep 1/2/3 (with corrections), revert 4, revert 5, + keep 6's *shape* but fix its cull. +10. **I could not determine the final residual pixel mechanism offline** and + say so rather than adding a seventh guess. + +--- + +## 2. Retail frame reconstruction + +Everything in this section is read from the decomp at the cited address. + +### 2.1 The four (and only four) alpha drains + +`grep "FlushAlphaList"` over the whole pseudo-C returns exactly five hits — +the definition plus **four call sites**: + +| Address | Site | Argument | Meaning | +|---|---|---|---| +| `0x00452bf0` | a `SmartBox` sibling (not the normal-mode path) | `0f` | drain all | +| `0x00453b8b` | `SmartBox::RenderNormalMode` epilogue | `0f` | **frame-end drain** | +| `0x0059f30b` | `RenderDeviceD3D::DrawBuilding`, **before** the portal pass | `0f` | **pre-punch drain** | +| `0x005a1a07` | `RenderDeviceD3D::DrawBlock`, after `DrawSortCell` | global `flush` | pressure valve | +| `0x005a4872` | `PView::DrawCells`, after `LScape::draw` | `0f` | **pre-clear drain** | + +`D3DPolyRender::FlushAlphaList` @0x0059d2e0 (Ghidra decompile, full body read): + +```c +if (((float)alphaedMeshCountClip < param_1 * 3000.0f) && + ((float)alphaedMeshCountAlpha < param_1 * 3000.0f)) return false; // 0x453B8000 = 3000.0f +... walk alphaedMeshListClip [0..count) -> RenderMeshSubset ... ; alphaedMeshCountClip = 0; +... walk alphaedMeshListAlpha [0..count) -> RenderMeshSubset ... ; alphaedMeshCountAlpha = 0; +``` + +Three load-bearing facts: + +- **There are TWO lists**, `alphaedMeshListClip` and `alphaedMeshListAlpha` + (both capacity `0xbb8` = 3000), drained clip-first. +- **There is NO SORT.** The drain is a straight forward walk of the arrays. + `D3DPolyRender::AddMeshToAlphaList` @0x0059c230 stores only + `{MeshBuffer*, subsetIndex, CSurface*, flags, worldMatrix}` — **no depth + key exists**. Retail's alpha order *is* the walk's submission order. +- `flush(0f)` always drains (threshold 0 ⇒ `count < 0` false). `flush(0.75)` + drains only above 2250 queued. + +The `DrawBlock` valve at `0x005a19ee-005a1a07` compares the **global `flush` +against `1.0f`**, not the queue size, and only calls through when the compare +fails. At any `flush ≤ 1.0` it never fires, and at `flush > 1.0` the +threshold `flush*3000` exceeds the 3000-entry cap, so it can never drain +either. **The mid-walk valve is effectively inert.** (The `test ah,0x41` +polarity is BN-unlifted; I read the idiom, not the raw bytes — **polarity +UNVERIFIED**, but both readings give "inert", so it is not load-bearing.) + +What defers, from `D3DPolyRender::DrawMesh` @0x0059d4a0: the decision is +**per mesh SUBSET**, keyed on `s_AlphaDelayMask & mesh->isStippledOrAlphaedMask[subset]`, +with an early bail when `render_device+0x7e0 != 0`. It is a *surface +property*, never a distance. + +### 2.2 `PView::DrawCells` @0x005a4840 — byte-order confirmed + +```c +if (this->outside_view.view_count > 0) { // 005a4852 + Render::useSunlightSet(1); // 005a485a + Render::PortalList = this; // 005a485f + LScape::draw(this->lscape); // 005a486b + D3DPolyRender::FlushAlphaList(0f); // 005a4872 <-- PRE-CLEAR DRAIN + render_device->m_nFrameStamp += 1; // 005a4886 <-- dedupe RE-ARM + if (forceClear == 0) { cond = (portalsDrawnCount == 0); portalsDrawnCount = 0; } // 005a4893-9e + if (forceClear != 0 || !cond) + render_device->Clear(4, black, 1.0f); // 005a48a9 <-- Z CLEAR + for (cell = cell_draw_list[n-1] .. [0]) // 005a48c9 far->near + if (cell->structure->drawing_bsp != 0) { + positionPush; for each view: setup_view; + for each portal: if (other_cell_id == 0xffffffff) + DrawPortalPolyInternal(portal.poly, 0); // 005a49b7 <-- SEALS (own depth) + } +} // 005a4852 block ENDS here +Render::useSunlightSet(0); Render::restore_all_lighting(); // 005a49f3 +for (cell far->near) if (drawing_bsp) { per view: setup_view; DrawEnvCell(cell); } // 005a4a05 +for (cell far->near) { PortalList = cell top view; DrawObjCellForDummies(cell); } // 005a4ae3 +``` + +**The depth clear AND the exit seals are both strictly inside +`outside_view.view_count > 0`.** There is no drain after `DrawEnvCell` and +none after `DrawObjCellForDummies` — the interior scope's alpha survives to +`RenderNormalMode`'s frame-end drain @0x00453b8b (verified: that epilogue +runs immediately after the root branch, before the target/rendering +callbacks). + +### 2.3 Buildings, punches, and the answer to (a) "clipped vs culled vs whole" + +`RenderDeviceD3D::DrawBuilding` @0x0059f2a0, read verbatim: + +```c +outdoor_pview->outdoor_portal_list = b->portals; +CPhysicsPart::UpdateViewerDistance(part0); +if (part0->gfxobj[part0->deg_level] != 0) { // 0059f2d3 — degrade gate + ... set detail surface state ... + D3DPolyRender::FlushAlphaList(0f); // 0059f30b — FULL drain, unconditional + CPhysicsPart::Draw(part0, 1); // 0059f31d — PORTAL pass + ObjBuildingOrBuildingPart = 1; + CPhysicsPart::Draw(part0, 0); // 0059f336 — SHELL pass + ObjBuildingOrBuildingPart = 0; +} +``` + +`PView::ConstructView(CBldPortal)` @0x005a59a0 — the punch itself: + +```c +side = sidedness(viewer, poly.plane, F_EPSILON=0.000199999995f); // 005a59c6 +if (portal_side ? side==NEGATIVE : side==POSITIVE) { + PView::GetClip(this, side, poly, &clip_view, &npts, pass); // 005a5a23 + if (npts != 0 && (dest = CEnvCell::GetVisible(other_cell_id)) != 0 + && Render::copy_view(dest->portal_view[dest->num_view-1], &clip_view, npts) != 0) { + if (arg5 != 2) DrawPortalPolyInternal(esi /* the RAW polygon */, arg5 == 1); // 005a5a7b + framePop(); + if (arg5 != 1) PView::ConstructView(this, dest, other_portal_id); // 005a5a9c + return 1; + } +} +return 0; +``` + +Two things this settles: + +- **Pass 1 punches (flag 1 = far-Z), pass 2 recurses.** Pass 2 draws no + polygon at all. +- **The punched polygon is `esi` — the ORIGINAL, UNCLIPPED authored + polygon.** `clip_view`/`npts` are used only to build the destination cell's + view. Retail never hardware-clips or scissors the punch. + +Answering the prompt's question (a) for an interior root with exit portals: + +| Content | Treatment | +|---|---| +| terrain (`DrawLandCell`) | **view-CULLED** per block and per 24 m landcell by `LScape::draw_check_blocks` @0x00505f80 / `landcell_check` @0x005050a0 against every active view; the surviving cells draw **whole**. Never clipped. | +| sky (`GameSky::Draw`) | drawn once at the head of `LScape::draw`, **whole**. | +| building shells | **whole**, per building, after that building's punch pass; gated only by `gfxobj[deg_level] != 0`. | +| EnvCell shells (`DrawEnvCell`) | **whole**, per cell per installed view. | +| objects / cell statics / dynamics | `Render::viewconeCheck` @0x0054c250 sphere-vs-view; PARTIAL draws **whole**. | +| **portal-chain polygons only** | the *only* CPU-clipped geometry, via `PView::GetClip` @0x005a4320 → `ACRender::polyClipFinish`. And the clip result is used for the **view**, not for the drawn punch. | + +### 2.4 Where particles live (this was the missing piece) + +`ParticleEmitter::EmitParticle` @0x0051d126: + +```c +Particle::Init(...); +CPhysicsObj::AddPartToShadowCells(this->physobj); // 0051d126 +``` + +**Every emitted particle is registered as a `CPhysicsPart` in its owner +object's SHADOW CELLS.** It therefore draws at those cells' turns through +`DrawBlock` (pass 1 updates in-view cells' shadow objects and +insertion-sorts shadow parts by depth; pass 2 draws them via `DrawSortCell` +→ `DrawObjCell`) and through `DrawObjCellForDummies` for interior cells — +i.e. through the same `CPhysicsPart::Draw` → `DrawMesh` path as any mesh, +and so through the same per-subset alpha-delay branch. + +`CPhysicsObj::ShouldDrawParticles` @0x0050fe60 is **not** a draw-order gate. +Its single caller is `ParticleEmitter::UpdateParticles` @0x0051d1a6 — the +**simulation** side. Body: + +```c +if (m_bExaminationObject == 0) { + if (!(CYpt < arg2 /*degrade_distance*/)) return 0; + if (cell == 0) return 0; + if (cell->vtable->IsInView() == 0) return 0; +} +return 1; +``` + +### 2.5 Answers to (b), (c), (d) + +**(b) Draw order relative to the clear and the seals**, interior root, `ov>0`: + +``` +sky ─┐ +terrain (culled cells) │ +per building: │ all inside LScape::draw → ALPHA QUEUED + FlushAlphaList(0f) │ (and drained at every building) + punch (far-Z, raw) │ + look-in DrawCells │ + shell │ +outdoor objects+particles┘ +────────── FlushAlphaList(0f) @005a4872 ────────── drain vs TRUE landscape depth +────────── m_nFrameStamp += 1 ────────── per-part dedupe RE-ARMED +────────── Clear(z) @005a48a9 ────────── gated on portalsDrawnCount +────────── exit seals @005a49b7 ────────── own-depth panels at apertures +DrawEnvCell per flood cell ─┐ +DrawObjCellForDummies per flood cell (objects+their │ ALPHA QUEUED + particles) ─┘ +────────── FlushAlphaList(0f) @00453b8b ────────── drain vs interior depth + seals +``` + +**(c) How the list drains.** Two arrays, no sort, insertion order, drained at +the four sites above; each drain zeroes its counts. The depth in place at +each: *pre-punch* = everything drawn so far this landscape walk; *pre-clear* += complete landscape depth including punched apertures and whatever look-in +content refilled them; *frame-end* = cleared depth ∪ seals ∪ interior shells +∪ interior objects. + +**(d) Depth at final drain.** At the **aperture** the seals own it (portal +surface's own projected depth, written `DEPTHTEST_ALWAYS` + z-write after the +clear). At the **vista** (everything the landscape painted) depth is `1.0` — +the clear erased it — and only **colour** survives. That is precisely why +retail *must* drain the landscape alpha before the clear: any landscape-scope +alpha that survived into the interior scope would z-pass across the whole +vista. Retail's guarantee is structural: after `FlushAlphaList(0f)` at +`005a4872` **the list is empty**, so nothing can. + +--- + +## 3. DAT geometry findings (installed DATs, read live) + +Run: `tools/A8CellAudit/bin/Release/net10.0/A8CellAudit.exe portals ` +(already built; no compilation performed). + +### 3.1 Landblock `0xF418` inventory + +- **88 outdoor objects** `0xCF418000`–`0xCF418057`. **Ordinals 1–7 are model + `0x0200085A`** — the spawn-marker Setup that retail never draws (see §6). +- **9 buildings** `0xCF418058`–`0xCF418060`. Four carry portals: + `0x01001FB0`→cells 0100-0102, **`0x01001FB2`→0103,0104**, + **`0x01001FB3`→0106-010B**, `0x01001FB7`→0112-0115. +- **24 EnvCells** `0xF4180100`–`0xF4180117`. + +### 3.2 The cells that matter + +**`0xF4180104`** (the owner's teleloc), `localAABB min=(-5.70,-12.00,9.80) +max=(5.02,12.00,20.00)`: + +| portal | other | flags | polyId | verts | plane N | centroid·N | +|---|---|---|---|---|---|---| +| 0 | `0xFFFF` EXIT | 5 | 36 | **4** | (0, 1, 0) | **−12.000** | +| 1 | `0xFFFF` EXIT | 5 | 39 | **7** | (−1, 0, 0.06) | −5.028 | +| 2 | `0xFFFF` EXIT | 5 | 37 | **4** | (0, −1, 0) | **−12.000** | +| 3 | `0x0105` | ExactMatch, PortalSide | 40 | 8 | (0, 0, −1) | 5.100 | +| 4 | `0xFFFF` EXIT | 5 | 38 | **7** | (1, 0, 0.06) | −5.035 | + +**This refutes slice 6's stated premise.** Portals 0 and 2 are 4-vertex +rectangles sitting exactly on the cell's ±Y faces at ±12.00 m — i.e. **the +entire 10.7 m × 10.2 m end faces**. Portals 1 and 4 are 7-vertex arches on +the ±X faces at ≈±5.03 m. This is an open-sided gallery, not a set of thin +seam bands. The "seam band" the PV campaign observed is a **screen-space** +artifact of how our clip slices are built, not an authored polygon shape. + +**`0xF4180106`** — the falls' owner cell, `localAABB min=(-5.49,-12.00,9.80) +max=(5.23,-6.00,20.00)`: 3 portals — interior →`0x0110` (poly 78, 9 verts), +interior →`0x010F` (poly 77, 9 verts), and **one exit** (poly 76, **4 verts**, +N=(0,1,0), centroid·N = 3.000, flags 7). One 4-vertex outdoor aperture. + +**`0xF418010F`**: 2 portals, both interior (→`0x0107`, →`0x0106`), **no +exits**. + +### 3.3 The exit-portal flag + +Across all 24 cells of `0xF418`: every `other == 0xFFFF` portal has flags +**5 or 7** (bit `0x4` always set); every interior portal has flags **1 or 3** +(bit `0x4` never set). Bit `0x4` ≡ "leads outside" — exactly as +`claude-memory/project_pview_visibility_campaign.md` records. Our tree +detects exits purely by the `0xFFFF` sentinel and never reads bit `0x4` +(`src/AcDream.App/Rendering/Walk/WalkCellFactory.cs:93`); the two are +redundant here, so this is correct-by-accident but not a defect. + +### 3.4 The falls' identity — PINNED + +`%LOCALAPPDATA%\Temp\fw3-falls-probe.log`, aggregated: + +``` +10303 [walk-part] cell-owners n=6 ids=[4f418012,4f418013,4f418014,4f418015,f4180106,f418010f] + 192 [walk-part] cell-owners n=5 ids=[4f418012,4f418013,4f418014,4f418015,f4180106] +``` + +`{4f418012, 4f418013, 4f418014, 4f418015}` **never appear without cell +`f4180106`**. `InteriorEntityIdAllocator.Base` mints +`0x40000000 | (lbX<<20) | (lbY<<12)` = `0x4F418000` for landblock `0xF418` +(`src/AcDream.Core/World/InteriorEntityIdAllocator.cs:47-48`), and the +`0xC…` sibling namespace covers landblock outdoor statics. So the falls are +**four EnvCell static objects of `0xF4180106`** — confirmed interior-cell +statics, not landblock objects and not unattached emitters. + +Corroborating: the `[walk-emit]` interior-unattached dump added at slice 5 +**never printed a single line** in any of the three gate logs +(`grep -c walk-emit` = 0 in `fw4-emit-probe.log`, `fw4-slice5-gate.log`, +`fw4-slice6-gate.log`) — the loop body is over an empty list. The +unattached-emitter theory is dead. + +**Cross-check against retail:** `terrace-edge.log` (retail's own walk at the +#456 pose) punches `DC pv=009d4b08 ov=0 n=2: f4180106 f418010f` every frame, +and `cathedral-arrival.log` roots at `DI f4180106` on all 39 frames — so +retail reaches this exact cell through the same two routes. + +**UNVERIFIED:** the Setup/GfxObj ids of the four falls objects. The audit +tool has no stab-dump verb and I did not build one. Also UNVERIFIED: where +the lake **water surface** geometry lives (landcell terrain vs a separate +surface). Both are cheap to establish and both matter to the fix plan. + +--- + +## 4. Divergence table (ranked) + +Rank = (how load-bearing for this defect) × (confidence it is real). + +| # | Divergence | Retail | acdream @ `bb9212c7` | Evidence | +|---|---|---|---|---| +| **D1** | **Per-building alpha barrier is partial, not full** | `FlushAlphaList(0f)` — drains the *entire* list before every punch pass | `AlphaBarrier` → `FlushLandscapeAlphaFartherThan(d)` — drains only entries with `ViewerDistance >= d` | decomp `0x0059f30b`; `WalkFrameDriver.cs:655`; `RetailPViewPassExecutor.WalkLeaf.cs:246-247`; `RetailPViewPassExecutor.cs:649-650`; `RetailAlphaQueue.cs:261-278` | +| **D2** | **Clear + seals fire unconditionally** | both strictly inside `if (outside_view.view_count > 0)` | emitted unconditionally at `OnInteriorFloodDrawTurn`, doc-commented as deliberate | decomp `0x005a4852`…`0x005a49b7`; `WalkFrameDriver.cs:690-704` ("both unconditional … whether or not a landscape turn just ran") | +| **D3** | **The punch is clipped, with a silent fall-open** | `DrawPortalPolyInternal(esi, 1)` on the **raw** polygon; no view clip, no scissor | clipped to `slices[activeViewIndex].Planes`; when the index is out of range it silently falls back to *no* planes | decomp `0x005a5a7b`; `RetailPViewPassExecutor.WalkLeaf.cs:145-158` | +| **D4** | **Interior-root terrain has no `in_view` cull** | `draw_check_blocks`/`landcell_check` mark per-block and per-24 m-cell visibility against the exit views; only marked cells draw | `_terrain.Draw(camera, frustum, clipPlanes: default, ndcClipAabb: full)` — every frustum-visible landblock slot draws whole | decomp `0x00505f80` / `0x005050a0`; `RetailPViewPassExecutor.WalkLeaf.cs:99-110`; `TerrainModernRenderer.cs:202-242` | +| **D5** | **The alpha drain sorts** | no sort — insertion order is the walk order; `AddMeshToAlphaList` stores no depth key | `SortRetailOrder()` radix-sorts by viewer distance at every flush | decomp `0x0059d2e0`, `0x0059c230`; `RetailAlphaQueue.cs:162, 269` | +| **D6** | **Marker degrade admission absent** | `gfxobj[deg_level] == 0` ⇒ part not drawn; spawn markers author a nothing-ladder and are never drawn at any distance | no per-entity degrade selection on this branch | `git merge-base --is-ancestor fce250ec bb9212c7` → **NO**; walk degrade applies only to `WalkBuilding` (`WalkBuildingFactory.cs:87-120`) | +| **D7** | **"Emit exactly once" invariant** | `m_nFrameStamp += 1` *after* the pre-clear drain deliberately re-arms the per-part dedupe so an object drawn outdoors draws **again** in the interior pass | slices 4/5 subtract pre-clear owners from both last-pass arms so each owner emits exactly once per frame | decomp `0x005a4886`; `RetailPViewRenderer.cs:2184-2185, 2322-2324` | +| **D8** | **Straddle heuristics instead of shadow-cell membership** | an object's parts live in every cell its sphere overlaps (`AddPartToShadowCells`), and draw at each of those cells' turns | `SphereStraddlesExitPlane(cell, c, r)` geometric test over flood cells | decomp `0x0051d126`; `RetailPViewRenderer.cs:597-626`; `WalkPView.cs` (slice 5) | +| **D9** | **Particle visibility is one frame stale and now over-wide** | `cell->IsInView()` is the *current* frame's flag | `TerrainModernRenderer.VisibleCellIds` + `InViewCells` are marked at frame end and consumed next frame; slice 6 widened the terrain set to the whole frustum | `WorldSceneRenderer.cs:263-264, 441-447`; `TerrainModernRenderer.cs:225-234` | +| D10 | Exit flag `0x4` never read | flag `0x4` ≡ leads-outside | detected only via the `0xFFFF` sentinel | `WalkCellFactory.cs:93`; A8CellAudit flags 5/7 vs 1/3 — **redundant here, benign** | + +D1–D3 are the ones that can plausibly produce "alpha paints across pixels +whose true occluder is in front of it". D4 and D9 are the ones that can +plausibly produce the **new** post-slice-6 report (#3, "particles within the +cathedral are also wrong"). D6 is the whole of the "stalks" half. + +--- + +## 5. Per-commit verdicts + +### `37febd1f` — FW4 slice 1, interior outside-view slices from the walk +**KEEP.** The diagnosis is sound and the mechanism is retail's: retail has +exactly one visibility structure, and having the walk decide *whether* +terrain draws while `PortalVisibilityBuilder` decided *where* is a state +that retail cannot produce. `ClipFrameAssembler.ReassembleOutsideViewFromWalk` +is the right seam. The punch-fan index aliasing repair is real. +**Correction owed:** it left the *silent* fall-open at +`RetailPViewPassExecutor.WalkLeaf.cs:146-148` — an out-of-range +`activeViewIndex` produces an unclipped punch with no log. That violates the +campaign's own binding rule 3 ("fail loud, never silently drop") and is the +same bug class the commit was fixing. + +### `c40aecfc` — FW4 slice 2, exit seals stamp the walk's own flood +**KEEP the mechanism; the stated diagnosis was wrong.** Sealing from +`cell_draw_list` is exactly `0x005a49b7`, and taking that list from the walk +rather than the old apparatus is correct. But the commit message's causal +claim — "the falls … submit POST-depth-clear on interior roots … the drain +z-passed across the unsealed opening" — is falsified by its own successor +evidence: after slices 4–5 the falls submit and drain *pre*-clear and the +symptom is unchanged. +**Corrections owed:** (i) seals must be gated on `ov>0` (D2); (ii) retail's +seal is the authored polygon under the cell's `setup_view`, not a hardware +slice clip — the "old assembly's per-cell slice clips where present" path is +an invented hybrid; (iii) the commit says it seals "unclipped where the old +apparatus had no entry (benign)" — that inconsistency means two different +seal geometries exist in one frame depending on an unrelated data structure's +contents. + +### `5f7ccdea` — FW4 slice 3, outside-stage predicate reads the walk flood +**KEEP; wrong target.** Feeding `DynamicDrawsInOutsideStage` the walk's +`VisitedCells` instead of the old flood is right for the same one-visibility- +structure reason. But the commit identifies "the same two emitter entities +(f4243/f4285)" as the falls. The probes show `f4243`/`f4285` are **dynamic +entities of radius ≈9.8-10 m** parented at `f4180104`/`f4180106` +(`fw4-slice3-gate.log`, `fw4-slice6-gate.log`: `[walk-dyn] … id=f4243 +parent=f4180104 r=9.8 outside=1 cone=1`), while the falls are the four +`4f41801[2-5]` cell statics. Slice 3 fixed a real desync for the wrong +objects, and its success criterion was therefore never testable. + +### `f3a03efc` — FW4 slice 4, straddler dynamics emit pre-clear, once +**REVERT.** Three independent problems: +1. **Wrong objects** — same misidentification as slice 3. +2. **Invented rule.** Retail has no "exit-plane straddler" concept. An + object's parts are in every shadow cell its sphere overlaps + (`AddPartToShadowCells` @0x0051d126); membership, not a plane test, + decides where it draws. +3. **Contradicts the decomp.** The commit's core invariant is "every owner + emits exactly once". Retail deliberately bumps `m_nFrameStamp` at + `0x005a4886` — *after* the pre-clear drain — precisely so that a part + drawn during `LScape::draw` **draws again** in the interior pass. The + `ExceptWith(_preClearParticleOwnerScratch)` subtractions at + `RetailPViewRenderer.cs:2184` and `:2322` implement the opposite of + retail's rule. + +### `0d6cd5c0` — FW4 slice 5, straddling cell statics' particles emit pre-clear +**REVERT, but keep the insight.** The retail citation is the right one — +`DrawBlock` pc:430056-430064 / the shadow-cell draw *is* how an object +overlapping outdoor landcells reaches the landscape scope. The implementation +is not that rule: it is `SphereStraddlesExitPlane` over the walk's **flood** +cells (`RetailPViewRenderer.cs:604-626`), gated with +`if ((cellId & 0xFFFF) < 0x100 || _lookInCellIds.Contains(cellId)) continue;` +— it **explicitly skips look-in cells**. On the failing frames +`0xF4180106` is a *look-in* cell (`fw4-slice6-gate.log:12786` shows it in +`walkCells` while the root flood at `:10352` does not contain it), so this +slice does not touch the falls at all. Its own probe evidence shows the falls +arriving on the `cell-owners` route, not the `static-owners n=12 +ids=[4f418007…]` straddler set it created. + +### `bb9212c7` — FW4 slice 6, interior roots draw landscape unclipped +**KEEP THE SHAPE, FIX THE CULL, RETRACT THE PREMISE.** +- **Right:** collapsing slice 1's per-view terrain fan to **one** terrain + turn is a genuine correction — `LScape::draw` runs its block walk once, and + the active views feed only `draw_check_blocks`. Removing the hardware clip + and scissor is also retail-correct ("retail never clips ordinary meshes per + view"). +- **Wrong premise:** "at the #456 cathedral seam those authored portal polys + are thin BANDS far narrower than the real opening" is **refuted by the + DAT** (§3.2): `0xF4180104`'s exits are full ±12.00 m faces and 7-vertex + arches; `0xF4180106`'s exit is a 4-vertex face. The narrow bands are a + property of our clip-slice construction, not of the authored geometry — + which means the *slice builder* is the thing to look at, and slice 6 + papered over that by removing the consumer instead. +- **Regression risk:** it replaced "clipped too tight" with "**not culled at + all**". Retail restricts the landscape to `in_view` landcells; the walk + already computes exactly that set (`RetailFrameWalk.DrawLandscape` calls + `landscape.CheckBlocks(ctx.CyPlane, activeViews)` at + `RetailFrameWalk.cs:152` and emits per-cell turns), and the leaf renderer + **ignores it**. Two consequences: terrain colour is painted over the whole + frustum before the clear (so any hole in the interior repaint shows world + where retail would show only the aperture), and + `TerrainModernRenderer.VisibleCellIds` — which feeds next frame's + `ShouldDrawParticles` cell-in-view gate — is widened to the whole frustum. + Both are live candidates for the owner's new report #3. + +--- + +## 6. The "stalks" — a separate, already-solved defect + +The lake-edge marker "stalks" are not part of the falls story and do not +need a new mechanism. `fce250ec` ("port retail marker-class degrade +admission") implements the decomp rule — `get_degrade` @0x0051E4B0 selects a +per-part LOD off the CYpt viewer distance, and both `DrawBuilding` +@0x0059f2a0 (`gfxobj[deg_level] != 0`, verified above at `0059f2d3`) and +`CPhysicsPart::Draw` @0x0050D7A0 skip the draw when the selected id is 0; +spawn markers author `{self at MaxDist=0, id 0 to infinity}` and are +therefore **never** drawn by retail at any distance. + +`git merge-base --is-ancestor fce250ec bb9212c7` returns **NO**. That commit +lives only on the quarantined `claude/cathedral-rendering-debug-47a417`. +Nothing on the FW branch replaces it: the FW1 degrade work +(`e23a589a`, `c1a029ed`, `b3ac5872`, all ancestors) selects a building's +drawing-BSP inside `WalkBuilding` only (`WalkBuildingFactory.cs:87-120`, +`WalkBuilding.cs:101-114`); no degrade gate is applied to cell statics or +dynamics anywhere in `src/` (`grep -n "Degrade" Walk/*.cs` and +`WalkStaticStreamPopulator.cs` — zero hits in the populator). + +The DAT confirms the class is present here: ordinals 1–7 of landblock +`0xF418`'s outdoor object list are model `0x0200085A`, the known marker +Setup. + +**Caveat, honestly flagged:** the prompt describes the observed stalks as +"server-spawned weenies, e.g. entities parented at `0xF418010D`". Weenies +carry their own Setup, so whether restoring `fce250ec` covers *these* +particular stalks depends on the Setup ACE gives them. +`claude-memory/project_pview_visibility_campaign.md` already flags this: +"If stalk-like objects still show at a gate, they're server weenies with a +different model: identify by guid." **UNVERIFIED** until someone logs the +guid → Setup → DIDDegrade chain for one visible stalk. + +--- + +## 7. Why the symptom survived all six fixes + +This is a method failure. Five specific causes, each with evidence: + +1. **The object was never identified before the fixes started.** Slice 2 + called the falls "cell-owners route" emitters, slice 3 named + `f4243`/`f4285` (dynamics), slice 4 called them "interior-parented + exit-plane straddler DYNAMICS", slice 5 called them "EnvCell STAB-LIST + statics". Only slice 5 was close, and even it used the wrong sense of + "stab" — in the DAT, `numStabs`/`stab_list` is the **visible-cell** list + (`references/ACE/Source/ACE.DatLoader/FileTypes/EnvCell.cs:36-68`; + our `WalkCell.StabList` is cell ids, `WalkCellFactory.cs:105`), while the + placed objects are `StaticObjects`. The four falls were identifiable from + `fw3-falls-probe.log` — which existed **before slice 2** — in one grep. + +2. **The depth buffer was never measured.** Every slice reasoned about depth + from code reading. Slice 6's own message asserts "the depth they test + against is EMPTY" as a conclusion, not a measurement. The probe apparatus + answers *when* (`phase=pre/post`) and *who* (`ids=[…]`) but has no verb + for *what depth is at these pixels*. The single question that would + discriminate between D1, D3, D4 and "the particle's own depth is wrong" + has never been asked of the machine. + +3. **Once `phase=pre` was achieved, the hypothesis space collapsed.** By + slice 5 the falls demonstrably drained pre-clear + (`fw4-slice6-gate.log:12793-12801`). At that point the ordering axis was + closed and every further ordering change was necessarily inert. Slice 6 + correctly inferred "then the depth must be empty" but then guessed at + *why* instead of measuring, and guessed a DAT fact that is false. + +4. **Two retail citations were mis-scoped, and nothing caught it.** Slice 4's + "emit exactly once" is the opposite of `m_nFrameStamp += 1` @0x005a4886. + Slice 6's "thin bands" is contradicted by four lines of A8CellAudit + output from an already-built tool. The campaign's binding rule 2 ("grep + named first … pseudocode notes before C#") was followed for the *shape* + of the mechanism and skipped for the *specific numbers*. + +5. **Six commits in 105 minutes with no gate between them.** `37febd1f` + 18:21 → `bb9212c7` 20:06. Each was validated by hermetic tests only + (6,762/0), which cannot see a depth-composition defect. Each slice's + premise was built on the previous slice's *unvalidated* conclusion, so the + errors compounded: slice 4 built on slice 3's misidentification, slice 5 + built on slice 4's invented rule, slice 6 built on slice 5's non-effect. + The campaign's own rule 4 ("the transition checklist is a standing + self-run gate … before the owner sees it") was not exercised between + slices. + +--- + +## 8. Recommended fix plan + +**Ground rule: no code change until Stage 0 produces a number.** The +investigation has spent six rounds on plausible mechanisms; the cheapest +remaining move is to make the frame observable. + +### Stage 0 — instrument (no behaviour change) + +**P1 — depth checkpoint readback.** Under a new +`ACDREAM_PROBE_WALK_DEPTH=1` (documented in `docs/launch-options.md` in the +same commit, per the binding rule), capture the depth attachment at three +points in an interior-rooted frame: (i) after the terrain turn, (ii) after +the last building turn, (iii) immediately before `passes.FlushLandscapeAlpha()` +in the `clearInteriorDepth` closure (`RetailPViewRenderer.cs:356`). Emit a +downsampled 64×36 depth grid per checkpoint plus a per-pixel min/max. +*Falsifiable prediction (D1/D3):* at checkpoint (iii), the screen cells where +the falls bleed hold ≈`0.999999` (punched far-Z), while checkpoint (i) holds +real terrain depth at the same cells. If (iii) already holds real terrain +depth, **D1 and D3 are dead** and the residual is the particles' own depth — +which the same dump measures by also logging each drained falls submission's +projected NDC z. + +**P2 — punch census.** Per punch fan, log building id, portal index, +`activeViewIndex`, `slices.Length`, whether `planes` was empty (the silent +fall-open), and the fan's screen-space AABB. +*Falsifiable prediction:* on failing frames at least one punch of building +`0x01001FB3` (the owner of `0xF4180106`) is emitted with `planes` empty and a +screen AABB covering the falls' region. + +**P3 — one grep, zero code:** dump `EnvCell 0xF4180106`'s `StaticObjects` +(a `stabs` verb on `A8CellAudit`, ~20 lines) to get the four falls objects' +Setup/GfxObj/DIDDegrade ids, and do the same for one visible stalk's weenie +Setup. This closes the two UNVERIFIED items in §3.4 and §6 and tells you +whether D6 alone fixes the stalks. + +### Stage 1 — decomp-provable repairs (each its own commit, each gated) + +| id | change | retail pin | +|---|---|---| +| **R1** | `AlphaBarrier` becomes a **full** `FlushLandscapeAlpha()`. Retire `FlushLandscapeAlphaFartherThan` from production. | `0x0059f30b` — `FlushAlphaList(0f)`, unconditional, inside the degrade gate | +| **R2** | Gate `ClearInteriorDepth` **and** `ExitSeals` on `outsideView.ViewCount > 0`; delete the "unconditional" doc claim at `WalkFrameDriver.cs:695-699`. | `0x005a4852` opens the block; `0x005a48a9` and `0x005a49b7` are both inside it | +| **R3** | Punch the **unclipped** authored polygon; delete the `slices[activeViewIndex]` clip. Make an out-of-range `activeViewIndex` throw, not silently fall open. | `0x005a5a7b` draws `esi` (the raw `CPolygon*`); the clip result feeds only `copy_view` | +| **R4** | Terrain draws the walk's own `in_view` landcell set (already computed by `WalkLandscape.CheckBlocks`), whole and unclipped. Retire the frustum-only interior path. | `0x00505f80` `draw_check_blocks`, `0x005050a0` `landcell_check` | +| **R5** | Drop `SortRetailOrder` once the walk owns submission order end to end; drain in insertion order. | `0x0059d2e0` has no sort; `0x0059c230` stores no depth key | +| **R6** | Cherry-pick `fce250ec`'s `RetailDegradePolicy` + `WbMeshAdapter.IsNeverDrawnByDegrade` onto this branch and apply it in the walk's static populator and the dynamic classifier. | `get_degrade` @0x0051E4B0; `gfxobj[deg_level] != 0` at `0x0059f2d3` and `CPhysicsPart::Draw` @0x0050D7A0 | +| **R7** | Replace `SphereStraddlesExitPlane` + the "emit exactly once" subtractions with retail's rule: an object submits at **every cell it is a shadow member of**, with a frame-stamp dedupe that is **re-armed after the pre-clear drain**. | `AddPartToShadowCells` @0x0051d126; `m_nFrameStamp += 1` @0x005a4886; `GetDrawnThisFrame`/`SetDrawnThisFrame` @0x0059f388 | + +**Ordering:** R2 and R3 are cheap and decomp-unambiguous — land them first; +they may change the symptom on their own and they make P1/P2's readings +easier to interpret. R1 next (it is the mechanism D1 names). R4 next (it also +closes the D9 widening). R7 replaces slices 4 and 5 wholesale, so revert +`f3a03efc` and `0d6cd5c0` as part of it rather than layering. R5 and R6 are +independent and can land any time. + +**Gate for each:** the two-checkpoint depth dump from P1 at the cathedral +pose, plus the campaign's own transition checklist (portal-in, Holtburg house +exit, teleport stopwatch, steady-state fps) — rule 4, which was skipped for +all six slices. Do **not** stack two of these before an owner look. + +### What NOT to do + +- Do not add a seventh ordering fix. The ordering axis is closed + (`fw4-slice6-gate.log:12793-12801`). +- Do not suppress the falls emitters, add a depth bias, force particle depth + writes, or scissor the drain. All are symptom-site workarounds and all are + already on the render digest's DO-NOT-RETRY list in spirit. +- Do not reintroduce per-view terrain clipping. Slice 6 is right that retail + culls rather than clips; the fix is to add the cull, not to restore the + clip. + +--- + +## 9. Open questions + +1. **What depth is actually at the failing pixels at the pre-clear drain?** + Unanswered. This is the whole investigation in one question and Stage 0/P1 + answers it in one run. +2. **Setup/GfxObj/DIDDegrade of `0xF4180106`'s four static objects.** + UNVERIFIED — needs a `stabs` verb on `A8CellAudit` (no build of production + code required). +3. **Where does the lake water surface live** — landcell terrain polys, or a + separate surface with its own pass? If it is a separate translucent pass, + it shares the alpha list with the falls and their relative order is decided + by D5 (our sort) rather than by the walk. UNVERIFIED. +4. **The `DrawBlock` alpha-valve polarity** (`test ah,0x41` @0x005a19fc). + I read the idiom, not the raw bytes. Both readings make the valve inert at + default `flush`, so it is not load-bearing here, but the FW pseudocode doc + still lists it as owed and it should be closed from the binary. +5. **Are the observed stalks the marker class?** Depends on the weenie Setup + ACE assigns. If not, `fce250ec` will not cover them and the guid → Setup + chain must be logged live. +6. **Why are our clip slices "thin bands" when the authored polygons are full + faces?** Slice 6 removed the *consumer* of those slices for terrain, but + the slices still drive the punch fans and the dynamics apertures. If the + slice builder is producing bands from full-face polygons, that is a defect + in `ClipFrameAssembler`/`ClipPlaneSet`/`WalkScreenClip` that outlives this + bug. Worth one focused offline check against `0xF4180104` poly 36 (a + 4-vertex ±12.00 m face) — project it and compare against the produced + slice. +7. **Does the one-frame lag in particle visibility matter here?** + `WorldSceneRenderer.cs:441-447` marks visible cells at frame end for the + next frame, while retail asks `cell->IsInView()` on the current frame. + Combined with slice 6's frustum-wide `VisibleCellIds`, this is the most + likely source of the owner's new "particles within the cathedral" report, + but I have no capture of that symptom to test against. UNVERIFIED. + +--- + +### Appendix — commands used (all read-only) + +``` +git show --stat 37febd1f c40aecfc 5f7ccdea f3a03efc 0d6cd5c0 bb9212c7 +git merge-base --is-ancestor fce250ec bb9212c7 # -> NO +tools/A8CellAudit/bin/Release/net10.0/A8CellAudit.exe portals F4180104|F4180106|F418010F +curl -s "http://127.0.0.1:8081/decompile_function?address=0x0059d2e0" +grep -n "FlushAlphaList|AddMeshToAlphaList|DrawPortalPolyInternal|ShouldDrawParticles" \ + docs/research/named-retail/acclient_2013_pseudo_c.txt +grep/awk over %LOCALAPPDATA%\Temp\fw3-falls-probe.log, fw4-slice3-gate.log, + fw4-slice5-gate.log, fw4-slice6-gate.log, fw4-emit-probe.log +``` diff --git a/docs/research/2026-08-30-cathedral-review-prompt.md b/docs/research/2026-08-30-cathedral-review-prompt.md new file mode 100644 index 00000000..5c55eff9 --- /dev/null +++ b/docs/research/2026-08-30-cathedral-review-prompt.md @@ -0,0 +1,165 @@ +# Cathedral rendering review — independent troubleshooting prompt + +You are an independent reviewer investigating a persistent rendering defect +in **acdream** (a modern C# .NET 10 Asheron's Call client; the code is +modern, the behavior must be retail). This is a **report-only** +investigation: read anything, run read-only commands (git log/diff/show, +grep, dat inspection), but do NOT edit code, do NOT build, do NOT launch +clients, and do NOT commit. Your single deliverable is a written report +(the path is given at the end). + +## Where the code is + +- Git worktree (the active campaign branch, work here): + `C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0` +- Branch: `claude/campaign-w-retail-frame-walk` +- HEAD at review time: `bb9212c7` (FW4 slice 6) +- **Baseline before ANY cathedral-specific fix: `37febd1f`** — the owner + first reported this defect on a build of that commit. Six fix commits + followed (see below). The owner's verdict: *nothing has fixed anything*. +- Main repository (for main-branch history): `C:\Users\erikn\source\repos\acdream` + +## The defect (owner-observed, on a live ACE server at 127.0.0.1:9000) + +At the cathedral terrace, landblock `0xF418`, standing in interior EnvCells +`0xF4180104` / `0xF4180106` (owner teleloc: `0xF4180104 [31.9 57.3 169.8]`): + +1. **Waterfall particles** (the blue falls over the lake outside) render on + top of terrain, water, and other content that should occlude them. + Intermittent — toggles with which side of "the seam" (the terrace's + interior/outdoor boundary) the CAMERA is on. Standing outdoors near the + falls (`0xF418000B`, `0xF4180015`) they look correct. +2. **"Stalks"** (dark monster-marker shapes near the lake-edge trees, + server-spawned weenies, e.g. entities parented at `0xF418010D`) leak + over trees and scenery. This predates the current campaign. +3. NEW (after the sixth fix): the owner reports **particles WITHIN the + cathedral are also wrong** (uncharacterized — treat as a regression + candidate of the fix stack). +4. A previous session's analysis (owner-supplied) adds: the visible + cathedral shell is assembled from multiple authored GfxObjs + (`0x01001FB2`, `0x01001FB0`, `0x01001FB3`) + EnvCells + a portal graph; + cell `0xF4180104` has exterior portals 0/1/2/4 and interior portal 3 → + `0xF4180105`; "if an incorrect depth or portal route prevents one + wall's colour pass from drawing, the wall appears transparent even + though its geometry and opaque texture are present." + +**The oracle fact that anchors everything: the RETAIL client connected to +the SAME ACE server renders this scene perfectly.** So a correct +client-side mechanism exists; the task is to find what retail actually +does for this scene and where our port diverges. + +## What you must do + +1. **Reconstruct retail's actual frame for this scene** from the named + decomp: `docs/research/named-retail/acclient_2013_pseudo_c.txt` + (18,366 PDB-named functions; grep by `class::method`) and + `docs/research/named-retail/acclient.h`. Key functions: + `SmartBox::RenderNormalMode` @0x00453aa0, `PView::DrawInside` @0x005a5860, + `PView::DrawCells` @0x005a4840 (landscape draw pc:432719, gated depth + clear pc:432731-2, exit seals pc:432785-6), `LScape::draw` @0x00506330, + `RenderDeviceD3D::DrawBlock` @0x005a17c0 (per-shadow-cell object draw + pc:430056-430064), `RenderDeviceD3D::DrawSortCell` @0x0059f140, + `RenderDeviceD3D::DrawBuilding` @0x0059f2a0, + `CPhysicsObj::ShouldDrawParticles` @0x0050FE60, + `D3DPolyRender::FlushAlphaList` @0x0059d2e0, `PView::GetClip` @0x005a4320, + `PView::InitCell` @0x005a4b70. A Ghidra MCP HTTP server may be live at + `http://127.0.0.1:8081` (`/decompile_function?address=0x...`) serving the + same 2013 build with PDB names — use it when grep is too noisy. + Answer specifically: for an interior root whose cell has exit portals, + (a) what exactly gets view-clipped vs view-culled vs drawn whole; + (b) when does each content class (terrain, sky, building shells, + EnvCell shells, cell-static objects + their emitters, dynamic objects + + their emitters, unattached emitters, water) draw relative to the gated + depth clear and the exit seals; (c) how does the ONE alpha list drain + (which flush sites, what depth is in place at each); (d) what depth + does the frame hold at the aperture and at the vista at final-drain time. + +2. **Read the cathedral's actual geometry from the installed DATs** + (`%USERPROFILE%\Documents\Asheron's Call\`, DatCollection is the + in-tree reader; `references/ACViewer` is a rendering oracle): + landblock `0xF418` — the LandblockInfo object list, the EnvCells + `0x0100`-`0x0115`-ish (esp. `0x0104`/`0x0105`/`0x0106`), their portal + polygons (which are exits, flag 0x4 → other_cell 0xFFFF), their + stab lists (the falls objects: local static ids `0x4F418012-15` were + observed as the falls' particle owners; setup/gfx ids of waterfall + objects), and where the water surface geometry lives. Establish: + are the falls objects EnvCell stabs, landblock objects, or both? + What shape/extent are the exit portal polygons vs the real visible + opening (the prior campaign claims they are thin "seam bands")? + +3. **Audit our implementation against that reconstruction**, at BOTH + `37febd1f` (baseline) and `bb9212c7` (HEAD). The relevant code: + `src/AcDream.App/Rendering/Walk/` (RetailFrameWalk, WalkPView, + WalkFrameDriver, WalkViews, WalkScreenClip, WalkProductionWorldData), + `src/AcDream.App/Rendering/RetailPViewRenderer.cs`, + `RetailPViewPassExecutor*.cs`, `ClipFrameAssembler.cs`, + `ClipPlaneSet.cs`, `ParticleRenderer.cs`, `RetailAlphaQueue.cs`, + `PortalVisibilityBuilder.cs` (the legacy visibility layer FW4 is + deleting), `Scene/RenderScenePViewFrameProduct.cs`. + +4. **Judge the six fix commits individually** — each claims a retail + citation; decide keep / revert / wrong-mechanism for each: + - `37febd1f` FW4 slice 1 — interior outside-view slices from the walk + (was: old PortalVisibilityBuilder slices; also fixed punch-fan index + aliasing). + - `c40aecfc` slice 2 — exit seals stamp the walk's own flood. + - `5f7ccdea` slice 3 — outside-stage predicate reads the walk flood. + - `f3a03efc` slice 4 — exit-plane straddler DYNAMICS' particles emit + pre-clear once (was: deliberately last-pass). + - `0d6cd5c0` slice 5 — straddling CELL-STATIC particles emit pre-clear + (retail shadow-cell rule claim). + - `bb9212c7` slice 6 — interior roots draw terrain+sky UNCLIPPED + (view-culled only), one terrain turn (was: per-exit-view + scissor+clip slices). + Evidence from the live probes is in + `%LOCALAPPDATA%\Temp\fw3-*.log` and `%LOCALAPPDATA%\Temp\fw4-*.log` + (`[walk-root]`, `[walk-part]`, `[walk-alpha]`, `[walk-dyn]`, + `[walk-portal]`, `[walk-emit]` lines; the probe is + `ACDREAM_PROBE_WALK_ROOT`, documented in `docs/launch-options.md`). + +5. **Explain why the symptom survived all six fixes**, and produce a + concrete, mechanism-first fix plan (what to change, where, what retail + evidence pins it, and what a falsifiable test/probe for it looks like + BEFORE any code is written). + +## Required background reading (in this order) + +1. `claude-memory/project_pview_visibility_campaign.md` (the #456 + campaign memory — the proven mechanism model, the do-not-retry list; + note: `claude-memory/` is a junction in the MAIN repo root at + `C:\Users\erikn\source\repos\acdream\claude-memory\`; the same files + are at `C:\Users\erikn\.claude\projects\C--Users-erikn-source-repos-acdream\memory\`) +2. `docs/plans/2026-08-30-campaign-fw-frame-walk.md` (the active + campaign plan — stages FW0-FW6, the FW1 conformance status, the FW4 + slice log) +3. `claude-memory/project_render_pipeline_digest.md` (render SSOT + + DO-NOT-RETRY table) +4. `docs/research/2026-08-30-fw-walk-oracle/` (the ten retail cdb traces + the walk is conformance-tested against) +5. `docs/plans/2026-08-30-pview-visibility-campaign.md` (the abandoned + PView campaign — what was tried and refuted) + +## Hard rules + +- The decomp is ground truth; ACE/ACViewer/WorldBuilder are interpretation + aids. Where sources disagree, the decomp wins. +- Do not propose workarounds (suppression flags, grace periods, + symptom-site early-outs). Root mechanisms only. +- Respect the do-not-retry lists in the memory docs (e.g., depth stamps as + "retail's mechanism" is decomp-refuted; the panels are portal polys, not + inert decoration). +- Every claim in your report needs a citation: a decomp address, a DAT + field, a file:line in our tree, a probe-log line, or a commit SHA. +- If you cannot verify a claim, say so explicitly — an honest "unverified" + beats a plausible guess. This investigation has already burned six fix + rounds on plausible guesses. + +## Deliverable + +Write your full report to: **`docs/research/2026-08-30-cathedral-review-.md`** +(replace `` with your model name, e.g. `fable`, `opus`, +`external`). Structure: Executive verdict (≤10 lines) → Retail frame +reconstruction → DAT geometry findings → Divergence table (ranked) → +Per-commit verdicts → Why the symptom survived → Recommended fix plan → +Open questions. Length: as long as it needs to be; completeness beats +brevity. diff --git a/docs/research/2026-08-30-cathedral-synthesis.md b/docs/research/2026-08-30-cathedral-synthesis.md new file mode 100644 index 00000000..e41cd3bb --- /dev/null +++ b/docs/research/2026-08-30-cathedral-synthesis.md @@ -0,0 +1,155 @@ +# Cathedral rendering — the seven-report synthesis and adjudicated plan + +2026-08-30. Synthesizes: the fable review, the opus review, the external +model review (owner-supplied), the code+probe-log audit, the DAT-format +report, the F418 DAT-geometry report, and the retail decomp +reconstruction (`2026-08-30-cathedral-review-*.md`). Where reports +disagreed, the adjudication below names the winner and the evidence. + +## Adjudications (the disagreements, settled) + +1. **Root kind at the terrace.** The fable review said "retail never + roots interior at the terrace" (top-level free traces: zero DI); the + external review cited `DI f4180104, ov=1, n=1`. BOTH are right about + different captures: `posed/terrace-center.log` (the defect pose) shows + 39× `DI f4180104` + `DC ov=1 n=1`; the top-level free captures rooted + outdoor. VERDICT: retail roots interior at our defect pose, with a + ONE-CELL flood and healthy exit views. The divergence to chase is the + FLOOD SHAPE and the exit-view survival, not the root kind. +2. **The falls' identity.** Opus said cell-0x106 stabs; the DAT-geometry + report proves the falls emitters are OUTDOOR LANDBLOCK OBJECTS + (0xCF418000–13: 7 east jets Setup 0x0200085A, 7 north jets 0x02000859, + 6 lake mist 0x020003C5), and 0x4F418012–15 are cell 0x106's TORCHES + + prop + plant. VERDICT: DAT-geometry wins (byte-exact parse); slice 5 + moved torches — the in-cathedral particle regression. Confirmed by + the external review. Residual: trace the 0xC owners' live route + (never directly observed in any probe — instrumentation step 1). +3. **"Thin authored seam bands."** REFUTED by the DAT: all exits at + 0x104/0x106 are full-size (10.72×10.20 m facades, 24×9.2 m arches). + Thin/empty exit views (the 66 ov==0 frames) are OUR + projection/clip/traversal loss. The REAL seam: 0x104's south exit and + 0x106's north exit are the SAME coincident rectangle at y=48, EACH + authored exit-to-outside — two abutting buildings; retail cannot + flood between these cells (they meet only through 0xFFFF portals). +4. **"Retail gates clear+seals on ov>0."** Refined by the decomp + reconstruction: the WHOLE landscape→drain→stamp→clear→seals block is + inside `ov > 0` (pc:432715), and the depth clear is additionally a + ONE-FRAME LATCH armed by the previous frame's seals + (`portalsDrawnCount`, pc:432725-32). Ours emits clear+seals + unconditionally — divergence confirmed, mechanism refined. +5. **"Stale color."** Retail full-clears COLOR+depth every frame at + BeginScene (Clear(7), pc:68673-86). Whether our ov==0 frames show + stale color depends on our world-pass color-load behavior — + UNVERIFIED; the instrumentation phase settles it. Either way the + ov==0 frames are wrong (retail has ov=1 at those poses). + +## The frame truth (retail, interior root — the decomp reconstruction) + +See `2026-08-30-cathedral-review-decomp.md` for the full pc-cited version. +Load-bearing facts: +- TWO PViews: the root's (draw_landscape=1) and the look-ins' + (draw_landscape=0, ov always 0) — look-in floods are ISOLATED from the + root flood and never trigger landscape/clear/seals. +- Landscape (sky, terrain in_view-culled + drawn whole, buildings with + punches + look-in interiors, outdoor objects INCLUDING the falls + emitters' parts) all draws PRE-clear; the full alpha drain at + pc:432720 resolves outdoor translucency vs outdoor depth. +- m_nFrameStamp re-arms mid-frame (pc:432722): straddling parts draw in + BOTH scopes. "Emit once" is anti-retail. +- z-only clear (latch-gated) → exit seals: EVERY 0xFFFF portal of EVERY + flooded cell, TRUE depth, DEPTHTEST_ALWAYS + write, invisible fan, + clipped to the installed view. +- Interior shells (whole, once, z-test only) → interior objects/emitters + (per-view sphere-cull, whole) → final drain vs interior+seal depth. +- Alpha lists: two FIFOs, NO sort at flush; order = the walk + + per-cell CYpt insertion sort. Full-flush sites: DrawBuilding (0f!), + DrawCells pre-clear, RenderNormalMode final; DrawBlock's per-cell + 0.75 pressure valve (BN misread resolved — it DOES fire). +- ShouldDrawParticles = UPDATE-time NoDraw (distance; cell test VACUOUS + for interior emitters — CEnvCell inherits constant PARTIALLY_INSIDE, + PDB-verified ICF fold @0x005269f0). + +## Why six fixes failed (unanimous) + +Slices 1–3+6 repaired real seams of the hybrid renderer; slices 4–5 +acted on a misidentified target (torches ≠ falls) with an invented +mechanism (sphere-straddle) — and no round measured depth at the +artifact pixels or verified the target's identity against the DAT before +editing. The two live defect mechanisms (the ov==0 frames; the missing +degrade admission for marker anchors) were never in any slice's scope. + +## Per-commit ledger (final) + +- 37febd1f slice 1 — KEEP (transitional; the walk owns outside views; + fixed real punch-fan index aliasing). +- c40aecfc slice 2 — KEEP the rule (seal the walk's flood); REWORK: use + the walk cell's installed views for the clip, not legacy per-cell + slices/no-clip fallback (plan step 4). +- 5f7ccdea slice 3 — KEEP mechanically for now; REWORK: VisitedCells is + a union of root flood + look-ins — retail stages those differently + (plan step 2 splits the sets and re-sources the predicate). +- f3a03efc slice 4 — REVERTED (7f500b97). +- 0d6cd5c0 slice 5 — REVERTED (7f500b97). +- bb9212c7 slice 6 — KEEP the one-turn/no-hard-clip principle; FIX: the + interior terrain currently uses the full camera frustum — restore + retail's in_view landcell culling under the active exit views + (draw_check_blocks @0x00505f80) (plan step 8). + +## The plan (instrument-first; each step gated) + +PHASE I — instrumentation (NO rendering edits): +1. **Falls-owner trace**: watch owners 0xCF418000–13 live — route + (outdoor-static vs other), walk turn, submission phase, drain point, + projected bounds/depth. Never infer identity from aggregate sets + again. +2. **Depth checkpoints**: read back depth at one known-bad pixel after + terrain / around punches / before the pre-clear drain / after clear / + after seals / before the final drain. Distinguishes missing terrain + depth vs punch overwrite vs clear/seal mis-gating vs particle depth + state. +3. **Pose conformance**: drive OUR walk at posed/terrace-center's exact + camera. Retail truth: DI f4180104, root flood n=1, ov=1, and separate + look-ins. Compare our root flood size, exit-view survival, and the + VisitedCells composition (root vs look-in members). If we produce + ov=0 or a multi-cell ROOT flood there, fix WalkPView + projection/side/clip math FIRST — the F67–79 foundry residue is the + same family, and the coincident y=48 double-exit plane is the prime + suspect surface. + +PHASE II — decomp-pinned repairs (one at a time, each with a falsifiable +prediction and a connected check): +4. Split the stage sets: InteriorFloodCells (root flood, post-clear) / + look-in cells (pre-clear, landscape scope) / VisitedLandscapeCellIds — + delete every union-based stage decision (incl. slice 3's predicate + source and the cell-owners particle union). +5. Gate clear+seals as retail does (the ov>0 block; note the seal-latch + nuance for the clear). +6. Seals from the walk cell's installed views (drop the legacy clip + borrow + unclipped fallback). +7. Retail particle staging: emitters draw at their owner cell's actual + walk turn; adopt the frame-stamp boundary (mid-frame re-arm) so + straddling parts draw in both scopes; delete SphereStraddlesExitPlane. +8. Alpha parity: DrawBuilding barrier = FULL flush; the queue preserves + insertion order (remove the global distance sort); keep the 0.75 + per-cell valve semantics. +9. Terrain: whole + unclipped (slice 6) but culled by the walk's + in_view landcell set (draw_check_blocks port). +10. Re-land the runtime-hidden degrade admission for outdoor objects + (the stalks = drawn never-drawn marker anchors; fce250ec is NOT an + ancestor of this branch). If a stalk survives, log its live + GUID→Setup→GfxObj chain. + +PHASE III — FW4 completion: delete the legacy PortalVisibilityBuilder +production role, legacy clip frames/viewcone feeds, packed dynamic +routes; the walk becomes the sole frame-decision owner; architecture doc +updated (it currently overstates single ownership). + +## Open questions carried + +- Depth at the leaking pixel pre-drain (Phase I.2 answers). +- The 0xC falls owners' actual live route (Phase I.1 answers). +- Why full-size authored portals yield thin/zero views at some poses + (Phase I.3 localizes; the fix lands in WalkPView). +- Our world-pass color-load behavior (stale color vs black on ov==0). +- Seal/punch clip equivalence vs retail setup_view+polyClipFinish. +- The ~1.5 MB/frame walk alloc tail (FW6). diff --git a/docs/research/2026-08-30-fw-flood-pseudocode-appendix.md b/docs/research/2026-08-30-fw-flood-pseudocode-appendix.md new file mode 100644 index 00000000..a6e65879 --- /dev/null +++ b/docs/research/2026-08-30-fw-flood-pseudocode-appendix.md @@ -0,0 +1,703 @@ +# FW1 flood decomp-read appendix - raw extraction reports (2026-08-30) + +Second read round: the interior-flood and view-support functions. Same method as the first appendix (BN pseudo-C, Ghidra-arbitrated where flagged). + +## Report 1 - Flood bookkeeping (InitCell / InsCellTodoList / GetVisible / curr_view_push) + +### PView::InitCell @0x005a4b70 + +**Summary:** Initializes the cell's TOP portal_view slot (portal_view.data[num_view-1]) for the flood: stamps view_timestamp = master_timestamp, clears cell_view_done, grows the per-portal portal_info array to num_portals, classifies every portal as in-view (inflag) or rejected via a cell-local viewpoint-vs-portal-plane side test, computes max_indist = max SQUARED viewpoint distance to any in-view portal vertex, and marks every rejected portal seen=1 so the flood never traverses it. The entry portal (real index; 0xffff sentinel never matches) is forced inflag=1 + seen=1 instead of side-tested. + +```c +int PView::InitCell(CEnvCell* cell, uint16 entry_portal_idx) // Ghidra: returns int; BN said void +{ + slot = cell->portal_view.data[cell->num_view - 1]; // TOP recursion slot + if (slot->view_count == 0) return 0; // no views on this cell -> nothing to do + + Render::positionPush(3, &cell->pos); // install CELL frame: viewpoint below is CELL-LOCAL + slot->cell_view_done = 0; + slot->view_timestamp = PView::master_timestamp; + if (slot->portal.sizeOf < cell->num_portals) + DArray::grow(&slot->portal, cell->num_portals); // exact-size; NEW entries UNINITIALIZED + + float max_d2 = 0.0f; + int any_rejected = /*UNINITIALIZED stack dword — see gotchas*/; + + for (i = 0; i < cell->num_portals; i++) { // CCellPortal stride 0x18 + CPolygon* poly = cell->portals[i].portal; + if (i == entry_portal_idx && slot->portal.data[i].inflag == 0) { + // entered-through portal: forced visible + consumed (0xffff seed sentinel never hits this) + slot->portal.data[i].inflag = 1; + slot->portal.data[i].seen = 1; + } else { + slot->portal.data[i].seen = 0; + // side of cell-local viewpoint vs portal plane (CPolygon.plane @ +0x20) + float d = plane.N.x*vp.x + plane.N.y*vp.y + plane.N.z*vp.z + plane.d; + int side; // 0=POSITIVE, 1=NEGATIVE + if (d > F_EPSILON) side = 0; // F_EPSILON = 0.000199999995f + else if (d < -F_EPSILON) side = 1; + else { slot->portal.data[i].inflag = 0; any_rejected = 1; goto vertex_scan; } // IN_PLANE: always reject + if (side != cell->portals[i].portal_side) + slot->portal.data[i].inflag = 1; // viewer on the see-through side + else { slot->portal.data[i].inflag = 0; any_rejected = 1; } // viewer on the portal's own side + } +vertex_scan: + if (slot->portal.data[i].inflag == 1 && poly->num_pts > 0) // num_pts = byte @ +0xe + for each CVertex* v in poly->vertices[0..num_pts) { // vertices = CVertex** @ +0 + d2 = (vp.x-v.x)^2 + (vp.y-v.y)^2 + (vp.z-v.z)^2; // SQUARED, cell-local, no sqrt + if (max_d2 < d2) max_d2 = d2; + } + } + slot->max_indist = max_d2; // max squared distance to any in-view portal vertex + + if (any_rejected != 0 && slot->view_count > 0) + for (v = 0; v < slot->view_count; v++) { + Render::set_view(&slot->view, v); // installs global active view; the check below does NOT read it + for (j = 0; j < cell->num_portals; j++) + if (portal[j].inflag == 0 && portal[j].seen == 0) + portal[j].seen = 1; // rejected portals become 'consumed': flood never walks them + } + + slot->update_count = slot->view_count; + Render::positionPop(); + return 1; +} +``` + +**Gotchas:** BN body @0x005a4b70 is UNUSABLE: it scrambled the x87 side-test control flow AND elided the squared-distance math (showed only the z subtraction). This model is Ghidra-verified (127.0.0.1:8081). Confirmed semantics: side==portal_side rejects, IN_PLANE (|d|<=0.000199999995f) always rejects — matches the FW doc's sidedness table. Real retail quirks: (1) any_rejected (local_4) is NEVER initialized — if no portal is rejected it reads stack garbage; the effect is benign (the fixup inner body no-ops when nothing was rejected; only side effect is redundant set_view churn), so a port should init it to 0 with identical observable behavior. (2) The entry-portal branch is guarded by the STALE inflag (inflag==0) — on a freshly grown portal array inflag is heap garbage (DArray::grow does NOT zero new entries); the caller (AddViewToPortals) presumably establishes it — verify that contract when porting FW3. (3) set_view inside the fixup loop installs each view globally but nothing in the loop consults it, and the LAST view stays installed on exit — both decompilers agree; purpose unclear (possibly vestigial). (4) positionPush(3, cell->pos) means the plane test and max_indist run in CELL-LOCAL coordinates. (5) 0xffff sentinel: ushort zero-extended vs uint loop index — never matches, so the seed cell side-tests every portal. (6) max_indist is a SQUARED distance — todo-list keys fed from it are squared; comparisons stay consistent. Ghidra return type is int (0 = early-out on view_count==0, 1 = did work); BN said void __stdcall. + +### PView::InsCellTodoList @0x005a4f50 + +**Summary:** Sorted insert into the flood todo list. Keeps cell_todo_list ordered NON-INCREASING by float distance from index 0: index 0 = FARTHEST, END = NEAREST. The new entry sinks toward index 0 past every entry with dist <= its own and stops under the first STRICTLY greater one. Since the flood pops from the END, pop order is SMALLEST-key-first (nearest-first traversal); ties pop FIFO (older equal entries first). 8-byte {cell,dist} nodes are lazily allocated once and recycled across floods; grow is batched +30 with explicit zero-fill of new slots. + +```c +void PView::InsCellTodoList(CEnvCell* cell, float dist) +{ + n = this->cell_todo_num; + if (n >= cell_todo_list.sizeOf) { + DArray::grow(&cell_todo_list, n + 0x1e); // +30; grow sets sizeOf to EXACTLY n+30 + for (k = this->cell_todo_num; k < cell_todo_list.sizeOf; k++) + cell_todo_list.data[k] = 0; // zero-fill ALL new slots (lazy-node contract) + } + if (cell_todo_list.data[n] == 0) + cell_todo_list.data[n] = new CellListType{cell=0, dist=0}; // 8 bytes; alloc-once, recycled, never freed here + node = cell_todo_list.data[n]; + node->cell = cell; node->dist = dist; + + pos = n; + while (pos > 0) { + prev = cell_todo_list.data[pos - 1]; + if (dist < prev->dist) break; // STRICT less stops the sink [GHIDRA polarity — BN was INVERTED] + cell_todo_list.data[pos] = prev; // shift the <=-dist entry toward the END + pos--; + } + cell_todo_list.data[pos] = node; + this->cell_todo_num++; +} +``` + +**Gotchas:** LOAD-BEARING BN INVERSION: BN's x87 flag mush (test ah,0x5) read as shift-while-LESS, which would produce an ascending list and a farthest-first pop. Ghidra (authoritative, verified live) shows `if (dist < prev->dist) break` — shift while dist >= prev->dist — descending list, END = nearest, pop-from-END = NEAREST-first flood. This reconciles exactly with DrawCells walking cell_draw_list from the end for far-to-near: cells append to the draw list in pop order (near->far), so end-first walk = far-to-near. Ties: equal-dist predecessors get shifted (>= shifts), so the newcomer lands closer to index 0 and pops AFTER existing equals — FIFO among ties (seed at dist 0 always pops first). No dedup: the same cell can be enqueued multiple times; dedup is the caller's job (ConstructView/AddViewToPortals). Nodes are pointer-recycled and permuted by the shift, never freed; the explicit zero-fill after grow is what makes the data[n]==0 lazy-alloc test sound (DArray::grow itself does NOT zero and sets sizeOf to exactly the requested count — the +30 batching is caller-side). + +### CEnvCell::GetVisible @0x0052dc10 + +**Summary:** Static resident-cell registry lookup: walks the bucket chain of CEnvCell::visible_cell_table (intrusive hash keyed by cell id, bucket = (uint64)cell_id % numBuckets) and returns the CEnvCell* whose node key matches, or null if the cell is not currently loaded/visible. Node layout {key @+0, next @+4, CEnvCell* value @+8}. + +```c +static CEnvCell* CEnvCell::GetVisible(uint32 cell_id) +{ + for (node = visible_cell_table.m_intrusiveTable.m_buckets[(uint64)cell_id % m_numBuckets]; + node != 0; node = node->next) // next @ +4 + if (node->key == cell_id) // key @ +0 + return node->value; // CEnvCell* @ +8 + return 0; +} +``` + +**Gotchas:** Trivial and unambiguous; both decompilers agree. BN's COMBINE(0, arg1) is just unsigned zero-extension of the 32-bit key for the modulo. The redundant post-match null re-check in both decomps (BN 'if (i != 0)' / Ghidra's second null test) is decompiler noise from the shared return path — one lookup, no side effects. + +### CEnvCell::curr_view_push @0x005a5090 + +**Summary:** Pushes one view-recursion level onto the cell: ensures portal_view has a slot at index num_view (exact-size grow to num_view+1, nulling just the ONE new slot), lazily allocates a 0x48-byte portal_view_type on first use (three empty DArrays with blocksize 0x80: portal_info list, view.poly, view.vertex; view_timestamp=0), then unconditionally resets EXACTLY three counters — view_count=0, update_count=0, view_timestamp=0 — and increments num_view. Slots are recycled across frames (never freed here); their DArrays keep capacity. + +```c +void CEnvCell::curr_view_push() +{ + if (num_view >= portal_view.sizeOf) { + DArray::grow(&portal_view, num_view + 1); // grow sets sizeOf EXACTLY num_view+1 + portal_view.data[num_view] = 0; // null only the single new slot + } + if (portal_view.data[num_view] == 0) { // lazy first-use alloc + s = operator new(0x48); + if (s) { + s->portal = {data=0, blocksize=0x80, next_available=0, sizeOf=0}; // DArray + s->view.poly = {data=0, blocksize=0x80, next_available=0, sizeOf=0}; + s->view.vertex = {data=0, blocksize=0x80, next_available=0, sizeOf=0}; + s->view_timestamp = 0; + // NOT initialized: view.vertex_count_total, max_indist, view_count, cell_view_done, update_count + } + portal_view.data[num_view] = s; + } + slot = portal_view.data[num_view]; + slot->view_count = 0; + slot->update_count = 0; + slot->view_timestamp = 0; + num_view += 1; +} +``` + +**Gotchas:** VERIFIES the earlier read: num_view++ with 0x48-byte lazy slot alloc + counter resets — with precision: exactly view_count/update_count/view_timestamp are reset on EVERY push (fresh or recycled); cell_view_done and max_indist are NOT reset here and stay stale (heap garbage on a brand-new slot) until PView::InitCell writes them — InitCell always runs before they are consumed, but a port must preserve that ordering or zero them harmlessly. The single-slot null after grow is sound only because this DArray grow(n) sets sizeOf to EXACTLY n (verified @0x005a45d0: copies old, sizeOf=arg; blocksize unused by grow; grow with arg<=sizeOf delegates to shrink) — no hidden capacity slack, so no garbage slots. portal_view_type layout confirmed in acclient.h: {DArray portal @0; view_type view @0x10 (vertex_count_total, poly@0x14, vertex@0x24); max_indist @0x34; view_count @0x38; cell_view_done @0x3c; view_timestamp @0x40; update_count @0x44}; DArray = {data, blocksize, next_available, sizeOf}. + +**Report notes:** All four bodies cross-checked against live Ghidra MCP (http://127.0.0.1:8081, patchmem.gpr) — mandatory here, because BN got two of them materially wrong: (1) InsCellTodoList's insertion comparison was polarity-INVERTED in BN (would have modeled a farthest-first pop); Ghidra's strict `dist < prev->dist` break gives a descending-from-index-0 list whose END-pop is NEAREST-first, which is what makes the draw list come out near->far and DrawCells' end-first walk far-to-near — consistent with FW doc section 5. (2) InitCell's BN body scrambled the plane-side branches and elided the dx^2+dy^2+dz^2 accumulation entirely (showed a bare z subtraction). Ghidra-confirmed model: side 0/1 vs portal_side rejects on equality, IN_PLANE always rejects (matches the doc's section 7 sidedness table), max_indist = max SQUARED cell-local distance to in-view portal vertices, and rejected portals get seen=1 in a fixup pass whose per-view set_view calls are side-effect-only. Two genuine retail quirks worth register-awareness if ported observably: InitCell's any_rejected flag is an uninitialized stack read (benign in effect), and the entry-portal force-visible branch keys off STALE inflag whose state is a caller contract (read PView::AddViewToPortals before relying on it in FW3). Struct authorities verified in acclient.h: portal_info {seen, inflag}; portal_view_type (0x48 bytes, field offsets in the curr_view_push gotchas); PView {outside_view, draw_landscape, outdoor_portal_list, cell_draw_list, cell_draw_num, cell_todo_list, cell_todo_num, lscape}; CellListType nodes are 8-byte {CEnvCell* cell, float dist}; CPolygon {vertices@0, num_pts byte@0xe, plane@0x20}. Sources: docs/research/named-retail/acclient_2013_pseudo_c.txt lines 311378-311393, 432896-433045, 433183-433243, 433279-433320; DArray grow/shrink @0x005a45d0 region; struct defs in docs/research/named-retail/acclient.h (portal_info @32458, portal_view_type @32346, view_type @32338, PView @45934, CPolygon @31855). + +## Report 2 - Flood propagation (ClipPortals / AddViewToPortals) + +### PView::ClipPortals @0x005a5520 + +**Summary:** Per popped flood cell: pass 1 scans the cell's top portal_view flags (seen && inflag!=1) and lazily resolves neighbor pointers via CEnvCell::GetVisible; returns 0 if no portal is live. Pass 2, in the cell's frame, installs each view in [start_view, view_count) and clips every live portal polygon (GetClip, do_clip=1). Survivors are appended to the neighbor's top portal_view (double-clipped via OtherPortalClip when exact_match==0 && other_portal_id>=0), or into this->outside_view for portals leading outdoors. Returns 1 when any portal was live. + +```c +int PView::ClipPortals(CEnvCell* cell, uint start_view /*first view index to process; 0 from ConstructView@005a5845, top->update_count from AdjustCellView@005a5796*/) +{ + portal_view_type* top = cell->portal_view.data[cell->num_view - 1]; // cell's current (top) view slot + Render::PortalList = top; // GLOBAL set unconditionally, before any early-out + int any_live = 0; + if ((int)cell->num_portals <= 0) return 0; // signed + + // ---- pass 1: which portals are live; resolve+cache neighbor pointers ---- + for (int j = 0; j < (int)cell->num_portals; j++) { // CCellPortal stride 0x18 + portal_info* pi = &top->portal.data[j]; // {seen@+0, inflag@+4} + if (pi->seen != 0 && pi->inflag != 1) { + CCellPortal* p = &cell->portals[j]; + if (p->other_cell_ptr == null && p->other_cell_id != 0xFFFFFFFF) { + p->other_cell_ptr = CEnvCell::GetVisible(p->other_cell_id); // cached into the portal record + if (p->other_cell_ptr == null) continue; // neighbor not visible/loaded => not live + } + any_live = 1; // live: ptr already set, OR id==0xFFFFFFFF (outdoors), OR GetVisible succeeded + } + } + if (!any_live) return 0; + + // ---- pass 2: clip every live portal against each view in the window ---- + Render::positionPush(3, &cell->pos); // enter the cell's frame + for (uint i = start_view; (int)i < (int)top->view_count; i++) { // signed compare + Render::set_view(&top->view, i); // install view i (CPU globals only) + for (int j = 0; j < (int)cell->num_portals; j++) { + portal_info* pi = &top->portal.data[j]; + if (pi->seen == 0 || pi->inflag == 1) continue; + CCellPortal* p = &cell->portals[j]; + uint n; + PView::GetClip(this, (Sidedness)p->portal_side, p->portal, clip_view /*global out buffer*/, &n, 1 /*do_clip*/); + if (n == 0) continue; // portal fully clipped away in this view + if (p->other_cell_id == 0xFFFFFFFF) { // ---- portal leads OUTDOORS ---- + if (this->draw_landscape != 0) { + if (cliplandscape != 0) + Render::copy_view(&this->outside_view, clip_view, n); // exit view = the clipped portal shape + else + Render::copy_view(&this->outside_view, null, 0); // null-src marker view (see gotchas) + } + } else if (p->other_cell_ptr != null) { // ---- portal into a resolved neighbor ---- + if (p->exact_match == 0 && (int)p->other_portal_id >= 0) { // far poly differs => double clip + if (PView::OtherPortalClip(this, p, clip_view, &n) == 0) { + Render::set_view(&top->view, i); // restore after far-frame excursion; nothing survived + continue; + } + Render::set_view(&top->view, i); // restore; clip_view/n now the doubly-clipped poly + } + CEnvCell* nb = p->other_cell_ptr; + if (nb->num_view != 0) // neighbor must have a pushed view slot (add_views/stab_list) + Render::copy_view(nb->portal_view.data[nb->num_view - 1], clip_view, n); // append to NEIGHBOR top view + } + // else: id != 0xFFFFFFFF and neighbor unresolved => clipped view silently dropped + } + } + Render::positionPop(); + return 1; // 1 = some portal was live, even if the view window [start_view, view_count) was empty +} +``` + +**Gotchas:** BN's body is type-mushed garbage here (`esi_2->vtable` stands for BOTH top->portal.data and the view_count loop bound; `m_timeStamp` = top->view @+0x10) — this model is Ghidra-arbitrated (127.0.0.1:8081, matches doc §9 practice). Render::PortalList is set BEFORE the early-outs, so the global still points at this cell's top view even on return 0. The cliplandscape==0 arm calls copy_view(&outside_view, null, 0) — doc §6 documents copy_view(dest,null,4)=full-viewport quad; whether count 0 vs 4 matters must be verified in Render::copy_view's body before porting that arm. Loop/window compares are SIGNED ints. Ghidra names the pop positionPop, BN framePop — same paired call. draw_landscape==0 discards exit-portal views entirely (outside_view never raised). + +### PView::OtherPortalClip @0x005a5400 + +**Summary:** The double-clip helper for non-exact_match portals (the task's ~0x005a5495 temp_view + copy_view site). Snapshots the near-clipped polygon into a lazily-initialized function-static temp_view (view 0), enters the FAR cell's frame, installs that snapshot as the active view, and re-clips against the far cell's own matching portal polygon (portals[other_portal_id]) with INVERTED sidedness (pass 1 iff far portal_side==0). Writes the result back through clip_view/count; returns count!=0. + +```c +int PView::OtherPortalClip(CCellPortal* p, Vec2Dscreen** clip_view, int* n) +{ + static portal_view_type temp_view; // guard-bit lazy init ($S225): all 3 DArrays {data=0,sizeOf=0,next_available=0,blocksize=0x80}, view_timestamp=0, atexit dtor + temp_view.view_count = 0; // reset EVERY call + if (Render::copy_view(&temp_view, clip_view, *n) == 0) // snapshot the near-clipped poly as temp view 0 + return 0; // rejected (<3 survivors per copy_view rules) + int opid = p->other_portal_id; + CCellPortal* far = &p->other_cell_ptr->portals[opid]; // far cell's OWN portal entry + Render::positionPush(3, &p->other_cell_ptr->pos); // enter the FAR cell's frame + Render::set_view(&temp_view.view, 0); // install the snapshot as the active view + PView::GetClip(this, (Sidedness)(far->portal_side == 0 ? 1 : 0), // INVERTED vs the far cell's declared side + far->portal, clip_view, n, 1 /*do_clip*/); // result written back through clip_view/n + Render::positionPop(); + return *n != 0; +} +``` + +**Gotchas:** The sidedness inversion is a literal `== 0` test, NOT a 0<->1 swap: a far portal_side of 2 (IN_PLANE) would pass POSITIVE(0) — in-data values should only be 0/1, but don't port it as XOR. temp_view is one shared static (single-threaded renderer; not reentrant). BN's `int80_t` return / `result` from copy_view is FPU-tracking mush — Ghidra confirms the return is exactly (*n != 0), with an early return 0 when the snapshot copy_view fails. Only called when exact_match==0 && other_portal_id>=0, so far indexing is safe. + +### PView::AddViewToPortals @0x005a52d0 + +**Summary:** Runs after ClipPortals(cell,...) returned 1: schedules neighbors that just received views. For each portal with a resolved neighbor, live source flags (seen && inflag!=1), and a nonempty neighbor top view: first touch (update_count==0) => InitCell + InsCellTodoList keyed by the neighbor top view's max_indist (+0x34); duplicate reach with NEW views (update_count!=view_count) => AddToCell, plus FixCellList re-place/re-clip when the neighbor was already marked cell_view_done, then update_count=view_count; no new views => skip entirely. Finally SetOtherSeen marks the neighbor's back-portal when other_portal_id>=0. + +```c +void PView::AddViewToPortals(CEnvCell* cell) +{ + for (uint j = 0; j < cell->num_portals; j++) { // unsigned compare; CCellPortal stride 0x18 + CCellPortal* p = &cell->portals[j]; + CEnvCell* nb = p->other_cell_ptr; // null for outdoor portals + unresolved neighbors + portal_info* pi = &cell->portal_view.data[cell->num_view - 1]->portal.data[j]; // SOURCE cell top-view flags (re-read each iteration) + if (nb == null || pi->inflag == 1 || pi->seen == 0 || nb->num_view == 0) + continue; + portal_view_type* nbtop = nb->portal_view.data[nb->num_view - 1]; // neighbor's top view slot + if (nbtop->view_count == 0) continue; // ClipPortals copied nothing in => nothing to schedule + + if (nbtop->update_count == 0) { + // ---- first touch this flood: schedule the neighbor ---- + if (PView::InitCell(this, nb, (uint16)p->other_portal_id) != 0) // ZERO-EXTENDED 16-bit read of the id + PView::InsCellTodoList(this, nb, nbtop->max_indist); // todo distance key = neighbor top view's max_indist (float @+0x34) + // update_count NOT set here (InitCell's business); fall through to SetOtherSeen + } else if (nbtop->update_count != nbtop->view_count) { + // ---- duplicate reach (2nd+ portal into nb) WITH new views since last processed ---- + PView::AddToCell(this, nb, (uint16)p->other_portal_id); + if (nbtop->cell_view_done != 0) // nb already popped+processed by ConstructView + PView::FixCellList(this, nb, cell); // = AdjustCellPlace(nb, cell) + AdjustCellView(nb); + // AdjustCellView@005a5770 re-runs ClipPortals(nb, nbtop->update_count) + // then AddViewToPortals(nb) => recursive incremental re-flood + nbtop->update_count = nbtop->view_count; // fresh re-read AFTER FixCellList returns (both arms) + } else { + continue; // update_count == view_count: nothing new; NO SetOtherSeen either (goto loop end) + } + + if ((int)p->other_portal_id >= 0) // FULL-WIDTH SIGNED test (sentinel -1 skips) + PView::SetOtherSeen(this, cell, j); + // SetOtherSeen@005a4e30 (verified): q = &nb->portals[other_portal_id]; + // if (q->other_cell_ptr == null) q->other_cell_ptr = cell; // backlink fill + // bp = &nbtop->portal.data[other_portal_id]; if (bp->inflag != 0) bp->seen = 1; // mark back-portal seen + } +} +``` + +**Gotchas:** TASK CORRECTION: outside_view is raised in ClipPortals, not here — outdoor portals keep other_cell_ptr null forever (GetVisible is never called for the 0xFFFFFFFF sentinel), so the nb==null gate skips them. The InitCell/AddToCell argument is a zero-extended 16-bit read of other_portal_id (both decompilers agree): id -1 => 0xFFFF, which IS ConstructView's no-through seed sentinel — coherent, but note InitCell/AddToCell DO run for such portals while SetOtherSeen (full signed int test) is skipped. In the InitCell branch, SetOtherSeen fires even when InitCell returned 0. update_count = view_count is a fresh read AFTER the FixCellList recursion returns — a portal cycle that adds views to nb during that recursion gets marked consumed (retail behavior; do not 'fix'). BN's loop-pointer prints (`arg2 = &arg2->m_pNext`, uint16 reads) are byte-offset-accumulator artifacts; Ghidra's `_padding_` expressions are equally mushed — the field decode above is offset-verified against acclient.h (other_cell_ptr +4, other_portal_id +0x10, stride 0x18; portal_view_type max_indist +0x34, view_count +0x38, cell_view_done +0x3C, update_count +0x44). + +**Report notes:** Extraction sources: docs/research/named-retail/acclient_2013_pseudo_c.txt lines 433446-433737 (BN), cross-arbitrated function-by-function against live Ghidra MCP (127.0.0.1:8081) — the BN body of ClipPortals is type-confused throughout and MUST NOT be used directly; Ghidra's decomp was clean and is the authority for all three bodies, with struct offsets independently verified against docs/research/named-retail/acclient.h (portal_view_type /* 3415 */, CCellPortal /* 3406 */, portal_info /* 3407 */, CEnvCell /* 3405 */, PView /* 4912 */ with outside_view at offset 0). Caller contract (completes doc §5): ConstructView@0x005a57b0 pops a todo cell, appends it to cell_draw_list (grow +30), sets top->cell_view_done=1, then ClipPortals(cell, 0) and — only on return 1 — AddViewToPortals(cell). The second ClipPortals call site is AdjustCellView@0x005a5770 (reached via FixCellList@0x005a5250 = AdjustCellPlace + AdjustCellView), which passes start_view = top->update_count, i.e. arg3 is the first-unprocessed-view index and the update_count/view_count pair is a consumed-views watermark: that is the whole duplicate-reach mechanism — a cell reached through a second portal only re-clips the view window [update_count, view_count). clip_view is a global Vec2Dscreen** scratch buffer shared by GetClip; Render::PortalList is a global that GetClip/DrawCells consume. The seen/inflag ORIGIN (who first sets them per view) is not in these bodies — it belongs to InitCell/AddToCell/GetClip extraction; here they are only read (gate: seen!=0 && inflag!=1) and seen is set by SetOtherSeen on the neighbor's back-portal, gated on that back-portal's inflag!=0. Open verify-before-port items: Render::copy_view(dest, null, 0) semantics in the cliplandscape==0 arm (doc §6 only documents count=4), and the far-side sidedness ==0 test if any data ever carries portal_side 2. + +## Report 3 - View-clip support (copy_view / polyClipFinish / xformStart) + +### Render::copy_view @0x0054dfc0 + +**Summary:** Appends ONE polygon view slot to a portal_view_type: perspective-divides homogeneous screen points in place, marks survivors by dropping ~1px duplicates and collinear points (three closing wrap checks included), rejects <3 survivors (returns 0, view_count untouched), caps at 31, stores pt list + closing duplicate, computes screen bounds, then per-edge WORLD planes from unprojected rays (live path: ScreenToViewTransform; N=cross(ray[k+1],ray[k]) normalized unless degenerate; d=-dot(N,viewer_world_space.viewpoint)). pts==null builds the full-viewport root quad. Returns 1 on success. + +```c +int copy_view(portal_view_type* dest, Vec2Dscreen** pts, uint npts) // Ghidra-verified; returns int (BN showed void) + vc = dest->view_count + vbase = (vc == 0) ? 0 : dest->view.vertex_count_total // FIRST view resets the vertex pool + if (vc >= view.poly.sizeOf) DArray::grow(&view.poly, vc + 0x10) + + if (pts == null) { // ---- full-viewport root quad path + n = 4; view.vertex_count_total = vbase + 5 + if (vbase+5 >= view.vertex.sizeOf) DArray::grow(&view.vertex, vbase + 0x15) + poly[vc] = { vertex_count: 4, vertex_index: vbase } + v = &view.vertex.data[vbase] // W/H = render_device->m_viewportWidth/Height (uint->float) + v[0].pt=(0,H); v[1].pt=(W,H); v[2].pt=(W,0); v[3].pt=(0,0); v[4].pt=(0,H) // closing dup + goto bounds + } + + // ---- survivor marking + keep[0]=1; n=1; last=0; stl=0 /*second-to-last kept corner*/; second=0 /*idx of 2nd kept (local_220)*/ + for (i = 0; i < npts; i++) { + p = pts[i] + if (p->w != 1.0) { p->x /= p->w; p->y /= p->w; p->w = 1.0 } // perspective divide IN PLACE (mutates caller's points) + if (i == 0) continue + distinct = |pts[i].x - pts[last].x| > 1.0 || |pts[i].y - pts[last].y| > 1.0 // strict >, vs LAST KEPT + keep[i] = distinct + if (!distinct) continue // ~1px duplicate dropped; last unchanged + if (this is only the 2nd kept point) { n++; second = i } + else { + pp = pts[stl]; prev = pts[last]; cur = pts[i] + span = max(|pp.x - cur.x|, |pp.y - cur.y|) // Chebyshev chord length + cross = (pp.x - prev.x)*(prev.y - cur.y) - (pp.y - prev.y)*(prev.x - cur.x) + if (|cross| >= span) { n++; stl = last } // prev is a genuine corner (~1px deviation test) + else { keep[last] = 0; if (second == last) second = i } // prev collinear: un-keep it; n unchanged (prev out, cur in) + } + last = i + } + // ---- closing wrap checks against pts[0] + first = pts[0] + distinct = |first.x - pts[last].x| > 1.0 || |first.y - pts[last].y| > 1.0 + keep[last] = distinct + if (!distinct) { n--; last = stl } // last duplicates first: drop it + else { + span = max(|pts[stl].x - first.x|, |pts[stl].y - first.y|) + cross = (pts[stl].x - pts[last].x)*(pts[last].y - first.y) - (pts[last].x - first.x)*(pts[stl].y - pts[last].y) + if (|cross| < span) { keep[last] = 0; n--; last = stl } // last collinear on stl->first + } + stl = last + if (second > 0) { // is point 0 itself collinear between stl and second? + span = max(|pts[stl].x - pts[second].x|, |pts[stl].y - pts[second].y|) + cross = (first.y - pts[second].y)*(pts[stl].x - first.x) - (first.x - pts[second].x)*(pts[stl].y - first.y) + if (|cross| < span) { n--; keep[0] = 0 } + } + + if (n < 3) return 0 // REJECT: nothing written, view_count NOT bumped + if (n > 0x1f) n = 0x1f // cap 31 + view.vertex_count_total = vbase + n + 1 + if (>= view.vertex.sizeOf) DArray::grow(&view.vertex, vbase + n + 0x11) + poly[vc] = { vertex_count: n, vertex_index: vbase } + v = &view.vertex.data[vbase]; j = 0 + for (i = 0; i < npts; i++) + if (keep[i]) { v[j].pt.x = fabs(pts[i].x); v[j].pt.y = fabs(pts[i].y); j++ } // REAL fabs (Ghidra-confirmed) + v[n].pt = v[0].pt // closing duplicate vertex (its plane slot never written) + +bounds: // over v[0..n-1] only + xmin=xmax=v[n-1].pt.x; ymin=ymax=v[n-1].pt.y + for (k = n-2; k >= 0; k--) { + if (v[k].x < xmin) xmin=v[k].x; else if (v[k].x > xmax) xmax=v[k].x + if (v[k].y < ymin) ymin=v[k].y; else if (v[k].y > ymax) ymax=v[k].y + } + poly[vc].{xmin,xmax,ymin,ymax} = ... + + // ---- per-edge world planes via unprojected rays (stack array ray[0..n], stride 0xc) + if (newmethod == 1) // newmethod statically = 1: this is the LIVE path + for (k = n-1; k >= 0; k--) PrimD3DRender::ScreenToViewTransform(&ray[k], v[k].pt.x, v[k].pt.y) // world ray dir @0x0059aa40 + else // DEAD legacy software fork + for (k = n-1; k >= 0; k--) { + u = v[k].pt.x * Render::xinvscale - Render::tx + w = v[k].pt.y * Render::yinvscale - Render::ty + ray[k] = Render::Xaxis*u + Render::Yaxis*Render::vdst - Render::Zaxis*w + } + ray[n] = ray[0] // closing duplicate ray + for (k = n-1; k >= 0; k--) { + N = cross(ray[k+1], ray[k]) // NOTE ORDER: next x current + if (|N.x| >= F_EPSILON || |N.y| >= F_EPSILON || |N.z| >= F_EPSILON) // F_EPSILON = 0.000199999995f + N *= 1.0f / sqrt(N.x^2 + N.y^2 + N.z^2) // else left tiny/unnormalized (degenerate edge, no reject) + v[k].plane.N = N // view_vertex = {Vec2D pt; Plane plane} stride 0x18 + v[k].plane.d = -dot(N, Render::viewer_world_space.viewpoint) // edge k = screen verts k -> k+1 + } + dest->view_count += 1 + return 1 +``` + +**Gotchas:** BN body is heavy x87-flag mush; every branch here is Ghidra-cross-checked (8081/patchmem). (1) MUTATES the caller's points (in-place perspective divide). (2) The vertex copy applies REAL fabs to x,y — harmless post-clip (coords in-viewport up to rounding) but real. (3) Cap-31 quirk: if >31 survive, the copy loop still writes ALL survivors, then the closing dup overwrites index 31 — corrupt polygon; unreachable from the <=32-vert callers but not guarded. (4) Plane N = cross(ray[k+1], ray[k]) — the fw-walk doc §6 summary says cross(ray_i, ray_i+1), i.e. NEGATED; decomp order is next-x-current. (5) The corner-keep boundary is |cross| >= span per Ghidra (consistent at all 3 sites); BN rendered strictness ambiguously. (6) newmethod is statically 1 with no other write found — ScreenToViewTransform is the live unproject; the Xaxis/vdst fork is dead. (7) Grow checks are '>= sizeOf' with +0x10 slack. (8) Returns int 0/1 (BN showed void); reject leaves dest completely untouched. + +### ACRender::polyClipFinish @0x006b6d00 + +**Summary:** Sutherland-Hodgman clip of a homogeneous screen polygon (array of Vec2Dscreen pointers) against the INSTALLED view: first the w >= cdstW plane (cdstW = 0.000199999995f), then each edge of Render::portal_vertex[0..portal_npnts-1] whose inmask bit is clear (all 3 retail callers pass inmask=0 — clip every edge). Each pass scans input in REVERSE; pointer lists ping-pong between static tempPtPBuf and pts_out; a final reverse-copy restores the ORIGINAL winding. Any stage dropping below 3 vertices returns without writing *npts_out (callers pre-zero it). + +```c +void polyClipFinish(Vec2Dscreen** pts_in, int npts_in, Vec2Dscreen** pts_out, int* npts_out, int inmask) + // Installed view: Render::portal_vertex (view_vertex[] {pt, plane}, stride 0x18), Render::portal_npnts. + // Statics: tempPtBuf = Vec2Dscreen pool for intersections (stride 0x10), tempPtPBuf @0x009053d0 = pointer list. + mask = inmask << (0x1e - portal_npnts) // aligns mask bit `npnts` at bit 30; per-edge <<1 exposes it at sign bit + parity = 0 // pass parity; dstsel = { [0]: pts_out, [1]: tempPtPBuf } + freept = tempPtBuf + cur_pts = pts_in; cur_n = npts_in + + // ---- pass 0: w-clip, only if some w < cdstW (scan last-to-first) + if (exists i: pts_in[i]->w < cdstW) { // cdstW = 0.000199999995f (set @0x007247d5) + parity = 1; out = base = tempPtPBuf + prev = pts_in[0]; sprev = prev->w - cdstW; inprev = (sprev >= 0) + for (i = npts_in-1; i >= 0; i--) { // REVERSE traversal; wrap pair (pts[0], pts[n-1]) first + cur = pts_in[i]; s = cur->w - cdstW; incur = (s >= 0) // INSIDE = w >= cdstW + if (inprev != incur) { + t = sprev / (sprev - s) // lands exactly on w = cdstW + *freept = prev + (cur - prev)*t // ALL FOUR components x,y,z,w lerped + *out++ = freept++ + } + if (incur) *out++ = cur + prev = cur; sprev = s; inprev = incur + } + cur_n = out - tempPtPBuf + if (cur_n < 3) return // *npts_out NOT written + cur_pts = tempPtPBuf + } + + // ---- edge passes, edges iterated LAST-to-FIRST as pairs (a,b): + // (v[0], v[npnts-1]), (v[npnts-1], v[npnts-2]), ..., (v[1], v[0]) + a = portal_vertex[0] + for (b = &portal_vertex[npnts-1]; b >= &portal_vertex[0]; a = b, b--) { + mask <<= 1 + if (mask < 0 /*sign bit set*/) continue // inmask bit SET = poly already inside this edge: skip + parity ^= 1; out = base = dstsel[parity] + ex = b->pt.x - a->pt.x; ey = b->pt.y - a->pt.y // screen-space edge direction + side(p) = (p->x - a->pt.x * p->w) * ey - (p->y - a->pt.y * p->w) * ex // homogeneous 2D cross; w>0 preserves sign + prev = cur_pts[0]; s0 = side(prev); sprev = s0; inprev = (s0 <= 0) // INSIDE = side <= 0 (Ghidra-verified) + for (i = cur_n-1; i >= 0; i--) { // REVERSE traversal again + cur = cur_pts[i] + s = (i != 0) ? side(cur) : s0 // final pair (prev=cur_pts[1], cur=cur_pts[0]) reuses point 0's side + incur = (s <= 0) + if (inprev != incur) { + t = sprev / (sprev - s) + *freept = prev + (cur - prev)*t // 4-component homogeneous lerp + *out++ = freept++ + } + if (incur) *out++ = cur + prev = cur; sprev = s; inprev = incur + } + cur_n = out - base + if (cur_n < 3) return // *npts_out NOT written + cur_pts = base // just-written buffer becomes next pass's input + } + *npts_out = cur_n + if (parity != 0) // final data sits in tempPtPBuf, not pts_out + for (p = out-1; p >= base; p--) *pts_out++ = *p // reverse-copy into pts_out + // NET ORDERING: each pass reverses order (reverse scan); (#passes + conditional copy) is always even, + // so pts_out ends with the ORIGINAL input winding. +``` + +**Gotchas:** Ghidra-verified against BN's flag mush. (1) The w-plane is w >= cdstW = 0.000199999995f, NOT w >= 0 — BN's 'vs 0f' is fsub-cdstW rendering. (2) Edge INSIDE = side <= 0 (verified sensible: interior of the root full-viewport quad (0,H),(W,H),(W,0),(0,0) yields negative sides); BN's literal rendering inverts this — trust Ghidra. (3) Early <3 returns NEVER write *npts_out — all 3 callers (GetClip @0x005a43b2/0x005a4414, DrawPortalPolyInternal @0x0059bdb0) pre-zero it; a port must preserve or document that contract. (4) inmask bit mapping: iteration k tests original bit npnts-k+1; bit npnts = wrap edge (v[0],v[npnts-1]) pair, bit 1 = (v[1],v[0]); bit 0 (the CY-plane bit of set_view's npnts+1-bit in-mask) is NEVER tested here — but all callers pass inmask=0 anyway, so every edge always clips and the skip path is dead in practice. (5) Zero-pass case (all bits set + no wclip via GetObjectMatrix()*WorldToView*ViewToClip, then viewport-scales WITHOUT perspective divide — x=(bw/2)(x_clip+w), y=(bh/2)(w-y_clip) (y flipped, origin top-left), z=raw clip z, w=raw clip w. toScreen==0: object->view; raw view-space x,y stored, z/w from the affine transform (w=1). The divide happens downstream (copy_view divides; polyClipFinish clips pre-divide homogeneously). + +```c +Vec2Dscreen* xformStart(Vector3* p_obj, int toScreen) + M_ov = D3DXMatrixMultiply(Render::GetObjectMatrix(), render_device->m_GState.WorldToViewMatrix) // object->view (row-vector conv.) + M_oc = D3DXMatrixMultiply(M_ov, render_device->m_GState.ViewToClipMatrix) // object->clip + M = toScreen ? M_oc : M_ov // BOTH products computed unconditionally, EVERY call + v4 = D3DXVec3Transform((p_obj,1), M) // homogeneous (x,y,z,w) + slot = &tmpScreenBuffer[pt_to_use] // static ring @0x00871360, stride 0x10 + pt_to_use += 1; if (pt_to_use == 100) pt_to_use = 0 + if (toScreen == 0) { slot->x = v4.x; slot->y = v4.y } // raw VIEW-space x,y + else { + slot->x = v4.x*Render::bw*0.5 + v4.w*Render::bw*0.5 // = (bw/2)*(x_clip + w): viewport-scaled, NO divide + slot->y = v4.w*Render::bh*0.5 - v4.y*Render::bh*0.5 // = (bh/2)*(w - y_clip): y-flip, 0 = top + } + slot->z = v4.z // raw clip z (or view z); never viewport-mapped here + slot->w = v4.w // raw clip w (view path: w = 1, affine) + return slot +``` + +**Gotchas:** (1) NO perspective divide — output is homogeneous 'screen * w' coordinates; dividing x,y by w yields pixels in [0,bw]x[0,bh]. copy_view performs the divide (its w != 1.0 check is exactly this contract); polyClipFinish consumes them undivided via the (p.x - a.x*p.w) homogeneous side test and clips w at cdstW. (2) Recomputes BOTH matrix concatenations per vertex, even the unused one — a per-vertex cost quirk, do not 'optimize into' different rounding without noting it. (3) 100-slot static ring: >100 outstanding returned pointers alias (callers hold <=32). (4) Uses Render::bw/bh for scaling while copy_view's root quad uses render_device->m_viewportWidth/Height — kept equal by the device, but two different globals. (5) BN's '0x63 == pre-increment' check is the same as Ghidra's '==100 post-increment' wrap. + +**Report notes:** All three bodies extracted from docs/research/named-retail/acclient_2013_pseudo_c.txt and cross-checked function-by-function against the live Ghidra MCP (http://127.0.0.1:8081, patchmem 2013 build) — the BN text for copy_view and polyClipFinish is severe x87-flag/stack mush and would have yielded at least two inverted branch polarities (the edge inside test and the corner-keep test) plus a wrong w-clip plane (0 instead of cdstW) if read literally. Key contract facts for FW3/FW4: (a) view_vertex = {Vec2D pt; Plane plane} stride 0x18 (acclient.h line 32483), view_poly = {vertex_count, vertex_index, xmin, xmax, ymin, ymax} stride 0x18, portal_view_type per acclient.h line 32346; copy_view appends into poly slot [view_count] and vertex pool [vertex_count_total], resetting the pool when view_count==0. (b) The full chain: xformStart(v,1) produces homogeneous viewport coords (no divide) -> PView::GetClip @0x005a4320 pre-zeroes *npts_out, reverses the pointer order for Sidedness != POSITIVE, sets Render::PolyCurrent=null/PolyCurrentMod=1.0/PolyCurrentPos=1, and calls polyClipFinish(screen, n, out, npts_out, 0) — inmask is ALWAYS 0 from all three call sites, so the edge-skip fast path is dead; do_clip==0 skips clipping entirely (copy/reverse only). (c) polyClipFinish output preserves input winding (reverse-scan passes + the conditional final reverse-copy always cancel). (d) copy_view then divides, dedups/collinear-prunes at ~1px (corner survives iff |2D cross| >= Chebyshev span), rejects <3, caps 31, and builds per-edge world planes N = normalize(cross(ray[k+1], ray[k])), d = -dot(N, Render::viewer_world_space.viewpoint) — note the cross ORDER is next-x-current, the fw-walk doc's §6 one-liner has it reversed (doc fix candidate, affects plane sign conventions for any consumer like viewconeCheck). (e) The live unproject is ScreenToViewTransform @0x0059aa40 (newmethod statically 1, initializer at data 0x0081efe8, no other writes found): ndc_u = ((2*sx/vpW)-1)/ViewToClip[0][0], ndc_v = ((2*sy/vpH)-1)*(-1/ViewToClip[1][1]), ray = u*row0 + v*row1 + row2 of inverse(WorldToView), with out.y taking matrix column 2 and out.z column 1 (D3D y-up -> AC z-up wiring); un-normalized direction. (f) Constants: cdstW = F_EPSILON = 0.000199999995f (0x3951B717); dedup threshold 1.0 px; vertex cap 0x1f; poly grow +0x10; vertex grow +0x10 slack. Ghidra decomp copies saved in scratchpad (copyview_ghidra.c, polyclip_ghidra.c, xformstart_ghidra.c) if the parent wants the raw text. + +## Report 4 - Landscape visibility (get_clip_height / block_check / set_default_view / update_viewpoint) + +### Render::get_pt_limit @0x0054b840 + +**Summary:** Defines the ViewIntervalType cell encoding. Classifies the vertical column at (x,y) against ONE clip plane, returning a signed scalar: outside_val (1001f) = column wholly outside; inside_val (0f) = wholly inside; positive h = inside only BELOW height h (plane normal points down, N.z < -eps); negative -h = inside only ABOVE height h (normal points up, N.z > eps). Vertical planes (|N.z| <= eps) collapse to all-in/all-out via Plane::which_side at z=0. + +```c +// F_EPSILON = 0.000199999995f; sky_height = 1000f; inside_val = 0f; outside_val = 1001f (static init $E106: 1000+1) +float get_pt_limit(float x, float y, Plane* p) { + if (p->N.z > F_EPSILON) { // inside half-space is z >= h + h = -((x*p->N.x + y*p->N.y + p->d) / p->N.z); + if (h >= sky_height) return outside_val; // need z >= 1000: nothing + if (h > 0) return -h; // inside above h + return inside_val; // h <= 0: whole column inside + } else if (p->N.z < -F_EPSILON) { // inside half-space is z <= h + h = -((x*p->N.x + y*p->N.y + p->d) / p->N.z); + if (h <= 0) return outside_val; // nothing above ground inside + if (h >= sky_height) return inside_val; // everything below sky inside + return h; // inside below h + } else { // vertical plane: no z dependence + if (Plane::which_side(p, Vector3(x, y, 0f), F_EPSILON) == NEGATIVE) + return outside_val; + return inside_val; // POSITIVE or ON_PLANE + } +} +``` + +**Gotchas:** BN body is pure x87-flag mush (unusable); this is the Ghidra decomp. Note the ROLE of eps: sidedness of N.z picks which half-space is 'inside' — inside is always the POSITIVE side of the plane (dot(N,p)+d >= 0), consistent with copy_view's plane winding and the vertical-plane which_side test. Vertical-plane test point is (x, y, 0) — z hardwired to 0. Boundary: h exactly 0 in the up-normal arm returns inside_val (encoding is continuous at 0). + +### Render::get_clip_height @0x0054cff0 + +**Summary:** Fills one ViewIntervalType (struct { float bound[32]; } — 0x80 bytes, acclient.h #4994) for the grid corner at world (x,y): bound[0] = column vs the CY near plane (Render::viewer_world_space.CY, installed by update_viewpoint); bound[1..portal_npnts] = column vs each edge plane of the ACTIVE view (installed by set_view: portal_vertex[i-1].plane). Called per landblock-grid corner by LScape::draw_check_blocks and per cell-grid corner by LScape::landcell_check. + +```c +void get_clip_height(float x, float y, ViewIntervalType* out) { + out->bound[0] = get_pt_limit(x, y, &Render::viewer_world_space.CY); + for (i = 1; i <= Render::portal_npnts; i++) // npnts = active view's edge count (4 for default view) + out->bound[i] = get_pt_limit(x, y, &Render::portal_vertex[i-1].plane); +} +``` + +**Gotchas:** BN's plane pointer '(edi_1 + portal_vertex) - 0x10' decodes as view_vertex stride 0x18 (Vec2Dscreen pt @0 + Plane @+8): iteration 1 hits vertex[0].plane. Loop bound is INCLUSIVE (i <= portal_npnts), so npnts+1 floats are written — matches set_view's portal_inmask = (1 << (npnts+1)) - 1 (edges + CY). Coordinates are viewer-block-relative 'world' space (the landscape's viewer-rebased frame), same space the CY/edge planes were built in. + +### Render::corner_plane_check @0x0054b930 + +**Summary:** Tests one corner's per-plane interval encoding against the block's z-range [min_z, max_z]. Returns BoundingType: OUTSIDE=0, PARTIALLY_INSIDE=1, ENTIRELY_INSIDE=2. Decodes the get_pt_limit scalar: sentinels first, then the above-h (negative) and below-h (positive) interval arms. + +```c +BoundingType corner_plane_check(float bound, float min_z, float max_z) { + if (bound == outside_val) return OUTSIDE; // 1001f + if (bound != inside_val) { // != 0f + if (bound <= 0f) { // inside is z >= h, h = -bound + h = -bound; + if (h > min_z) { // block bottom below clip height + if (max_z <= h) return OUTSIDE; // whole block below h + return PARTIALLY_INSIDE; + } // h <= min_z: block wholly above h + } else if (bound < max_z) { // inside is z <= h, h = bound; block top above h + if (bound <= min_z) return OUTSIDE; // whole block above h + return PARTIALLY_INSIDE; + } // h >= max_z: block wholly below h + } + return ENTIRELY_INSIDE; +} +``` + +**Gotchas:** BN body is x87-flag mush; polarity decoded from Ghidra's '(a < b) == (a == b)' idiom = a > b. Equality edges: touching the clip height on the OUT side counts OUTSIDE (max_z == h / min_z == h both reject); touching on the IN side counts ENTIRELY_INSIDE. Arg order min_z-then-max_z is established by the double swap through block_check (see its gotcha). + +### Render::block_plane_check @0x0054d060 + +**Summary:** Combines the four corner classifications of one plane for a block: OUTSIDE only when ALL four corners are OUTSIDE; ENTIRELY_INSIDE only when ALL four are ENTIRELY_INSIDE; anything mixed is PARTIALLY_INSIDE. The first corner's class picks which unanimity test runs. + +```c +BoundingType block_plane_check(float b1, float b2, float b3, float b4, float min_z, float max_z) { + c1 = corner_plane_check(b1, min_z, max_z); + c2 = corner_plane_check(b2, min_z, max_z); + c3 = corner_plane_check(b3, min_z, max_z); + c4 = corner_plane_check(b4, min_z, max_z); + if (c1 == OUTSIDE) { + if (c2 == OUTSIDE && c3 == OUTSIDE && c4 == OUTSIDE) return OUTSIDE; + } else if (c1 == ENTIRELY_INSIDE && c2 == ENTIRELY_INSIDE && c3 == ENTIRELY_INSIDE && c4 == ENTIRELY_INSIDE) { + return ENTIRELY_INSIDE; + } + return PARTIALLY_INSIDE; +} +``` + +**Gotchas:** This is conservative per plane: 3-of-4 corners outside one plane still yields PARTIAL (the block may straddle the plane). Cross-plane rejection happens in block_check, which ANDs OUTSIDE across planes — a block fully outside ANY single plane is culled. + +### Render::block_check @0x0054dc50 + +**Summary:** The exact block-vs-view interval test. Takes the block's four corner ViewIntervalTypes (west[y], west[y+1], east[y], east[y+1]) plus the block's max_zval/min_zval. Tests plane 0 (CY) first with early-out, then each of the active view's portal_npnts edge planes: any plane reporting all-corners-OUTSIDE culls the block; any PARTIAL demotes the running result; otherwise the plane-0 result (possibly ENTIRELY_INSIDE) survives. + +```c +// caller passes (..., blk->max_zval, blk->min_zval) — note arg5=max, arg6=min +BoundingType block_check(ViewIntervalType* i00, ViewIntervalType* i01, + ViewIntervalType* i10, ViewIntervalType* i11, + float max_zval, float min_zval) { + result = block_plane_check(i00->bound[0], i01->bound[0], i10->bound[0], i11->bound[0], + min_zval, max_zval); // CY plane first (args swapped back to min,max) + if (result == OUTSIDE) return OUTSIDE; + for (k = 1; k <= Render::portal_npnts; k++) { + r = block_plane_check(i00->bound[k], i01->bound[k], i10->bound[k], i11->bound[k], + min_zval, max_zval); + if (r == OUTSIDE) return OUTSIDE; // fully outside ONE plane => culled + if (r == PARTIALLY_INSIDE) result = PARTIALLY_INSIDE; // sticky demotion + } + return result; // ENTIRELY_INSIDE only if every plane said so +} +``` + +**Gotchas:** Argument-order trap: block_check receives (max_zval, min_zval) but forwards (arg6, arg5) = (min, max) to block_plane_check, which forwards positionally to corner_plane_check — net effect corner_plane_check(bound, min_z, max_z). Ghidra confirms the swap. BN's pointer-difference loop ('eax_5 = arg1 - arg3' etc.) is just base-relative addressing of bound[k] across the four structs — Ghidra's version shown here is the honest shape. Loop is 1..portal_npnts inclusive (bound[0] handled before the loop). + +### Render::update_viewpoint (Position const*) @0x0054cdd0 + +**Summary:** Installs the viewer for the frame: copies the pose into Render::viewer_pos, splits the rotation into Xaxis/Yaxis/Zaxis (right/forward/up rows of m_fl2gv), builds viewer_world_space = { viewpoint = eye origin, CY = near plane with N = Yaxis (forward), d = -dot(origin, Yaxis) - znear }, then pushes the D3D world-to-view matrix (view Z = forward, translation = world origin in viewer-local coords), refreshes lights, and recomputes selection_ray when check_selection is armed. This is ALL the state get_clip_height/viewconeCheck read besides set_view's. + +```c +void update_viewpoint(Position* pos) { + viewer_pos.objcell_id = pos->objcell_id; + viewer_pos.frame = pos->frame; + Xaxis = m_fl2gv[0..2]; Yaxis = m_fl2gv[3..5]; Zaxis = m_fl2gv[6..8]; // right, FORWARD, up + viewer_world_space.CY.d = -(origin.x*m[3] + origin.y*m[4] + origin.z*m[5]) - znear; + viewer_world_space.viewpoint = viewer_pos.frame.m_fOrigin; + viewer_world_space.CY.N = Yaxis; // near plane: dot(fwd,p) >= dot(fwd,eye)+znear + o = Frame::globaltolocal(&viewer_pos.frame, (0,0,0)); // world origin in view space + M = 4x4 { rows built from Xaxis / Zaxis / Yaxis, translation o, last row (0,0,0,1) }; // D3D: view Z = forward + RenderDeviceD3D::SetWorldToViewMatrix(render_device, &M); + m_pRenderer->UpdateLightsInternal(...); // vtbl +0x28 + if (check_selection) selection_ray = *pick_ray(&o, selection_x, selection_y); +} +``` + +**Gotchas:** The Frame overload @0x0054dc20 wraps into a stack Position{vftable, objcell_id = 0, frame} and tail-calls this — BN's 'var_48 = 0x796910' is Position's vftable pointer, NOT a cell id; objcell_id is 0. The exact element ordering of the D3D Matrix4 is ambiguous in both decompilers (Ghidra shows _21 = Xaxis.z, _31 = Xaxis.y — transposed-looking stack writes); semantics (world-to-view, forward mapped to view Z) are solid but element layout should be re-derived at port time if it becomes load-bearing. CY does NOT depend on the active view — it is rebuilt only here; set_default_view/set_view never touch it. + +### Render::set_default_view @0x0054ef50 + +**Summary:** Installs the outdoor full-screen view. One-time-inits the static Render::window (a portal_view_type; portal/poly/vertex DArrays zeroed, blocksize 0x80, atexit dtor), resets view_count and vertex_count_total to 0, appends the full-viewport quad via copy_view(&window, null, 0), sets Render::PortalList = &window, and activates it with set_view(&window.view, 0) — after which portal_npnts = 4, portal_inmask = 0x1F (4 edge planes + CY), portal_vertex points at the quad's verts, and xmin/xmax/ymin/ymax hold the full screen bounds. + +```c +void set_default_view() { + if (!($S273 & 1)) { // one-time static init + $S273 |= 1; + window.portal = window.view.poly = window.view.vertex = empty DArray (blocksize 0x80); + window.view_timestamp = 0; + atexit($E274); + } + window.view_count = 0; + window.view.vertex_count_total = 0; + copy_view(&window, /*screen pts*/ null, /*npts*/ 0); // null source => full-viewport quad: + // appends poly {vertex_count=4, vertex_index=base}, verts (0,H),(W,H),(W,0),(0,0) + wrap copy of v0 + // (W/H = render_device->m_viewportWidth/Height), computes xmin/xmax/ymin/ymax, + // builds 4 WORLD-space edge planes from the corner rays: + // ray = Xaxis*sx + Yaxis*vdst - Zaxis*sy (sx = x*xinvscale - tx, sy = y*yinvscale - ty) + // N = normalize(cross(ray_i, ray_i+1)), d = -dot(N, viewer_world_space.viewpoint) + // then window.view_count += 1 (=> 1) + Render::PortalList = &window; + set_view(&window.view, 0); // portal_npnts=4, portal_inmask=(1<<5)-1=0x1F, + // portal_vertex=&vertex[poly[0].vertex_index], screen bounds +} +``` + +**Gotchas:** Third copy_view arg here is 0 (source-point count, unused for the null source) — PView::DrawInside's root uses copy_view(top_view, null, 4); the null branch is identical, the count is ignored. copy_view has TWO ray paths gated on the global 'newmethod': ==1 uses PrimD3DRender::ScreenToViewTransform per point; else the inline xinvscale/yinvscale/tx/ty/vdst formula shown. Edge-plane normalization is skipped when every cross component < F_EPSILON (degenerate edge left unnormalized). The window's DArrays are grow-only and reused across frames; only the counters reset. copy_view returns 0 (view rejected, view_count NOT bumped) when <3 distinct screen points survive dedup — impossible for the null-source quad. + +### LScape::draw_check_blocks @0x00505f80 + +**Summary:** The per-frame landscape visibility pass (called by LScape::update_viewpoint @0x005062d0/0x0050634b). Clears every block's and land cell's in_view, (re)allocates the rolling corner-interval buffer, then FOR EACH VIEW in Render::PortalList (1 outdoor default view, or N portal exit views): installs the view with set_view, computes ViewIntervalType per landblock-grid corner at block_length (192 m) spacing in viewer-block-relative coords, and runs block_check per block; non-OUTSIDE blocks get in_view set and are refined per-cell by landcell_check @0x005050a0 (same machinery at 24 m). + +```c +void LScape::draw_check_blocks() { + // 1) clear + for (y,x over mid_width x mid_width) if (blk = land_blocks[mid_width*y + x]) { + blk->in_view = OUTSIDE; // +0xfc + for (i < side_cell_count^2) blk->lcell[i].in_view = 0; // CLandCell stride 0x108, field +0x104 + } + // 2) rolling corner buffer: 2 rows x (mid_width+1) ViewIntervalType (0x80 each) + if (block_interval && block_int_size != mid_width) delete[] block_interval, block_interval = null; + if (!block_interval) { block_interval = new[( mid_width+1) * 0x100]; block_int_size = mid_width; } + // 3) per active view + nviews = Render::PortalList ? Render::PortalList->view_count : 0; + v = 0; last = false; + do { + if (nviews == 0) last = true; + else { Render::set_view(&Render::PortalList->view, v); v++; if (v == nviews) last = true; } + // seed west column (grid x index 0) into row 0 + for (i = 0; i <= mid_width; i++) + get_clip_height((0 - viewer_b_xoff) * block_length, // block_length = 24*8 = 192f + (i - viewer_b_yoff) * block_length, + &block_interval[i]); + for (bx = 0; bx < mid_width; bx++) { + // east column (grid x = bx+1) into row (bx-1)&1 == (bx+1)&1 + for (by = 0; by <= mid_width; by++) + get_clip_height((bx + 1 - viewer_b_xoff) * block_length, + (by - viewer_b_yoff) * block_length, + &block_interval[((bx-1) & 1) * (mid_width+1) + by]); + for (by = 0; by < mid_width; by++) { + if (!(blk = land_blocks[mid_width*bx + by])) continue; + west = &block_interval[(bx & 1) * (mid_width+1) + by]; // x = bx corners + east = &block_interval[((bx-1) & 1) * (mid_width+1) + by]; // x = bx+1 corners + bt = Render::block_check(west, west+1, east, east+1, // +1 struct = y+1 corner (+0x80) + blk->max_zval, blk->min_zval); + if (bt != OUTSIDE) { blk->in_view = bt; LScape::landcell_check(this, blk); } + } + } + } while (!last); +} +``` + +**Gotchas:** BN ELIDED the grid-spacing constant to '0f' — the real multiplier is the global ::block_length = 192.0f (static init: 24*8; the 24f seen at 0x00505187/0x00505206 belongs to landcell_check's 24 m cell grid, a different function). in_view is only WRITTEN when the result is non-OUTSIDE, so across the multi-view loop a block visible in ANY exit view stays marked (values can also be overwritten ENTIRELY<->PARTIALLY by later views; landcell_check reruns per view). When PortalList is null the body still runs ONCE against whatever set_view state is stale — unreachable in practice (set_default_view always precedes the outdoor walk). Ghidra renders side_cell_count/lcell as '_padding_' — real names from CLandBlockStruct (acclient.h #3393): side_cell_count @+0x48, lcell @+0x90; the +0x104/0x108 constants mean CLandCell is 0x108 bytes with in_view last. + +**Report notes:** All addresses from docs/research/named-retail/acclient_2013_pseudo_c.txt; every x87-ambiguous body cross-checked against the live Ghidra MCP (patchmem, port 8081) — get_pt_limit, corner_plane_check, block_check, set_default_view, update_viewpoint, draw_check_blocks, and copy_view's null branch were all fetched and agree with BN's control flow where BN was readable. + +THE MODEL (how this completes FW sections 5-6): a ViewIntervalType is NOT a z-interval — it is a per-grid-corner VECTOR of 32 per-plane column classifications (bound[0] = the CY near plane from Render::viewer_world_space, bound[1..portal_npnts] = the active view's edge planes). get_pt_limit encodes each plane's intersection with the vertical column at (x,y) as a signed height: 0f = column wholly inside that plane's positive half-space, 1001f = wholly outside, +h = inside below h, -h = inside above h (sky_height = 1000f caps both). block_check then tests a landblock's z-slab [min_zval, max_zval] against the four corner columns, plane by plane: fully-outside-any-plane culls; per-plane mixing demotes to PARTIALLY_INSIDE; ENTIRELY_INSIDE requires unanimity on every plane. This is the landscape analog of viewconeCheck (which does the same CY+edge-planes test for a sphere) and consumes exactly the state installed by update_viewpoint (viewpoint, X/Y/Z axes, CY) + set_view (npnts, vertex planes, inmask). + +Outdoor default view: set_default_view appends ONE full-viewport 4-vertex quad view to the static Render::window (screen corners (0,H),(W,H),(W,0),(0,0), 4 world-space edge planes built from corner eye rays with d = -dot(N, eye)), points PortalList at it, and activates it — so the outdoor walk always runs draw_check_blocks with exactly one view of 4 edge planes + CY (portal_inmask 0x1F). Landscape-through-portals reuses the identical loop with PortalList = &outside_view and view_count = N clipped exit views (FW section 5's 'ov' arm). + +Constants for the port: F_EPSILON = 0.000199999995f; sky_height = 1000f; inside_val = 0f; outside_val = 1001f; block_length = 192f (24*8); ViewIntervalType = float[32] (0x80 bytes); BoundingType OUTSIDE=0 / PARTIALLY_INSIDE=1 / ENTIRELY_INSIDE=2; view_vertex stride 0x18 (Vec2Dscreen pt + Plane). + +Key traps recorded in per-function gotchas: (1) BN elided block_length to '0f' in draw_check_blocks — 24f in the neighborhood belongs to landcell_check, not this function; porting 24 here would shrink the visible landscape 8x. (2) block_check receives (max_zval, min_zval) but corner_plane_check consumes (min_z, max_z) via a double positional swap. (3) equality edges: touching a clip height on the out side is OUTSIDE, on the in side is ENTIRELY_INSIDE. (4) update_viewpoint(Frame) wraps with objcell_id = 0 (BN's 0x796910 is Position's vftable). (5) the D3D world-to-view Matrix4 element order is decompiler-ambiguous (flagged, not guessed) — semantics are right/up/forward rows with view Z = forward; not load-bearing for the CPU walk. + +Not extracted (out of scope, already covered or adjacent): copy_view's non-null source path and set_view are as FW section 6 describes (verified in passing); LScape::landcell_check @0x005050a0 is the per-cell (24 m) refinement using the same get_clip_height/interval machinery plus get_block_orient — it is the natural next extraction if FW needs cell-level in_view. + + diff --git a/docs/research/2026-08-30-fw-walk-oracle/README.md b/docs/research/2026-08-30-fw-walk-oracle/README.md new file mode 100644 index 00000000..020b038a --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/README.md @@ -0,0 +1,84 @@ +# FW0 — retail walk-oracle traces (captured 2026-08-30) + +Live cdb captures of retail's per-frame draw walk (2013 v11.4186 client, +PDB-paired, connected to local ACE; owner drove the character). These are +the conformance fixtures for Campaign FW slice FW1: `RetailFrameWalk` must +reproduce these sequences position-for-position. Capture harness: +`tools/walk-oracle/` (`fw0-recon.cdb` dumped the offsets; `fw0-capture.cdb` +is the template the per-pose scripts derive from). + +## Trace format + +One line per event, frames delimited by `F `: + +- `F n` — frame start (`SmartBox::RenderNormalMode` @0x00453AA0 entry). +- `LS` — `LScape::draw` @0x00506330 (the landscape walk ran). +- `BLD ` — `RenderDeviceD3D::DrawBuilding` @0x0059F2A0; the id is + the building's `Position.objcell_id` (CBuildingObj+0x4C). +- `DI ` — `PView::DrawInside` @0x005A5860; the EnvCell being + descended into (arg at esp+4; id = CEnvCell+0x28 `m_DID`). +- `DC pv= ov= n=: ` + — `PView::DrawCells` @0x005A4840 entry; dumps the PView's whole + `cell_draw_list` (PView+0x50 data / +0x60 count / +0x38 ov). + +The last frame of each capture can be truncated (the auto-detach fires at +the frame marker, before that frame's draws) — ignore the final frame when +replaying. + +## Traces + +| File | Pose | Root shape | Why it matters | +|---|---|---|---| +| `terrace-center.log` | Sanctuary terrace center, still, 40f | OUTDOOR | Baseline outdoor frame: `LS`, 14 buildings far-to-near **including 0xF518002E every frame**, terrace cells drawn as 1-cell look-in punches at their building's turn. | +| `terrace-edge.log` | Waterfall ledge (the #456 pose), still, 40f | OUTDOOR | **The #456 acceptance oracle.** Retail STILL draws 0xF518002E all 39 complete frames — the vista is hidden by depth cover, not by culling. Edge adds a second look-in cell (n=2: f4180106 f418010f). | +| `cathedral-arrival.log` | Cathedral portal-in arrival, still, 40f | INTERIOR (DI f4180106) | Interior root: DI → DC(ov=1) → LS drawn THROUGH the exit view — and the building roster is culled to 10; **0xF518002E is absent**. Rooting selects the mechanism. | +| `holtburg-doorway-still.log` | Standing in a cottage doorway, still, 40f | INTERIOR (DI a9b4013f) | The flap scene: root is rock-stable all 39 frames at the threshold. Note the same cell (a9b40100) punched by three consecutive look-in views — retail tolerates duplicate punches. | +| `holtburg-walkout.log` | Walking inside → out of the cottage, 80f | DI a9b4013f (F1-76) → DI a9b40150 (F77-79) → OUTDOOR (F80) | The handover contract: interior cell-to-cell at F77, a clean ONE-FRAME interior→outdoor flip at F80. No intermediate state. | +| `holtburg-street-porchcam.log` | Player in the street facing away from the cottage, still, 40f | INTERIOR (DI a9b40150) | **Proof the frame roots at the CAMERA's cell, not the player's** — the chase camera tucked into the porch keeps the frame interior-rooted while the player stands outdoors. Wide doorway view culls nothing (full 14-building roster). | +| `holtburg-street-outdoor.log` | Mid-street, camera in the open, still, 40f | OUTDOOR | Clean outdoor town fixture: LS, 13 buildings, two look-in punches (n=3, n=2), zero DI. | +| `holtburg-walkabout.log` | Walking through Holtburg outdoors, 80f | OUTDOOR throughout | Moving outdoor fixture; dense look-in punch activity (~10 DC/frame) as doorways sweep the view. | +| `foundry-entry.log` | Walking from the street into the Holtburg foundry and down, 80f | OUTDOOR (F1-56) → DI a9b40178 (F57-78, **LS=false**) → DI a9b40177 (F79) | The outdoor→interior flip in one frame — and the pure-interior shape: the moment the camera faces down the stairs, no exit view survives, so NO landscape and NO buildings draw (ov=0). | +| `foundry-deep.log` | Bottom of the foundry, still, 40f | INTERIOR (DI a9b40176) | Deep interior with a surviving chain: ov=1 through the stairwell, so retail draws the landscape AND 12 town buildings from the basement — all buried by depth. Confirms draw-and-let-z-cover is the philosophy everywhere. | + +## Findings that bind the FW1 port + +1. **The frame roots at the camera-eye's cell** (porchcam trace). Player + position is irrelevant to rooting. +2. **Outdoor root draws every distance-eligible building — including the + #456 far building — and hides them by depth**, never by omission + (terrace-edge trace). acdream's #456 bleed is therefore a HOLE in our + drawn cover at that pose, not extra visibility. The cover mechanism + inside `RenderDeviceD3D::DrawBuilding` (pre-punch flush + portal far-Z + pass) is the next decomp read. +3. **Interior root gates the world through the exit-view chain**: the + building roster and landscape are whatever survives the chain's + cone/clip — from nothing (foundry entry, ov=0) to the whole town + (foundry deep, porchcam). +4. **Look-ins draw at the owning building's walk turn**, as 1-3 cell + `DrawCells` punches (ov=0) interleaved with the building sequence, and + duplicate punches of the same cell are tolerated. +5. **Transitions are one-frame flips** with no blended or intermediate + state (walkout F80, foundry F57), and the root is perfectly stable + when stationary — even standing in a doorway. +6. **Buildings draw far-to-near** (`LScape::calc_draw_order`), and the + whole-frame sequence repeats bit-for-bit while the camera is still. + +## Pose-stamped round (2026-08-30 evening, `posed/`) + +The second capture round adds a `P` line per frame (raw IEEE-754 dwords +from `Render::viewer_pos` @0x0081ef00: camera cell id, world origin xyz, +the four Frame quaternion components in storage order) — the exact-replay +inputs the first round lacked. Ten fixtures in `posed/`: cathedral-arrival, +terrace-center (interior-rooted this round — different camera state than +the morning; the pose stamp makes each fixture self-consistent), +terrace-edge (outdoor, the #456 pose), holtburg-doorway-still, +holtburg-walkout, holtburg-transitions (a full out-and-back crossing with +all four root flips — supersedes walkout as the transition contract), +holtburg-street-outdoor, holtburg-walkabout (80 moving frames), +foundry-entry (outdoor approach; the flip fell outside the window), +foundry-deep (the pure-interior shape: DI + DC ov=0, no landscape). +Caveat: the pose is dumped at the frame MARKER (RenderNormalMode entry), +i.e. before update_viewpoint copies the new camera state — for moving +captures the stamped pose belongs to the PREVIOUS frame's draw; still +captures are unaffected. FW1 conformance gates on the STILL fixtures +first for exactly this reason. diff --git a/docs/research/2026-08-30-fw-walk-oracle/cathedral-arrival.log b/docs/research/2026-08-30-fw-walk-oracle/cathedral-arrival.log new file mode 100644 index 00000000..a46e2848 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/cathedral-arrival.log @@ -0,0 +1,665 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-cathedral-arrival.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +F 1 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 2 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 3 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 4 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 5 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 6 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 7 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 8 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 9 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 10 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 11 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 12 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 13 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 14 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 15 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 16 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 17 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 18 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 19 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 20 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 21 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 22 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 23 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 24 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 25 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 26 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 27 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 28 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 29 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 30 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 31 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 32 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 33 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 34 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 35 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 36 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 37 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 38 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 39 +DI f4180106 +DC pv=009d4a80 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4b08 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +BLD f418000a +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/foundry-deep.log b/docs/research/2026-08-30-fw-walk-oracle/foundry-deep.log new file mode 100644 index 00000000..7d3a9a78 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/foundry-deep.log @@ -0,0 +1,665 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-foundry-deep.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +F 1 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 2 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 3 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 4 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 5 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 6 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 7 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 8 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 9 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 10 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 11 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 12 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 13 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 14 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 15 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 16 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 17 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 18 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 19 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 20 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 21 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 22 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 23 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 24 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 25 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 26 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 27 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 28 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 29 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 30 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 31 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 32 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 33 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 34 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 35 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 36 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 37 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 38 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 39 +DI a9b40176 +DC pv=009d4a80 ov=1 n=2: a9b40176 a9b40177 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b4000f +BLD a9b40026 +BLD a9b40016 +BLD a9b4001e +BLD a9b40017 +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/foundry-entry.log b/docs/research/2026-08-30-fw-walk-oracle/foundry-entry.log new file mode 100644 index 00000000..871a06c1 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/foundry-entry.log @@ -0,0 +1,1733 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-dungeon-entry2.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n80) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 1 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 2 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 3 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 4 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 5 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 6 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 7 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 8 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 9 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 10 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 11 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 12 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 13 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 14 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 15 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 16 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 17 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 18 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 19 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 20 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 21 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 22 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 23 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 24 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 25 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 26 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 27 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 28 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 29 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 30 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 31 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 32 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 33 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 34 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 35 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 36 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 37 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 38 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 39 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 40 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=1: a9b40106 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 41 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=2: a9b40106 a9b40105 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 42 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=2: a9b40106 a9b40105 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 43 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=2: a9b40106 a9b40105 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 44 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4b08 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +DC pv=009d4b08 ov=0 n=2: a9b40106 a9b40105 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 45 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 46 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4b08 ov=0 n=1: a9b40116 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b40139 a9b40138 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40120 +DC pv=009d4b08 ov=0 n=1: a9b40122 +DC pv=009d4b08 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40102 a9b40100 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4b08 ov=0 n=1: a9b40178 +F 47 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=1: a9b40102 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 48 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=1: a9b40102 +DC pv=009d4b08 ov=0 n=3: a9b40107 a9b40108 a9b40104 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 49 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 50 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 51 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 52 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 53 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 54 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 55 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 56 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4b08 ov=0 n=2: a9b40177 a9b40176 +DC pv=009d4b08 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 57 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 58 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 59 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 60 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 61 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 62 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 63 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 64 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 65 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 66 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 67 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 68 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 69 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 70 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 71 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 72 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 73 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 74 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 75 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 76 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 77 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 78 +DI a9b40178 +DC pv=009d4a80 ov=0 n=3: a9b40178 a9b40177 a9b40176 +F 79 +DI a9b40177 +DC pv=009d4a80 ov=0 n=3: a9b40177 a9b40178 a9b40176 +F 80 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/holtburg-doorway-still.log b/docs/research/2026-08-30-fw-walk-oracle/holtburg-doorway-still.log new file mode 100644 index 00000000..65360717 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/holtburg-doorway-still.log @@ -0,0 +1,916 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-doorway.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 1 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/holtburg-street-outdoor.log b/docs/research/2026-08-30-fw-walk-oracle/holtburg-street-outdoor.log new file mode 100644 index 00000000..58ce5c83 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/holtburg-street-outdoor.log @@ -0,0 +1,718 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-street.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 1 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4b08 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/holtburg-street-porchcam.log b/docs/research/2026-08-30-fw-walk-oracle/holtburg-street-porchcam.log new file mode 100644 index 00000000..e368261f --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/holtburg-street-porchcam.log @@ -0,0 +1,910 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-street.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +F 1 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/holtburg-walkabout.log b/docs/research/2026-08-30-fw-walk-oracle/holtburg-walkabout.log new file mode 100644 index 00000000..795ba243 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/holtburg-walkabout.log @@ -0,0 +1,2096 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-dungeon-entry.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n80) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +F 1 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 41 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 42 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 43 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 44 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 45 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 46 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 47 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 48 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 49 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 50 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 51 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 52 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 53 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 54 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 55 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 56 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 57 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 58 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 59 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 60 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 61 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 62 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 63 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 64 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 65 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 66 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 67 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 68 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 69 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 70 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 71 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 72 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 73 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 74 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 75 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 76 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 77 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 78 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 79 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 80 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/holtburg-walkout.log b/docs/research/2026-08-30-fw-walk-oracle/holtburg-walkout.log new file mode 100644 index 00000000..18a94b5a --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/holtburg-walkout.log @@ -0,0 +1,1705 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-walkthrough.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n80) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +F 1 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 41 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 42 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 43 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 44 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 45 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 46 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 47 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 48 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 49 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 50 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 51 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 52 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 53 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 54 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 55 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 56 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 57 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 58 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 59 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 60 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 61 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 62 +DI a9b4013f +DC pv=009d4a80 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 63 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 64 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 65 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 66 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 67 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 68 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 69 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 70 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 71 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 72 +DI a9b4013f +DC pv=009d4a80 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 73 +DI a9b4013f +DC pv=009d4a80 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 74 +DI a9b4013f +DC pv=009d4a80 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 75 +DI a9b4013f +DC pv=009d4a80 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 76 +DI a9b4013f +DC pv=009d4a80 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 77 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 78 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 79 +DI a9b40150 +DC pv=009d4a80 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4b08 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4b08 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4b08 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4b08 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +DC pv=009d4b08 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4b08 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4b08 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4b08 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4b08 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 80 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/cathedral-arrival.log b/docs/research/2026-08-30-fw-walk-oracle/posed/cathedral-arrival.log new file mode 100644 index 00000000..93707a71 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/cathedral-arrival.log @@ -0,0 +1,716 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-cathedral-arrival.log' +0:021> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:021> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:021> .reload /f acclient.exe +0:021> r $t0 = 0 +0:021> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +0:021> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:021> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:021> bp 00506330 ".printf \"LS\\n\"; gc" +0:021> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:021> g +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 1 +P f4180106 4217ce4b 4238a567 432c2114 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 2 +P f4180106 4217cef9 4238a3c4 432c2136 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 3 +P f4180106 4217cef9 4238a3c4 432c2136 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 4 +P f4180106 4217cef9 4238a3c4 432c2136 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 5 +P f4180106 4217cef8 4238a3c6 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 6 +P f4180106 4217cef8 4238a3c6 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 7 +P f4180106 4217cef8 4238a3c6 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 8 +P f4180106 4217cef7 4238a3c9 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 9 +P f4180106 4217cef7 4238a3c9 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 10 +P f4180106 4217cef7 4238a3c9 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 11 +P f4180106 4217cef6 4238a3cc 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 12 +P f4180106 4217cef6 4238a3cc 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 13 +P f4180106 4217cef6 4238a3cc 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 14 +P f4180106 4217cef5 4238a3ce 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 15 +P f4180106 4217cef5 4238a3ce 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 16 +P f4180106 4217cef5 4238a3ce 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 17 +P f4180106 4217cef4 4238a3d0 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 18 +P f4180106 4217cef4 4238a3d0 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 19 +P f4180106 4217cef4 4238a3d0 432c2135 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 20 +P f4180106 4217cef3 4238a3d2 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 21 +P f4180106 4217cef3 4238a3d2 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 22 +P f4180106 4217cef3 4238a3d2 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 23 +P f4180106 4217cef2 4238a3d5 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 24 +P f4180106 4217cef2 4238a3d5 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 25 +P f4180106 4217cef2 4238a3d5 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 26 +P f4180106 4217cef1 4238a3d8 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 27 +P f4180106 4217cef1 4238a3d8 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 28 +P f4180106 4217cef1 4238a3d8 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 29 +P f4180106 4217cef0 4238a3da 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 30 +P f4180106 4217cef0 4238a3da 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 31 +P f4180106 4217cef0 4238a3da 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 32 +P f4180106 4217ceef 4238a3dc 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 33 +P f4180106 4217ceef 4238a3dc 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 34 +P f4180106 4217ceef 4238a3dc 432c2134 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 35 +P f4180106 4217ceee 4238a3de 432c2133 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 36 +P f4180106 4217ceee 4238a3de 432c2133 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 37 +P f4180106 4217ceee 4238a3de 432c2133 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 38 +P f4180106 4217ceed 4238a3e1 432c2133 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 39 +P f4180106 4217ceed 4238a3e1 432c2133 bf786b71 3e11d730 3ce81370 be45a7ad +DI f4180106 +DC pv=009d4e38 ov=1 n=1: f4180106 +LS +BLD f3180020 +BLD f4180004 +BLD f4180014 +BLD f418000c +DC pv=009d4398 ov=0 n=2: f4180101 f4180100 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +BLD f418000a +F 40 +P f4180106 4217ceed 4238a3e1 432c2133 bf786b71 3e11d730 3ce81370 be45a7ad +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/foundry-deep.log b/docs/research/2026-08-30-fw-walk-oracle/posed/foundry-deep.log new file mode 100644 index 00000000..574c48c0 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/foundry-deep.log @@ -0,0 +1,198 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-foundry-deep.log' +0:021> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:021> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:021> .reload /f acclient.exe +0:021> r $t0 = 0 +0:021> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +0:021> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:021> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:021> bp 00506330 ".printf \"LS\\n\"; gc" +0:021> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:021> g +F 1 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 2 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 3 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 4 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 5 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 6 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 7 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 8 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 9 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 10 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 11 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 12 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 13 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 14 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 15 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 16 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 17 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 18 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 19 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 20 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 21 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 22 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 23 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 24 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 25 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 26 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 27 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 28 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 29 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 30 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 31 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 32 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 33 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 34 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 35 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 36 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 37 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 38 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 39 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +DI a9b40176 +DC pv=009d4e38 ov=0 n=1: a9b40176 +F 40 +P a9b40176 4290a349 431a4e89 427c8503 3f617e5d be0461c6 3d8771b3 bee6b58d +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/foundry-entry.log b/docs/research/2026-08-30-fw-walk-oracle/posed/foundry-entry.log new file mode 100644 index 00000000..d08399f2 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/foundry-entry.log @@ -0,0 +1,1550 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-foundry-entry.log' +0:021> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:021> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:021> .reload /f acclient.exe +0:021> r $t0 = 0 +0:021> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n80) { qd } .else { gc }" +0:021> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:021> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:021> bp 00506330 ".printf \"LS\\n\"; gc" +0:021> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:021> g +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 1 +P a9b40017 426cc1d3 431b9295 4288954a bf486f86 3de597b5 3db010ac bf1b1794 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 2 +P a9b40017 4268ee4a 431a7b50 4288a403 bf67649c 3e071ba8 3d6f02a6 bece324a +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 3 +P a9b40017 4268ee4a 431a7b50 4288a403 bf67649c 3e071ba8 3d6f02a6 bece324a +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 4 +P a9b40017 4268ee4a 431a7b50 4288a403 bf67649c 3e071ba8 3d6f02a6 bece324a +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 5 +P a9b40017 42688119 431a60d2 4288a4f9 bf69f270 3e08c039 3d61a1f2 bec24a2a +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 6 +P a9b40017 42688119 431a60d2 4288a4f9 bf69f270 3e08c039 3d61a1f2 bec24a2a +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=3: a9b40115 a9b40111 a9b40113 +BLD a9b40017 +F 7 +P a9b40017 42688119 431a60d2 4288a4f9 bf69f270 3e08c039 3d61a1f2 bec24a2a +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=2: a9b40115 a9b40111 +BLD a9b40017 +F 8 +P a9b40017 4267fb57 431a44ec 4288a5bc bf6cbf86 3e0a825d 3d5189cf beb42ccf +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=2: a9b40115 a9b40111 +BLD a9b40017 +F 9 +P a9b40017 4267fb57 431a44ec 4288a5bc bf6cbf86 3e0a825d 3d5189cf beb42ccf +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +DC pv=009d4398 ov=0 n=2: a9b40115 a9b40111 +BLD a9b40017 +F 10 +P a9b40017 4267fb57 431a44ec 4288a5bc bf6cbf86 3e0a825d 3d5189cf beb42ccf +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 11 +P a9b40017 42676195 431a2972 4288a656 bf6f979b 3e0c44c8 3d3f6b91 bea46c4e +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 12 +P a9b40017 42676195 431a2972 4288a656 bf6f979b 3e0c44c8 3d3f6b91 bea46c4e +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 13 +P a9b40017 42676195 431a2972 4288a656 bf6f979b 3e0c44c8 3d3f6b91 bea46c4e +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 14 +P a9b40017 4266bb60 431a103e 4288a6cb bf7246d3 3e0de9ec 3d2c3a5d be93d47e +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 15 +P a9b40017 4266bb60 431a103e 4288a6cb bf7246d3 3e0de9ec 3d2c3a5d be93d47e +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 16 +P a9b40017 4266bb60 431a103e 4288a6cb bf7246d3 3e0de9ec 3d2c3a5d be93d47e +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 17 +P a9b40017 4266047d 4319f912 4288a72d bf74d24e 3e0f76b7 3d177b45 be81f5e0 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 18 +P a9b40017 4266047d 4319f912 4288a72d bf74d24e 3e0f76b7 3d177b45 be81f5e0 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 19 +P a9b40017 4266047d 4319f912 4288a72d bf74d24e 3e0f76b7 3d177b45 be81f5e0 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 20 +P a9b40017 4265564d 4319e523 4288a77b bf76e915 3e10bc73 3d03cc6c be621087 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 21 +P a9b40017 4265564d 4319e523 4288a77b bf76e915 3e10bc73 3d03cc6c be621087 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 22 +P a9b40017 4265564d 4319e523 4288a77b bf76e915 3e10bc73 3d03cc6c be621087 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 23 +P a9b40017 42649494 4319d3b2 4288a7bb bf78d871 3e11e902 3cdc7654 be3d0e08 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 24 +P a9b40017 42649494 4319d3b2 4288a7bb bf78d871 3e11e902 3cdc7654 be3d0e08 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 25 +P a9b40017 42649494 4319d3b2 4288a7bb bf78d871 3e11e902 3cdc7654 be3d0e08 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 26 +P a9b40017 4263c108 4319c57a 4288a7f7 bf7a88fb 3e12ef16 3cadcf54 be151836 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 27 +P a9b40017 4263c108 4319c57a 4288a7f7 bf7a88fb 3e12ef16 3cadcf54 be151836 +LS +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 28 +P a9b40017 4263c108 4319c57a 4288a7f7 bf7a88fb 3e12ef16 3cadcf54 be151836 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 29 +P a9b40017 4262e478 4319bb77 4288a824 bf7bdb53 3e13bc50 3c7acdc3 bdd75d1f +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 30 +P a9b40017 4262e478 4319bb77 4288a824 bf7bdb53 3e13bc50 3c7acdc3 bdd75d1f +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 31 +P a9b40017 4262e478 4319bb77 4288a824 bf7bdb53 3e13bc50 3c7acdc3 bdd75d1f +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 32 +P a9b40017 4261ef88 4319b594 4288a84e bf7cd1e6 3e1452dd 3c0f40a9 bd76e12e +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 33 +P a9b40017 4261ef88 4319b594 4288a84e bf7cd1e6 3e1452dd 3c0f40a9 bd76e12e +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 34 +P a9b40017 4261ef88 4319b594 4288a84e bf7cd1e6 3e1452dd 3c0f40a9 bd76e12e +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 35 +P a9b40017 4260f748 4319b500 4288a86e bf7d4311 3e149a01 3b06c742 bc6ef0ac +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 36 +P a9b40017 4260f748 4319b500 4288a86e bf7d4311 3e149a01 3b06c742 bc6ef0ac +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 37 +P a9b40017 4260f748 4319b500 4288a86e bf7d4311 3e149a01 3b06c742 bc6ef0ac +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 38 +P a9b40017 42601884 4319b709 4288a88a bf7d3285 3e149415 bb822633 3cd9dc25 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 39 +P a9b40017 42601884 4319b709 4288a88a bf7d3285 3e149415 bb822633 3cd9dc25 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 40 +P a9b40017 42601884 4319b709 4288a88a bf7d3285 3e149415 bb822633 3cd9dc25 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 41 +P a9b40017 425f2d0a 4319bed9 4288a89f bf7ca431 3e1443c1 bc2ada87 3d90bc02 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 42 +P a9b40017 425f2d0a 4319bed9 4288a89f bf7ca431 3e1443c1 bc2ada87 3d90bc02 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +F 43 +P a9b40017 425f2d0a 4319bed9 4288a89f bf7ca431 3e1443c1 bc2ada87 3d90bc02 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=1: a9b40177 +F 44 +P a9b40017 425e3eaa 4319cc95 4288a8ac bf7b8981 3e13a072 bc8bff21 3dedd581 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=1: a9b40177 +F 45 +P a9b40017 425e3eaa 4319cc95 4288a8ac bf7b8981 3e13a072 bc8bff21 3dedd581 +LS +BLD aab50002 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=1: a9b40177 +F 46 +P a9b40017 425e3eaa 4319cc95 4288a8ac bf7b8981 3e13a072 bc8bff21 3dedd581 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=1: a9b40177 +F 47 +P a9b40017 425d45c8 4319e145 4288a8bc bf79bfe4 3e12960e bcc66e3c 3e28bf5d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=1: a9b40177 +F 48 +P a9b40017 425d45c8 4319e145 4288a8bc bf79bfe4 3e12960e bcc66e3c 3e28bf5d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=1: a9b40177 +F 49 +P a9b40017 425d45c8 4319e145 4288a8bc bf79bfe4 3e12960e bcc66e3c 3e28bf5d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=2: a9b40177 a9b40178 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 50 +P a9b40017 425c4240 4319fe08 4288a8c8 bf771bff 3e110b39 bd02ae8c 3e5e66c1 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=2: a9b40177 a9b40178 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 51 +P a9b40017 425c4240 4319fe08 4288a8c8 bf771bff 3e110b39 bd02ae8c 3e5e66c1 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 52 +P a9b40017 425b9cdf 431a157b 4288a8cf bf74ee3d 3e0fc4d3 bd179eb9 3e810c4d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 53 +P a9b40017 425b9cdf 431a157b 4288a8cf bf74ee3d 3e0fc4d3 bd179eb9 3e810c4d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 54 +P a9b40017 425b023f 431a2df7 4288a8d2 bf728621 3e0e5c04 bd2ba0f5 3e921a12 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 55 +P a9b40017 425b023f 431a2df7 4288a8d2 bf728621 3e0e5c04 bd2ba0f5 3e921a12 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 56 +P a9b40017 425a6797 431a4c2b 4288a8d3 bf6f9b8d 3e0ca67c bd40e516 3ea43985 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 57 +P a9b40017 425a6797 431a4c2b 4288a8d3 bf6f9b8d 3e0ca67c bd40e516 3ea43985 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 58 +P a9b40017 4259ce42 431a705a 4288a8db bf6c1692 3e0a9638 bd577f3d 3eb77be0 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 59 +P a9b40017 4259ce42 431a705a 4288a8db bf6c1692 3e0a9638 bd577f3d 3eb77be0 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 60 +P a9b40017 4259473b 431a936c 4288a8de bf687d4a 3e0879ea bd6c15a9 3ec9069d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 61 +P a9b40017 4259473b 431a936c 4288a8de bf687d4a 3e0879ea bd6c15a9 3ec9069d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 62 +P a9b40017 4258ba64 431abfe7 4288a8e0 bf63dff3 3e05c4e9 bd81dabb 3edd274a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 63 +P a9b40017 4258ba64 431abfe7 4288a8e0 bf63dff3 3e05c4e9 bd81dabb 3edd274a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 64 +P a9b40017 425869b4 431af08a 4288a8e5 bf5ee737 3e02da29 bd8d3fb5 3ef09183 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 65 +P a9b40017 425869b4 431af08a 4288a8e5 bf5ee737 3e02da29 bd8d3fb5 3ef09183 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 66 +P a9b40017 42585ca9 431b24a5 4288a8ea bf599047 3dff700e bd984af4 3f01b153 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 67 +P a9b40017 42585ca9 431b24a5 4288a8ea bf599047 3dff700e bd984af4 3f01b153 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 68 +P a9b40017 4258bdda 431b5541 4288a8f1 bf547e08 3df97c5f bda1dc8e 3f09d831 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 69 +P a9b40017 4258bdda 431b5541 4288a8f1 bf547e08 3df97c5f bda1dc8e 3f09d831 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 70 +P a9b40017 4259e701 431b8c99 4288a8f2 bf4ed39e 3df2d60e bdabadca 3f123549 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 71 +P a9b40017 4259e701 431b8c99 4288a8f2 bf4ed39e 3df2d60e bdabadca 3f123549 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 72 +P a9b40017 425b6ab3 431bba15 4288a8f0 bf4a4dd2 3ded8727 bdb2f3c7 3f186795 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 73 +P a9b40017 425b6ab3 431bba15 4288a8f0 bf4a4dd2 3ded8727 bdb2f3c7 3f186795 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 74 +P a9b40017 425d5f27 431be1c8 4288a8f7 bf46a7ba 3de93ecc bdb8800b 3f1d2190 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 75 +P a9b40017 425d5f27 431be1c8 4288a8f7 bf46a7ba 3de93ecc bdb8800b 3f1d2190 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 76 +P a9b40017 425fd484 431c05e7 4288a8f8 bf43bb83 3de5d09a bdbcc1a1 3f20c1d5 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 77 +P a9b40017 425fd484 431c05e7 4288a8f8 bf43bb83 3de5d09a bdbcc1a1 3f20c1d5 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 78 +P a9b40017 42625cd3 431c2461 4288776c bf420e87 3dc53690 bda45250 3f23dad0 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 79 +P a9b40017 42625cd3 431c2461 4288776c bf420e87 3dc53690 bda45250 3f23dad0 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b40031 +BLD a9b40029 +BLD a9b40032 +BLD a9b40022 +BLD a9b4001a +BLD a9b40036 +DC pv=009d4398 ov=0 n=1: a9b40116 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b40139 a9b40138 +DC pv=009d4398 ov=0 n=2: a9b4013b a9b4013a +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40120 +DC pv=009d4398 ov=0 n=1: a9b40122 +DC pv=009d4398 ov=0 n=1: a9b40125 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40102 a9b40100 +BLD a9b40016 +BLD a9b4000f +BLD a9b40017 +DC pv=009d4398 ov=0 n=3: a9b40177 a9b40178 a9b40176 +DC pv=009d4398 ov=0 n=1: a9b40178 +F 80 +P a9b40017 42651230 431c3fec 42886221 bf40b547 3dac5fbf bd91b2c2 3f2624b6 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-doorway-still.log b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-doorway-still.log new file mode 100644 index 00000000..2b483d4f --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-doorway-still.log @@ -0,0 +1,744 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-holtburg-doorway.log' +0:020> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:020> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:020> .reload /f acclient.exe +0:020> r $t0 = 0 +0:020> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +0:020> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:020> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:020> bp 00506330 ".printf \"LS\\n\"; gc" +0:020> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:020> g +F 1 +P a9b4013f 43054826 41604391 42c0a8ff 3f7ad6aa be1342bb bca4fd4d 3e0c84c0 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +P a9b4013f 4305484d 41604402 42c0a8f6 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +P a9b4013f 4305484d 41604406 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +P a9b4013f 4305484d 41604407 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +P a9b4013f 4305484d 41604408 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +P a9b4013f 4305484d 41604409 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +P a9b4013f 4305484d 4160440a 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +P a9b4013f 4305484d 4160440b 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +P a9b4013f 4305484d 4160440c 42c0a8f7 3f7ad5a6 be134223 bca51f4a 3e0ca1b2 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-street-outdoor.log b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-street-outdoor.log new file mode 100644 index 00000000..4e9586ba --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-street-outdoor.log @@ -0,0 +1,744 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-street-outdoor.log' +0:020> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:020> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:020> .reload /f acclient.exe +0:020> r $t0 = 0 +0:020> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +0:020> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:020> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:020> bp 00506330 ".printf \"LS\\n\"; gc" +0:020> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:020> g +F 1 +P a9b40029 4304c599 41bf2387 42c0a910 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +P a9b40029 4304c57b 41bf238b 42c0a8fe 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +P a9b40029 4304c57c 41bf238b 42c0a8fe 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +P a9b40029 4304c57d 41bf238a 42c0a8ff 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +P a9b40029 4304c57e 41bf238a 42c0a8ff 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +P a9b40029 4304c57f 41bf238a 42c0a900 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +P a9b40029 4304c580 41bf238a 42c0a901 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +P a9b40029 4304c581 41bf238a 42c0a901 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +P a9b40029 4304c582 41bf238a 42c0a902 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +P a9b40029 4304c583 41bf238a 42c0a902 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +P a9b40029 4304c584 41bf2389 42c0a903 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +P a9b40029 4304c585 41bf2389 42c0a904 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +P a9b40029 4304c586 41bf2389 42c0a904 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +P a9b40029 4304c587 41bf2389 42c0a905 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +P a9b40029 4304c588 41bf2389 42c0a905 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +P a9b40029 4304c589 41bf2389 42c0a906 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +P a9b40029 4304c58a 41bf2389 42c0a907 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +P a9b40029 4304c58b 41bf2388 42c0a907 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +P a9b40029 4304c58c 41bf2388 42c0a908 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +P a9b40029 4304c58d 41bf2388 42c0a908 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +P a9b40029 4304c58e 41bf2388 42c0a909 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +P a9b40029 4304c58f 41bf2388 42c0a90a 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +P a9b40029 4304c590 41bf2388 42c0a90a 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +P a9b40029 4304c591 41bf2388 42c0a90b 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +P a9b40029 4304c592 41bf2388 42c0a90b 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +P a9b40029 4304c593 41bf2387 42c0a90c 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +P a9b40029 4304c594 41bf2387 42c0a90d 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +P a9b40029 4304c595 41bf2387 42c0a90d 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +P a9b40029 4304c596 41bf2387 42c0a90e 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +P a9b40029 4304c597 41bf2387 42c0a90e 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +P a9b40029 4304c598 41bf2387 42c0a90f 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +P a9b40029 4304c599 41bf2387 42c0a910 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +P a9b40029 4304c59a 41bf2386 42c0a910 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +P a9b40029 4304c59b 41bf2386 42c0a911 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +P a9b40029 4304c59c 41bf2386 42c0a911 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +P a9b40029 4304c59d 41bf2386 42c0a912 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +P a9b40029 4304c59e 41bf2386 42c0a913 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +P a9b40029 4304c59f 41bf2386 42c0a913 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +P a9b40029 4304c5a0 41bf2386 42c0a914 3f34a2ab bdd417c0 bdd07917 3f318d73 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=4: a9b40164 a9b40162 a9b40167 a9b40169 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +P a9b40029 4304c5a1 41bf2385 42c0a914 3f34a2ab bdd417c0 bdd07917 3f318d73 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-transitions.log b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-transitions.log new file mode 100644 index 00000000..3f37bd38 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-transitions.log @@ -0,0 +1,2120 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-holtburg-transitions.log' +0:020> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:020> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:020> .reload /f acclient.exe +0:020> r $t0 = 0 +0:020> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n80) { qd } .else { gc }" +0:020> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:020> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:020> bp 00506330 ".printf \"LS\\n\"; gc" +0:020> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:020> g +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 1 +P a9b4013f 4304ffad 4172a031 42c0921a 3f79e038 be12b202 bcc28f9a 3e25b44b +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +P a9b4013f 430578f0 415c65cb 42c0a1b2 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +P a9b4013f 430578f0 415c65cb 42c0a1b2 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +P a9b4013f 43058b20 4159104e 42c0a34c 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +P a9b4013f 43058b20 4159104e 42c0a34c 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +P a9b4013f 43059f23 4155650a 42c0a48f 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +P a9b4013f 43059f23 4155650a 42c0a48f 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +P a9b4013f 4305afeb 41525185 42c0a55c 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +P a9b4013f 4305afeb 41525185 42c0a55c 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +P a9b4013f 4305bee3 414f933a 42c0a606 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +P a9b4013f 4305bee3 414f933a 42c0a606 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +P a9b4013f 4305cbdc 414d3273 42c0a691 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +P a9b4013f 4305cbdc 414d3273 42c0a691 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +P a9b4013f 4305d718 414b2326 42c0a6fe 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +P a9b4013f 4305d718 414b2326 42c0a6fe 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +P a9b4013f 4305e188 41493a0d 42c0a760 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +P a9b4013f 4305e188 41493a0d 42c0a760 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +P a9b4013f 4305eb20 4147778c 42c0a7a9 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +P a9b4013f 4305eb20 4147778c 42c0a7a9 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +P a9b4013f 4305f347 4145f944 42c0a7e7 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +P a9b4013f 4305f347 4145f944 42c0a7e7 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +P a9b4013f 4305fa21 4144b7c0 42c0a81d 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +P a9b4013f 4305fa21 4144b7c0 42c0a81d 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +P a9b4013f 4305ffd8 4143ac17 42c0a845 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +P a9b4013f 4305ffd8 4143ac17 42c0a845 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +P a9b4013f 43060434 4142e004 42c0a868 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +P a9b4013f 43060434 4142e004 42c0a868 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +P a9b4013f 430603ec 4142ed78 42c0a880 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +P a9b4013f 430603ec 4142ed78 42c0a880 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +P a9b4013f 4305fd09 4144308c 42c0a896 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +P a9b4013f 4305fd09 4144308c 42c0a896 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +P a9b4013f 4305ee10 4146ee11 42c0a8aa 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +P a9b4013f 4305ee10 4146ee11 42c0a8aa 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +P a9b4013f 4305d9ba 414aa881 42c0a8ba 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +P a9b4013f 4305d9ba 414aa881 42c0a8ba 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +P a9b4013f 4305beb2 414f9b92 42c0a8c7 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +P a9b4013f 4305beb2 414f9b92 42c0a8c7 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +P a9b4013f 4305993f 4156786d 42c0a8d5 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +P a9b4013f 4305993f 4156786d 42c0a8d5 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +P a9b4013f 4305750e 415d19dc 42c0a8e1 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 41 +P a9b4013f 4305750e 415d19dc 42c0a8e1 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 42 +P a9b4013f 43054d63 416460f3 42c0a8e4 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 43 +P a9b4013f 43054d63 416460f3 42c0a8e4 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 44 +P a9b4013f 43051fe5 416cb740 42c0a8e3 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD aab50002 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 45 +P a9b4013f 43051fe5 416cb740 42c0a8e3 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 46 +P a9b4013f 4304f312 4174f04b 42c0a8ee 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 47 +P a9b4013f 4304f312 4174f04b 42c0a8ee 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 48 +P a9b4013f 4304c81e 417cd0d3 42c0a8f4 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 49 +P a9b4013f 4304c81e 417cd0d3 42c0a8f4 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b40150 +DC pv=009d4e38 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 50 +P a9b40150 43046e43 4186a4e2 42c06666 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b40150 +DC pv=009d4e38 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 51 +P a9b40150 43046e43 4186a4e2 42c06666 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 52 +P a9b40029 430451e3 41893e28 42c06881 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 53 +P a9b40029 430451e3 41893e28 42c06881 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 54 +P a9b40029 430448f7 418a0fa3 42c078b1 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 55 +P a9b40029 430448f7 418a0fa3 42c078b1 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 56 +P a9b40029 430441c8 418ab87b 42c084d0 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 57 +P a9b40029 430441c8 418ab87b 42c084d0 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 58 +P a9b40029 43043c4a 418b398d 42c08dcf 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 59 +P a9b40029 43043c4a 418b398d 42c08dcf 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 60 +P a9b40029 43043a02 418b6ec3 42c0947a 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 61 +P a9b40029 43043a02 418b6ec3 42c0947a 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 62 +P a9b40029 43043b15 418b550a 42c0997a 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 63 +P a9b40029 43043b15 418b550a 42c0997a 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 64 +P a9b40029 4304406b 418ad78f 42c09d3f 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 65 +P a9b40029 4304406b 418ad78f 42c09d3f 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 66 +P a9b40029 43044491 418a765c 42c09116 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 67 +P a9b40029 43044491 418a765c 42c09116 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 68 +P a9b40029 430449a0 4189ffa1 42c07adf 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 69 +P a9b40029 430449a0 4189ffa1 42c07adf 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 70 +P a9b40029 4304543e 41890682 42c0672e 3f79e038 be12b202 bcc28f99 3e25b44a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 71 +P a9b40029 4304543e 41890682 42c0672e 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b40150 +DC pv=009d4e38 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 72 +P a9b40150 43046998 4187117b 42c06666 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b40150 +DC pv=009d4e38 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 73 +P a9b40150 43046998 4187117b 42c06666 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b40150 +DC pv=009d4e38 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 74 +P a9b40150 4304829f 4184c654 42c06666 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b40150 +DC pv=009d4e38 ov=1 n=1: a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 75 +P a9b40150 4304829f 4184c654 42c06666 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 76 +P a9b4013f 4304a496 4181a968 42c07830 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 77 +P a9b4013f 4304a496 4181a968 42c07830 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 78 +P a9b4013f 4304c507 417d606c 42c08529 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 79 +P a9b4013f 4304c507 417d606c 42c08529 3f79e038 be12b202 bcc28f99 3e25b44a +DI a9b4013f +DC pv=009d4e38 ov=1 n=2: a9b4013f a9b40150 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 80 +P a9b4013f 4304e515 41777f9c 42c08e9b 3f79e038 be12b202 bcc28f99 3e25b44a +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-walkabout.log b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-walkabout.log new file mode 100644 index 00000000..de5eb529 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-walkabout.log @@ -0,0 +1,1805 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-holtburg-walkabout.log' +0:020> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:020> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:020> .reload /f acclient.exe +0:020> r $t0 = 0 +0:020> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n80) { qd } .else { gc }" +0:020> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:020> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:020> bp 00506330 ".printf \"LS\\n\"; gc" +0:020> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:020> g +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +DC pv=009d4398 ov=0 n=1: a9b40170 +BLD a9b40029 +DC pv=009d4398 ov=0 n=1: a9b40150 +DC pv=009d4398 ov=0 n=2: a9b4014f a9b40141 +F 1 +P a9b40029 42f778fd 41b6bf58 42c0a8f0 3f475a3a bdea11a1 3db7747f bf1c3edb +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +DC pv=009d4398 ov=0 n=1: a9b40170 +BLD a9b40029 +DC pv=009d4398 ov=0 n=2: a9b4014f a9b40141 +F 2 +P a9b40029 42f939ff 41b30bd0 42c0a8f9 3f59688c bdff44f1 3d989552 bf01f3d8 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +DC pv=009d4398 ov=0 n=1: a9b40170 +BLD a9b40029 +DC pv=009d4398 ov=0 n=2: a9b4014f a9b40141 +F 3 +P a9b40029 42f939ff 41b30bd0 42c0a8f9 3f59688c bdff44f1 3d989552 bf01f3d8 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +DC pv=009d4398 ov=0 n=1: a9b40170 +BLD a9b40029 +DC pv=009d4398 ov=0 n=2: a9b4014f a9b40141 +F 4 +P a9b40029 42f97145 41b2679a 42c0a8f4 3f5bfd39 be012657 3d936541 befb1181 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +DC pv=009d4398 ov=0 n=1: a9b40170 +BLD a9b40029 +DC pv=009d4398 ov=0 n=2: a9b4014f a9b40141 +F 5 +P a9b40029 42f97145 41b2679a 42c0a8f4 3f5bfd39 be012657 3d936541 befb1181 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +DC pv=009d4398 ov=0 n=1: a9b4014f +F 6 +P a9b40029 42f9b3f3 41b18ad2 42c0a8f7 3f5f5141 be031a8b 3d8c5373 beef06c0 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +DC pv=009d4398 ov=0 n=1: a9b4014f +F 7 +P a9b40029 42f9b3f3 41b18ad2 42c0a8f7 3f5f5141 be031a8b 3d8c5373 beef06c0 +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 8 +P a9b40029 42f9ff21 41b08fc9 42c0a8f7 3f630318 be0545d1 3d83e663 bee0ac7d +LS +BLD aab30023 +BLD aab3000c +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 9 +P a9b40029 42f9ff21 41b08fc9 42c0a8f7 3f630318 be0545d1 3d83e663 bee0ac7d +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 10 +P a9b40029 42fa4e7f 41af92ec 42c0a8f4 3f66ae81 be076d53 3d759e6d bed13074 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 11 +P a9b40029 42fa4e7f 41af92ec 42c0a8f4 3f66ae81 be076d53 3d759e6d bed13074 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 12 +P a9b40029 42faa7a1 41ae8d94 42c0a8f1 3f6a7160 be09a299 3d612011 bebfbc39 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 13 +P a9b40029 42faa7a1 41ae8d94 42c0a8f1 3f6a7160 be09a299 3d612011 bebfbc39 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 14 +P a9b40029 42fafc82 41ada205 42c0a8ee 3f6dafba be0b8a13 3d4d83f6 beaf08af +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 15 +P a9b40029 42fafc82 41ada205 42c0a8ee 3f6dafba be0b8a13 3d4d83f6 beaf08af +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +DC pv=009d4398 ov=0 n=1: a9b4011f +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 16 +P a9b40029 42fb5c32 41acb97e 42c0a8f0 3f70e92b be0d6eab 3d37a603 be9c6903 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +DC pv=009d4398 ov=0 n=1: a9b4011f +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 17 +P a9b40029 42fb5c32 41acb97e 42c0a8f0 3f70e92b be0d6eab 3d37a603 be9c6903 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 18 +P a9b40029 42fbde10 41abbff6 42c0a8f0 3f749502 be0f966c 3d1a96f2 be83a94a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 19 +P a9b40029 42fbde10 41abbff6 42c0a8f0 3f749502 be0f966c 3d1a96f2 be83a94a +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 20 +P a9b40029 42fc5ca5 41aaf824 42c0a8f4 3f777e76 be114c0e 3cfcf406 be576f93 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +DC pv=009d4398 ov=0 n=2: a9b40179 a9b4017a +BLD a9b40031 +BLD a9b40029 +F 21 +P a9b40029 42fc5ca5 41aaf824 42c0a8f4 3f777e76 be114c0e 3cfcf406 be576f93 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +P a9b40029 42fcf6a9 41aa3adf 42c0a8f3 3f7a350f be12e3d6 3cb8ed98 be1d8002 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +P a9b40029 42fcf6a9 41aa3adf 42c0a8f3 3f7a350f be12e3d6 3cb8ed98 be1d8002 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +P a9b40029 42fd8951 41a9bc99 42c0a8f7 3f7bfc5e be13ef23 3c70ce2c bdcd16f8 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +P a9b40029 42fd8951 41a9bc99 42c0a8f7 3f7bfc5e be13ef23 3c70ce2c bdcd16f8 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +P a9b40029 42fe2655 41a989cd 42c0a8f4 3f7d0cba be148f0a 3bcdb5ee bd2f3344 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +P a9b40029 42fe2655 41a989cd 42c0a8f4 3f7d0cba be148f0a 3bcdb5ee bd2f3344 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +P a9b40029 42febaa1 41a98f3a 42c0a8f1 3f7d44c5 be14aff0 bae23407 3c40a739 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +P a9b40029 42febaa1 41a98f3a 42c0a8f1 3f7d44c5 be14aff0 bae23407 3c40a739 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +P a9b40029 42ff4c1d 41a9cbc1 42c0a8f6 3f7cb997 be145e3c bc1e56f2 3d86dae0 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +P a9b40029 42ff4c1d 41a9cbc1 42c0a8f6 3f7cb997 be145e3c bc1e56f2 3d86dae0 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +P a9b40029 42ffe495 41aa6378 42c0a8f2 3f7b48b7 be1385ab bc9549e4 3dfe4b09 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +P a9b40029 42ffe495 41aa6378 42c0a8f2 3f7b48b7 be1385ab bc9549e4 3dfe4b09 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +P a9b40029 43003aeb 41ab2fd0 42c0a8ef 3f790125 be122f0f bcd9d05b 3e398228 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +P a9b40029 43003aeb 41ab2fd0 42c0a8ef 3f790125 be122f0f bcd9d05b 3e398228 +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +P a9b40029 430084a8 41ac62fd 42c0a8f2 3f7591ec be102ae7 bd11b272 3e782cdc +LS +BLD aab50002 +DC pv=009d4398 ov=0 n=1: aab50100 +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40116 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +DC pv=009d4398 ov=0 n=2: a9b4011d a9b4011b +BLD a9b4001a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +P a9b40029 430084a8 41ac62fd 42c0a8f2 3f7591ec be102ae7 bd11b272 3e782cdc +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +P a9b40029 4300c7ef 41adc115 42c0a8f3 3f714da3 be0da9a2 bd34c8e6 3e99f8a9 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +DC pv=009d4398 ov=0 n=2: a9b40118 a9b40117 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +P a9b40029 4300c7ef 41adc115 42c0a8f3 3f714da3 be0da9a2 bd34c8e6 3e99f8a9 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +P a9b40029 4300fac2 41af0930 42c0a8f5 3f6d2593 be0b38f4 bd50ecce 3eb1f018 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +DC pv=009d4398 ov=0 n=2: a9b4013c a9b4013a +DC pv=009d4398 ov=0 n=2: a9b4013d a9b40138 +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 41 +P a9b40029 4300fac2 41af0930 42c0a8f5 3f6d2593 be0b38f4 bd50ecce 3eb1f018 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +DC pv=009d4398 ov=0 n=1: a9b4011f +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 42 +P a9b40029 4301283a 41b071c9 42c0a8f6 3f687bc9 be087c1d bd6c1073 3ec90d49 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +DC pv=009d4398 ov=0 n=1: a9b4011f +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 43 +P a9b40029 4301283a 41b071c9 42c0a8f6 3f687bc9 be087c1d bd6c1073 3ec90d49 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +DC pv=009d4398 ov=0 n=1: a9b4011f +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 44 +P a9b40029 43014e5e 41b1e4b0 42c0a8f6 3f639783 be059cef bd8283e5 3ede50b1 +LS +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +DC pv=009d4398 ov=0 n=1: a9b4011f +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 45 +P a9b40029 43014e5e 41b1e4b0 42c0a8f6 3f639783 be059cef bd8283e5 3ede50b1 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 46 +P a9b40029 430170ef 41b382d9 42c0a8f5 3f5e0008 be02548b bd8f2daa 3ef3e2a1 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 47 +P a9b40029 430170ef 41b382d9 42c0a8f5 3f5e0008 be02548b bd8f2daa 3ef3e2a1 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 48 +P a9b40029 4301803b 41b515c3 42c0a8f9 3f588e3f bdfe449b bd9a3ef7 3f035e5e +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 49 +P a9b40029 4301803b 41b515c3 42c0a8f9 3f588e3f bdfe449b bd9a3ef7 3f035e5e +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 50 +P a9b40029 4301795d 41b6d60c 42c0a8fd 3f526d69 bdf7128d bda586e8 3f0cf9fd +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 51 +P a9b40029 4301795d 41b6d60c 42c0a8fd 3f526d69 bdf7128d bda586e8 3f0cf9fd +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 52 +P a9b40029 43015dba 41b87848 42c0a8fd 3f4c5cff bdeff3cc bdafb094 3f15a1c7 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 53 +P a9b40029 43015dba 41b87848 42c0a8fd 3f4c5cff bdeff3cc bdafb094 3f15a1c7 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 54 +P a9b40029 43015dba 41b87848 42c0a8fd 3f4c5cff bdeff3cc bdafb094 3f15a1c7 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 55 +P a9b40029 4301106b 41ba9617 42c0a900 3f436d06 bde57560 bdbd3098 3f212137 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 56 +P a9b40029 4301106b 41ba9617 42c0a900 3f436d06 bde57560 bdbd3098 3f212137 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 57 +P a9b40029 4301106b 41ba9617 42c0a900 3f436d06 bde57560 bdbd3098 3f212137 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 58 +P a9b40029 4300af76 41bc57d6 42c0a8fd 3f3a812d bddafbd1 bdc938c4 3f2b6088 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 59 +P a9b40029 4300af76 41bc57d6 42c0a8fd 3f3a812d bddafbd1 bdc938c4 3f2b6088 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +DC pv=009d4398 ov=0 n=2: a9b40164 a9b40162 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 60 +P a9b40029 4300af76 41bc57d6 42c0a8fd 3f3a812d bddafbd1 bdc938c4 3f2b6088 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 61 +P a9b40029 43003a57 41bdcb26 42c0a8fb 3f311226 bdcfe837 bdd4a593 3f351b8c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 62 +P a9b40029 43003a57 41bdcb26 42c0a8fb 3f311226 bdcfe837 bdd4a593 3f351b8c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 63 +P a9b40029 43003a57 41bdcb26 42c0a8fb 3f311226 bdcfe837 bdd4a593 3f351b8c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 64 +P a9b40029 42ff7f0f 41bec928 42c0a8fd 3f27f23f bdc53187 bdde9e32 3f3d9992 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 65 +P a9b40029 42ff7f0f 41bec928 42c0a8fd 3f27f23f bdc53187 bdde9e32 3f3d9992 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 66 +P a9b40029 42ff7f0f 41bec928 42c0a8fd 3f27f23f bdc53187 bdde9e32 3f3d9992 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 67 +P a9b40029 42fe77f8 41bf0f09 42c0a8f5 3f202a61 bdbc0eca bde66327 3f443785 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 68 +P a9b40029 42fe77f8 41bf0f09 42c0a8f5 3f202a61 bdbc0eca bde66327 3f443785 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 69 +P a9b40029 42fe77f8 41bf0f09 42c0a8f5 3f202a61 bdbc0eca bde66327 3f443785 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 70 +P a9b40029 42fd6b23 41bebc9c 42c0a8ef 3f19d9d7 bdb4a4bd bdec3edf 3f4934cc +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 71 +P a9b40029 42fd6b23 41bebc9c 42c0a8ef 3f19d9d7 bdb4a4bd bdec3edf 3f4934cc +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 72 +P a9b40029 42fd6b23 41bebc9c 42c0a8ef 3f19d9d7 bdb4a4bd bdec3edf 3f4934cc +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 73 +P a9b40029 42fc4a60 41bdd4fd 42c0a8ed 3f14b322 bdae9864 bdf0c001 3f4d0ae5 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 74 +P a9b40029 42fc4a60 41bdd4fd 42c0a8ed 3f14b322 bdae9864 bdf0c001 3f4d0ae5 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 75 +P a9b40029 42fc4a60 41bdd4fd 42c0a8ed 3f14b322 bdae9864 bdf0c001 3f4d0ae5 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 76 +P a9b40029 42fb29c5 41bc9579 42c0a8f4 3f10942c bda9c1b7 bdf42f97 3f4ff805 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 77 +P a9b40029 42fb29c5 41bc9579 42c0a8f4 3f10942c bda9c1b7 bdf42f97 3f4ff805 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=3: a9b4016e a9b4016a a9b4016c +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 78 +P a9b40029 42fb29c5 41bc9579 42c0a8f4 3f10942c bda9c1b7 bdf42f97 3f4ff805 +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 79 +P a9b40029 42fa07cd 41bb0f4d 42c0a8f8 3f0d45cc bda5dff3 bdf6d6de 3f523a8b +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +BLD a9b40026 +BLD a9b40036 +BLD a9b4001a +DC pv=009d4398 ov=0 n=2: a9b4016e a9b4016a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 80 +P a9b40029 42fa07cd 41bb0f4d 42c0a8f8 3f0d45cc bda5dff3 bdf6d6de 3f523a8b +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-walkout.log b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-walkout.log new file mode 100644 index 00000000..e873db8f --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/holtburg-walkout.log @@ -0,0 +1,1868 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-holtburg-walkout.log' +0:020> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:020> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:020> .reload /f acclient.exe +0:020> r $t0 = 0 +0:020> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n80) { qd } .else { gc }" +0:020> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:020> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:020> bp 00506330 ".printf \"LS\\n\"; gc" +0:020> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:020> g +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 1 +P a9b4013f 4305f666 4153a1aa 42c0a900 3f78bd58 be12074c bce063ce 3e3f1bd7 +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 2 +P a9b4013f 4305f60a 41539e82 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 3 +P a9b4013f 4305f60a 41539e82 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 4 +P a9b4013f 4305f60b 41539e7f 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 5 +P a9b4013f 4305f60b 41539e7f 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 6 +P a9b4013f 4305f60b 41539e81 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 7 +P a9b4013f 4305f60b 41539e81 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 8 +P a9b4013f 4305f60b 41539e83 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 9 +P a9b4013f 4305f60b 41539e83 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 10 +P a9b4013f 4305f60b 41539e84 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 11 +P a9b4013f 4305f60b 41539e84 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 12 +P a9b4013f 4305f60b 41539e85 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 13 +P a9b4013f 4305f60b 41539e85 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 14 +P a9b4013f 4305f60b 41539e86 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 15 +P a9b4013f 4305f60b 41539e86 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 16 +P a9b4013f 4305f60b 41539e87 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 17 +P a9b4013f 4305f60b 41539e87 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 18 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 19 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 20 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 21 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 22 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 23 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 24 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 25 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 26 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 27 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 28 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 29 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 30 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 31 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 32 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 33 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 34 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 35 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 36 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 37 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 38 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 39 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 40 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 41 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 42 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 43 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 44 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 45 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 46 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 47 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 48 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 49 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 50 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 51 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 52 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 53 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 54 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 55 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 56 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 57 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 58 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 59 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 60 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 61 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 62 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 63 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 64 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 65 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 66 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 67 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 68 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 69 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 70 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 71 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 72 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 73 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 74 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 75 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 76 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 77 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 78 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 79 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +DI a9b4013f +DC pv=009d4e38 ov=2 n=3: a9b4013f a9b40150 a9b4014c +LS +BLD a9b3003c +BLD a9b4000f +BLD a9b40017 +BLD a9b4002f +BLD a9b40016 +BLD a9b4001e +DC pv=009d4398 ov=0 n=2: a9b40103 a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +DC pv=009d4398 ov=0 n=1: a9b40100 +BLD a9b40026 +DC pv=009d4398 ov=0 n=1: a9b40124 +BLD a9b40036 +BLD a9b4001a +BLD a9b40022 +BLD a9b40032 +BLD a9b40031 +BLD a9b40029 +F 80 +P a9b4013f 4305f60b 41539e88 42c0a8fd 3f78c11d be120983 bce00784 3e3ecd3d +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/street-portal-gate-dump.txt b/docs/research/2026-08-30-fw-walk-oracle/posed/street-portal-gate-dump.txt new file mode 100644 index 00000000..4786eec3 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/street-portal-gate-dump.txt @@ -0,0 +1,30 @@ +pose cell=a9b40029 origin=<132.77141, 23.892355, 96.33006> +building a9b4001a: dist=54.7 eff=0.0 eyeLocal=<47.290646, 28.046478, 2.3300629> portals=3 + level BSP portal refs: 3 + ref idx=2 other=a9b4016e rawSide=0 exact=True planeD@eye=-43.04 eyeSide=1 clipN=0 gate(side==rawSide)=reject + ref idx=1 other=a9b4016d rawSide=0 exact=True planeD@eye=51.54 eyeSide=0 clipN=0 gate(side==rawSide)=PASS + ref idx=0 other=a9b4016c rawSide=0 exact=True planeD@eye=33.35 eyeSide=0 clipN=0 gate(side==rawSide)=PASS +building a9b4001e: dist=120.2 eff=20.2 eyeLocal=<107.64956, 48.678543, 30.330063> portals=10 + level BSP portal refs: 10 + ref idx=6 other=a9b40107 rawSide=0 exact=True planeD@eye=115.15 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=9 other=a9b4010b rawSide=0 exact=True planeD@eye=59.68 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=4 other=a9b40102 rawSide=0 exact=True planeD@eye=112.65 eyeSide=0 clipN=6 gate(side==rawSide)=PASS + ref idx=3 other=a9b40103 rawSide=0 exact=True planeD@eye=-102.65 eyeSide=1 clipN=6 gate(side==rawSide)=reject + ref idx=7 other=a9b40109 rawSide=0 exact=True planeD@eye=59.68 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=8 other=a9b4010a rawSide=0 exact=True planeD@eye=59.68 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=5 other=a9b40106 rawSide=0 exact=True planeD@eye=116.65 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=0 other=a9b40100 rawSide=0 exact=True planeD@eye=-25.33 eyeSide=1 clipN=4 gate(side==rawSide)=reject + ref idx=1 other=a9b40100 rawSide=0 exact=True planeD@eye=-25.33 eyeSide=1 clipN=4 gate(side==rawSide)=reject + ref idx=2 other=a9b40100 rawSide=0 exact=True planeD@eye=-25.33 eyeSide=1 clipN=4 gate(side==rawSide)=reject +building a9b40022: dist=28.3 eff=0.0 eyeLocal=<12.107626, 25.2714, 2.3300629> portals=3 + level BSP portal refs: 3 + ref idx=2 other=a9b4015e rawSide=0 exact=True planeD@eye=17.11 eyeSide=0 clipN=0 gate(side==rawSide)=PASS + ref idx=0 other=a9b40164 rawSide=0 exact=True planeD@eye=-14.27 eyeSide=1 clipN=0 gate(side==rawSide)=reject + ref idx=1 other=a9b40165 rawSide=0 exact=True planeD@eye=35.27 eyeSide=0 clipN=0 gate(side==rawSide)=PASS +building a9b40026: dist=117.7 eff=17.7 eyeLocal=<-28.271423, 111.60765, 30.330063> portals=5 + level BSP portal refs: 5 + ref idx=1 other=a9b40120 rawSide=1 exact=True planeD@eye=-117.26 eyeSide=1 clipN=4 gate(side==rawSide)=PASS + ref idx=2 other=a9b40122 rawSide=0 exact=True planeD@eye=117.26 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=4 other=a9b40125 rawSide=0 exact=True planeD@eye=117.26 eyeSide=0 clipN=4 gate(side==rawSide)=PASS + ref idx=3 other=a9b40124 rawSide=0 exact=True planeD@eye=-22.07 eyeSide=1 clipN=4 gate(side==rawSide)=reject + ref idx=0 other=a9b4011f rawSide=0 exact=True planeD@eye=-22.07 eyeSide=1 clipN=4 gate(side==rawSide)=reject diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/terrace-center.log b/docs/research/2026-08-30-fw-walk-oracle/posed/terrace-center.log new file mode 100644 index 00000000..f8536984 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/terrace-center.log @@ -0,0 +1,789 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-terrace-center.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 1 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 2 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 3 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 4 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 5 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 6 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 7 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 8 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 9 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 10 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 11 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 12 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 13 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 14 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 15 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 16 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 17 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 18 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 19 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 20 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 21 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 22 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 23 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 24 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 25 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 26 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 27 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 28 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 29 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 30 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 31 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 32 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 33 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 34 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 35 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 36 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 37 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 38 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 39 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +DI f4180104 +DC pv=009d4e38 ov=1 n=1: f4180104 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +BLD f418000c +BLD f418000b +F 40 +P f4180104 42076245 425ebea2 432c214a bf3c0083 3ddcbdee bdc74a9f 3f29bba9 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/posed/terrace-edge.log b/docs/research/2026-08-30-fw-walk-oracle/posed/terrace-edge.log new file mode 100644 index 00000000..10e8bb3b --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/posed/terrace-edge.log @@ -0,0 +1,834 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-cap-terrace-edge.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0x81ef00+4), poi(0x81ef00+0x3c), poi(0x81ef00+0x40), poi(0x81ef00+0x44), poi(0x81ef00+8), poi(0x81ef00+0xc), poi(0x81ef00+0x10), poi(0x81ef00+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 1 +P f418000b 41c6b82f 425abe2d 432c216f bf3bfcd6 3ddcb99d bdc74f67 3f29bfbb +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 2 +P f418000b 41c6bab4 425abe28 432c2156 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 3 +P f418000b 41c6bab4 425abe28 432c2156 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 4 +P f418000b 41c6bab5 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 5 +P f418000b 41c6bab5 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 6 +P f418000b 41c6bab3 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 7 +P f418000b 41c6bab3 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 8 +P f418000b 41c6bab2 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 9 +P f418000b 41c6bab2 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 10 +P f418000b 41c6bab1 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 11 +P f418000b 41c6bab1 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 12 +P f418000b 41c6bab0 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 13 +P f418000b 41c6bab0 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 14 +P f418000b 41c6baaf 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 15 +P f418000b 41c6baaf 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 16 +P f418000b 41c6baae 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 17 +P f418000b 41c6baae 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 18 +P f418000b 41c6baad 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 19 +P f418000b 41c6baad 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 20 +P f418000b 41c6baac 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 21 +P f418000b 41c6baac 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 22 +P f418000b 41c6baab 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 23 +P f418000b 41c6baab 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 24 +P f418000b 41c6baaa 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 25 +P f418000b 41c6baaa 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 26 +P f418000b 41c6baa9 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 27 +P f418000b 41c6baa9 425abe27 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 28 +P f418000b 41c6baa8 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 29 +P f418000b 41c6baa8 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 30 +P f418000b 41c6baa7 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 31 +P f418000b 41c6baa7 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 32 +P f418000b 41c6baa6 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 33 +P f418000b 41c6baa6 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 34 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 35 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 36 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 37 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 38 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 39 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4398 ov=0 n=1: f4180106 +BLD f418000c +DC pv=009d4398 ov=0 n=1: f4180101 +BLD f418000b +DC pv=009d4398 ov=0 n=1: f4180104 +F 40 +P f418000b 41c6baa5 425abe26 432c2157 bf3bfcd5 3ddcb99c bdc74f68 3f29bfbc +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/terrace-center.log b/docs/research/2026-08-30-fw-walk-oracle/terrace-center.log new file mode 100644 index 00000000..099fbb29 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/terrace-center.log @@ -0,0 +1,743 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-terrace-center.log' +0:021> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:021> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:021> .reload /f acclient.exe +0:021> r $t0 = 0 +0:021> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:021> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:021> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:021> bp 00506330 ".printf \"LS\\n\"; gc" +0:021> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:021> g +F 1 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 2 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 3 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 4 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 5 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 6 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 7 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 8 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 9 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 10 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 11 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 12 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 13 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 14 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 15 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 16 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 17 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 18 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 19 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 20 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 21 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 22 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 23 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 24 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 25 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 26 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 27 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 28 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 29 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 30 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 31 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 32 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 33 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 34 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 35 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 36 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 37 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 38 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 39 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=1: f4180106 +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-oracle/terrace-edge.log b/docs/research/2026-08-30-fw-walk-oracle/terrace-edge.log new file mode 100644 index 00000000..adf272b0 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-oracle/terrace-edge.log @@ -0,0 +1,743 @@ +Opened log file 'C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-terrace-edge.log' +0:018> .sympath C:\Users\erikn\source\repos\acdream\refs +Symbol search path is: C:\Users\erikn\source\repos\acdream\refs +Expanded Symbol search path is: c:\users\erikn\source\repos\acdream\refs + +************* Path validation summary ************** +Response Time (ms) Location +OK C:\Users\erikn\source\repos\acdream\refs +0:018> .symopt+ 0x40 +Symbol options are 0xB0367: + 0x00000001 - SYMOPT_CASE_INSENSITIVE + 0x00000002 - SYMOPT_UNDNAME + 0x00000004 - SYMOPT_DEFERRED_LOADS + 0x00000020 - SYMOPT_OMAP_FIND_NEAREST + 0x00000040 - SYMOPT_LOAD_ANYTHING + 0x00000100 - SYMOPT_NO_UNQUALIFIED_LOADS + 0x00000200 - SYMOPT_FAIL_CRITICAL_ERRORS + 0x00010000 - SYMOPT_AUTO_PUBLICS + 0x00020000 - SYMOPT_NO_IMAGE_SEARCH + 0x00080000 - SYMOPT_NO_PROMPTS +0:018> .reload /f acclient.exe +0:018> r $t0 = 0 +0:018> bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +0:018> bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +0:018> bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +0:018> bp 00506330 ".printf \"LS\\n\"; gc" +0:018> bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +0:018> g +F 1 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 2 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 3 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 4 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 5 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 6 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 7 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 8 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 9 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 10 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 11 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 12 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 13 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 14 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 15 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 16 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 17 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 18 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 19 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 20 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 21 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 22 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 23 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 24 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 25 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 26 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 27 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 28 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 29 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 30 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 31 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 32 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 33 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 34 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 35 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 36 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 37 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 38 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 39 +LS +BLD f518002e +BLD f4170011 +BLD f4170012 +BLD f4170002 +BLD f3180020 +BLD f4180011 +BLD f4180001 +BLD f4180009 +BLD f4180002 +BLD f4180004 +BLD f4180014 +BLD f418000a +DC pv=009d4b08 ov=0 n=2: f4180106 f418010f +BLD f418000c +BLD f418000b +DC pv=009d4b08 ov=0 n=1: f4180104 +F 40 +quit: +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\atlmfc.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\concurrency.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\cpp_rest.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\ObjectiveC.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\stl.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Data.Json.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Geolocation.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Devices.Sensors.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\Windows.Media.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\windows.natvis' +NatVis script unloaded from 'C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\Visualizers\winrt.natvis' diff --git a/docs/research/2026-08-30-fw-walk-pseudocode-appendix.md b/docs/research/2026-08-30-fw-walk-pseudocode-appendix.md new file mode 100644 index 00000000..5bbf7b83 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-pseudocode-appendix.md @@ -0,0 +1,1218 @@ +# FW0 decomp-read appendix - raw extraction reports (2026-08-30) + +Five parallel reads of the named retail decomp (BN pseudo-C cross-checked against Ghidra patchmem where flag-mush demanded it). The distilled port model is docs/research/2026-08-30-fw-walk-pseudocode.md; this appendix preserves the complete per-function extractions verbatim. + +## Report 1 - Rooting (RenderNormalMode / update_viewer / set_default_view) + +### SmartBox::RenderNormalMode @0x00453aa0 + +**Summary:** The per-frame world-render root. If the scene is open, roots the frame on ONE test: is the viewer (camera) position's cell id outdoor (low word < 0x100)? Outdoor: full-screen default view + sunlight + LScape::draw. Indoor: optional landscape-viewpoint refresh (only when viewer_cell->seen_outside) then RenderDevice::DrawInside(viewer_cell). Afterwards flushes the alpha list, fires the target bounding-box callback and the generic rendering callback. + +```c +void SmartBox::RenderNormalMode() { + RenderDevice* rd = RenderDevice::render_device; + if (rd->m_bOpenScene) { + bool viewer_outdoors = (viewer.objcell_id & 0xFFFF) < 0x100; // THE rooting decision + bool sees_outside = viewer_outdoors || viewer_cell->seen_outside; // short-circuit: seen_outside only read when indoors + if (!m_bUseViewDistance) + Render::SetFOVRad(m_fGameFOV / (rd->m_ViewportAspectRatio - 0.1f)); // 0x3dcccccd + else + Render::set_vdst(m_fViewDistFOV); + if (viewer_outdoors) { + LScape::update_viewpoint(lscape, viewer.objcell_id); + Render::update_viewpoint(&viewer); + Render::set_default_view(); // full-screen clip window, no portal clipping + Render::useSunlightSet(1); + LScape::draw(lscape); // landscape+buildings pass (the trace's outdoor frame) + } else { + if (sees_outside) { // == viewer_cell->seen_outside here + uint outCell = Position::get_outside_cell_id(&viewer); + LScape::update_viewpoint(lscape, outCell); // pre-arm LScape so DrawCells(ov=1) can draw it through the exit view + } + Render::update_viewpoint(&viewer); + rd->vtbl->DrawInside(rd, (CEnvCell*)viewer_cell); // vtbl slot +0x48 = DrawInside(CEnvCell*); NO set_default_view, NO useSunlightSet here + } + } + D3DPolyRender::FlushAlphaList(0.0f); + if (target_object_id != 0 && target_callback != NULL) { + ObjectSelectStatus st = SmartBox::GetObjectBoundingBox(this, target_object_id, &rect, &depth); + target_callback(target_object_id, st, &rect, depth); + } + if (m_renderingCallback) m_renderingCallback(); +} + +// Frame-root chain (callers): +// SmartBox::Draw @0x00455570: { if (hidden) return; tailcall DrawNoBlit(); } +// SmartBox::DrawNoBlit @0x00454c20: +// SetNormalMode(); // leaves creature (portrait) mode if active, restores game ambient, flush_cells +// if (player) { update_viewer(); // resolves viewer + viewer_cell (see below) +// if (viewer_cell != NULL) RenderNormalMode(); } // nothing drawn when camera cell unresolved +// if (lookingForObject) { harvest Render::GetMouseSelectionPartIndex/ObjectID -> click_object_*; ECM_UI::SendNotice_SmartBoxObjectFound; lookingForObject=0; } +// Render::clear_selection_cursor(); +``` + +**Gotchas:** BN pseudo-C mangles the rooting condition into register mush (`edi_2 = -((edi - edi))`); Ghidra on the same PDB-paired binary resolves it as `((viewer.objcell_id & 0xFFFF) < 0x100)` — i.e. the test is on the VIEWER (camera) position's cell id, not the player's, and not a null test on viewer_cell. `viewer_cell` is guaranteed non-null by DrawNoBlit's guard; outdoors it is the camera's CLandCell but is not used by the outdoor branch. `sees_outside` is computed before the FOV block but only matters on the indoor branch (short-circuit protects the deref order, not a semantic OR). The FOV divisor constant is aspect_ratio - 0.1f (0x3dcccccd). Vtable offset 0x48 verified against RenderDeviceVtbl in acclient.h = DrawInside(CEnvCell*). Note the indoor branch does NOT call set_default_view or useSunlightSet — DrawInside/PView machinery owns view + lighting setup there. + +### SmartBox::update_viewer @0x00453ce0 + +**Summary:** Resolves the camera position (`viewer`) and camera cell (`viewer_cell`) each frame, called by DrawNoBlit immediately before RenderNormalMode. Sweeps the global viewer collision sphere from a pivot point on the player (CameraManager pivot part + pivot_offset) toward viewer_sought_position (produced by CameraManager::UpdateCamera via SmartBox::PlayerPhysicsUpdatedCallback) using the full CTransition collision machinery; the sweep's final curr_pos/curr_cell become viewer/viewer_cell. Two fallbacks: AdjustPosition on the raw sought position, else camera at player position with viewer_cell = NULL (frame not rendered). + +```c +void SmartBox::update_viewer() { + CPhysicsObj* player = this->player; + if (!player) return; + if (player->cell == NULL) { + CPhysicsObj::reenter_visibility(player); + player = this->player; + if (player->cell == NULL) { set_viewer(&player->m_position, 1); viewer_cell = NULL; return; } + } + Render::player_pos.objcell_id = player->m_position.objcell_id; // global used by lighting distance math + Render::player_pos.frame = player->m_position.frame; + if (static_camera) return; // global debug toggle: keep last viewer + + Position sought = viewer_sought_position; // camera's DESIRED position (CameraManager output) + CameraManager* cm = camera_manager; + // pivot frame: a specific setup part when pivot_part_index valid, else the object frame + Frame F; + if (cm->pivot_part_index != -1 && cm->pivot_part_index < player->part_array->num_parts) + F = player->part_array->parts[cm->pivot_part_index]->pos.frame; + else + F = player->m_position.frame; + F.m_fOrigin += F.localtoglobalvec(cm->pivot_offset); // pivot offset rotated into world axes (writes Frame +0x34..0x3C = m_fOrigin) + + // resolve the START cell containing the pivot point + CObjCell* startCell; + if ((player->m_position.objcell_id & 0xFFFF) < 0x100) { + startCell = player->cell; // outdoors: pivot stays in the player's landcell + } else { + Position p = { player->m_position.objcell_id, F }; + if (!CPhysicsObj::AdjustPosition(&p, &viewer_sphere, &startCell, 0, 1)) + startCell = player->cell; // fallback + } + Position startPos = { startCell->m_DID.id, F }; // pivot expressed in startCell + sought.frame.m_fOrigin = Position::localtoglobal(&startPos, ..., &sought); // sought origin re-based into startCell's block space + Position endPos = { startCell->m_DID.id, sought.frame }; + + CTransition* t = CTransition::makeTransition(); + if (!t) return; + CTransition::init_object(t, player, 0x5C); // OBJECTINFO state = 0x5C + CTransition::init_sphere(t, 1, &viewer_sphere, 1.0f); // ONE sphere, global viewer_sphere, scale 1 + CTransition::init_path(t, startCell, &startPos, &endPos); // sweep pivot -> desired camera spot + if (CTransition::find_valid_position(t)) { + set_viewer(&t->sphere_path.curr_pos, 0); + viewer_cell = t->sphere_path.curr_cell; // <- THE camera cell (CEnvCell indoors / CLandCell outdoors) + } else if (CPhysicsObj::AdjustPosition(&sought /*local_120*/, &viewer_sphere, &cellOut, 0, 1)) { + set_viewer(&sought, 0); + viewer_cell = cellOut; // fallback 1: desired spot pushed into a valid cell + } else { + set_viewer(&player->m_position, 1); // fallback 2: camera collapses onto the player, + viewer_cell = NULL; // viewer_cell NULL => DrawNoBlit skips RenderNormalMode + } + CTransition::cleanupTransition(t); +} +``` + +**Gotchas:** Ghidra mislabels the pivot-offset add as `local_16c.fl2gv[6..8]` — its own stale Frame typedef; BN's stack offsets (+0x34/+0x38/+0x3C from the Frame base) match acclient.h's Frame {quat 0x00; m_fl2gv[9] 0x10; m_fOrigin 0x34}, so the target is m_fOrigin. The Position::localtoglobal arg list is heuristic in both decomps (BN shows 3 args, the retail signature has a point arg); the semantic effect — sought origin re-expressed relative to startCell's landblock — is solid from the surrounding data flow. init_object flag 0x5C reads, per GDLE's ObjectInfoEnum naming, as IS_VIEWER(0x4)|PATH_CLIPPED(0x8)|FREE_ROTATE(0x10)|PERFECT_CLIP(0x40) — interpretive, verify before porting names. `viewer_sphere` is a global CSphere (the camera's collision ball); its radius initializer was not chased in this pass. Note set_viewer itself nulls viewer_cell unconditionally, so the success paths assign viewer_cell AFTER the set_viewer call — preserve that order. viewer_sought_position is written by SmartBox::PlayerPhysicsUpdatedCallback @0x00452d60 = CameraManager::UpdateCamera output, i.e. camera desire updates on physics ticks, camera RESOLUTION happens per render frame here. + +### SmartBox::set_viewer @0x00452c40 + +**Summary:** Commits a camera position: copies pos into `viewer` (and into `viewer_sought_position` when arg3 != 0 — the failure/reset paths), NULLs viewer_cell, rebuilds the single viewer dynamic light (offset z=+2m above the player when a player exists, else at the viewer itself, for light types 0/2), re-adds cell dynamic lights, and pushes the viewer position into SoundManager, LScape sky, and SceneTool camera. + +```c +void SmartBox::set_viewer(const Position* pos, int reset_sought) { + viewer.objcell_id = pos->objcell_id; viewer.frame = pos->frame; + if (reset_sought) { viewer_sought_position = *pos; } + viewer_cell = NULL; // caller reassigns on success paths + viewer_light.intensity = s_fViewerLightIntensity; + viewer_light.falloff = s_fViewerLightFalloff; + Render::world_lights.num_dynamic_lights = 0; + if (player != NULL) { + if (viewer_light.type == 0 || viewer_light.type == 2) viewer_light.offset.m_fOrigin = (0, 0, 2.0f); + lightCell = player->m_position.objcell_id; lightFrame = &player->m_position.frame; + } else { + if (viewer_light.type == 0 || viewer_light.type == 2) viewer_light.offset.m_fOrigin = (0, 0, 0); + lightCell = viewer.objcell_id; lightFrame = &viewer.frame; + } + Render::add_dynamic_light(&viewer_light, lightCell, lightFrame); + CObjCell::add_dynamic_lights(); + SoundManager::SetPlayerPosition(&viewer); + LScape::set_sky_position(lscape, &viewer); + SceneTool::SetupCamera(&viewer); +} +``` + +**Gotchas:** arg3 semantics: 1 = also overwrite viewer_sought_position (used when the camera is forced onto the player after a resolution failure, and by teleport paths at 0x004538d5); 0 = normal per-frame commit. The unconditional `viewer_cell = NULL` means callers MUST set viewer_cell after calling — an easy ordering bug in a port. + +### Position::get_outside_cell_id @0x004527b0 + +**Summary:** Projects a position to the outdoor landcell gid that contains its x,y. Copies origin + objcell_id, calls LandDefs::adjust_to_outside on the copies, returns the adjusted outdoor cell id on success, 0 on failure. Used by RenderNormalMode's indoor branch to point LScape's viewpoint at the landcell 'outside' the viewer's EnvCell. + +```c +uint Position::get_outside_cell_id() { + Vector3 p = frame.m_fOrigin; + uint cid = objcell_id; + int ok = LandDefs::adjust_to_outside(&cid, &p); // regparm + return ok ? cid : 0; // (BN renders the select as reg mush; Ghidra: -(uint)(ok!=0) & cid) +} + +// LandDefs::adjust_to_outside @0x005a9bc0: +// low16 of cid must be in [1,0x40] (outdoor cells) or [0x100,0xFFFD] (envcells) or == 0xFFFF (block-only), else fail; +// |x| < 0.0002f -> x = 0; |y| < 0.0002f -> y = 0; // epsilon snap +// if (LandDefs::get_outside_lcoord(cid, &p, &lx, &ly)) { +// cid = LandDefs::lcoord_to_gid(lx, ly); +// p.x = p.x - floor(p.x / C) * C; p.y likewise; // wrap into cell-local range +// return 1; +// } +// cid = 0; return 0; // failure zeroes the id +``` + +**Gotchas:** The wrap constant C in adjust_to_outside is FPU-elided by BN (prints as `0f`) — recover it from the raw binary (reference_pe_byte_decode.md) before porting; it is the cell/block modulus, not zero. The epsilon 0.000199999995f is exact (2e-4). Both decomps' return-select expressions are branchless artifacts of `neg/sbb`; semantics are the ternary shown. + +### Render::set_default_view @0x0054ef50 + +**Summary:** Resets the portal-view system to one full-screen view. Lazily initializes a function-static `window` (portal_view_type: portal/poly/vertex DArrays, blocksize 0x80, view_timestamp 0), zeroes its view_count and vertex_count_total, calls copy_view(&window, NULL, 0) to synthesize the 4-vertex full-viewport clip polygon, sets Render::PortalList = &window, and makes it current via Render::set_view(&window.view, 0). This is the outdoor frame's 'no portal clipping' state; interior rendering replaces it with portal-clipped views. + +```c +void Render::set_default_view() { + static portal_view_type window; // one-time static init: + // window.portal.{data,sizeOf,next_available}=0, blocksize=0x80; + // window.view.poly.{...}=0, blocksize=0x80; window.view.vertex.{...}=0, blocksize=0x80; + // window.view_timestamp = 0; atexit(dtor); + window.view_count = 0; + window.view.vertex_count_total = 0; + Render::copy_view(&window, NULL, 0); + Render::PortalList = &window; + Render::set_view(&window.view, 0); +} + +// copy_view(&window, NULL, 0) — the src==NULL branch @0x0054e003 (else-arm): +// poly[view_count] = { num_pts = 4, vertex_index = vertex_count_total }; +// vertices (stride 0x18): v0=(0, H), v1=(W, H), v2=(W, 0), v3=(0, 0), v4=v0 repeated // W/H = RenderDevice viewport width/height +// then computes and stores poly xmin/xmax/ymin/ymax from the vertices (here: 0..W, 0..H); +// when newmethod != 1, additionally builds per-edge view planes from Render::Yaxis * Render::vdst (frustum side planes). +// +// Render::set_view(view_type* v, int n) @0x0054d0e0 — makes poly n of v the ACTIVE clip window: +// Render::portal_view = v; Render::portal_view_num = n; +// Render::portal_npnts = v->poly.data[n].num_pts; +// Render::portal_inmask = (1 << (npnts + 1)) - 1; +// Render::portal_vertex = &v->vertex.data[v->poly.data[n].vertex_index]; +// Render::xmin/xmax/ymin/ymax = poly[n].xmin/xmax/ymin/ymax; +``` + +**Gotchas:** Other production callers: Render::Set3DViewInternal @0x0054f070 (after SetFOVInternal, clearing selection state) and SmartBox::GetObjectBoundingBox @0x00452e4a plus the creature-portrait path @0x00452bb9 — so the 'default full-screen view' is also the baseline for selection/bounds math, not only outdoor world draw. copy_view's screen-space poly winding here is (0,H)->(W,H)->(W,0)->(0,0) with the first vertex duplicated at the end — preserve the duplicate; portal_inmask's (1<<(n+1))-1 counts it. The `newmethod` global gates the per-edge plane build; its value at runtime was not established in this pass (live-read before assuming a branch runs — feedback_live_read_capability_gates). + +**Report notes:** Reconciliation with the 2026-08-30 fw-walk oracle: the trace's two frame shapes fall directly out of RenderNormalMode's single rooting test on the CAMERA cell id, (viewer.objcell_id & 0xFFFF) < 0x100. Outdoor frames: set_default_view (full-screen clip window) + useSunlightSet(1) + LScape::draw — the interleaved DrawBuilding far-to-near and PView::DrawCells(ov=0) look-in punches happen INSIDE LScape::draw / the building draw, not in this function. Interior frames: RenderDevice::DrawInside(viewer_cell) with NO set_default_view and NO sunlight-set switch at this level (PView/DrawInside owns those); the only landscape work RenderNormalMode does indoors is pre-arming LScape::update_viewpoint with Position::get_outside_cell_id(&viewer) when viewer_cell->seen_outside — which is exactly what lets DrawCells(ov=1) draw LScape through the exit view. Camera pipeline ownership: CameraManager::UpdateCamera writes viewer_sought_position on physics updates (SmartBox::PlayerPhysicsUpdatedCallback @0x00452d60); SmartBox::update_viewer resolves it per render frame by sweeping the global viewer_sphere from the player pivot with the full CTransition collision machinery (OBJECTINFO 0x5C, one sphere, scale 1.0), so viewer_cell is a collision-resolved cell, never a lookup by coordinates; when resolution fails entirely, viewer_cell = NULL and DrawNoBlit skips RenderNormalMode — the frame draws no world. Frame chain: SmartBox::Draw (hidden gate) -> DrawNoBlit -> SetNormalMode (portrait-mode exit) -> update_viewer -> [viewer_cell != NULL] RenderNormalMode -> mouse-selection harvest -> clear_selection_cursor. Cross-checks used: Ghidra MCP (patchmem.gpr, port 8081) decomps of 0x00453aa0/0x00453ce0/0x004527b0/0x00454c20 to resolve BN register mush, and acclient.h verbatim structs (SmartBox @35189, Frame @30647, Position @30658, RenderDeviceVtbl @39019 — slot +0x48 = DrawInside(CEnvCell*), CameraManager @35238). Source file: docs/research/named-retail/acclient_2013_pseudo_c.txt (RenderNormalMode at line 92635; update_viewer 92761; set_viewer 91780; get_outside_cell_id 91552; set_default_view 345550; set_view 343750; copy_view 344784; adjust_to_outside 438719; DrawNoBlit 93707; Draw 94280). + +## Report 2 - Interior recursion (DrawInside / DrawCells / remove_views) + +### PView::DrawInside @0x005a5860 + +**Summary:** Interior-frame root draw. Given the camera's CEnvCell, it pushes a fresh view onto that cell, adds views for every cell in the cell's stab list, pushes an identity Position stamped with the cell's DID, seeds the top view as the full screen, runs the ConstructView flood (portal BFS that builds cell_draw_list and may add exit views into outside_view), draws everything via DrawCells, then pops the position and unwinds every view it pushed. + +```c +void PView::DrawInside(PView* this, CEnvCell* cell) { + Render::object_scale_vec = (1,1,1); Render::object_scale = 1.0f; + + CEnvCell::curr_view_push(cell); // cell->num_view += 1; (re)allocs+zeroes portal_view.data[num_view] (0x48 bytes: portal DArray, view poly/vertex DArrays, blocksize 0x80) and resets view_count=0, update_count=0, view_timestamp=0 + PView::add_views(this, cell->num_stabs, cell->stab_list); // curr_view_push on every stab cell that GetVisible() finds + + Position pos; // local, vtable 0x796910 + pos.objcell_id = 0; + pos.frame = identity; // quat (1,0,0,0), origin (0,0,0) + Frame::cache(&pos.frame); // build cached rotation matrix + pos.objcell_id = cell->m_DID.id; // Ghidra-confirmed: DID stored AFTER Frame::cache, before push + Render::positionPush(3, &pos); // push identity position, mode 3 + + Render::copy_view(cell->portal_view.data[cell->num_view - 1], nullptr, 4); // seed the cell's TOP view as the full screen (null clip pts, 4 corners) + + PView::ConstructView(this, cell, 0xffff); // CEnvCell overload @0x005a57b0: outside_view.view_count = 0; master_timestamp++; BFS: InitCell + InsCellTodoList, then pop todo -> append to cell_draw_list (grow by +0x1e), mark top view cell_view_done=1, ClipPortals(cell,0) -> AddViewToPortals; exit portals feed outside_view + + PView::DrawCells(this, 0); // literal 0 pushed (Ghidra); the param is DEAD inside DrawCells + + Render::framePop(); // Ghidra names this call Render::positionPop() — undoes positionPush + PView::remove_views(this, cell->num_stabs, cell->stab_list); // num_view -= 1 on every visible stab cell + cell->num_view -= 1; // undo the initial curr_view_push on the camera cell +} +``` + +**Gotchas:** BN shows `edx_2 = ConstructView(...)` then `DrawCells(this, edx_2)` — that is a fastcall misdetect; Ghidra shows the real pushed literal is 0 (BN's stray `var_60_2 = 0` IS that stack argument), and DrawCells never reads it anyway. BN drops the `pos.objcell_id = cell->m_DID.id` store (shows a dead `uint32_t id = arg2->m_DID.id`); Ghidra confirms the store into the local Position after Frame::cache. BN names the epilogue call Render::framePop, Ghidra names the same call site Render::positionPop — it is the counterpart of positionPush(3, …). num_stabs/stab_list live on the CObjCell base (acclient.h ~30927), not on CEnvCell itself. remove_views only decrements num_view — the portal_view slot object stays allocated for reuse. + +### PView::DrawCells @0x005a4840 + +**Summary:** Draws the flooded cell list built by ConstructView, far-to-near (cell_draw_list walked from cell_draw_num-1 down to 0). Gate: only if outside_view.view_count != 0 (the trace's 'ov') does it draw the landscape through the exit views, conditionally clear, and punch the never-drawn portal polys of portals whose other_cell_id == -1. Then, unconditionally, it draws every cell's BSP geometry per view and finally the cells' contained objects with Render::PortalList pointed at each cell's top view. + +```c +void PView::DrawCells(PView* this, int deadArg /*UNUSED*/) { + // ---- ov branch: only when exit views into the outdoors exist ---- + if (this->outside_view.view_count != 0) { // 'ov' in the live trace + Render::useSunlightSet(1); + Render::PortalList = &this->outside_view; // offset 0 of PView; LScape clips through the exit views + LScape::draw(this->lscape); + D3DPolyRender::FlushAlphaList(0.0f); + RenderDevice::render_device->m_nFrameStamp += 1; + // clear condition: forceClear global OR portals were drawn since last reset + bool drawn = (D3DPolyRender::portalsDrawnCount != 0); + D3DPolyRender::portalsDrawnCount = 0; // read-then-reset happens even when forceClear != 0 skips the read? (BN: reset only in forceClear==0 arm; Ghidra: reset in the condition — reset occurs whenever the second operand is evaluated, i.e. when forceClear==0. With forceClear!=0 the count is left alone.) + if (forceClear != 0 || drawn) + RenderDevice::render_device->vtbl->Clear(4, &RGBAColor_Black /*0x00820fc0 = ADDRESS of the constant*/, 1.0f); + + // per-cell portal-poly punch pass, far-to-near + for (i = cell_draw_num; i != 0; i--) { + CEnvCell* c = cell_draw_list.data[i-1]; + if (c->structure->drawing_bsp == 0) continue; + RenderDeviceD3D::SetCurrentMaterial(render_device, nullptr, 0); + Render::SetSurfaceArray(c->surfaces); + object_scale_vec=(1,1,1); object_scale=1.0f; + Render::positionPush(3, &c->pos); + uint views = (c->num_view == 0) ? 0xFFFF // degenerate sentinel path, see gotchas + : (uint16)c->portal_view.data[c->num_view-1]->view_count; + if (views != 0) { // view_count==0 -> skip straight to pop + for (v = 0; v < views; v++) { + CEnvCell::setup_view(c, v); // = Render::set_view(&top_view->view, v) + for (j = 0; j < c->num_portals; j++) // CCellPortal stride 0x18 + if (c->portals[j].other_cell_id == 0xFFFFFFFF) // portal leads OUTSIDE + D3DPolyRender::DrawPortalPolyInternal(c->portals[j].portal, 0); + } + } + Render::framePop(); // positionPop + } + } + + // ---- always runs, ov or not ---- + Render::useSunlightSet(0); + Render::restore_all_lighting(); + + // pass 2: cell BSP geometry, far-to-near, per view + for (i = cell_draw_num; i != 0; i--) { + CEnvCell* c = cell_draw_list.data[i-1]; + if (c->structure->drawing_bsp == 0) continue; + SetCurrentMaterial(render_device, nullptr, 0); + Render::SetSurfaceArray(c->surfaces); + object_scale_vec=(1,1,1); object_scale=1.0f; + Render::positionPush(3, &c->pos); + uint views = (c->num_view == 0) ? 0xFFFF : (uint16)c->portal_view.data[c->num_view-1]->view_count; + if (views != 0) + for (v = 0; v < views; v++) { + CEnvCell::setup_view(c, v); + render_device->vtbl->DrawEnvCell(c); // vtable +0x5c + } + Render::framePop(); + } + + // pass 3: contained/static objects, far-to-near — no drawing_bsp gate, no per-view loop + for (i = cell_draw_num; i != 0; i--) { + CEnvCell* c = cell_draw_list.data[i-1]; + Render::PortalList = c->portal_view.data[c->num_view - 1]; // objects clip against the CELL's top view + render_device->vtbl->DrawObjCellForDummies(c); // vtable +0x64 + } + + object_scale_vec=(1,1,1); object_scale=1.0f; + Render::useSunlightSet(1); +} +``` + +**Gotchas:** (1) The int parameter (0 from DrawInside, 1 from DrawPortal) is NEVER read — the live trace's 'ov' is NOT this argument, it is outside_view.view_count read at entry (confirmed by the fw-walk-oracle README line format 'DC pv=… ov='). (2) BN's 0x820fc0 in the Clear call is the ADDRESS of the RGBAColor_Black constant, not a packed color; flags=4, z=1.0f — the flag's D3D mapping goes through RenderDevice::Clear, don't assume raw D3DCLEAR bits. (3) The num_view==0 path loads a 0xFFFF(-1 masked to uint16) view count and would spin 65535 setup_view iterations — a degenerate path that can't be hit in practice because every cell in cell_draw_list got curr_view_push'd (num_view>=1); do not port it as meaningful behavior. (4) portalsDrawnCount is reset only on the forceClear==0 arm (short-circuit). (5) Punch pass draws portal polys only for portals with other_cell_id == -1 (CCellPortal offset 0, stride 0x18; poly at offset 8) — i.e. portals opening to the landscape — once per view of the cell's TOP portal_view. (6) Passes 1/2 gate on structure->drawing_bsp != 0; pass 3 (objects) does not, and it swaps Render::PortalList per cell without restoring it. (7) view_count checks in Ghidra are !=0 (BN shows >0 on an int16) — counts are non-negative in practice so equivalent. + +### PView::remove_views @0x005a42e0 + +**Summary:** Exact inverse of PView::add_views: walks a stab list (count + id array) and decrements num_view on every cell CEnvCell::GetVisible resolves, popping the view that add_views pushed via curr_view_push. It frees nothing — the portal_view slot object (0x48 bytes) stays allocated on the cell for reuse by the next push. + +```c +void PView::remove_views(PView* this, uint16 num_stabs, uint32* stab_list) { + if (num_stabs > 0) { + for (i = 0; i < num_stabs; i++) { + CEnvCell* c = CEnvCell::GetVisible(stab_list[i]); + if (c != 0) + c->num_view -= 1; // pop the top view; no deallocation, no field reset + } + } +} +``` + +**Gotchas:** Cells that were visible at add_views time but no longer resolve via GetVisible at remove time are silently skipped — a cell unloaded mid-draw would leak a num_view increment (can't happen within one frame). Counterpart add_views @0x005a5210 has the identical shape but calls CEnvCell::curr_view_push, which resets view_count/update_count/view_timestamp to 0 on the (re)used top slot; remove_views does NOT touch those fields on the way down. + +**Report notes:** Cross-checked BN pseudo-C (docs/research/named-retail/acclient_2013_pseudo_c.txt) against the live Ghidra MCP decomp (patchmem, port 8081) for all three bodies plus DrawPortal; struct offsets verified in docs/research/named-retail/acclient.h. Key reconciliation with the 2026-08-30 fw-walk-oracle trace: 'ov' in the DC log lines is this->outside_view.view_count at DrawCells entry (the README's own line format says so), NOT DrawCells' int argument — that argument (0 from DrawInside @0x005a5952, 1 from DrawPortal @0x005a5b53) is dead code inside DrawCells. So interior frames with a surviving exit-view chain hit the ov!=0 branch (LScape drawn through the exit views with Render::PortalList = &outside_view, conditional depth-ish Clear(4, black, 1.0), portal-poly punches for other_cell_id==-1 portals), while foundry-deep-style ov=0 frames skip straight to the BSP + object passes. Supporting bodies read: PView::add_views @0x005a5210, CEnvCell::curr_view_push @0x005a5090 (num_view++ with 0x48-byte lazy slot alloc + counter reset), PView::ConstructView(CEnvCell,uint16) @0x005a57b0 (zeroes outside_view.view_count, bumps master_timestamp, BFS via cell_todo_list -> cell_draw_list with +0x1e growth, sets top view's cell_view_done=1, ClipPortals->AddViewToPortals), PView::ConstructView(CBldPortal,CPolygon,int,int) @0x005a59a0 (sidedness test against ±0.0002 with portal_side gating, GetClip, copy_view into the other cell's top view, optional DrawPortalPolyInternal, recursive ConstructView through other_portal_id), PView::DrawPortal @0x005a5ab0, CEnvCell::setup_view @0x0052c430 (= Render::set_view(&top_view->view, i)), PView::GetClip @0x005a4320. PView layout (acclient.h ~45934): outside_view @0, draw_landscape, outdoor_portal_list, cell_draw_list, cell_draw_num, cell_todo_list, cell_todo_num, lscape. portal_view_type (~32346): portal DArray, view_type view, max_indist, view_count, cell_view_done, view_timestamp, update_count. CCellPortal (~32300, stride 0x18): other_cell_id, other_cell_ptr, portal, portal_side, other_portal_id, exact_match. num_stabs/stab_list/seen_outside live on the CObjCell base (~30927). + +## Report 3 - Building portal machinery (DrawBuilding family, punch/seal primitive) + +### RenderDeviceD3D::DrawBuilding @0x0059f2a0 + +**Summary:** Per-building draw entry (called from DrawSortCell during far-to-near DrawBlock iteration). Publishes the building's CBldPortal array to the outdoor PView, then runs TWO CPhysicsPart::Draw calls on part 0: first the portal pass (flag 1 → BSP portal walk that punches/constructs look-in views and calls DrawCells), then the normal pass (flag 0 → the visible shell mesh). The 'cover mechanism' is NOT in this body — it is delegated through DrawMeshInternal → build_draw_portals_only → DrawPortal → PView::DrawPortal → DrawPortalPolyInternal (invisible depth-only portal fans). + +```c +void RenderDeviceD3D::DrawBuilding(CBuildingObj* b) { + RenderDeviceD3D::outdoor_pview->outdoor_portal_list = b->portals; // ALWAYS, even if nothing draws below + CPhysicsPart::UpdateViewerDistance(b->part_array->parts[0]); // updates deg_level + CPhysicsPart* part = b->part_array->parts[0]; + if (part->gfxobj[part->deg_level] != 0) { // degraded-out slot == null → whole building skipped + CBuildingObj::curr_pos = &b->m_position; // static; consumed by PView::DrawPortal restore + DrawBuildingLeaf + Render::curr_detail_surface = Render::building_detail_surface; + Render::curr_detail_tiling = Render::building_detail_tiling; + Render::curr_detail_src_blend = 9; + Render::curr_detail_dst_blend = 6; + D3DPolyRender::FlushAlphaList(0f); + CPhysicsPart::Draw(b->part_array->parts[0], 1); // PORTAL pass: punch far-Z apertures + construct look-in views + DrawCells + RenderDeviceD3D::ObjBuildingOrBuildingPart = 1; + CPhysicsPart::Draw(b->part_array->parts[0], 0); // SHELL pass: normal mesh draw of the building exterior + RenderDeviceD3D::ObjBuildingOrBuildingPart = 0; + Render::curr_detail_surface = nullptr; + } +} +``` + +**Gotchas:** ObjBuildingOrBuildingPart=1 wraps ONLY the shell pass, not the portal pass. curr_pos is the only write to that static in the whole binary. The portal pass and shell pass both go through the same CPhysicsPart::Draw → vtable DrawMesh path; the arg (1 vs 0) is what forks them inside DrawMeshInternal. No render-state (z/depth) changes happen in this body itself — all depth trickery lives in DrawPortalPolyInternal. + +### RenderDeviceD3D::DrawMeshInternal @0x0059f360 + +**Summary:** Fork point between portal pass and shell pass. Portal flag set → pins building_view to the current portal view index and runs the drawing BSP's portal-only walk twice (pass 1 then pass 2). Flag clear → draws the constructed mesh, with a once-per-frame dedupe for non-player physics parts. + +```c +void DrawMeshInternal(CGfxObj* g, uint8 portalFlag, BoundingType bt) { + part = RenderDeviceD3D::s_current_physics_part; + if (portalFlag == 0 && part != 0 && !CPhysicsPart::IsPartOfPlayerObj(part)) { + if (CPhysicsPart::GetDrawnThisFrame(part) != 0) return; // already drawn this frame-stamp → skip entirely + CPhysicsPart::SetDrawnThisFrame(part); + } + if (Render::useSunlight == 0) Render::minimize_object_lighting(); + if (g->use_built_mesh != 0) { + if (portalFlag != 0) { + Render::obj_view_set(); + saved = RenderDeviceD3D::building_view; + RenderDeviceD3D::building_view = Render::portal_view_num; // pin walk to current portal view + BSPTREE::build_draw_portals_only(g->drawing_bsp, 1); // pass 1: far-Z punch polys + BSPTREE::build_draw_portals_only(g->drawing_bsp, 2); // pass 2: construct views + DrawCells + RenderDeviceD3D::building_view = saved; + return; + } + D3DPolyRender::DrawMesh(g, g->constructed_mesh); // shell geometry + } +} +``` + +**Gotchas:** If use_built_mesh == 0 nothing at all is drawn (no unbuilt-mesh fallback here). The drawn-this-frame dedupe does NOT apply to the portal pass or the player. building_view pinning means the two-pass portal walk executes once per portal view of the enclosing DrawMesh loop. + +### RenderDeviceD3D::DrawMesh @0x005a0860 + +**Summary:** Vtable DrawMesh (called by CPhysicsPart::Draw). Two modes: Render::PortalList == 0 → single view, viewcone-check the drawing sphere, DrawMeshInternal; PortalList != 0 → loop every portal view i, gated by building_view (== -1 or == i), set_view + viewconeCheck per view, DrawMeshInternal per passing view. Portal-flagged draws (arg4!=0) run DrawMeshInternal even when viewcone says OUTSIDE. + +```c +ObjectDrawStatus DrawMesh(CGfxObj* g, Position* pos, uint8 portalFlag) { + result = 0; Render::lighting_type = FULL_LIGHTING; + if (Render::PortalList == 0) { + Render::positionPush(1, pos); + bt = Render::viewconeCheck(g->drawing_sphere); + if (bt != OUTSIDE) { Render::positionPush(2, null); Render::GfxObjUnderSelectionRay(g); DrawMeshInternal(g, portalFlag, bt); Render::framePop(); return 2; } + if (portalFlag != 0) { Render::positionPush(2, null); DrawMeshInternal(g, portalFlag, OUTSIDE); Render::framePop(); return 2; } + result = 1; + } else { + Render::positionPush(1, pos); outsideCount = 0; selectionRayDone = 0; + for (i = 0; i < PortalList->view_count; i++) { + if (building_view == 0xffffffff || building_view == i) { + Render::set_view(&PortalList->view, i); + bt = Render::viewconeCheck(g->drawing_sphere); + if (bt == OUTSIDE) { + if (portalFlag != 0) { positionPush(2, null); DrawMeshInternal(g, portalFlag, OUTSIDE); result = max(result,2); } + else result = max(result,1); + outsideCount++; + } else { + if (!selectionRayDone) { positionPush(2, null); GfxObjUnderSelectionRay(g); selectionRayDone = 1; } + DrawMeshInternal(g, portalFlag, bt); result = max(result,2); + } + } + } + if (outsideCount == PortalList->view_count) result = 1; + } + Render::framePop(); + return result; +} +``` + +**Gotchas:** BN stack mush in the multi-view branch (arg3 reused as the outside counter, phantom 'top' variable) — semantics reconstructed above. Note frame-push imbalance is BN presentation: positionPush(2,...) inside each view is popped by the single framePop pairing per DrawMeshInternal path (framePop pops one level; the trailing framePop pops the level-1 push). + +### CPhysicsPart::Draw @0x0050d7a0 + +**Summary:** Per-part draw wrapper. Skips hidden parts (draw_state bit0) and, for non-portal draws, parts already drawn at the current device frame stamp. Sets material/surfaces/scale, marks Render::check_curr_object, sets s_current_physics_part around the vtable DrawMesh call, and latches selected_object_in_view for the viewcone-check object. + +```c +void CPhysicsPart::Draw(CPhysicsPart* p, int portalFlag) { + if (p->draw_state & 1) return; // hidden + if (portalFlag == 0 && p->m_current_render_frame_num == render_device->m_nFrameStamp) return; // per-frame dedupe (normal draws only) + deg = p->deg_level; if (p->degrades == 0 || deg >= p->degrades->num_degrades) deg = 0; + g = p->gfxobj[deg]; if (g == 0) return; + RenderDeviceD3D::SetCurrentMaterial(render_device, p->material, 0); + Render::SetSurfaceArray(p->surfaces); + Render::SetObjectScale(&p->gfxobj_scale); + Render::check_curr_object = (p->physobj && p->physobj->id) || CPhysicsPart::creature_mode; // exact: 0 unless physobj-with-id, else creature_mode + RenderDeviceD3D::s_current_physics_part = p; + status = render_device->vtable->DrawMesh(g, &p->draw_pos, portalFlag != 0); + RenderDeviceD3D::s_current_physics_part = null; + if (status == 2 && CPhysicsPart::viewcone_check_object_id != 0 + && CPhysicsPart::viewcone_check_object_id == (p->physobj ? p->physobj->id : 0)) + CPhysicsPart::selected_object_in_view = 1; +} +``` + +**Gotchas:** m_current_render_frame_num is compared but not visibly updated here — the drawn-this-frame stamping for parts happens via SetDrawnThisFrame inside DrawMeshInternal. The building path calls this with parts[0] only; buildings never iterate multiple parts here. + +### BSPTREE::build_draw_portals_only (+ BSPNODE @0x0053c100) @0x00539860 + +**Summary:** Entry to the portal-only walk of a building's drawing BSP. Dispatches root by node tag ('FAIL' 0x4c454146 = stop, 'PORT' 0x504f5254 = BSPPORTAL::portal_draw_portals_only, else BSPNODE::build_draw_portals_only), then flushes the poly list. BSPNODE variant walks front-to-back relative to the CURRENT viewer position against each splitting plane (epsilon 0.0002), recursing into far side first is NOT done — it visits the viewer-side subtree ordering and dispatches PORT nodes to the portal drawer, passing the pass number (1 or 2) through unchanged. + +```c +void BSPTREE::build_draw_portals_only(BSPTREE* t, int pass) { + n = t->root_node; + if (n) { + if (n->tag != 'FAIL') { + if (n->tag == 'PORT') BSPPORTAL::portal_draw_portals_only(n, pass); + else BSPNODE::build_draw_portals_only(n, pass); + } + } + Render::m_pRenderer->vtable->polyListFinishInternal(); + Render::PolyNext = &Render::PolyList; +} + +void BSPNODE::build_draw_portals_only(BSPNODE* n, int pass) { // iterative + recursive mix + loop { + d = dot(FrameCurrent->viewer.viewpoint, n->splitting_plane.N) + n->splitting_plane.d; + side = (d > 0.000199999995) ? 0 /*positive*/ : (d < -0.000199999995 ? 1 /*negative*/ : 2 /*in-plane*/); + if (side == 0) { // viewer on positive side: visit neg child first, then continue into pos child + c = n->neg_node; + if (c && c->tag != 'FAIL') { if (c->tag=='PORT') BSPPORTAL::portal_draw_portals_only(c,pass); else recurse(c,pass); } + next = n->pos_node; + } else { // negative or in-plane: visit pos child first, then continue into neg child + c = n->pos_node; + if (c && c->tag != 'FAIL') { if (c->tag=='PORT') BSPPORTAL::portal_draw_portals_only(c,pass); else recurse(c,pass); } + next = n->neg_node; + } + if (!next || next->tag == 'FAIL') return; + if (next->tag == 'PORT') { BSPPORTAL::portal_draw_portals_only(next, pass); return; } + n = next; // tail-continue + } +} +``` + +**Gotchas:** Tags are 4CC constants: 0x4c454146='FAIL' (leaf sentinel), 0x504f5254='PORT'. Traversal order: the child OPPOSITE the viewer is visited first (back-to-front), viewer-side child processed by tail-continuation — i.e., portals are emitted far-to-near. Plane epsilon is exactly 0.000199999995. + +### BSPPORTAL::portal_draw_portals_only @0x0053d870 + +**Summary:** The PORT-node handler. Same plane-side ordering as BSPNODE, but after visiting the first child it emits every in_portal of this node via the render-device vtable: render_device->DrawPortal(in_portals[i], 1, pass). Positive-side and negative-side branches both emit; the in-plane branch (side==2) emits nothing and just continues. + +```c +void BSPPORTAL::portal_draw_portals_only(BSPPORTAL* n, int pass) { + loop { + d = dot(viewer.viewpoint, n->splitting_plane.N) + n->splitting_plane.d; // epsilon 0.000199999995 + side = pos(0)/neg(1)/in-plane(2); + if (side == 0) { + visit n->neg_node (PORT→portal_draw_portals_only, else build_draw_portals_only, skip FAIL/null); + for (i = 0; i < n->num_portals; i++) + RenderDevice::render_device->vtable->DrawPortal(n->in_portals[i], 1, pass); // arg3 ALWAYS 1 + next = n->pos_node; + } else if (side == 1) { + visit n->pos_node (same dispatch); + for (i = 0; i < n->num_portals; i++) + render_device->vtable->DrawPortal(n->in_portals[i], 1, pass); + next = n->neg_node; + } else { // side == 2 (viewer in plane): visit pos child, NO portal emission + visit n->pos_node (same dispatch); + next = n->neg_node; + } + if (!next || next->tag=='FAIL') return; + if (next->tag != 'PORT') { build_draw_portals_only(next, pass); return; } + n = next; + } +} +``` + +**Gotchas:** These vtable calls are the ONLY call sites of DrawPortal in the whole binary, and pass is only ever 1 or 2 (from DrawMeshInternal). Therefore PView::DrawPortal's arg4==3 branch is dead code in the 2013 build. arg3 is the literal constant 1 always. + +### RenderDeviceD3D::DrawPortal @0x0059f0e0 + +**Summary:** Vtable shim: saves building_view, sets it to -1 (so meshes drawn inside the look-in draw in ALL portal views), forwards to PView::DrawPortal on the OUTDOOR pview, restores building_view. + +```c +void RenderDeviceD3D::DrawPortal(CPortalPoly* pp, int arg3, int pass) { + RenderDeviceD3D::backup_building_view = RenderDeviceD3D::building_view; + RenderDeviceD3D::building_view = 0xffffffff; + PView::DrawPortal(RenderDeviceD3D::outdoor_pview, pp, arg3, pass); + RenderDeviceD3D::building_view = RenderDeviceD3D::backup_building_view; +} +``` + +**Gotchas:** Always the outdoor pview — building look-ins are an outdoor-pview mechanism even though they render EnvCells. backup_building_view is a static, not stack: not reentrant, but the call graph never nests it. + +### PView::DrawPortal @0x005a5ab0 + +**Summary:** The look-in punch driver for one building portal polygon. Flushes the pending poly list, backs up render state, resets object scale to 1, resolves the CBldPortal via outdoor_portal_list[pp->portal_index], adds the portal's stab views, then ConstructView. On success: pass!=1 → DrawCells (this is the ov=0 look-in punch in the live trace); then re-pushes the building frame (positionPush(3, CBuildingObj::curr_pos)) so the continuing BSP walk stays in building object space. On failure: pass==3 would seal the portal poly at its own depth (dead in this build). + +```c +void PView::DrawPortal(PView* this, CPortalPoly* pp, int arg3 /*always 1*/, int pass /*1|2*/) { + Render::m_pRenderer->vtable->polyListFinishInternal(); + Render::PolyNext = &Render::PolyList; + ACRender::backup_curr_state(); + Render::object_scale = 1f; Render::object_scale_vec = (1,1,1); + CBldPortal* bp = this->outdoor_portal_list[pp->portal_index]; + CPolygon* poly = pp->portal; + PView::add_views(this, bp->num_stabs, bp->stab_list); + ok = PView::ConstructView(this, bp, poly, arg3, pass); // the CBldPortal overload @005a59a0 + if (ok == 0) { + if (pass == 3) D3DPolyRender::DrawPortalPolyInternal(poly, 0); // DEAD: pass is never 3 + ACRender::restore_curr_state(); + } else { + if (pass != 1) PView::DrawCells(this, ); // pass 2: draw the constructed cell list (the trace's DrawCells ov=0 punch) + ACRender::restore_curr_state(); + Render::positionPush(3, CBuildingObj::curr_pos); // restore building object frame for the ongoing BSP walk + Render::obj_view_set(); + } + PView::remove_views(this, bp->num_stabs, bp->stab_list); +} +``` + +**Gotchas:** DrawCells' second argument is a stale register (DrawCells never reads it — BN artifact). The success path pushes a frame (positionPush) with no visible pop here; the balance is restored by the enclosing DrawMesh/DrawMeshInternal frame stack. This is WHY DrawBuilding must set CBuildingObj::curr_pos before the portal pass. + +### PView::ConstructView (CBldPortal overload) @0x005a59a0 + +**Summary:** Gates and builds the look-in view for one building portal. Sidedness of the VIEWER against the portal polygon plane must match the authored portal_side (portal_side==0 requires POSITIVE, portal_side!=0 requires NEGATIVE — in-plane fails both... see gotchas). Then GetClip produces a clipped view; the destination EnvCell must be currently Visible; copy_view pushes the clipped view onto that cell's portal_view stack. Pass 1 additionally draws the portal poly with flag 1 (the far-Z punch); pass !=1 recurses into the EnvCell-overload ConstructView (BFS over interior cells). + +```c +int PView::ConstructView(PView* this, CBldPortal* bp, CPolygon* poly, int arg4 /*1*/, int pass) { + d = dot(FrameCurrent->viewer.viewpoint, poly->plane.N) + poly->plane.d; // epsilon 0.000199999995 + side = d > eps ? POSITIVE : (d < -eps ? NEGATIVE : IN_PLANE); + if (bp->portal_side != 0) { if (side != NEGATIVE) return 0; } + else { if (side != POSITIVE) return 0; } + PView::GetClip(this, side, poly, &clip_view, &clippedPoly, arg4); + if (clippedPoly == 0) return 0; + CEnvCell* cell = CEnvCell::GetVisible(bp->other_cell_id); + if (cell == 0) return 0; + if (Render::copy_view(cell->portal_view.data[cell->num_view - 1], &clip_view, clippedPoly) == 0) return 0; // pushes the view frame + if (pass != 2) D3DPolyRender::DrawPortalPolyInternal(poly, pass == 1); // pass 1 → flag 1 (far-Z punch); pass 3 → flag 0 (own-depth seal, dead) + Render::framePop(); + if (pass != 1) PView::ConstructView(this, cell, bp->other_portal_id); // EnvCell overload @005a57b0: BFS builds cell_draw_list + return 1; +} +``` + +**Gotchas:** IN_PLANE (viewer within ±0.0002 of the portal plane) fails BOTH sidedness gates → no punch, no look-in, portal contributes nothing that pass. If GetVisible fails (destination cell not loaded/visible) the punch is silently skipped too — pass 1 draws nothing for that portal. BN artifact: the decomp shows arg names shifted (arg3 reused as GetClip out-poly); layout above is reconstructed from CBldPortal header fields (portal_side@0, other_cell_id@4, other_portal_id@8, num_stabs@0x10, stab_list@0x14). + +### D3DPolyRender::DrawPortalPolyInternal @0x0059bc90 + +**Summary:** THE cover-panel primitive: draws one portal polygon as an untextured triangle fan with DEPTHTEST_ALWAYS and (by default) depth-write ON and color alpha 0 under SRCALPHA/INVSRCALPHA blending — i.e., an invisible depth-only write. flag=1 (mode global maxZ1, default 7): every vertex Z is FORCED to 0.999998987 (far plane) — this 'punches' the aperture open in the depth buffer. flag=0 (maxZ2, default 6): real projected Z — this 'seals' the aperture at the portal's own depth. Rejects polys entirely outside a ±12.0 local-XY box first. + +```c +void DrawPortalPolyInternal(CPolygon* poly, uint8 flag) { + Render::CalcObjectMatrix(); + mode = flag ? maxZ1 : maxZ2; // globals: maxZ1 = 7, maxZ2 = 6 (static defaults in .data) + // trivial reject vs local box (24-unit cell): track per-axis all-outside flags across vertices + allBeyond(+12x)=1; allBeyond(-12x)=1; allBeyond(+12y)=1; allBeyond(-12y)=1; + for (i = 0; i < poly->num_pts; i++) { + v = poly->vertices[i]; + clear corresponding flag when v.x/v.y is inside the ±12.0 bound; // FP-idiom (test ah,0x44) — polarity see gotchas + scrBuf[i] = PrimD3DRender::xformStart(v, 1); + } + if (any allBeyond flag still set) return; // poly wholly outside one ±12 bound → skip + if (flag == 0) D3DPolyRender::portalsDrawnCount++; // ONLY own-depth seals are counted + Render::PolyCurrent = null; Render::PolyCurrentMod = 1f; Render::PolyCurrentPos = 1; + ACRender::polyClipFinish(scrBuf, num_pts, scrBufclipped, &n, 0); + if (n < 3) return; + SetStageTexture(0, null); + SetAlphaTestEnable(0); + SetBlendFunction(BLEND_SRCALPHA, BLEND_INVSRCALPHA, BLENDOP_ADD); + SetDepthBufferMode(DEPTHTEST_ALWAYS, (mode >> 2) & 1); // depth test ALWAYS; z-write = bit2 → ON for both 7 and 6 + ApplyVertexFormat(0x144); + SetCullMode(CULLMODE_NONE); + colorSel = (colorSel + 1) & cycle-of-8 → picks a debug RGB (white/red/green/blue/yellow/cyan/magenta/black); wraps colorSel to -1 at 7; + for each clipped vertex k: + screen.x = clip.x / clip.w + viewportX; screen.y = clip.y / clip.w + viewportY; + screen.z = (mode & 1) ? 0.999998987f : clip.z / clip.w; // bit0 → force far-plane Z (maxZ1=7 has it; maxZ2=6 does not) + rhw = 1 / clip.w; + color = debugRGB | (alphaBit(mode) ? 0x80000000 : 0); // alphaBit = ~(mode << 30) & 0x80000000 → 0 for both 6 and 7 → alpha 0 → INVISIBLE + RenderDeviceD3D::DrawPrimitiveUP(D3DPT_TRIANGLEFAN, n - 2, v, 0x1c); +} +``` + +**Gotchas:** This is the invisible 'panel'. Default mode words decode as: bit0 = force-far-Z, bit2 = enable z-write, bit1 (via the <<30 alpha mush) = make visible at 50% alpha — a debug visualization toggle (change maxZ1/maxZ2 in a debugger to SEE the panels in the cycling colors). The ±12.0 reject-loop polarity is an FP-status-word idiom (test ah,0x44) BN could not lift cleanly — the accept path requires all four all-outside flags cleared; exact per-comparison polarity should be byte-verified against the binary before porting. It does NOT restore the depth/blend/cull state it set — callers rely on ACRender::backup_curr_state/restore_curr_state or later SetupState calls. Vertex stride 0x1c, FVF 0x144 (XYZRHW|DIFFUSE). + +### PView::DrawCells @0x005a4840 + +**Summary:** Draws the cell_draw_list built by ConstructView, far-to-near (list is BFS/distance-ordered; iterated from the END down). Only when outside_view.view_count > 0 (ov>0 — the interior/exit-view case): draws the LANDSCAPE through the constructed exit views, then conditionally full-screen depth-clears to 1.0 (if forceClear, or if any own-depth seal poly was drawn since the last check), then seals every portal whose other_cell_id == 0xFFFFFFFF with an invisible own-depth panel. Then unconditionally: far-to-near DrawEnvCell per view, then far-to-near object pass (DrawObjCellForDummies with PortalList pointed at each cell's top portal_view). + +```c +void PView::DrawCells(PView* this, int unusedArg) { + if (this->outside_view.view_count > 0) { // ov>0: only interior frames / exit-view case + Render::useSunlightSet(1); + Render::PortalList = &this->outside_view; + LScape::draw(this->lscape); // landscape THROUGH the exit view(s) + D3DPolyRender::FlushAlphaList(0f); + render_device->m_nFrameStamp += 1; + doClear = forceClear; + if (!forceClear) { doClear = (portalsDrawnCount != 0); portalsDrawnCount = 0; } + if (doClear) render_device->vtable->Clear(4, &color_820fc0, 1.0f); // flag4 → D3DCLEAR_ZBUFFER, full RT, z=1.0 + for (i = cell_draw_num; i >= 1; i--) { // far-to-near SEAL pass + cell = cell_draw_list[i-1]; + if (!cell->structure->drawing_bsp) continue; + SetCurrentMaterial(null); SetSurfaceArray(cell->surfaces); scale=1; + Render::positionPush(3, &cell->pos); + vc = cell->num_view ? cell->portal_view[num_view-1]->view_count : -1; + if (vc != 0) for (v = 0; v != vc; v++) { // vc==-1 → loop runs once with no set_view? see gotchas + CEnvCell::setup_view(cell, v); + for (j = 0; j < cell->num_portals; j++) // CCellPortal stride 0x18 + if (cell->portals[j].other_cell_id == 0xffffffff) + D3DPolyRender::DrawPortalPolyInternal(cell->portals[j].portal, 0); // SEAL: own-depth, invisible, z-write + } + Render::framePop(); + } + } + Render::useSunlightSet(0); + Render::restore_all_lighting(); + for (i = cell_draw_num; i >= 1; i--) { // far-to-near GEOMETRY pass + cell = cell_draw_list[i-1]; + if (!cell->structure->drawing_bsp) continue; + SetCurrentMaterial(null); SetSurfaceArray(cell->surfaces); scale=1; + Render::positionPush(3, &cell->pos); + vc as above; if (vc != 0) for (v = 0; v != vc; v++) { CEnvCell::setup_view(cell, v); render_device->vtable->DrawEnvCell(cell); } + Render::framePop(); + } + for (i = cell_draw_num; i >= 1; i--) { // far-to-near OBJECT pass + cell = cell_draw_list[i-1]; + Render::PortalList = cell->portal_view.data[cell->num_view - 1]; // fields +0x134/+0x138 + render_device->vtable->DrawObjCellForDummies(cell); + } + Render::object_scale=(1,1,1); Render::useSunlightSet(1); +} +``` + +**Gotchas:** RECONCILES THE TRACE: outdoor building look-ins arrive here with outside_view.view_count == 0 (trace's 'ov=0') → NO LScape, NO depth clear, NO sealing — just the interior cells + objects, drawn INTO the far-Z-punched aperture. Interior frames (DrawInside → ov=1) get the LScape-through-exit + conditional z-clear + sealing. The vc==-1 path (num_view==0) enters the loop body once WITHOUT a valid portal_view — setup_view is called with v=0 on a cell with no views; verify against binary before porting. portalsDrawnCount is only incremented by flag-0 seal draws, so the depth clear triggers on the NEXT DrawCells after any sealing. The frame-stamp bump (m_nFrameStamp += 1) re-arms CPhysicsPart per-frame dedupe so objects already drawn outside can draw again inside the look-in. Second arg is dead (BN stale edx at both call sites). + +### RenderDeviceD3D::DrawSortCell @0x0059f140 + +**Summary:** The actual caller into DrawBuilding — there is NO CBuildingObj::draw method in the 2013 build. A CSortCell (outdoor cell) draws its attached building first (vtable DrawBuilding), then its object contents (vtable DrawObjCell). + +```c +void RenderDeviceD3D::DrawSortCell(CSortCell* cell) { + if (cell->building != 0) this->vtable->DrawBuilding(cell->building); + this->vtable->DrawObjCell(cell); +} +``` + +**Gotchas:** Building before objects, per cell — combined with DrawBlock's far-to-near draw_array order this produces the trace's 'DrawBuilding far-to-near with DrawCells punches interleaved'. CBuildingObj is drawn purely through this render-device path; grep confirms no draw method on the class itself. + +### RenderDeviceD3D::DrawBlock @0x005a17c0 + +**Summary:** Per-landblock draw (vtable DrawBlock, invoked from the LScape draw loop at 0x00506374). Pushes an identity Position stamped with the block DID, sets vertex lighting, then two loops over draw_array[side_cell_count²] (pre-sorted far-to-near): loop 1 updates in-view obj cells and insertion-sorts their shadow parts by depth; loop 2 per cell draws terrain (DrawLandCell, with landscape detail surface when side_cell_count==8, src_blend=5 dst_blend=6) then DrawSortCell (buildings+objects) with an alpha-list flush when the global 'flush' != 1.0. + +```c +void RenderDeviceD3D::DrawBlock(CLandBlock* lb) { + scale=(1,1,1); localPos = identity Position (vtbl 0x796910), objcell_id = lb->m_DID.id; + Frame::cache(&localPos.frame); Render::positionPush(3, &localPos); + ACRender::curLandBlockVertexLighting = lb->vertex_lighting; + n = lb->side_cell_count * lb->side_cell_count; + for (i = 0; i < n; i++) { // pass 1: update + sort + c = lb->draw_array[i]; + if (c->vtable->IsInView() && c->num_shadow_objects != 0) { + RenderDeviceD3D::UpdateObjCell(this, c); + if (c->num_shadow_parts > 1) CShadowPart::insertion_sort(&c->shadow_part_list, c->num_shadow_parts); + } + } + isFullBlock = (lb->side_cell_count == 8); + for (i = 0; i < n; i++) { // pass 2: draw (draw_array order = far-to-near) + (lazy one-shot: flush pending FF light state at +0x7e4/+0x468, reset diffuse/ambient source to FromVertex); + Render::SetSurfaceArray(CRegionDesc::current_region->terrain_info-> ...hold_run); + scale=(1,1,1); + c = lb->draw_array[i]; + if (c->vtable->IsInView()) { + if (isFullBlock) { curr_detail_surface = landscape_detail_surface; tiling = landscape_detail_tiling; src_blend=5; dst_blend=6; } + this->vtable->DrawLandCell(c); + curr_detail_surface = null; + } + if (alwaysDrawObjects || c->vtable->IsInView()) { + this->vtable->DrawSortCell(c); + if (flush != 1f) D3DPolyRender::FlushAlphaList(flush); + } + } + ACRender::curLandBlockVertexLighting = null; + Render::framePop(); +} +``` + +**Gotchas:** BN drops the store of lb->m_DID.id into the local Position's objcell_id (the load is shown, the store elided) — same pattern in PView::DrawInside. IsInView is a virtual at vtable+0x68. Terrain detail texturing only on full 8x8 blocks. The trace's outdoor frame = LScape::draw iterating blocks → this function → DrawSortCell → DrawBuilding, far-to-near. + +### RenderDeviceD3D::DrawObjCell + RenderDeviceD3D::DrawPartCell @0x005a1a40 / 0x005a07a0 + +**Summary:** DrawObjCell (0x005a1a40) forwards a CObjCell to DrawPartCell(cell->m_DID.id, cell, 0). DrawPartCell (0x005a07a0) clears curr_detail_surface and draws every entry of the cell's depth-sorted shadow_part_list via CShadowPart::draw → CPhysicsPart::Draw(part->part, 0) — the normal (non-portal) mesh path. + +```c +void DrawObjCell(CObjCell* c) { + if (c != 0) { DrawPartCell(this, c->m_DID.id, (CPartCell*)c, 0); return; } + DrawPartCell(this, c->m_DID.id, null, 0); // BN artifact: derefs null id — unreachable in practice +} +void DrawPartCell(uint32 cellId, CPartCell* pc, uint32 idx) { + Render::curr_detail_surface = null; + for (i = 0; i < pc->num_shadow_parts; i++) + if (pc->shadow_part_list.data[i]) CShadowPart::draw(pc->shadow_part_list.data[i]); // → CPhysicsPart::Draw(part, 0) +} +``` + +**Gotchas:** cellId and idx are dead parameters in DrawPartCell (only used by the DrawBuildingLeaf caller for bookkeeping that no longer exists). The null-cell branch of DrawObjCell reads c->m_DID.id off a null pointer — decompiled control-flow artifact of a shared tail; the guard makes it unreachable. + +### RenderDeviceD3D::DrawBuildingLeaf @0x005a07e0 + +**Summary:** Legacy per-BSP-leaf building-interior draw: looks up CBuildingObj::curr_leaf_cells[leafIdx]; if it has shadow parts, flushes the poly list, backs up state, sets pushLevelOffset=1, and DrawPartCell's that CPartCell under the building's curr_pos cell id, then restores. APPEARS DEAD in the 2013 build: no call site of the vtable slot exists anywhere in the pseudo-C, and the statics curr_leaf_cells/curr_num_leaves are never assigned (initialized 0 in .data; the CBuildingObj member leaf_cells is likewise only ever zero-initialized and freed). + +```c +void RenderDeviceD3D::DrawBuildingLeaf(uint32 leafIdx) { + CPartCell* pc = CBuildingObj::curr_leaf_cells[leafIdx]; + if (pc != 0 && pc->num_shadow_parts > 0) { + Render::m_pRenderer->vtable->polyListFinishInternal(); + Render::PolyNext = &Render::PolyList; + ACRender::backup_curr_state(); + Render::pushLevelOffset = 1; + RenderDeviceD3D::DrawPartCell(this, CBuildingObj::curr_pos->objcell_id, CBuildingObj::curr_leaf_cells[leafIdx], leafIdx); + Render::pushLevelOffset = 0; + ACRender::restore_curr_state(); + Render::obj_view_set(); + } +} +``` + +**Gotchas:** Dead legacy path from the pre-EnvCell building-interior model: curr_leaf_cells is never written (would null-deref if the slot were ever invoked with curr_num_leaves>0), and grep finds zero '->DrawBuildingLeaf(' call sites. Building interiors in this build are EnvCells drawn through PView::DrawCells instead. Do not port as live behavior. + +### PView::ConstructView (CEnvCell overload) + PView::DrawInside @0x005a57b0 / 0x005a5860 + +**Summary:** ConstructView(cell, portalIdx): resets outside_view.view_count=0, bumps master_timestamp, clears todo/draw lists, InitCell(cell, portalIdx), seeds the todo list, then BFS: pop nearest-last todo cell, append to cell_draw_list, mark cell_view_done, ClipPortals → AddViewToPortals (which propagates clipped views into neighbor cells and can raise outside_view). DrawInside (interior frame entry, via RenderDeviceD3D::DrawInside on the indoor pview): pushes the cell's view + stab views, pushes an identity Position stamped with the cell DID, copy_view of the cell's top portal_view, ConstructView(cell, 0xffff), DrawCells, then unwinds (framePop, remove_views, num_view -= 1). + +```c +void PView::ConstructView(PView* this, CEnvCell* cell, uint16 throughPortal) { + this->outside_view.view_count = 0; PView::master_timestamp += 1; + this->cell_todo_num = 0; this->cell_draw_num = 0; + PView::InitCell(this, cell, throughPortal); + PView::InsCellTodoList(this, cell, 0f); // distance-sorted insert + while (this->cell_todo_num > 0) { + c = cell_todo_list[--cell_todo_num]->cell; if (c == 0) return; + grow cell_draw_list if needed (by 0x1e); cell_draw_list[cell_draw_num++] = c; + c->portal_view[c->num_view - 1]->cell_view_done = 1; + if (PView::ClipPortals(this, c, 0) != 0) PView::AddViewToPortals(this, c); + } +} +void PView::DrawInside(PView* this, CEnvCell* cell) { + scale=(1,1,1); + CEnvCell::curr_view_push(cell); + PView::add_views(this, cell->num_stabs, cell->stab_list); + localPos = identity Position (vtbl 0x796910), objcell_id = cell->m_DID.id; Frame::cache; Render::positionPush(3, &localPos); + Render::copy_view(cell->portal_view.data[cell->num_view - 1], null, 4); + PView::ConstructView(this, cell, 0xffff); + PView::DrawCells(this, ); + Render::framePop(); + PView::remove_views(this, cell->num_stabs, cell->stab_list); + cell->num_view -= 1; +} +``` + +**Gotchas:** Included for reconciliation only (bodies of InitCell/ClipPortals/AddViewToPortals/GetClip not fully extracted this batch). outside_view is raised inside the ClipPortals/AddViewToPortals propagation when a portal leads outdoors — which is what makes DrawCells' ov>0 LScape-through-exit branch fire on interior frames (trace: DrawInside then DrawCells ov=1). 0xffff = 'no through-portal' sentinel matching InitCell's uint16 compare. + +**Report notes:** THE COVER MECHANISM (the priority question) is not inside DrawBuilding's own body — DrawBuilding is 20 lines — it is the portal pass it triggers. Full outdoor sequence per building, in submission order: (1) DrawBuilding publishes b->portals as outdoor_pview->outdoor_portal_list, sets CBuildingObj::curr_pos, sets building detail-surface state (src=9,dst=6), FlushAlphaList(0). (2) PORTAL pass — CPhysicsPart::Draw(part,1) → vtable DrawMesh (per portal view, building_view-gated) → DrawMeshInternal pins building_view=portal_view_num and walks the building's drawing BSP TWICE via build_draw_portals_only: pass 1 then pass 2, both far-to-near over the BSP portal nodes. At each portal: render_device->DrawPortal(pp,1,pass) → building_view=-1 → PView::DrawPortal → ConstructView(CBldPortal): viewer sidedness must match authored portal_side, clip must survive, destination EnvCell must be Visible. Pass 1 then draws the portal polygon via D3DPolyRender::DrawPortalPolyInternal(poly,1): an UNTEXTURED, CULL-NONE, DEPTHTEST_ALWAYS, ALPHA-0 (invisible under SRCALPHA/INVSRCALPHA) triangle fan with every Z forced to 0.999998987 and Z-WRITE ON (mode word maxZ1=7: bit0=force-far-Z, bit2=zwrite) — i.e., it punches the aperture's depth back to the far plane. Pass 2 draws no poly; it recurses ConstructView(EnvCell) (BFS building cell_draw_list) and then PView::DrawCells — which for outdoor look-ins runs with outside_view.view_count==0 (the trace's ov=0), skipping LScape/z-clear/sealing and just drawing the interior EnvCells + their objects far-to-near into the punched aperture. (3) SHELL pass — CPhysicsPart::Draw(part,0) draws the building exterior mesh normally (ObjBuildingOrBuildingPart=1 around it). So every submitted 'extra' geometry beyond the visible shell is: per qualifying portal, one invisible far-Z depth fan (pass 1), the look-in cell geometry + objects (pass 2), and — only on interior frames (ov>0) — invisible OWN-depth seal fans for portals with other_cell_id==0xFFFFFFFF plus a conditional full depth clear to 1.0 (Clear flag 4 → D3DCLEAR_ZBUFFER) triggered when any seal was drawn since the last check (portalsDrawnCount counts ONLY flag-0 seals). This matches the PV campaign's proven model (panels = never-drawn portal polys): the 'panels' are DrawPortalPolyInternal fans, alpha-0 by default, visualizable by flipping the maxZ1/maxZ2 debug globals (defaults 7/6 in .data at 0x820e18/0x820e14; bit1-ish of the mode via the <<30 mush enables 0x80 alpha with cycling debug colors). Key retail invariants a port must preserve: depth-test ALWAYS + depth-write ON for both punch and seal; punch Z is exactly 0.999998987; sidedness epsilon 0.000199999995 with IN_PLANE failing both gates; punches are skipped entirely when the destination cell is not Visible (no fallback seal on the outdoor path — the arg4==3 seal-on-fail branch in PView::DrawPortal is dead, since BSPPORTAL only ever passes pass∈{1,2}); the ±12.0 local-XY trivial reject in DrawPortalPolyInternal; the m_nFrameStamp bump in DrawCells re-arms per-frame part dedupe inside look-ins. On the trace's invisible-distant-building puzzle: DrawBuilding submits the shell through the normal depth-tested path, but its apertures' far-Z punches OVERWRITE whatever depth was already in those pixels (test ALWAYS), and look-in cell content then depth-tests against that — nothing in this chain draws an opaque cover over the shell itself; the shell's visibility is decided by ordinary depth vs. previously drawn landscape plus the viewcone/building_view gates in DrawMesh. DEAD CODE flagged: RenderDeviceD3D::DrawBuildingLeaf + CBuildingObj::curr_leaf_cells/curr_num_leaves/curr_shadow (never written, slot never called) — legacy pre-EnvCell interior path; do not port. Struct anchors used (acclient.h): CCellPortal{other_cell_id,+4 other_cell_ptr,+8 portal,+0xC portal_side,+0x10 other_portal_id,+0x14 exact_match} stride 0x18; CBldPortal{portal_side,other_cell_id,other_portal_id,exact_match,num_stabs,stab_list,sidedness}. Source lines: acclient_2013_pseudo_c.txt — DrawBuilding 427938, DrawMeshInternal 427965, DrawMesh 429245, CPhysicsPart::Draw 274964, BSPTREE 323225, BSPNODE 325389, BSPPORTAL 326881, RenderDeviceD3D::DrawPortal 427852, PView::DrawPortal 433895, ConstructView(CBldPortal) 433827, DrawPortalPolyInternal 424490, PView::DrawCells 432709, DrawSortCell 427872, DrawBlock 430027, DrawObjCell 430147, DrawPartCell 429198, DrawBuildingLeaf 429223, ConstructView(CEnvCell) 433750, DrawInside 433793. + +## Report 4 - Landscape walk (LScape draw / order / visibility, DrawBlock/DrawSortCell) + +### LScape::draw @0x00506330 + +**Summary:** Top-level outdoor landscape walk. Draws the sky dome, then iterates block_draw_list BACKWARDS (index mid_width*mid_width-1 down to 0). Since get_block_order builds that list near-to-far (viewer's block at index 0, then rings outward), the backwards walk is FAR-TO-NEAR, confirming the trace. Each block with in_view != OUTSIDE goes through the RenderDevice vtable DrawBlock. Weather overlay sky pass last. + +```c +LScape::draw(this): + if (this->sky) GameSky::Draw(this->sky, 0) // pass 0 = sky dome background + if (this->block_draw_list == 0) return // no viewpoint -> nothing else + LScape::draw_check_blocks(this) // recompute block/cell in_view for all portal views + for (i = this->mid_width * this->mid_width - 1; i >= 0; i--): // BACKWARDS = far-to-near + blk = this->block_draw_list[i] + if (blk != 0 && blk->in_view != 0) // in_view @ CLandBlock+0xfc, BoundingType + RenderDevice::render_device->vtable->DrawBlock(blk) // = RenderDeviceD3D::DrawBlock @0x005a17c0 + if (this->sky && LScape::weather_enabled) + GameSky::Draw(this->sky, 1) // pass 1 = weather (drawn after terrain) +``` + +**Gotchas:** block_draw_list has exactly mid_width^2 entries (11x11 = 121 with the ctor defaults mid_radius=5, mid_width=0xb); the ring fill in get_block_order covers every grid slot exactly once so no stale entries survive a rebuild. The in_view test reads raw +0xfc — verified as CLandBlock::in_view (BoundingType) in acclient.h. Callers: PView::DrawCells @0x005a4840 (sets Render::PortalList = the PView first, then calls LScape::draw, then FlushAlphaList(0f), then the cell_draw_num punch list — matches the trace's DrawCells look-in interleave) and SmartBox::RenderNormalMode @0x00453aa0 (0x00453b4d). + +### LScape::calc_draw_order @0x00505c70 + +**Summary:** Recomputes the viewer-relative block grid when the viewer's cell changes. Converts the viewer cell to block-grid offsets (viewer_b_xoff/yoff); if the viewer left the loaded grid, tears the viewpoint down. Optionally rebuilds the near-to-far block_draw_list (get_block_order), then for EVERY loaded block sets its viewer-relative frame (calc_frame) and recomputes its internal cell draw order (CLandBlock::calc_draw_order) keyed by the block's compass direction from the viewer. + +```c +LScape::calc_draw_order(this, new_cell_id, rebuild_block_list): + if (new_cell_id == 0) return + if (this->loaded_cell_id != 0): + center_x8 = (loaded_cell_id >> 0x15) & 0x7f8 // loaded-center block lcoord x * 8 + center_y8 = ((int8)(loaded_cell_id >> 0x10)) << 3 // block lcoord y * 8 + // else: center_x8/y8 UNINITIALIZED in the decomp (see gotchas) + LandDefs::gid_to_lcoord(new_cell_id, &vx, &vy) // viewer global cell lcoord + r8 = this->mid_radius << 3 + this->viewer_b_xoff = (r8 - center_x8 + vx) >> 3 // viewer block's index in the grid + this->viewer_b_yoff = (r8 - center_y8 + vy) >> 3 + if (viewer_b_xoff >= mid_width || viewer_b_yoff >= mid_width || viewer_b_xoff < 0 || viewer_b_yoff < 0): + LScape::update_viewpoint(this, 0) // out of grid: free block_draw_list, viewer_cell_id = 0 + return + if (rebuild_block_list != 0) LScape::get_block_order(this) // rebuild near-to-far ring list + sq = SqCoord{ vx & 7, vy & 7 } // viewer's CELL coord within its block + for (row = 0; row < mid_width; row++): + for (col = 0; col < mid_width; col++): + blk = this->land_blocks[mid_width*row + col] + if (blk == 0) continue + dir = LandDefs::get_dir(row - viewer_b_xoff, col - viewer_b_yoff) + LScape::calc_frame(this, blk, row, col) // block_frame.origin = ((row-xoff)*192, (col-yoff)*192, 0) + CLandBlock::calc_draw_order(blk, dir, &sq) // per-block far-to-near cell order +``` + +**Gotchas:** 1) Block frames are VIEWER-RELATIVE: calc_frame sets block_frame.m_fOrigin = ((row - viewer_b_xoff) * K, (col - viewer_b_yoff) * K, 0) where K is an FPU-elided constant BN prints as '0f' — it is the landblock side length 192.0 (landcell_check uses an explicit 24f per cell x 8 cells). The whole landscape renders in viewer-block-local space for float precision. 2) The loaded_cell_id==0 branch leaves center_x8/y8 as uninitialized locals in the BN output (var_14 mush) — real retail flow can only reach the math with loaded_cell_id != 0 or with values that immediately fail the bounds check; do not port the uninitialized read. 3) Caller LScape::update_viewpoint passes arg3 via the BN-mangled expression '-((eax_4 - eax_4))' — the underlying neg/sbb idiom is ((old_viewer_cell ^ new_cell) & 0xffff0000) != 0 ? 1 : 0, i.e. rebuild the block list only when the viewer crossed a LANDBLOCK boundary; within-block cell changes reorder cells but keep the block list. + +### LScape::get_block_order @0x00504c50 + +**Summary:** Builds block_draw_list NEAR-TO-FAR: index 0 = the block containing the viewer, then concentric square rings outward (ring radius 1..max distance to grid edge), 8 quadrant-symmetric slots per ring step generated from static coefficient tables. LScape::draw walking this list backwards yields the observed far-to-near block order. + +```c +LScape::get_block_order(this): + if (this->block_draw_list == 0) + this->block_draw_list = new CLandBlock*[mid_width * mid_width] + this->block_draw_list[0] = this->land_blocks[viewer_b_xoff * mid_width + viewer_b_yoff] // viewer block FIRST + max_ring = max over the 4 edge distances of (viewer_b_xoff, viewer_b_yoff) within [0, mid_width) + n = 1 + for (ring = 1; ring <= max_ring; ring++): + for (step = 0; step < ring; step++): + for each of 8 symmetric quadrant slots: // 2 table groups x 4 combos, coeff tables @0x0081cc6c..0x0081cd18 + bx = f_x(ring, step) + viewer_b_xoff // linear combo: cx1*step + cx2*ring + cx0 + by = f_y(ring, step) + viewer_b_yoff + if (0 <= bx < mid_width && 0 <= by < mid_width): + this->block_draw_list[n++] = this->land_blocks[mid_width*bx + by] +``` + +**Gotchas:** The exact within-ring visit order is encoded in eight static int32 coefficient triplets per axis (tables at 0x0081cc6c–0x0081cd18, read in two 0x10-stride groups); BN shows only raw table loads. Each in-bounds grid slot lands in the list exactly once (ring sweep covers the full square), so the list is fully populated; a faithful port only needs 'center first, rings outward, skip out-of-bounds' — the intra-ring order only affects tie-breaking between equidistant blocks. + +### LScape::draw_check_blocks @0x00505f80 + +**Summary:** Per-frame visibility pass over the block grid, run once per portal view. Clears every block's and cell's in_view, (re)allocates the shared block_interval scratch (two rows of mid_width+1 ViewIntervalType, 0x80 bytes each), then for EACH view in Render::PortalList (a PView; the outdoor view plus any portal-punched views): computes per-column clip-height intervals at block corners (x = (bx - viewer_b_xoff)*192, y = (by - viewer_b_yoff)*192) double-buffered by column parity, runs Render::block_check(corner intervals, max_zval, min_zval) per block, and for blocks not OUTSIDE sets block->in_view = BoundingType and refines per-cell in_view via landcell_check. + +```c +LScape::draw_check_blocks(this): + // pass 1: clear all visibility + for each land_blocks[row][col] != 0: + blk->in_view = 0 // +0xfc + for (i = 0; i < side_cell_count^2; i++) + blk->lcell[i].in_view = 0 // cell stride 0x108, in_view @ +0x104 + // scratch (file-static): ViewIntervalType block_interval[2*(mid_width+1)], realloc if mid_width changed + if (block_interval == 0 || block_int_size != mid_width): + delete[] block_interval; block_interval = new[ (mid_width+1) << 8 ]; block_int_size = mid_width + // per portal view (Render::PortalList = the active PView; view_count == 0 -> single pass, no set_view) + view_count = Render::PortalList ? Render::PortalList->view_count : 0 + v = 0 + loop: + if (view_count != 0): Render::set_view(&Render::PortalList->view, v); v++ + last_pass = (view_count == 0 || v == view_count) + // column x=0 of the corner grid + for (j = 0; j <= mid_width; j++) + Render::get_clip_height((0 - viewer_b_xoff)*192.0, (j - viewer_b_yoff)*192.0, &block_interval[j]) // 192.0 FPU-elided ('0f' in BN) + for (bx = 0; bx < mid_width; bx++): + for (j = 0; j <= mid_width; j++) // next column, double-buffered by parity + Render::get_clip_height((bx - viewer_b_xoff + 1)*192.0, (j - viewer_b_yoff)*192.0, + &block_interval[((bx-1)&1)*(mid_width+1) + j]) + for (by = 0; by < mid_width; by++): + blk = land_blocks[mid_width*bx + by] + if (blk == 0) continue + curr = &block_interval[(bx&1)*(mid_width+1) + by]; next = &block_interval[((bx-1)&1)*(mid_width+1) + by] + bt = Render::block_check(curr, curr+1, next, next+1, blk->max_zval, blk->min_zval) + if (bt != OUTSIDE): + blk->in_view = bt // NOTE: only ever raises; cleared once in pass 1, + LScape::landcell_check(this, blk) // so visibility accumulates ACROSS views + if (last_pass) return + goto loop +``` + +**Gotchas:** Both world-coordinate multiplies print as '* 0f' — the FPU constant was elided by BN; it is 192.0 (landblock side; landcell_check's cell version uses an explicit 24f). block_interval/block_int_size are file-static globals shared with ~LScape (freed there). ViewIntervalType is 0x80 bytes (the allocation is (mid_width+1)<<8 = 2*(mid_width+1)*0x80). Render::PortalList is set by PView::DrawCells to the PView itself immediately before LScape::draw, so 'views' here are the PView's outside_view entries (main frustum + portal-punched look-out/look-in views); blocks/cells visible through ANY view stay marked. The column parity buffering means column bx uses parity rows (bx&1) = current x and ((bx-1)&1) = x+1 — the freshly written row is the FAR edge; keep the parity exactly as written when porting. + +### LScape::landcell_check @0x005050a0 + +**Summary:** Refines per-cell visibility inside one block that passed block_check, for the current view. Non-8-cell blocks (low-res distant blocks): every cell in_view = PARTIALLY_INSIDE(1). Block ENTIRELY_INSIDE(2): every cell in_view = 2. Otherwise (full 8x8 block, partially visible): builds a (side+1)^2 corner clip grid at 24 m cell pitch offset by the block's viewer-relative frame origin, and per cell whose IsInView() is still 0 computes cell->in_view = Render::block_check(cell corner intervals, block max_zval/min_zval). + +```c +LScape::landcell_check(this, blk): + n = blk->side_cell_count + if (n != 8): // low-detail far block + for (i = 0; i < n*n; i++) blk->lcell[i].in_view = 1 // PARTIALLY_INSIDE + return + if (blk->in_view == ENTIRELY_INSIDE): // == 2 + for (i = 0; i < n*n; i++) blk->lcell[i].in_view = 2 + return + // partial 8x8 block: stack grid of ViewIntervalType, double-buffered by column parity like draw_check_blocks + x0 = blk->block_frame.m_fOrigin.x; y0 = blk->block_frame.m_fOrigin.y // viewer-relative block origin + for (j = 0; j <= n; j++) Render::get_clip_height(x0, j*24.0 + y0, &grid[j]) // column cx=0 + for (cx = 0; cx < n; cx++): + for (j = 0; j <= n; j++) + Render::get_clip_height((cx+1)*24.0 + x0, j*24.0 + y0, &grid[((cx-1)&1)*(n+1) + j]) + for (cy = 0; cy < n; cy++): + cell = &blk->lcell[n*cx + cy] + if (cell != 0 && cell->vtable->IsInView() == 0): // vtable+0x68; only cells not already seen by an earlier view + curr = &grid[(cx&1)*(n+1) + cy]; next = &grid[((cx-1)&1)*(n+1) + cy] + cell->in_view = Render::block_check(curr, curr+1, next, next+1, blk->max_zval, blk->min_zval) +``` + +**Gotchas:** Two BN artifacts in the final store: 'eax_10->num_static_objects = Render::block_check(...)' is field-name garbage — the store target is the CELL's in_view (+0x104 within the 0x108-byte CLandCell), NOT the block's num_static_objects; and 'eax_9 != -(lcell)' is pointer-null-check mush. The 24f here is explicit (not elided), which is what pins draw_check_blocks'/calc_frame's elided constant at 8*24 = 192. The IsInView()==0 pre-check makes cell visibility a UNION across portal views (a later view never downgrades a cell already marked). BoundingType numeric values used raw: 0 = OUTSIDE, 1 = PARTIALLY_INSIDE, 2 = ENTIRELY_INSIDE. + +### CLandBlock::calc_draw_order (-> calc_sq_draw_order) @0x00530300 (tailcall to 0x0052f4a0) + +**Summary:** Per-block CELL ordering; the exact mirror of get_block_order one level down, but written back-to-front. Picks the block's cell nearest the viewer from the block's compass direction (dir switch over 9 LandDefs::Direction cases; IN_VIEWER_BLOCK uses the viewer's own cell coord scaled by 8/side_cell_count), early-outs if that closest cell is unchanged, then fills draw_array from the LAST index (closest cell) backwards through outward rings — so forward iteration of draw_array (as DrawBlock does) visits cells FAR-TO-NEAR. + +```c +CLandBlock::calc_sq_draw_order(this, dir, viewer_sq): // viewer_sq = viewer cell & 7 per axis + if (this->draw_array == 0 || draw_array_size < n*n) // n = side_cell_count + (re)alloc draw_array[n*n], draw_array_size = n*n + if (n == 1) { draw_array[0] = this->lcell; return n } + scale = 8 / n + switch (dir): // jump table @0x0052f8e0: 0=IN_VIEWER_BLOCK,1=NORTH,2=SOUTH, + IN_VIEWER_BLOCK: cx = viewer_sq->x/scale; cy = viewer_sq->y/scale // 3=EAST,4=WEST,5=NORTHWEST,6=SOUTHWEST, + NORTH: cx = viewer_sq->x/scale; cy = 0 // 7=NORTHEAST,8=SOUTHEAST + SOUTH: cx = viewer_sq->x/scale; cy = n-1 + EAST: cx = 0; cy = viewer_sq->y/scale + WEST: cx = n-1; cy = viewer_sq->y/scale + NORTHWEST: cx = n-1; cy = 0 + SOUTHWEST: cx = n-1; cy = n-1 + NORTHEAST: cx = 0; cy = 0 + SOUTHEAST: cx = 0; cy = n-1 + this->dir = dir // stored BEFORE the early-out check + if (cx == this->closest.x && cy == this->closest.y) return 0 // no reorder needed + this->closest = {cx, cy} + max_ring = max(edge distances of cx, cy in [0,n)) // same formula as get_block_order + k = n*n + draw_array[--k] = &this->lcell[n*cx + cy] // CLOSEST cell at the LAST slot + for (ring = 1; ring <= max_ring; ring++): + for (step = 0; step < ring; step++): + for each of 8 symmetric quadrant slots: // coeff tables @0x0081df88..0x0081e034 (cell twin of the block tables) + ex = f_x(ring, step) + cx; ey = f_y(ring, step) + cy + if (0 <= ex <= n-1 && 0 <= ey <= n-1) + draw_array[--k] = &this->lcell[n*ex + ey] // fills BACKWARDS -> forward walk = far-to-near + return 1 +``` + +**Gotchas:** The early-out compares ONLY closest.x/y, not dir — a direction flip that maps to the same closest cell keeps the stale order (retail behavior; keep it). The 'if (dir > SOUTHEAST_OF_VIEWER) { use uninitialized locals }' branch is BN's rendering of the switch default — LandDefs::get_dir only returns 0..8, so it is unreachable; do not port. Direction semantics imply lcoord y grows northward (NORTH_OF_VIEWER -> closest edge y=0). CLandCell stride 0x108 is hardcoded in the index math. Entries are written with --k so the array is exactly filled (k reaches 0); DrawBlock then iterates 0..n*n-1 forward. + +### RenderDeviceD3D::DrawBlock @0x005a17c0 + +**Summary:** Draws one landblock, two passes over the block's far-to-near draw_array. Pass 1: for visible cells with shadow objects, UpdateObjCell + insertion-sort the cell's shadow part list. Pass 2 per cell: restore FF material state if dirty, bind the region terrain surface array, then if the cell IsInView draw terrain (DrawLandCell, with the landscape detail texture enabled only for full 8x8 blocks), then if (alwaysDrawObjects || IsInView) draw the cell's contents (DrawSortCell = building + object parts) and conditionally flush the accumulated alpha mesh list. Pushes an identity viewer-relative Position for the whole block (the block offset lives in each cell's data/parts). + +```c +RenderDeviceD3D::DrawBlock(this, blk): + Render::object_scale_vec = (1,1,1); Render::object_scale = 1 + local Position pos = identity (vtable 0x796910, objcell_id 0); Frame::cache(&pos.frame) + Render::positionPush(3, &pos) + ACRender::curLandBlockVertexLighting = blk->vertex_lighting // per-block baked vertex light + n2 = blk->side_cell_count^2 + for (i = 0; i < n2; i++): // PASS 1: sort translucent/shadow parts + cell = blk->draw_array[i] + if (cell->IsInView() != 0 && cell->num_shadow_objects != 0): + RenderDeviceD3D::UpdateObjCell(this, cell) + if (cell->num_shadow_parts > 1) + CShadowPart::insertion_sort(&cell->shadow_part_list, cell->num_shadow_parts) + full_res = (blk->side_cell_count == 8) + for (i = 0; i < n2; i++): // PASS 2: draw, far-to-near cells + if (render_device->ffStateDirty): // +0x7e4 flag; restores FF lighting sources + ... reset material via device vtable, SetFFDiffuseColorSource(FromVertex), SetFFAmbientColorSource(FromVertex) + Render::SetSurfaceArray(CommandList::GetHead(CRegionDesc::current_region->terrain_info)->hold_run) + Render::object_scale_vec = (1,1,1); Render::object_scale = 1 + cell = blk->draw_array[i] + if (cell->IsInView() != 0): // virtual, vtable+0x68 + if (full_res): // detail texture only on full-res blocks + Render::curr_detail_surface = Render::landscape_detail_surface + Render::curr_detail_tiling = Render::landscape_detail_tiling + Render::curr_detail_src_blend = 5; Render::curr_detail_dst_blend = 6 + this->vtable->DrawLandCell(cell) // terrain polys + Render::curr_detail_surface = 0 + if (alwaysDrawObjects != 0 || cell->IsInView() != 0): + this->vtable->DrawSortCell(cell) // building + objects (below) + if (flush ) // global float flush = 0.75 @0x00820ed0 + D3DPolyRender::FlushAlphaList(flush) // flushes only if alpha list > flush*3000 entries + ACRender::curLandBlockVertexLighting = 0 + Render::framePop() +``` + +**Gotchas:** 1) The FlushAlphaList guard is x87 mush (fcom flush vs 1f, test ah,0x41) — polarity ambiguous from BN, but the global 'float flush = 0.75' (@0x00820ed0) plus FlushAlphaList's own internal gate (it flushes only when alphaedMeshCountClip or alphaedMeshCountAlpha exceeds arg*3000, i.e. 2250) means the sensible reading is 'if (flush < 1.0f) FlushAlphaList(flush)': a mid-walk pressure valve, not an every-cell flush; end-of-frame calls use FlushAlphaList(0f) = flush everything. 2) 'uint32_t id = blk->m_DID.id' is read then apparently unused in the BN output — likely it fills the local Position's objcell_id (var_44); harmless either way since the frame is identity. 3) IsInView is the virtual at vtable+0x68 (BN shows it named in pass 1 but as a raw '+0x68' call in pass 2 — same slot). 4) draw_array entries are CLandCell* but dispatched through the CObjCell/CSortCell interfaces (CLandCell : CSortCell : CObjCell). + +### RenderDeviceD3D::DrawSortCell (+ DrawLandCell, where DrawBuilding fires) @0x0059f140 (DrawLandCell 0x0059f120, DrawBuilding 0x0059f2a0, DrawObjCell 0x005a1a40) + +**Summary:** The per-cell content dispatch, one level below DrawBlock. DrawLandCell submits the cell's terrain polygons (ACRender::landPolysDraw(cell->polygons, 2)). DrawSortCell is where buildings enter the outdoor walk: if the cell owns a CBuildingObj it calls the vtable DrawBuilding FIRST, then DrawObjCell for the cell's remaining parts (scenery/static/dynamic shadow parts via DrawPartCell). Because DrawBlock walks cells far-to-near inside blocks that LScape::draw walks far-to-near, DrawBuilding fires strictly far-to-near — exactly the trace's interleave. + +```c +RenderDeviceD3D::DrawLandCell(this, cell): // @0x0059f120 + ACRender::landPolysDraw(cell->polygons, 2) + +RenderDeviceD3D::DrawSortCell(this, cell): // @0x0059f140; cell is CSortCell + if (cell->building != 0) + this->vtable->DrawBuilding(cell->building) // = RenderDeviceD3D::DrawBuilding @0x0059f2a0 + this->vtable->DrawObjCell(cell) // = RenderDeviceD3D::DrawObjCell @0x005a1a40 + +RenderDeviceD3D::DrawObjCell(this, cell): // @0x005a1a40 + RenderDeviceD3D::DrawPartCell(this, cell->m_DID.id, cell ? &cell->vtable : 0, 0) + +RenderDeviceD3D::DrawBuilding(this, bldg): // @0x0059f2a0 (head only; body not in scope this task) + RenderDeviceD3D::outdoor_pview->outdoor_portal_list = bldg->portals // arms look-in portal punches + CPhysicsPart::UpdateViewerDistance(bldg->part_array->parts[0]); ... +``` + +**Gotchas:** DrawObjCell's BN body has a bogus else-branch dereferencing arg2 after a null check ('if (arg2) DrawPartCell(..., &arg2->vtable, 0); else DrawPartCell(arg2->m_DID.id, nullptr, 0)') — decomp artifact of a cmov/sete; the intent is DrawPartCell(cell_id, cell-or-null, 0). DrawBuilding's very first act is publishing the building's portal list into the outdoor PView — this is the hook that produces the DrawCells look-in punches (ov=0, 1–3 cells) interleaved with far-to-near DrawBuilding calls in the live trace; the building body itself was only skimmed here (out of assigned scope). + +**Report notes:** Trace reconciliation (docs/research/2026-08-30-fw-walk-oracle/README.md): fully consistent. PView::DrawCells @0x005a4840 with an outdoor view (outside_view.view_count > 0) sets Render::PortalList = the PView, calls LScape::draw, then FlushAlphaList(0f), then walks its cell_draw_num punch list — that is the interleave of LScape::draw / DrawBuilding / DrawCells look-ins the trace shows. The far-to-near ordering has TWO nested sources, both ports of the same ring pattern: (a) LScape::get_block_order builds block_draw_list near-to-far (viewer block index 0, rings outward via static coefficient tables @0x0081cccc..0x0081cd18) and LScape::draw iterates it BACKWARDS; (b) CLandBlock::calc_sq_draw_order fills the per-block cell draw_array BACKWARDS from the closest cell (direction-selected via the 9-case LandDefs::Direction switch, jump table @0x0052f8e0: 0=IN_VIEWER_BLOCK,1=N,2=S,3=E,4=W,5=NW,6=SW,7=NE,8=SE) so DrawBlock's forward walk is far-to-near. Terrain vs buildings vs scenery: DrawBlock per cell draws terrain first (DrawLandCell -> landPolysDraw, detail texture only when side_cell_count==8) then DrawSortCell = building (if the CSortCell owns one) then DrawObjCell (scenery/static/dynamic shadow parts via DrawPartCell); shadow parts are pre-sorted per cell (CShadowPart::insertion_sort) in DrawBlock pass 1. Visibility: LScape::draw_check_blocks clears all block/cell in_view then unions visibility across every portal view using clip-height interval grids (Render::get_clip_height per corner, Render::block_check per block/cell against max_zval/min_zval); a cell already marked by an earlier view is skipped (IsInView()==0 pre-check), so downgrades never happen. Key constants: grid is mid_width=11 x 11 blocks, mid_radius=5 (LScape ctor @0x00505370); landblock side = 192.0 m (FPU-elided as '0f' in calc_frame/draw_check_blocks — pinned by the explicit 24f cell pitch in landcell_check); block frames are viewer-relative (origin (row-viewer_b_xoff)*192, (col-viewer_b_yoff)*192, 0); global float flush = 0.75 @0x00820ed0 gates mid-walk alpha flushing (FlushAlphaList flushes only above arg*3000 queued alpha meshes). Struct authority (acclient.h): CLandBlock : SerializeUsingPackDBObj, CLandBlockStruct — side_cell_count @+0x48, lcell @+0x90 (CLandCell stride 0x108, cell in_view @+0x104), in_view @+0xfc (BoundingType 0=OUTSIDE,1=PARTIALLY_INSIDE,2=ENTIRELY_INSIDE), max_zval/min_zval, draw_array/draw_array_size at tail; LScape = {mid_radius, mid_width, land_blocks, block_draw_list, loaded_cell_id, viewer_cell_id, viewer_b_xoff, viewer_b_yoff, sky, 4 detail surfaces}. Second LScape::draw caller: SmartBox::RenderNormalMode @0x00453aa0. All BN mush encountered is flagged per-function; the two worth repeating: the '-((eax_4 - eax_4))' arg in update_viewpoint decodes to 'landblock (high-word) changed ? 1 : 0' (it gates get_block_order), and landcell_check's 'num_static_objects =' store is really the cell's in_view. + +## Report 5 - View construction (ConstructView overloads / GetClip / viewconeCheck / set_view) + +### PView::ConstructView (CEnvCell overload — interior cell flood) @0x005a57b0 + +**Summary:** The interior visibility flood. Resets the PView's outside_view and per-frame counters, bumps the master timestamp, seeds the todo list with the entry cell (portal index 0xffff = 'entered from no portal' when called from DrawInside; other_portal_id when recursed into from the CBldPortal overload), then LIFO-pops cells: each popped cell is appended to cell_draw_list, its TOP portal_view entry marked cell_view_done, and if ClipPortals finds visible portals, AddViewToPortals pushes neighbor cells (with clipped views) onto the todo list. Returns void. + +```c +void PView::ConstructView(CEnvCell* seed, uint16_t thru_portal_idx) // __thiscall, 0x005a57b0 +{ + this->outside_view.view_count = 0; // reset the accumulated exit-to-landscape view + PView::master_timestamp += 1; + this->cell_todo_num = 0; + this->cell_draw_num = 0; + PView::InitCell(this, seed, thru_portal_idx); // 0x005a4b70 + PView::InsCellTodoList(this, seed, 0.0f); // 0x005a4f50 — seed at distance key 0.0 + while (true) { + if (this->cell_todo_num == 0) return; + cell = this->cell_todo_list.data[--this->cell_todo_num]->cell; // LIFO: pop from END + if (cell == null) return; // null entry terminates the whole flood + if (this->cell_draw_num >= this->cell_draw_list.sizeOf) + DArray::grow(&this->cell_draw_list, this->cell_draw_num + 0x1e); // +30 + this->cell_draw_list.data[this->cell_draw_num++] = cell; + cell->portal_view.data[cell->num_view - 1]->cell_view_done = 1; // mark TOP view done + if (PView::ClipPortals(this, cell, 0) != 0) // 0x005a5520, arg3=0 (portal start index) + PView::AddViewToPortals(this, cell); // 0x005a52d0 — enqueues neighbors w/ views + } +} +``` + +**Gotchas:** The actual view-array appending is DELEGATED: ClipPortals clips each of the cell's portals against the cell's current view (via GetClip with do_clip=1 and a temp_view + Render::copy_view), and AddViewToPortals does per-neighbor InitCell + InsCellTodoList (distance key read at neighbor+0x34) — neither was in this assignment's scope; only their call points are recorded here. cell_todo_list pop is from the END (LIFO), while InsCellTodoList's float key suggests sorted insertion — pop order therefore depends on InsCellTodoList's insert position (unverified). The 'if (cell == 0) break' path exits the entire flood, not just skips the entry. Callers: PView::DrawInside @0x005a5860 (seed = player's cell, idx 0xffff, after Render::copy_view(top_view, NULL, 4) installed a full-viewport quad as the root view and an identity Position with the cell's id was pushed via Render::positionPush(3,...)); and the CBldPortal overload's recursion. DrawInside then calls PView::DrawCells(this, 0) — literal 0. + +### PView::ConstructView (CBldPortal overload — look through one building portal) @0x005a59a0 + +**Summary:** Views through a single building portal polygon. Tests which side of the portal plane the eye is on (epsilon 0.0002), rejects if the eye is on the wrong side for this portal's authored side (or exactly in-plane), clips the portal polygon to the active view via GetClip, installs the clipped screen polygon as a NEW view on the destination cell's top portal_view entry via Render::copy_view, optionally rasterizes the portal poly, pops the current position frame, then recurses into the CEnvCell flood overload. Returns 1 on success, 0 on any rejection. + +```c +int PView::ConstructView(CBldPortal* bp, CPolygon* poly, int do_clip, int mode) // __thiscall, 0x005a59a0 +{ + // Viewpoint side test. F_EPSILON = 0.000199999995f (~0.0002). Viewpoint is + // Render::FrameCurrent->viewer.viewpoint = eye in the CURRENTLY-PUSHED frame's local space + // (the building's object frame), same space as poly->plane. + d = poly->plane.N.x*vp.x + poly->plane.N.y*vp.y + poly->plane.N.z*vp.z + poly->plane.d; + if (d <= 0.0002f) { side = NEGATIVE; if (d >= -0.0002f) side = IN_PLANE; } + else side = POSITIVE; + if (bp->portal_side == 0) { if (side != POSITIVE) return 0; } // authored front-side portal + else { if (side != NEGATIVE) return 0; } // authored back-side portal + // (IN_PLANE fails BOTH gates -> return 0) + int npts; + PView::GetClip(this, side, poly, PView::clip_view /*static Vec2Dscreen* buffer*/, &npts, do_clip); // 0x005a4320 + if (npts == 0) return 0; + CEnvCell* cell = CEnvCell::GetVisible(bp->other_cell_id); // 0x0052dc10 + if (cell == null) return 0; + // APPEND: one view_poly + its screen pts + per-edge world planes into the DESTINATION + // cell's TOP portal_view entry (portal_view.data[num_view-1]).view.{poly,vertex}; ++view_count + ok = Render::copy_view(cell->portal_view.data[cell->num_view - 1], PView::clip_view, npts); // 0x0054dfc0 + if (ok == 0) return 0; // degenerate (<3 surviving screen pts) -> reject + if (mode != 2) + D3DPolyRender::DrawPortalPolyInternal(poly, mode == 1); // 0x0059bc90 + Render::positionPop(); // BN names it framePop — pops the building frame, SUCCESS PATH ONLY + if (mode != 1) + PView::ConstructView(this, cell, (uint16_t)bp->other_portal_id); // recurse into 0x005a57b0 flood + return 1; +} +``` + +**Gotchas:** (1) BN's Sidedness selection at 0x005a59ea has an INVERTED flag decode ('if (p_1) eax = IN_PLANE' from test ah,0x5); Ghidra confirms the correct reading: side = POSITIVE iff d > +0.0002, NEGATIVE iff d < -0.0002, IN_PLANE iff -0.0002 <= d <= +0.0002 — both boundary comparisons are INCLUSIVE toward IN_PLANE, and IN_PLANE always rejects (nothing drawn through a portal whose plane contains the eye). (2) Render::positionPop happens ONLY on the success path, and BEFORE the recursion; on failure the pushed building frame is left in place — the caller PView::DrawPortal @0x005a5ab0 compensates by re-pushing CBuildingObj::curr_pos + Render::obj_view_set only on success. Any port must preserve this push/pop asymmetry. (3) BN's 'st0_1 = copy_view(...)' return handling is mush; the return is a plain int in eax. (4) mode semantics at this level: mode==2 skips drawing the portal poly; mode==1 draws it with flag=true and SKIPS the recursion (caller DrawPortal also skips DrawCells when mode==1); DrawPortal's failure path draws the poly with flag=false only when mode==3. (5) do_clip (param_3) is forwarded verbatim to GetClip as its clip/copy switch. (6) clip_view is a shared static output buffer (also used by ClipPortals' GetClip call at 0x005a5655) — not reentrant. + +### PView::GetClip @0x005a4320 + +**Summary:** Projects a portal polygon's vertices to screen space and produces the ordered (winding-corrected) screen point list, either verbatim (do_clip=0) or clipped against the currently installed view (do_clip!=0) via ACRender::polyClipFinish — the chain-polygon clip against the active view's screen polygon/planes installed by Render::set_view. NEGATIVE side reverses vertex order so the output winding is consistent regardless of which face of the portal is toward the eye. + +```c +void PView::GetClip(Sidedness side, CPolygon* poly, Vec2Dscreen** out_pts, int* out_npts, int do_clip) // this unused; 0x005a4320 +{ + *out_npts = 0; + for (i = 0; i < poly->num_pts; i++) // num_pts is a uint8 + poly->screen[i] = PrimD3DRender::xformStart(poly->vertices[i], 1); // 0x0059b990, project; returns ptr into xform buffer + if (do_clip == 0) { + *out_npts = poly->num_pts; + if (side == POSITIVE) for (i) out_pts[i] = poly->screen[i]; // forward order + else for (i) out_pts[i] = poly->screen[poly->num_pts - 1 - i]; // reversed (winding flip) + return; + } + if (side == POSITIVE) { + Render::PolyCurrent = null; Render::PolyCurrentMod = 1.0f; Render::PolyCurrentPos = 1; + ACRender::polyClipFinish(poly->screen, poly->num_pts, out_pts, out_npts, 0); // 0x006b6d00 + } else { + Vec2Dscreen* rev[32]; // fixed 32-slot stack buffer + for (i = 0; i < poly->num_pts; i++) rev[i] = poly->screen[poly->num_pts - 1 - i]; + Render::PolyCurrent = null; Render::PolyCurrentMod = 1.0f; Render::PolyCurrentPos = 1; + ACRender::polyClipFinish(rev, poly->num_pts, out_pts, out_npts, 0); + } +} +``` + +**Gotchas:** The clip itself lives in ACRender::polyClipFinish (not in scope), which clips against the CPU view context installed by Render::set_view (portal_npnts/portal_vertex/portal_inmask/xmin..ymax) — GetClip only projects, orders, and resets Render::PolyCurrent/PolyCurrentMod/PolyCurrentPos before delegating. The IN_PLANE side takes the NEGATIVE (reversed) branch in both modes, though ConstructView never passes IN_PLANE (other callers: ClipPortals @0x005a54f6/0x005a5655 pass sides from portal records). The reversal buffer is a fixed 32 pointers — portal polys are assumed <= 32 verts. Side effect: mutates poly->screen[] with pointers into a shared per-frame transform buffer (xformStart output), so results are only valid within the current frame context. Convention quirk: declared thiscall (this in ecx) but the body never touches this. + +### Render::viewconeCheck @0x0054c250 + +**Summary:** Sphere-vs-active-view test. Scales the sphere by Render::object_scale, transforms its center from the current pushed frame into viewer_pos block space ('global'), publishes the viewer-frame-local center and scaled radius into Render::local_object_center/local_object_radius (as CPU globals for downstream draw code), then tests the global center against the fixed viewer_world_space.CY plane plus the portal_npnts active view edge planes (portal_vertex[i].plane, installed by set_view). Returns OUTSIDE if fully behind any plane; PARTIALLY_INSIDE if any plane's distance <= radius; else ENTIRELY_INSIDE. + +```c +BoundingType Render::viewconeCheck(const CSphere* s) // __cdecl, 0x0054c250 +{ + c = Render::object_scale * s->center; // Vec3, assembled contiguously on stack + r = Render::object_scale * s->radius; + // current-frame local -> viewer_pos block space ('global'): + g = Position::localtoglobal(&Render::viewer_pos, /*out*/, &Render::FrameCurrent->position, /*in*/ c); + // publish viewer-frame-local center + radius (side effect, ALWAYS, even for OUTSIDE): + l = Frame::globaltolocal(&Render::viewer_pos.frame, /*out*/, /*in*/ g); + Render::local_object_center = l; + Render::local_object_radius = r; + // plane 1: the fixed CY plane of viewer_world_space (world-space view cone) + d = dot(Render::viewer_world_space.CY.N, g) + Render::viewer_world_space.CY.d; + if (d < -r) return OUTSIDE; // strictly less + partial = (d <= r); // inclusive + // planes 2..1+portal_npnts: active view edge planes (view_vertex stride 24, plane at +8) + for (i = 0; i < Render::portal_npnts; i++) { + P = Render::portal_vertex[i].plane; + d = P.N.x*g.x + P.N.y*g.y + P.N.z*g.z + P.d; + if (d < -r) return OUTSIDE; + if (d <= r) partial = true; + } + return partial ? PARTIALLY_INSIDE : ENTIRELY_INSIDE; // enum: OUTSIDE=0, PARTIALLY_INSIDE=1, ENTIRELY_INSIDE=2 +} +``` + +**Gotchas:** The BN pseudo-C for this function is UNUSABLE for the comparisons: its esi_1 partial-flag logic ('if (p_1) esi_1 = 0 else 1' and the final 'eax_4 = esi_1 == 0') has inverted flag senses and a lost return value; the pseudocode above is from the Ghidra decomp of the same PDB-paired binary and is geometrically self-consistent. Two distinct spaces are in play: the PLANE tests use the 'global' (viewer_pos block-space) center g, while the PUBLISHED Render::local_object_center is the viewer-frame-LOCAL center l — BN's stack-slot aliasing (local_10/local_4 reuse across the two transform calls) obscures this completely. The local_object_center/radius stores happen BEFORE any plane test, so they are valid even when OUTSIDE is returned. Boundary semantics: cull is strict (d < -r); the partial flag is inclusive (d <= r), so a sphere exactly tangent from inside counts as PARTIAL, not ENTIRELY_INSIDE. With portal_npnts == 0, the result depends on the CY plane alone. The edge planes were built in world space by Render::copy_view (cross products of unprojected screen-point rays, d = -dot(N, viewer_world_space.viewpoint)), which is why a sphere test against screen-derived portal views is done in world space here. Caller RenderDeviceD3D::DrawMesh @0x005a0860 shows the enum contract: != OUTSIDE draws with the returned value passed into DrawMeshInternal (ENTIRELY_INSIDE presumably skips per-poly clip). + +### Render::set_view @0x0054d0e0 + +**Summary:** Installs one view (poly record i of a view_type) as the active CPU clip context: sets the portal_view/portal_view_num globals, the active edge count portal_npnts, the clip in-mask with npnts+1 bits (the +1 covering the fixed CY plane alongside the npnts edge planes), the portal_vertex base pointer (screen pt + world plane per vertex), and the screen-space bounding rect xmin/xmax/ymin/ymax. Pure global-installation; no computation. + +```c +void Render::set_view(view_type* v, int i) // __cdecl, 0x0054d0e0 +{ + Render::portal_view_num = i; + Render::portal_view = v; // callers pass &portal_view_type::view (offset 16) + view_poly* vp = &v->poly.data[i]; // {int vertex_count; int vertex_index; float xmin,xmax,ymin,ymax} + Render::portal_npnts = vp->vertex_count; + Render::portal_inmask = (1 << ((vp->vertex_count + 1) & 0x1f)) - 1; // npnts edge planes + 1 CY plane + Render::portal_vertex = &v->vertex.data[vp->vertex_index]; // view_vertex {Vec2D pt; Plane plane}, stride 24 + Render::xmin = vp->xmin; Render::xmax = vp->xmax; + Render::ymin = vp->ymin; Render::ymax = vp->ymax; +} +``` + +**Gotchas:** The CPU globals installed: portal_view_num, portal_view, portal_npnts, portal_inmask, portal_vertex, xmin, xmax, ymin, ymax. These are exactly what viewconeCheck (planes) and ACRender::polyClipFinish / the poly pipeline (mask + bounds) consume. The '& 0x1f' on the shift count is the x86 shl truncation made explicit by Ghidra — with copy_view capping views at 31 points, vertex_count+1 <= 32, and a 32 shift would wrap; retail never hits it because copy_view clamps to 0x1f. Callers iterate i over [0, portal_view_type::view_count) on a cell's TOP portal_view entry (e.g. PView::DrawCells at 0x005a08d8-pattern sites, RenderDeviceD3D::DrawMesh @0x005a08d8, CEnvCell code @0x0052c449) — one cell can hold several view polys (one per portal it was reached through) and each gets installed and tested in turn. BN renders some call sites as 'set_view(&esi[4], i)' or 'set_view(&arg2->m_timeStamp, arg3)' — field-name garbage; all pass a portal_view_type's embedded view_type. + +**Report notes:** Sources: docs/research/named-retail/acclient_2013_pseudo_c.txt (lines 433750-433933 ConstructView overloads + DrawInside/DrawPortal; 432344-432425 GetClip; 342860-342941 viewconeCheck; 343750-343764 set_view) cross-checked against the live Ghidra patchmem decomp (port 8081) for every x87-flag-ambiguous branch, and docs/research/named-retail/acclient.h for structs: view_poly (line 32465), view_vertex {Vec2D pt; Plane plane} (32483, stride 24), view_type {vertex_count_total; DArray poly; DArray vertex} (32338), portal_view_type {DArray portal; view_type view; float max_indist; uint view_count; int cell_view_done; int view_timestamp; int update_count} (32346), PView {portal_view_type outside_view; int draw_landscape; CBldPortal** outdoor_portal_list; DArray cell_draw_list; uint cell_draw_num; DArray cell_todo_list; uint cell_todo_num; LScape* lscape} (45934), CBldPortal {portal_side; other_cell_id; other_portal_id; exact_match; num_stabs; stab_list; sidedness} (32094), CCellPortal (32300). Enums: Sidedness {POSITIVE=0, NEGATIVE=1, IN_PLANE=2, CROSSING=3} (2527), BoundingType {OUTSIDE=0, PARTIALLY_INSIDE=1, ENTIRELY_INSIDE=2} (5365). + +APPEND MECHANICS (Render::copy_view @0x0054dfc0, read for call-site accuracy, not a full assignment): copy_view(dest_pv, pts, npts) appends ONE view to dest_pv->view: a new view_poly at index view_count (vertex_index = current vertex_count_total, which RESETS to 0 when view_count==0), the surviving screen points into .view.vertex (perspective-divide by w unless w==1; drop points within ~1px of the previous kept point AND collinear within a 1px cross-product tolerance; <3 survivors => return 0; cap 0x1f=31; a closing duplicate vertex is appended after the poly), the xmin/xmax/ymin/ymax bounds, then per-edge WORLD-space planes into each view_vertex.plane (unproject each screen pt to a view ray — PrimD3DRender::ScreenToViewTransform when Render::newmethod==1, else the manual Xaxis/Yaxis/Zaxis/xinvscale/yinvscale/tx/ty/vdst path — N = normalize(cross(ray_i, ray_i+1)) with F_EPSILON degeneracy skip, d = -dot(N, viewer_world_space.viewpoint)), and finally ++view_count, return 1. copy_view(dest, NULL, 4) is the special full-viewport-quad path used by DrawInside for the root cell view. + +TRACE RECONCILIATION (docs/research/2026-08-30-fw-walk-oracle/README.md): (a) The overall shape matches the code: outdoor building look-ins go RenderDeviceD3D::DrawBuilding -> PView::DrawPortal @0x005a5ab0 -> ConstructView(CBldPortal) -> recursion into the cell flood -> PView::DrawCells; interior frames go PView::DrawInside @0x005a5860 -> full-viewport root view -> ConstructView(CEnvCell, 0xffff) -> DrawCells. The 1-3 cell look-in punches are the cell_draw_list contents of that flood. (b) DISCREPANCY TO RE-CHECK ON THE TRACE SIDE: the literal second argument to PView::DrawCells is 0 from DrawInside and 1 from DrawPortal (both confirmed in Ghidra; BN's 'DrawCells(this, edx_2)' consuming ConstructView's return is a phantom — the CEnvCell overload is void and the real arg is the stack literal). The oracle's labels (look-ins 'ov=0', interior 'ov=1') are EXACTLY INVERTED relative to these raw literals — either the probe read the wrong slot for this (stack vs register) or 'ov' in the trace is a derived label, not the raw argument. Worth re-verifying before anything keys off ov. These are the only two DrawCells call sites in the binary. (c) 'DrawCells draws LScape through the exit view' is consistent with PView::outside_view being zeroed at flood start and (per PView layout: draw_landscape flag, lscape pointer) consumed inside DrawCells @0x005a4840 — DrawCells was not in this assignment. + +ADJACENT FUNCTIONS a porter will need next (addresses pinned, bodies not read in full): PView::InitCell @0x005a4b70, PView::InsCellTodoList @0x005a4f50, PView::ClipPortals @0x005a5520 (contains the second GetClip site with do_clip=1 and a temp_view + copy_view at 0x005a5495), PView::AddViewToPortals @0x005a52d0, PView::DrawCells @0x005a4840, PView::add_views @0x005a5210 / remove_views @0x005a42e0 (push/pop portal_view entries on stab-list cells around a portal draw), ACRender::polyClipFinish @0x006b6d00, PrimD3DRender::xformStart @0x0059b990, Render::copy_view @0x0054dfc0. + +Global epsilon: F_EPSILON = 0.000199999995f (raw float 0x3951B717), used both by ConstructView's side test and copy_view's degenerate-normal skip. + + diff --git a/docs/research/2026-08-30-fw-walk-pseudocode.md b/docs/research/2026-08-30-fw-walk-pseudocode.md new file mode 100644 index 00000000..79ae6612 --- /dev/null +++ b/docs/research/2026-08-30-fw-walk-pseudocode.md @@ -0,0 +1,277 @@ +# FW0 — the retail frame walk, port-ready pseudocode model (2026-08-30) + +The distilled model FW1 ports from. Sources: the five decomp reads in +[`2026-08-30-fw-walk-pseudocode-appendix.md`](2026-08-30-fw-walk-pseudocode-appendix.md) +(BN pseudo-C cross-checked against the Ghidra patchmem decomp wherever +x87-flag mush demanded it), reconciled against the live traces in +[`2026-08-30-fw-walk-oracle/`](2026-08-30-fw-walk-oracle/README.md). +Every function below carries its named symbol + address; the appendix has +the full extractions with per-function gotchas. + +## 1. The frame root — `SmartBox::RenderNormalMode` @0x00453aa0 + +Per frame (via `SmartBox::Draw` → `DrawNoBlit` @0x00454c20, which first +runs `update_viewer` and skips rendering entirely when `viewer_cell` is +null): + +``` +if ((viewer.objcell_id & 0xFFFF) < 0x100) { // CAMERA cell is outdoor + LScape::update_viewpoint(lscape, viewer.objcell_id); + Render::update_viewpoint(&viewer); + Render::set_default_view(); // full-screen view + Render::useSunlightSet(1); + LScape::draw(lscape); // → §3 +} else { // camera in an EnvCell + if (viewer_cell->seen_outside) + LScape::update_viewpoint(lscape, Position::get_outside_cell_id(&viewer)); + Render::update_viewpoint(&viewer); + render_device->DrawInside(viewer_cell); // → PView::DrawInside, §5 +} +D3DPolyRender::FlushAlphaList(0f); +``` + +`SmartBox::update_viewer` @0x00453ce0 resolves the camera pose and cell: +a `CTransition` sphere sweep (the global `viewer_sphere`) from a pivot on +the player (CameraManager pivot part + offset) toward the camera's sought +position; `t->sphere_path.curr_cell` becomes `viewer_cell`. Fallbacks: +`AdjustPosition` on the raw sought position, else camera at the player +with `viewer_cell = null` (frame skipped). **The frame roots at the +CAMERA's cell** — proven live by the porch-cam trace. + +## 2. The invisible-panel primitive — `D3DPolyRender::DrawPortalPolyInternal` @0x0059bc90 + +The single primitive behind both "punch" and "seal": draws one portal +polygon as an untextured CULL_NONE triangle fan, **depth-test ALWAYS, +z-write ON, color alpha 0** (invisible under SRCALPHA/INVSRCALPHA). +Byte-verified in the raw pseudo-C: `SetDepthBufferMode(DEPTHTEST_ALWAYS, +(mode>>2)&1)` @0059be02; forced Z `0.999998987f` @0059bf4b. + +- `flag=1` (mode global `maxZ1`=7): every vertex Z forced to + **0.999998987 (far plane)** — the **PUNCH**: re-opens the aperture's + depth so look-in content can draw into it. +- `flag=0` (mode `maxZ2`=6): real projected Z — the **SEAL**: writes the + portal surface's own depth at the aperture. Only seals increment + `portalsDrawnCount` (the deferred z-clear trigger). +- Trivial reject: polygon wholly outside a ±12.0 local-XY box (the + 24 m cell); the reject-loop polarity is an FP-status idiom (`test + ah,0x44`) BN could not lift — **re-verify polarity at FW1 against the + binary bytes** before porting. +- Debug: raising the mode's alpha bit (via the maxZ1/maxZ2 globals, + .data @0x820e18/0x820e14) renders the panels visibly in cycling colors. +- Goes through `DrawPrimitiveUP`, gated by the registry bool + `s_bAllowDrawPrimitiveUP` (default 1). +- Restores NO state — callers rely on backup/restore_curr_state. + +**This resolves the campaign's panel question:** the "seal panels" are +not mesh subsets (those authored Translucency-1.0 subsets stay +never-drawn); they are the buildings'/cells' PORTAL POLYGONS drawn +depth-only by this primitive. AD-117's stamps unknowingly re-invented a +real retail mechanism at the wrong site with the wrong geometry. + +## 3. The outdoor walk — `LScape::draw` @0x00506330 + +``` +GameSky::Draw(sky, 0) // dome +LScape::draw_check_blocks(this) // per-view visibility union (below) +for i = mid_width² - 1 .. 0: // block_draw_list built near-to-far → + blk = block_draw_list[i] // backwards walk = FAR-TO-NEAR + if (blk && blk->in_view) render_device->DrawBlock(blk) +if (weather) GameSky::Draw(sky, 1) +``` + +- Grid: `mid_width`=11 × 11 blocks (`mid_radius`=5); block side 192 m + (FPU-elided in BN — pinned by the explicit 24 m cell pitch). +- `get_block_order` @0x00504c50: viewer's block first, then concentric + rings (8 quadrant-symmetric slots per step from static coefficient + tables); rebuild only when the viewer crosses a LANDBLOCK boundary. +- Block frames are **viewer-relative**: origin + `((row−viewer_b_xoff)·192, (col−viewer_b_yoff)·192, 0)` — the + landscape renders in viewer-block-local space for float precision. +- `draw_check_blocks` @0x00505f80: clears every block/cell `in_view`, + then FOR EACH VIEW of `Render::PortalList` (outdoor: the default view; + interior: the exit views) unions visibility via clip-height interval + grids (`get_clip_height` corners → `block_check` vs max/min_zval); + `landcell_check` @0x005050a0 refines per-cell (non-8×8 far blocks: + all cells PARTIAL; ENTIRELY_INSIDE blocks: all cells 2; else per-cell + corner grids at 24 m pitch). A cell marked by an earlier view is never + downgraded. +- `CLandBlock::calc_sq_draw_order` @0x0052f4a0: per-block cell order, + closest cell (picked by the 9-case compass direction switch) written + LAST, rings filled backwards → forward iteration = far-to-near. + Early-out compares only `closest.x/y`, not `dir` (keep this quirk). + +Per block, `RenderDeviceD3D::DrawBlock` @0x005a17c0: pass 1 updates +in-view cells' shadow objects + insertion-sorts shadow parts by depth; +pass 2 per cell (far-to-near): terrain (`DrawLandCell` — detail texture +only on full 8×8 blocks) then `DrawSortCell` @0x0059f140: + +``` +if (cell->building) render_device->DrawBuilding(cell->building) // §4 +render_device->DrawObjCell(cell) // scenery/statics/dynamics via sorted shadow parts → CPhysicsPart::Draw(part, 0) +``` + +Mid-walk alpha pressure valve: `FlushAlphaList(flush)` with the global +`flush`=0.75 (flushes only above ~2250 queued alpha meshes). + +## 4. Buildings — `RenderDeviceD3D::DrawBuilding` @0x0059f2a0 + +``` +outdoor_pview->outdoor_portal_list = b->portals; // ALWAYS +CPhysicsPart::UpdateViewerDistance(part0); // degrade level +if (part0->gfxobj[deg_level] == 0) return; // degraded out → whole building skipped +CBuildingObj::curr_pos = &b->m_position; // frame-restore anchor for the portal pass +set building detail-surface state; FlushAlphaList(0f); +CPhysicsPart::Draw(part0, 1); // PORTAL pass +ObjBuildingOrBuildingPart = 1; +CPhysicsPart::Draw(part0, 0); // SHELL pass (normal mesh; per-frame dedupe applies) +ObjBuildingOrBuildingPart = 0; +``` + +The portal pass, through `DrawMesh` @0x005a0860 (per portal view, +`building_view`-gated; portal-flagged draws run even when viewconeCheck +says OUTSIDE) → `DrawMeshInternal` @0x0059f360, walks the building's +drawing-BSP **twice** (`BSPTREE::build_draw_portals_only` — portal nodes +visited far-to-near, plane epsilon 0.0002): + +- **Pass 1 — punch.** Each in_portal → `PView::DrawPortal` @0x005a5ab0 → + `ConstructView(CBldPortal)` @0x005a59a0: viewer sidedness must match + the authored `portal_side` (IN_PLANE within ±0.0002 fails BOTH gates); + `GetClip` must leave ≥3 points; the destination EnvCell must be + currently Visible (`CEnvCell::GetVisible` — not loaded ⇒ silently no + punch, no fallback). On success: `DrawPortalPolyInternal(poly, 1)` — + the far-Z punch — and the clipped view is pushed onto the destination + cell's top `portal_view` via `Render::copy_view`. +- **Pass 2 — look-in.** Same walk/gates; on success recurses + `ConstructView(CEnvCell)` (the §5 flood seeded through + `other_portal_id`) and calls `PView::DrawCells` — the trace's + `DC ov=0` punches: interior cells + objects drawn into the punched + aperture (no landscape, no clear, no sealing on this path). +- Push/pop asymmetry (MUST preserve): `ConstructView(CBldPortal)` pops + the building frame only on SUCCESS (before recursing); on failure the + frame stays pushed and `DrawPortal` compensates by re-pushing + `CBuildingObj::curr_pos` only on success. +- `DrawCells` bumps `m_nFrameStamp`, re-arming the per-frame part dedupe + so objects already drawn outdoors can draw again inside a look-in. +- DEAD in 2013 (do not port): `DrawBuildingLeaf` + `curr_leaf_cells` + (pre-EnvCell interior model); `PView::DrawPortal`'s pass==3 + seal-on-fail branch (pass only ever ∈ {1,2}). + +## 5. Interior frames — `PView::DrawInside` @0x005a5860 + +``` +CEnvCell::curr_view_push(cell); // num_view++ (0x48-byte lazy slot, counters reset) +PView::add_views(this, cell->num_stabs, cell->stab_list); // push a view slot on every visible stab cell +Render::positionPush(3, identity Position stamped with cell DID); +Render::copy_view(cell->top_view, null, 4); // root view = full viewport quad +PView::ConstructView(this, cell, 0xffff); // the flood (below) +PView::DrawCells(this, 0); // dead arg +Render::positionPop(); remove_views(...); cell->num_view -= 1; +``` + +`ConstructView(CEnvCell)` @0x005a57b0 — the flood: zero +`outside_view.view_count`, bump `master_timestamp`, reset todo/draw +lists; seed `InitCell(cell, 0xffff)` + `InsCellTodoList(cell, 0)`; +then pop-from-END: append cell to `cell_draw_list` (grow +30), mark top +view `cell_view_done`, `ClipPortals` → `AddViewToPortals` (clips each +portal against the cell's current view and enqueues neighbors with their +clipped views; portals leading outdoors raise `outside_view`). + +`PView::DrawCells` @0x005a4840 — the draw, all passes far-to-near +(`cell_draw_list` walked from the end): + +``` +if (outside_view.view_count > 0) { // 'ov' in the traces (field, not the dead arg) + Render::PortalList = &outside_view; + LScape::draw(lscape); // landscape THROUGH the exit views (§3) + FlushAlphaList(0f); m_nFrameStamp += 1; + if (forceClear || portalsDrawnCount != 0) // count reset only on the !forceClear arm + Clear(flag 4 /*z-buffer*/, black, z=1.0); // deferred clear triggered by earlier SEALS + for cells far-to-near, per view of the cell's top portal_view: + for each portal with other_cell_id == 0xFFFFFFFF: // exits to the landscape + DrawPortalPolyInternal(portal.poly, 0); // SEAL @ own depth (verified @0059a49b7) +} +useSunlightSet(0); restore_all_lighting(); +for cells far-to-near, per view: setup_view; DrawEnvCell(cell); // BSP geometry +for cells far-to-near: PortalList = cell top view; DrawObjCellForDummies(cell); // objects +``` + +Degenerate guard NOT to port: `num_view==0` would loop 65535 views — +unreachable (every listed cell was `curr_view_push`ed). + +## 6. View machinery + +- `Render::set_view` @0x0054d0e0 — pure CPU global install: the active + view's edge count, in-mask (`npnts+1` bits: edges + the CY plane), + vertex/plane base, screen bounds. No GPU state. +- `Render::copy_view` @0x0054dfc0 — appends ONE view: perspective-divided + screen points (drop near-duplicates/collinear within ~1 px; <3 + survivors ⇒ reject; cap 31), bounds, and per-edge WORLD-space planes + (`N = normalize(cross(ray[k+1], ray[k]))` — NEXT × CURRENT, corrected + 2026-08-30 by the flood-read appendix against Ghidra; an earlier + revision of this line had the operands reversed — + `d = −dot(N, viewpoint)`). `copy_view(dest, null, n)` = the + full-viewport root quad (count ignored). Full extraction: + `2026-08-30-fw-flood-pseudocode-appendix.md`. +- `PView::GetClip` @0x005a4320 — projects the portal polygon + (`xformStart`), reverses winding for NEGATIVE side, and (do_clip) + clips via `ACRender::polyClipFinish` against the installed view. ≤32 + verts assumed. The only CPU polygon clip in the frame. +- `Render::viewconeCheck` @0x0054c250 — sphere vs the CY plane + the + active view's edge planes, in viewer-block space. Cull strict + (`d < −r`); partial inclusive (`d ≤ r`); publishes + `local_object_center/radius` ALWAYS (even when OUTSIDE). BN's version + of this body is unusable (inverted flags) — the model here is + Ghidra-verified. + +## 7. Constants and anchors + +| Item | Value | +|---|---| +| Outdoor cell test | `(objcell_id & 0xFFFF) < 0x100` | +| Plane/side epsilon `F_EPSILON` | 0.000199999995f (0x3951B717) | +| Punch far-Z | 0.999998987f | +| Panel depth mode | test ALWAYS, write ON (mode bit2), alpha 0 | +| Panel local-XY reject box | ±12.0 | +| Landscape grid | mid_width 11, mid_radius 5, block 192 m, cell 24 m | +| Alpha pressure valve | global `flush` = 0.75 (~2250 meshes) | +| copy_view vertex cap | 31 (0x1F) | +| Flood list growth | +30 (0x1E) | +| BoundingType | 0 OUTSIDE, 1 PARTIALLY_INSIDE, 2 ENTIRELY_INSIDE | +| Sidedness | 0 POSITIVE, 1 NEGATIVE, 2 IN_PLANE (always rejects) | +| Exit-portal sentinel | `other_cell_id == 0xFFFFFFFF` (cell), `0xFFFF` (no-through seed) | + +Struct anchors (acclient.h): `PView` {outside_view@0 (view_count@+0x38), +draw_landscape, outdoor_portal_list, cell_draw_list@+0x50, +cell_draw_num@+0x60, cell_todo_list, cell_todo_num, lscape@+0x78}; +`CEnvCell.m_DID`@+0x28, `num_view`@+0x134, `portal_view`@+0x138; +`CCellPortal` stride 0x18 {other_cell_id, other_cell_ptr, portal@+8, +portal_side, other_portal_id, exact_match}; `CBldPortal` {portal_side, +other_cell_id, other_portal_id, exact_match, num_stabs, stab_list}; +`CLandBlock.in_view`@+0xFC, `CLandCell` stride 0x108 (in_view@+0x104). + +## 8. What the traces + code jointly prove about #456 + +Outdoor frames draw EVERYTHING distance-eligible — the far building +first (far-to-near) — and correctness is pure depth: nearer terrain, +shells, punches, and look-in cell geometry bury the vista. Interior +frames never roster the far building (exit-view cone culls it) and SEAL +their exit apertures at own depth after drawing the landscape through +them, so nothing drawn later can leak into the aperture. There is no +hiding mechanism to invent; FW3/FW4 reproducing this walk resolves #456 +wholesale. + +## 9. Verification status + +Byte-verified against the raw pseudo-C by hand: the seal loop +(`other_cell_id==0xffffffff → DrawPortalPolyInternal(poly,0)` @0059a49af), +the deferred z-clear (@005a48a9), `DEPTHTEST_ALWAYS` + z-write-from-mode +(@0059be02), punch Z 0.999998987f (@0059bf4b), the fan submit (@0059bf84). +Ghidra-arbitrated where BN mush was flagged: the rooting condition, the +`viewconeCheck` comparisons, the ConstructView sidedness decode, the +DrawCells dead argument. **Re-verify at FW1 before relying on:** the ±12 +reject polarity in `DrawPortalPolyInternal` (FP-status idiom), the +`DrawBlock` alpha-flush comparison polarity, and `InsCellTodoList`'s +insert position (LIFO pop order depends on it — port it from its body +@0x005a4f50, not from assumption). Resolved non-issue: the trace's `ov` +is the FIELD `outside_view.view_count` (probe read PView+0x38), not +`DrawCells`' dead argument — reports 2 and 5 agree once combined. diff --git a/docs/superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md b/docs/superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md new file mode 100644 index 00000000..9bece6bb --- /dev/null +++ b/docs/superpowers/specs/2026-08-30-campaign-w-retail-frame-walk-design.md @@ -0,0 +1,215 @@ +# Campaign FW — the retail frame walk (rendering redesign design spec) + +**Status:** APPROVED by owner 2026-08-30. Implementation plan: +[`docs/plans/2026-08-30-campaign-fw-frame-walk.md`](../../plans/2026-08-30-campaign-fw-frame-walk.md). +**Naming note:** approved as "Campaign W"; renamed to **FW** because the +roadmap already owns "Phase W" (the historical Unified Cell Graph program). +Stage ids are FW0–FW6. +**Owner directive:** "I want this as solid as retail, no weird seams between +walls or floors, it should work as retail. As stable as retail." Scope +confirmed 2026-08-30: retail owns every frame decision, modern code owns +only GPU mechanics, and the camera behavior is ported too. +**Predecessor:** Campaign PV (halted 2026-08-30 by owner verdict — +`docs/plans/2026-08-30-pview-visibility-campaign.md`). PV tried to import +retail's visibility decisions piecemeal into our gather/regroup renderer +and failed. This campaign replaces the renderer's decision layer outright. + +--- + +## 1. Why (the disease, named once) + +Retail has no separate "visibility system." The world draws itself by +walking itself: the frame starts at the viewer's cell, recurses through +portals (or walks landcells outward when outdoors), and each cell draws its +own polygons at its turn in the walk. Every polygon is drawn exactly once, +by exactly one owner, in an order that resolves every depth tie, from +geometry the DATs author to be watertight per cell. Correctness is a +property of the structure, not of any check. + +acdream inverted that: gather everything visible into lists, regroup by +material for GPU efficiency, draw in batch order. Regrouping discards +retail's ordering and ownership guarantees, and we have spent months buying +them back one patch at a time. The complete patch inventory — the doorway +flap, the seam strips, the +0.02 z-fight lift, the exit-portal stencils, +the look-in seed heuristics, the seal-panel depth stamps, the #456 +cathedral bleed, and the 2026-08-29/30 transition breakage — is one disease +with one cure: make the walk own the frame. + +The precedent is physics. "No patching collision" led to a faithful retail +port, and physics has been stable since. The renderer is the last subsystem +violating the project thesis (modern code, retail behavior). + +## 2. Goal and non-goals + +**Goal.** Port retail's frame composition verbatim so that every defect +class above becomes structurally impossible: no seams between walls, +floors, or terrain; no visibility flap; no vista bleed at any position +retail can reach; no stale partial-world frames; retail camera behavior. + +**Non-goals.** +- NOT porting retail's per-polygon D3D submission. Our pre-built meshes + contain the same triangles (conformance-tested); porting 2002 D3D buys + zero correctness. +- NOT touching DAT decoding, mesh extraction, terrain math, texture + decode, or GPU residency (the WB-derived asset layer, ~19K lines, + healthy). +- NOT redesigning streaming. The only streaming change is one new + invariant (§4, atomic cell presence). +- NOT changing lighting/shading models already user-gated (VisualMaster). + +## 3. The ownership line + +**Retail owns every decision** — what draws, from where, in what order, +clipped by what. Ported verbatim from `docs/research/named-retail/` with +named-symbol citations in code comments: + +| Decision | Retail mechanism (port source) | +|---|---| +| Frame rooting | `SmartBox::RenderNormalMode` @0x00453aa0: viewer in an EnvCell → `CEnvCell` DrawInside recursion; truly outdoors → `set_default_view` + `LScape` draw | +| Per-portal views | `ConstructView` / `set_view` / `PView::GetClip`; the portal CHAIN's polygon is the only CPU-clipped geometry (`ACRender::polyClipFinish`); one view per chain, never merged (the PV1 finding stands) | +| Object gating | `Render::viewconeCheck` — coarse sphere-vs-cone; PARTIALLY_INSIDE draws the whole object; pixel exactness comes from recursion + z-buffer | +| Landscape walk | `LScape`/`CLandBlock`/`CLandCell` draw order and radius rules | +| Buildings | `CBuildingObj` draw (pre-punch flush @0x0059F2A0) + `BuildInfo.Portals` look-in views (`ConstructView(CBldPortal)`) | +| Stage interleave | The full retail frame sequence (landscape early/late, alpha farther/near, exit mask, shells, dynamics, particles) — owned BY the walk, not approximated from outside as `RetailPViewPassExecutor` does today | +| Depth semantics | Retail's depth-test function and write configuration verbatim, so submission-order tie resolution matches retail exactly (this is what retires the +0.02 lift) | +| LOD/degrade | The marker-class degrade admission (already ported at `RetailDegradePolicy`; relocates to the walk's object-gating step) | +| Particles/dynamics | Emitters draw at their owner cell's walk turn, unclipped (`ShouldDrawParticles` @0x0050FE60) | +| Camera | Retail camera behavior in full: chase, 0.3 m collision probe, slope alignment (already default-on), PLUS the retail zoom envelope. The 40 m development zoom is retired and its register row (AD-116) deleted. If a development free-camera is still wanted later it is a separate explicit dev tool, not a modification of the retail camera; out of scope here. | + +**Modern code owns only mechanics**, and each substitution carries a proof +of pixel-neutrality: + +| Modern mechanic | Neutrality proof | +|---|---| +| Pre-built vertex/index buffers (WB-derived) | Same triangles — existing conformance suites | +| Bindless textures, Vulkan RHI | Resource binding strategy; changes no order, no coverage | +| Merging **adjacent** same-state draws into one MDI call | Order-preserving by construction; a merge across a state or stage boundary is forbidden | +| Async landblock streaming | The atomic-presence invariant (§4) makes async loading indistinguishable from retail's synchronous loading, minus the hitch | + +**The rule:** if a modern component ever makes a decision retail did not +make, that is a campaign bug regardless of how the pixels look. + +## 4. Architecture + +### Components (each one purpose, testable alone) + +- **`RetailFrameWalk`** (new, App/Rendering) — the ported recursion + + landscape walk. Pure CPU: input = world snapshot + camera pose; output = + the ordered draw stream and the frame's visible-cell set. No GPU types. + Unit-testable headless against synthetic worlds and against captured + retail traces (§5). +- **`PViewSet`** (new) — retail `PView` construction, chain-polygon + clipping, cone tests. Owned by the walk; no consumer sees clip planes + except through it. +- **`OrderedDrawStream`** (new) — the append-only frame command list: + (mesh ref, transform, material state, stage) tuples in walk order. +- **`OrderPreservingSubmitter`** (new, replaces the regrouping half of + `WbDrawDispatcher`) — walks the stream, merges adjacent same-state + commands into MDI calls, submits through the existing RHI. May never + reorder. The bindless/SSBO machinery beneath is reused as-is. +- **`WalkWorldSnapshot`** (new seam over existing streaming) — the atomic + view: a cell/landblock is either present-and-complete or absent. Leans + on the existing typed completion admission (Modern Runtime Slice E); the + walk consumes only committed-complete cells. **Invariant: no frame ever + walks a partially published cell.** This is the one place modern differs + from retail by design (async vs synchronous load) and it gets a + divergence-register row. +- **`RetailCameraController`** (extend existing camera) — re-land the + retail zoom envelope on top of the already-default-on chase/collide/ + slope-align behaviors; delete the dev-zoom deviation. + +### What gets deleted (the patch apparatus) + +`PortalVisibilityBuilder` as production visibility, the look-in seed +heuristics, exit-portal stencils, `ClipPlaneSet`'s gating role beyond chain +polygons, the +0.02 lift, the seal-panel depth stamps (quarantined, +never merged), the `InViewCells` side-channel (consumers — radar, lights, +particle culling — read the walk's visible-cell output instead: one gate, +computed once, enforced once). `RetailPViewRenderer`/`RetailPViewPassExecutor` +are absorbed: their already-correct stage knowledge moves into the walk; +the shells are retired at cutover. + +### Data flow (one frame) + +1. Streaming publishes committed-complete cells → `WalkWorldSnapshot`. +2. `RetailCameraController` produces the eye pose (retail rules). +3. `RetailFrameWalk` roots at the eye's cell (or outdoors), recurses/walks, + consults `PViewSet` per portal chain, gates objects per view, and + appends draws to `OrderedDrawStream` in retail stage order. +4. `OrderPreservingSubmitter` merges adjacent runs and submits via RHI. +5. The walk's visible-cell set feeds radar/lights/particles/audio. + +## 5. Conformance and gates + +- **The walk oracle (new tooling, built FIRST).** cdb attaches to the + paired 2013 retail client and captures the per-frame cell-draw sequence + (cell id order + stage boundaries) at canonical positions: the Sanctuary + terrace and its edge, the cathedral portal-in, a Holtburg doorway + (flap scene), a Holtburg street + house exit, one deep dungeon corridor. + Our `RetailFrameWalk`, fed the same world state and pose, must produce + the identical sequence. This gates the port BEFORE any pixel is judged. + (Toolchain and safety rules: CLAUDE.md "Retail debugger toolchain" + the + PV campaign's cdb lessons — no inline `-c` attach, every `j` branch ends + in `gc`.) +- **Pixel/behavior gates (owner-judged):** cathedral bleed gone at the + edge AND at normal camera (#456 acceptance); doorway flap gone; no + wall/floor/terrain seams in dungeons; clean portal-in, house exit, and + teleport timing. **The transition checklist (portal-in, house exit, + teleport stopwatch) is a standing self-run gate on every candidate build + before it reaches the owner** — the binding lesson of 2026-08-29/30. +- **Perf checkpoint EARLY (stage W3, before full commitment):** dense + Arwic uncapped with walk-order submission, measured in Release. Target: + within 20% of the current production profile. A larger regression stops + the campaign for an explicit owner decision — we measure, not hope. +- **Suites:** walk unit tests on synthetic worlds; captured-trace replay + tests checked into `docs/research/` fixtures; the standard hermetic + suites stay green at every stage; every ported function cites its named + retail symbol. + +## 6. Staged cutover (no long-lived dual path) + +Campaign V precedent: port behind the contract, then delete. Each stage +lands build+test green; visual stages get the standing transition +checklist self-run plus owner gates. + +- **W0** — Oracle tooling: the cdb walk-capture harness + recorded traces + at the canonical positions. Deliverable: replayable trace fixtures. +- **W1** — `RetailFrameWalk` + `PViewSet` as pure CPU modules, conformant + to the traces. No production rendering change yet. +- **W2** — `OrderedDrawStream` + `OrderPreservingSubmitter` against the + existing RHI; walk drives a diagnostic scene. +- **W3** — Static world cutover (terrain, EnvCells, buildings) to the + walk; the old gather path for statics is deleted in the same stage. + **The perf checkpoint lives here.** +- **W4** — Objects, entities, particles, dynamics move into walk turns; + delete the look-in machinery, stencils, stamps, lift, and the + `InViewCells` side-channel. +- **W5** — Camera port completion (retail zoom envelope; AD-116 retired). +- **W6** — Closeout: divergence-register reconciliation, docs, the full + gate matrix, roadmap/milestones update. + +## 7. Risks + +- **Perf** (walk-order submission loses cross-cell batching). Mitigation: + adjacency merging + bindless; the W3 checkpoint decides with numbers. +- **Streaming scope creep.** Guard: only the atomic-presence contract may + touch streaming; anything more is out of scope. +- **Oracle fidelity.** Retail traces need live retail sessions (owner + assists per the established cdb workflow); traces are captured once and + checked in as fixtures. +- **The quarantined PV branch.** Nothing merges from it. Salvageable + pieces (the degrade port, PV1's merged-hull deletion) are RE-LANDED + fresh on this campaign's stages if and when their stage needs them, + each with the transition checklist. The unidentified back-half culprit + stays quarantined until its machinery is deleted wholesale at W4. +- **Camera/dev workflow.** Retiring the 40 m zoom changes the owner's dev + ergonomics; the optional separate flycam tool is deliberately deferred + to keep this campaign's scope honest. + +## 8. Register impact + +Added: the streaming atomic-presence adaptation (W3); order-preserving +MDI merging as intentional architecture. Retired at their stages: the ++0.02 lift row, AD-116 (camera), AD-117 (stamps — dies with the +quarantine), and every look-in/stencil-era row the deletions obsolete. +Rule 1 of the register applies to every stage commit. diff --git a/src/AcDream.App/Composition/FrameRootComposition.cs b/src/AcDream.App/Composition/FrameRootComposition.cs index dc94659c..793ce392 100644 --- a/src/AcDream.App/Composition/FrameRootComposition.cs +++ b/src/AcDream.App/Composition/FrameRootComposition.cs @@ -512,7 +512,13 @@ internal sealed class FrameRootCompositionPhase new WorldScenePViewRenderer( new RetailPViewRenderer( currentRenderSceneOracle, - renderFrameProduct), + renderFrameProduct, + // Campaign FW3.2b-2: the walk's production world + // data, published/retired with each landblock by the + // render publisher (FW3.1). + live.LandblockPipeline.RenderPublisher?.WalkBuildings, + live.LandblockPipeline.RenderPublisher?.WalkLandscape, + d.CellVisibility), retailPViewPassExecutor, retailPViewPassExecutor), retailPViewCells, diff --git a/src/AcDream.App/Rendering/CellVisibility.cs b/src/AcDream.App/Rendering/CellVisibility.cs index 31b9ebca..26034263 100644 --- a/src/AcDream.App/Rendering/CellVisibility.cs +++ b/src/AcDream.App/Rendering/CellVisibility.cs @@ -12,6 +12,7 @@ using System.Collections.Generic; using System.Numerics; +using AcDream.App.Rendering.Walk; namespace AcDream.App.Rendering; @@ -114,6 +115,21 @@ public sealed class LoadedCell /// test fixtures use low ids for interior cells, so keying on the id would misfire. /// public bool IsOutdoorNode; + + /// + /// Campaign FW3.1: the retail frame walk's model of this cell (portal + /// side/exact-match decode, portal polygons + planes, stab list, + /// UNLIFTED transform), built atomically alongside this + /// by + /// EnvCellLandblockBuildBuilder.BuildVisibilityCell — see + /// WalkCellFactory.FromParsed. Null only for hand-built test + /// fixtures that construct a directly instead of + /// through the streaming build. WalkProductionFrameContext.GetVisible + /// is the walk's sole read of this field — the committed registry + /// () is the walk's only cell + /// source; its dead BFS role is unrelated. + /// + public WalkCell? Walk { get; internal set; } } /// diff --git a/src/AcDream.App/Rendering/ClipFrameAssembler.cs b/src/AcDream.App/Rendering/ClipFrameAssembler.cs index c7b50def..4b12fda6 100644 --- a/src/AcDream.App/Rendering/ClipFrameAssembler.cs +++ b/src/AcDream.App/Rendering/ClipFrameAssembler.cs @@ -144,6 +144,18 @@ public sealed class ClipFrameAssembly internal void SetOutsideViewSlices(ClipViewSlice[] slices) => OutsideViewSlices = slices; + /// FW4 slice 1: returns the outside-view slice array to the + /// pool ahead of a same-frame reassembly from the walk's own views + /// () — + /// without this the replaced array would leak from the slice pool for + /// the frame. + internal void ReturnOutsideViewSlicesForReassembly() + { + if (OutsideViewSlices.Length != 0) + ReturnSlices(OutsideViewSlices); + OutsideViewSlices = System.Array.Empty(); + } + private ClipViewSlice[] RentSlices(int length) { if (_sliceArraysByLength.TryGetValue(length, out Stack? pool) @@ -380,6 +392,143 @@ public static class ClipFrameAssembler return assembly; } + /// + /// Campaign FW4 slice 1 — the interior root's outside-view cutover. + /// Replaces the assembly's outside-view block (slices, terrain mode, + /// scissor/NDC bounds, plane count) with slices derived from THE WALK'S + /// OWN outside_view (), + /// filled by the walk's ConstructView during Collect. Retail has + /// exactly ONE visibility structure per frame: LScape::draw's + /// terrain clip, the punch fans' building_view planes, and the + /// landscape turn's view count all read the views the walk itself + /// installed. Feeding these from the old PortalVisibilityBuilder + /// assembly let the two systems desynchronize on camera-transition + /// boundary frames — terrain splashed through stale/fat old-apparatus + /// exit views over interior pixels the walk's flood never repainted + /// (the FW3 visual-gate stairwell/grass flash, probe-pinned + /// 2026-08-30), and punch fans indexed the old slice array with walk + /// view indices. + /// + /// The walk stores view vertices as PIXEL screen points + /// (copy_view's post-divide viewport coordinates, origin + /// top-left, +Y down — : + /// x=(W/2)(x_c+w), y=(H/2)(w−y_c)); inverting that mapping yields the + /// standard NDC this assembler's s already use + /// (ndcX = 2x/W − 1, ndcY = 1 − 2y/H). Winding is normalized inside + /// , and the closing + /// duplicate vertex copy_view stores is merged there too. + /// + /// Must run AFTER the walk's Collect and BEFORE + /// PrepareClipFrame publishes the clip regions — appended slots + /// join the same single publication. + /// + public static void ReassembleOutsideViewFromWalk( + ClipFrameAssembly assembly, + Walk.WalkPortalView outsideView, + float viewportWidth, + float viewportHeight) + { + System.ArgumentNullException.ThrowIfNull(assembly); + System.ArgumentNullException.ThrowIfNull(outsideView); + if (viewportWidth <= 0f || viewportHeight <= 0f) + { + throw new System.ArgumentOutOfRangeException( + nameof(viewportWidth), + $"viewport {viewportWidth}x{viewportHeight} — the walk projected its " + + "views through a real viewport; a non-positive extent here means the " + + "caller handed a different frame's context (fail-loud rule)."); + } + + ClipFrame frame = assembly.Frame; + int viewCount = outsideView.ViewCount; + var polys = outsideView.View.Polys; + var pool = outsideView.View.Vertices; + if (polys.Count < viewCount) + { + throw new System.InvalidOperationException( + $"walk outside_view holds {polys.Count} polys for ViewCount={viewCount} — " + + "the view set's append bookkeeping desynchronized (fail-loud rule)."); + } + + assembly.ReturnOutsideViewSlicesForReassembly(); + + List outsideSlicesList = assembly.SliceScratch; + outsideSlicesList.Clear(); + int outsideMaxPlaneCount = 0; + bool outsideHasScissorFallback = false; + int scissorFallbacks = assembly.ScissorFallbacks; + float unionMinX = float.MaxValue, unionMinY = float.MaxValue; + float unionMaxX = float.MinValue, unionMaxY = float.MinValue; + + for (int v = 0; v < viewCount; v++) + { + Walk.WalkViewPoly walkPoly = polys[v]; + var vertices = new Vector2[walkPoly.VertexCount]; + for (int k = 0; k < walkPoly.VertexCount; k++) + { + Vector2 px = pool[walkPoly.VertexIndex + k].Point; + vertices[k] = new Vector2( + px.X / viewportWidth * 2f - 1f, + 1f - px.Y / viewportHeight * 2f); + } + var poly = new ViewPolygon(vertices); + if (!poly.IsEmpty) + { + if (poly.MinX < unionMinX) unionMinX = poly.MinX; + if (poly.MinY < unionMinY) unionMinY = poly.MinY; + if (poly.MaxX > unionMaxX) unionMaxX = poly.MaxX; + if (poly.MaxY > unionMaxY) unionMaxY = poly.MaxY; + } + + var cps = ClipPlaneSet.From(poly); + if (cps.IsNothingVisible) + continue; + + int slot; + Vector4[] planes; + if (cps.Count > 0) + { + planes = cps.PlaneArray; + slot = frame.AppendSlot(planes); + if (cps.Count > outsideMaxPlaneCount) + outsideMaxPlaneCount = cps.Count; + } + else + { + planes = System.Array.Empty(); + slot = 0; + outsideHasScissorFallback = true; + scissorFallbacks++; + } + + outsideSlicesList.Add(new ClipViewSlice(slot, AabbOf(poly), planes)); + } + + ClipViewSlice[] outsideViewSlices = assembly.CopySlices(outsideSlicesList); + bool outdoorVisible = outsideViewSlices.Length > 0; + int outdoorSlot = outdoorVisible ? outsideViewSlices[0].Slot : 0; + TerrainClipMode terrainMode = !outdoorVisible + ? TerrainClipMode.Skip + : (outsideHasScissorFallback ? TerrainClipMode.Scissor : TerrainClipMode.Planes); + + Vector4 outsideViewNdcAabb = outdoorVisible + ? new Vector4(unionMinX, unionMinY, unionMaxX, unionMaxY) + : Vector4.Zero; + Vector4 terrainScissor = terrainMode == TerrainClipMode.Scissor + ? outsideViewNdcAabb + : Vector4.Zero; + + assembly.SetOutsideViewSlices(outsideViewSlices); + assembly.OutdoorSlot = outdoorSlot; + assembly.OutdoorVisible = outdoorVisible; + assembly.TerrainMode = terrainMode; + assembly.TerrainScissorNdcAabb = terrainScissor; + assembly.HasOutsideView = outdoorVisible; + assembly.OutsideViewNdcAabb = outsideViewNdcAabb; + assembly.OutsidePlaneCount = terrainMode == TerrainClipMode.Planes ? outsideMaxPlaneCount : 0; + assembly.ScissorFallbacks = scissorFallbacks; + } + /// /// Appends the cell views used by nested DrawBuilding -> DrawPortal /// PViews to the already assembled frame. Retail installs each nested diff --git a/src/AcDream.App/Rendering/DirectionalSunShadowRenderer.cs b/src/AcDream.App/Rendering/DirectionalSunShadowRenderer.cs index 75e9518c..b43d745f 100644 --- a/src/AcDream.App/Rendering/DirectionalSunShadowRenderer.cs +++ b/src/AcDream.App/Rendering/DirectionalSunShadowRenderer.cs @@ -1073,6 +1073,12 @@ internal sealed class DirectionalSunShadowRenderer : IDirectionalShadowReceiverS }); } + /// + /// The caster's own depth-only pipeline. Depth compare is + /// — see that type for the + /// world-space GL_LESS citation this shares with every other world + /// pipeline. + /// private static IGpuPipeline CreatePipeline( IGpuDevice device, string name, @@ -1087,7 +1093,7 @@ internal sealed class DirectionalSunShadowRenderer : IDirectionalShadowReceiverS VertexLayout = layout, Topology = GpuPrimitiveTopology.TriangleList, Blend = GpuBlendMode.None, - Depth = new GpuDepthState(true, true, GpuCompareOp.Less), + Depth = new GpuDepthState(true, true, WorldDepthContract.WorldCompare), Cull = GpuCullMode.Back, FrontFace = frontFace, AlphaToCoverage = false, diff --git a/src/AcDream.App/Rendering/ParticleRenderer.Rhi.cs b/src/AcDream.App/Rendering/ParticleRenderer.Rhi.cs index cd68e206..f4870ff9 100644 --- a/src/AcDream.App/Rendering/ParticleRenderer.Rhi.cs +++ b/src/AcDream.App/Rendering/ParticleRenderer.Rhi.cs @@ -232,12 +232,14 @@ public sealed unsafe partial class ParticleRenderer /// which is the GL arm's bracket verbatim /// (Enable(DepthTest)/DepthMask(false)/Disable(CullFace)). /// - /// Depth compare is Less, not the contract's LessOrEqual - /// default: the world frame runs under GL_LESS and this renderer never - /// called glDepthFunc, so it inherited it. Alpha-to-coverage is off - /// for the same kind of reason and the opposite way round — the frame-global - /// state controller disables it and only WbDrawDispatcher's opaque - /// bracket turns it on, so particles have never drawn with it. + /// Depth compare is + /// (Less), not the contract's LessOrEqual default — see that + /// type for the full citation. The world frame runs under GL_LESS + /// and this renderer never called glDepthFunc, so it inherited it. + /// Alpha-to-coverage is off for the same kind of reason and the opposite + /// way round — the frame-global state controller disables it and only + /// WbDrawDispatcher's opaque bracket turns it on, so particles have + /// never drawn with it. /// private static IGpuPipeline CreateBillboardPipeline( IGpuDevice device, @@ -251,7 +253,7 @@ public sealed unsafe partial class ParticleRenderer VertexLayout = BillboardVertexLayout, Topology = GpuPrimitiveTopology.TriangleList, Blend = blend, - Depth = new GpuDepthState(Test: true, Write: false, GpuCompareOp.Less), + Depth = new GpuDepthState(Test: true, Write: false, WorldDepthContract.WorldCompare), Cull = GpuCullMode.None, FrontFace = GpuFrontFace.CounterClockwise, AlphaToCoverage = false, @@ -260,10 +262,12 @@ public sealed unsafe partial class ParticleRenderer }); /// - /// One mesh-particle pipeline. Same depth bracket as the billboards; the - /// winding is CW because PrepareMeshPipeline sets - /// glFrontFace(GL_CW), and the cull mode stays DYNAMIC because it is - /// resolved per sub-batch from the DAT's own CullMode. + /// One mesh-particle pipeline. Same depth bracket as the billboards (see + /// for the world + /// GL_LESS citation); the winding is CW because + /// PrepareMeshPipeline sets glFrontFace(GL_CW), and the cull + /// mode stays DYNAMIC because it is resolved per sub-batch from the DAT's + /// own CullMode. /// private static IGpuPipeline CreateMeshParticlePipeline( IGpuDevice device, @@ -277,7 +281,7 @@ public sealed unsafe partial class ParticleRenderer VertexLayout = MeshVertexLayout, Topology = GpuPrimitiveTopology.TriangleList, Blend = blend, - Depth = new GpuDepthState(Test: true, Write: false, GpuCompareOp.Less), + Depth = new GpuDepthState(Test: true, Write: false, WorldDepthContract.WorldCompare), Cull = GpuCullMode.None, FrontFace = GpuFrontFace.Clockwise, AlphaToCoverage = false, diff --git a/src/AcDream.App/Rendering/ParticleRenderer.cs b/src/AcDream.App/Rendering/ParticleRenderer.cs index 9766089b..75f60578 100644 --- a/src/AcDream.App/Rendering/ParticleRenderer.cs +++ b/src/AcDream.App/Rendering/ParticleRenderer.cs @@ -266,7 +266,15 @@ public sealed unsafe partial class ParticleRenderer : IDisposable if (_submissionScratch.Count == 0) return; - if (renderPass == ParticleRenderPass.Scene && _alphaQueue?.IsCollecting == true) + bool defers = renderPass == ParticleRenderPass.Scene && _alphaQueue?.IsCollecting == true; + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + { + Console.WriteLine( + $"[walk-part] finish pass={renderPass} n={_submissionScratch.Count} " + + $"branch={(defers ? "defer" : "immediate")} " + + $"phase={AcDream.Core.Rendering.RenderingDiagnostics.WalkRootPhase}"); + } + if (defers) DeferToRetailAlphaQueue(camera); else DrawOrdered(camera); diff --git a/src/AcDream.App/Rendering/PortalVisibilityBuilder.cs b/src/AcDream.App/Rendering/PortalVisibilityBuilder.cs index c0ef5f89..24d9fe37 100644 --- a/src/AcDream.App/Rendering/PortalVisibilityBuilder.cs +++ b/src/AcDream.App/Rendering/PortalVisibilityBuilder.cs @@ -342,31 +342,26 @@ public static class PortalVisibilityBuilder Console.WriteLine($"[pv-ERROR] chain tail(24):{tail}"); } - /// The +Z world lift applied to DRAWN cell shells (z-fighting vs - /// terrain; applied in GameWindow's cell registration). The visibility - /// graph stays in PHYSICS (unlifted) space — feeding the lift into portal - /// planes broke horizontal-portal side tests (#119-residual, f35cb8b). - /// Draw-space consumers of portal polygons (the OutsideView color gate - /// here, the seal/punch depth fans in GameWindow) must apply this lift so - /// they meet the drawn shell's aperture edge — the unlifted gate left a - /// 2 cm background strip under the drawn lintel (#130). - public const float ShellDrawLiftZ = 0.02f; + // Campaign FW3.3 (2026-08-30): ShellDrawLiftZ (the 0.02 m drawn-shell + // lift, register row AP-32) is RETIRED. Retail draws cell geometry at + // the dat EnvCell origin verbatim; the coplanar tie-breaks the lift + // stood in for are now owned by the walk's retail draw ORDER under + // WorldDepthContract's Less (first-drawn-wins — RenderDeviceD3D:: + // DrawBlock terrain-then-objects per cell, PView::DrawCells shells-then- + // contents). With the lift gone, the visibility gate and the drawn + // geometry share ONE space, so the #130 strip mechanism (gate space ≠ + // drawn space) no longer exists. /// Resolve a full cell id to its LoadedCell, or null if not loaded. /// Optional: true if a cell id is in the camera building's cell /// set. When provided, a neighbour OUTSIDE the set routes to CrossBuildingViews instead of /// continuing the in-building BFS. Pass null to treat all reachable cells as in-building. - /// World +Z applied ONLY to the exit-portal projection feeding - /// (a draw-space region; see - /// ). Flood admission, side tests, and CellViews are unaffected. - /// Production passes ; tests replaying visibility semantics pass 0. public static PortalVisibilityFrame Build( LoadedCell cameraCell, Vector3 cameraPos, Func lookup, Matrix4x4 viewProj, Func? buildingMembership = null, - float drawLiftZ = 0f, PortalVisibilityFrame? reuseFrame = null) { var frame = reuseFrame ?? new PortalVisibilityFrame(); @@ -544,38 +539,13 @@ public static class PortalVisibilityBuilder if (portal.OtherCellId == 0xFFFF) { - // Exit portal -> outdoors visible through this (clipped) opening. - // OutsideView gates DRAWN color (terrain/sky/scissor), and the - // shell that rasterizes this aperture draws +drawLiftZ above - // the physics transform — project the region in the SAME - // lifted space or terrain stops a lift-height short of the - // drawn lintel (#130 strip). Flood semantics keep the - // unlifted clippedRegion path above. - int outsideCount; - if (drawLiftZ == 0f) - { - AddRegion(frame.OutsideView, clippedRegion); - outsideCount = clippedRegion.Count; - } - else - { - using PortalVisibilityFrame.ClipRegionScratchLease outsideRegionLease = - frame.RentClipRegionScratch(); - List outsideRegion = outsideRegionLease.Region; - ClipPortalAgainstView( - frame, - poly, - cell.WorldTransform * Matrix4x4.CreateTranslation(0f, 0f, drawLiftZ), - viewProj, - currentView.Polygons, - processedCount, - endCount - processedCount, - outsideRegion, - out _); - AddRegion(frame.OutsideView, outsideRegion); - outsideCount = outsideRegion.Count; - } - trace?.Add($"portal cell=0x{cell.CellId:X8} p{i}->EXIT addOutside={outsideCount} clipVerts={clipVerts}"); + // Exit portal -> outdoors visible through this (clipped) + // opening. FW3.3: shells draw at the dat origin (the + // ShellDrawLiftZ retirement), so the gate and the drawn + // aperture share one space — the unlifted clippedRegion + // IS the draw-space region. + AddRegion(frame.OutsideView, clippedRegion); + trace?.Add($"portal cell=0x{cell.CellId:X8} p{i}->EXIT addOutside={clippedRegion.Count} clipVerts={clipVerts}"); continue; } diff --git a/src/AcDream.App/Rendering/RetailAlphaQueue.cs b/src/AcDream.App/Rendering/RetailAlphaQueue.cs index 3f828f0a..cdcc97f2 100644 --- a/src/AcDream.App/Rendering/RetailAlphaQueue.cs +++ b/src/AcDream.App/Rendering/RetailAlphaQueue.cs @@ -146,6 +146,12 @@ internal sealed class RetailAlphaQueue : IWorldSceneAlphaFrame { if (!IsCollecting) throw new InvalidOperationException("Retail alpha flush requires an active frame."); + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled && _submissions.Count > 0) + { + Console.WriteLine( + $"[walk-alpha] flush n={_submissions.Count} " + + $"phase={AcDream.Core.Rendering.RenderingDiagnostics.WalkRootPhase}"); + } Exception? drawFailure = null; List? resetFailures = null; diff --git a/src/AcDream.App/Rendering/RetailChaseCamera.cs b/src/AcDream.App/Rendering/RetailChaseCamera.cs index 5362b457..b227fc60 100644 --- a/src/AcDream.App/Rendering/RetailChaseCamera.cs +++ b/src/AcDream.App/Rendering/RetailChaseCamera.cs @@ -252,12 +252,23 @@ public sealed class RetailChaseCamera : ICamera var swept = CollisionProbe.SweepEye(pivotWorld, _soughtEye, cellId, selfEntityId, playerPosition); publishedEye = swept.Eye; ViewerCellId = swept.ViewerCellId; - // Total-failure fallback = retail set_viewer(player_pos, reset_sought=1) - // (update_viewer :92886 and the cell==0 bail :92775 — both surface here as - // ViewerCellId == 0): the sought resets to the returned position and - // re-extends from there. + // Total-failure fallback = retail set_viewer(&player->m_position, + // reset_sought=1) (update_viewer @0x00453fad and the cell==0 bail + // @0x00453d1d — both surface here as ViewerCellId == 0): the + // sought resets to the returned position and re-extends, AND the + // viewer INHERITS THE PLAYER'S POSITION CELL — set_viewer copies + // the whole Position, objcell_id included, so retail ROOTS ON THE + // PLAYER'S (interior) CELL for these frames. Leaving 0 here made + // the walk read the frame as OUTDOOR-rooted while the eye was + // inside a doorway graze: full-screen terrain with the look-in + // gates correctly refusing from the interior side — the FW3 + // visual gate's "grass briefly covers the stairwell at the + // crossing" report (the historic #119 family's transition arm). if (swept.ViewerCellId == 0) + { _soughtEye = swept.Eye; + ViewerCellId = cellId; + } } // Retail viewer — the base of next frame's interpolation (step 5). _publishedEye = publishedEye; diff --git a/src/AcDream.App/Rendering/RetailPViewPassExecutor.WalkLeaf.cs b/src/AcDream.App/Rendering/RetailPViewPassExecutor.WalkLeaf.cs new file mode 100644 index 00000000..6efd1f1c --- /dev/null +++ b/src/AcDream.App/Rendering/RetailPViewPassExecutor.WalkLeaf.cs @@ -0,0 +1,252 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; +using AcDream.Core.Vfx; + +namespace AcDream.App.Rendering; + +/// Campaign FW3.2b-2 (step 1): the walk driver's leaf draws over +/// this executor's renderers. Same leaf mechanics as the packed slice +/// methods — the cutover changes ORDER only. +internal sealed partial class RetailPViewPassExecutor +{ + /// The walk's single sky turn: retail draws GameSky once + /// inside LScape::draw, clipped by the active views; looping + /// today's per-slice scissor + terrain-clip block reproduces today's + /// pixels while the driver sees ONE turn. + internal void DrawWalkSky( + RetailPViewFrameInput frame, ClipFrameAssembly clipAssembly) + { + if (!frame.RenderSky) + return; + + // FW4 slice 6: an INTERIOR root draws the sky ONCE, unclipped — + // the same LScape::draw rule as the terrain turn below (view-culled + // landscape content is never view-clipped; the clear + seals + + // interior repaint own aperture exactness). The former per-slice + // scissor left stale sky color wherever the authored exit-portal + // bands were narrower than the real opening. + if (!frame.RootCell.IsOutdoorNode) + { + _sky?.RenderSky( + frame.Camera, + frame.CameraWorldPosition, + frame.DayFraction, + frame.ActiveDayGroup, + frame.SkyKeyframe, + frame.EnvironOverrideActive); + if (_particles is not null && _particleRenderer is not null) + { + _particleRenderer.Draw( + frame.Camera, + frame.CameraWorldPosition, + ParticleRenderPass.SkyPreScene); + } + return; + } + + ReadOnlySpan slices = clipAssembly.OutsideViewSlices; + for (int sliceIndex = 0; sliceIndex < slices.Length; sliceIndex++) + { + ClipViewSlice slice = slices[sliceIndex]; + bool scissor = BeginDoorwayScissor(slice.NdcAabb); + _surface.BindTerrainClip(); + EnableClipDistances(); + _sky?.RenderSky( + frame.Camera, + frame.CameraWorldPosition, + frame.DayFraction, + frame.ActiveDayGroup, + frame.SkyKeyframe, + frame.EnvironOverrideActive); + DisableClipDistances(); + if (_particles is not null && _particleRenderer is not null) + { + _particleRenderer.Draw( + frame.Camera, + frame.CameraWorldPosition, + ParticleRenderPass.SkyPreScene); + } + if (scissor) + _surface.EndScissor(); + } + } + + /// The walk's per-slice terrain turn — the terrain block of + /// DrawLandscapeSlice (scissor + terrain clip + slice planes + + /// NDC AABB), without the sky/entity halves the walk owns separately. + internal void DrawWalkTerrainSlice( + RetailPViewFrameInput frame, ClipFrameAssembly clipAssembly, int sliceIndex) + { + ReadOnlySpan slices = clipAssembly.OutsideViewSlices; + if ((uint)sliceIndex >= (uint)slices.Length) + { + throw new ArgumentOutOfRangeException( + nameof(sliceIndex), sliceIndex, + $"walk terrain turn: slice {sliceIndex} of {slices.Length}"); + } + + // FW4 slice 6: an INTERIOR root draws the terrain UNCLIPPED — + // retail's LScape::draw draws whole blocks (view-culled, never + // view-clipped; "retail never clips ordinary meshes per view"), + // and aperture exactness comes from the depth clear + exit seals + + // interior repaint that follow in the walk's own order. The former + // per-slice scissor+clip under-painted terrain COLOR AND DEPTH + // wherever the authored exit-portal polygons are narrower than the + // real opening (the #456 cathedral seam bands) — leaving stale + // color and empty depth that unclipped alpha (the falls) then + // painted straight across. The outdoor root keeps its single + // full-screen slice (equivalent to unclipped by construction). + if (!frame.RootCell.IsOutdoorNode) + { + _terrainDiagnostics.Begin(); + _terrain?.Draw( + frame.Camera, + frame.Frustum, + neverCullLandblockId: frame.PlayerLandblockId, + clipPlanes: default, + ndcClipAabb: new Vector4(-1f, -1f, 1f, 1f)); + _terrainDiagnostics.Complete(); + return; + } + + ClipViewSlice slice = slices[sliceIndex]; + bool scissor = BeginDoorwayScissor(slice.NdcAabb); + _surface.BindTerrainClip(); + EnableClipDistances(); + _terrainDiagnostics.Begin(); + _terrain?.Draw( + frame.Camera, + frame.Frustum, + neverCullLandblockId: frame.PlayerLandblockId, + clipPlanes: slice.Planes, + ndcClipAabb: slice.NdcAabb); + _terrainDiagnostics.Complete(); + DisableClipDistances(); + if (scissor) + _surface.EndScissor(); + } + + /// The walk's punch-fan turn — DrawPortalPolyInternal + /// @0x0059bc90's far-Z punch through PortalDepthMaskRenderer, + /// clipped by the pinned view's slice planes (retail + /// building_view @0x0059f3bf). FW3.3: fans draw at the dat + /// aperture verbatim (the ShellDrawLiftZ retirement). + internal void DrawWalkPunchFan( + RetailPViewFrameInput frame, + ClipFrameAssembly clipAssembly, + WalkPolygon worldPolygon, + int activeViewIndex) + { + if (_portalDepthMask is null) + return; + Vector3[] vertices = worldPolygon.Vertices; + if (vertices.Length < 3) + return; + ReadOnlySpan slices = clipAssembly.OutsideViewSlices; + ReadOnlySpan planes = (uint)activeViewIndex < (uint)slices.Length + ? slices[activeViewIndex].Planes + : default; + + Span world = stackalloc Vector3[32]; + int count = Math.Min(vertices.Length, world.Length); + for (int vertex = 0; vertex < count; vertex++) + world[vertex] = vertices[vertex]; + _portalDepthMask.DrawDepthFan( + world[..count], + frame.ViewProjection, + planes, + forceFarZ: true); + } +} + +/// +/// Campaign FW stage FW3.2b-2 (step 1, additive): the production +/// over this executor's leaf renderers. +/// Constructed per frame by the FW3.2b-2 rooting (plan §FW3 "FW3.2b-2 — +/// the production rooting"); nothing invokes it until the static cutover +/// flips. Each member maps a turn onto the +/// SAME leaf calls the packed path uses today, so the cutover changes +/// ORDER, never the leaf mechanics: +/// +/// +/// → the sky block of DrawLandscapeSlice, +/// looped over the active slices internally (retail draws GameSky once +/// inside LScape::draw clipped by the active views; the per-slice +/// scissor+clip here reproduces today's pixels while the driver still sees +/// ONE sky turn). +/// → the terrain block of +/// DrawLandscapeSlice (scissor + terrain clip + slice planes). +/// → EnvCellRenderer opaque + +/// transparent-ordered for ONE cell (retail DrawEnvCell +/// @0x0059f170 draws per cell at its flood turn). +/// → PortalDepthMaskRenderer.DrawDepthFan +/// with forceFarZ, clipped by the pinned view's slice planes +/// (retail building_view @0x0059f3bf); FW3.3 draws fans at the dat +/// aperture verbatim (the ShellDrawLiftZ retirement). +/// / → +/// caller-supplied actions (the renderer owns the pass scope and the +/// root-flood seal iteration; the adapter only provides the turns). +/// → FlushLandscapeAlphaFartherThan +/// (the DrawBuilding barrier; retail's flush-all +/// FlushAlphaList(0f) @0x0059f30b is the FW4 adjudication +/// candidate recorded on the driver's interface). +/// +/// +internal sealed class WalkProductionLeafRenderer : IWalkFrameLeafRenderer +{ + private readonly RetailPViewPassExecutor _passes; + private readonly RetailPViewFrameInput _frame; + private readonly ClipFrameAssembly _clipAssembly; + private readonly Action _clearInteriorDepth; + private readonly Action _drawExitSeals; + private readonly HashSet _singleCellScratch = new(); + private readonly List _singleCellListScratch = new(); + + internal WalkProductionLeafRenderer( + RetailPViewPassExecutor passes, + RetailPViewFrameInput frame, + ClipFrameAssembly clipAssembly, + Action clearInteriorDepth, + Action drawExitSeals) + { + _passes = passes ?? throw new ArgumentNullException(nameof(passes)); + _frame = frame ?? throw new ArgumentNullException(nameof(frame)); + _clipAssembly = clipAssembly; + _clearInteriorDepth = clearInteriorDepth + ?? throw new ArgumentNullException(nameof(clearInteriorDepth)); + _drawExitSeals = drawExitSeals + ?? throw new ArgumentNullException(nameof(drawExitSeals)); + } + + public void DrawSky() => _passes.DrawWalkSky(_frame, _clipAssembly); + + public void DrawTerrainSlice(int sliceIndex) => + _passes.DrawWalkTerrainSlice(_frame, _clipAssembly, sliceIndex); + + public void DrawCellShell(uint cellId) + { + _singleCellScratch.Clear(); + _singleCellScratch.Add(cellId); + _passes.DrawOpaqueCellShells(_singleCellScratch); + if (_passes.CellHasTransparentShell(cellId)) + { + _singleCellListScratch.Clear(); + _singleCellListScratch.Add(cellId); + _passes.DrawTransparentCellShellsOrdered(_singleCellListScratch); + } + } + + public void ClearInteriorDepth() => _clearInteriorDepth(); + + public void DrawStaticParticles(IReadOnlySet ownerIds) => + _passes.DrawLandscapeStaticParticles( + _frame, new RetailPViewLandscapeStaticParticleContext(ownerIds)); + + public void DrawExitSeals() => _drawExitSeals(); + + public void DrawPunchFan(WalkPolygon worldPolygon, int activeViewIndex) => + _passes.DrawWalkPunchFan(_frame, _clipAssembly, worldPolygon, activeViewIndex); + + public void AlphaBarrier(float viewerDistance) => + _passes.FlushLandscapeAlphaFartherThan(viewerDistance); +} diff --git a/src/AcDream.App/Rendering/RetailPViewPassExecutor.cs b/src/AcDream.App/Rendering/RetailPViewPassExecutor.cs index 037c9f17..0f3df8ca 100644 --- a/src/AcDream.App/Rendering/RetailPViewPassExecutor.cs +++ b/src/AcDream.App/Rendering/RetailPViewPassExecutor.cs @@ -1,4 +1,5 @@ using System.Numerics; +using AcDream.App.Rendering.Gpu; using AcDream.App.Rendering.Scene; using AcDream.App.Rendering.Sky; using AcDream.App.Rendering.Wb; @@ -114,7 +115,7 @@ internal interface IRenderFrameEntityPassExecutor /// is written once; the four places it touches graphics state directly are owned /// by . /// -internal sealed class RetailPViewPassExecutor : +internal sealed partial class RetailPViewPassExecutor : IRetailPViewPassExecutor, IRenderFrameEntityPassExecutor, IOutdoorSceneParticleOwnerSource @@ -179,8 +180,29 @@ internal sealed class RetailPViewPassExecutor : public void BeginFrame() { _particleClassifications.BeginFrame(); + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + AcDream.Core.Rendering.RenderingDiagnostics.WalkRootPhase = "pre"; } + /// Campaign FW3.2b-2: the shared dispatcher, for + /// 's WalkFrameDriver + /// construction — the driver's ctor takes a + /// directly (it calls SubmitOrderedStream itself; see that + /// class's own doc comment). + internal WbDrawDispatcher Dispatcher => _entities; + + /// Campaign FW3.2b-2: forwards to + /// — the frame/ + /// encoder pair the walk driver submits its stream flushes into. + internal (IGpuFrame Frame, IGpuPassEncoder Encoder) RequireWalkSubmission() => + _entities.RequireWalkSubmission(); + + /// Campaign FW3.2b-2: forwards to + /// — the real + /// viewport size for WalkProductionFrameContext. + internal (int Width, int Height)? WalkAttachmentExtent => + _entities.WalkAttachmentExtent; + public void BeginEntityFrame(in RenderFrameView view) => _entities.BeginPackedProductionFrame(in view); @@ -448,7 +470,16 @@ internal sealed class RetailPViewPassExecutor : // DrawLandscapeStaticParticles after the slice loop (retail: one // unclipped alpha-list insertion per emitter), not per slice here. EnableClipDistances(); - if (frame.RenderSky && frame.RenderWeather) + // Retail GameSky::Draw @0x00506ff0 gates the WEATHER pass (arg2==1) + // on SmartBox::is_player_outside @0x00451e80 — Ghidra-arbitrated: + // (player objcell_id & 0xFFFF) < 0x100. The sky pass always draws; + // the rain draws ONLY while the PLAYER stands in an outdoor cell. + // That one boolean is retail's entire rain confinement (the + // owner-reported indoor/seam rain at the cathedral: rain on the + // ledges, none the instant the player crosses into an interior + // cell) — no depth or view-clip mechanism is involved. + bool playerOutside = (frame.PlayerCellId & 0xFFFFu) < 0x100u; + if (frame.RenderSky && frame.RenderWeather && playerOutside) { _sky?.RenderWeather( frame.Camera, @@ -490,6 +521,7 @@ internal sealed class RetailPViewPassExecutor : DisableClipDistances(); _particleClassifications.ReplaceOutdoor(context.ParticleOwnerIds); + ProbeWalkParticleRoute("static-owners", _particleClassifications.Outdoor); if (_particleClassifications.Outdoor.Count > 0 && _particles is not null && _particleRenderer is not null) @@ -549,7 +581,12 @@ internal sealed class RetailPViewPassExecutor : DisableClipDistances(); } - public void ClearInteriorDepth() => _surface.ClearInteriorDepth(); + public void ClearInteriorDepth() + { + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + AcDream.Core.Rendering.RenderingDiagnostics.WalkRootPhase = "post"; + _surface.ClearInteriorDepth(); + } public void DrawExitPortalMask( RetailPViewFrameInput frame, @@ -578,6 +615,8 @@ internal sealed class RetailPViewPassExecutor : // hardware clip slot made effects vanish by view direction (zero // outside slices in view = zero submissions) — invented behavior. DisableClipDistances(); + ProbeWalkParticleRoute( + outdoorCells ? "unattached-outdoor" : "unattached-interior", null); _particleRenderer.DrawForOwners( frame.Camera, frame.CameraWorldPosition, @@ -590,6 +629,53 @@ internal sealed class RetailPViewPassExecutor : : UnattachedEmitterCellScope.InteriorCells); } + /// ACDREAM_PROBE_WALK_ROOT companion (throwaway, dies with the + /// cathedral falls investigation): logs each particle submission route + /// with its owner count + the pre/post-depth-clear phase tag. + private static void ProbeWalkParticleRoute(string route, IReadOnlySet? owners) + { + if (!AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + return; + string ids = ""; + if (owners is not null) + { + var sb = new System.Text.StringBuilder(); + int shown = 0; + foreach (uint id in owners) + { + if (shown++ == 6) { sb.Append(",…"); break; } + if (sb.Length > 0) sb.Append(','); + sb.Append(id.ToString("x")); + } + ids = $" n={owners.Count} ids=[{sb}]"; + + // Phase I cathedral instrumentation: the REAL falls owners + // (outdoor landblock statics 0xCF418000-13 per the DAT-geometry + // report) — print EVERY submission that carries one, with the + // exact watched ids, unconditionally (never rate-limited; these + // are the money lines the six fix rounds never had). + System.Text.StringBuilder? falls = null; + foreach (uint id in owners) + { + if (id >= 0xCF418000u && id <= 0xCF418014u) + { + falls ??= new System.Text.StringBuilder(); + if (falls.Length > 0) falls.Append(','); + falls.Append(id.ToString("x")); + } + } + if (falls is not null) + { + Console.WriteLine( + $"[falls] route={route} phase=" + + $"{AcDream.Core.Rendering.RenderingDiagnostics.WalkRootPhase} " + + $"ids=[{falls}]"); + } + } + Console.WriteLine( + $"[walk-part] {route}{ids} phase={AcDream.Core.Rendering.RenderingDiagnostics.WalkRootPhase}"); + } + public void FlushLandscapeAlpha() => _alpha.Flush(); public void FlushLandscapeAlphaFartherThan(float minViewerDistance) => @@ -613,6 +699,7 @@ internal sealed class RetailPViewPassExecutor : return; DisableClipDistances(); + ProbeWalkParticleRoute("cell-owners", visible); // Retail never clips cell particles to a portal view: the owner // cell's walls own occlusion via the depth test at the alpha flush. _particleRenderer.DrawForOwners( @@ -638,6 +725,7 @@ internal sealed class RetailPViewPassExecutor : return; DisableClipDistances(); + ProbeWalkParticleRoute("dyn-owners", dynamics); _particleRenderer.DrawForOwners( frame.Camera, frame.CameraWorldPosition, @@ -691,10 +779,11 @@ internal sealed class RetailPViewPassExecutor : int count = Math.Min(localVertices.Length, world.Length); for (int vertex = 0; vertex < count; vertex++) { + // FW3.3: fans draw at the dat aperture verbatim (the + // ShellDrawLiftZ retirement — shells draw unlifted too). world[vertex] = Vector3.Transform( localVertices[vertex], cell.WorldTransform); - world[vertex].Z += PortalVisibilityBuilder.ShellDrawLiftZ; } _diagnostics.EmitSeamMask( diff --git a/src/AcDream.App/Rendering/RetailPViewRenderer.cs b/src/AcDream.App/Rendering/RetailPViewRenderer.cs index f1c71440..a8209b6c 100644 --- a/src/AcDream.App/Rendering/RetailPViewRenderer.cs +++ b/src/AcDream.App/Rendering/RetailPViewRenderer.cs @@ -71,6 +71,10 @@ public sealed class RetailPViewRenderer private readonly HashSet _cellParticleOwnerScratch = new(); private readonly HashSet _dynamicParticleOwnerScratch = new(); + // The walk's TRUE root flood as a set, rebuilt per frame for the + // DynamicLast stage gate (the stage-set split — synthesis plan step 4). + private readonly HashSet _rootFloodSetScratch = new(); + // MP-Alloc (2026-07-05): the frame's entity partition (ByCell/OutdoorStatic/ // Dynamics), reused across frames instead of `new`ing a Result (a Dictionary // + 2 Lists, plus one List per visible cell) every DrawInside @@ -93,10 +97,47 @@ public sealed class RetailPViewRenderer { } + // FW3 visual-gate fix: the interior root's dynamics phase, invoked by + // the driver's clearInteriorDepth closure at the walk's pre-clear + // boundary (retail draws outside objects inside LScape::draw, before + // the clear+seals). Assigned per frame around the Replay, always + // cleared in finally. + private Action? _walkPreClearDynamics; + + // ACDREAM_PROBE_WALK_ROOT (FW3 visual-gate apparatus, throwaway): the + // previous frame's root kind + a post-flip frame countdown so each + // interior/outdoor transition dumps 8 frames of rooting facts. + private bool? _probeWalkRootPrevOutdoor; + private int _probeWalkRootFramesLeft; + private ulong _probeWalkRootFrame; + + // Campaign FW3.2b-2: the walk's production world-data registries + // (published/retired by LandblockRenderPublisher) plus the per-frame + // driver state. Null until the composition passes them; the static + // cutover requires all three. + private readonly Walk.WalkBuildingRegistry? _walkBuildings; + private readonly Walk.WalkLandscapeAssembler? _walkLandscape; + private readonly CellVisibility? _walkCellRegistry; + + // Campaign FW3.2b-2: the production IWalkFrameWorldData over the retained + // scene — owned here (not just inside the driver) because DrawInside also + // reads it directly to re-source particle owners for the routes the walk + // now draws (plan §FW3 item 4). Non-null exactly when _walkBuildings is. + private readonly Walk.WalkProductionWorldData? _walkWorldData; + internal RetailPViewRenderer( InteriorEntityPartition.IObserver? partitionObserver, - RenderScenePViewFrameProductController? sceneFrameProduct = null) + RenderScenePViewFrameProductController? sceneFrameProduct = null, + Walk.WalkBuildingRegistry? walkBuildings = null, + Walk.WalkLandscapeAssembler? walkLandscape = null, + CellVisibility? walkCellRegistry = null) { + _walkBuildings = walkBuildings; + _walkLandscape = walkLandscape; + _walkCellRegistry = walkCellRegistry; + _walkWorldData = walkBuildings is not null + ? new Walk.WalkProductionWorldData(walkBuildings) + : null; _partitionObserver = partitionObserver; _candidateObserver = partitionObserver as ICurrentRenderPViewObserver; _sceneFrameProduct = sceneFrameProduct; @@ -125,7 +166,6 @@ public sealed class RetailPViewRenderer ctx.Cells.Find, ctx.ViewProjection, buildingMembership: null, - drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ, reuseFrame: _mainPortalFrameScratch); // R-A2: outdoor root — flood each nearby building SEPARATELY from its own entrance and merge @@ -160,8 +200,10 @@ public sealed class RetailPViewRenderer pvFrame, _clipAssemblyScratch); passes.AppendLookInClipFrames(_lookInFrames, clipAssembly); - int terrainUploadCount = checked(1 + clipAssembly.OutsideViewSlices.Length * 2); - passes.PrepareClipFrame(terrainUploadCount); + // FW4 slice 1: PrepareClipFrame (the one clip-region publication) + // moved BELOW the walk block — an interior-rooted walk frame + // re-derives the outside-view slices from the walk's own views + // first, so the appended slots join the same single publication. // R1: draw EVERY visible cell (retail cell_draw_list), not only the cells the // assembler handed a clip-slot. This feeds the Prepare filter + entity partition, @@ -173,6 +215,224 @@ public sealed class RetailPViewRenderer var drawableCells = _drawableCellsScratch; passes.UseIndoorMembershipOnlyRouting(); + // Campaign FW3.2b-2: the production rooting. A concrete executor is + // required — the walk submits through WbDrawDispatcher.SubmitOrderedStream + // and needs a real GPU frame/encoder (RequireWalkSubmission), which no + // test IRetailPViewPassExecutor fake can supply. Whenever a concrete + // executor IS present, the packed entity-route product must ALSO be + // wired with all three walk registries — a scene product without the + // walk data (or vice versa) is a production miswiring, not a + // legacy/diagnostic shape, so it fails loud rather than silently + // falling back to the retired static routes (plan §FW3 item 6). + RetailPViewPassExecutor? walkExecutor = passes as RetailPViewPassExecutor; + bool walkRegistriesReady = + _walkBuildings is not null + && _walkLandscape is not null + && _walkCellRegistry is not null + && _walkWorldData is not null; + if (walkExecutor is not null + && _sceneFrameProduct is not null + && !walkRegistriesReady) + { + throw new InvalidOperationException( + "RetailPViewRenderer has a concrete pass executor and a " + + "RenderScenePViewFrameProductController but the walk registries " + + "(WalkBuildingRegistry/WalkLandscapeAssembler/CellVisibility) are " + + "not all wired — the Campaign FW3.2b-2 static cutover requires " + + "every piece together; see FrameRootComposition's " + + "RetailPViewRenderer construction."); + } + bool walkActive = + walkExecutor is not null + && _sceneFrameProduct is not null + && walkRegistriesReady; + + // Campaign FW3.4a: THE ONE WALK. Builds walkContext/walkLandscape/ + // walkCameraCell exactly as the pre-FW3.4a pre-walk collection pass + // did, then drives WalkFrameDriver.Collect — a SINGLE RetailFrameWalk + // pass that both learns the flood/visited-cell set (needed below, + // BEFORE prepareCells is finalized, so EnvCellRenderer prepares + // batches for every shell the driver will draw later in this same + // DrawInside call) and records the walk's draw events for Replay + // further down, in DrawWalkDrivenStatics. The former SECOND walk pass + // (a dedicated set-collecting sink, run again through this same + // driver machinery just to submit) is gone — see WalkFrameDriver's + // own doc comment for the FW3.4 perf numbers that motivated this. + // _walkWorldData.BeginFrame precedes Collect deliberately: Collect's + // stream appends classify records immediately (WalkStaticStreamPopulator + // runs at append time, not at Replay time), so the world data must + // already be rebuilt for this frame before the walk starts. + Walk.WalkFrameDriver? walkDriver = null; + if (walkActive) + { + Matrix4x4 view = ctx.CameraView; + var forward = Vector3.Normalize(new Vector3(-view.M13, -view.M23, -view.M33)); + (int Width, int Height)? attachment = walkExecutor!.WalkAttachmentExtent; + // Fallback matches the FW3.2b-2 shadow probe's own comment: every + // screen projection shares the same constants, so this is only + // reached before the world pass has published its scope. + float viewportWidth = attachment?.Width ?? 1024f; + float viewportHeight = attachment?.Height ?? 720f; + var walkContext = new Walk.WalkProductionFrameContext( + _walkCellRegistry!, + _walkBuildings!, + ctx.ViewerEyePos, + forward, + ctx.ViewProjection, + viewportWidth, + viewportHeight); + _walkLandscape!.SetViewer(ctx.ViewerCellId, ctx.ViewerEyePos); + Walk.WalkLandscape walkLandscape = _walkLandscape.Landscape; + + Walk.WalkCell? walkCameraCell = null; + if ((ctx.ViewerCellId & 0xFFFFu) >= 0x100) + { + walkCameraCell = _walkCellRegistry!.TryGetCell(ctx.ViewerCellId, out LoadedCell? loaded) + ? loaded?.Walk + : null; + if (walkCameraCell is null) + { + throw new InvalidOperationException( + $"walk root=0x{ctx.ViewerCellId:X8}: the interior camera cell has " + + "no committed walk data — the Campaign FW3.2b-2 static cutover " + + "requires the walk registry to already hold the viewer's own cell " + + "(fail-loud rule; a silently skipped root would leave the frame " + + "with no static draws at all)."); + } + } + + if (ctx.RootCell.IsOutdoorNode && clipAssembly.OutsideViewSlices.Length != 1) + { + throw new InvalidOperationException( + "walk static cutover: an outdoor root's clip assembly produced " + + $"{clipAssembly.OutsideViewSlices.Length} outside-view slices, not the " + + "expected 1 — the outdoor root draws through the full-screen default " + + "view (retail set_default_view; the walk fans exactly its own 1), and " + + "the outdoor slice data still comes from the assembler (plan §FW3 item " + + "2c's pinned assumption; assert rather than silently coercing to 1)."); + } + + _walkWorldData!.BeginFrame( + _sceneFrameProduct!.SceneQuery, + ctx.PlayerLandblockId ?? 0u, + ctx.RenderCenterLbX, + ctx.RenderCenterLbY); + + Action clearInteriorDepth = () => + { + // FW3 visual-gate fix (owner report: doors/candles invisible + // looking out; the crossing vanish): retail draws the + // OUTSIDE world's objects INSIDE LScape::draw — strictly + // BEFORE the depth clear + seals (the #118 house-exit + // clip+vanish lesson: anything drawn after the seals z-fails + // against their true-depth stamp the moment it stands beyond + // the door plane). The surviving dynamic routes + outdoor + // particles + weather therefore run HERE, at the walk's + // pre-clear boundary, for an interior root. + _walkPreClearDynamics?.Invoke(); + // Retail PView::DrawCells 0x005A4872 drains the landscape + // alpha list immediately before the gated full depth clear — + // mirrors DrawLandscapeThroughOutsideView's own pre-clear + // drain. + passes.FlushLandscapeAlpha(); + passes.ClearInteriorDepth(); + }; + // FW4 slice 2: the seals stamp the WALK'S OWN flood cells (see + // DrawWalkExitPortalMasks). walkDriver is assigned below, before + // any Replay can fire this closure. + Action drawExitSeals = () => + DrawWalkExitPortalMasks(ctx, passes, clipAssembly, walkDriver!); + + var leafRenderer = new WalkProductionLeafRenderer( + walkExecutor!, ctx, clipAssembly, clearInteriorDepth, drawExitSeals); + walkDriver = new Walk.WalkFrameDriver(walkExecutor!.Dispatcher, leafRenderer, _walkWorldData); + + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + { + AcDream.Core.Rendering.RenderingDiagnostics.WalkPortalProbeThisFrame = + _probeWalkRootFrame % 90 == 0; + } + walkDriver.Collect( + _frameWalk, ctx.ViewerCellId, walkCameraCell, walkLandscape, walkContext, + ctx.ViewProjection, ctx.CameraWorldPosition); + AcDream.Core.Rendering.RenderingDiagnostics.WalkPortalProbeThisFrame = false; + + // FW4 slice 1: an interior root's terrain/sky/punch clip slices + // come from THE WALK'S OWN outside_view — retail's one + // visibility structure. See ClipFrameAssembler. + // ReassembleOutsideViewFromWalk's doc comment for the boundary- + // frame desync (the stairwell/grass flash) this retires. The + // outdoor root keeps the assembler's single full-screen slice + // (asserted ==1 above; identical content by construction). + if (walkCameraCell is not null) + { + ClipFrameAssembler.ReassembleOutsideViewFromWalk( + clipAssembly, + _frameWalk.InteriorOutsideView, + viewportWidth, + viewportHeight); + } + + // Phase I cathedral instrumentation (synthesis §Phase I.3): the + // continuous rooting line SEPARATES the true root flood + // (InteriorFloodCells) from the visited union (root + look-ins — + // the conflation the review corpus indicted), and adds the + // walk's OWN exit-view count. [walk-cam] dumps a replayable + // camera every ~300 frames and at every root flip. + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + { + _probeWalkRootFrame++; + bool outdoorNow = ctx.RootCell.IsOutdoorNode; + bool flipped = _probeWalkRootPrevOutdoor is bool prev && prev != outdoorNow; + if (flipped) + { + _probeWalkRootFramesLeft = 8; + Console.WriteLine( + $"[walk-root] ---- FLIP {(outdoorNow ? "IN->OUT" : "OUT->IN")} at frame {_probeWalkRootFrame} ----"); + } + _probeWalkRootPrevOutdoor = outdoorNow; + bool sample = _probeWalkRootFramesLeft > 0 || _probeWalkRootFrame % 30 == 0; + if (_probeWalkRootFramesLeft > 0) + _probeWalkRootFramesLeft--; + if (sample) + { + List rootFlood = walkDriver.InteriorFloodCells; + string flood = string.Join(",", rootFlood + .GetRange(0, Math.Min(rootFlood.Count, 8)) + .ConvertAll(c => c.ToString("x8"))); + int walkOv = outdoorNow ? -1 : _frameWalk.InteriorOutsideView.ViewCount; + Vector3 fwd = walkContext.CyPlane.Normal; + Console.WriteLine( + $"[walk-root] f={_probeWalkRootFrame} out={(outdoorNow ? 1 : 0)} " + + $"viewer=0x{ctx.ViewerCellId:X8} root=0x{ctx.RootCell.CellId:X8} " + + $"res={ctx.CameraCellResolution} slices={clipAssembly.OutsideViewSlices.Length} " + + $"walkOv={walkOv} rootFlood={rootFlood.Count}[{flood}] " + + $"visited={walkDriver.VisitedCells.Count} bld={walkDriver.VisitedBuildings.Count} " + + $"eye=({ctx.ViewerEyePos.X:F2},{ctx.ViewerEyePos.Y:F2},{ctx.ViewerEyePos.Z:F2}) " + + $"fwd=({fwd.X:F3},{fwd.Y:F3},{fwd.Z:F3})"); + } + if (flipped || _probeWalkRootFrame % 300 == 0) + { + Matrix4x4 vp = ctx.ViewProjection; + Console.WriteLine( + $"[walk-cam] viewer=0x{ctx.ViewerCellId:X8} " + + $"eye=({ctx.ViewerEyePos.X:R},{ctx.ViewerEyePos.Y:R},{ctx.ViewerEyePos.Z:R}) " + + $"vw={viewportWidth:R} vh={viewportHeight:R} vp=[" + + $"{vp.M11:R},{vp.M12:R},{vp.M13:R},{vp.M14:R}," + + $"{vp.M21:R},{vp.M22:R},{vp.M23:R},{vp.M24:R}," + + $"{vp.M31:R},{vp.M32:R},{vp.M33:R},{vp.M34:R}," + + $"{vp.M41:R},{vp.M42:R},{vp.M43:R},{vp.M44:R}]"); + } + } + } + + // FW4 slice 1: the ONE clip-region publication, after any walk + // reassembly so the walk-derived outside-view slots are included + // (moved from directly after AssembleClipFrame; the count is + // reservation metadata the RHI arm ignores). + int terrainUploadCount = checked(1 + clipAssembly.OutsideViewSlices.Length * 2); + passes.PrepareClipFrame(terrainUploadCount); + // #124: look-in cells need prepared shell batches + their statics routed // into partition.ByCell (consumed ONLY by DrawBuildingLookIns — the main // cell-object pass iterates pvFrame.OrderedVisibleCells, which never @@ -180,7 +440,7 @@ public sealed class RetailPViewRenderer // seals, the outside-stage predicate, and the frame result. var prepareCells = drawableCells; _lookInCellIds.Clear(); - if (_lookInFrames.Count > 0) + if (_lookInFrames.Count > 0 || walkActive) { _lookInPrepareScratch.Clear(); _lookInPrepareScratch.UnionWith(drawableCells); @@ -192,6 +452,13 @@ public sealed class RetailPViewRenderer _lookInCellIds.Add(c); } } + if (walkActive) + { + // The walk's own flood/look-in cell set — unioned in (never + // aliased with drawableCells, which the outside-stage and seal + // predicates below still need scoped to the OLD flood only). + _lookInPrepareScratch.UnionWith(walkDriver!.VisitedCells); + } prepareCells = _lookInPrepareScratch; } @@ -232,6 +499,28 @@ public sealed class RetailPViewRenderer _candidateObserver?.BeginPViewFrame(); try { + // FW4 slice 3: the outside-stage predicate's flood-membership set + // is THE WALK'S visited cells on walk frames (root flood + + // look-in floods — retail draws all of their objects inside + // LScape::draw, pre-clear). The old apparatus's drawableCells + // misses cells at the #456 seam band, dropping interior-parented + // outdoor emitters (the cathedral falls weenies) to the + // post-clear last pass, where the cleared depth lets them splat + // across terrain and water. drawableCells keeps its other roles + // (prepare filter, frame result) unchanged. + HashSet outsideStageFlood = + walkActive ? walkDriver!.VisitedCells : drawableCells; + + // The stage-set split: the walk's TRUE root flood (never the + // visited union) keys which interior-parented dynamics may ride + // the last pass — see BuildOutsideDynamicRoutes' sibling gate. + _rootFloodSetScratch.Clear(); + if (walkActive) + { + foreach (uint cellId in walkDriver!.InteriorFloodCells) + _rootFloodSetScratch.Add(cellId); + } + if (_sceneFrameProduct is not null) { frameView = _sceneFrameProduct.BuildAndBorrow( @@ -239,10 +528,14 @@ public sealed class RetailPViewRenderer clipAssembly, viewcone, _lookInFrames, - drawableCells, + outsideStageFlood, ctx.Cells, ctx.AnimatedEntityIds, - ctx.RootCell.IsOutdoorNode); + ctx.RootCell.IsOutdoorNode, + // Non-walk frames (diagnostic fakes / legacy fallback) + // keep the pre-split admission: drawableCells WAS the + // flood in the legacy meaning. + walkActive ? _rootFloodSetScratch : drawableCells); frameViewBorrowed = true; frameEntityPasses!.BeginEntityFrame(in frameView); entityFrameOpen = true; @@ -282,6 +575,13 @@ public sealed class RetailPViewRenderer partition); passes.EmitDiagnostics(ctx, result); + // Campaign FW3.2b-2 flip apparatus (ACDREAM_PROBE_WALK_SHADOW=1, + // throwaway — dies with the flip commit): run the PRODUCTION + // retail frame walk in shadow and report set divergence vs this + // frame's old-path visibility. No draws change. + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkShadowEnabled) + RunWalkShadowProbe(ctx, prepareCells); + // #118: stage assignment for dynamics under an INTERIOR root. Retail // draws the OUTSIDE world's objects inside the landscape stage — // PView::DrawCells runs LScape::draw FIRST (pc:432719), then the gated @@ -304,57 +604,127 @@ public sealed class RetailPViewRenderer foreach (var e in partition.Dynamics) { EntitySphere(e, out var c, out float r); - if (DynamicDrawsInOutsideStage(e.ParentCellId, c, r, drawableCells, ctx.Cells)) + // FW4 slice 3: same walk-flood membership set as the + // frame product's BuildOutsideDynamicRoutes — the two + // predicate call sites must agree or routed and drawn + // stages diverge. + if (DynamicDrawsInOutsideStage(e.ParentCellId, c, r, outsideStageFlood, ctx.Cells)) _outsideStageDynamics.Add(e); } } - DrawLandscapeThroughOutsideView( - ctx, - passes, - clipAssembly, - partition, - viewcone, - frameEntityPasses, - in frameView); - passes.UseIndoorMembershipOnlyRouting(); - - // Retail DrawBuilding @0x0059F2A0 runs FlushAlphaList(0f) BEFORE - // its portal-only far-Z pass. In retail's strict far→near walk - // everything queued at that instant is FARTHER than the structure - // being punched, so no already-drained poly can meet a punched - // aperture's falsified depth, and everything drained later is - // NEARER than the punched structure and legitimately composites in - // front of it. The batched outdoor frame reproduces that invariant - // here: drain the far prefix — every entry at or beyond the - // nearest cell whose exit-portal mask is about to punch far-Z — - // against still-true landscape depth. Without this, an exterior - // waterfall beyond the cathedral drains after the punches and - // z-passes across every aperture pixel whose true depth the punch - // erased (#132 regression found at the 2026-08-29 cathedral gate). - // Interior roots keep their pre-clear stage-boundary drain. - if (ctx.RootCell.IsOutdoorNode) + if (walkActive) { - passes.FlushLandscapeAlphaFartherThan( - ExitPortalMaskBarrierDistance( - pvFrame, - drawableCells, - ctx.Cells, - ctx.CameraWorldPosition)); + // Campaign FW3.2b-2: the walk owns every static draw — + // terrain/sky, building shells + punches + look-in cell + // statics, and the interior root's own flood shells + + // statics (with the depth clear + exit seals at their real + // retail turn). The OLD visibility (pvFrame/clipAssembly/ + // viewcone, already built above) keeps running unchanged to + // feed the surviving dynamic routes only (plan §FW3 item 1's + // dual-compute split). Campaign FW3.4a: the walk itself + // already ran (Collect, above) — this is Replay only. + // + // FW3 visual-gate fix: for an INTERIOR root the dynamics + // phase (outside dynamics + look-in dynamics + outdoor + // particles + weather) must draw at the walk's PRE-CLEAR + // boundary — retail draws them inside LScape::draw, before + // the clear+seals — so the driver's clearInteriorDepth + // closure invokes it via _walkPreClearDynamics. For an + // OUTDOOR root there is no clear (retail has none) and the + // phase runs after the driver, matching the old order. + RenderFrameView capturedView = frameView; + IRenderFrameEntityPassExecutor? capturedPasses = frameEntityPasses; + InteriorEntityPartition.Result? capturedPartition = partition; + ViewconeCuller capturedViewcone = viewcone; + Walk.WalkFrameDriver capturedDriver = walkDriver!; + _walkPreClearDynamics = () => + { + // Static-owner emitters now submit AT THEIR OWN WALK + // TURNS during Replay (WalkFrameEventKind.StaticParticles + // — the #132 positional invariant), so the pre-clear + // closure carries only the dynamics phase. + passes.UseIndoorMembershipOnlyRouting(); + DrawLandscapeDynamicsPhase( + ctx, + passes, + clipAssembly, + capturedPartition, + capturedViewcone, + capturedPasses, + in capturedView); + }; + try + { + DrawWalkDrivenStatics(ctx, walkExecutor!, walkDriver!); + passes.UseIndoorMembershipOnlyRouting(); + if (ctx.RootCell.IsOutdoorNode) + { + DrawLandscapeDynamicsPhase( + ctx, + passes, + clipAssembly, + partition, + viewcone, + frameEntityPasses, + in frameView); + } + } + finally + { + _walkPreClearDynamics = null; + } + } + else + { + DrawLandscapeThroughOutsideView( + ctx, + passes, + clipAssembly, + partition, + viewcone, + frameEntityPasses, + in frameView); + passes.UseIndoorMembershipOnlyRouting(); + + // Retail DrawBuilding @0x0059F2A0 runs FlushAlphaList(0f) BEFORE + // its portal-only far-Z pass. In retail's strict far→near walk + // everything queued at that instant is FARTHER than the structure + // being punched, so no already-drained poly can meet a punched + // aperture's falsified depth, and everything drained later is + // NEARER than the punched structure and legitimately composites in + // front of it. The batched outdoor frame reproduces that invariant + // here: drain the far prefix — every entry at or beyond the + // nearest cell whose exit-portal mask is about to punch far-Z — + // against still-true landscape depth. Without this, an exterior + // waterfall beyond the cathedral drains after the punches and + // z-passes across every aperture pixel whose true depth the punch + // erased (#132 regression found at the 2026-08-29 cathedral gate). + // Interior roots keep their pre-clear stage-boundary drain. + if (ctx.RootCell.IsOutdoorNode) + { + passes.FlushLandscapeAlphaFartherThan( + ExitPortalMaskBarrierDistance( + pvFrame, + drawableCells, + ctx.Cells, + ctx.CameraWorldPosition)); + } + + DrawExitPortalMasks(ctx, passes, pvFrame, clipAssembly, drawableCells); + DrawEnvCellShells(passes, pvFrame); + DrawCellObjectLists( + ctx, + passes, + pvFrame, + clipAssembly, + drawableCells, + partition, + viewcone, + frameEntityPasses, + in frameView); } - DrawExitPortalMasks(ctx, passes, pvFrame, clipAssembly, drawableCells); - DrawEnvCellShells(passes, pvFrame); - DrawCellObjectLists( - ctx, - passes, - pvFrame, - clipAssembly, - drawableCells, - partition, - viewcone, - frameEntityPasses, - in frameView); DrawDynamicsLast( ctx, passes, @@ -859,6 +1229,429 @@ public sealed class RetailPViewRenderer } } + /// Campaign FW3.2b-2 flip apparatus (the I5 dual-shadow + /// pattern): drive the production walk over the FW3.1 registries with a + /// set-collecting sink and print one [walk-shadow] line per frame + /// whose visited cells diverge from the old path's + /// (main flood ∪ look-ins). Divergence is + /// EXPECTED where the walk's retail model deliberately differs from the + /// old builder — the probe's value is proving the production data + /// pipeline live and QUANTIFYING the difference for the flip review. A + /// probe exception prints loudly and never kills the frame (it is the + /// probe's own signal, not a production fault). + private void RunWalkShadowProbe( + RetailPViewFrameInput ctx, HashSet oldPathCells) + { + if (_walkBuildings is null || _walkLandscape is null + || _walkCellRegistry is null) + { + return; + } + try + { + // Forward = -(view column 3): System.Numerics CreateLookAt's + // zaxis is eye-target (backward). Viewport: the walk's SETS are + // viewport-scale-tolerant (every screen projection shares the + // same constants), so the shadow pins retail's capture size; the + // flip itself will use the real attachment extent. + Matrix4x4 view = ctx.CameraView; + var forward = Vector3.Normalize(new Vector3(-view.M13, -view.M23, -view.M33)); + var context = new Walk.WalkProductionFrameContext( + _walkCellRegistry, + _walkBuildings, + ctx.ViewerEyePos, + forward, + ctx.ViewProjection, + viewportWidth: 1024f, + viewportHeight: 720f); + Walk.WalkLandscape landscape = _walkLandscape.Landscape; + _walkLandscape.SetViewer(ctx.ViewerCellId, ctx.ViewerEyePos); + Walk.WalkCell? cameraCell = null; + if ((ctx.ViewerCellId & 0xFFFFu) >= 0x100) + { + cameraCell = _walkCellRegistry.TryGetCell(ctx.ViewerCellId, out LoadedCell? loaded) + ? loaded?.Walk + : null; + if (cameraCell is null) + { + Console.WriteLine( + $"[walk-shadow] root={ctx.ViewerCellId:x8} interior camera cell has no walk data"); + return; + } + } + var sink = new WalkVisitedSetCollector(); + _frameWalk.WalkFrame( + ctx.ViewerCellId, cameraCell, landscape, context, sink); + + int onlyWalk = 0; + foreach (uint id in sink.Cells) + if (!oldPathCells.Contains(id)) + onlyWalk++; + int onlyOld = 0; + foreach (uint id in oldPathCells) + if (!sink.Cells.Contains(id)) + onlyOld++; + if (onlyWalk != 0 || onlyOld != 0) + { + Console.WriteLine( + $"[walk-shadow] root={ctx.ViewerCellId:x8} walkCells={sink.Cells.Count} " + + $"oldCells={oldPathCells.Count} onlyWalk={onlyWalk} onlyOld={onlyOld} " + + $"walkBuildings={sink.BuildingCount} landscapeTurns={sink.LandscapeCount}"); + } + } + catch (Exception failure) + { + Console.WriteLine($"[walk-shadow] PROBE FAULT root={ctx.ViewerCellId:x8}: {failure}"); + } + } + + // Campaign FW3.2b-2: the one RetailFrameWalk instance shared by the + // diagnostic shadow probe and the real Collect run (WalkFrameDriver.Collect, + // driven from DrawInside's walkActive block) — WalkFrame calls are never + // concurrent/re-entrant within a single-threaded render loop, so one + // shared instance is safe and avoids re-allocating the walk's own PView + // scratch per call site. Campaign FW3.4a retired the THIRD role this + // field used to serve (a dedicated pre-walk collection pass) — Collect + // now gathers the same visited sets itself, on WalkFrameDriver, as a + // side effect of the one walk it already runs. + private readonly Walk.RetailFrameWalk _frameWalk = new(); + + /// Campaign FW3.2b-2 (the I5 dual-shadow pattern): an + /// events-only that collects the SETS a + /// driven run would touch, without doing any leaf drawing itself. Used + /// ONLY by now — Campaign FW3.4a moved + /// the production role (the walk's flood cell set for the + /// prepareCells union, the visited building list and + /// landscape-cell turn ids for particle re-sourcing) onto + /// itself, which gathers the same sets + /// as a side effect of the one walk + /// already runs, instead of a second dedicated pass. + private sealed class WalkVisitedSetCollector : Walk.IWalkEventSink + { + public readonly HashSet Cells = new(); + public readonly List Buildings = new(); + public readonly HashSet LandscapeCellIds = new(); + + public int BuildingCount => Buildings.Count; + public int LandscapeCount => LandscapeCellIds.Count; + + public void Reset() + { + Cells.Clear(); + Buildings.Clear(); + LandscapeCellIds.Clear(); + } + + public void Emit(in Walk.WalkEvent walkEvent) + { + switch (walkEvent.Kind) + { + case Walk.WalkEventKind.DrawInside: + Cells.Add(walkEvent.CellId); + break; + case Walk.WalkEventKind.DrawCells: + foreach (uint id in walkEvent.Cells) + Cells.Add(id); + break; + } + } + + public void OnLandscapeCellTurn(uint cellId) => LandscapeCellIds.Add(cellId); + + public void OnBuildingTurn(Walk.WalkBuilding building) => Buildings.Add(building); + } + + /// Campaign FW3.2b-2 — THE PRODUCTION ROOTING; Campaign FW3.4a — + /// REPLAY ONLY. already ran its Collect pass + /// earlier in (before PrepareCellBatches); + /// this method's job is now just + /// (terrain/sky, every building's shell + punch + look-in cell statics, + /// and the interior root's own flood shells + statics, with retail's + /// depth-clear/exit-seal turn — all in walk order, replacing + /// 's static half, + /// 's old top-level call, + /// , and 's + /// static half for this frame) plus re-sourcing the particle owners the + /// routes it replaced used to ride, from the driver's own visited + /// sets (plan §FW3 "FW3.2b-2 — the production rooting", items 2 and + /// 4). + private void DrawWalkDrivenStatics( + RetailPViewFrameInput ctx, + RetailPViewPassExecutor passes, + Walk.WalkFrameDriver driver) + { + var (frame, encoder) = passes.RequireWalkSubmission(); + driver.Replay(frame, encoder); + + // Landscape-stage static-owner particles (candles, the cathedral + // falls) submit AT THEIR OWN WALK TURNS inside Replay + // (WalkFrameEventKind.StaticParticles) for BOTH root kinds — the + // #132 positional invariant (e102fb36's user-verified rule ported + // walk-natively): each owner cell's emitters enter the one alpha + // queue at that cell's far-to-near position, so every nearer + // building's pre-punch AlphaBarrier drains the farther content + // against still-true depth before its punch stamps far-Z. + + // Cell-stage particle owners for the interior root's OWN flood cells + // (non-look-in — the walk draws their statics too, via + // OnInteriorFloodDrawTurn/EmitCellTurn, so the retired CellStatic + // route's cell-particle submission needs the same re-sourcing). + // These stay POST-replay: interior emitters draw in the final world + // scope where the cell walls already own depth (retail's cell-walk + // insertion). Look-in cells get their OWN per-cell union in + // DrawBuildingLookInDynamics so a static owner is never submitted + // twice. + _cellParticleOwnerScratch.Clear(); + foreach (uint cellId in driver.VisitedCells) + { + if (_lookInCellIds.Contains(cellId)) + continue; + UnionRecordOwners(_walkWorldData!.GetCellStatics(cellId), _cellParticleOwnerScratch); + } + if (_cellParticleOwnerScratch.Count > 0) + { + passes.DrawCellParticles( + ctx, + new RetailPViewCellSliceContext(0u, NoClipSlice, _cellParticleOwnerScratch)); + } + } + + private static void UnionRecordOwners( + Walk.WalkFrameStaticRecords records, HashSet destination) + { + foreach (RenderProjectionRecord record in records.Records) + { + if (record.Source.LocalEntityId != 0) + destination.Add(record.Source.LocalEntityId); + } + } + + /// Campaign FW3.2b-2: the DYNAMICS-only remainder of the old + /// + + /// split — the walk now draws every STATIC route (see + /// ); this method keeps ONLY what + /// stays on the OLD visibility pipeline per the plan's dual-compute + /// split: outdoor-cell unattached particles, LookInObject dynamics + their + /// per-cell particles, the late per-slice outside-dynamics/weather loop, + /// and the late particle union submission. + private void DrawLandscapeDynamicsPhase( + RetailPViewFrameInput ctx, + IRetailPViewPassExecutor passes, + ClipFrameAssembly clipAssembly, + InteriorEntityPartition.Result? partition, + ViewconeCuller viewcone, + IRenderFrameEntityPassExecutor? frameEntityPasses, + in RenderFrameView frameView) + { + if (clipAssembly.OutsideViewSlices.Length == 0) + return; + + // Ownerless OUTDOOR-cell emitters — now unconditional: the old + // hasBuildingLookIns gate only existed to sequence this submission + // around the OLD static barrier drains, which no longer run here + // (the walk owns its own alpha barriers — WalkFrameDriver.OnBuildingTurn). + passes.DrawUnattachedSceneParticles(ctx, outdoorCells: true); + + DrawBuildingLookInDynamics( + ctx, passes, clipAssembly, partition, frameEntityPasses, in frameView); + + // LATE phase (per slice): outside-stage dynamics' meshes + weather — + // unchanged from DrawLandscapeThroughOutsideView's own late loop. + _staticParticleUnionScratch.Clear(); + int probeSliceIndex = 0; + foreach (var slice in clipAssembly.OutsideViewSlices) + { + passes.SetTerrainClip(slice.Planes); + passes.ClearClipRouting(); + + _outdoorStaticScratch.Clear(); + _lateParticleOwnerScratch.Clear(); + foreach (var e in _outsideStageDynamics) + { + EntitySphere(e, out var c, out float r); + if (viewcone.SphereVisibleInOutsideSlice(probeSliceIndex, c, r)) + { + _outdoorStaticScratch.Add(e); + if (!InteriorEntityPartition.IsIndoorCellId(e.ParentCellId)) + _lateParticleOwnerScratch.Add(e.Id); + } + } + if (frameEntityPasses is not null) + { + RenderFrameRouteOwnerSelector.Union( + _lateParticleOwnerScratch, + in frameView, + RenderFrameCandidateRoute.LandscapeOutsideDynamic, + probeSliceIndex, + 0); + } + _candidateObserver?.ObservePViewBucket( + CurrentRenderPViewRoute.LandscapeOutsideDynamic, + probeSliceIndex, + 0, + _outdoorStaticScratch); + RenderFrameEntityDrawRequest? entityDraw = + frameEntityPasses is null + ? null + : new RenderFrameEntityDrawRequest( + frameView, + RenderFrameCandidateRoute.LandscapeOutsideDynamic, + probeSliceIndex, + 0, + ctx.PlayerLandblockId ?? 0); + probeSliceIndex++; + _staticParticleUnionScratch.UnionWith(_lateParticleOwnerScratch); + passes.DrawLandscapeSliceLate( + ctx, + new RetailPViewLandscapeLateSliceContext(slice, _outdoorStaticScratch) + { + EntityDraw = entityDraw, + }); + } + + // Late-particle union submission — DynamicLast owners excluded, same + // as DrawLandscapeThroughOutsideView's own final submission. + if (frameEntityPasses is not null) + { + RenderFrameRouteOwnerSelector.ExceptRoute( + _staticParticleUnionScratch, in frameView, RenderFrameCandidateRoute.DynamicLast); + } + if (_staticParticleUnionScratch.Count > 0) + { + passes.DrawLandscapeStaticParticles( + ctx, + new RetailPViewLandscapeStaticParticleContext(_staticParticleUnionScratch)); + _staticParticleUnionScratch.Clear(); + } + + passes.UseIndoorMembershipOnlyRouting(); + } + + /// Campaign FW3.2b-2: the DYNAMICS-only remainder of the old + /// — punches, shells, and look-in cell + /// STATICS are now walk-owned ('s + /// Building/BuildingShell/LookInStatic turns); this method keeps ONLY the + /// LookInObject route (now dynamic-classified — see + /// RenderScenePViewFrameBuilder.BuildLookInRoutes) and the per-cell + /// particle union that route's owners feed, unioned with the walk's + /// static owners for that SAME cell (plan §FW3 item 4 — GetCellStatics + /// fills the gap the retired CellStatic-route particle submission left + /// for look-in cells specifically). + private void DrawBuildingLookInDynamics( + RetailPViewFrameInput ctx, + IRetailPViewPassExecutor passes, + ClipFrameAssembly clipAssembly, + InteriorEntityPartition.Result? partition, + IRenderFrameEntityPassExecutor? frameEntityPasses, + in RenderFrameView frameView) + { + if (_lookInFrames.Count == 0) + return; + + int lookInRouteIndex = 0; + for (int frameIndex = 0; frameIndex < _lookInFrames.Count; frameIndex++) + { + PortalVisibilityFrame frame = _lookInFrames[frameIndex]; + for (int i = frame.OrderedVisibleCells.Count - 1; i >= 0; i--) + { + uint cellId = frame.OrderedVisibleCells[i]; + var clipKey = new LookInClipCell(frameIndex, cellId); + if (!clipAssembly.LookInCellToViewSlices.TryGetValue( + clipKey, + out ClipViewSlice[]? cellSlices) + || cellSlices.Length == 0) + { + continue; + } + + _cellStaticScratch.Clear(); + if (partition is not null) + { + foreach (var e in partition.Dynamics) + if (e.ParentCellId == cellId) + _cellStaticScratch.Add(e); + } + + bool cellDrewObjects = false; + _cellParticleUnionScratch.Clear(); + foreach (ClipViewSlice slice in cellSlices) + { + int routeIndex = lookInRouteIndex++; + passes.UseCellPortalViewRouting(cellId, slice); + + if (frameEntityPasses is not null) + { + RenderFrameRouteOwnerSelector.Replace( + _cellParticleOwnerScratch, + in frameView, + RenderFrameCandidateRoute.LookInObject, + routeIndex, + cellId); + } + else + { + ReplaceOwnerIds( + _cellParticleOwnerScratch, + _cellStaticScratch); + } + + if (frameEntityPasses is not null + || _cellStaticScratch.Count > 0) + { + _candidateObserver?.ObservePViewBucket( + CurrentRenderPViewRoute.LookInObject, + routeIndex, + cellId, + _cellStaticScratch); + _oneCell.Clear(); + _oneCell.Add(cellId); + DrawEntityRouteOrLegacy( + ctx, + passes, + frameEntityPasses, + in frameView, + RenderFrameCandidateRoute.LookInObject, + routeIndex, + cellId, + _cellStaticScratch, + _oneCell); + + cellDrewObjects = true; + _cellParticleUnionScratch.UnionWith( + _cellParticleOwnerScratch); + } + } + + // The walk already drew this cell's STATIC content + // (WalkFrameDriver's LookInStatic turn) but never submits + // particles for it — GetCellStatics fills that gap, unioned + // with the dynamic route's own owners so ONE + // DrawCellParticles call covers both. + if (_walkWorldData is not null) + { + Walk.WalkFrameStaticRecords statics = + _walkWorldData.GetCellStatics(cellId); + foreach (RenderProjectionRecord record in statics.Records) + { + if (record.Source.LocalEntityId != 0) + { + _cellParticleUnionScratch.Add(record.Source.LocalEntityId); + cellDrewObjects = true; + } + } + } + + if (cellDrewObjects) + { + passes.DrawCellParticles(ctx, new RetailPViewCellSliceContext( + cellId, NoClipSlice, _cellParticleUnionScratch)); + } + } + + passes.UseIndoorMembershipOnlyRouting(); + } + } + private void DrawLandscapeThroughOutsideView( RetailPViewFrameInput ctx, IRetailPViewPassExecutor passes, @@ -1277,6 +2070,39 @@ public sealed class RetailPViewRenderer } } + /// Campaign FW4 slice 2 — the walk-flood seal draw. Retail's + /// PView::DrawCells stamps every exit portal of THE FLOOD'S OWN + /// cells (pc:432785-432786, reverse cell_draw_list far→near) — one + /// visibility structure decides the flood, the seals, and the terrain + /// views alike. The old apparatus's flood misses exit portals at the + /// #456 cathedral seam band (its never-drawn panel family), leaving + /// aperture depth unsealed after the interior clear; the end-of-frame + /// alpha drain (cell-owned emitters — retail's own timing) then + /// z-passes across the whole opening (the falls shine-through, + /// probe-pinned via ACDREAM_PROBE_WALK_ROOT's phase tags). Per-cell + /// slice clips still come from the old assembly where present; a cell + /// the old apparatus missed seals unclipped (the depth fan is the exact + /// dat aperture polygon and z-tests, so over-coverage is benign). + private void DrawWalkExitPortalMasks( + RetailPViewFrameInput ctx, + IRetailPViewPassExecutor passes, + ClipFrameAssembly clipAssembly, + Walk.WalkFrameDriver driver) + { + List floodCells = driver.InteriorFloodCells; + for (int i = floodCells.Count - 1; i >= 0; i--) + { + uint cellId = floodCells[i]; + foreach (var slice in GetCellSlicesOrNoClip(clipAssembly, cellId)) + passes.DrawExitPortalMask( + ctx, + new RetailPViewCellSliceContext( + cellId, + slice, + NoParticleOwners)); + } + } + private void DrawEnvCellShells( IRetailPViewPassExecutor passes, PortalVisibilityFrame pvFrame) diff --git a/src/AcDream.App/Rendering/Scene/RenderInstanceCandidate.cs b/src/AcDream.App/Rendering/Scene/RenderInstanceCandidate.cs index 5b30afd6..90ceee09 100644 --- a/src/AcDream.App/Rendering/Scene/RenderInstanceCandidate.cs +++ b/src/AcDream.App/Rendering/Scene/RenderInstanceCandidate.cs @@ -70,6 +70,47 @@ internal readonly record struct RenderInstanceCandidate( TupleLandblockId: tupleLandblockId); } + /// + /// Campaign FW stage FW3.2a: builds a candidate straight from a + /// , without the packed route's + /// /frame-arena mesh-part + /// flattening. The walk populator reads + /// records directly (CopyCellStaticsTo / CopyIndexTo), so it + /// has no frame arena to look the source candidate up in — every field + /// this needs already lives on the record's own + /// and . + /// + /// defaults to false: the walk's static + /// routes (RenderProjectionClass.OutdoorStatic / + /// IndoorCellStatic) never carry retail's per-part + /// TransparentPartHook animation — that mechanic keys off a live + /// entity's ServerGuid, not a world static's. A future dynamic walk route + /// passes true explicitly. + /// + internal static RenderInstanceCandidate FromProjection( + in RenderProjectionRecord projection, + uint tupleLandblockId, + bool animated = false) + { + RenderEntityPayload payload = projection.EntityPayload; + return new RenderInstanceCandidate( + ProjectionId: projection.Id, + LocalEntityId: projection.Source.LocalEntityId, + ServerGuid: projection.Source.ServerGuid, + SourceId: projection.Source.SourceId, + ParentCellId: projection.Source.ParentCellId, + RootWorld: projection.Transform.LocalToWorld, + Position: projection.Transform.Position, + Rotation: projection.Transform.Rotation, + Scale: projection.Transform.UniformScale, + Bounds: projection.Bounds, + PaletteOverride: payload.PaletteOverride, + IsBuildingShell: payload.IsBuildingShell, + Animated: animated, + MeshPartCount: payload.MeshRefs?.Count ?? 0, + TupleLandblockId: tupleLandblockId); + } + internal static RenderInstanceCandidate FromFrame( in RenderFrameEntityCandidate source, uint tupleLandblockId) diff --git a/src/AcDream.App/Rendering/Scene/RenderScenePViewFrameProduct.cs b/src/AcDream.App/Rendering/Scene/RenderScenePViewFrameProduct.cs index 10bb06e3..451a8b34 100644 --- a/src/AcDream.App/Rendering/Scene/RenderScenePViewFrameProduct.cs +++ b/src/AcDream.App/Rendering/Scene/RenderScenePViewFrameProduct.cs @@ -13,7 +13,8 @@ internal readonly record struct RenderScenePViewBuildInput( HashSet DrawableCells, IRetailPViewCellSource Cells, HashSet? AnimatedEntityIds, - bool RootIsOutdoor); + bool RootIsOutdoor, + IReadOnlySet RootFloodCells); internal readonly record struct RenderFrameProductComparisonSnapshot( bool Enabled, @@ -122,6 +123,11 @@ internal sealed class RenderScenePViewFrameProductController : { private readonly RenderSceneShadowRuntime _shadow; private readonly CurrentRenderSceneOracle? _current; + + /// Campaign FW3.2b-2: the frame's retained-scene read view for + /// the walk's world-data provider (the same query + /// reads its routes from). + internal RenderSceneQuery SceneQuery => _shadow.Query; private readonly WbDrawDispatcher? _dispatcher; private readonly RenderScenePViewFrameBuilder _builder = new(); private readonly RenderFrameExchange _exchange = new(); @@ -183,7 +189,8 @@ internal sealed class RenderScenePViewFrameProductController : HashSet drawableCells, IRetailPViewCellSource cells, HashSet? animatedEntityIds, - bool rootIsOutdoor) + bool rootIsOutdoor, + IReadOnlySet rootFloodCells) { ArgumentNullException.ThrowIfNull(portalFrame); ArgumentNullException.ThrowIfNull(clipAssembly); @@ -210,7 +217,8 @@ internal sealed class RenderScenePViewFrameProductController : drawableCells, cells, animatedEntityIds, - rootIsOutdoor); + rootIsOutdoor, + rootFloodCells); _builder.Build(_exchange, frameSequence, in input); return _exchange.BorrowLatest( scene.Generation, @@ -230,8 +238,12 @@ internal sealed class RenderScenePViewFrameProductController : HashSet? animatedEntityIds, uint tupleLandblockId, bool rootIsOutdoor, - Vector3 cameraWorldPosition = default) + Vector3 cameraWorldPosition = default, + IReadOnlySet? rootFloodCells = null) { + // Comparison/diagnostic path: absent an explicit walk root flood, + // drawableCells keeps the pre-stage-split admission (drawableCells + // WAS the flood in the legacy meaning these fixtures pin). RenderFrameView view = BuildAndBorrow( portalFrame, clipAssembly, @@ -240,7 +252,8 @@ internal sealed class RenderScenePViewFrameProductController : drawableCells, cells, animatedEntityIds, - rootIsOutdoor); + rootIsOutdoor, + rootFloodCells ?? drawableCells); try { Compare( @@ -1123,7 +1136,6 @@ internal sealed class RenderScenePViewFrameBuilder private const byte EnvCellProjectionDomain = 2; private readonly HashSet _projectionIds = []; - private RenderProjectionRecord[] _outdoor = []; private RenderProjectionRecord[] _dynamics = []; private RenderProjectionRecord[] _cell = []; private RenderProjectionRecord[] _dirty = []; @@ -1134,14 +1146,15 @@ internal sealed class RenderScenePViewFrameBuilder // marks every non-player part): an object whose cell drew with a look-in // must not enter the final dynamics route again. private readonly HashSet _lookInCellScratch = new(); - private RenderProjectionRecord[] _cellRoute = []; - private readonly Dictionary - _outdoorPositions = []; private readonly Dictionary _dynamicPositions = []; - private int _outdoorCount; private int _dynamicCount; - private int _cellRouteCount; + + // ACDREAM_PROBE_WALK_ROOT companion (throwaway): rate limiter for the + // [walk-dyn] outside-stage classification dump, plus the [dyn-route] + // per-entity on-change admission cache. + private uint _probeDynFrameCounter; + private readonly Dictionary _probeDynRouteStates = new(); private int _dirtyCount; private RenderSceneGeneration _indexGeneration; private ulong _indexRevision; @@ -1164,7 +1177,13 @@ internal sealed class RenderScenePViewFrameBuilder _projectionIds.Clear(); LoadSceneIndices(input.Scene); - BuildOutdoorRoutes(writer, in input); + // Campaign FW3.2b-2: LandscapeOutdoorStatic, LandscapeBuildingShell, + // and CellStatic no longer emit here — WalkFrameDriver draws every + // outdoor static, building shell, and cell static (including + // look-in cell statics) directly through OrderedDrawStream (plan + // §FW3 "FW3.2b-2 — the production rooting", item 3). LookInObject + // keeps emitting, but BuildLookInRoutes below is now filtered to + // DYNAMIC candidates only — the walk owns that route's statics. int lookInRouteIndex = 0; for (int frameIndex = 0; frameIndex < input.LookInFrames.Count; @@ -1175,13 +1194,8 @@ internal sealed class RenderScenePViewFrameBuilder in input, frameIndex, ref lookInRouteIndex); - BuildLookInBuildingShellRoutes( - writer, - in input, - frameIndex); } BuildOutsideDynamicRoutes(writer, in input); - BuildCellStaticRoute(writer, in input); BuildDynamicLastRoute(writer, in input); writer.Publish(); AcknowledgeCachedDirtyRecords(); @@ -1200,18 +1214,6 @@ internal sealed class RenderScenePViewFrameBuilder if (scene.Generation != _indexGeneration || revision != _indexRevision) { - EnsureCapacity(ref _outdoor, counts.OutdoorStatic); - _outdoorCount = scene.CopyIndexTo( - RenderSceneIndex.OutdoorStatic, - _outdoor); - _outdoorCount = CompactAndSort( - _outdoor, - _outdoorCount); - BuildPositionIndex( - _outdoor, - _outdoorCount, - _outdoorPositions); - EnsureCapacity(ref _dynamics, counts.Dynamic); _dynamicCount = scene.CopyIndexTo( RenderSceneIndex.Dynamic, @@ -1235,12 +1237,6 @@ internal sealed class RenderScenePViewFrameBuilder for (int index = 0; index < _dirtyCount; index++) { RenderProjectionRecord record = _dirty[index]; - if (_outdoorPositions.TryGetValue( - record.Id, - out int outdoorPosition)) - { - _outdoor[outdoorPosition] = record; - } if (_dynamicPositions.TryGetValue( record.Id, out int dynamicPosition)) @@ -1255,16 +1251,6 @@ internal sealed class RenderScenePViewFrameBuilder for (int index = 0; index < _dirtyCount; index++) { RenderProjectionId id = _dirty[index].Id; - if (_outdoorPositions.TryGetValue( - id, - out int outdoorPosition)) - { - _outdoor[outdoorPosition] = - _outdoor[outdoorPosition] with - { - DirtyMask = RenderDirtyMask.None, - }; - } if (_dynamicPositions.TryGetValue( id, out int dynamicPosition)) @@ -1289,103 +1275,13 @@ internal sealed class RenderScenePViewFrameBuilder positions.Add(records[index].Id, index); } - private void BuildOutdoorRoutes( - RenderFrameWriter writer, - in RenderScenePViewBuildInput input) - { - int sliceCount = input.ClipAssembly.OutsideViewSlices.Length; - for (int sliceIndex = 0; sliceIndex < sliceCount; sliceIndex++) - { - int count = 0; - EnsureCapacity(ref _survivors, _outdoorCount); - for (int i = 0; i < _outdoorCount; i++) - { - RenderProjectionRecord record = _outdoor[i]; - if (record.EntityPayload.IsBuildingShell - && RetailPViewRenderer.FindLookInFrameIndex( - record.Source.BuildingShellAnchorCellId, - input.LookInFrames, - input.Cells) >= 0) - { - continue; - } - Sphere(in record, out Vector3 center, out float radius); - if (!input.Viewcone.SphereVisibleInOutsideSlice( - sliceIndex, - in center, - radius)) - { - continue; - } - - _survivors[count++] = record; - writer.AddOutdoor(in record); - AddProjection( - writer, - in record, - input.AnimatedEntityIds); - } - - writer.AddRouteRange( - RenderFrameCandidateRoute.LandscapeOutdoorStatic, - sliceIndex, - 0, - _survivors.AsSpan(0, count)); - } - } - - private void BuildLookInBuildingShellRoutes( - RenderFrameWriter writer, - in RenderScenePViewBuildInput input, - int frameIndex) - { - int sliceCount = input.ClipAssembly.OutsideViewSlices.Length; - for (int sliceIndex = 0; sliceIndex < sliceCount; sliceIndex++) - { - int count = 0; - EnsureCapacity(ref _survivors, _outdoorCount); - for (int i = 0; i < _outdoorCount; i++) - { - RenderProjectionRecord record = _outdoor[i]; - if (!record.EntityPayload.IsBuildingShell - || RetailPViewRenderer.FindLookInFrameIndex( - record.Source.BuildingShellAnchorCellId, - input.LookInFrames, - input.Cells) != frameIndex) - { - continue; - } - - Sphere(in record, out Vector3 center, out float radius); - if (!input.Viewcone.SphereVisibleInOutsideSlice( - sliceIndex, - in center, - radius)) - { - continue; - } - - _survivors[count++] = record; - writer.AddOutdoor(in record); - AddProjection( - writer, - in record, - input.AnimatedEntityIds); - } - - int routeIndex = - RetailPViewRenderer.LookInBuildingShellRouteIndex( - frameIndex, - sliceCount, - sliceIndex); - writer.AddRouteRange( - RenderFrameCandidateRoute.LandscapeBuildingShell, - routeIndex, - 0, - _survivors.AsSpan(0, count)); - } - } - + /// Campaign FW3.2b-2: LookInObject now carries DYNAMIC + /// candidates only — the walk draws every look-in cell's STATIC content + /// directly (WalkFrameDriver's LookInStatic turn, via + /// WalkProductionWorldData.GetCellStatics), so loading this + /// route's cell contents with includeStatics: false is what keeps + /// the two draws from doubling a look-in room's furniture (plan §FW3 + /// item 3). private void BuildLookInRoutes( RenderFrameWriter writer, in RenderScenePViewBuildInput input, @@ -1408,6 +1304,7 @@ internal sealed class RenderScenePViewFrameBuilder int count = LoadCell( input.Scene, cellId, + includeStatics: false, includeDynamics: true); for (int sliceIndex = 0; sliceIndex < slices.Length; sliceIndex++) { @@ -1437,6 +1334,9 @@ internal sealed class RenderScenePViewFrameBuilder return; int sliceCount = input.ClipAssembly.OutsideViewSlices.Length; + bool probeDynamics = + AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled + && ++_probeDynFrameCounter % 120 == 0; for (int sliceIndex = 0; sliceIndex < sliceCount; sliceIndex++) { int count = 0; @@ -1445,19 +1345,23 @@ internal sealed class RenderScenePViewFrameBuilder { RenderProjectionRecord record = _dynamics[i]; Sphere(in record, out Vector3 center, out float radius); - if (!RetailPViewRenderer.DynamicDrawsInOutsideStage( - ParentCell(in record), - center, - radius, - input.DrawableCells, - input.Cells) - || !input.Viewcone.SphereVisibleInOutsideSlice( - sliceIndex, - in center, - radius)) + bool outside = RetailPViewRenderer.DynamicDrawsInOutsideStage( + ParentCell(in record), + center, + radius, + input.DrawableCells, + input.Cells); + bool cone = input.Viewcone.SphereVisibleInOutsideSlice( + sliceIndex, in center, radius); + if (probeDynamics) { - continue; + Console.WriteLine( + $"[walk-dyn] slice={sliceIndex} id={record.Source.LocalEntityId:x} " + + $"parent={ParentCell(in record)?.ToString("x8") ?? "null"} " + + $"r={radius:F1} outside={(outside ? 1 : 0)} cone={(cone ? 1 : 0)}"); } + if (!outside || !cone) + continue; _survivors[count++] = record; writer.AddDynamic(in record); @@ -1475,61 +1379,6 @@ internal sealed class RenderScenePViewFrameBuilder } } - private void BuildCellStaticRoute( - RenderFrameWriter writer, - in RenderScenePViewBuildInput input) - { - _cellRouteCount = 0; - IReadOnlyList ordered = input.PortalFrame.OrderedVisibleCells; - for (int i = ordered.Count - 1; i >= 0; i--) - { - uint cellId = ordered[i]; - if (!input.DrawableCells.Contains(cellId)) - continue; - - int loaded = LoadCell( - input.Scene, - cellId, - includeDynamics: false); - int count = 0; - for (int index = 0; index < loaded; index++) - { - RenderProjectionRecord record = _cell[index]; - Sphere(in record, out Vector3 center, out float radius); - if (!input.Viewcone.SphereVisibleInCell( - cellId, - in center, - radius)) - { - continue; - } - - _cell[count++] = record; - AddProjection( - writer, - in record, - input.AnimatedEntityIds); - } - - writer.AddCellRange( - cellId, - i, - _cell.AsSpan(0, count)); - EnsureCapacity( - ref _cellRoute, - checked(_cellRouteCount + count)); - _cell.AsSpan(0, count).CopyTo( - _cellRoute.AsSpan(_cellRouteCount)); - _cellRouteCount += count; - } - - writer.AddRouteRange( - RenderFrameCandidateRoute.CellStatic, - 0, - 0, - _cellRoute.AsSpan(0, _cellRouteCount)); - } - private void BuildDynamicLastRoute( RenderFrameWriter writer, in RenderScenePViewBuildInput input) @@ -1561,7 +1410,47 @@ internal sealed class RenderScenePViewFrameBuilder // would draw it after the boundary alpha drain and overpaint // nearer flames (the Holtburg candle-behind-door class). if (indoor && _lookInCellScratch.Contains(parentCellId!.Value)) + { + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + { + string state = $"parent={parentCellId.Value:x8} lookin-excluded"; + if (!_probeDynRouteStates.TryGetValue(record.Source.LocalEntityId, out string? prev) + || prev != state) + { + _probeDynRouteStates[record.Source.LocalEntityId] = state; + Console.WriteLine( + $"[dyn-route] id={record.Source.LocalEntityId:x} {state}"); + } + } continue; + } + + // The stage-set split (synthesis plan step 4, [dyn-route]-pinned + // 2026-08-30): an interior-parented dynamic rides the LAST pass + // ONLY when its parent cell is in THE WALK'S OWN ROOT FLOOD. + // Retail draws a look-in cell's occupants inside the landscape + // stage through the composed portal chain, and an unreachable + // cell's occupants not at all — the legacy visibility builder + // invents cross-building cell views at the cathedral (real + // 3-5-plane cones for 0xF4180112 from roots with no sightline), + // which let a remote player draw post-clear/post-world through + // opaque walls. The walk's flood is oracle-trace-conformant; + // key the route on it. + if (indoor && !input.RootFloodCells.Contains(parentCellId!.Value)) + { + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled) + { + string state = $"parent={parentCellId.Value:x8} rootflood-excluded"; + if (!_probeDynRouteStates.TryGetValue(record.Source.LocalEntityId, out string? prev) + || prev != state) + { + _probeDynRouteStates[record.Source.LocalEntityId] = state; + Console.WriteLine( + $"[dyn-route] id={record.Source.LocalEntityId:x} {state}"); + } + } + continue; + } Sphere(in record, out Vector3 center, out float radius); bool visible = indoor @@ -1572,6 +1461,25 @@ internal sealed class RenderScenePViewFrameBuilder : input.Viewcone.SphereVisibleOutside( in center, radius); + // ACDREAM_PROBE_WALK_ROOT companion (throwaway): the DynamicLast + // admission trace for the through-wall remote-player report — + // per entity, ON CHANGE: parent cell, look-in exclusion, the + // viewcone verdict, and the cell's lifted-plane shape ("0" = a + // pass-all zero-plane slice — the scissor-fallback trapdoor). + if (AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled + && indoor) + { + string state = + $"parent={parentCellId!.Value:x8} vis={(visible ? 1 : 0)} " + + $"cone={input.Viewcone.ProbeDescribeCell(parentCellId.Value)}"; + if (!_probeDynRouteStates.TryGetValue(record.Source.LocalEntityId, out string? prev) + || prev != state) + { + _probeDynRouteStates[record.Source.LocalEntityId] = state; + Console.WriteLine( + $"[dyn-route] id={record.Source.LocalEntityId:x} {state} route=DynamicLast"); + } + } if (!visible) continue; @@ -1593,18 +1501,25 @@ internal sealed class RenderScenePViewFrameBuilder private int LoadCell( RenderSceneQuery scene, uint cellId, - bool includeDynamics) + bool includeDynamics, + bool includeStatics = true) { - int staticCount = scene.GetCellStaticCount(cellId); + int staticCount = includeStatics + ? scene.GetCellStaticCount(cellId) + : 0; int dynamicCount = includeDynamics ? scene.GetCellDynamicCount(cellId) : 0; EnsureCapacity( ref _cell, checked(staticCount + dynamicCount)); - int count = scene.CopyCellStaticsTo( - cellId, - _cell.AsSpan(0, staticCount)); + int count = 0; + if (staticCount > 0) + { + count = scene.CopyCellStaticsTo( + cellId, + _cell.AsSpan(0, staticCount)); + } if (dynamicCount > 0) { count += scene.CopyCellDynamicsTo( diff --git a/src/AcDream.App/Rendering/TerrainModernRenderer.DirectionalShadowReceivers.cs b/src/AcDream.App/Rendering/TerrainModernRenderer.DirectionalShadowReceivers.cs index 8ec70656..97a10be4 100644 --- a/src/AcDream.App/Rendering/TerrainModernRenderer.DirectionalShadowReceivers.cs +++ b/src/AcDream.App/Rendering/TerrainModernRenderer.DirectionalShadowReceivers.cs @@ -41,7 +41,10 @@ public sealed partial class TerrainModernRenderer VertexLayout = TerrainVertexLayout, Topology = GpuPrimitiveTopology.TriangleList, Blend = GpuBlendMode.None, - Depth = new GpuDepthState(true, true, GpuCompareOp.Less), + // WorldDepthContract.WorldCompare — see that type for the + // world-space GL_LESS citation this receiver pipeline shares + // with terrain's own base pass. + Depth = new GpuDepthState(true, true, WorldDepthContract.WorldCompare), Cull = GpuCullMode.Back, FrontFace = GpuFrontFace.CounterClockwise, AlphaToCoverage = false, diff --git a/src/AcDream.App/Rendering/TerrainModernRenderer.Rhi.cs b/src/AcDream.App/Rendering/TerrainModernRenderer.Rhi.cs index 0d9a0f0d..4ca62c12 100644 --- a/src/AcDream.App/Rendering/TerrainModernRenderer.Rhi.cs +++ b/src/AcDream.App/Rendering/TerrainModernRenderer.Rhi.cs @@ -85,12 +85,14 @@ public sealed unsafe partial class TerrainModernRenderer VertexLayout = TerrainVertexLayout, Topology = GpuPrimitiveTopology.TriangleList, Blend = GpuBlendMode.None, - // GL_LESS, not the contract's LessOrEqual default: the world frame - // runs under GL_LESS and terrain never called glDepthFunc, so it - // inherited it. LessOrEqual would change which of two coplanar retail - // surfaces wins — visible exactly where terrain meets roads and - // building footings, which is what zFightTerrainAdjust is about. - Depth = new GpuDepthState(Test: true, Write: true, GpuCompareOp.Less), + // WorldDepthContract.WorldCompare (GL_LESS), not the contract's + // LessOrEqual default: the world frame runs under GL_LESS and + // terrain never called glDepthFunc, so it inherited it. LessOrEqual + // would change which of two coplanar retail surfaces wins — visible + // exactly where terrain meets roads and building footings, which is + // what zFightTerrainAdjust is about. See WorldDepthContract for the + // full citation. + Depth = new GpuDepthState(Test: true, Write: true, WorldDepthContract.WorldCompare), // #108-residual: retail terrain is SINGLE-SIDED. See the GL arm's // Draw for the full reasoning; this bakes the same triple. Cull = GpuCullMode.Back, diff --git a/src/AcDream.App/Rendering/ViewconeCuller.cs b/src/AcDream.App/Rendering/ViewconeCuller.cs index d686deeb..572c8b50 100644 --- a/src/AcDream.App/Rendering/ViewconeCuller.cs +++ b/src/AcDream.App/Rendering/ViewconeCuller.cs @@ -166,6 +166,23 @@ public sealed class ViewconeCuller return true; } + /// ACDREAM_PROBE_WALK_ROOT companion (throwaway): a cell's + /// lifted-plane shape for the [dyn-route] admission trace — "none" + /// (culls), or per-slice plane counts ("0" = a pass-all zero-plane + /// slice, the scissor-fallback trapdoor). + internal string ProbeDescribeCell(uint cellId) + { + if (!_cellPlanes.TryGetValue(cellId, out PlaneSet? set)) + return "none"; + var sb = new System.Text.StringBuilder(); + for (int s = 0; s < set.Slices.Count; s++) + { + if (sb.Length > 0) sb.Append('+'); + sb.Append(set.Slices[s].Count); + } + return sb.Length == 0 ? "empty" : sb.ToString(); + } + /// Sphere-vs-the-cell's-views: visible when any slice passes. /// A cell with no views culls (not in the draw list ⇒ never reached in /// retail). A zero-plane slice is pass-all. diff --git a/src/AcDream.App/Rendering/Walk/LandWalkOrder.cs b/src/AcDream.App/Rendering/Walk/LandWalkOrder.cs new file mode 100644 index 00000000..4aef0c69 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/LandWalkOrder.cs @@ -0,0 +1,163 @@ +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW1 — retail's landscape draw-order machinery, ported from the +/// named 2013 decomp (model: docs/research/2026-08-30-fw-walk-pseudocode.md §3). +/// +/// Retail enumerates viewer-centered Chebyshev rings with one shared 8-slot +/// coefficient pattern at BOTH grid levels: LScape::get_block_order +/// @0x00504c50 builds the landblock draw list NEAR-TO-FAR (viewer block at +/// index 0; LScape::draw @0x00506330 then walks it BACKWARDS = +/// far-to-near), and CLandBlock::calc_sq_draw_order @0x0052f4a0 fills +/// the per-block cell array BACKWARDS from the closest cell (forward walk = +/// far-to-near). The coefficient tables were byte-decoded from the +/// PDB-paired binary (block tables VA 0x0081cc6c..0x0081cd2b, cell tables +/// VA 0x0081df88..0x0081e047 — the two sets are IDENTICAL). +/// +public static class LandWalkOrder +{ + // The shared 8-slot ring pattern. For ring r, step s (0..r-1), slot k + // emits offset (dx, dy) = (XStep[k]*s + XRing[k]*r + XConst[k], + // YStep[k]*s + YRing[k]*r + YConst[k]). + // Expanded: (-s,+r) (-r,-s) (+s,-r) (+r,+s) (+s+1,+r) (-r,+s+1) + // (-s-1,-r) (+r,-s-1) — tiles each ring's 8r slots exactly once. + // Byte-decoded 2026-08-30; do not "simplify" the visit order — it decides + // draw order between equidistant blocks/cells and the oracle traces pin it. + private static readonly int[] XConst = [0, 0, 0, 0, 1, 0, -1, 0]; + private static readonly int[] XRing = [0, -1, 0, 1, 0, -1, 0, 1]; + private static readonly int[] XStep = [-1, 0, 1, 0, 1, 0, -1, 0]; + private static readonly int[] YConst = [0, 0, 0, 0, 0, 1, 0, -1]; + private static readonly int[] YStep = [0, -1, 0, 1, 0, 1, 0, -1]; + private static readonly int[] YRing = [1, 0, -1, 0, 1, 0, -1, 0]; + + /// + /// LScape::get_block_order @0x00504c50: fills + /// with grid slots (x * width + y) near-to-far — + /// the viewer's slot first, then rings outward, skipping out-of-bounds + /// slots. Returns the number of slots written (= width² when the viewer + /// is inside the grid). The caller draws by walking the result BACKWARDS. + /// + public static int GetBlockOrder(int viewerX, int viewerY, int width, Span order) + { + int count = 0; + order[count++] = viewerX * width + viewerY; + int maxRing = MaxRingTo(viewerX, viewerY, width, width); + for (int ring = 1; ring <= maxRing; ring++) + { + for (int step = 0; step < ring; step++) + { + for (int slot = 0; slot < 8; slot++) + { + int x = XStep[slot] * step + XRing[slot] * ring + XConst[slot] + viewerX; + int y = YStep[slot] * step + YRing[slot] * ring + YConst[slot] + viewerY; + if (x >= 0 && x < width && y >= 0 && y < width) + order[count++] = x * width + y; + } + } + } + return count; + } + + /// + /// CLandBlock::calc_sq_draw_order @0x0052f4a0 (ring half): fills + /// with cell slots (x * side + y) so that a + /// FORWARD walk visits cells far-to-near — the closest cell is written to + /// the LAST index and rings fill backwards from there. The array is + /// exactly filled (retail's --k reaches 0). + /// + public static void FillCellOrderFarToNear(int closestX, int closestY, int side, Span order) + { + int k = side * side; + order[--k] = closestX * side + closestY; + int maxRing = MaxRingTo(closestX, closestY, side, side); + for (int ring = 1; ring <= maxRing; ring++) + { + for (int step = 0; step < ring; step++) + { + for (int slot = 0; slot < 8; slot++) + { + int x = XStep[slot] * step + XRing[slot] * ring + XConst[slot] + closestX; + int y = YStep[slot] * step + YRing[slot] * ring + YConst[slot] + closestY; + if (x >= 0 && x < side && y >= 0 && y < side) + order[--k] = x * side + y; + } + } + } + } + + /// + /// LandDefs::get_dir @0x005a9aa0: compass direction of a block at + /// grid offset (dx, dy) from the viewer's block. Lcoord y grows northward. + /// + public static LandDirection GetDirection(int dx, int dy) + { + if (dx < 0) + { + if (dy < 0) return LandDirection.SouthWest; + return dy > 0 ? LandDirection.NorthWest : LandDirection.West; + } + if (dx == 0) + { + if (dy < 0) return LandDirection.South; + return dy > 0 ? LandDirection.North : LandDirection.InViewerBlock; + } + if (dy < 0) return LandDirection.SouthEast; + return dy > 0 ? LandDirection.NorthEast : LandDirection.East; + } + + /// + /// CLandBlock::calc_sq_draw_order @0x0052f4a0 (direction switch, + /// jump table @0x0052f8e0): the block's cell nearest the viewer, given the + /// block's compass direction from the viewer. For the viewer's own block + /// the viewer's cell coordinate (cell & 7 per axis) is scaled by + /// 8/side; for other blocks the facing edge/corner is closest. + /// + public static (int X, int Y) ClosestCell( + LandDirection dir, int viewerSqX, int viewerSqY, int side) + { + int scale = 8 / side; + return dir switch + { + LandDirection.InViewerBlock => (viewerSqX / scale, viewerSqY / scale), + LandDirection.North => (viewerSqX / scale, 0), + LandDirection.South => (viewerSqX / scale, side - 1), + LandDirection.East => (0, viewerSqY / scale), + LandDirection.West => (side - 1, viewerSqY / scale), + LandDirection.NorthWest => (side - 1, 0), + LandDirection.SouthWest => (side - 1, side - 1), + LandDirection.NorthEast => (0, 0), + LandDirection.SouthEast => (0, side - 1), + _ => throw new ArgumentOutOfRangeException(nameof(dir)), + }; + } + + // get_block_order's branchy max computation @0x00504ca0-0x00504cba: + // the largest Chebyshev distance from (x, y) to any grid corner — + // max(x, y, width-1-x, height-1-y, ...) — which guarantees the ring sweep + // reaches every in-bounds slot. + private static int MaxRingTo(int x, int y, int width, int height) + { + int max = x; + if (y > max) max = y; + if (width - 1 - x > max) max = width - 1 - x; + if (height - 1 - y > max) max = height - 1 - y; + return max; + } +} + +/// +/// LandDefs::Direction (retail enum, values used raw by the +/// calc_sq_draw_order jump table @0x0052f8e0). +/// +public enum LandDirection +{ + InViewerBlock = 0, + North = 1, + South = 2, + East = 3, + West = 4, + NorthWest = 5, + SouthWest = 6, + NorthEast = 7, + SouthEast = 8, +} diff --git a/src/AcDream.App/Rendering/Walk/OrderedDrawStream.cs b/src/AcDream.App/Rendering/Walk/OrderedDrawStream.cs new file mode 100644 index 00000000..11565a33 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/OrderedDrawStream.cs @@ -0,0 +1,180 @@ +using System.Numerics; +using AcDream.App.Rendering.Wb; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW stage FW2 — retail's frame phases, in the order the walk +/// visits them. RetailPViewPassExecutor's packed route contract +/// (RenderFrameCandidateRoute: LandscapeOutdoorStatic → +/// LandscapeBuildingShell → LookInObject → LandscapeOutsideDynamic → +/// CellStatic → DynamicLast — WbDrawDispatcher.PackedOracle.cs:108/171 +/// enforces in-order consumption today) is the closest existing analogue; +/// this enum is the walk submitter's OWN phase vocabulary, and a merge run +/// built by may never +/// span two different stages — the submitter treats a stage boundary exactly +/// like a material-state boundary (see +/// docs/plans/2026-08-30-campaign-fw-frame-walk.md §FW2). +/// +internal enum WalkDrawStage : byte +{ + /// LScape::draw @0x00506330 / + /// LScape::grab_visible_cells @0x00504EC0 — outdoor terrain. + Terrain, + + /// + /// Campaign FW stage FW3.2a: the outdoor static objects (scenery, + /// buildings-as-decor, landblock statics — + /// RenderProjectionClass.OutdoorStatic) LScape::draw visits + /// for each landblock alongside its terrain mesh — retail's landscape + /// walk draws a landblock's ground and its static content in the same + /// pass, distinct from the ground mesh itself () and + /// from a building's own exterior shell (). + /// The packed route's analogue is + /// RenderFrameCandidateRoute.LandscapeOutdoorStatic + /// (WbDrawDispatcher.PackedOracle.cs). + /// + OutdoorStatic, + + /// An indoor PView::DrawCells @0x005A4840 flood's static + /// geometry: EnvCell shells plus the static meshes they contain. + CellStatic, + + /// DrawBuilding's (RenderDeviceD3D::DrawBuilding + /// @0x0059f2a0) exterior shell pass. + BuildingShell, + + /// + /// DrawPortalPolyInternal's depth-only invisible portal-polygon + /// panel — punch far-Z / seal own-depth. FW0 confirmed retail actually + /// draws these every frame (not an acdream invention); the AD-117 stamps + /// re-invented the mechanism at the wrong site. + /// + /// No FW2 submission path exists yet. + /// throws + /// if a command carries this + /// stage — punch geometry emission lands in FW3 with the world wiring. + /// The stage exists now purely so stage-separation gates can exercise the + /// boundary before the real emission path is built. + /// + PortalPunch, + + /// ConstructView(CBldPortal) look-in static geometry — + /// what an exterior building's window or doorway reveals of its own + /// interior. + LookInStatic, + + /// Every non-static draw the walk visits last: entities, + /// monsters, items, and the meshes particles ride. + Dynamic, +} + +/// +/// One walk-ordered draw command. The nine fields after and +/// are exactly the per-instance data +/// WbDrawDispatcher.PrepareDeferredAlphaDraws's +/// DeferredAlphaInstance carries — that method is the per-instance-first +/// SSBO-layout template FW2's submitter follows — plus the walk provenance +/// (, ) the submitter needs to know +/// where a merge run may and may not cross a boundary. +/// +/// Mesh-subset and material identity: index range, texture +/// slot/layer, translucency, foliage flags, cull mode. The same +/// the classic material-bucketed path groups instances +/// by — FW2 does not bucket by it, only reads its fields per instance. +/// World transform. Storage binding 0 +/// (StorageInstances). +/// The retail frame phase this command belongs to. A +/// merge run may never span two different stages. +/// Walk-order provenance: which cell's traversal emitted +/// this command. Not bound to any GPU storage section today — carried for +/// FW3's portal-punch wiring and for diagnostics. +/// Storage binding 3 (StorageClipSlots). +/// Storage binding 5 (StorageInstanceLightSets). +/// Storage binding 6 (StorageInstanceIndoor). +/// Storage binding 7 (StorageInstanceAlpha). +/// Storage binding 8 +/// (StorageInstanceSelectionLighting). +/// Storage binding 9 +/// (StorageInstanceDetailCategory). A nonzero value forces this +/// command into a solo merge run — mirrors the deferred-alpha detail break in +/// WbDrawDispatcher.DrawPreparedAlphaBatchRhi. +internal readonly record struct OrderedDrawCommand( + GroupKey Key, + Matrix4x4 Transform, + WalkDrawStage Stage, + uint CellId, + uint ClipSlot, + WbDrawDispatcher.InstanceLightSet Lights, + uint IndoorFlag, + float Alpha, + Vector2 SelectionLighting, + uint DetailCategory); + +/// +/// Append-only, walk-ordered draw-command stream. Struct-of-arrays storage — +/// one parallel list per field, the same +/// shape as 's per-instance lists +/// — so can walk the stream +/// by index instead of allocating one boxed command per instance. +/// +/// The stream carries no ordering logic of its own: reading it back is +/// exactly the sequence was called in, unconditionally. +/// That is the campaign invariant this type exists to make impossible to +/// silently regress — see +/// docs/plans/2026-08-30-campaign-fw-frame-walk.md §FW2's "a merge across a +/// state or stage boundary is forbidden by construction (assert it)" rule. +/// +internal sealed class OrderedDrawStream +{ + public readonly List Keys = new(); + public readonly List Transforms = new(); + public readonly List Stages = new(); + public readonly List CellIds = new(); + public readonly List ClipSlots = new(); + public readonly List Lights = new(); + public readonly List IndoorFlags = new(); + public readonly List Alphas = new(); + public readonly List SelectionLighting = new(); + public readonly List DetailCategories = new(); + + /// Number of commands appended since the last . + public int Count => Keys.Count; + + public void Append(in OrderedDrawCommand command) + { + Keys.Add(command.Key); + Transforms.Add(command.Transform); + Stages.Add(command.Stage); + CellIds.Add(command.CellId); + ClipSlots.Add(command.ClipSlot); + Lights.Add(command.Lights); + IndoorFlags.Add(command.IndoorFlag); + Alphas.Add(command.Alpha); + SelectionLighting.Add(command.SelectionLighting); + DetailCategories.Add(command.DetailCategory); + } + + /// + /// Clears every parallel list together, in one method. The established + /// #193 lesson (WbDrawDispatcher.InstanceGroup.ClearPerInstanceData + /// carries the same remark): a stream with N parallel lists that resets + /// them independently can leave one list stale relative to the others + /// after a future field is added and its clear call forgotten — and a + /// stale list that only ever grows leaks unboundedly. Ten lists, one + /// reset call, so a new eleventh list has nowhere to hide from it. + /// + public void Reset() + { + Keys.Clear(); + Transforms.Clear(); + Stages.Clear(); + CellIds.Clear(); + ClipSlots.Clear(); + Lights.Clear(); + IndoorFlags.Clear(); + Alphas.Clear(); + SelectionLighting.Clear(); + DetailCategories.Clear(); + } +} diff --git a/src/AcDream.App/Rendering/Walk/RetailFrameWalk.cs b/src/AcDream.App/Rendering/Walk/RetailFrameWalk.cs new file mode 100644 index 00000000..52b5cdfe --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/RetailFrameWalk.cs @@ -0,0 +1,297 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// The composition context: the cell/building halves plus the +/// frame-level state retail keeps in globals (the CY near plane from +/// Render::update_viewpoint, and the active-view installation the +/// building clip consumes). +public interface IRetailFrameWalkContext : IWalkBuildingFrameContext +{ + WalkPlane CyPlane { get; } + + /// Render::set_view at the frame level: install view + /// of as the active + /// clip context for subsequent building-polygon clips. + void SetActiveView(WalkPortalView views, int index); + + float ViewportWidth { get; } + float ViewportHeight { get; } +} + +/// +/// Campaign FW1 — the frame walk root, composing the ported machinery into +/// retail's frame shapes (model: +/// docs/research/2026-08-30-fw-walk-pseudocode.md §1, §3-§5; oracle: +/// docs/research/2026-08-30-fw-walk-oracle/README.md): +/// +/// +/// Rooting (SmartBox::RenderNormalMode @0x00453aa0): the +/// CAMERA cell's low word < 0x100 → outdoor root (default full-screen +/// view + the landscape walk); otherwise → DrawInside. +/// Outdoor (LScape::draw @0x00506330): visibility per view, +/// blocks far-to-near, per-block cells far-to-near, buildings at their +/// cell's turn with the two-pass portal machinery (punches + look-ins on +/// the OUTDOOR pview — the traces' pv=009d4b08 ov=0). +/// Interior (PView::DrawInside @0x005a5860 + +/// DrawCells @0x005a4840): the flood on the INTERIOR pview +/// (pv=009d4a80), then the landscape drawn THROUGH the exit views +/// when any survive (ov>0). +/// +/// +/// Two PView instances exist exactly as the live traces showed. +/// +public sealed class RetailFrameWalk +{ + private readonly WalkPView _interiorPView = new(); + // The outdoor pview never draws the landscape through its look-in + // floods (the landscape is already drawn when buildings punch), so its + // draw_landscape is FALSE and look-in DCs always read ov=0 — exactly + // the pv=…/ov=0 pattern of every look-in in the oracle traces. + private readonly WalkPView _outdoorPView = new() { DrawLandscape = false }; + private readonly WalkPortalView _defaultView = new(); + + public WalkPView InteriorPView => _interiorPView; + public WalkPView OutdoorPView => _outdoorPView; + + /// Retail global alwaysDrawObjects (.data default 1 + /// @0x00820ed4): cell contents draw for every cell of an in-view block + /// regardless of per-cell visibility. + public bool AlwaysDrawObjects = true; + + /// Retail global Render::deg_mul — DYNAMIC: the + /// auto-tuner (auto_update_deg_mul) swings it with frame load + /// (positive ⇒ degrade thresholds slide toward each level's max; + /// negative ⇒ toward its min). The oracle captures pin ≈+0.99 for every + /// fixture except doorway-still, whose capture ran under cdb load with + /// the multiplier depressed (the recon session's live dump read −0.99 + /// under the same conditions). + public float DegradeMultiplier = WalkBuilding.DefaultDegradeMultiplier; + + /// FW4 slice 1: the interior root's outside_view — the + /// exit-view polygons THIS walk's own ConstructView installed + /// during the most recent . The production + /// renderer materializes the frame's terrain/sky/punch clip slices from + /// these views (retail has exactly one visibility structure; the old + /// PortalVisibilityBuilder assembly no longer feeds the walk path's + /// outside views). Valid after returns for an + /// interior root, until the next interior root's view push resets it. + internal WalkPortalView InteriorOutsideView => _interiorPView.OutsideView; + + /// The per-frame root (SmartBox::RenderNormalMode). + /// may be null only when the camera is + /// outdoors. + public void WalkFrame( + uint cameraCellId, WalkCell? cameraCell, WalkLandscape landscape, + IRetailFrameWalkContext ctx, IWalkEventSink sink) + { + if ((cameraCellId & 0xFFFF) < 0x100) + { + // Render::set_default_view @0x0054ef50: the full-screen quad view. + _defaultView.ResetForPush(); + WalkCopyView.AppendFullViewportQuad( + _defaultView, ctx.Rays, ctx.WorldViewpoint, + ctx.ViewportWidth, ctx.ViewportHeight); + DrawLandscape(landscape, _defaultView, ctx, sink); + } + else + { + DrawInside( + cameraCell ?? throw new ArgumentNullException(nameof(cameraCell)), + landscape, ctx, sink); + } + } + + /// PView::DrawInside + the event half of + /// DrawCells. The geometry/object passes emit no walk events. + /// PView::DrawCells @0x005a4840's actual DRAW order for the root + /// flood is NOT the order its events fire in: the + /// + /// call below fires at breakpoint-ENTRY order (matching the FW0 oracle + /// traces, whose breakpoint sat at DrawCells entry — before + /// retail has drawn anything), but retail itself draws + /// LScape::draw FIRST (pc:432719, only when exit views survived), + /// then a gated full depth clear (pc:432731-432732), then the exit- + /// portal seals (pc:432785-432786), and ONLY THEN the flood's own cells + /// far-to-near. + /// fires at that later point (see its own doc comment). + public void DrawInside( + WalkCell cell, WalkLandscape landscape, + IRetailFrameWalkContext ctx, IWalkEventSink sink) + { + sink.Emit(WalkEvent.DrawInside(cell.CellId)); + cell.PushView(); + AddViews(cell.StabList, ctx); + WalkCopyView.AppendFullViewportQuad( + cell.TopView, ctx.Rays, ctx.WorldViewpoint, + ctx.ViewportWidth, ctx.ViewportHeight); + _interiorPView.ConstructView(cell, 0xFFFF, ctx.CellContext); + + uint[] floodCells = EmitDrawCells(_interiorPView, sink); + if (_interiorPView.OutsideView.ViewCount > 0) + DrawLandscape(landscape, _interiorPView.OutsideView, ctx, sink); + + // Additive (Campaign FW3.2b-1): see this method's own doc comment — + // the flood's actual cell-drawing turn, unconditional of whether a + // landscape turn just ran (ov==0 skips straight here from the DC + // event above). + sink.OnInteriorFloodDrawTurn(floodCells); + + RemoveViews(cell.StabList, ctx); + cell.PopView(); + } + + /// LScape::draw: visibility per active view, then blocks + /// far-to-near, cells far-to-near, buildings at their cell's turn. + public void DrawLandscape( + WalkLandscape landscape, WalkPortalView activeViews, + IRetailFrameWalkContext ctx, IWalkEventSink sink) + { + sink.Emit(WalkEvent.Landscape(activeViews.ViewCount)); + landscape.CalcDrawOrder(); + landscape.CheckBlocks(ctx.CyPlane, activeViews); + + for (int i = landscape.BlockDrawCount - 1; i >= 0; i--) + { + WalkLandBlock? block = landscape.Blocks[landscape.BlockDrawList[i]]; + if (block is null || block.InView == WalkBoundingType.Outside) + continue; + int cellCount = block.SideCellCount * block.SideCellCount; + for (int k = 0; k < cellCount; k++) + { + int cellIndex = block.DrawArray[k]; + // RenderDeviceD3D::DrawBlock @0x005a19d9: DrawSortCell runs + // when alwaysDrawObjects != 0 (retail .data default 1 + // @0x00820ed4) OR the cell IsInView; terrain (DrawLandCell) + // emits no walk event. + if (!AlwaysDrawObjects + && block.CellInView[cellIndex] == WalkBoundingType.Outside) + { + continue; + } + // RenderDeviceD3D::DrawSortCell @0x0059f140 (decomp- + // confirmed 2026-08-30): DrawBuilding(building) FIRST, then + // DrawObjCell(cell) UNCONDITIONALLY — the building's turn + // (shell + portal machinery) precedes this cell's own + // outdoor-static turn. + if (block.CellBuildings[cellIndex] is WalkBuilding building) + DrawBuilding(building, activeViews, ctx, sink); + sink.OnLandscapeCellTurn((block.LandblockId & 0xFFFF0000u) | (uint)(cellIndex + 1)); + } + } + } + + /// RenderDeviceD3D::DrawBuilding @0x0059f2a0 at the walk + /// level: the BLD event fires at ENTRY (before the degrade check — the + /// oracle traces' breakpoint sat there, so this stays unconditional for + /// conformance). The ENTIRE rest of the body — the alpha barrier, the + /// portal pass, and the shell draw — sits inside retail's + /// if (part->gfxobj[part->deg_level] != 0) @0x0059f2d3; a + /// degraded-out slot draws NOTHING beyond the BLD event. + /// HasGeometry + a non-null SelectDrawingBsp together model + /// that one gate. Inside the gate, retail's own order + /// (@0x0059f30b–0x0059f345) is D3DPolyRender::FlushAlphaList(0f) → + /// CPhysicsPart::Draw(parts, 1) (the PORTAL flavor — the two-pass + /// punch/look-in walk below) → CPhysicsPart::Draw(parts, 0) (the + /// plain mesh — the building's own SHELL) → flag reset: the alpha + /// barrier and the portal pass both precede the shell draw, not follow + /// it. + public void DrawBuilding( + WalkBuilding building, WalkPortalView activeViews, + IRetailFrameWalkContext ctx, IWalkEventSink sink) + { + sink.Emit(WalkEvent.Building(building.PositionCellId)); + if (!building.HasGeometry) return; + // Retail walks the CURRENT degrade level's drawing BSP + // (part->gfxobj[deg_level]); a degraded-out slot skips everything + // after publishing the portal list. + WalkBspNode? bsp = building.SelectDrawingBsp( + ctx.ViewerDistanceTo(building), + degradeMultiplier: DegradeMultiplier); + if (bsp is null) return; + + // Additive (Campaign FW3.2b-1): the alpha barrier + // (D3DPolyRender::FlushAlphaList(0f) @0x0059f30b) — gated by the + // SAME part->gfxobj[deg_level]!=0 check as everything below it, so + // this fires only now that both HasGeometry and the bsp lookup have + // passed. + sink.OnBuildingTurn(building); + + int viewCount = Math.Max(activeViews.ViewCount, 0); + var passSink = new PortalPassSink(building, sink); + Vector3 viewpoint = ctx.ViewpointInBuilding(building); + for (int v = 0; v < viewCount; v++) + { + // Retail pins building_view = the CURRENT view for the whole + // two-pass walk (DrawMeshInternal @0x0059f3bf) — the punch fans + // it emits clip against THAT view, so the sink carries the index. + passSink.ActiveViewIndex = v; + ctx.SetActiveView(activeViews, v); + WalkBuildingPortals.BuildDrawPortalsOnly( + bsp, 1, viewpoint, + (portalRef, pass) => WalkBuildingPortals.DrawPortal( + _outdoorPView, building, portalRef, pass, ctx, passSink)); + WalkBuildingPortals.BuildDrawPortalsOnly( + bsp, 2, viewpoint, + (portalRef, pass) => WalkBuildingPortals.DrawPortal( + _outdoorPView, building, portalRef, pass, ctx, passSink)); + } + + // Additive (Campaign FW3.2b-1): CPhysicsPart::Draw(parts, 0) + // @0x0059f331 — the building's own shell mesh — runs AFTER the + // portal walk completes (CPhysicsPart::Draw(parts, 1) just above), + // not before it. + sink.OnBuildingShellTurn(building); + } + + /// Returns the extracted cell-id array so + /// can hand the SAME flood list to OnInteriorFloodDrawTurn later, + /// without re-walking pview.CellDrawList a second time. + private uint[] EmitDrawCells(WalkPView pview, IWalkEventSink sink) + { + uint[] cells = new uint[pview.CellDrawList.Count]; + for (int i = 0; i < cells.Length; i++) + cells[i] = pview.CellDrawList[i].CellId; + sink.Emit(WalkEvent.DrawCells(pview.OutsideView.ViewCount, cells)); + return cells; + } + + private void AddViews(uint[] stabList, IRetailFrameWalkContext ctx) + { + foreach (uint id in stabList) + ctx.GetVisible(id)?.PushView(); + } + + private void RemoveViews(uint[] stabList, IRetailFrameWalkContext ctx) + { + foreach (uint id in stabList) + ctx.GetVisible(id)?.PopView(); + } + + private sealed class PortalPassSink(WalkBuilding building, IWalkEventSink sink) + : WalkBuildingPortals.IWalkPortalPassSink + { + /// The view the two-pass walk is currently pinned to + /// (retail building_view = Render::portal_view_num + /// @0x0059f3bf) — punch fans clip against THIS view's slice. + public int ActiveViewIndex; + + public void OnPunch(WalkPolygon polygon) + { + // The far-Z punch is a depth-only GPU submission (FW2's ordered + // stream); the oracle traces do not log it. Additive (Campaign + // FW3.2b-1): forward to the richer sink so a driver can flush + + // draw the punch fan — building-local space, world transform is + // the driver's job (WalkProductionFrameContext-style lookup). + sink.OnPunchGeometry(building, polygon, ActiveViewIndex); + } + + public void OnDrawCells(WalkPView pview) + { + uint[] cells = new uint[pview.CellDrawList.Count]; + for (int i = 0; i < cells.Length; i++) + cells[i] = pview.CellDrawList[i].CellId; + sink.Emit(WalkEvent.DrawCells(pview.OutsideView.ViewCount, cells)); + } + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkBuilding.cs b/src/AcDream.App/Rendering/Walk/WalkBuilding.cs new file mode 100644 index 00000000..0f150262 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkBuilding.cs @@ -0,0 +1,330 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// Retail CBldPortal: one building portal — the authored +/// side gate, the destination interior cell, its reciprocal portal index, +/// and the stab list of cells whose view stacks are pushed around the +/// look-in (PView::add_views/remove_views). +public struct WalkBldPortal +{ + public int PortalSide; + public uint OtherCellId; + public int OtherPortalId; + public bool ExactMatch; + public uint[] StabList; +} + +/// One CPortalPoly reference on a PORT BSP node: the index +/// into the building's portal list plus the portal polygon (building-local). +public struct WalkPortalRef +{ + public int PortalIndex; + public WalkPolygon Polygon; +} + +/// A node of the building's drawing BSP as the portal-only walk +/// sees it (retail tags: 'FAIL' leaf = stop, 'PORT' = portal node with +/// in_portals, anything else = plain splitting node). +public sealed class WalkBspNode +{ + public WalkPlane SplittingPlane; + public WalkBspNode? PosNode; + public WalkBspNode? NegNode; + public bool IsFail; + public WalkPortalRef[]? InPortals; // non-null = PORT node + + public bool IsPortal => InPortals is not null; +} + +/// One degrade-ladder level: the drawing BSP of that level's +/// GfxObj (portal-only view) and the level's authored distance bands. +public readonly record struct WalkBuildingDegradeLevel( + float MinDist, float IdealDist, float MaxDist, WalkBspNode? DrawingBsp); + +/// The walk's building model (retail CBuildingObj + +/// BuildInfo as the frame walk consumes them). +public sealed class WalkBuilding +{ + /// Position.objcell_id — the id the oracle's BLD events + /// carry (CBuildingObj+0x4C). + public uint PositionCellId; + + public WalkBldPortal[] Portals = []; + + /// The drawing BSP of part 0's BASE GfxObj (portal-only view). + /// Used directly when the model has no degrade ladder. + public WalkBspNode? DrawingBsp; + + /// The degrade ladder (near→far). Retail walks the CURRENT + /// level's drawing BSP (part->gfxobj[deg_level]) — and building + /// degrade models beyond the first band carry NO portal nodes, which is + /// what limits look-in punches to nearby buildings (probed 2026-08-30: + /// every Holtburg building has ports at level 0 only). + public WalkBuildingDegradeLevel[] DegradeLevels = []; + + /// part->gfxobj[deg_level] != 0 — a degraded-out slot + /// skips the whole building AFTER publishing the portal list. + public bool HasGeometry = true; + + /// The base GfxObj's sort center — retail measures the viewer + /// distance to the part's SCALED sort center, not the position origin + /// (CPhysicsPart::UpdateViewerDistance @0x0050e030). + public Vector3 SortCenter; + + /// Retail Render::s_rDegradeDistance — a subtractive + /// slack before the ladder applies (live-dumped 100 on the capture + /// client; registry-configurable). + public const float DefaultDegradeDistance = 100f; + + /// The live capture client's Render::deg_mul arm: + /// magnitude 0.99 pinned by the walkout-F2 fixture (building a9b4001e, + /// effective 30.3, level 0 ideal/max 24/48 — retail floods, so its + /// threshold ≈ max ⇒ the POSITIVE arm; the recon note's "−0.99" sign was + /// a misread — the negative arm's threshold ≈ min contradicts the + /// fixture from both directions). Re-dump at the next retail session. + public const float DefaultDegradeMultiplier = 0.99f; + + /// + /// GfxObjDegradeInfo::get_degrade @0x0051e4b0 (BN flag-mush on + /// the FPU compares — cross-checked against the Ghidra decomp, which is + /// clean): effective = max(0, |distance| − degradeDistance), then the + /// FIRST level whose threshold exceeds effective wins; no match → the + /// LAST level. The threshold depends on the multiplier's sign: + /// mul ≥ 0 → ideal − (ideal − max)·mul (ideal→max as mul→1); + /// mul < 0 → ideal + (ideal − min)·mul (ideal→min as mul→−1). + /// mul is Render::deg_mul when auto_update_deg_mul is on, + /// else s_rUserSuppliedDegradeBias. + /// + public WalkBspNode? SelectDrawingBsp( + float viewerDistance, + float degradeDistance = DefaultDegradeDistance, + float degradeMultiplier = DefaultDegradeMultiplier) + { + if (DegradeLevels.Length == 0) return DrawingBsp; + float effective = MathF.Max(0f, MathF.Abs(viewerDistance) - degradeDistance); + foreach (WalkBuildingDegradeLevel level in DegradeLevels) + { + float threshold = degradeMultiplier >= 0f + ? level.IdealDist - (level.IdealDist - level.MaxDist) * degradeMultiplier + : level.IdealDist + (level.IdealDist - level.MinDist) * degradeMultiplier; + if (effective < threshold) + return level.DrawingBsp; + } + return DegradeLevels[^1].DrawingBsp; + } +} + +/// +/// Campaign FW1 — the building look-in machinery, ported from the first +/// decomp appendix report 3 (docs/research/2026-08-30-fw-walk-pseudocode-appendix.md): +/// BSPTREE/BSPNODE::build_draw_portals_only @0x00539860/@0x0053c100, +/// BSPPORTAL::portal_draw_portals_only @0x0053d870, +/// PView::DrawPortal @0x005a5ab0, and the CBldPortal +/// PView::ConstructView overload @0x005a59a0. +/// +/// The invisible-panel primitive (DrawPortalPolyInternal @0x0059bc90 +/// — punch far-Z / seal own-depth) is a GPU submission and belongs to FW2's +/// ordered stream; here it surfaces as the +/// punch callback so FW1 conformance can observe when retail would draw it. +/// +public static class WalkBuildingPortals +{ + /// What the portal passes report outward: punches (pass 1) and + /// look-in cell floods (pass 2, the oracle's DC ov=… events). + public interface IWalkPortalPassSink + { + /// Pass 1 drew the portal polygon as a far-Z punch + /// (DrawPortalPolyInternal(poly, 1)). + void OnPunch(WalkPolygon polygon); + + /// Pass 2 completed a look-in flood and retail called + /// PView::DrawCells — the DC event with the flood's list. + void OnDrawCells(WalkPView pview); + } + + /// + /// BSPTREE::build_draw_portals_only @0x00539860 + the node/portal + /// walkers (BSPNODE @0x0053c100, BSPPORTAL @0x0053d870; + /// side arms verified against the GHIDRA decomp 2026-08-30 — BN's + /// FPU-flag pseudo-C reads the negative/in-plane split ambiguously, and + /// a "corrected" swap of these arms broke four fixtures before being + /// falsified; Ghidra: d ≤ ε → side=1 unless −ε ≤ d → side=2): + /// dispatch the root, then walk plane-side ordered — the child OPPOSITE + /// the viewer first, so portals emit far-to-near. PORT nodes emit every + /// in_portal on the POSITIVE (d > ε) and NEGATIVE (d < −ε) arms; + /// the IN_PLANE arm (|d| ≤ ε) visits the positive child and emits + /// NOTHING. Plain nodes group IN_PLANE with NEGATIVE. + /// + public static void BuildDrawPortalsOnly( + WalkBspNode? root, int pass, Vector3 viewpointInBuilding, + Action emitPortal) + { + if (root is null || root.IsFail) return; + Walk(root, pass, viewpointInBuilding, emitPortal); + } + + private static void Walk( + WalkBspNode node, int pass, Vector3 viewpoint, + Action emitPortal) + { + while (true) + { + float d = Vector3.Dot(node.SplittingPlane.Normal, viewpoint) + node.SplittingPlane.D; + int side = d > WalkVisibilityMath.Epsilon ? 0 + : d < -WalkVisibilityMath.Epsilon ? 1 : 2; + + WalkBspNode? next; + if (node.IsPortal) + { + if (side == 0) + { + Visit(node.NegNode, pass, viewpoint, emitPortal); + foreach (WalkPortalRef portal in node.InPortals!) + emitPortal(portal, pass); + next = node.PosNode; + } + else if (side == 1) + { + Visit(node.PosNode, pass, viewpoint, emitPortal); + foreach (WalkPortalRef portal in node.InPortals!) + emitPortal(portal, pass); + next = node.NegNode; + } + else + { + Visit(node.PosNode, pass, viewpoint, emitPortal); + next = node.NegNode; + } + } + else + { + if (side == 0) + { + Visit(node.NegNode, pass, viewpoint, emitPortal); + next = node.PosNode; + } + else + { + Visit(node.PosNode, pass, viewpoint, emitPortal); + next = node.NegNode; + } + } + + if (next is null || next.IsFail) return; + node = next; // retail's tail-continue + } + } + + private static void Visit( + WalkBspNode? child, int pass, Vector3 viewpoint, + Action emitPortal) + { + if (child is null || child.IsFail) return; + Walk(child, pass, viewpoint, emitPortal); + } + + /// + /// PView::DrawPortal @0x005a5ab0 for one emitted portal polygon: + /// resolve the CBldPortal, push view slots on its stab cells + /// (add_views), run the CBldPortal ConstructView, on pass 2 + /// success run the look-in DrawCells, then pop the stab views. The + /// GPU-state backup/restore and the building-frame re-push are + /// submission concerns (FW2); the CPU state here is complete. + /// + public static bool DrawPortal( + WalkPView pview, WalkBuilding building, in WalkPortalRef portalRef, + int pass, IWalkBuildingFrameContext ctx, IWalkPortalPassSink sink) + { + ref readonly WalkBldPortal bldPortal = ref building.Portals[portalRef.PortalIndex]; + AddViews(bldPortal.StabList, ctx); + bool ok = ConstructBuildingView( + pview, building, in bldPortal, portalRef.Polygon, pass, ctx, sink); + if (ok && pass != 1) + sink.OnDrawCells(pview); + RemoveViews(bldPortal.StabList, ctx); + return ok; + } + + /// + /// The CBldPortal PView::ConstructView overload @0x005a59a0: + /// the viewer's side of the portal plane must EQUAL the authored + /// portal_side (IN_PLANE within ±ε fails both gates); the polygon must + /// survive the active-view clip with ≥3 points; the destination cell + /// must be Visible; the clipped view is appended to its top slot. Pass 1 + /// punches the polygon; pass ≠ 1 recurses into the interior flood. + /// + public static bool ConstructBuildingView( + WalkPView pview, WalkBuilding building, in WalkBldPortal bldPortal, + WalkPolygon polygon, int pass, IWalkBuildingFrameContext ctx, + IWalkPortalPassSink sink) + { + Vector3 viewpoint = ctx.ViewpointInBuilding(building); + float d = Vector3.Dot(polygon.Plane.Normal, viewpoint) + polygon.Plane.D; + int side = d > WalkVisibilityMath.Epsilon ? 0 + : d < -WalkVisibilityMath.Epsilon ? 1 : 2; + if (bldPortal.PortalSide != 0) + { + if (side != 1) return false; + } + else if (side != 0) + { + return false; + } + + Span clipped = stackalloc WalkScreenPoint[64]; + int n = ctx.ClipBuildingPolygon(building, polygon, side, clipped); + if (n == 0) return false; + + WalkCell? cell = ctx.GetVisible(bldPortal.OtherCellId); + if (cell is null) return false; + if (!WalkCopyView.Append( + cell.TopView, clipped[..n], ctx.Rays, ctx.WorldViewpoint)) + return false; + + if (pass != 2) + sink.OnPunch(polygon); // DrawPortalPolyInternal(poly, pass == 1) + if (pass != 1) + pview.ConstructView(cell, ToEntryIndex(bldPortal.OtherPortalId), ctx.CellContext); + return true; + } + + private static int ToEntryIndex(int otherPortalId) + => otherPortalId < 0 ? 0xFFFF : otherPortalId; + + private static void AddViews(uint[] stabList, IWalkBuildingFrameContext ctx) + { + foreach (uint id in stabList) + ctx.GetVisible(id)?.PushView(); + } + + private static void RemoveViews(uint[] stabList, IWalkBuildingFrameContext ctx) + { + foreach (uint id in stabList) + ctx.GetVisible(id)?.PopView(); + } +} + +/// The building half of the frame context: building-local +/// viewpoint and projection (retail pushes the building's object frame +/// before the portal pass), plus the shared cell context. +public interface IWalkBuildingFrameContext +{ + Vector3 ViewpointInBuilding(WalkBuilding building); + + /// The viewer's distance to the building + /// (CPhysicsPart::UpdateViewerDistance's input) — selects the + /// degrade level whose drawing BSP the portal pass walks. + float ViewerDistanceTo(WalkBuilding building); + + /// Project + clip one building-local portal polygon against + /// the ACTIVE view (retail: GetClip with do_clip=1 in the building + /// frame). Returns the surviving count. + int ClipBuildingPolygon( + WalkBuilding building, WalkPolygon polygon, int side, Span output); + + WalkCell? GetVisible(uint cellId); + IWalkRayCaster Rays { get; } + Vector3 WorldViewpoint { get; } + IWalkFrameContext CellContext { get; } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkBuildingFactory.cs b/src/AcDream.App/Rendering/Walk/WalkBuildingFactory.cs new file mode 100644 index 00000000..680d3124 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkBuildingFactory.cs @@ -0,0 +1,191 @@ +using System.Numerics; +using AcDream.Content; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Enums; +using DatReaderWriter.Types; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW3.1 — production construction, +/// ported from the FW1 conformance harness +/// (tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapter.cs::BuildBuildings +/// /ConvertDrawingBsp/BuildGfxPolygon) to the legal +/// seam. This closes the FW3.1 gap: today's +/// Wb.BuildingLoader.AddBuilding (update thread) reads +/// BuildingInfo.Portals only for BFS seeding and drops ModelId, +/// Frame, portal Flags/StabList, and the drawing BSP the frame walk needs — +/// this factory reads the SAME BuildingInfo plus the GfxObj/ +/// GfxObjDegradeInfo chain, on the worker thread inside +/// LandblockBuildFactory where access +/// is legal (BuildingLoader itself never touches DATs — it runs +/// update-thread, after the streaming build already completed). +/// +/// Adjudication toggles the FW1 harness carried as public mutable fields for +/// sweep testing are PINNED here to their winning arms (2026-08-30 data-pin, +/// verified against the ten oracle traces): +/// +/// GfxObj portal-polygon planes are NOT flipped (the plain +/// first-three-vertices cross survives every building-portal fixture). +/// Building portal_side is the INVERSE of the cell decode's 0x2 bit +/// (WalkWorldDatAdapter.BuildingSideMode == 1's winning arm). +/// +/// +public static class WalkBuildingFactory +{ + /// One built plus its landblock-local + /// placement transform ( already has the + /// caller's block offset baked in — see ). + public sealed record Entry( + WalkBuilding Building, Matrix4x4 WorldTransform, Matrix4x4 InverseWorldTransform); + + /// Builds every building of one landblock. + /// is the SAME landblock-local world offset every other production + /// builder in this streaming job uses (LandblockBuildFactory's + /// lbOffset/worldOffset convention) — baked directly into + /// each building's world transform, which is mathematically identical to + /// the FW1 harness's two-step compose (build landblock-local, then + /// post-multiply the block offset translation): translations commute, + /// so R·T(origin)·T(lbOffset) == R·T(origin+lbOffset). + public static List Build( + IDatReaderWriter dats, uint landblockId, + IReadOnlyList? buildingInfos, Vector3 lbOffset) + { + var result = new List(); + if (buildingInfos is null) + return result; + uint lbMask = landblockId & 0xFFFF0000u; + + foreach (BuildingInfo buildingInfo in buildingInfos) + { + Vector3 origin = new( + buildingInfo.Frame.Origin.X, + buildingInfo.Frame.Origin.Y, + buildingInfo.Frame.Origin.Z); + int cellX = (int)MathF.Floor(origin.X / 24f); + int cellY = (int)MathF.Floor(origin.Y / 24f); + uint positionCellId = lbMask | (uint)(cellX * 8 + cellY + 1); + + var portals = new WalkBldPortal[buildingInfo.Portals.Count]; + for (int i = 0; i < portals.Length; i++) + { + BuildingPortal portal = buildingInfo.Portals[i]; + portals[i] = new WalkBldPortal + { + PortalSide = DecodeBuildingSide((ushort)portal.Flags), + ExactMatch = ((ushort)portal.Flags & 0x1) != 0, + OtherCellId = portal.OtherCellId == 0xFFFF + ? 0xFFFFFFFFu + : lbMask | portal.OtherCellId, + OtherPortalId = unchecked((short)portal.OtherPortalId), + StabList = portal.StabList.Select(s => lbMask | s).ToArray(), + }; + } + + WalkBspNode? bsp = null; + Vector3 sortCenter = Vector3.Zero; + var degradeLevels = new List(); + if (dats.Get(buildingInfo.ModelId) is GfxObj gfxObj) + { + bsp = ConvertDrawingBsp(gfxObj, gfxObj.DrawingBSP?.Root); + sortCenter = new Vector3(gfxObj.SortCenter.X, gfxObj.SortCenter.Y, gfxObj.SortCenter.Z); + if (gfxObj.DIDDegrade != 0 + && dats.Get(gfxObj.DIDDegrade) + is GfxObjDegradeInfo degradeInfo) + { + foreach (GfxObjInfo level in degradeInfo.Degrades) + { + WalkBspNode? levelBsp = null; + if (level.Id != 0 + && dats.Get((uint)level.Id) is GfxObj levelGfx) + { + levelBsp = ConvertDrawingBsp(levelGfx, levelGfx.DrawingBSP?.Root); + } + degradeLevels.Add( + new WalkBuildingDegradeLevel(level.MinDist, level.IdealDist, level.MaxDist, levelBsp)); + } + } + } + + Matrix4x4 worldTransform = + Matrix4x4.CreateFromQuaternion(buildingInfo.Frame.Orientation) + * Matrix4x4.CreateTranslation(origin + lbOffset); + Matrix4x4.Invert(worldTransform, out Matrix4x4 inverse); + result.Add(new Entry( + new WalkBuilding + { + PositionCellId = positionCellId, + Portals = portals, + DrawingBsp = bsp, + DegradeLevels = degradeLevels.ToArray(), + SortCenter = sortCenter, + }, + worldTransform, + inverse)); + } + return result; + } + + private static int DecodeBuildingSide(ushort flags) => (flags & 0x2) != 0 ? 0 : 1; + + private static WalkBspNode? ConvertDrawingBsp(GfxObj gfxObj, DrawingBSPNode? node) + { + if (node is null) return null; + var converted = new WalkBspNode + { + SplittingPlane = new WalkPlane(node.SplittingPlane.Normal, node.SplittingPlane.D), + IsFail = node.Type == BSPNodeType.Leaf, + PosNode = ConvertDrawingBsp(gfxObj, node.PosNode), + NegNode = ConvertDrawingBsp(gfxObj, node.NegNode), + }; + if (node.Type == BSPNodeType.Portal && node.Portals is not null) + { + var refs = new List(node.Portals.Count); + foreach (PortalRef portalRef in node.Portals) + { + WalkPolygon? polygon = BuildGfxPolygon(gfxObj, portalRef.PolyId); + if (polygon is not null) + refs.Add(new WalkPortalRef + { + PortalIndex = portalRef.PortalIndex, + Polygon = polygon, + }); + } + converted.InPortals = refs.ToArray(); + } + return converted; + } + + private static WalkPolygon? BuildGfxPolygon(GfxObj gfxObj, ushort polygonId) + { + if (!gfxObj.Polygons.TryGetValue(polygonId, out Polygon? poly) + || poly is null || poly.VertexIds.Count < 3) + { + return null; + } + return BuildPolygonFromVertices( + poly.VertexIds, + id => gfxObj.VertexArray.Vertices.TryGetValue((ushort)id, out SWVertex? v) + ? new Vector3(v.Origin.X, v.Origin.Y, v.Origin.Z) + : null); + } + + private static WalkPolygon? BuildPolygonFromVertices( + IReadOnlyList vertexIds, Func resolve) + { + var vertices = new Vector3[vertexIds.Count]; + for (int i = 0; i < vertexIds.Count; i++) + { + Vector3? v = resolve(vertexIds[i]); + if (v is null) return null; + vertices[i] = v.Value; + } + Vector3 normal = Vector3.Normalize( + Vector3.Cross(vertices[1] - vertices[0], vertices[2] - vertices[0])); + return new WalkPolygon + { + Vertices = vertices, + Plane = new WalkPlane(normal, -Vector3.Dot(normal, vertices[0])), + }; + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkBuildingRegistry.cs b/src/AcDream.App/Rendering/Walk/WalkBuildingRegistry.cs new file mode 100644 index 00000000..db1ad45c --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkBuildingRegistry.cs @@ -0,0 +1,75 @@ +using System.Diagnostics.CodeAnalysis; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW3.1 — the walk's per-landblock +/// registry: the production sibling of +/// . Publish/retire +/// mirror that registry's landblock lifecycle exactly — both are committed +/// together in LandblockRenderPublisher.AdvanceCompleteOne's +/// BuildingRegistryCommitted step and retired together from +/// LandblockRenderPublisher.RemoveBuildingRegistry — because a walk +/// building and its BFS-derived Wb.Building counterpart come from the +/// SAME BuildingInfo array at the SAME landblock commit. +/// +/// The reverse index () exists because +/// resolves a building's placement +/// by REFERENCE during the portal pass — ViewpointInBuilding, +/// ViewerDistanceTo, and ClipBuildingPolygon are called many +/// times per building per frame once FW3.2 wires the walk into the render +/// loop, so this must be O(1), not a per-landblock scan. +/// +public sealed class WalkBuildingRegistry +{ + private readonly Dictionary> _byLandblock = new(); + private readonly Dictionary _byBuilding = new(); + + /// Atomically replaces one landblock's complete building set. + /// Mirrors Wb.BuildingRegistry's "no partial landblock" commit + /// discipline — is the immutable, fully-built + /// list carried by the streaming worker's + /// Wb.EnvCellLandblockBuild.WalkBuildings. + public void Publish(uint landblockId, IReadOnlyList entries) + { + uint key = landblockId & 0xFFFF0000u; + if (_byLandblock.TryGetValue(key, out IReadOnlyList? previous)) + { + foreach (WalkBuildingFactory.Entry entry in previous) + _byBuilding.Remove(entry.Building); + } + _byLandblock[key] = entries; + foreach (WalkBuildingFactory.Entry entry in entries) + _byBuilding[entry.Building] = entry; + } + + /// Removes every building of one landblock. Safe to call on a + /// landblock that never published (no-op). + public void Retire(uint landblockId) + { + uint key = landblockId & 0xFFFF0000u; + if (_byLandblock.Remove(key, out IReadOnlyList? previous)) + { + foreach (WalkBuildingFactory.Entry entry in previous) + _byBuilding.Remove(entry.Building); + } + } + + /// The buildings of one landblock, or empty when none are + /// published (unloaded, far-tier, or no BuildingInfo entries). + public IReadOnlyList GetBuildings(uint landblockId) => + _byLandblock.TryGetValue(landblockId & 0xFFFF0000u, out IReadOnlyList? list) + ? list + : Array.Empty(); + + /// O(1) reverse lookup: this building's committed placement. + /// False means the building is not (or no longer) committed — the walk + /// must treat that as a hard desync, never a silent skip (the FW + /// fail-loud rule). + public bool TryGetEntry( + WalkBuilding building, [MaybeNullWhen(false)] out WalkBuildingFactory.Entry entry) => + _byBuilding.TryGetValue(building, out entry); + + /// Number of landblocks with committed buildings (diagnostics). + public int LandblockCount => _byLandblock.Count; +} diff --git a/src/AcDream.App/Rendering/Walk/WalkCellFactory.cs b/src/AcDream.App/Rendering/Walk/WalkCellFactory.cs new file mode 100644 index 00000000..ccd0bd5b --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkCellFactory.cs @@ -0,0 +1,167 @@ +using System.Numerics; +using AcDream.Content; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Types; +using Environment = DatReaderWriter.DBObjs.Environment; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW3.1 — production construction, ported +/// from the FW1 conformance harness +/// (tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapter.cs::BuildCell) +/// to the legal seam +/// (RuntimeDatAccessArchitectureTests forbids raw +/// DatCollection anywhere in this assembly outside +/// RuntimeDatCollectionFactory/DatCollectionAdapter). +/// +/// is the shared core: it takes an ALREADY-FETCHED +/// / pair and the production +/// UNLIFTED cell transform. EnvCellLandblockBuildBuilder.BuildVisibilityCell +/// (src/AcDream.App/Rendering/Wb/EnvCellLandblockBuild.cs) calls this +/// directly — it already has both parsed and the transform in hand from its +/// own construction, so no extra DAT read is spent. +/// is the standalone DAT-reading convenience for +/// callers that only have a cell id (the walk landscape's stab-list +/// look-in cells, and the FW3 conformance harness). +/// +/// Conventions (fixture-pinned; the ten oracle traces are the referee — see +/// docs/research/2026-08-30-fw-walk-oracle/): +/// +/// portal_side = (Flags & 0x2) != 0 ? 0 : 1 — the INVERSE of +/// the bit, matching EnvCellLandblockBuildBuilder.BuildVisibilityCell's +/// existing PortalClipPlane.InsideSide decode +/// ((Flags & 0x2) == 0 ? 1 : 0 — the same formula). +/// Exit-portal sentinel widening: dat 0xFFFF → +/// 0xFFFFFFFF ( is a full +/// cell id; the dat field is a 16-bit local id). +/// Portal-polygon plane: first-three-vertices cross, +/// d = −dot(N, p0) — the same formula +/// BuildVisibilityCell's PortalClipPlane already uses. +/// +/// +public static class WalkCellFactory +{ + /// DAT-reading entry point: fetches EnvCell/Environment/CellStruct + /// and builds their landblock-local ( + /// added) UNLIFTED transform before delegating to . + /// Returns null when the cell, its environment, or its cell structure + /// cannot be resolved (unregistered/degenerate cell — same as the FW1 + /// test adapter). + public static WalkCell? BuildCell(IDatReaderWriter dats, uint cellId, Vector3 blockOffset) + { + if (dats.Get(cellId) is not EnvCell envCell) + return null; + if (dats.Get(0x0D000000u | envCell.EnvironmentId) is not Environment environment + || !environment.Cells.TryGetValue(envCell.CellStructure, out CellStruct? cellStruct) + || cellStruct is null) + { + return null; + } + + Matrix4x4 worldTransform = + Matrix4x4.CreateFromQuaternion(envCell.Position.Orientation) + * Matrix4x4.CreateTranslation( + envCell.Position.Origin.X + blockOffset.X, + envCell.Position.Origin.Y + blockOffset.Y, + envCell.Position.Origin.Z + blockOffset.Z); + Matrix4x4.Invert(worldTransform, out Matrix4x4 inverse); + return FromParsed(cellId, envCell, cellStruct, worldTransform, inverse); + } + + /// Builds a from an already-fetched + /// EnvCell/CellStruct pair and the production cell transform. No DAT + /// access — safe to call from a context that already holds the reader + /// lock for an unrelated read. + public static WalkCell FromParsed( + uint cellId, EnvCell envCell, CellStruct cellStruct, + Matrix4x4 worldTransform, Matrix4x4 inverseWorldTransform) + { + uint lbMask = cellId & 0xFFFF0000u; + int portalCount = envCell.CellPortals.Count; + var portals = new WalkCellPortal[portalCount]; + var polygons = new WalkPolygon[portalCount]; + for (int i = 0; i < portalCount; i++) + { + CellPortal portal = envCell.CellPortals[i]; + portals[i] = new WalkCellPortal + { + OtherCellId = portal.OtherCellId == 0xFFFF + ? 0xFFFFFFFFu + : lbMask | portal.OtherCellId, + PolygonIndex = i, + PortalSide = ((ushort)portal.Flags & 0x2) != 0 ? 0 : 1, + ExactMatch = ((ushort)portal.Flags & 0x1) != 0, + OtherPortalId = unchecked((short)portal.OtherPortalId), + }; + polygons[i] = BuildPolygon(cellStruct, portal.PolygonId) ?? new WalkPolygon(); + } + + return new WalkCell + { + CellId = cellId, + Portals = portals, + PortalPolygons = polygons, + StabList = envCell.VisibleCells.Select(v => lbMask | v).ToArray(), + WorldTransform = worldTransform, + InverseWorldTransform = inverseWorldTransform, + }; + } + + /// Every interior cell of one landblock, bounded by + /// LandBlockInfo.NumCells (the production bound — + /// LandblockBuildFactory.BuildInteriorEntitiesForStreaming uses + /// the same count; the FW1 test adapter instead scans until the first + /// miss, which is equivalent for well-formed installed DATs). + public static Dictionary BuildInteriorCells( + IDatReaderWriter dats, uint landblockId, Vector3 blockOffset, + Dictionary? into = null) + { + uint lbMask = landblockId & 0xFFFF0000u; + Dictionary cells = into ?? new Dictionary(); + if (dats.Get(lbMask | 0xFFFEu) is not LandBlockInfo info) + return cells; + + uint firstCellId = lbMask | 0x0100u; + for (uint offset = 0; offset < info.NumCells; offset++) + { + WalkCell? cell = BuildCell(dats, firstCellId + offset, blockOffset); + if (cell is not null) + cells[cell.CellId] = cell; + } + return cells; + } + + private static WalkPolygon? BuildPolygon(CellStruct cellStruct, ushort polygonId) + { + if (!cellStruct.Polygons.TryGetValue(polygonId, out Polygon? poly) + || poly is null || poly.VertexIds.Count < 3) + { + return null; + } + return BuildPolygonFromVertices( + poly.VertexIds, + id => cellStruct.VertexArray.Vertices.TryGetValue((ushort)id, out SWVertex? v) + ? new Vector3(v.Origin.X, v.Origin.Y, v.Origin.Z) + : null); + } + + private static WalkPolygon? BuildPolygonFromVertices( + IReadOnlyList vertexIds, Func resolve) + { + var vertices = new Vector3[vertexIds.Count]; + for (int i = 0; i < vertexIds.Count; i++) + { + Vector3? v = resolve(vertexIds[i]); + if (v is null) return null; + vertices[i] = v.Value; + } + Vector3 normal = Vector3.Normalize( + Vector3.Cross(vertices[1] - vertices[0], vertices[2] - vertices[0])); + return new WalkPolygon + { + Vertices = vertices, + Plane = new WalkPlane(normal, -Vector3.Dot(normal, vertices[0])), + }; + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkEvents.cs b/src/AcDream.App/Rendering/Walk/WalkEvents.cs new file mode 100644 index 00000000..a2c911d3 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkEvents.cs @@ -0,0 +1,170 @@ +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW1 — the frame walk's observable event stream. These events +/// mirror the FW0 oracle-trace vocabulary one-to-one +/// (docs/research/2026-08-30-fw-walk-oracle/README.md): the conformance +/// contract is that RetailFrameWalk, fed the same world state and +/// camera pose as a capture, emits the identical sequence. Richer draw +/// commands (mesh/state/stage tuples for the FW2 ordered stream) layer on +/// later; this vocabulary stays the conformance surface. +/// +public enum WalkEventKind +{ + /// LScape::draw @0x00506330 ran (outdoor root, or drawn + /// through an interior frame's exit views). + Landscape, + + /// RenderDeviceD3D::DrawBuilding @0x0059f2a0 entered for + /// one building (identified by its position cell id). + Building, + + /// PView::DrawInside @0x005a5860 entered — the frame is + /// rooted at this interior cell. + DrawInside, + + /// PView::DrawCells @0x005a4840 entered with the flood's + /// cell list (far-to-near iteration happens inside; the event carries the + /// list in storage order, matching the oracle dump). + DrawCells, +} + +public readonly record struct WalkEvent( + WalkEventKind Kind, + uint CellId, + int OutsideViewCount, + IReadOnlyList Cells) +{ + /// FW4 slice 1: the landscape turn carries the ACTIVE view + /// set's ViewCount (retail LScape::draw iterates the + /// views the walk itself installed — 1 for the outdoor root's + /// full-screen default view, the interior root's own surviving + /// exit-view count otherwise). The driver fans exactly this many + /// terrain slices; the old clip apparatus no longer supplies the + /// count. Reuses the record's existing + /// field; the conformance trace mapping compares the kind only + /// (LS), so oracle fixtures are unaffected. + public static WalkEvent Landscape(int activeViewCount) + => new(WalkEventKind.Landscape, 0, activeViewCount, Array.Empty()); + + public static WalkEvent Building(uint positionCellId) + => new(WalkEventKind.Building, positionCellId, 0, Array.Empty()); + + public static WalkEvent DrawInside(uint cellId) + => new(WalkEventKind.DrawInside, cellId, 0, Array.Empty()); + + public static WalkEvent DrawCells(int outsideViewCount, IReadOnlyList cells) + => new(WalkEventKind.DrawCells, 0, outsideViewCount, cells); +} + +/// +/// The sink a walk emits into. FW1 conformance tests collect events; FW2's +/// production sink will additionally receive the ordered draw stream. +/// +/// Campaign FW3.2b-1 additive seam: also +/// calls the five richer, default-no-op members below at turns the +/// vocabulary-only stream cannot express (a visited +/// landscape cell with no building emits no at all; +/// carries only a cell id, not the +/// reference a driver needs to look up shell +/// content, degrade state, or world transform; and punches are not part of +/// the FW1 conformance vocabulary at all — the oracle traces do not log +/// them). Every FW1/FW2 sink that only implements +/// continues to compile and behave identically — these are C# default +/// interface members, never called by any pre-FW3.2b-1 code path. +/// +public interface IWalkEventSink +{ + void Emit(in WalkEvent walkEvent); + + /// + /// Fires once per visited landscape cell, AFTER that cell's building + /// turn (if any) — RenderDeviceD3D::DrawSortCell @0x0059f140 + /// calls DrawBuilding(building) first, then + /// DrawObjCell(cell) UNCONDITIONALLY (decomp-confirmed + /// 2026-08-30). follows retail's outdoor cell + /// encoding — (landblockId & 0xFFFF0000) | (cellIndex + 1) — + /// the same convention + /// and + + /// already use. Default + /// no-op. + /// + void OnLandscapeCellTurn(uint cellId) { } + + /// + /// Fires at once retail's own + /// gate has passed — RenderDeviceD3D::DrawBuilding @0x0059f2a0 + /// wraps its ENTIRE body (the alpha barrier, the portal pass, the shell + /// draw) in if (part->gfxobj[part->deg_level] != 0) + /// @0x0059f2d3 — a degraded-out slot draws NOTHING beyond the + /// unconditional + /// call. and a non-null + /// result together model that + /// one gate, so this hook fires only after both have passed. This is the + /// ALPHA BARRIER turn (D3DPolyRender::FlushAlphaList(0f) + /// @0x0059f30b) — retail's own order runs it BEFORE the portal pass + /// (CPhysicsPart::Draw(parts, 1)), which in turn runs BEFORE the + /// shell draw (CPhysicsPart::Draw(parts, 0) — see + /// , fired separately, after the portal + /// pass completes). Default no-op. + /// + void OnBuildingTurn(WalkBuilding building) { } + + /// + /// Fires at the END of , after + /// its two-pass portal walk (punches + look-ins, across every active + /// view) has fully completed — CPhysicsPart::Draw(parts, 0) + /// @0x0059f331, retail's plain-mesh draw of the building's own shell, + /// which runs strictly AFTER CPhysicsPart::Draw(parts, 1) (the + /// portal flavor) per the decomp sequence at @0x0059f30b–0x0059f345. Only + /// fires when also fired (same gate; see its + /// doc comment) — a degraded-out slot reaches neither. Default no-op. + /// + void OnBuildingShellTurn(WalkBuilding building) { } + + /// + /// Fires when the two-pass portal machinery + /// () would draw a far-Z punch fan + /// (DrawPortalPolyInternal @0x0059bc90, pass 1) — carries the + /// owning building and the polygon in BUILDING-LOCAL space (as stored on + /// the emitted ) so a driver can resolve the + /// world transform itself. The FW1 oracle traces never log punches + /// ('s internal PortalPassSink.OnPunch + /// stayed a no-op through FW1/FW2 for exactly that reason). Default + /// no-op. + /// + /// The building whose portal walk emitted the + /// punch. + /// The portal polygon, building-local. + /// The active-view index the two-pass walk + /// is pinned to (retail building_view @0x0059f3bf) — the punch + /// fan clips against THIS view's slice planes in production. + void OnPunchGeometry( + WalkBuilding building, WalkPolygon polygon, int activeViewIndex) + { } + + /// + /// Fires once per interior root, at the point PView::DrawCells + /// @0x005a4840 actually DRAWS the root flood's own cells — NOT where the + /// call for the + /// SAME flood fires (that one sits at breakpoint-ENTRY order, matching + /// the FW0 oracle traces; it only RECORDS the flood list). Retail's own + /// order inside DrawCells is: LScape::draw FIRST + /// (pc:432719, only when exit views survived — see + /// and + /// ), then a full depth clear + /// (pc:432731-432732), then the exit-portal seals (pc:432785-432786) — + /// BOTH unconditional for an interior root's + /// own flood, whether or not a landscape turn just ran — and ONLY THEN + /// the flood's cells far-to-near (shell then contents per cell, same + /// discipline as 's per-cell contents + /// and a building's look-in). This hook fires at that later point, so + /// this is where a driver should actually draw . + /// Building look-in floods are UNAFFECTED — retail calls + /// DrawCells re-entrantly there with ov==0 and no + /// landscape/clear/seal step, so their + /// call still fires at the actual draw point (a + /// driver may keep drawing those immediately, as before). Default no-op. + /// + void OnInteriorFloodDrawTurn(IReadOnlyList cells) { } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkFrameDriver.cs b/src/AcDream.App/Rendering/Walk/WalkFrameDriver.cs new file mode 100644 index 00000000..6a6975f1 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkFrameDriver.cs @@ -0,0 +1,936 @@ +using System.Numerics; +using AcDream.App.Rendering; +using AcDream.App.Rendering.Gpu; +using AcDream.App.Rendering.Scene; +using AcDream.App.Rendering.Wb; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW stage FW3.2b-1: one cell's or one building's already-queried +/// static content, ready for — +/// caller-built, never read from a retained scene (see +/// 's doc comment). +/// +/// Already-classified s +/// for this turn's cell/building, in the SAME order they must enter the walk +/// stream (never re-sorted downstream — 's +/// own contract). Campaign FW3.4a: a segment INTO 's +/// per-frame arena, not a freshly allocated array — see that type's own doc +/// comment. +/// The clip-slot-resolving landblock id +/// WbDrawDispatcher.ClassifyEntityForWalk needs per record (FW3.2a's +/// tupleLandblockId parameter) — carried per-turn rather than once per +/// frame because a single frame's cells/buildings can span more than one +/// committed landblock. +internal readonly record struct WalkFrameStaticRecords( + ArraySegment Records, uint TupleLandblockId) +{ + public static readonly WalkFrameStaticRecords Empty = + new(ArraySegment.Empty, 0); +} + +/// +/// Campaign FW stage FW3.2b-1: the world-data lookups +/// needs at each walk turn, entirely caller-built — the driver reads no +/// retained scene state of its own (mirrors 's +/// own "reads no retained scene state itself" contract one layer up). FW3.2b-2 +/// wires the real production implementation (RenderSceneQuery.CopyCellStaticsTo +/// / CopyIndexTo + ); this stage's +/// headless referee tests wire a synthetic fake instead. +/// +internal interface IWalkFrameWorldData +{ + /// An indoor PView::DrawCells flood cell's (or a building + /// look-in's) static content — RenderProjectionClass.IndoorCellStatic. + WalkFrameStaticRecords GetCellStatics(uint cellId); + + /// One visited landscape (outdoor) cell's static content — + /// RenderProjectionClass.OutdoorStatic, keyed by the SAME + /// (landblockId & 0xFFFF0000) | (cellIndex+1) id + /// computes. + WalkFrameStaticRecords GetOutdoorStatics(uint cellId); + + /// One building's own exterior shell content (IsBuildingShell + /// records anchored at the building's position cell). + WalkFrameStaticRecords GetBuildingShellStatics(WalkBuilding building); + + /// Building-local → world, for transforming a punch polygon + /// before — the + /// production implementation is 's + /// WorldTransform (FW3.2b-2 wiring). + Matrix4x4 GetBuildingWorldTransform(WalkBuilding building); +} + +/// +/// Campaign FW stage FW3.2b-1: the leaf GPU-adjacent actions +/// calls at walk turns that have no +/// submission path YET (sky, terrain, an +/// EnvCell shell, a portal punch fan, the interior depth clear, the exit- +/// portal seals) or that aren't a draw at all (the +/// barrier). Kept as its own seam — rather +/// than folding these into directly — so the +/// FW3.2b-1 headless referee suite can wire a fake and prove turn ORDER +/// without standing up the real renderers EnvCellRenderer, +/// TerrainModernRenderer, GameSky, and +/// PortalDepthMaskRenderer.DrawDepthFan — FW3.2b-2's job. +/// +/// Stream submission itself (WbDrawDispatcher.PrepareOrderedStream/ +/// DrawOrderedRange) is deliberately NOT part of this interface: it is +/// already real, production-tested machinery, so +/// calls it directly rather than abstracting a method that would just +/// forward to it one layer deeper. +/// +internal interface IWalkFrameLeafRenderer +{ + /// LScape::draw draws GameSky once per outdoor + /// walk (retail draws it once inside LScape::draw; the CURRENT + /// executor's per-slice call is per-slice-equals-once only for the + /// single-view outdoor case it handles today — the walk driver always + /// calls this exactly once per frame's Landscape turn). + void DrawSky(); + + /// LScape::grab_visible_cells's terrain mesh, once per + /// ACTIVE clip slice — is caller-supplied + /// ('s activeTerrainSliceCount) + /// since FW3.2b-1 does not wire ClipFrameAssembler/ + /// ViewconeCuller (FW3.2b-2's job — see plan §FW3.2's dynamic-route + /// survival note). Terrain draws FULLY before any per-cell building/ + /// outdoor-static turn in this stage's turn order — an intra-stage + /// simplification of retail's true per-cell DrawLandCell/ + /// DrawObjCell interleave, recorded here rather than ported, since + /// terrain itself carries no walk event today. + void DrawTerrainSlice(int sliceIndex); + + /// One committed cell's EnvCell shell — + /// PView::DrawCells's DrawEnvCell @0x005a4abe, which + /// precedes DrawObjCellForDummies @0x005a4b0d (the cell's static + /// contents, appended to the stream instead — see + /// 's type doc comment) for every cell of + /// EVERY flood this stage drives (the ordinary interior root's own + /// DrawCells AND a building's look-in DrawCells both walk + /// this same shell-then-contents order). + void DrawCellShell(uint cellId); + + /// One landscape cell's or building shell's static-owner + /// particle submission, at its own walk turn — see + /// for the retail + /// positional invariant this carries (the #132 falls containment). + void DrawStaticParticles(IReadOnlySet ownerIds); + + /// PView::DrawCells @0x005a4840's gated full depth clear + /// (pc:432731-432732) between the outside stage and the interior root's + /// own flood — production maps this to IWorldPassScope.ClearInteriorDepth + /// (see that interface's own member of the same name in + /// RetailPViewRenderer.cs, staged there on OutsideViewSlices.Length + /// > 0 — an ACKNOWLEDGED approximation of retail's true + /// portalsDrawnCount gate per that file's own comment). This walk + /// driver instead fires unconditionally for every interior root (per the + /// 2026-08-30 decomp correction: the coordinator's directive supersedes + /// the packed path's staged gate — reconcile the two if a firmer + /// portalsDrawnCount reading ever lands). Only called for an + /// INTERIOR root, never outdoors (retail has no depth clear there — + /// portalsDrawnCount never applies to LScape::draw's own + /// top-level walk). + void ClearInteriorDepth(); + + /// The exit-portal seals (pc:432785-432786) — re-stamping every + /// outside-leading portal's TRUE depth right after + /// , so the aperture the clear just wiped + /// stays occluded by the world beyond it rather than by whatever draws + /// next. Production maps this to the existing seal-fan machinery + /// (RetailPViewRenderer.DrawExitPortalMask/ + /// PortalDepthMaskRenderer) — this driver only provides the TURN; + /// the real per-portal fan geometry is FW3.2b-2's job. Only called for an + /// INTERIOR root's own flood, never for a building look-in (those call + /// DrawCells re-entrantly with no clear/seal step) and never + /// outdoors. + void DrawExitSeals(); + + /// DrawPortalPolyInternal @0x0059bc90's depth-only far-Z + /// punch fan — pass 1 of the building portal walk. + /// is already transformed building-local + /// → world ( does the transform via + /// at Collect + /// time — see that type's own doc comment). The real implementation is + /// PortalDepthMaskRenderer.DrawDepthFan with forceFarZ + /// (FW3.2b-2 wiring) — Replay calls this at exactly the point Collect + /// recorded it: any content queued ahead of the punch (a preceding + /// cell's/building's contents — never this building's OWN shell, which + /// retail draws only after the whole portal walk completes; see + /// 's type doc comment) reaches the GPU + /// first. is the view the emitting + /// two-pass walk was pinned to (retail building_view = + /// Render::portal_view_num @0x0059f3bf) — production clips the fan by + /// that view's slice planes. + void DrawPunchFan(WalkPolygon worldPolygon, int activeViewIndex); + + /// RetailAlphaQueue.FlushFartherThan's DrawBuilding + /// barrier — retail's own call site is + /// D3DPolyRender::FlushAlphaList(0f) @0x0059f30b, a FLUSH-ALL, not + /// a distance-gated flush; this stage keeps the DISPATCHED + /// FlushFartherThan(viewerDistanceTo(building)) shape (the two + /// coincide under the walk's far-to-near landscape order, since a nearer + /// emitter has not been inserted into the alpha queue yet — see + /// RetailAlphaQueue.FlushFartherThan's own doc comment) and flags + /// the 0f/address detail as an FW4 adjudication candidate rather than + /// silently reinterpreting the dispatched design. + void AlphaBarrier(float viewerDistance); +} + +/// +/// Campaign FW stage FW3.2b-1 test seam: an optional, diagnostic-only +/// observer of every ordered-stream range +/// draws. Production callers pass (the default) — this +/// exists purely so the headless referee suite can assert range COUNT, +/// per-range command count, and per-range stage without re-deriving them +/// from RecordingGpuDevice.Calls' lower-level RHI call log. +/// +internal interface IWalkFrameDriverTrace +{ + /// is a snapshot (never a live, + /// about-to-mutate list) of every command's in + /// the drawn segment, in stream order — by this stage's own segmenting + /// discipline (a segment boundary before every non-stream leaf action) a + /// segment is always single-stage in practice, but the full list is + /// passed so a test can assert that invariant itself instead of trusting + /// it. + void OnFlush(int commandCount, IReadOnlyList stages); +} + +/// +/// Campaign FW3.4a: one turn Collect recorded, replayed by +/// in the exact order Collect saw it. +/// is the collect-time analogue of +/// the old immediate driver's flush point — see 's +/// own doc comment for the full list and what each carries. +/// +internal enum WalkFrameEventKind : byte +{ + /// The accumulated grew since the + /// last mark and must be drawn, via WbDrawDispatcher.DrawOrderedRange, + /// before whatever leaf event follows. + /// is the stream's exclusive-end command index at the moment this event + /// was recorded. + StreamMark, + + /// . + Sky, + + /// — + /// is the slice index. + TerrainSlice, + + /// — + /// is the cell. + CellShell, + + /// — + /// is the already-world-transformed + /// polygon (transformed at Collect time, exactly as the pre-FW3.4a driver + /// transformed it before its own immediate call), + /// is the active view index. + PunchFan, + + /// — + /// is the viewer distance, computed + /// at Collect time (the context that supplies it does not outlive Collect). + AlphaBarrier, + + /// . + ClearInteriorDepth, + + /// . + ExitSeals, + + /// — + /// ONE landscape cell's () or ONE + /// building shell's () static-owner + /// particle submission, emitted AT ITS OWN WALK TURN. Retail's falls + /// containment is positional: an outdoor emitter's polys join the one + /// alpha list during its owner cell's DrawObjCell in the + /// far-to-near landscape walk, so every nearer building's pre-punch + /// alpha barrier (DrawBuilding @0x0059f2a0's + /// FlushAlphaList @0x0059f30b) drains the already-queued FARTHER + /// content against still-true depth BEFORE the punch stamps far-Z into + /// the aperture. The former single batched submission at the pre-clear + /// closure ran AFTER every punch — the barriers fired over an empty + /// queue and the falls drained against punched-far aperture pixels (the + /// cathedral bleed; the old pipeline's user-verified #132 fix + /// `e102fb36` encoded the same invariant). + StaticParticles, +} + +/// See for what each field means per +/// kind. A single struct (rather than a kind hierarchy) keeps Collect's +/// per-turn list a flat, allocation-cheap List<WalkFrameEvent> — +/// only (a punch fan's already-transformed geometry) +/// allocates, and only once per punch, which is rare enough per frame to be +/// unconditionally acceptable (plan §FW3.4a's own call). +internal readonly struct WalkFrameEvent +{ + private WalkFrameEvent( + WalkFrameEventKind kind, int intArg, uint cellId, float floatArg, WalkPolygon? polygon, + WalkBuilding? building = null) + { + Kind = kind; + IntArg = intArg; + CellId = cellId; + FloatArg = floatArg; + Polygon = polygon; + Building = building; + } + + internal WalkFrameEventKind Kind { get; } + + internal int IntArg { get; } + + internal uint CellId { get; } + + internal float FloatArg { get; } + + internal WalkPolygon? Polygon { get; } + + /// only: the + /// building whose shell statics' owners submit at this turn; null for a + /// landscape cell's turn (then names the cell). + internal WalkBuilding? Building { get; } + + internal static WalkFrameEvent Mark(int exclusiveEnd) => + new(WalkFrameEventKind.StreamMark, exclusiveEnd, 0, 0f, null); + + internal static WalkFrameEvent Sky() => + new(WalkFrameEventKind.Sky, 0, 0, 0f, null); + + internal static WalkFrameEvent TerrainSlice(int sliceIndex) => + new(WalkFrameEventKind.TerrainSlice, sliceIndex, 0, 0f, null); + + internal static WalkFrameEvent CellShell(uint cellId) => + new(WalkFrameEventKind.CellShell, 0, cellId, 0f, null); + + internal static WalkFrameEvent PunchFan(WalkPolygon worldPolygon, int activeViewIndex) => + new(WalkFrameEventKind.PunchFan, activeViewIndex, 0, 0f, worldPolygon); + + internal static WalkFrameEvent AlphaBarrier(float viewerDistance) => + new(WalkFrameEventKind.AlphaBarrier, 0, 0, viewerDistance, null); + + internal static WalkFrameEvent LandscapeCellParticles(uint cellId) => + new(WalkFrameEventKind.StaticParticles, 0, cellId, 0f, null); + + internal static WalkFrameEvent BuildingShellParticles(WalkBuilding building) => + new(WalkFrameEventKind.StaticParticles, 0, 0, 0f, null, building); + + internal static WalkFrameEvent ClearInteriorDepth() => + new(WalkFrameEventKind.ClearInteriorDepth, 0, 0, 0f, null); + + internal static WalkFrameEvent ExitSeals() => + new(WalkFrameEventKind.ExitSeals, 0, 0, 0f, null); +} + +/// +/// Campaign FW stage FW3.2b-1 — THE WALK FRAME DRIVER. Executes one full +/// static-content frame by driving with itself +/// as the , so that GPU command-buffer order +/// equals retail's walk order (plan §FW3.2b-1's "INTERLEAVING RULE"). +/// +/// Campaign FW3.4a — the ONE-walk split. Before this stage, a +/// single frame ran TWICE — once with a +/// set-collecting sink to learn the flood/visited-cell set before +/// PrepareCellBatches, once more through this driver to actually +/// submit — and each walk turn's stream content flushed IMMEDIATELY through +/// its own full WbDrawDispatcher.SubmitOrderedStream call (~40 of +/// those per frame at a town, each rewriting and rebinding all nine +/// per-instance sections for that turn's handful of instances). The FW3.4 +/// perf checkpoint measured +33.5% CPU p50 and 14× frame allocation from +/// exactly those two costs (plus a third, unrelated one — see +/// 's own doc comment) and tripped the +/// campaign's ±20% stop rule. This stage collapses both: +/// runs ONCE, doing everything the immediate +/// driver used to do EXCEPT the actual GPU submission — stream appends +/// accumulate without flushing, every former immediate leaf call records a +/// instead, and the driver keeps its +/// visited-set bookkeeping (absorbing the renderer's old dedicated +/// set-collecting sink) so the SAME walk answers both questions. +/// then performs the actual GPU work afterward: +/// WbDrawDispatcher.PrepareOrderedStream uploads the WHOLE frame's +/// stream once, and each recorded +/// becomes one cheap DrawOrderedRange call over the already-uploaded +/// payload — interleaved, in the exact recorded order, with the leaf +/// renderer calls the OLD immediate driver made inline. Because Replay walks +/// the SAME event sequence Collect recorded at the SAME points the old code +/// flushed, GPU command order is unchanged bit-for-bit; only the number of +/// walks (two → one) and the shape of the GPU submission (many small +/// rebind-and-draw calls → one bind, many cheap draws) changes. +/// remains Collect immediately followed by Replay, for +/// callers (today: the headless referee suite) that do not need the split; +/// RetailPViewRenderer uses the split directly, since it must run +/// PrepareCellBatches/BuildAndBorrow BETWEEN them. +/// +/// The one mark rule that reproduces the whole frame script: +/// before EVERY leaf-renderer event (, +/// TerrainSlice, CellShell, ClearInteriorDepth, +/// ExitSeals, PunchFan) and before every +/// event, Collect records a +/// if the stream grew since the +/// last one (a no-op otherwise — "empty segments submit nothing"); a +/// building's own shell content is APPENDED (not marked) the moment +/// fires, so it only gets a +/// mark ahead of whatever non-stream event comes next (the next building's +/// alpha barrier, or the final mark at 's prepare step). +/// This single rule, combined with "shell before contents" per cell, +/// retail's own building order (alpha barrier → portal pass → shell — see +/// 's doc comment), and retail's +/// own interior-root DRAW order (landscape → clear → seals → the flood's own +/// cells — see 's doc +/// comment; this is NOT the order the walk's EVENTS fire in, which is +/// breakpoint-entry order matching the FW0 oracle traces), is what produces +/// every ordering constraint the plan's frame script names: [cell1 shell] +/// [cell1 contents mark] [cell2 shell] …, [alpha barrier] [punch fan(s) + +/// look-in flood(s), each following the SAME shell-then-contents per-cell +/// discipline] [building shell content mark], [landscape (if exit views +/// survived)] [interior depth clear] [exit-portal seals] [the interior +/// root's own flood cells], and a final mark at Replay's prepare step. No +/// special-casing per turn kind is needed beyond that. +/// +/// Retail anchors: SmartBox::RenderNormalMode @0x00453aa0 (the +/// root already ports), +/// RenderDeviceD3D::DrawSortCell @0x0059f140 (building-before- +/// DrawObjCell per landscape cell), PView::DrawCells @0x005a4840 +/// (DrawEnvCell @0x005a4abe before DrawObjCellForDummies +/// @0x005a4b0d per flooded cell; LScape::draw pc:432719, the depth +/// clear pc:432731-432732, and the exit-portal seals pc:432785-432786 — +/// ALL strictly before the flood's own cells, though the event marking +/// DrawCells entry fires before all three), RenderDeviceD3D::DrawBuilding +/// @0x0059f2a0 (the part->gfxobj[deg_level]!=0 gate @0x0059f2d3 +/// and the alpha-barrier → portal-pass → shell order @0x0059f30b–0x0059f345). +/// +internal sealed class WalkFrameDriver : IWalkEventSink +{ + private readonly WbDrawDispatcher _dispatcher; + private readonly WalkStaticStreamPopulator _populator; + private readonly IWalkFrameLeafRenderer _leafRenderer; + private readonly IWalkFrameWorldData _worldData; + private readonly IWalkFrameDriverTrace? _trace; + private readonly OrderedDrawStream _stream = new(); + private readonly List _events = new(); + private readonly List _markPositions = new(); + + // Campaign FW3.4a: visited-set collection, absorbed from the renderer's + // former dedicated set-collecting sink (RetailPViewRenderer's old + // WalkVisitedSetCollector) — the SAME shapes that sink produced, now + // populated by the ONE walk Collect already runs instead of a second + // walk pass dedicated to nothing but set-gathering. + internal HashSet VisitedCells { get; } = new(); + + /// FW4 slice 2: the interior root's ORDERED flood cell list, + /// exactly as retail's PView::DrawCells iterates it for the + /// exit-portal seals (pc:432785-432786) — captured at + /// . Empty for an + /// outdoor-rooted frame. The production seal draw iterates THIS list + /// (the walk's own flood), not the old visibility apparatus's — at the + /// #456 seam band the old builder's flood misses exit portals the walk + /// provably floods, leaving unsealed aperture depth the end-of-frame + /// alpha drain splats through (the cathedral falls shine-through). + internal List InteriorFloodCells { get; } = new(); + + // Replay scratch for StaticParticles events (sequential replay — one + // reused set is safe). + private readonly HashSet _staticParticleOwnerScratch = new(); + + private static void UnionOwners( + in WalkFrameStaticRecords records, HashSet destination) + { + foreach (RenderProjectionRecord record in records.Records) + { + if (record.Source.LocalEntityId != 0) + destination.Add(record.Source.LocalEntityId); + } + } + + internal List VisitedBuildings { get; } = new(); + + internal HashSet VisitedLandscapeCellIds { get; } = new(); + + // ---- transient per-Collect state (set in BeginFrame, read by Replay, + // cleared by Replay's own completion) ---- + private IWalkBuildingFrameContext? _ctx; + private Matrix4x4 _viewProjection; + private Vector3 _cameraWorldPosition; + private bool _skyDrawnThisFrame; + private WalkDrawStage? _currentDcStage; + private bool _readyToReplay; + + internal WalkFrameDriver( + WbDrawDispatcher dispatcher, + IWalkFrameLeafRenderer leafRenderer, + IWalkFrameWorldData worldData, + IWalkFrameDriverTrace? trace = null) + { + _dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher)); + _leafRenderer = leafRenderer ?? throw new ArgumentNullException(nameof(leafRenderer)); + _worldData = worldData ?? throw new ArgumentNullException(nameof(worldData)); + _trace = trace; + _populator = new WalkStaticStreamPopulator(dispatcher); + } + + /// + /// Drives one complete frame at retail's root (SmartBox::RenderNormalMode): + /// immediately followed by . Kept + /// for callers that don't need the split (today: the headless referee + /// suite) — RetailPViewRenderer calls the pair directly, since it + /// must run other frame work BETWEEN them (plan §FW3.4a). + /// + internal void RunFrame( + RetailFrameWalk walk, + uint cameraCellId, + WalkCell? cameraCell, + WalkLandscape landscape, + IRetailFrameWalkContext ctx, + IGpuFrame frame, + IGpuPassEncoder encoder, + Matrix4x4 viewProjection, + Vector3 cameraWorldPosition) + { + ArgumentNullException.ThrowIfNull(frame); + ArgumentNullException.ThrowIfNull(encoder); + + Collect( + walk, cameraCellId, cameraCell, landscape, ctx, + viewProjection, cameraWorldPosition); + Replay(frame, encoder); + } + + /// + /// Campaign FW3.4a Phase 1 — THE ONE WALK. Drives + /// with this driver as its sink, + /// sandwiched between /, + /// performing NO GPU work: see this type's own doc comment. + /// + internal void Collect( + RetailFrameWalk walk, + uint cameraCellId, + WalkCell? cameraCell, + WalkLandscape landscape, + IRetailFrameWalkContext ctx, + Matrix4x4 viewProjection, + Vector3 cameraWorldPosition) + { + ArgumentNullException.ThrowIfNull(walk); + ArgumentNullException.ThrowIfNull(landscape); + ArgumentNullException.ThrowIfNull(ctx); + + BeginFrame(ctx, viewProjection, cameraWorldPosition); + walk.WalkFrame(cameraCellId, cameraCell, landscape, ctx, this); + EndFrame(); + } + + /// + /// Opens a collect scope without driving the walk itself — for a caller + /// (or a test) that already holds an isolated walk entry point (e.g. one + /// or + /// call) and wants this + /// driver's turn handling without going through the top-level root. + /// is implemented in terms of this pair. Performs no + /// GPU work — see this type's own doc comment. + /// + internal void BeginFrame( + IWalkBuildingFrameContext ctx, + Matrix4x4 viewProjection, + Vector3 cameraWorldPosition) + { + ArgumentNullException.ThrowIfNull(ctx); + if (_ctx is not null) + { + throw new InvalidOperationException( + "WalkFrameDriver.BeginFrame was called while a previous frame was still open — " + + "the driver is not re-entrant (Campaign FW3.2b-1 fail-loud rule); call " + + "EndFrame (or let a thrown exception's cleanup run) before starting the next."); + } + + _ctx = ctx; + _viewProjection = viewProjection; + _cameraWorldPosition = cameraWorldPosition; + _skyDrawnThisFrame = false; + _currentDcStage = null; + _readyToReplay = false; + _stream.Reset(); + _events.Clear(); + _markPositions.Clear(); + VisitedCells.Clear(); + VisitedBuildings.Clear(); + VisitedLandscapeCellIds.Clear(); + InteriorFloodCells.Clear(); + } + + /// Records the final segment mark (plan §FW3.2b-1's "at frame + /// end: final segment flush", now a mark rather than a draw — see this + /// type's own doc comment), then closes the collect scope. The recorded + /// stream/events survive this call — consumes them — + /// which is the one behavioral difference from the pre-FW3.4a EndFrame, + /// which reset the stream here because it had just drawn it. + internal void EndFrame() + { + try + { + MarkIfGrown(); + } + finally + { + _ctx = null; + _readyToReplay = true; + } + } + + /// + /// Campaign FW3.4a Phase 2. Requires a completed Collect (an + /// having run since the last Replay) — throws + /// otherwise, rather than silently replaying a stale or empty event list. + /// Uploads the WHOLE collected stream exactly once (skipped when it is + /// empty), then walks the recorded events in order: a + /// issues one + /// WbDrawDispatcher.DrawOrderedRange call over the segment it + /// closes off; every other event kind issues its corresponding + /// call. Because Collect recorded + /// these events at EXACTLY the points the pre-FW3.4a immediate driver + /// used to flush/draw, this reproduces the SAME interleaved GPU command + /// order — the campaign invariant — from one walk instead of two. + /// + internal void Replay(IGpuFrame frame, IGpuPassEncoder encoder) + { + ArgumentNullException.ThrowIfNull(frame); + ArgumentNullException.ThrowIfNull(encoder); + if (!_readyToReplay) + { + throw new InvalidOperationException( + "WalkFrameDriver.Replay was called without a completed Collect (BeginFrame/" + + "EndFrame, or Collect/RunFrame) preceding it — there is nothing recorded to " + + "replay."); + } + + if (_stream.Count > 0) + _dispatcher.PrepareOrderedStream(frame, _stream, _viewProjection, _markPositions); + + int cursor = 0; + for (int i = 0; i < _events.Count; i++) + { + WalkFrameEvent e = _events[i]; + switch (e.Kind) + { + case WalkFrameEventKind.StreamMark: + int end = e.IntArg; + int count = end - cursor; + if (_trace is not null) + _trace.OnFlush(count, _stream.Stages.GetRange(cursor, count)); + _dispatcher.DrawOrderedRange(encoder, cursor, count); + cursor = end; + break; + case WalkFrameEventKind.Sky: + _leafRenderer.DrawSky(); + break; + case WalkFrameEventKind.TerrainSlice: + _leafRenderer.DrawTerrainSlice(e.IntArg); + break; + case WalkFrameEventKind.CellShell: + _leafRenderer.DrawCellShell(e.CellId); + break; + case WalkFrameEventKind.PunchFan: + _leafRenderer.DrawPunchFan(e.Polygon!, e.IntArg); + break; + case WalkFrameEventKind.AlphaBarrier: + _leafRenderer.AlphaBarrier(e.FloatArg); + break; + case WalkFrameEventKind.ClearInteriorDepth: + _leafRenderer.ClearInteriorDepth(); + break; + case WalkFrameEventKind.ExitSeals: + _leafRenderer.DrawExitSeals(); + break; + case WalkFrameEventKind.StaticParticles: + _staticParticleOwnerScratch.Clear(); + UnionOwners( + e.Building is WalkBuilding shellOwner + ? _worldData.GetBuildingShellStatics(shellOwner) + : _worldData.GetOutdoorStatics(e.CellId), + _staticParticleOwnerScratch); + if (_staticParticleOwnerScratch.Count > 0) + _leafRenderer.DrawStaticParticles(_staticParticleOwnerScratch); + break; + } + } + + _stream.Reset(); + _events.Clear(); + _markPositions.Clear(); + _readyToReplay = false; + } + + // ------------------------------------------------------------------ + // IWalkEventSink + // ------------------------------------------------------------------ + + void IWalkEventSink.Emit(in WalkEvent walkEvent) + { + switch (walkEvent.Kind) + { + case WalkEventKind.DrawInside: + _currentDcStage = WalkDrawStage.CellStatic; + VisitedCells.Add(walkEvent.CellId); + break; + case WalkEventKind.Landscape: + HandleLandscapeTurn(walkEvent.OutsideViewCount); + break; + case WalkEventKind.DrawCells: + foreach (uint id in walkEvent.Cells) + VisitedCells.Add(id); + HandleDrawCellsTurn(walkEvent.Cells); + break; + case WalkEventKind.Building: + // OnBuildingTurn (below) carries the actual side effects — + // this vocabulary-only event needs no driver action. + break; + } + } + + void IWalkEventSink.OnLandscapeCellTurn(uint cellId) + { + RequireOpenFrame(); + VisitedLandscapeCellIds.Add(cellId); + WalkFrameStaticRecords records = _worldData.GetOutdoorStatics(cellId); + _populator.PopulateOutdoorStatics( + _stream, cellId, records.Records, records.TupleLandblockId, + _cameraWorldPosition, _viewProjection); + // FW4 (the #132 positional invariant): this cell's emitter owners + // submit AT THIS TURN, so nearer buildings' pre-punch barriers + // drain them against still-true depth — see + // WalkFrameEventKind.StaticParticles. Mark first so the cell's own + // meshes flush ahead of its particle submission (retail's + // per-object DrawObjCell order). + if (HasAnyOwner(records)) + { + MarkIfGrown(); + _events.Add(WalkFrameEvent.LandscapeCellParticles(cellId)); + } + } + + private static bool HasAnyOwner(in WalkFrameStaticRecords records) + { + foreach (RenderProjectionRecord record in records.Records) + { + if (record.Source.LocalEntityId != 0) + return true; + } + return false; + } + + void IWalkEventSink.OnBuildingTurn(WalkBuilding building) + { + ArgumentNullException.ThrowIfNull(building); + IWalkBuildingFrameContext ctx = RequireOpenFrame(); + VisitedBuildings.Add(building); + + // D3DPolyRender::FlushAlphaList(0f) @0x0059f30b — retail's alpha + // barrier, first inside the gate. The portal pass (punches + + // look-ins) follows this call; the building's own shell content is + // appended only once that pass completes (OnBuildingShellTurn). + MarkIfGrown(); + _events.Add(WalkFrameEvent.AlphaBarrier(ctx.ViewerDistanceTo(building))); + + _currentDcStage = WalkDrawStage.LookInStatic; + } + + void IWalkEventSink.OnBuildingShellTurn(WalkBuilding building) + { + ArgumentNullException.ThrowIfNull(building); + RequireOpenFrame(); + + // CPhysicsPart::Draw(parts, 0) @0x0059f331 — retail's plain-mesh + // shell draw, strictly after the portal pass (CPhysicsPart::Draw + // (parts, 1)). Mark first so this building's shell content never + // shares a replayed range with whatever the portal pass's last + // look-in flood appended (keeps every range single-stage). + MarkIfGrown(); + WalkFrameStaticRecords shell = _worldData.GetBuildingShellStatics(building); + _populator.PopulateCell( + _stream, WalkDrawStage.BuildingShell, building.PositionCellId, + shell.Records, shell.TupleLandblockId, _cameraWorldPosition, _viewProjection); + // FW4 (the #132 positional invariant): the building's own shell + // emitters submit at the shell turn, after the shell content + // flushes — see WalkFrameEventKind.StaticParticles. + if (HasAnyOwner(shell)) + { + MarkIfGrown(); + _events.Add(WalkFrameEvent.BuildingShellParticles(building)); + } + } + + void IWalkEventSink.OnPunchGeometry( + WalkBuilding building, WalkPolygon polygon, int activeViewIndex) + { + ArgumentNullException.ThrowIfNull(building); + ArgumentNullException.ThrowIfNull(polygon); + RequireOpenFrame(); + + MarkIfGrown(); + Matrix4x4 worldTransform = _worldData.GetBuildingWorldTransform(building); + _events.Add( + WalkFrameEvent.PunchFan(TransformToWorld(polygon, worldTransform), activeViewIndex)); + } + + void IWalkEventSink.OnInteriorFloodDrawTurn(IReadOnlyList cells) + { + ArgumentNullException.ThrowIfNull(cells); + RequireOpenFrame(); + + // PView::DrawCells @0x005a4840: the gated full depth clear + // (pc:432731-432732) then the exit-portal seals (pc:432785-432786) — + // both unconditional for an interior root's own flood, whether or + // not a landscape turn just ran (see this driver's type doc + // comment). + MarkIfGrown(); + _events.Add(WalkFrameEvent.ClearInteriorDepth()); + + MarkIfGrown(); + _events.Add(WalkFrameEvent.ExitSeals()); + + // FW4 slice 2: retain the ordered flood for the seal draw (the + // DrawExitSeals leaf runs at Replay, when Collect has long filled + // this) — see the property's own doc comment. + InteriorFloodCells.Clear(); + for (int i = 0; i < cells.Count; i++) + InteriorFloodCells.Add(cells[i]); + + for (int i = 0; i < cells.Count; i++) + EmitCellTurn(WalkDrawStage.CellStatic, cells[i]); + } + + // ------------------------------------------------------------------ + // Turn handlers + // ------------------------------------------------------------------ + + private void HandleLandscapeTurn(int activeViewCount) + { + RequireOpenFrame(); + if (activeViewCount < 1) + { + throw new InvalidOperationException( + $"A Landscape turn fired with {activeViewCount} active views — " + + "RetailFrameWalk only draws the landscape through an installed view set " + + "(the outdoor root's full-screen default view, or an interior root's " + + "surviving exit views, both at least 1). A zero/negative count is a " + + "walk/driver desync (Campaign FW fail-loud rule)."); + } + if (_skyDrawnThisFrame) + { + throw new InvalidOperationException( + "A second Landscape turn fired in one frame — RetailFrameWalk.WalkFrame/" + + "DrawInside's own call graph guarantees at most one Landscape turn per " + + "frame (outdoor root draws it once; an interior root draws it at most " + + "once more, through surviving exit views). A second occurrence is a walk/" + + "driver desync, not something to silently double-draw sky for (Campaign " + + "FW3.2b-1 fail-loud rule)."); + } + + MarkIfGrown(); + _events.Add(WalkFrameEvent.Sky()); + _skyDrawnThisFrame = true; + // FW4 slice 6 (correcting slice 1's per-view fan): retail's + // LScape::draw draws the terrain blocks ONCE per landscape turn — + // the active views feed only the block-level visibility union + // (CheckBlocks); terrain cells are ordinary meshes and retail never + // clips those per view (pixel exactness = the depth clear + seals + + // interior repaint afterward). One terrain turn, always; the walk's + // views still own the punch fans and dynamics apertures. + _events.Add(WalkFrameEvent.TerrainSlice(0)); + } + + private void HandleDrawCellsTurn(IReadOnlyList cells) + { + RequireOpenFrame(); + if (_currentDcStage is not { } stage) + { + throw new InvalidOperationException( + "A DrawCells turn fired before any DrawInside or Building turn established " + + "which stage its cells belong to — a walk/driver desync (Campaign FW3.2b-1 " + + "fail-loud rule): RetailFrameWalk only ever emits DrawCells after DrawInside " + + "(the interior root's own flood) or after a building's look-in portal pass."); + } + + if (stage == WalkDrawStage.CellStatic) + { + // The interior root's OWN flood: this DC event fired at + // breakpoint-ENTRY order (matching the FW0 oracle traces), not + // retail's actual draw point — RECORD only. RetailFrameWalk. + // DrawInside hands the SAME cell list to + // OnInteriorFloodDrawTurn later, at the point retail really + // draws it (after the landscape turn, or immediately when no + // exit views survived) — see that method's doc comment. + return; + } + + // Any other stage (LookInStatic) is a building's look-in flood: + // retail calls DrawCells re-entrantly there with no landscape/clear/ + // seal step, so its DC event already fires at the real draw point — + // record immediately, unchanged from before this correction. + for (int i = 0; i < cells.Count; i++) + EmitCellTurn(stage, cells[i]); + } + + private void EmitCellTurn(WalkDrawStage stage, uint cellId) + { + MarkIfGrown(); + _events.Add(WalkFrameEvent.CellShell(cellId)); + WalkFrameStaticRecords records = _worldData.GetCellStatics(cellId); + _populator.PopulateCell( + _stream, stage, cellId, records.Records, records.TupleLandblockId, + _cameraWorldPosition, _viewProjection); + } + + /// Campaign FW3.4a: the collect-time analogue of the old + /// immediate driver's FlushIfNonEmpty — records a + /// at the stream's current + /// length if it grew since the last mark (a no-op otherwise, exactly + /// like that method's own "empty segments submit nothing" rule). Also + /// appends the boundary to , which + /// hands to PrepareOrderedStream so a merge + /// run can never span it — see WbDrawDispatcher.BuildOrderedMergeRuns's + /// forcedBreaksAscending parameter for why that matters. + private void MarkIfGrown() + { + int count = _stream.Count; + int last = _markPositions.Count > 0 ? _markPositions[^1] : 0; + if (count == last) + return; + + _markPositions.Add(count); + _events.Add(WalkFrameEvent.Mark(count)); + } + + private IWalkBuildingFrameContext RequireOpenFrame() => + _ctx ?? throw new InvalidOperationException( + "WalkFrameDriver received a walk turn outside BeginFrame/EndFrame — call " + + "BeginFrame (or Collect/RunFrame) before driving the walk with this driver as " + + "its IWalkEventSink."); + + /// ConstructBuildingView's polygon is building-local; the + /// punch fan needs world space. Vertices transform directly; the plane + /// normal uses (correct for the + /// rigid, shear-free placements and + /// build) and D is rederived from + /// the transformed normal and the first transformed vertex — the SAME + /// construction / + /// already use for their own polygons (Plane = new WalkPlane(normal, + /// -Vector3.Dot(normal, vertices[0]))). + private static WalkPolygon TransformToWorld(WalkPolygon local, Matrix4x4 worldTransform) + { + var vertices = new Vector3[local.Vertices.Length]; + for (int i = 0; i < vertices.Length; i++) + vertices[i] = Vector3.Transform(local.Vertices[i], worldTransform); + + Vector3 normal = local.Vertices.Length > 0 + ? Vector3.Normalize(Vector3.TransformNormal(local.Plane.Normal, worldTransform)) + : Vector3.Zero; + float d = vertices.Length > 0 ? -Vector3.Dot(normal, vertices[0]) : 0f; + + return new WalkPolygon { Vertices = vertices, Plane = new WalkPlane(normal, d) }; + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkLandscape.cs b/src/AcDream.App/Rendering/Walk/WalkLandscape.cs new file mode 100644 index 00000000..bad0855c --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkLandscape.cs @@ -0,0 +1,235 @@ +namespace AcDream.App.Rendering.Walk; + +/// One landblock as the walk sees it (retail CLandBlock): +/// static shape plus the per-frame visibility the landscape pass writes. +public sealed class WalkLandBlock +{ + /// Additive (Campaign FW3.2b-1): this block's landblock id in + /// retail's (bx<<24 | by<<16) encoding — + /// already derives + /// (bx, by) from this SAME encoding (its BlockCoords + /// helper), and / + /// 's low-word convention + /// (low >= 1 && low <= 0x40) both key off it too. + /// This field lets a per-visited-cell walk-turn hook + /// () recover a real + /// outdoor cell id — (LandblockId & 0xFFFF0000) | (cellIndex+1) + /// — without a second landblock lookup. Defaults to 0: purely additive, + /// unread by every pre-FW3.2b-1 caller (the FW1 conformance harness's + /// synthetic blocks never populate it). + public uint LandblockId; + + public int SideCellCount = 8; + public float MaxZ; + public float MinZ; + + /// Per cell index (x * side + y): the building the cell's + /// CSortCell owns, if any. + public WalkBuilding?[] CellBuildings = []; + + // ---- per-frame visibility (draw_check_blocks / landcell_check) ---- + public WalkBoundingType InView; + public WalkBoundingType[] CellInView = []; + + // ---- per-block cell draw order cache (calc_sq_draw_order) ---- + public int[] DrawArray = []; + public int ClosestX = -1; + public int ClosestY = -1; + + public void EnsureCellArrays() + { + int n = SideCellCount * SideCellCount; + if (CellInView.Length < n) CellInView = new WalkBoundingType[n]; + if (DrawArray.Length < n) DrawArray = new int[n]; + if (CellBuildings.Length < n) CellBuildings = new WalkBuilding?[n]; + } +} + +/// The viewer-centered block grid (retail LScape): mid_width +/// × mid_width blocks (retail 11×11), the near-to-far block draw list, and +/// the viewer's grid offsets (calc_draw_order). +public sealed class WalkLandscape +{ + public const float BlockLength = 192f; // 24 m cell × 8 (BN elided this to '0f') + public const float CellLength = 24f; + + public int MidWidth = 11; + public WalkLandBlock?[] Blocks = []; // [x * MidWidth + y] + public int ViewerBlockX; + public int ViewerBlockY; + public int ViewerCellX; // viewer cell & 7 per axis (SqCoord) + public int ViewerCellY; + + public int[] BlockDrawList = []; + public int BlockDrawCount; + + public WalkLandBlock? BlockAt(int gridX, int gridY) + => gridX >= 0 && gridX < MidWidth && gridY >= 0 && gridY < MidWidth + ? Blocks[gridX * MidWidth + gridY] + : null; + + /// LScape::get_block_order + per-block + /// calc_draw_order: rebuild the near-to-far block list and each + /// block's far-to-near cell order for the current viewer placement. + public void CalcDrawOrder() + { + if (BlockDrawList.Length < MidWidth * MidWidth) + BlockDrawList = new int[MidWidth * MidWidth]; + BlockDrawCount = LandWalkOrder.GetBlockOrder( + ViewerBlockX, ViewerBlockY, MidWidth, BlockDrawList); + + for (int x = 0; x < MidWidth; x++) + { + for (int y = 0; y < MidWidth; y++) + { + WalkLandBlock? block = Blocks[x * MidWidth + y]; + if (block is null) continue; + block.EnsureCellArrays(); + LandDirection dir = LandWalkOrder.GetDirection( + x - ViewerBlockX, y - ViewerBlockY); + (int cx, int cy) = LandWalkOrder.ClosestCell( + dir, ViewerCellX, ViewerCellY, block.SideCellCount); + // Retail's early-out: same closest cell keeps the stale order + // (the dir field is NOT compared — keep the quirk). + if (cx == block.ClosestX && cy == block.ClosestY) continue; + block.ClosestX = cx; + block.ClosestY = cy; + LandWalkOrder.FillCellOrderFarToNear( + cx, cy, block.SideCellCount, + block.DrawArray.AsSpan(0, block.SideCellCount * block.SideCellCount)); + } + } + } + + /// + /// LScape::draw_check_blocks @0x00505f80 + landcell_check + /// @0x005050a0: clear all visibility, then for EACH view of the active + /// portal view union block/cell visibility from clip-height interval + /// grids at 192 m block / 24 m cell pitch in viewer-block-relative + /// coordinates. A block/cell marked by an earlier view is never + /// downgraded (blocks are only written non-Outside; cells are skipped + /// once in view). + /// + public void CheckBlocks(in WalkPlane cyPlane, WalkPortalView activeViews) + { + foreach (WalkLandBlock? block in Blocks) + { + if (block is null) continue; + block.EnsureCellArrays(); + block.InView = WalkBoundingType.Outside; + Array.Clear(block.CellInView, 0, block.SideCellCount * block.SideCellCount); + } + + int viewCount = activeViews.ViewCount; + Span boundsScratch = stackalloc float[32]; + // Corner interval grids: 2 rolling rows of (MidWidth+1) corners, + // each corner a plane-classification vector. + int cornerRow = MidWidth + 1; + var intervals = new float[2 * cornerRow][]; + for (int i = 0; i < intervals.Length; i++) intervals[i] = new float[32]; + + int v = 0; + while (true) + { + WalkPlane[] edgePlanes; + int edgeCount; + bool last; + if (viewCount == 0) + { + edgePlanes = []; + edgeCount = 0; + last = true; + } + else + { + WalkViewPoly poly = activeViews.View.Polys[v]; + edgePlanes = new WalkPlane[poly.VertexCount]; + for (int k = 0; k < poly.VertexCount; k++) + edgePlanes[k] = activeViews.View.Vertices[poly.VertexIndex + k].Plane; + edgeCount = poly.VertexCount; + v++; + last = v == viewCount; + } + + // Seed the west column (grid x = 0) into parity row 0. + for (int j = 0; j <= MidWidth; j++) + WalkVisibilityMath.FillClipHeights( + (0 - ViewerBlockX) * BlockLength, + (j - ViewerBlockY) * BlockLength, + cyPlane, edgePlanes, intervals[j]); + for (int bx = 0; bx < MidWidth; bx++) + { + int westRow = (bx & 1) * cornerRow; + int eastRow = ((bx - 1) & 1) * cornerRow; + for (int j = 0; j <= MidWidth; j++) + WalkVisibilityMath.FillClipHeights( + (bx + 1 - ViewerBlockX) * BlockLength, + (j - ViewerBlockY) * BlockLength, + cyPlane, edgePlanes, intervals[eastRow + j]); + for (int by = 0; by < MidWidth; by++) + { + WalkLandBlock? block = Blocks[bx * MidWidth + by]; + if (block is null) continue; + WalkBoundingType bt = WalkVisibilityMath.BlockCheck( + intervals[westRow + by], intervals[westRow + by + 1], + intervals[eastRow + by], intervals[eastRow + by + 1], + edgeCount, block.MaxZ, block.MinZ); + if (bt != WalkBoundingType.Outside) + { + block.InView = bt; + LandCellCheck(block, bx, by, cyPlane, edgePlanes); + } + } + } + if (last) return; + } + } + + // landcell_check @0x005050a0: non-8×8 far blocks mark all cells PARTIAL; + // ENTIRELY_INSIDE blocks mark all cells 2; else per-cell corner grids at + // 24 m pitch, skipping cells already in view (union across views). + private void LandCellCheck( + WalkLandBlock block, int bx, int by, + in WalkPlane cyPlane, WalkPlane[] edgePlanes) + { + int n = block.SideCellCount; + if (n != 8) + { + for (int i = 0; i < n * n; i++) + block.CellInView[i] = WalkBoundingType.PartiallyInside; + return; + } + if (block.InView == WalkBoundingType.EntirelyInside) + { + for (int i = 0; i < n * n; i++) + block.CellInView[i] = WalkBoundingType.EntirelyInside; + return; + } + float x0 = (bx - ViewerBlockX) * BlockLength; + float y0 = (by - ViewerBlockY) * BlockLength; + int cornerRow = n + 1; + var grid = new float[2 * cornerRow][]; + for (int i = 0; i < grid.Length; i++) grid[i] = new float[32]; + for (int j = 0; j <= n; j++) + WalkVisibilityMath.FillClipHeights( + x0, j * CellLength + y0, cyPlane, edgePlanes, grid[j]); + for (int cx = 0; cx < n; cx++) + { + int westRow = (cx & 1) * cornerRow; + int eastRow = ((cx - 1) & 1) * cornerRow; + for (int j = 0; j <= n; j++) + WalkVisibilityMath.FillClipHeights( + (cx + 1) * CellLength + x0, j * CellLength + y0, + cyPlane, edgePlanes, grid[eastRow + j]); + for (int cy = 0; cy < n; cy++) + { + if (block.CellInView[n * cx + cy] != WalkBoundingType.Outside) + continue; // union across views: never downgrade + block.CellInView[n * cx + cy] = WalkVisibilityMath.BlockCheck( + grid[westRow + cy], grid[westRow + cy + 1], + grid[eastRow + cy], grid[eastRow + cy + 1], + edgePlanes.Length, block.MaxZ, block.MinZ); + } + } + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkLandscapeAssembler.cs b/src/AcDream.App/Rendering/Walk/WalkLandscapeAssembler.cs new file mode 100644 index 00000000..e1871383 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkLandscapeAssembler.cs @@ -0,0 +1,194 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW3.1 — the production sibling of the FW1 conformance harness's +/// WalkLandscapeDatBuilder +/// (tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeDatBuilder.cs): owns +/// retail's viewer-centred block grid (LScape mid_radius = 25 → a +/// 51×51 window, recon 2026-08-30) and its LOD ring pyramid +/// (). +/// +/// Unlike the test builder — which re-scans the whole grid from a +/// DatCollection on every call — this class is fed INCREMENTALLY from +/// landblock commit/retire (/ +/// ), the same lifecycle +/// Wb.BuildingRegistry and CellVisibility already follow. Each +/// landblock's z-slab and building placements are computed ONCE, on the +/// streaming worker thread, at landblock-build time +/// (LandblockBuildFactory/WalkBuildingFactory) — publishing +/// here is a pure dictionary write, no DAT or GfxObj work. +/// +/// recentres the grid on the camera's block, porting +/// the test builder's viewer-cell recompute; it goes further by also +/// reflowing the 51×51 window when the camera crosses into a different +/// landblock (the test builder never needs this — every moving fixture stays +/// within its anchor block). Reflow only touches already-published data (a +/// dictionary lookup per slot); no DAT access ever happens here. +/// +/// No frame currently calls or reads +/// — FW3.2 wires RetailFrameWalk into the +/// render loop. This class exists now so that wiring is additive, and so the +/// FW3.1 conformance gate can exercise the SAME assembly code path +/// production will drive. +/// +public sealed class WalkLandscapeAssembler +{ + /// Retail LScape mid_radius (recon 2026-08-30) — NOT + /// acdream's streaming radius (two-tier N1/N2), which is smaller. Blocks + /// outside the streamed window simply stay unpublished (null slots). + public const int MidRadius = 25; + + public const int GridWidth = MidRadius * 2 + 1; + + private sealed class BlockData + { + public required float MaxZ; + public required float MinZ; + public required IReadOnlyList Buildings; + } + + private readonly Dictionary<(int X, int Y), BlockData> _blocks = new(); + private int _viewerBlockX = int.MinValue; + private int _viewerBlockY = int.MinValue; + + public WalkLandscape Landscape { get; } = new() + { + MidWidth = GridWidth, + Blocks = new WalkLandBlock?[GridWidth * GridWidth], + ViewerBlockX = MidRadius, + ViewerBlockY = MidRadius, + }; + + /// Landblock commit + /// (LandblockRenderPublisher.AdvanceCompleteOne's + /// BuildingRegistryCommitted step): register/replace this + /// landblock's z-slab and building placements. If the landblock falls + /// within the CURRENT window, the visible slot refreshes immediately. + public void PublishLandblock( + uint landblockId, float maxZ, float minZ, + IReadOnlyList buildings) + { + (int bx, int by) = BlockCoords(landblockId); + _blocks[(bx, by)] = new BlockData { MaxZ = maxZ, MinZ = minZ, Buildings = buildings }; + RefreshSlotIfWindowed(bx, by); + } + + /// Landblock retirement (LandblockRenderPublisher + /// .RemoveBuildingRegistry): drop this landblock's data. Safe to call + /// on a landblock that never published (no-op). + public void RetireLandblock(uint landblockId) + { + (int bx, int by) = BlockCoords(landblockId); + _blocks.Remove((bx, by)); + RefreshSlotIfWindowed(bx, by); + } + + /// Recentres the grid on the camera's block and updates the + /// sub-block cell offsets (retail's viewer recentre — + /// WalkLandscapeDatBuilder.SetViewer's port). When the camera's + /// block hasn't changed since the last call, this only updates + /// / + /// — zero allocation, matching the test builder's lightweight path. A + /// block crossing additionally reflows the 51×51 window from already- + /// published data (a bounded, allocation-free dictionary-lookup pass — + /// no DAT/GfxObj work, which already happened at publish time). + public void SetViewer(uint cameraCellId, Vector3 cameraOrigin) + { + int cameraBlockX = (int)(cameraCellId >> 24); + int cameraBlockY = (int)((cameraCellId >> 16) & 0xFF); + if (cameraBlockX != _viewerBlockX || cameraBlockY != _viewerBlockY) + { + _viewerBlockX = cameraBlockX; + _viewerBlockY = cameraBlockY; + RebuildWindow(); + } + + uint low = cameraCellId & 0xFFFFu; + if (low >= 1 && low <= 0x40) + { + int cellIndex = (int)low - 1; + Landscape.ViewerCellX = cellIndex / 8; + Landscape.ViewerCellY = cellIndex % 8; + } + else + { + // Interior camera: derive the outside-projected landcell from + // the camera origin, matching the test builder's fallback + // (Position::get_outside_cell_id via SmartBox::RenderNormalMode's + // seen_outside arm). + Landscape.ViewerCellX = Math.Clamp((int)MathF.Floor(cameraOrigin.X / 24f), 0, 7); + Landscape.ViewerCellY = Math.Clamp((int)MathF.Floor(cameraOrigin.Y / 24f), 0, 7); + } + } + + /// ring <= 1 ? 8 : ring == 2 ? 4 : ring <= 4 ? 2 : 1 + /// — the live-observed resolution pyramid (recon 2026-08-30): 8×8 in the + /// 3×3 core, 4×4 at ring 2, 2×2 at rings 3–4, 1×1 beyond. Buildings only + /// attach at full resolution (ring ≤ 1) — the traces show no BLD beyond + /// ±1 block. + internal static int SideCellCountForRing(int ring) + => ring <= 1 ? 8 : ring == 2 ? 4 : ring <= 4 ? 2 : 1; + + internal static int RingOf(int gridX, int gridY) + => Math.Max(Math.Abs(gridX - MidRadius), Math.Abs(gridY - MidRadius)); + + private void RebuildWindow() + { + for (int gx = 0; gx < GridWidth; gx++) + { + for (int gy = 0; gy < GridWidth; gy++) + { + int bx = _viewerBlockX + gx - MidRadius; + int by = _viewerBlockY + gy - MidRadius; + Landscape.Blocks[gx * GridWidth + gy] = BuildSlot(bx, by, gx, gy); + } + } + } + + private void RefreshSlotIfWindowed(int bx, int by) + { + if (_viewerBlockX == int.MinValue) + return; // SetViewer has never run — no window to refresh yet. + int gx = bx - _viewerBlockX + MidRadius; + int gy = by - _viewerBlockY + MidRadius; + if (gx < 0 || gx >= GridWidth || gy < 0 || gy >= GridWidth) + return; + Landscape.Blocks[gx * GridWidth + gy] = BuildSlot(bx, by, gx, gy); + } + + private WalkLandBlock? BuildSlot(int bx, int by, int gx, int gy) + { + if (bx < 0 || bx > 0xFF || by < 0 || by > 0xFF) + return null; + if (!_blocks.TryGetValue((bx, by), out BlockData? data)) + return null; + + int sideCellCount = SideCellCountForRing(RingOf(gx, gy)); + var block = new WalkLandBlock + { + // Additive (Campaign FW3.2b-1): same (bx<<24 | by<<16) encoding + // BlockCoords decodes below — see WalkLandBlock.LandblockId. + LandblockId = (uint)bx << 24 | (uint)by << 16, + SideCellCount = sideCellCount, + MaxZ = data.MaxZ, + MinZ = data.MinZ, + }; + block.EnsureCellArrays(); + + if (sideCellCount == 8) + { + foreach (WalkBuildingFactory.Entry entry in data.Buildings) + { + int cellIndex = (int)(entry.Building.PositionCellId & 0xFFFFu) - 1; + if (cellIndex >= 0 && cellIndex < 64) + block.CellBuildings[cellIndex] = entry.Building; + } + } + return block; + } + + private static (int X, int Y) BlockCoords(uint landblockId) + => ((int)((landblockId >> 24) & 0xFFu), (int)((landblockId >> 16) & 0xFFu)); +} diff --git a/src/AcDream.App/Rendering/Walk/WalkPView.cs b/src/AcDream.App/Rendering/Walk/WalkPView.cs new file mode 100644 index 00000000..faeb9859 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkPView.cs @@ -0,0 +1,462 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW1 — retail PView's interior flood, transcribed from the +/// flood-read appendix (docs/research/2026-08-30-fw-flood-pseudocode-appendix.md) +/// plus the raw bodies re-read for AddToCell @0x005a4d90, AdjustDrawList +/// @0x005a4e90, AdjustCellPlace @0x005a5010, FixCellList @0x005a5250, +/// AdjustCellView @0x005a5770, and ConstructView @0x005a57b0. +/// +/// PORTAL-FLAG CONVENTION (resolved 2026-08-30 — the PDB names mislead): +/// inflag (+4) == 1 marks a portal whose polygon FACES the viewer as +/// a visible surface (it feeds max_indist); inflag == 0 with +/// seen (+0) == 1 marks an OPENING on the viewer's look-through side +/// (InitCell's side == portal_side arm — the same side condition +/// ConstructView(CBldPortal) REQUIRES for building look-ins). +/// ClipPortals' traversal gate seen != 0 && inflag != 1 +/// therefore selects exactly the armed openings; the entry portal is forced +/// {seen=1, inflag=1} so the flood never walks back out of it. Transcribe; +/// do not "fix" the names. +/// +public sealed class WalkPView +{ + private static int _masterTimestamp; + + private readonly struct TodoEntry(WalkCell cell, float dist) + { + public readonly WalkCell Cell = cell; + public readonly float Dist = dist; + } + + public readonly WalkPortalView OutsideView = new(); + public readonly List CellDrawList = new(); + private readonly List _todo = new(); + private readonly WalkPortalView _otherPortalScratch = new(); // retail's static temp_view + private Vector2[] _activeViewVerts = new Vector2[32]; + private int _activeViewVertCount; + private readonly WalkScreenPoint[] _projectScratch = new WalkScreenPoint[64]; + private readonly WalkScreenPoint[] _clipScratch = new WalkScreenPoint[64]; + + /// Retail PView.draw_landscape: exit portals raise + /// only when set. + public bool DrawLandscape = true; + + /// Retail Render::PortalList as ClipPortals installs it — + /// the last processed cell's top view (consumed by the landscape draw). + public WalkPortalView? PortalList { get; private set; } + + // ------------------------------------------------------------------ + // ConstructView (CEnvCell overload) @0x005a57b0 — the flood. + // ------------------------------------------------------------------ + public void ConstructView(WalkCell seed, int throughPortalIndex, IWalkFrameContext ctx) + { + OutsideView.ResetForPush(); // outside_view.view_count = 0 (counters only) + _masterTimestamp++; + _todo.Clear(); + CellDrawList.Clear(); + InitCell(seed, throughPortalIndex, ctx); + InsCellTodoList(seed, 0f); + while (_todo.Count > 0) + { + WalkCell cell = _todo[^1].Cell; + _todo.RemoveAt(_todo.Count - 1); + CellDrawList.Add(cell); + cell.TopView.CellViewDone = true; + if (ClipPortals(cell, 0, ctx)) + AddViewToPortals(cell, ctx); + } + } + + // ------------------------------------------------------------------ + // InitCell @0x005a4b70 (Ghidra-verified raw re-read 2026-08-30). + // ------------------------------------------------------------------ + public bool InitCell(WalkCell cell, int entryPortalIndex, IWalkFrameContext ctx) + { + WalkPortalView top = cell.TopView; + if (top.ViewCount == 0) return false; + + Vector3 viewpoint = ctx.ViewpointIn(cell); + top.CellViewDone = false; + top.ViewTimestamp = _masterTimestamp; + if (top.PortalFlags.Length < cell.Portals.Length) + top.PortalFlags = new WalkPortalFlags[cell.Portals.Length]; + + float maxDistSquared = 0f; + bool anyLookThrough = false; // retail var_4 (uninitialized there; benign — init false) + + for (int i = 0; i < cell.Portals.Length; i++) + { + ref WalkPortalFlags flags = ref top.PortalFlags[i]; + WalkPolygon poly = cell.PortalPolygons[cell.Portals[i].PolygonIndex]; + + if (i == entryPortalIndex && !flags.InView) + { + // Entered-through portal: forced facing + armed — never re-traversed. + flags.InView = true; + flags.Seen = true; + } + else + { + flags.Seen = false; + float d = Vector3.Dot(poly.Plane.Normal, viewpoint) + poly.Plane.D; + if (d <= WalkVisibilityMath.Epsilon && d >= -WalkVisibilityMath.Epsilon) + { + flags.InView = false; // IN_PLANE: neither surface nor opening + anyLookThrough = true; + } + else + { + int side = d > WalkVisibilityMath.Epsilon ? 0 : 1; + if (side == cell.Portals[i].PortalSide) + { + flags.InView = false; // viewer on the look-through side (opening) + anyLookThrough = true; + } + else + { + flags.InView = true; // portal polygon faces the viewer + } + } + if (AcDream.Core.Rendering.RenderingDiagnostics.WalkPortalProbeThisFrame) + { + Console.WriteLine( + $"[walk-portal] init cell={cell.CellId:x8} i={i} " + + $"dest={cell.Portals[i].OtherCellId:x8} d={d:F3} " + + $"pside={cell.Portals[i].PortalSide} " + + $"inview={(flags.InView ? 1 : 0)}"); + } + } + + if (flags.InView) + { + foreach (Vector3 v in poly.Vertices) + { + float dx = viewpoint.X - v.X; + float dy = viewpoint.Y - v.Y; + float dz = viewpoint.Z - v.Z; + float d2 = dx * dx + dy * dy + dz * dz; + if (d2 > maxDistSquared) maxDistSquared = d2; + } + } + } + top.MaxInDistSquared = maxDistSquared; + + // Fixup: arm every opening (retail runs this once per view with a + // vestigial set_view per pass; the flag writes are idempotent). + if (anyLookThrough && top.ViewCount > 0) + { + for (int j = 0; j < cell.Portals.Length; j++) + { + ref WalkPortalFlags flags = ref top.PortalFlags[j]; + if (!flags.InView && !flags.Seen) flags.Seen = true; + } + } + + top.UpdateCount = top.ViewCount; + return true; + } + + // ------------------------------------------------------------------ + // InsCellTodoList @0x005a4f50 — descending by dist from index 0; + // END = nearest; pop-from-END = nearest-first (the Ghidra-corrected + // polarity: the sink stops under the first STRICTLY greater key). + // ------------------------------------------------------------------ + public void InsCellTodoList(WalkCell cell, float dist) + { + int pos = _todo.Count; + while (pos > 0 && !(dist < _todo[pos - 1].Dist)) + pos--; + _todo.Insert(pos, new TodoEntry(cell, dist)); + } + + // ------------------------------------------------------------------ + // ClipPortals @0x005a5520. + // ------------------------------------------------------------------ + public bool ClipPortals(WalkCell cell, int startView, IWalkFrameContext ctx) + { + WalkPortalView top = cell.TopView; + PortalList = top; // set BEFORE any early-out (retail) + if (cell.Portals.Length <= 0) return false; + + // Pass 1: which portals are live; resolve+cache neighbors. + bool anyLive = false; + for (int j = 0; j < cell.Portals.Length; j++) + { + ref WalkPortalFlags flags = ref top.PortalFlags[j]; + if (!flags.Seen || flags.InView) continue; + ref WalkCellPortal portal = ref cell.Portals[j]; + if (cell.CachedNeighbors[j] is null && portal.OtherCellId != 0xFFFFFFFFu) + { + cell.CachedNeighbors[j] = ctx.GetVisible(portal.OtherCellId); + if (cell.CachedNeighbors[j] is null) continue; // not loaded: silently dead + } + anyLive = true; + } + if (!anyLive) return false; + + // Pass 2: clip every live portal against each view in the window. + for (int i = startView; i < top.ViewCount; i++) + { + SetView(top, i); + for (int j = 0; j < cell.Portals.Length; j++) + { + ref WalkPortalFlags flags = ref top.PortalFlags[j]; + if (!flags.Seen || flags.InView) continue; + ref WalkCellPortal portal = ref cell.Portals[j]; + int n = GetClip( + cell, portal.PortalSide, + cell.PortalPolygons[portal.PolygonIndex], + doClip: true, ctx, _clipScratch); + if (AcDream.Core.Rendering.RenderingDiagnostics.WalkPortalProbeThisFrame) + { + Console.WriteLine( + $"[walk-portal] clip cell={cell.CellId:x8} view={i} j={j} " + + $"dest={portal.OtherCellId:x8} n={n}"); + } + if (n == 0) continue; + + if (portal.OtherCellId == 0xFFFFFFFFu) + { + if (DrawLandscape) + { + if (ctx.ClipLandscape) + WalkCopyView.Append( + OutsideView, _clipScratch.AsSpan(0, n), + ctx.Rays, ctx.WorldViewpoint); + else + WalkCopyView.AppendFullViewportQuad( + OutsideView, ctx.Rays, ctx.WorldViewpoint, + ctx.ViewportWidth, ctx.ViewportHeight); + } + } + else if (cell.CachedNeighbors[j] is WalkCell neighbor) + { + if (!portal.ExactMatch && portal.OtherPortalId >= 0) + { + n = OtherPortalClip(cell, j, n, ctx); + SetView(top, i); // restore after the far-frame excursion + if (n == 0) continue; + } + if (neighbor.NumView != 0) + WalkCopyView.Append( + neighbor.TopView, _clipScratch.AsSpan(0, n), + ctx.Rays, ctx.WorldViewpoint); + } + } + } + return true; + } + + // ------------------------------------------------------------------ + // OtherPortalClip @0x005a5400 — the double clip for non-exact_match + // portals: snapshot the near-clipped poly as a temp view, then re-clip + // against the FAR cell's own portal polygon with INVERTED sidedness + // (a literal == 0 test, not an XOR). + // ------------------------------------------------------------------ + private int OtherPortalClip( + WalkCell cell, int portalIndex, int count, IWalkFrameContext ctx) + { + _otherPortalScratch.ResetForPush(); + if (!WalkCopyView.Append( + _otherPortalScratch, _clipScratch.AsSpan(0, count), + ctx.Rays, ctx.WorldViewpoint)) + return 0; + ref WalkCellPortal portal = ref cell.Portals[portalIndex]; + WalkCell far = cell.CachedNeighbors[portalIndex] + ?? throw new InvalidOperationException( + "OtherPortalClip requires a resolved neighbor (ClipPortals pass 1 contract)."); + ref WalkCellPortal farPortal = ref far.Portals[portal.OtherPortalId]; + SetView(_otherPortalScratch, 0); + return GetClip( + far, farPortal.PortalSide == 0 ? 1 : 0, + far.PortalPolygons[farPortal.PolygonIndex], + doClip: true, ctx, _clipScratch); + } + + // ------------------------------------------------------------------ + // AddViewToPortals @0x005a52d0. + // ------------------------------------------------------------------ + public void AddViewToPortals(WalkCell cell, IWalkFrameContext ctx) + { + for (int j = 0; j < cell.Portals.Length; j++) + { + ref WalkCellPortal portal = ref cell.Portals[j]; + WalkCell? neighbor = cell.CachedNeighbors[j]; + ref WalkPortalFlags flags = ref cell.TopView.PortalFlags[j]; + if (neighbor is null || flags.InView || !flags.Seen || neighbor.NumView == 0) + continue; + WalkPortalView neighborTop = neighbor.TopView; + if (neighborTop.ViewCount == 0) continue; + + if (neighborTop.UpdateCount == 0) + { + // First touch this flood: schedule the neighbor. + if (InitCell(neighbor, ToEntryIndex(portal.OtherPortalId), ctx)) + InsCellTodoList(neighbor, neighborTop.MaxInDistSquared); + } + else if (neighborTop.UpdateCount != neighborTop.ViewCount) + { + // Duplicate reach with NEW views since last processed. + AddToCell(neighbor, ToEntryIndex(portal.OtherPortalId)); + if (neighborTop.CellViewDone) + FixCellList(neighbor, cell, ctx); + neighborTop.UpdateCount = neighborTop.ViewCount; // fresh re-read after recursion + } + else + { + continue; // nothing new; NO SetOtherSeen either + } + + if (portal.OtherPortalId >= 0) // full-width signed test (−1 sentinel skips) + SetOtherSeen(cell, j); + } + } + + /// Retail passes other_portal_id as a ZERO-EXTENDED 16-bit read: + /// −1 becomes 0xFFFF, InitCell/AddToCell's never-matching sentinel. + private static int ToEntryIndex(int otherPortalId) + => otherPortalId < 0 ? 0xFFFF : otherPortalId; + + // ------------------------------------------------------------------ + // AddToCell @0x005a4d90 — the duplicate-reach flag refresh over the + // NEW views window only. + // ------------------------------------------------------------------ + public void AddToCell(WalkCell cell, int entryPortalIndex) + { + WalkPortalView top = cell.TopView; + for (int i = top.UpdateCount; i < top.ViewCount; i++) + { + // retail set_view(top.view, i) here is side-effect-only (vestigial) + for (int j = 0; j < cell.Portals.Length; j++) + { + ref WalkPortalFlags flags = ref top.PortalFlags[j]; + if (j == entryPortalIndex && !flags.InView) flags.InView = true; + if (!flags.InView && !flags.Seen) flags.Seen = true; + } + } + } + + // ------------------------------------------------------------------ + // SetOtherSeen @0x005a4e30: fill the neighbor's backlink and arm its + // back-portal when that portal faces the neighbor's viewer. + // ------------------------------------------------------------------ + public void SetOtherSeen(WalkCell cell, int portalIndex) + { + WalkCell? neighbor = cell.CachedNeighbors[portalIndex]; + if (neighbor is null) return; + int backIndex = cell.Portals[portalIndex].OtherPortalId; + ref WalkCellPortal backPortal = ref neighbor.Portals[backIndex]; + if (neighbor.CachedNeighbors[backIndex] is null) + neighbor.CachedNeighbors[backIndex] = cell; + ref WalkPortalFlags backFlags = ref neighbor.TopView.PortalFlags[backIndex]; + if (backFlags.InView) backFlags.Seen = true; + } + + // ------------------------------------------------------------------ + // FixCellList @0x005a5250 = AdjustCellPlace + AdjustCellView. + // ------------------------------------------------------------------ + public void FixCellList(WalkCell moved, WalkCell reachedThrough, IWalkFrameContext ctx) + { + AdjustCellPlace(moved, reachedThrough); + AdjustCellView(moved, ctx); + } + + // AdjustCellPlace @0x005a5010: re-place, then recurse through the + // reaching cell's armed facing portals. + private void AdjustCellPlace(WalkCell moved, WalkCell reachedThrough) + { + WalkPortalView top = reachedThrough.TopView; + if (!AdjustDrawList(moved, reachedThrough)) return; + for (int i = 0; i < reachedThrough.Portals.Length; i++) + { + ref WalkPortalFlags flags = ref top.PortalFlags[i]; + if (flags.Seen && flags.InView && reachedThrough.CachedNeighbors[i] is WalkCell next) + AdjustCellPlace(reachedThrough, next); + } + } + + // AdjustDrawList @0x005a4e90: if `moved` appears in the draw list BEFORE + // `reachedThrough`, insert `reachedThrough` at `moved`'s slot (shifting + // the range up) so the walk-from-the-end draws `reachedThrough` earlier + // (farther). Appends `reachedThrough` when absent. Returns true when a + // move happened. + private bool AdjustDrawList(WalkCell moved, WalkCell reachedThrough) + { + for (int i = 0; i < CellDrawList.Count; i++) + { + uint id = CellDrawList[i].CellId; + if (id == reachedThrough.CellId) break; // already earlier: nothing to do + if (id != moved.CellId) continue; + + int at = i; + while (at < CellDrawList.Count && CellDrawList[at].CellId != reachedThrough.CellId) + at++; + if (at == CellDrawList.Count) + CellDrawList.Add(reachedThrough); // conceptual append (grown below by the shift) + for (int k = at; k > i; k--) + CellDrawList[k] = CellDrawList[k - 1]; + CellDrawList[i] = reachedThrough; + return true; + } + return false; + } + + // AdjustCellView @0x005a5770: incremental re-flood over the new-views + // window only (the update_count watermark). + private void AdjustCellView(WalkCell cell, IWalkFrameContext ctx) + { + if (ClipPortals(cell, cell.TopView.UpdateCount, ctx)) + AddViewToPortals(cell, ctx); + } + + // ------------------------------------------------------------------ + // set_view @0x0054d0e0 (the slice GetClip consumes: the installed + // view's screen vertices). + // ------------------------------------------------------------------ + public void SetView(WalkPortalView portalView, int polyIndex) + { + WalkViewPoly poly = portalView.View.Polys[polyIndex]; + if (_activeViewVerts.Length < poly.VertexCount) + _activeViewVerts = new Vector2[poly.VertexCount]; + for (int k = 0; k < poly.VertexCount; k++) + _activeViewVerts[k] = portalView.View.Vertices[poly.VertexIndex + k].Point; + _activeViewVertCount = poly.VertexCount; + } + + // ------------------------------------------------------------------ + // PView::GetClip @0x005a4320: project, order by sidedness, optionally + // clip against the installed view. Returns the surviving count (0 on + // full rejection — the caller's pre-zero contract). + // ------------------------------------------------------------------ + public int GetClip( + WalkCell cell, int side, WalkPolygon polygon, bool doClip, + IWalkFrameContext ctx, Span output) + { + int n = polygon.Vertices.Length; + Matrix4x4 objectToClip = ctx.ObjectToClip(cell); + for (int i = 0; i < n; i++) + { + _projectScratch[i] = WalkScreenClip.TransformToScreen( + polygon.Vertices[i], objectToClip, ctx.ViewportWidth, ctx.ViewportHeight); + } + // Sidedness != POSITIVE reverses the winding (IN_PLANE takes the + // reversed branch too, though flood callers never pass it). + if (side != 0) + { + for (int i = 0; i < n / 2; i++) + (_projectScratch[i], _projectScratch[n - 1 - i]) + = (_projectScratch[n - 1 - i], _projectScratch[i]); + } + if (!doClip) + { + _projectScratch.AsSpan(0, n).CopyTo(output); + return n; + } + return WalkScreenClip.ClipAgainstView( + _projectScratch.AsSpan(0, n), + _activeViewVerts.AsSpan(0, _activeViewVertCount), + output); + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkProductionFrameContext.cs b/src/AcDream.App/Rendering/Walk/WalkProductionFrameContext.cs new file mode 100644 index 00000000..a71ea982 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkProductionFrameContext.cs @@ -0,0 +1,174 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW3.1 — the production / +/// / +/// implementation: cells resolve through the committed +/// registry (LoadedCell.Walk, per the FW +/// binding rule that the walk consumes ONLY the committed registry — +/// CellVisibility.TryGetCell, never a synthetic/dead-code path); +/// buildings resolve through ; the camera +/// pose, projection, and viewport are supplied by the caller. +/// +/// Deliberately NOT coupled to any concrete camera type — FW3.2 will supply +/// live values from WorldCameraFrame; wiring that in is additive. +/// The ray caster is a GENERIC inverse-view-projection unprojection, not the +/// capture client's exact Render::xinvscale/tx/vdst +/// constants the FW1 conformance harness's WalkTraceReplayContext +/// uses — those are FIXTURE PINS specific to the 1024×720 capture client, +/// not production values. This is safe because +/// only ever CROSS-PRODUCTS these rays to +/// build view-edge planes: a uniform scale or additive offset along a ray +/// cancels out of every cross product it feeds, so any two points along the +/// true eye ray (near/far unprojection) are observably equivalent to +/// retail's exact construction for this contract. +/// +/// One instance is a per-frame value (like WalkTraceReplayContext): +/// construct fresh each frame with that frame's camera pose. +/// +public sealed class WalkProductionFrameContext : IWalkFrameContext, IRetailFrameWalkContext +{ + /// Render::znear @0x0081ec84 / set_vdst @0x0054b240. + public const float ZNear = 0.1f; + + private sealed class InverseViewProjectionRayCaster : IWalkRayCaster + { + private readonly Matrix4x4 _inverseViewProjection; + private readonly float _viewportWidth; + private readonly float _viewportHeight; + + public InverseViewProjectionRayCaster( + Matrix4x4 viewProjection, float viewportWidth, float viewportHeight) + { + if (!Matrix4x4.Invert(viewProjection, out _inverseViewProjection)) + { + throw new ArgumentException( + "The walk's view-projection matrix must be invertible.", + nameof(viewProjection)); + } + _viewportWidth = viewportWidth; + _viewportHeight = viewportHeight; + } + + /// Screen space: origin top-left, +Y down — matching + /// and + /// 's quad + /// winding. + public Vector3 RayThrough(float screenX, float screenY) + { + float ndcX = screenX / _viewportWidth * 2f - 1f; + float ndcY = 1f - screenY / _viewportHeight * 2f; + Vector4 near = Vector4.Transform( + new Vector4(ndcX, ndcY, 0f, 1f), _inverseViewProjection); + Vector4 far = Vector4.Transform( + new Vector4(ndcX, ndcY, 1f, 1f), _inverseViewProjection); + Vector3 nearWorld = new Vector3(near.X, near.Y, near.Z) / near.W; + Vector3 farWorld = new Vector3(far.X, far.Y, far.Z) / far.W; + return farWorld - nearWorld; + } + } + + private readonly CellVisibility _cells; + private readonly WalkBuildingRegistry _buildings; + private readonly Matrix4x4 _viewProjection; + private readonly IWalkRayCaster _rays; + + private Vector2[] _activeViewVerts = new Vector2[32]; + private int _activeViewVertCount; + + public WalkProductionFrameContext( + CellVisibility cells, + WalkBuildingRegistry buildings, + Vector3 worldViewpoint, + Vector3 forward, + Matrix4x4 viewProjection, + float viewportWidth, + float viewportHeight) + { + _cells = cells ?? throw new ArgumentNullException(nameof(cells)); + _buildings = buildings ?? throw new ArgumentNullException(nameof(buildings)); + WorldViewpoint = worldViewpoint; + _viewProjection = viewProjection; + ViewportWidth = viewportWidth; + ViewportHeight = viewportHeight; + _rays = new InverseViewProjectionRayCaster(viewProjection, viewportWidth, viewportHeight); + // The retail CY near plane: N = forward, d = -dot(eye, forward) - znear. + CyPlane = new WalkPlane(forward, -Vector3.Dot(worldViewpoint, forward) - ZNear); + } + + public Vector3 WorldViewpoint { get; } + public float ViewportWidth { get; } + public float ViewportHeight { get; } + public WalkPlane CyPlane { get; } + public IWalkRayCaster Rays => _rays; + public IWalkFrameContext CellContext => this; + + public Vector3 ViewpointIn(WalkCell cell) + => Vector3.Transform(WorldViewpoint, cell.InverseWorldTransform); + + public Matrix4x4 ObjectToClip(WalkCell cell) => cell.WorldTransform * _viewProjection; + + /// Resolves through the committed + /// registry only — a missing/uncommitted cell returns null (retail's + /// portal-skip behavior; the FW binding rule requires any such miss to + /// be diagnostically counted under a flag rather than silently swallowed + /// once a caller wires one up — this seam does not itself log, matching + /// 's documented contract). + public WalkCell? GetVisible(uint cellId) + => _cells.TryGetCell(cellId, out LoadedCell? cell) ? cell?.Walk : null; + + public void SetActiveView(WalkPortalView views, int index) + { + WalkViewPoly poly = views.View.Polys[index]; + if (_activeViewVerts.Length < poly.VertexCount) + _activeViewVerts = new Vector2[poly.VertexCount]; + for (int k = 0; k < poly.VertexCount; k++) + _activeViewVerts[k] = views.View.Vertices[poly.VertexIndex + k].Point; + _activeViewVertCount = poly.VertexCount; + } + + public Vector3 ViewpointInBuilding(WalkBuilding building) + => Vector3.Transform(WorldViewpoint, GetEntry(building).InverseWorldTransform); + + /// CPhysicsPart::UpdateViewerDistance @0x0050e030: the + /// distance to the part's SCALED sort center, not the position origin. + public float ViewerDistanceTo(WalkBuilding building) + { + WalkBuildingFactory.Entry entry = GetEntry(building); + return Vector3.Distance( + WorldViewpoint, Vector3.Transform(building.SortCenter, entry.WorldTransform)); + } + + public int ClipBuildingPolygon( + WalkBuilding building, WalkPolygon polygon, int side, Span output) + { + Matrix4x4 objectToClip = GetEntry(building).WorldTransform * _viewProjection; + Span projected = stackalloc WalkScreenPoint[polygon.Vertices.Length]; + for (int i = 0; i < polygon.Vertices.Length; i++) + { + projected[i] = WalkScreenClip.TransformToScreen( + polygon.Vertices[i], objectToClip, ViewportWidth, ViewportHeight); + } + if (side != 0) + projected.Reverse(); + return WalkScreenClip.ClipAgainstView( + projected, _activeViewVerts.AsSpan(0, _activeViewVertCount), output); + } + + private WalkBuildingFactory.Entry GetEntry(WalkBuilding building) + { + if (!_buildings.TryGetEntry(building, out var entry)) + { + // Fail loud (the PV3 post-mortem rule): a building the walk is + // actively placing MUST be committed in the same registry the + // walk was handed — a miss here is a walk/registry desync, never + // a silently-skipped building. + throw new InvalidOperationException( + "WalkProductionFrameContext was asked to place a WalkBuilding " + + "that is not committed in its WalkBuildingRegistry."); + } + return entry; + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkProductionWorldData.cs b/src/AcDream.App/Rendering/Walk/WalkProductionWorldData.cs new file mode 100644 index 00000000..0685f1be --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkProductionWorldData.cs @@ -0,0 +1,265 @@ +using System.Numerics; +using System.Runtime.InteropServices; +using AcDream.App.Rendering.Scene; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW3.2b-2: the production over +/// the retained scene () and the FW3.1 +/// . Rebuilt facts per frame via +/// : +/// +/// +/// Cell statics — on +/// demand, one arena segment per distinct cell per frame (a cell can be +/// visited once by the root flood OR once per admitting look-in portal; the +/// per-frame cache keeps the copy single). +/// Outdoor statics — ONE +/// sweep bucketed by landscape cell id +/// ((lb & 0xFFFF0000) | (cellX*8 + cellY + 1) from the record's +/// world position — the same encoding +/// computes), EXCLUDING building shells (they draw at their building's own +/// shell turn, retail CPhysicsPart::Draw(parts, 0) @0x0059f331, not +/// at the cell's DrawObjCell turn). +/// Building shells — the same sweep's IsBuildingShell records +/// bucketed by Source.BuildingShellAnchorCellId; a +/// maps to its anchor via its first +/// non-exit portal's destination (the SAME rule +/// LandblockLoader used to author the anchor). +/// +/// +/// The tuple landblock id handed to the classifier is the frame's player +/// landblock — the packed path's own convention for every +/// RenderFrameEntityDrawRequest. +/// +/// Campaign FW3.4a: , , +/// and used to materialize their result +/// with _cellScratch[..count] / [.. bucket] — a FRESH +/// RenderProjectionRecord[] allocation per distinct cell/anchor per +/// frame. At a town-density frame (dozens of cells) that was the single +/// largest contributor to the FW3.4 perf checkpoint's 14× frame-allocation +/// regression (1.9 MB/frame p50). replaces it: a +/// grow-only buffer, reset to length 0 once per frame in +/// , that every materialization call +/// s its records into instead of snapshotting a +/// new array — after the arena reaches its steady-state size (a few frames +/// of warmup, same shape as /'s +/// existing grow-on-demand pattern), zero further heap allocation occurs +/// here. Every segment is +/// STRICTLY per-frame scratch — nothing holds one across a frame boundary +/// (the driver/populator consume it immediately, matching +/// 's existing lifetime contract) — so reusing the +/// same backing array's memory next frame is safe. +/// +internal sealed class WalkProductionWorldData : IWalkFrameWorldData +{ + private readonly WalkBuildingRegistry _buildings; + private RenderSceneQuery _scene; + private uint _tupleLandblockId; + private int _renderCenterLbX; + private int _renderCenterLbY; + + private readonly Dictionary _cellCache = new(); + private readonly Dictionary> _outdoorByCell = new(); + private readonly Dictionary> _shellsByAnchor = new(); + private readonly Dictionary _outdoorMaterialized = new(); + private readonly Dictionary _shellMaterialized = new(); + private RenderProjectionRecord[] _sweepScratch = new RenderProjectionRecord[1024]; + private RenderProjectionRecord[] _cellScratch = new RenderProjectionRecord[256]; + + // Campaign FW3.4a: the per-frame, grow-only materialization arena — see + // this type's own doc comment. + private RenderProjectionRecord[] _arena = new RenderProjectionRecord[4096]; + private int _arenaLength; + + internal WalkProductionWorldData(WalkBuildingRegistry buildings) + { + _buildings = buildings ?? throw new ArgumentNullException(nameof(buildings)); + } + + /// Rebuilds the frame's outdoor/shell buckets and clears the + /// per-cell cache. Call once per frame before the driver runs. + /// / + /// are the streaming recenter origin: record positions are + /// RENDER-ORIGIN-RELATIVE (each landblock's entities carry + /// (lbX − CenterX)·192 offsets), so mapping a position back to + /// its TRUE landblock byte needs the center added back — the first + /// connected gate of the FW3.2b-2 cutover shipped without this and most + /// outdoor scenery landed in garbage buckets no walk turn ever reads. + internal void BeginFrame( + RenderSceneQuery scene, + uint tupleLandblockId, + int renderCenterLbX, + int renderCenterLbY) + { + _scene = scene; + _tupleLandblockId = tupleLandblockId; + _renderCenterLbX = renderCenterLbX; + _renderCenterLbY = renderCenterLbY; + _cellCache.Clear(); + _outdoorMaterialized.Clear(); + _shellMaterialized.Clear(); + _arenaLength = 0; + foreach (List bucket in _outdoorByCell.Values) + bucket.Clear(); + foreach (List bucket in _shellsByAnchor.Values) + bucket.Clear(); + + // CopyIndexTo THROWS on an undersized destination (ArchRenderScene + // validates up front — the first connected gate run of the FW3.2b-2 + // cutover crashed on exactly this at Aerlinthe's 5,040 outdoor + // statics), so presize from the query's own index counts. + int required = _scene.IndexCounts.For(RenderSceneIndex.OutdoorStatic); + if (required > _sweepScratch.Length) + { + _sweepScratch = new RenderProjectionRecord[ + Math.Max(required, _sweepScratch.Length * 2)]; + } + int count = _scene.CopyIndexTo(RenderSceneIndex.OutdoorStatic, _sweepScratch); + for (int i = 0; i < count; i++) + { + ref readonly RenderProjectionRecord record = ref _sweepScratch[i]; + if (record.EntityPayload.IsBuildingShell) + { + uint anchor = record.Source.BuildingShellAnchorCellId; + if (!_shellsByAnchor.TryGetValue(anchor, out List? shells)) + _shellsByAnchor[anchor] = shells = new List(); + shells.Add(record); + continue; + } + uint cellId = LandscapeCellId( + record.Transform.Position, _renderCenterLbX, _renderCenterLbY); + if (!_outdoorByCell.TryGetValue(cellId, out List? bucket)) + _outdoorByCell[cellId] = bucket = new List(); + bucket.Add(record); + } + } + + /// The landscape cell owning a RENDER-ORIGIN-RELATIVE position + /// — retail's 24 m cell grid inside the 192 m landblock, producing the + /// same TRUE (lb & 0xFFFF0000) | (cellX*8 + cellY + 1) encoding + /// the walk's landscape turn emits: the relative block index + /// (floor(p/192)) plus the streaming center recovers the true + /// landblock byte, because entity positions carry + /// (lbX − CenterX)·192 world offsets + /// (LandblockBuildFactory's worldOffset). + internal static uint LandscapeCellId( + Vector3 relativePosition, int renderCenterLbX, int renderCenterLbY) + { + int relBlockX = (int)MathF.Floor(relativePosition.X / 192f); + int relBlockY = (int)MathF.Floor(relativePosition.Y / 192f); + float localX = relativePosition.X - relBlockX * 192f; + float localY = relativePosition.Y - relBlockY * 192f; + int cellX = Math.Clamp((int)(localX / 24f), 0, 7); + int cellY = Math.Clamp((int)(localY / 24f), 0, 7); + uint landblock = + ((uint)(byte)(renderCenterLbX + relBlockX) << 24) + | ((uint)(byte)(renderCenterLbY + relBlockY) << 16); + return landblock | (uint)(cellX * 8 + cellY + 1); + } + + public WalkFrameStaticRecords GetCellStatics(uint cellId) + { + if (_cellCache.TryGetValue(cellId, out WalkFrameStaticRecords cached)) + return cached; + // Same up-front-validation contract as CopyIndexTo: presize from the + // query's own count rather than probing with an undersized span. + int required = _scene.GetCellStaticCount(cellId); + if (required > _cellScratch.Length) + { + _cellScratch = new RenderProjectionRecord[ + Math.Max(required, _cellScratch.Length * 2)]; + } + int count = _scene.CopyCellStaticsTo(cellId, _cellScratch); + WalkFrameStaticRecords records = count == 0 + ? WalkFrameStaticRecords.Empty with { TupleLandblockId = _tupleLandblockId } + : new WalkFrameStaticRecords( + AppendToArena(_cellScratch.AsSpan(0, count)), _tupleLandblockId); + _cellCache[cellId] = records; + return records; + } + + public WalkFrameStaticRecords GetOutdoorStatics(uint cellId) + { + if (_outdoorMaterialized.TryGetValue(cellId, out WalkFrameStaticRecords cached)) + return cached; + WalkFrameStaticRecords records = + _outdoorByCell.TryGetValue(cellId, out List? bucket) + && bucket.Count > 0 + ? new WalkFrameStaticRecords( + AppendToArena(CollectionsMarshal.AsSpan(bucket)), _tupleLandblockId) + : WalkFrameStaticRecords.Empty with { TupleLandblockId = _tupleLandblockId }; + _outdoorMaterialized[cellId] = records; + return records; + } + + public WalkFrameStaticRecords GetBuildingShellStatics(WalkBuilding building) + { + uint anchor = AnchorCellId(building); + if (anchor == 0) + return WalkFrameStaticRecords.Empty with { TupleLandblockId = _tupleLandblockId }; + if (_shellMaterialized.TryGetValue(anchor, out WalkFrameStaticRecords cached)) + return cached; + WalkFrameStaticRecords records = + _shellsByAnchor.TryGetValue(anchor, out List? shells) + && shells.Count > 0 + ? new WalkFrameStaticRecords( + AppendToArena(CollectionsMarshal.AsSpan(shells)), _tupleLandblockId) + : WalkFrameStaticRecords.Empty with { TupleLandblockId = _tupleLandblockId }; + _shellMaterialized[anchor] = records; + return records; + } + + /// Copies into at + /// its current length, growing the arena first if needed (doubling, or + /// exactly enough for an unusually large sweep — the same growth shape + /// / already use), + /// and returns the segment the copy landed in. A prior frame's growth can + /// leave an earlier-returned segment pointing at a retired backing array + /// — harmless, since that array's content stays valid and nothing reads + /// a segment across a frame boundary (see this type's own doc + /// comment). + private ArraySegment AppendToArena( + ReadOnlySpan source) + { + if (source.Length == 0) + return ArraySegment.Empty; + + int required = _arenaLength + source.Length; + if (required > _arena.Length) + { + var grown = new RenderProjectionRecord[Math.Max(required, _arena.Length * 2)]; + Array.Copy(_arena, grown, _arenaLength); + _arena = grown; + } + + source.CopyTo(_arena.AsSpan(_arenaLength, source.Length)); + var segment = new ArraySegment(_arena, _arenaLength, source.Length); + _arenaLength += source.Length; + return segment; + } + + /// The building's authored shell anchor: its first non-exit + /// portal's destination cell — the SAME rule LandblockLoader used + /// when it stamped BuildingShellAnchorCellId on the shell entity. + internal static uint AnchorCellId(WalkBuilding building) + { + foreach (ref readonly WalkBldPortal portal in building.Portals.AsSpan()) + { + if (portal.OtherCellId != 0xFFFFFFFFu) + return portal.OtherCellId; + } + return 0; + } + + public Matrix4x4 GetBuildingWorldTransform(WalkBuilding building) + { + if (!_buildings.TryGetEntry(building, out WalkBuildingFactory.Entry? entry)) + { + throw new InvalidOperationException( + $"walk building 0x{building.PositionCellId:X8} has no committed registry entry"); + } + return entry.WorldTransform; + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkScreenClip.cs b/src/AcDream.App/Rendering/Walk/WalkScreenClip.cs new file mode 100644 index 00000000..ca39f85c --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkScreenClip.cs @@ -0,0 +1,176 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Retail Vec2Dscreen: homogeneous viewport coordinates as produced +/// by PrimD3DRender::xformStart @0x0059b990 — X/Y are viewport-scaled +/// but NOT perspective-divided (divide by W to get pixels), Z is raw clip z, +/// W is raw clip w. copy_view performs the divide; +/// polyClipFinish clips pre-divide homogeneously. +/// +public struct WalkScreenPoint +{ + public float X, Y, Z, W; + + public WalkScreenPoint(float x, float y, float z, float w) + { + X = x; Y = y; Z = z; W = w; + } +} + +/// +/// Campaign FW1 — the screen-space projection/clip chain, ported from the +/// flood-read appendix (docs/research/2026-08-30-fw-flood-pseudocode-appendix.md, +/// report 3; Ghidra-arbitrated — BN's literal rendering inverts the edge +/// inside test and the w-clip plane). +/// +public static class WalkScreenClip +{ + /// The w-clip plane constant cdstW (= retail F_EPSILON). + public const float MinW = WalkVisibilityMath.Epsilon; + + /// + /// PrimD3DRender::xformStart @0x0059b990 (toScreen path): object + /// space → homogeneous viewport coordinates. x=(bw/2)(x_clip+w), + /// y=(bh/2)(w−y_clip) — y flipped, origin top-left — z/w raw clip. + /// is the concatenated object→clip + /// matrix (row-vector convention, v * M). + /// + public static WalkScreenPoint TransformToScreen( + Vector3 point, in Matrix4x4 objectToClip, float viewportWidth, float viewportHeight) + { + Vector4 clip = Vector4.Transform(new Vector4(point, 1f), objectToClip); + return new WalkScreenPoint( + clip.X * viewportWidth * 0.5f + clip.W * viewportWidth * 0.5f, + clip.W * viewportHeight * 0.5f - clip.Y * viewportHeight * 0.5f, + clip.Z, + clip.W); + } + + /// + /// ACRender::polyClipFinish @0x006b6d00: Sutherland-Hodgman clip + /// of a homogeneous screen polygon against the active view — first the + /// w ≥ plane (only when some w is below it), then + /// every view edge, iterated LAST-to-FIRST as vertex pairs + /// (v[0], v[n−1]), (v[n−1], v[n−2]), …, (v[1], v[0]). Edge INSIDE is + /// side ≤ 0 with the homogeneous 2D cross + /// side(p) = (p.x − a.x·p.w)·ey − (p.y − a.y·p.w)·ex. Each pass scans + /// its input in REVERSE; the output keeps the ORIGINAL winding (retail's + /// pass-parity bookkeeping collapses to reversing per pass and + /// un-reversing at the end — this port appends reversed per pass and + /// restores at the end, observably identical). Returns the surviving + /// count, or 0 the moment any stage drops below 3 vertices — in which + /// case content is unspecified (retail never + /// writes the out count on that path; callers pre-zero it). + /// + public static int ClipAgainstView( + ReadOnlySpan input, + ReadOnlySpan viewEdgeVertices, + Span output) + { + // Working buffers sized for retail's ≤32-vertex contract plus clip growth. + Span bufferA = stackalloc WalkScreenPoint[64]; + Span bufferB = stackalloc WalkScreenPoint[64]; + Span current = bufferA; + int count = input.Length; + input.CopyTo(current); + // Track how many reversing passes ran so the final copy can restore + // the original winding exactly as retail's parity dance does. + int reversals = 0; + + // Pass 0: the w-plane, only when some vertex is below cdstW. + bool anyBelow = false; + for (int i = 0; i < count; i++) + if (current[i].W < MinW) { anyBelow = true; break; } + if (anyBelow) + { + count = ClipPassW(current[..count], bufferB); + if (count < 3) return 0; + Span swap = current; + current = bufferB; + bufferB = swap; + reversals++; + } + + // Edge passes: pairs (a, b) = (v[0], v[n-1]), (v[n-1], v[n-2]) … (v[1], v[0]). + int n = viewEdgeVertices.Length; + for (int e = n - 1; e >= 0; e--) + { + Vector2 a = viewEdgeVertices[e == n - 1 ? 0 : e + 1]; + Vector2 b = viewEdgeVertices[e]; + count = ClipPassEdge(current[..count], a, b, bufferB); + if (count < 3) return 0; + Span swap = current; + current = bufferB; + bufferB = swap; + reversals++; + } + + // Restore original winding: each pass reversed the order once. + if ((reversals & 1) != 0) + { + for (int i = 0; i < count; i++) + output[i] = current[count - 1 - i]; + } + else + { + current[..count].CopyTo(output); + } + return count; + } + + private static int ClipPassW(ReadOnlySpan pts, Span outPts) + { + int outCount = 0; + // Reverse traversal starting from the wrap pair (pts[0], pts[n-1]). + WalkScreenPoint prev = pts[0]; + float sPrev = prev.W - MinW; + bool inPrev = sPrev >= 0f; + for (int i = pts.Length - 1; i >= 0; i--) + { + WalkScreenPoint cur = pts[i]; + float s = cur.W - MinW; + bool inCur = s >= 0f; + if (inPrev != inCur) + outPts[outCount++] = Lerp(prev, cur, sPrev / (sPrev - s)); + if (inCur) + outPts[outCount++] = cur; + prev = cur; sPrev = s; inPrev = inCur; + } + return outCount; + } + + private static int ClipPassEdge( + ReadOnlySpan pts, Vector2 a, Vector2 b, Span outPts) + { + float ex = b.X - a.X; + float ey = b.Y - a.Y; + float Side(in WalkScreenPoint p) => (p.X - a.X * p.W) * ey - (p.Y - a.Y * p.W) * ex; + + int outCount = 0; + WalkScreenPoint prev = pts[0]; + float s0 = Side(prev); + float sPrev = s0; + bool inPrev = s0 <= 0f; // INSIDE = side <= 0 (Ghidra-verified) + for (int i = pts.Length - 1; i >= 0; i--) + { + WalkScreenPoint cur = pts[i]; + float s = i != 0 ? Side(cur) : s0; // final pair reuses point 0's side + bool inCur = s <= 0f; + if (inPrev != inCur) + outPts[outCount++] = Lerp(prev, cur, sPrev / (sPrev - s)); + if (inCur) + outPts[outCount++] = cur; + prev = cur; sPrev = s; inPrev = inCur; + } + return outCount; + } + + private static WalkScreenPoint Lerp(in WalkScreenPoint p, in WalkScreenPoint q, float t) + => new( + p.X + (q.X - p.X) * t, + p.Y + (q.Y - p.Y) * t, + p.Z + (q.Z - p.Z) * t, + p.W + (q.W - p.W) * t); +} diff --git a/src/AcDream.App/Rendering/Walk/WalkStaticStreamPopulator.cs b/src/AcDream.App/Rendering/Walk/WalkStaticStreamPopulator.cs new file mode 100644 index 00000000..d138c2cf --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkStaticStreamPopulator.cs @@ -0,0 +1,137 @@ +using System.Numerics; +using AcDream.App.Rendering.Scene; +using AcDream.App.Rendering.Wb; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW stage FW3.2a: the walk→draw population layer. Turns one +/// cell's already-classified static content into +/// appends (opaque, walk order), per-instance deferred-alpha submissions +/// (translucent), and selection-scene publications (picking) — WITHOUT any +/// production frame wiring. WorldSceneRenderer does not call this +/// class yet; FW3.2b roots it into the real frame. +/// +/// Why per-entity append instead of the classic material grouping: +/// under 's depth-compare Less, opaque draw +/// order is pixel-relevant ONLY for coplanar surfaces (a rug on a floor, a +/// shell over terrain) — and retail resolves those by first-drawn-wins in +/// ITS walk/cell-content order, not by any texture/material grouping. So +/// this populator appends one per (entity, +/// opaque batch) in the SAME order the caller's records span presents +/// them — never material-grouped, never re-sorted. Translucent batches go to +/// the SAME the classic/packed paths already +/// use (global far→near re-sort still applies; walk-order submission only +/// improves retail's submission-order tie-break fidelity for coincident +/// distances — WbDrawDispatcher.DeferTransparentGroups's own doc +/// comment cites the same CShadowPart::insertion_sort stability this +/// preserves). +/// +/// Reads no retained scene state itself: every method takes the target +/// and a caller-supplied span of already +/// -queried s (from +/// RenderSceneQuery.CopyCellStaticsTo / CopyIndexTo). Owns only +/// two small per-call scratch lists — the classify seam's per-entity output +/// — reused across records to keep this hot path allocation-free after +/// warmup. +/// +internal sealed class WalkStaticStreamPopulator +{ + private readonly WbDrawDispatcher _dispatcher; + private readonly List _batchScratch = new(); + private readonly List _selectionScratch = new(); + + internal WalkStaticStreamPopulator(WbDrawDispatcher dispatcher) + { + _dispatcher = dispatcher ?? throw new ArgumentNullException(nameof(dispatcher)); + } + + /// + /// Populates from one indoor cell's static + /// content (RenderProjectionClass.IndoorCellStatic — + /// RenderSceneQuery.CopyCellStaticsTo). + /// is caller-selected per the walk turn this cell's content belongs to + /// — for an ordinary + /// PView::DrawCells flood, + /// for a ConstructView(CBldPortal) look-in, or + /// for a building's own + /// exterior shell content. + /// + internal void PopulateCell( + OrderedDrawStream stream, + WalkDrawStage stage, + uint cellId, + ReadOnlySpan records, + uint tupleLandblockId, + Vector3 cameraWorldPosition, + Matrix4x4 viewProjection) + { + ArgumentNullException.ThrowIfNull(stream); + for (int i = 0; i < records.Length; i++) + { + ClassifyAndAppend( + stream, stage, cellId, in records[i], tupleLandblockId, + cameraWorldPosition, viewProjection); + } + } + + /// + /// The landscape entry point: outdoor static content + /// (RenderProjectionClass.OutdoorStatic — + /// RenderSceneQuery.CopyIndexTo(RenderSceneIndex.OutdoorStatic, ...)) + /// at , the terrain-adjacent + /// stage LScape::draw visits a landblock's static objects at + /// alongside its ground mesh (see that stage value's own doc comment). + /// is the OUTDOOR landblock id — outdoor + /// statics have no EnvCell of their own, so this is walk-order + /// provenance only, not a clip-slot key. + /// + internal void PopulateOutdoorStatics( + OrderedDrawStream stream, + uint cellId, + ReadOnlySpan records, + uint tupleLandblockId, + Vector3 cameraWorldPosition, + Matrix4x4 viewProjection) => + PopulateCell( + stream, WalkDrawStage.OutdoorStatic, cellId, records, + tupleLandblockId, cameraWorldPosition, viewProjection); + + private void ClassifyAndAppend( + OrderedDrawStream stream, + WalkDrawStage stage, + uint cellId, + in RenderProjectionRecord record, + uint tupleLandblockId, + Vector3 cameraWorldPosition, + Matrix4x4 viewProjection) + { + _batchScratch.Clear(); + _selectionScratch.Clear(); + _dispatcher.ClassifyEntityForWalk( + in record, tupleLandblockId, _batchScratch, _selectionScratch); + + for (int i = 0; i < _batchScratch.Count; i++) + { + WbDrawDispatcher.WalkClassifiedBatch batch = _batchScratch[i]; + if (batch.IsOpaque) + { + stream.Append(new OrderedDrawCommand( + batch.Key, batch.Transform, stage, cellId, batch.ClipSlot, + batch.Lights, batch.IndoorFlag, batch.Alpha, + batch.SelectionLighting, batch.DetailCategory)); + } + else + { + _dispatcher.SubmitWalkAlphaInstance( + in batch, cameraWorldPosition, viewProjection); + } + } + + for (int i = 0; i < _selectionScratch.Count; i++) + { + WbDrawDispatcher.WalkClassifiedSelectionPart part = _selectionScratch[i]; + _dispatcher.PublishWalkSelectionPart(in part); + } + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkViews.cs b/src/AcDream.App/Rendering/Walk/WalkViews.cs new file mode 100644 index 00000000..1df32d26 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkViews.cs @@ -0,0 +1,285 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// Retail view_vertex (stride 0x18): a screen point plus the +/// world-space plane of the edge that STARTS at it (edge k = verts k → k+1). +public struct WalkViewVertex +{ + public Vector2 Point; + public WalkPlane Plane; +} + +/// Retail view_poly: one view polygon's slice of the shared +/// vertex pool plus its screen bounds. +public readonly record struct WalkViewPoly( + int VertexCount, int VertexIndex, float XMin, float XMax, float YMin, float YMax); + +/// Retail view_type: the poly list + shared vertex pool one +/// portal_view_type accumulates its views into. +public sealed class WalkViewSet +{ + public readonly List Polys = new(); + public readonly List Vertices = new(); + public int VertexCountTotal; +} + +/// +/// Retail portal_view_type (0x48 bytes): one view-recursion slot on a +/// cell (or the PView's outside_view). Retail recycles slots and +/// resets exactly view_count/update_count/view_timestamp on push +/// (CEnvCell::curr_view_push @0x005a5090); this port models the same +/// counters over list storage — when is 0 the next +/// append clears the pools, matching retail's vertex-pool base reset. +/// +public sealed class WalkPortalView +{ + /// Per-portal portal_info flags (seen, inflag), sized by + /// PView::InitCell for the owning cell's portal count. + public WalkPortalFlags[] PortalFlags = []; + + public readonly WalkViewSet View = new(); + + /// Max SQUARED cell-local distance to any in-view portal vertex + /// (PView::InitCell); the flood's todo-list distance key. + public float MaxInDistSquared; + + public int ViewCount; + public bool CellViewDone; + public int ViewTimestamp; + public int UpdateCount; + + /// curr_view_push's per-push counter reset. + public void ResetForPush() + { + ViewCount = 0; + UpdateCount = 0; + ViewTimestamp = 0; + } +} + +public struct WalkPortalFlags +{ + public bool Seen; + public bool InView; +} + +/// +/// Unprojects a screen point to a world-space eye ray direction — +/// retail PrimD3DRender::ScreenToViewTransform @0x0059aa40 (the live +/// newmethod==1 path of Render::copy_view's plane builder). +/// The exact matrix wiring lives with the camera module; the walk depends +/// only on this contract. +/// +public interface IWalkRayCaster +{ + Vector3 RayThrough(float screenX, float screenY); +} + +/// +/// Campaign FW1 — Render::copy_view @0x0054dfc0, ported from the +/// flood-read appendix report 3 (Ghidra-arbitrated). Appends ONE view +/// polygon to a : perspective-divides the +/// homogeneous screen points IN PLACE, prunes ~1 px duplicates and +/// collinear points (three closing wrap checks included), rejects fewer +/// than 3 survivors (returns false, dest untouched), caps at 31, stores the +/// point list plus a closing duplicate, computes bounds, and builds +/// per-edge WORLD planes N = normalize(cross(ray[k+1], ray[k])) — NEXT × +/// CURRENT — with d = −dot(N, viewpoint). +/// +public static class WalkCopyView +{ + public const int MaxVertices = 31; // retail cap 0x1f + public const float DedupThreshold = 1f; // strict > 1 px + + /// The null-source path: the full-viewport root quad + /// (0,H)(W,H)(W,0)(0,0) — used by Render::set_default_view and + /// PView::DrawInside's root view (the source count is ignored). + public static bool AppendFullViewportQuad( + WalkPortalView dest, IWalkRayCaster rays, Vector3 viewpoint, + float viewportWidth, float viewportHeight) + { + Span quad = + [ + new(0f, viewportHeight, 0f, 1f), + new(viewportWidth, viewportHeight, 0f, 1f), + new(viewportWidth, 0f, 0f, 1f), + new(0f, 0f, 0f, 1f), + ]; + return Append(dest, quad, rays, viewpoint); + } + + /// The point-source path. is mutated + /// (in-place perspective divide) exactly as retail mutates the shared + /// clip buffer; the buffer is consumed per portal, so the mutation never + /// leaks across calls. + public static bool Append( + WalkPortalView dest, Span points, + IWalkRayCaster rays, Vector3 viewpoint) + { + int npts = points.Length; + if (npts == 0) return false; + + // ---- survivor marking (keep[] / last / stl / second bookkeeping) ---- + Span keep = stackalloc bool[npts]; + keep[0] = true; + int n = 1; + int last = 0; + int secondToLast = 0; // retail 'stl': index of the second-to-last kept corner + int second = 0; // retail local_220: index of the 2nd kept point + + for (int i = 0; i < npts; i++) + { + ref WalkScreenPoint p = ref points[i]; + if (p.W != 1f) + { + p.X /= p.W; + p.Y /= p.W; + p.W = 1f; + } + if (i == 0) continue; + + bool distinct = + MathF.Abs(points[i].X - points[last].X) > DedupThreshold + || MathF.Abs(points[i].Y - points[last].Y) > DedupThreshold; + keep[i] = distinct; + if (!distinct) continue; + + if (n == 1) + { + n++; + second = i; + } + else + { + WalkScreenPoint pp = points[secondToLast]; + WalkScreenPoint prev = points[last]; + WalkScreenPoint cur = points[i]; + float span = MathF.Max(MathF.Abs(pp.X - cur.X), MathF.Abs(pp.Y - cur.Y)); + float cross = (pp.X - prev.X) * (prev.Y - cur.Y) + - (pp.Y - prev.Y) * (prev.X - cur.X); + if (MathF.Abs(cross) >= span) + { + n++; + secondToLast = last; + } + else + { + // prev was collinear: un-keep it; count unchanged (prev out, cur in). + keep[last] = false; + if (second == last) second = i; + } + } + last = i; + } + + // ---- closing wrap checks against point 0 ---- + WalkScreenPoint first = points[0]; + bool lastDistinct = + MathF.Abs(first.X - points[last].X) > DedupThreshold + || MathF.Abs(first.Y - points[last].Y) > DedupThreshold; + keep[last] = lastDistinct; + if (!lastDistinct) + { + n--; + last = secondToLast; + } + else + { + float span = MathF.Max( + MathF.Abs(points[secondToLast].X - first.X), + MathF.Abs(points[secondToLast].Y - first.Y)); + float cross = (points[secondToLast].X - points[last].X) * (points[last].Y - first.Y) + - (points[last].X - first.X) * (points[secondToLast].Y - points[last].Y); + if (MathF.Abs(cross) < span) + { + keep[last] = false; + n--; + last = secondToLast; + } + } + secondToLast = last; + if (second > 0) + { + // Is point 0 itself collinear between the last corner and the second? + float span = MathF.Max( + MathF.Abs(points[secondToLast].X - points[second].X), + MathF.Abs(points[secondToLast].Y - points[second].Y)); + float cross = (first.Y - points[second].Y) * (points[secondToLast].X - first.X) + - (first.X - points[second].X) * (points[secondToLast].Y - first.Y); + if (MathF.Abs(cross) < span) + { + n--; + keep[0] = false; + } + } + + if (n < 3) return false; // REJECT: dest completely untouched + if (n > MaxVertices) n = MaxVertices; // cap 31 (corrupt overflow path unreachable ≤32 in) + + // ---- append into the pool (view_count==0 resets the pool base) ---- + WalkViewSet view = dest.View; + if (dest.ViewCount == 0) + { + view.Polys.Clear(); + view.Vertices.Clear(); + view.VertexCountTotal = 0; + } + int vbase = view.VertexCountTotal; + view.VertexCountTotal = vbase + n + 1; + + int written = 0; + for (int i = 0; i < npts && written < n; i++) + { + if (!keep[i]) continue; + view.Vertices.Add(new WalkViewVertex + { + // Retail applies a REAL fabs on copy (harmless post-clip; preserved). + Point = new Vector2(MathF.Abs(points[i].X), MathF.Abs(points[i].Y)), + }); + written++; + } + // Closing duplicate vertex (its plane slot is never consumed). + view.Vertices.Add(new WalkViewVertex { Point = view.Vertices[vbase].Point }); + + // ---- bounds over v[0..n-1] ---- + float xmin, xmax, ymin, ymax; + Vector2 seed = view.Vertices[vbase + n - 1].Point; + xmin = xmax = seed.X; + ymin = ymax = seed.Y; + for (int k = n - 2; k >= 0; k--) + { + Vector2 pt = view.Vertices[vbase + k].Point; + if (pt.X < xmin) xmin = pt.X; else if (pt.X > xmax) xmax = pt.X; + if (pt.Y < ymin) ymin = pt.Y; else if (pt.Y > ymax) ymax = pt.Y; + } + view.Polys.Add(new WalkViewPoly(n, vbase, xmin, xmax, ymin, ymax)); + + // ---- per-edge world planes from unprojected rays ---- + Span ray = stackalloc Vector3[n + 1]; + for (int k = 0; k < n; k++) + { + Vector2 pt = view.Vertices[vbase + k].Point; + ray[k] = rays.RayThrough(pt.X, pt.Y); + } + ray[n] = ray[0]; + for (int k = n - 1; k >= 0; k--) + { + Vector3 normal = Vector3.Cross(ray[k + 1], ray[k]); // NEXT × CURRENT + if (MathF.Abs(normal.X) >= WalkVisibilityMath.Epsilon + || MathF.Abs(normal.Y) >= WalkVisibilityMath.Epsilon + || MathF.Abs(normal.Z) >= WalkVisibilityMath.Epsilon) + { + normal *= 1f / MathF.Sqrt( + normal.X * normal.X + normal.Y * normal.Y + normal.Z * normal.Z); + } + // else: degenerate edge left tiny/unnormalized (retail behavior). + WalkViewVertex v = view.Vertices[vbase + k]; + v.Plane = new WalkPlane(normal, -Vector3.Dot(normal, viewpoint)); + view.Vertices[vbase + k] = v; + } + + dest.ViewCount += 1; + return true; + } +} diff --git a/src/AcDream.App/Rendering/Walk/WalkVisibilityMath.cs b/src/AcDream.App/Rendering/Walk/WalkVisibilityMath.cs new file mode 100644 index 00000000..c447cbdf --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkVisibilityMath.cs @@ -0,0 +1,211 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// +/// Campaign FW1 — retail's CPU visibility primitives, ported from the named +/// 2013 decomp (extractions: +/// docs/research/2026-08-30-fw-flood-pseudocode-appendix.md, report 4; all +/// x87-ambiguous branches Ghidra-arbitrated). Two families: +/// +/// 1. The landscape interval test — a grid corner's vertical column is +/// classified against each active clip plane as a signed height +/// (Render::get_pt_limit @0x0054b840), and a landblock's z-slab +/// is tested against its four corner columns plane by plane +/// (corner_plane_check @0x0054b930, block_plane_check +/// @0x0054d060, block_check @0x0054dc50). +/// 2. The sphere-vs-view test (Render::viewconeCheck @0x0054c250). +/// +/// Both consume the same installed state: the CY near plane (built by +/// Render::update_viewpoint) plus the active view's edge planes +/// (installed by Render::set_view). +/// +public static class WalkVisibilityMath +{ + /// Retail F_EPSILON (raw float 0x3951B717). + public const float Epsilon = 0.000199999995f; + + /// get_pt_limit sky cap: a clip height at or above this means + /// the column holds nothing (up-normal arm) / everything (down-normal + /// arm). + public const float SkyHeight = 1000f; + + /// Sentinel: the column is wholly inside the plane's positive + /// half-space. + public const float InsideColumn = 0f; + + /// Sentinel: the column is wholly outside (static init 1000+1). + public const float OutsideColumn = 1001f; + + /// + /// Render::get_pt_limit @0x0054b840: classify the vertical column + /// at (x, y) against one plane. Returns / + /// , a positive h (inside only BELOW h — + /// down-pointing normal), or a negative −h (inside only ABOVE h — + /// up-pointing normal). Vertical planes (|N.z| ≤ ε) collapse to + /// all-in/all-out via the plane side of (x, y, 0). + /// + public static float GetPointLimit(float x, float y, in WalkPlane plane) + { + Vector3 n = plane.Normal; + if (n.Z > Epsilon) + { + float h = -((x * n.X + y * n.Y + plane.D) / n.Z); + if (h >= SkyHeight) return OutsideColumn; + return h > 0f ? -h : InsideColumn; + } + if (n.Z < -Epsilon) + { + float h = -((x * n.X + y * n.Y + plane.D) / n.Z); + if (h <= 0f) return OutsideColumn; + return h >= SkyHeight ? InsideColumn : h; + } + // Vertical plane: no z dependence; test point (x, y, 0), retail + // Plane::which_side semantics (NEGATIVE = strictly below -epsilon). + float d = x * n.X + y * n.Y + plane.D; + return d < -Epsilon ? OutsideColumn : InsideColumn; + } + + /// + /// Render::get_clip_height @0x0054cff0: fill one corner's + /// interval vector — bounds[0] vs the CY plane, bounds[1..edgeCount] vs + /// each active edge plane (the loop is INCLUSIVE of edgeCount entries: + /// edgeCount + 1 floats are written). + /// + public static void FillClipHeights( + float x, float y, in WalkPlane cyPlane, ReadOnlySpan edgePlanes, + Span bounds) + { + bounds[0] = GetPointLimit(x, y, cyPlane); + for (int i = 0; i < edgePlanes.Length; i++) + bounds[i + 1] = GetPointLimit(x, y, edgePlanes[i]); + } + + /// + /// Render::corner_plane_check @0x0054b930: one corner's encoding + /// vs the block z-slab [minZ, maxZ]. Boundary semantics are retail's: + /// touching the clip height on the OUT side is Outside; on the IN side + /// is EntirelyInside. + /// + public static WalkBoundingType CornerPlaneCheck(float bound, float minZ, float maxZ) + { + if (bound == OutsideColumn) return WalkBoundingType.Outside; + if (bound != InsideColumn) + { + if (bound <= 0f) + { + // inside is z >= h, h = -bound + float h = -bound; + if (h > minZ) + { + if (maxZ <= h) return WalkBoundingType.Outside; + return WalkBoundingType.PartiallyInside; + } + } + else if (bound < maxZ) + { + // inside is z <= h, h = bound; the block top pokes above h + if (bound <= minZ) return WalkBoundingType.Outside; + return WalkBoundingType.PartiallyInside; + } + } + return WalkBoundingType.EntirelyInside; + } + + /// + /// Render::block_plane_check @0x0054d060: four corners vs one + /// plane. Outside/EntirelyInside require unanimity; anything mixed is + /// PartiallyInside. + /// + public static WalkBoundingType BlockPlaneCheck( + float b1, float b2, float b3, float b4, float minZ, float maxZ) + { + WalkBoundingType c1 = CornerPlaneCheck(b1, minZ, maxZ); + WalkBoundingType c2 = CornerPlaneCheck(b2, minZ, maxZ); + WalkBoundingType c3 = CornerPlaneCheck(b3, minZ, maxZ); + WalkBoundingType c4 = CornerPlaneCheck(b4, minZ, maxZ); + if (c1 == WalkBoundingType.Outside) + { + if (c2 == WalkBoundingType.Outside + && c3 == WalkBoundingType.Outside + && c4 == WalkBoundingType.Outside) + { + return WalkBoundingType.Outside; + } + } + else if (c1 == WalkBoundingType.EntirelyInside + && c2 == WalkBoundingType.EntirelyInside + && c3 == WalkBoundingType.EntirelyInside + && c4 == WalkBoundingType.EntirelyInside) + { + return WalkBoundingType.EntirelyInside; + } + return WalkBoundingType.PartiallyInside; + } + + /// + /// Render::block_check @0x0054dc50: the block-vs-view test over + /// four corner interval vectors. Retail's call site passes + /// (max_zval, min_zval) and an internal double positional swap hands + /// corner_plane_check (min, max) — this port takes (maxZ, minZ) to + /// mirror the caller's argument order and performs the same swap, so + /// call sites read like the decomp. Any plane with all four corners + /// outside culls; any partial plane demotes stickily; EntirelyInside + /// requires unanimity on every plane. planeCount = the active view's + /// edge count (bounds[0] is the CY plane, tested first with early-out). + /// + public static WalkBoundingType BlockCheck( + ReadOnlySpan corner00, ReadOnlySpan corner01, + ReadOnlySpan corner10, ReadOnlySpan corner11, + int planeCount, float maxZ, float minZ) + { + WalkBoundingType result = BlockPlaneCheck( + corner00[0], corner01[0], corner10[0], corner11[0], minZ, maxZ); + if (result == WalkBoundingType.Outside) return WalkBoundingType.Outside; + for (int k = 1; k <= planeCount; k++) + { + WalkBoundingType r = BlockPlaneCheck( + corner00[k], corner01[k], corner10[k], corner11[k], minZ, maxZ); + if (r == WalkBoundingType.Outside) return WalkBoundingType.Outside; + if (r == WalkBoundingType.PartiallyInside) + result = WalkBoundingType.PartiallyInside; + } + return result; + } + + /// + /// Render::viewconeCheck @0x0054c250 (plane-test half): a sphere + /// (center already in viewer-block space, radius already scaled) vs the + /// CY plane plus the active view's edge planes. Cull is STRICT + /// (d < −r); the partial flag is INCLUSIVE (d ≤ r) — a sphere exactly + /// tangent from inside counts Partial, not EntirelyInside. The retail + /// body's side effects (publishing local_object_center/radius) belong + /// to the walk context, not this math. + /// + public static WalkBoundingType ViewconeCheck( + Vector3 center, float radius, in WalkPlane cyPlane, + ReadOnlySpan edgePlanes) + { + float d = Vector3.Dot(cyPlane.Normal, center) + cyPlane.D; + if (d < -radius) return WalkBoundingType.Outside; + bool partial = d <= radius; + foreach (ref readonly WalkPlane plane in edgePlanes) + { + d = Vector3.Dot(plane.Normal, center) + plane.D; + if (d < -radius) return WalkBoundingType.Outside; + if (d <= radius) partial = true; + } + return partial ? WalkBoundingType.PartiallyInside : WalkBoundingType.EntirelyInside; + } +} + +/// Retail Plane: dot(N, p) + d, positive side = inside. +public readonly record struct WalkPlane(Vector3 Normal, float D); + +/// Retail BoundingType, values used raw by the walk. +public enum WalkBoundingType +{ + Outside = 0, + PartiallyInside = 1, + EntirelyInside = 2, +} diff --git a/src/AcDream.App/Rendering/Walk/WalkWorld.cs b/src/AcDream.App/Rendering/Walk/WalkWorld.cs new file mode 100644 index 00000000..8a3f60b0 --- /dev/null +++ b/src/AcDream.App/Rendering/Walk/WalkWorld.cs @@ -0,0 +1,94 @@ +using System.Numerics; + +namespace AcDream.App.Rendering.Walk; + +/// A cell-local portal polygon with its plane (retail +/// CPolygon: vertices + plane @+0x20). +public sealed class WalkPolygon +{ + public Vector3[] Vertices = []; + public WalkPlane Plane; +} + +/// Retail CCellPortal (stride 0x18). The exit-to-landscape +/// sentinel is OtherCellId == 0xFFFFFFFF; OtherPortalId == -1 +/// means "no reciprocal". +public struct WalkCellPortal +{ + public uint OtherCellId; + public int PolygonIndex; + public int PortalSide; + public int OtherPortalId; + public bool ExactMatch; +} + +/// +/// The flood's cell model (retail CEnvCell as the walk sees it). +/// Retail stores the walk state ON the cell (num_view / portal_view stack / +/// cached neighbor pointers); this port keeps the same placement so the +/// transcription stays line-by-line — production adapters construct these +/// from the committed cell registry (FW3 wiring). +/// +public sealed class WalkCell +{ + public uint CellId; + public WalkCellPortal[] Portals = []; + public WalkPolygon[] PortalPolygons = []; + public uint[] StabList = []; + + /// Cell-local → landblock-local (retail CEnvCell.pos; + /// the frame the flood's plane tests and projections run in). + public Matrix4x4 WorldTransform = Matrix4x4.Identity; + public Matrix4x4 InverseWorldTransform = Matrix4x4.Identity; + + // ---- walk state (retail: fields on CEnvCell) ---- + public int NumView; + public readonly List PortalViews = new(); + public WalkCell?[] CachedNeighbors = []; + + public WalkPortalView TopView => PortalViews[NumView - 1]; + + /// CEnvCell::curr_view_push @0x005a5090: push one + /// view-recursion level (lazy slot, exactly three counters reset). + public void PushView() + { + while (PortalViews.Count <= NumView) + PortalViews.Add(new WalkPortalView()); + PortalViews[NumView].ResetForPush(); + NumView++; + if (CachedNeighbors.Length < Portals.Length) + CachedNeighbors = new WalkCell?[Portals.Length]; + } + + public void PopView() => NumView--; +} + +/// +/// The per-frame context retail keeps in globals (Render::FrameCurrent +/// after positionPush(3, cell.pos), the projection state, the visible +/// cell registry, and the cliplandscape toggle — .data default 1). +/// +public interface IWalkFrameContext +{ + /// The eye position in the cell's local frame (retail: the + /// pushed frame's viewer.viewpoint). + Vector3 ViewpointIn(WalkCell cell); + + /// Object(cell-local)→clip matrix for projecting the cell's + /// portal polygons (retail: the pushed frame composed with + /// WorldToView·ViewToClip). + Matrix4x4 ObjectToClip(WalkCell cell); + + /// CEnvCell::GetVisible: the committed/visible cell + /// registry. Returning null skips the portal silently (retail behavior — + /// but implementations should count the miss for the fail-loud rule). + WalkCell? GetVisible(uint cellId); + + IWalkRayCaster Rays { get; } + Vector3 WorldViewpoint { get; } + float ViewportWidth { get; } + float ViewportHeight { get; } + + /// Retail global cliplandscape (.data @0x00820f4c = 1). + bool ClipLandscape => true; +} diff --git a/src/AcDream.App/Rendering/Wb/EnvCellLandblockBuild.cs b/src/AcDream.App/Rendering/Wb/EnvCellLandblockBuild.cs index 9a1c02a0..ed2b2c15 100644 --- a/src/AcDream.App/Rendering/Wb/EnvCellLandblockBuild.cs +++ b/src/AcDream.App/Rendering/Wb/EnvCellLandblockBuild.cs @@ -1,5 +1,6 @@ using System.Collections.Immutable; using System.Numerics; +using AcDream.App.Rendering.Walk; using AcDream.Core.Rendering.Wb; using DatReaderWriter.DBObjs; using DatReaderWriter.Enums; @@ -34,22 +35,48 @@ public sealed class EnvCellLandblockBuild public EnvCellLandblockBuild( uint landblockId, IEnumerable visibilityCells, - IEnumerable shells) + IEnumerable shells, + IEnumerable? walkBuildings = null, + float walkMaxZ = 0f, + float walkMinZ = 0f) { LandblockId = landblockId; VisibilityCells = visibilityCells.ToImmutableArray(); Shells = shells.ToImmutableArray(); + WalkBuildings = (walkBuildings ?? Enumerable.Empty()).ToImmutableArray(); + WalkMaxZ = walkMaxZ; + WalkMinZ = walkMinZ; uint expectedPrefix = landblockId & 0xFFFF0000u; if (VisibilityCells.Any(cell => (cell.CellId & 0xFFFF0000u) != expectedPrefix)) throw new ArgumentException("A visibility cell belongs to a different landblock.", nameof(visibilityCells)); if (Shells.Any(shell => (shell.CellId & 0xFFFF0000u) != expectedPrefix)) throw new ArgumentException("A render shell belongs to a different landblock.", nameof(shells)); + if (WalkBuildings.Any(entry => (entry.Building.PositionCellId & 0xFFFF0000u) != expectedPrefix)) + throw new ArgumentException("A walk building belongs to a different landblock.", nameof(walkBuildings)); } public uint LandblockId { get; } public ImmutableArray VisibilityCells { get; } public ImmutableArray Shells { get; } + + /// Campaign FW3.1: this landblock's walk building placements + /// (WalkBuildingFactory.Build, computed worker-side alongside + /// ). Committed atomically with the rest of + /// this transaction — see WalkBuildingRegistry.Publish at + /// LandblockRenderPublisher.AdvanceCompleteOne. + public ImmutableArray WalkBuildings { get; } + + /// Campaign FW3.1: this landblock's retail z-slab + /// (heightTable[maxByte] + 200) — the walk landscape's per-block + /// visibility bound (WalkLandscapeAssembler.PublishLandblock). + /// Computed once, worker-side, from the SAME heightmap bytes + height + /// table the terrain mesh build already reads — no extra DAT access. + public float WalkMaxZ { get; } + + /// Campaign FW3.1: this landblock's retail z-slab + /// (heightTable[minByte] − 1). See . + public float WalkMinZ { get; } } /// @@ -62,6 +89,9 @@ public sealed class EnvCellLandblockBuildBuilder private readonly uint _landblockId; private readonly List _visibilityCells = new(); private readonly List _shells = new(); + private readonly List _walkBuildings = new(); + private float _walkMaxZ; + private float _walkMinZ; private bool _built; public EnvCellLandblockBuildBuilder(uint landblockId) @@ -69,6 +99,31 @@ public sealed class EnvCellLandblockBuildBuilder _landblockId = landblockId; } + /// Campaign FW3.1: registers this landblock's walk building + /// placements (WalkBuildingFactory.Build's output). Additive to + /// the existing cell/shell accumulation — called once per landblock from + /// LandblockBuildFactory.BuildInteriorEntitiesForStreaming, where + /// LandBlockInfo is already in hand. + public void AddWalkBuildings(IEnumerable entries) + { + if (_built) + throw new InvalidOperationException("This landblock cell build is already complete."); + _walkBuildings.AddRange(entries); + } + + /// Campaign FW3.1: registers this landblock's retail z-slab + /// (/). + /// Independent of interior-cell/building presence — every near-tier + /// landblock has outdoor terrain heights, so + /// LandblockBuildFactory.BuildLocked calls this unconditionally. + public void SetWalkZSlab(float maxZ, float minZ) + { + if (_built) + throw new InvalidOperationException("This landblock cell build is already complete."); + _walkMaxZ = maxZ; + _walkMinZ = minZ; + } + public void AddCell( uint envCellId, EnvCell envCell, @@ -116,7 +171,8 @@ public sealed class EnvCellLandblockBuildBuilder if (_built) throw new InvalidOperationException("This landblock cell build is already complete."); _built = true; - return new EnvCellLandblockBuild(_landblockId, _visibilityCells, _shells); + return new EnvCellLandblockBuild( + _landblockId, _visibilityCells, _shells, _walkBuildings, _walkMaxZ, _walkMinZ); } /// @@ -290,6 +346,18 @@ public sealed class EnvCellLandblockBuildBuilder PortalPolygons = portalPolygons, VisibleCells = visibleCells, SeenOutside = envCell.Flags.HasFlag(EnvCellFlags.SeenOutside), + // Campaign FW3.1: the walk's model of this cell, built from the + // SAME EnvCell/CellStruct/transform this LoadedCell was just + // built from — WalkCellFactory.FromParsed does its own portal + // pass (independent of the clipPlanes/portalPolygons above; the + // two consumers decode the same dat fields for different needs) + // so it stays a direct, auditable port of the FW1 test adapter + // rather than reshaping LoadedCell's own list layout around it. + // cellTransform/inverse are the dat EnvCell origin verbatim — + // since FW3.3 retired ShellDrawLiftZ, render and physics share + // this one transform (retail draws at the origin; the walk's + // retail draw order owns the coplanar tie-breaks). + Walk = WalkCellFactory.FromParsed(envCellId, envCell, cellStruct, cellTransform, inverse), }; } } diff --git a/src/AcDream.App/Rendering/Wb/EnvCellRenderer.Rhi.cs b/src/AcDream.App/Rendering/Wb/EnvCellRenderer.Rhi.cs index bf51a132..8154724e 100644 --- a/src/AcDream.App/Rendering/Wb/EnvCellRenderer.Rhi.cs +++ b/src/AcDream.App/Rendering/Wb/EnvCellRenderer.Rhi.cs @@ -88,10 +88,12 @@ public sealed unsafe partial class EnvCellRenderer /// shared: mesh_modern, the 32-byte world-mesh vertex, triangle lists, /// back-face culling with clockwise front faces. /// - /// Depth compare is Less, not the contract's LessOrEqual - /// default. The world frame runs under GL_LESS and this renderer never - /// called glDepthFunc, so it inherited it; baking LessOrEqual - /// would change which of two coplanar retail surfaces wins. + /// Depth compare is + /// (Less), not the contract's LessOrEqual default — see that + /// type for the full citation. The world frame runs under GL_LESS + /// and this renderer never called glDepthFunc, so it inherited it; + /// baking LessOrEqual would change which of two coplanar retail + /// surfaces wins. /// private static IGpuPipeline CreateShellPipeline( IGpuDevice device, @@ -100,7 +102,7 @@ public sealed unsafe partial class EnvCellRenderer bool depthWrite, int sampleCount, string shaderName = "mesh_modern", - GpuCompareOp depthCompare = GpuCompareOp.Less) => + GpuCompareOp depthCompare = AcDream.App.Rendering.WorldDepthContract.WorldCompare) => device.CreatePipeline(new GpuPipelineDescription { Name = name, diff --git a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.OrderedStream.cs b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.OrderedStream.cs new file mode 100644 index 00000000..468323fa --- /dev/null +++ b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.OrderedStream.cs @@ -0,0 +1,590 @@ +using System.Numerics; +using AcDream.App.Rendering.Gpu; +using AcDream.App.Rendering.Walk; +using AcDream.Core.Lighting; +using AcDream.Core.Meshing; +using AcDream.Core.Rendering; +using DatReaderWriter.Enums; + +namespace AcDream.App.Rendering.Wb; + +/// +/// Campaign FW stage FW2: 's submitter. +/// +/// Walk-order submission through the SAME RHI machinery +/// WbDrawDispatcher.Rhi.cs already owns — the ring-section writers, +/// , and — is +/// why this is a partial of rather than a +/// standalone class. Two shapes are reused directly: +/// 's per-instance-first emission +/// (command i owns exactly one instance, BaseInstance = i, so +/// walk order — never material bucketing — survives into the indirect array) +/// and 's "write every section once" +/// shape (_ordered* fields here, not the persisted _alpha* +/// fields: those belong to , which can still be +/// mid-flight in the same frame, and overwriting them would corrupt that +/// replay). +/// +/// Campaign FW stage FW3.4a (2026-08-30): the FW2 submitter was ONE +/// method, SubmitOrderedStream, that wrote every per-instance section +/// AND drew every merge run in one call — fine for FW2/FW3.2's proof, but the +/// FW3.4 perf checkpoint measured ~40 of these per frame at a town (one per +/// walk segment — every cell shell, every building's alpha barrier, every +/// punch fan flushes the accumulated stream so far), each one re-writing all +/// nine per-instance ring sections and rebinding everything, for that +/// segment's handful of instances. + +/// replace it: the WHOLE frame's stream is +/// written and bound ONCE, and each walk segment becomes a cheap +/// call over the ALREADY-uploaded payload — +/// the same split / +/// already prove for the alpha path. +/// SubmitOrderedStream itself is deleted; every FW2 caller/test now +/// calls the pair (prepare once, draw the whole stream as one range, or as +/// several — see OrderPreservingSubmitterTests). +/// +/// Scope: this stage proves walk-order submission through the existing +/// RHI on static content (plan §FW2). It does NOT wire the retail +/// building-detail overlay replay (DrawBuildingDetailRangeRhi's second +/// pass through RetailDetail/RetailDetailTransparent) — a +/// detail-category command still forces a solo merge run (mirroring the +/// deferred-alpha detail break), but this submitter issues only the +/// base-pipeline draw for it. The overlay replay is production wiring, +/// deferred to whichever stage cuts the walk over for real content. +/// +public sealed unsafe partial class WbDrawDispatcher +{ + /// + /// One walk-order merge run: a maximal, in-order span of commands that + /// share a , a resolved pipeline, and a cull + /// mode, built by . + /// + internal readonly record struct OrderedMergeRun(int FirstCommand, int CommandCount); + + /// + /// The four pipeline buckets a translucency kind resolves to, independent + /// of any live instance. + /// selects between Opaque and OpaqueAlphaToCoverage uniformly + /// for the whole submission — it never varies per command — so merge-run + /// legality only needs to know WHICH bucket a command falls in, not which + /// concrete that resolves to. That is what lets + /// stay pure CPU logic, testable + /// without a live GPU device — the same separation + /// already draws between layout and RHI + /// glue. + /// + private enum PipelineBucket + { + Opaque, + AlphaBlend, + AlphaAdditive, + AlphaInverse, + } + + private static PipelineBucket BucketFor(TranslucencyKind kind) + { + if (IsOpaque(kind)) + return PipelineBucket.Opaque; + + return kind switch + { + TranslucencyKind.Additive => PipelineBucket.AlphaAdditive, + TranslucencyKind.InvAlpha => PipelineBucket.AlphaInverse, + _ => PipelineBucket.AlphaBlend, + }; + } + + private IGpuPipeline PipelineForBucket(MeshPipelineSet pipelines, PipelineBucket bucket) => + bucket switch + { + PipelineBucket.Opaque => AlphaToCoverage ? pipelines.OpaqueAlphaToCoverage : pipelines.Opaque, + PipelineBucket.AlphaAdditive => pipelines.AlphaAdditive, + PipelineBucket.AlphaInverse => pipelines.AlphaInverse, + _ => pipelines.AlphaBlend, + }; + + /// + /// Builds the maximal in-order merge runs for . + /// Pure CPU: no GPU device, no live pipeline, no encoder — every legality + /// decision is a comparison over the stream's own parallel arrays, which + /// is what lets this be unit-tested directly. + /// + /// A run extends from command i to j while every + /// command in [i, j) shares the same , + /// the same , the same , + /// and none carries a nonzero DetailCategory — a detail-category + /// command always emits alone, mirroring + /// DrawPreparedAlphaBatchRhi's hasDetail break. Never + /// reorders or drops anything: every command in + /// belongs to exactly one returned run, in stream order. + /// + /// (FW3.4a addition, + /// default none): extra command indices, sorted ascending, at which a run + /// must end even when the state comparison above would otherwise extend + /// it. 's Replay phase draws the frame's ONE + /// prepared stream as several calls — one + /// per walk segment, each separated by a leaf GPU call (a cell shell, a + /// punch fan, an alpha barrier) that MUST execute between them — and nothing + /// about /bucket/cull/detail forbids two + /// DIFFERENT segments from sharing all four (two consecutive indoor cells + /// drawn Opaque/CounterClockwise, the overwhelmingly common case). Without + /// this parameter, a whole-stream merge pass would happily fuse such + /// segments into one run spanning the leaf call that must run BETWEEN + /// them, silently reordering GPU commands relative to retail's walk — the + /// one invariant this campaign may never trade away. Passing each + /// segment's start index here makes 's + /// "a range boundary always coincides with a run boundary" assumption + /// true BY CONSTRUCTION instead of by hope; that method's own assert + /// stays as insurance against a future bug in how boundaries are + /// supplied. Every FW2 call site keeps passing none, so existing + /// single-segment behavior (and its tests) is unchanged. + /// + /// Fails loud before building any run: + /// has no submission path (see that value's own documentation), so a + /// stream carrying one throws immediately rather than silently degrading + /// to some other stage's handling. + /// + internal static List BuildOrderedMergeRuns( + OrderedDrawStream stream, IReadOnlyList? forcedBreaksAscending = null) + { + ArgumentNullException.ThrowIfNull(stream); + int count = stream.Count; + + for (int i = 0; i < count; i++) + { + if (stream.Stages[i] == WalkDrawStage.PortalPunch) + { + throw new NotSupportedException( + $"OrderedDrawStream command {i} carries WalkDrawStage.PortalPunch, " + + "which has no FW2 submission path — punch geometry emission lands " + + "in FW3 with the world wiring " + + "(docs/plans/2026-08-30-campaign-fw-frame-walk.md §FW2/§FW3). The " + + "stage exists now purely so stage-separation gates can exercise the " + + "boundary before the real emission path exists."); + } + } + + IReadOnlyList breaks = forcedBreaksAscending ?? Array.Empty(); + int breakCursor = 0; + + var runs = new List(); + int cursor = 0; + while (cursor < count) + { + // A break AT OR BEFORE cursor already ended the previous run (or + // predates the stream entirely) — only a break STRICTLY AFTER + // cursor can stop the one starting here. + while (breakCursor < breaks.Count && breaks[breakCursor] <= cursor) + breakCursor++; + + WalkDrawStage stage = stream.Stages[cursor]; + PipelineBucket bucket = BucketFor(stream.Keys[cursor].Translucency); + CullMode cull = stream.Keys[cursor].CullMode; + bool detail = stream.DetailCategories[cursor] != 0; + + int end = cursor + 1; + if (!detail) + { + while (end < count + && !(breakCursor < breaks.Count && breaks[breakCursor] == end) + && stream.Stages[end] == stage + && stream.DetailCategories[end] == 0 + && BucketFor(stream.Keys[end].Translucency) == bucket + && stream.Keys[end].CullMode == cull) + { + end++; + } + } + + runs.Add(new OrderedMergeRun(cursor, end - cursor)); + cursor = end; + } + + return runs; + } + + /// + /// The campaign's "assert it" rule (plan §FW2: "a merge across a state or + /// stage boundary is forbidden by construction"). + /// only ever EXTENDS a run while stage/bucket/cull/detail all match, so + /// this should never fire — it exists so a future edit to that method's + /// loop condition fails a test immediately instead of silently drawing + /// the wrong material state for part of a run. + /// + private static void ValidateMergeRun(OrderedDrawStream stream, OrderedMergeRun run) + { + int firstCommand = run.FirstCommand; + WalkDrawStage stage = stream.Stages[firstCommand]; + PipelineBucket bucket = BucketFor(stream.Keys[firstCommand].Translucency); + CullMode cull = stream.Keys[firstCommand].CullMode; + bool detail = stream.DetailCategories[firstCommand] != 0; + int end = firstCommand + run.CommandCount; + + if (detail && run.CommandCount != 1) + { + throw new InvalidOperationException( + $"Merge run [{firstCommand}, {end}) carries a nonzero DetailCategory but " + + $"contains {run.CommandCount} commands — a detail-category command must " + + "emit alone."); + } + + for (int i = firstCommand + 1; i < end; i++) + { + if (stream.Stages[i] != stage) + { + throw new InvalidOperationException( + $"Merge run [{firstCommand}, {end}) crosses a WalkDrawStage boundary " + + $"at command {i} ({stream.Stages[i]} != {stage}) — a merge across a " + + "stage boundary is forbidden by construction (Campaign FW §FW2)."); + } + if (BucketFor(stream.Keys[i].Translucency) != bucket) + { + throw new InvalidOperationException( + $"Merge run [{firstCommand}, {end}) crosses a pipeline boundary at " + + $"command {i} — a merge across a material-state boundary is " + + "forbidden by construction (Campaign FW §FW2)."); + } + if (stream.Keys[i].CullMode != cull) + { + throw new InvalidOperationException( + $"Merge run [{firstCommand}, {end}) crosses a cull-mode boundary at " + + $"command {i} — a merge across a material-state boundary is " + + "forbidden by construction (Campaign FW §FW2)."); + } + if (stream.DetailCategories[i] != 0) + { + throw new InvalidOperationException( + $"Merge run [{firstCommand}, {end}) contains a detail-category " + + $"command at {i} outside a solo run — a detail-category command " + + "must emit alone (Campaign FW §FW2)."); + } + } + } + + /// + /// Campaign FW3.2b-2: the production frame/encoder pair for + /// 's own + /// calls (contrast this stage's diagnostic-target callers, which supply + /// their own frame/encoder). Reads the SAME world-pass scope + /// already requires ( / + /// _scope.RequireEncoder()) — fails loud rather than handing the + /// driver a null pair when the world phase is not bracketing. + /// + internal (IGpuFrame Frame, IGpuPassEncoder Encoder) RequireWalkSubmission() => + (RequireRhiFrame(), _scope!.RequireEncoder()); + + /// + /// Campaign FW3.2b-2: the live colour-attachment size, for + /// 's viewport (the walk's ray + /// caster needs the REAL viewport, not the FW0/FW1 capture-client + /// fixture constants — see that class's own doc comment). Null outside + /// the world phase (no scope published yet); the caller falls back to + /// the fixture constants with a comment in that case rather than + /// failing loud, since a missing scope here is a startup-ordering + /// timing question, not a misconfiguration. + /// + internal (int Width, int Height)? WalkAttachmentExtent => + _scope is null ? null : (_scope.AttachmentWidth, _scope.AttachmentHeight); + + // ── Campaign FW3.4a: the prepared-once, drawn-in-ranges pair ─────────── + // + // Persisted state a PrepareOrderedStream call fills and every later + // DrawOrderedRange call in the SAME frame reads. Deliberately its own set + // — never _alpha* — for the same reason SubmitOrderedStream's per-frame + // locals were never _alpha* (see this file's type doc comment): + // RetailAlphaQueue can still be mid-flight when a walk segment flushes, + // and sharing storage would corrupt whichever path writes second. + + private OrderedDrawStream? _orderedStream; + private List _orderedRuns = new(); + private int _orderedPreparedCount; + // Caller-supplied, exactly like SubmitOrderedStream's own frame/encoder + // parameters were (see this file's type doc comment: the walk submitter + // draws into whatever pass its caller has open, never pulled from + // _frames/_scope) — DrawOrderedRange's bind-once step needs the SAME + // frame Prepare wrote sections into, for WorldFrameSectionBinding's + // clip-region/scene-lighting binds; RequireRhiFrame() is the wrong tool + // here since it demands the dispatcher's OWN BeginFrame/_dynamicFrameStarted + // bookkeeping, which the walk path never participates in. + private IGpuFrame? _orderedFrame; + private Matrix4x4 _orderedViewProjection; + private uint _orderedTransformBaseInstance; + private RhiSection _orderedInstances; + private RhiSection _orderedBatches; + private RhiSection _orderedClipSlots; + private RhiSection _orderedGlobalLights; + private RhiSection _orderedLightSets; + private RhiSection _orderedIndoor; + private RhiSection _orderedAlpha; + private RhiSection _orderedSelectionLighting; + private RhiSection _orderedDetailCategory; + private RhiSection _orderedCommands; + + /// + /// Writes 's ENTIRE walk-order payload into the + /// frame ring exactly ONCE — the per-instance-first emission + /// ('s shape) followed by one + /// section write per per-instance array ('s + /// shape, into the _ordered* fields above). No draw happens here; + /// issues the actual + /// calls against this prepared payload, + /// as many times as the caller needs ( calls + /// it once per walk segment, interleaved with the leaf GPU calls that + /// must run between segments). + /// + /// forwards to + /// — see that parameter's own doc + /// comment. Pass the walk segment boundaries here so a later + /// call's range always aligns with a merge + /// run by construction. + /// + /// A no-op (leaves at 0) when + /// the stream is empty or the mesh source is not yet ready — mirrors + /// 's own early-outs. Fails loud + /// BEFORE any GPU work if the stream carries an unsupported stage (see + /// ). + /// + internal void PrepareOrderedStream( + IGpuFrame frame, + OrderedDrawStream stream, + in Matrix4x4 viewProjection, + IReadOnlyList? forcedBreaksAscending = null) + { + ArgumentNullException.ThrowIfNull(frame); + ArgumentNullException.ThrowIfNull(stream); + + _orderedStream = stream; + _orderedFrame = frame; + _orderedPreparedCount = 0; + + // Fail loud before any GPU work: a PortalPunch command has no + // submission path. + _orderedRuns = BuildOrderedMergeRuns(stream, forcedBreaksAscending); + + int count = stream.Count; + if (count == 0) + return; + + GlobalMeshBuffer? global = _meshAdapter.MeshManager?.GlobalBuffer; + if (global is null || !MeshSourceReady()) + return; + + // Per-instance-first emission — see PrepareDeferredAlphaDraws, into + // the SAME shared per-instance scratch arrays that method writes + // (safe: this is a single-threaded render frame, and the writer here + // runs to completion — including the section uploads below — before + // any other per-instance producer touches the scratch again). Cull + // modes are the one exception: this stage keeps its own + // _orderedDrawCullModes scratch (see DrawIndirectRangeRhi's doc + // comment) precisely so a walk-ordered draw can freely interleave + // with a mid-flight RetailAlphaQueue scope without corrupting — or + // being corrupted by — the alpha path's _drawCullModes. + EnsureDeferredAlphaCapacity(count); + EnsureOrderedCullModeCapacity(count); + for (int i = 0; i < count; i++) + { + GroupKey key = stream.Keys[i]; + WriteMatrix(_instanceData, i * 16, stream.Transforms[i]); + _clipSlotData[i] = stream.ClipSlots[i]; + _indoorData[i] = stream.IndoorFlags[i]; + _detailCategoryData[i] = stream.DetailCategories[i]; + _alphaData[i] = stream.Alphas[i]; + _selectionLightingData[i] = stream.SelectionLighting[i]; + stream.Lights[i].CopyTo(_lightSetData, i * LightManager.MaxLightsPerObject); + + _batchData[i] = new BatchData + { + TextureIndex = key.TextureSlot.Index, + TextureLayer = key.TextureLayer, + Flags = 1u | key.FoliageFlags, + }; + _indirectCommands[i] = new DrawElementsIndirectCommand + { + Count = (uint)key.IndexCount, + InstanceCount = 1, + FirstIndex = key.FirstIndex, + BaseVertex = key.BaseVertex, + BaseInstance = (uint)i, + }; + _orderedDrawCullModes[i] = key.CullMode; + } + + // Write every section ONCE — the PrepareRhiAlphaSections shape, into + // _ordered* rather than _alpha* (see this file's type doc comment). + _orderedViewProjection = viewProjection; + _orderedInstances = WriteWorldTransformSection( + frame, _instanceData.AsSpan(0, count * 16), out uint transformBaseInstance); + _orderedTransformBaseInstance = transformBaseInstance; + _orderedBatches = WriteRingSection(frame, _batchData.AsSpan(0, count)); + _orderedClipSlots = WriteRingSection(frame, _clipSlotData.AsSpan(0, count)); + int lightCount = GlobalLightPacker.Pack(_pointSnapshot, ref _globalLightData); + int uploadCount = lightCount > 0 ? lightCount : 1; + _orderedGlobalLights = WriteRingSection( + frame, + _globalLightData.AsSpan(0, uploadCount * GlobalLightPacker.FloatsPerLight)); + _orderedLightSets = WriteRingSection( + frame, _lightSetData.AsSpan(0, count * LightManager.MaxLightsPerObject)); + _orderedIndoor = WriteRingSection(frame, _indoorData.AsSpan(0, count)); + _orderedAlpha = WriteRingSection(frame, _alphaData.AsSpan(0, count)); + _orderedSelectionLighting = WriteRingSection( + frame, _selectionLightingData.AsSpan(0, count)); + _orderedDetailCategory = WriteRingSection(frame, _detailCategoryData.AsSpan(0, count)); + GpuRingAllocation commandsAllocation = WriteIndirectCommands( + frame, _indirectCommands.AsSpan(0, count), transformBaseInstance); + _orderedCommands = new RhiSection( + commandsAllocation.Buffer, + commandsAllocation.OffsetBytes, + checked((uint)(count * DrawCommandStride))); + + _orderedPreparedCount = count; + } + + /// + /// Draws commands [firstCommand, firstCommand + commandCount) of + /// the payload the most recent call + /// uploaded. Every call re-binds the pipeline, push constants, and the + /// per-instance sections — leaf draws and alpha flushes between ranges + /// rebind the same set-0 slots to THEIR buffers, so a latched skip draws + /// against foreign sections (the dense-Arwic device-lost). The FW3.4a + /// win is the once-per-frame ring WRITES in + /// (what used to be ~40 full SubmitOrderedStream uploads per + /// frame at a town becomes one bind plus ~40 cheap + /// calls). Section binds survive + /// pipeline switches (every mesh pipeline shares one layout — the same + /// reasoning SubmitRhi/the old SubmitOrderedStream already + /// relied on), so binding once per frame rather than once per pipeline + /// switch is safe. + /// + /// Fail-loud range check mirrors 's: + /// a range outside [0, _orderedPreparedCount] throws + /// rather than silently + /// clamping or drawing garbage — including when nothing was ever + /// prepared this frame (a caller drawing without preparing is a real + /// bug, not a valid empty draw). A zero-length range is a legal no-op + /// (mirrors an empty walk segment). + /// + /// Walks the runs built that + /// intersect this range. By construction (the boundaries the caller fed + /// as forcedBreaksAscending) a + /// run never starts before the range and never ends after it — this is + /// asserted, not assumed: a run that straddles the range edge throws + /// rather than being silently sliced, per plan §FW3.4a. + /// + internal void DrawOrderedRange(IGpuPassEncoder encoder, int firstCommand, int commandCount) + { + ArgumentNullException.ThrowIfNull(encoder); + if (firstCommand < 0 + || commandCount < 0 + || firstCommand > _orderedPreparedCount - commandCount) + { + throw new ArgumentOutOfRangeException( + nameof(firstCommand), + "The ordered draw range exceeds the payload the most recent " + + "PrepareOrderedStream call uploaded."); + } + if (commandCount == 0) + return; + if (_orderedCommands.Buffer is null || _orderedStream is null) + return; + + GlobalMeshBuffer? global = _meshAdapter.MeshManager?.GlobalBuffer; + if (global is null) + return; + + MeshPipelineSet pipelines = PipelinesFor(encoder); + var pushConstants = new GpuPushConstants + { + ViewProjection = _orderedViewProjection, + DrawIdOffset = 0, + LightingMode = 0, + RenderPass = 0, + LightDebug = RenderingDiagnostics.LightDebugMode, + TextureIndexA = 0, + TextureIndexB = _orderedTransformBaseInstance, + ParamA = 0f, + ParamB = 0f, + }; + + { + IGpuFrame frame = _orderedFrame + ?? throw new InvalidOperationException( + "DrawOrderedRange has no frame to bind clip-region/" + + "scene-lighting sections against — PrepareOrderedStream must run first."); + + // Bind the SECTIONS on EVERY range call — never latch them + // across calls. Between ordered ranges the walk's leaf draws run + // (terrain, cell shells, sky, punch fans) and RetailAlphaQueue + // flushes rebind the SAME set-0 storage bindings to THEIR + // sections; a latched skip here draws the next range against the + // alpha path's buffers — out-of-bounds instance reads and a + // VK_ERROR_DEVICE_LOST at dense Arwic (the FW3.4a re-measure + // crash). The expensive part — the ring WRITES — already happens + // once per frame in PrepareOrderedStream; these are descriptor + // binds only, the same per-batch rebinding the proven + // DrawPreparedAlphaBatchRhi does for the same reason. + BindPipelineWithMesh(encoder, pipelines.Opaque, global); + encoder.SetPushConstants(in pushConstants); + BindSection(encoder, GpuBindingModel.StorageInstances, _orderedInstances); + BindSection(encoder, GpuBindingModel.StorageBatches, _orderedBatches); + BindSection(encoder, GpuBindingModel.StorageClipSlots, _orderedClipSlots); + BindSection(encoder, GpuBindingModel.StorageGlobalLights, _orderedGlobalLights); + BindSection(encoder, GpuBindingModel.StorageInstanceLightSets, _orderedLightSets); + BindSection(encoder, GpuBindingModel.StorageInstanceIndoor, _orderedIndoor); + BindSection(encoder, GpuBindingModel.StorageInstanceAlpha, _orderedAlpha); + BindSection( + encoder, GpuBindingModel.StorageInstanceSelectionLighting, _orderedSelectionLighting); + BindSection( + encoder, GpuBindingModel.StorageInstanceDetailCategory, _orderedDetailCategory); + AcDream.App.Rendering.WorldFrameSectionBinding.BindClipRegions( + encoder, _scope!.Sections, frame); + AcDream.App.Rendering.WorldFrameSectionBinding.BindSceneLighting( + encoder, _scope!.Sections, frame); + } + + IGpuBuffer commandBuffer = _orderedCommands.Buffer!; + uint commandBase = _orderedCommands.OffsetBytes; + int rangeEnd = firstCommand + commandCount; + + foreach (OrderedMergeRun run in _orderedRuns) + { + int runEnd = run.FirstCommand + run.CommandCount; + if (runEnd <= firstCommand) + continue; + if (run.FirstCommand >= rangeEnd) + break; + + if (run.FirstCommand < firstCommand || runEnd > rangeEnd) + { + throw new InvalidOperationException( + $"DrawOrderedRange [{firstCommand}, {rangeEnd}) straddles merge run " + + $"[{run.FirstCommand}, {runEnd}) — a range boundary must coincide with " + + "a run boundary by construction (PrepareOrderedStream's " + + "forcedBreaksAscending should have forced a break here; Campaign FW " + + "§FW3.4a)."); + } + + ValidateMergeRun(_orderedStream, run); + + PipelineBucket bucket = BucketFor(_orderedStream.Keys[run.FirstCommand].Translucency); + IGpuPipeline pipeline = PipelineForBucket(pipelines, bucket); + pushConstants.RenderPass = bucket == PipelineBucket.Opaque ? 0 : 1; + + BindPipelineWithMesh(encoder, pipeline, global); + DrawIndirectRangeRhi( + encoder, ref pushConstants, commandBuffer, commandBase, + run.FirstCommand, run.CommandCount, _orderedDrawCullModes); + } + } + + /// + /// Grows to at least + /// — the same growth shape + /// EnsureDeferredAlphaCapacity uses for , + /// kept as its own method because this scratch array is not part of that + /// method's shared per-instance group (see this file's type doc comment). + /// + private void EnsureOrderedCullModeCapacity(int count) + { + if (_orderedDrawCullModes.Length < count) + _orderedDrawCullModes = new CullMode[count + 64]; + } +} diff --git a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.PackedOracle.cs b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.PackedOracle.cs index d3df7aef..f5e16ffa 100644 --- a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.PackedOracle.cs +++ b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.PackedOracle.cs @@ -635,56 +635,22 @@ public sealed unsafe partial class WbDrawDispatcher batchIndex < renderData.Batches.Count; batchIndex++) { - ObjectRenderBatch batch = - renderData.Batches[batchIndex]; - - // #426: mirrors the classic ClassifyBatches gate exactly — see - // RetailUntexturedSubsetPolicy for the retail citation. ONE - // shared predicate so the classic and packed classifiers cannot - // drift (Campaign VM VM6). - if (!RetailUntexturedSubsetPolicy.Draws(entity.IsBuildingShell, batch.Key.IsSolid)) - continue; - - TranslucencyKind translucency = batch.Translucency; - if (opacity < 1f && IsOpaque(translucency)) - translucency = TranslucencyKind.AlphaBlend; - - ResolvedTexture texture = ResolveTexture( - in entity, - meshRef, - batch, - paletteIdentity, - out bool compositePending); + // Campaign FW stage FW3.2a: mirrors the classic ClassifyBatches + // gate/promotion/resolve/foliage-classify sequence exactly — see + // the one shared core (WbDrawDispatcher.WalkClassify.cs's + // TryClassifyBatch) also used by ClassifyBatches and the walk + // classifier, so the classic and packed classifiers cannot drift + // (Campaign VM VM6). `survives=false` still applies + // compositePending exactly as before this extraction. + bool survives = TryClassifyBatch( + renderData, batchIndex, in entity, meshRef, paletteIdentity, + opacity, entityHasCutoutSubset, + out GroupKey key, out bool compositePending); if (compositePending) reusableAcrossFrames = false; - if (!texture.Slot.IsAssigned) + if (!survives) continue; - // Campaign VM VM6 review fix round 2 (F1 BLOCKER): the packed - // production classifier never computed FoliageFlags, so the - // production BatchData.flags word was always 0 for every - // scenery entity — the world geometry never swayed even though - // the independently-classified shadow caster did. Classify - // BEFORE constructing the key, from the RAW (pre-#188- - // promotion) batch.Translucency, exactly as the classic - // ClassifyBatches does — see that method's own comment for why - // raw translucency is used for classification but the (possibly - // promoted) local `translucency` is still what the key/group - // partitions draws by. - uint foliageFlags = FoliageWindClassification.Classify( - entity.LocalEntityId, - FoliageWindExclusions.Contains(meshRef.GfxObjId), - batch.Translucency, - entityHasCutoutSubset); - var key = new GroupKey( - batch.FirstIndex, - (int)batch.BaseVertex, - batch.IndexCount, - texture.Slot, - texture.Layer, - translucency, - FoliageFlags: foliageFlags, - CullMode: batch.CullMode); var classified = new PackedClassifiedBatch( key, restPose, diff --git a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.Rhi.cs b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.Rhi.cs index 2d9fac4b..47051004 100644 --- a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.Rhi.cs +++ b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.Rhi.cs @@ -315,11 +315,12 @@ public sealed unsafe partial class WbDrawDispatcher /// where ApplyCullMode sets them, because core Vulkan 1.3 makes those /// dynamic and blend and alpha-to-coverage not. /// - /// Depth compare is Less, not the contract's - /// LessOrEqual default: the world frame runs under GL_LESS and - /// this renderer never called glDepthFunc, so it inherited it. Baking - /// LessOrEqual would change which of two coplanar retail surfaces - /// wins. + /// Depth compare is + /// (Less), not the contract's LessOrEqual default — see that + /// type for the full citation. The short version: the world frame runs + /// under GL_LESS and this renderer never called glDepthFunc, + /// so it inherited it. Baking LessOrEqual would change which of two + /// coplanar retail surfaces wins. /// private static IGpuPipeline CreateMeshPipeline( IGpuDevice device, @@ -330,7 +331,7 @@ public sealed unsafe partial class WbDrawDispatcher int sampleCount, string shaderName = "mesh_modern", GpuShaderSet? shaders = null, - GpuCompareOp depthCompare = GpuCompareOp.Less, + GpuCompareOp depthCompare = AcDream.App.Rendering.WorldDepthContract.WorldCompare, bool usesRenderPackShaderAbi = false) => device.CreatePipeline(new GpuPipelineDescription { @@ -795,23 +796,40 @@ public sealed unsafe partial class WbDrawDispatcher _ => pipelines.AlphaBlend, }; + /// + /// Reads cull modes from when the caller + /// supplies one, or from the shared scratch + /// otherwise (every pre-FW3.2a call site). Campaign FW stage FW3.2a: + /// passes its OWN scratch + /// () so a walk-ordered submission can + /// interleave with a mid-flight scope — + /// _drawCullModes is written fresh by + /// PrepareDeferredAlphaDraws at every alpha flush and read right + /// back by this method for that draw; an ordered submission sharing the + /// same array between those two steps could silently draw the alpha + /// content's faces with the ordered content's cull mode, or vice + /// versa (the FW2 caveat this stage retires — see + /// WbDrawDispatcher.OrderedStream.cs). + /// private void DrawIndirectRangeRhi( IGpuPassEncoder encoder, ref GpuPushConstants pushConstants, IGpuBuffer commandBuffer, uint commandBaseOffsetBytes, int startCommand, - int commandCount) + int commandCount, + CullMode[]? cullModes = null) { + CullMode[] modes = cullModes ?? _drawCullModes; int end = startCommand + commandCount; int command = startCommand; while (command < end) { - CullMode cullMode = _drawCullModes[command]; + CullMode cullMode = modes[command]; ApplyCullModeRhi(encoder, cullMode); int runCount = 1; - while (command + runCount < end && _drawCullModes[command + runCount] == cullMode) + while (command + runCount < end && modes[command + runCount] == cullMode) runCount++; // Each multi-draw-indirect call restarts gl_DrawID at 0, so a run diff --git a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.WalkClassify.cs b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.WalkClassify.cs new file mode 100644 index 00000000..1e1351b2 --- /dev/null +++ b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.WalkClassify.cs @@ -0,0 +1,355 @@ +using System.Numerics; +using AcDream.App.Rendering.Scene; +using AcDream.App.Rendering.Selection; +using AcDream.Core.Meshing; +using AcDream.Core.World; +using DatReaderWriter.Enums; + +namespace AcDream.App.Rendering.Wb; + +/// +/// Campaign FW stage FW3.2a: the walk-order population layer. This partial +/// holds two things. +/// +/// The shared per-batch classify core (): +/// extracted from ClassifyBatches (this file's sibling +/// WbDrawDispatcher.cs) and ClassifyPackedBatches +/// (WbDrawDispatcher.PackedOracle.cs), which carried byte-identical +/// per-batch logic (the #426 untextured-subset gate, the #188 opacity +/// promotion, texture resolution, Campaign VM foliage classification, the +/// construction) with only their SURROUNDING +/// bookkeeping differing (classic appends to an +/// via caller-scoped instance fields; packed appends via explicit +/// parameters). Both call sites now call this one method per batch and keep +/// their own append logic — the classic and packed paths are unchanged in +/// every observable way (same hermetic + Lane=InstalledDat suites +/// stay the referee); this stage's OWN new walk classifier +/// () is the third caller. +/// +/// The per-entity walk classify seam +/// (): given ONE +/// — the same shape ClassifyPackedEntity consumes, but read straight +/// off the record's own via +/// RenderInstanceCandidate.FromProjection rather than the packed +/// route's frame-arena mesh-part flattening — yields one +/// per surviving (part, batch) pair WITHOUT +/// touching any , plus the per-part selection +/// data AddPackedSelectionPart would have published, for +/// WalkStaticStreamPopulator to publish itself (deliverable +/// 1 leaves the publish decision — timing, stage/cell provenance — to the +/// caller; see , the thin internal seam +/// that keeps _selectionSink encapsulated). +/// +/// Scope: this stage classifies static content only (no production +/// frame wiring — see plan §FW3.2a). Per-part translucency-fade +/// (TranslucencyFadeManager/EntityOpacity) is NOT threaded +/// through: that mechanic is TransparentPartHook, a retail LIVE-entity +/// behavior keyed by ServerGuid, not something world statics undergo — every +/// classified batch here carries Alpha = 1f. Likewise the async +/// mesh-miss self-heal request (_missRequested/EnsureLoaded, +/// frame-scoped state cleared by BeginEntityDispatch) is not fired +/// here — this seam has no production frame to be scoped to yet; a missing +/// mesh is simply skipped, matching every other unwired FW2/FW3.2a path. +/// +public sealed partial class WbDrawDispatcher +{ + /// + /// One walk-classified (entity, part, batch) draw candidate — exactly + /// OrderedDrawCommand's per-instance field set (minus + /// the walk-provenance Stage/CellId fields, which the + /// populator stamps on since the classifier has no notion of either) + /// plus two fields an opaque command has no use for but a translucent + /// one needs to reach the alpha queue: (so the + /// populator can route without re-deriving it from + /// ) and + /// (the authored GfxObj sort center RetailAlphaOrdering.ComputeViewerDistance + /// transforms through — the same value + /// InstanceGroup.LocalSortCenters carries per instance today). + /// + internal readonly record struct WalkClassifiedBatch( + GroupKey Key, + Matrix4x4 Transform, + uint ClipSlot, + InstanceLightSet Lights, + uint IndoorFlag, + float Alpha, + Vector2 SelectionLighting, + uint DetailCategory, + bool IsOpaque, + Vector3 LocalSortCenter); + + /// + /// One retail-picking part surfaced by + /// — the exact argument tuple AddPackedSelectionPart's + /// publishSelection: true branch passes to + /// IRetailSelectionRenderSink.AddVisiblePart. The classify seam + /// surfaces this; is the caller's + /// publish call. + /// + internal readonly record struct WalkClassifiedSelectionPart( + uint ServerGuid, + uint LocalEntityId, + int PartIndex, + uint GfxObjId, + Matrix4x4 LocalToWorld); + + /// + /// The shared per-batch classify core. Given one already-resolved + /// and the batch at , + /// applies — in this exact order, matching both ClassifyBatches and + /// ClassifyPackedBatches before this extraction — the #426 + /// untextured-subset-on-a-shell-only gate, the #188 mid-fade-forces- + /// AlphaBlend promotion, texture resolution, and Campaign VM foliage + /// classification, then builds the surviving batch's . + /// + /// Returns false when the batch does not survive — either the + /// untextured-subset gate rejected it (in which case + /// is always false: ResolveTexture + /// is never called) or its resolved texture slot is unassigned (in which + /// case still reflects whatever + /// ResolveTexture reported — a caller must apply it to its own + /// reusability/readiness tracking regardless of the false return, exactly + /// as both existing callers did before this extraction). + /// + private bool TryClassifyBatch( + ObjectRenderData renderData, + int batchIndex, + in RenderInstanceCandidate entity, + MeshRef meshRef, + PaletteCompositeIdentity paletteIdentity, + float opacityMultiplier, + bool entityHasCutoutSubset, + out GroupKey key, + out bool compositePending) + { + key = default; + compositePending = false; + ObjectRenderBatch batch = renderData.Batches[batchIndex]; + + // #426 — see RetailUntexturedSubsetPolicy for the retail citation. + // ONE shared predicate for every classifier so they cannot drift. + if (!RetailUntexturedSubsetPolicy.Draws(entity.IsBuildingShell, batch.Key.IsSolid)) + return false; + + TranslucencyKind translucency = batch.Translucency; + + // #188: a mid-fade instance whose surface is otherwise Opaque/ClipMap + // must route through the alpha-blend pass so mesh_modern.frag's + // (blend-enabled) shader actually composites the reduced alpha — the + // no-blend opaque pass would ignore it. + if (opacityMultiplier < 1.0f && IsOpaque(translucency)) + translucency = TranslucencyKind.AlphaBlend; + + ResolvedTexture texture = ResolveTexture( + in entity, meshRef, batch, paletteIdentity, out compositePending); + if (!texture.Slot.IsAssigned) + return false; + + // Classify from the RAW (pre-#188-promotion) batch.Translucency — a + // mid-fade trunk is still a trunk, it just landed in the alpha-blend + // group instead of opaque (Campaign VM VM6 review fix round). + uint foliageFlags = FoliageWindClassification.Classify( + entity.LocalEntityId, + FoliageWindExclusions.Contains(meshRef.GfxObjId), + batch.Translucency, + entityHasCutoutSubset); + key = new GroupKey( + batch.FirstIndex, (int)batch.BaseVertex, + batch.IndexCount, texture.Slot, texture.Layer, translucency, + FoliageFlags: foliageFlags, + CullMode: batch.CullMode); + return true; + } + + /// + /// Classifies one static entity for the walk populator: resolves its clip + /// slot / light set / selection lighting exactly as + /// ClassifyPackedEntity does (via the shared + /// / ResolvePackedLightSet + /// helpers), walks its Setup parts or single mesh (mirroring + /// ClassifyPackedEntity's own shape), and appends one + /// per surviving batch to + /// plus one + /// per part to — WITHOUT touching + /// _groups/_packedGroups or publishing selection itself (see + /// this file's type doc comment). + /// + /// A culled entity ( returns + /// Culled: true — not visible through the active clip route) + /// contributes nothing, matching every other classifier's cull gate. + /// + internal void ClassifyEntityForWalk( + in RenderProjectionRecord projection, + uint tupleLandblockId, + List batches, + List selectionParts) + { + ArgumentNullException.ThrowIfNull(batches); + ArgumentNullException.ThrowIfNull(selectionParts); + + RenderInstanceCandidate entity = + RenderInstanceCandidate.FromProjection(in projection, tupleLandblockId); + + (uint slot, bool culled) = ResolveSlotForFrame( + _clipRoutingActive, entity.ServerGuid, entity.ParentCell, + _cellIdToSlot, _outdoorSlot, _outdoorVisible); + if (culled) + return; + + ResolvePackedLightSet(in entity, out InstanceLightSet lights, out bool indoor); + Vector2 selectionLighting = + _selectionLighting?.TryGetLighting( + entity.ServerGuid, entity.LocalEntityId, out RetailSelectionLighting lighting) == true + ? new Vector2(lighting.Luminosity, lighting.Diffuse) + : new Vector2(0f, 1f); + uint detailCategory = entity.IsBuildingShell ? 1u : 0u; + + PaletteCompositeIdentity paletteIdentity = default; + if (entity.PaletteOverride is not null) + paletteIdentity = TextureCache.GetPaletteIdentity(entity.PaletteOverride); + + IReadOnlyList? meshRefs = projection.EntityPayload.MeshRefs; + if (meshRefs is null) + return; + + for (int partIndex = 0; partIndex < meshRefs.Count; partIndex++) + { + MeshRef meshRef = meshRefs[partIndex]; + ObjectRenderData? renderData = _meshAdapter.TryGetRenderData(meshRef.GfxObjId); + if (renderData is null) + continue; + + if (renderData.IsSetup && renderData.SetupParts.Count > 0) + { + // Same entity-scoped OR the classic/packed classifiers compute + // — a Setup composite's parts are separate GfxObjs with their + // own independently cached HasCutoutSubset (Campaign VM VM6 + // review fix round A4/F1). + bool entityHasCutoutSubset = FoliageWindClassification.ComputeEntityHasCutoutSubset( + renderData.SetupParts, + _meshAdapter, + static (adapter, part) => adapter.TryGetRenderData(part.GfxObjId) + is { HasCutoutSubset: true }); + + for (int setupPartIndex = 0; setupPartIndex < renderData.SetupParts.Count; setupPartIndex++) + { + (ulong gfxObjId, Matrix4x4 partTransform) = renderData.SetupParts[setupPartIndex]; + ObjectRenderData? partData = _meshAdapter.TryGetRenderData(gfxObjId); + if (partData is null) + continue; + + Matrix4x4 restPose = partTransform * meshRef.PartTransform; + Matrix4x4 model = restPose * entity.RootWorld; + int selectionPartIndex = unchecked((partIndex << 16) | (setupPartIndex & 0xFFFF)); + + EmitClassifiedBatches( + partData, model, in entity, meshRef, paletteIdentity, + entityHasCutoutSubset, slot, lights, indoor, selectionLighting, + detailCategory, batches); + selectionParts.Add(new WalkClassifiedSelectionPart( + entity.ServerGuid, entity.LocalEntityId, selectionPartIndex, + (uint)gfxObjId, model)); + } + } + else + { + Matrix4x4 model = meshRef.PartTransform * entity.RootWorld; + EmitClassifiedBatches( + renderData, model, in entity, meshRef, paletteIdentity, + entityHasCutoutSubsetOverride: null, slot, lights, indoor, + selectionLighting, detailCategory, batches); + selectionParts.Add(new WalkClassifiedSelectionPart( + entity.ServerGuid, entity.LocalEntityId, partIndex, + (uint)meshRef.GfxObjId, model)); + } + } + } + + /// + /// Walks one resolved mesh's batches through + /// and appends every surviving one to at + /// Alpha = 1f (see this file's type doc comment for why statics + /// never carry a per-part opacity multiplier here). + /// + private void EmitClassifiedBatches( + ObjectRenderData renderData, + Matrix4x4 model, + in RenderInstanceCandidate entity, + MeshRef meshRef, + PaletteCompositeIdentity paletteIdentity, + bool? entityHasCutoutSubsetOverride, + uint slot, + InstanceLightSet lights, + bool indoor, + Vector2 selectionLighting, + uint detailCategory, + List sink) + { + bool entityHasCutoutSubset = entityHasCutoutSubsetOverride ?? renderData.HasCutoutSubset; + for (int batchIdx = 0; batchIdx < renderData.Batches.Count; batchIdx++) + { + bool survives = TryClassifyBatch( + renderData, batchIdx, in entity, meshRef, paletteIdentity, + opacityMultiplier: 1.0f, entityHasCutoutSubset, + out GroupKey key, out _); + if (!survives) + continue; + + sink.Add(new WalkClassifiedBatch( + key, model, slot, lights, indoor ? 1u : 0u, Alpha: 1f, + selectionLighting, detailCategory, IsOpaque: IsOpaque(key.Translucency), + LocalSortCenter: renderData.SortCenter)); + } + } + + /// + /// The thin internal publish seam WalkStaticStreamPopulator + /// calls for every + /// surfaced — same call shape as + /// AddPackedSelectionPart's publishSelection: true branch. + /// Keeps _selectionSink encapsulated: the populator lives outside + /// the dispatcher and must not reach the field directly. + /// + internal void PublishWalkSelectionPart(in WalkClassifiedSelectionPart part) => + _selectionSink?.AddVisiblePart( + part.ServerGuid, part.LocalEntityId, part.PartIndex, part.GfxObjId, part.LocalToWorld); + + /// + /// The walk populator's per-instance sibling of DeferTransparentGroups + /// (see that method for the retail citations this mirrors): submits ONE + /// translucent into the same + /// _deferredAlpha/ machinery the + /// classic material-grouped path uses, so scenery, particles, and walk + /// content share retail's one stable far-to-near stream. Same + /// view-projection consistency check, same + /// call, same + /// queue.Submit contract — the walk path denormalizes to one + /// instance per call instead of flattening a material group. + /// + internal void SubmitWalkAlphaInstance( + in WalkClassifiedBatch batch, + Vector3 cameraWorldPosition, + Matrix4x4 viewProjection) + { + RetailAlphaQueue queue = _alphaQueue + ?? throw new InvalidOperationException( + "SubmitWalkAlphaInstance requires an active RetailAlphaQueue."); + + if (_deferredAlpha.Count == 0) + _deferredAlphaViewProjection = viewProjection; + else if (_deferredAlphaViewProjection != viewProjection) + throw new InvalidOperationException( + "One retail alpha scope cannot combine different view-projection matrices."); + + float viewerDistance = RetailAlphaOrdering.ComputeViewerDistance( + batch.LocalSortCenter, batch.Transform, cameraWorldPosition); + if (!float.IsFinite(viewerDistance) || viewerDistance <= 0f) + viewerDistance = 0f; + + int token = _deferredAlpha.Count; + _deferredAlpha.Add(new DeferredAlphaInstance( + batch.Key, batch.Transform, batch.ClipSlot, batch.Lights, + batch.IndoorFlag, batch.DetailCategory, batch.Alpha, batch.SelectionLighting)); + queue.Submit(_alphaSource, token, viewerDistance); + } +} diff --git a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.cs b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.cs index 3ea377bb..32cbf82f 100644 --- a/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.cs +++ b/src/AcDream.App/Rendering/Wb/WbDrawDispatcher.cs @@ -598,6 +598,12 @@ public sealed partial class WbDrawDispatcher : IDisposable private BatchData[] _batchData = new BatchData[256]; private DrawElementsIndirectCommand[] _indirectCommands = new DrawElementsIndirectCommand[256]; private CullMode[] _drawCullModes = new CullMode[256]; + + // Campaign FW stage FW3.2a: SubmitOrderedStream's OWN cull-mode scratch, + // separate from _drawCullModes above. See DrawIndirectRangeRhi's doc + // comment for why sharing the array made an ordered submission unsafe to + // interleave with a mid-flight RetailAlphaQueue scope. + private CullMode[] _orderedDrawCullModes = new CullMode[256]; private BatchDataPublic[] _batchPublicScratch = new BatchDataPublic[256]; private readonly List _groupInputScratch = new(256); private readonly List _retiredGroupKeys = new(); @@ -3312,62 +3318,25 @@ public sealed partial class WbDrawDispatcher : IDisposable bool allTexturesReady = true; for (int batchIdx = 0; batchIdx < renderData.Batches.Count; batchIdx++) { - var batch = renderData.Batches[batchIdx]; - - // #426: retail's D3DPolyRender::DrawMesh skips an UNTEXTURED - // (solid-colour) subset only on a BUILDING SHELL - // (RenderDeviceD3D::DrawBuilding sets ObjBuildingOrBuildingPart); - // ordinary statics/scenery/creatures/items draw it same as any - // textured subset. ONE shared predicate with ClassifyPackedBatches - // and AddDirectionalShadowBatches — see RetailUntexturedSubsetPolicy. - if (!RetailUntexturedSubsetPolicy.Draws(entity.IsBuildingShell, batch.Key.IsSolid)) - continue; - - TranslucencyKind translucency = batch.Translucency; - - // #188: a mid-fade instance whose surface is otherwise Opaque/ClipMap - // must route through the alpha-blend pass so mesh_modern.frag's - // (blend-enabled) shader actually composites the reduced alpha — - // the no-blend opaque pass would ignore it. - if (opacityMultiplier < 1.0f && IsOpaque(translucency)) - translucency = TranslucencyKind.AlphaBlend; - - ResolvedTexture texture = ResolveTexture( - in entity, - meshRef, - batch, - paletteIdentity, - out bool compositePending); + // Campaign FW stage FW3.2a: the untextured-subset gate, the #188 + // opacity promotion, texture resolution, and Campaign VM foliage + // classification now live in the one shared core + // (WbDrawDispatcher.WalkClassify.cs) also used by + // ClassifyPackedBatches and the walk classifier — see + // TryClassifyBatch's doc comment. `survives=false` still applies + // compositePending exactly as before this extraction (a batch + // that fails the untextured-subset gate never touched + // ResolveTexture, so compositePending is always false there; a + // batch with an unresolved texture slot still reports it). + bool survives = TryClassifyBatch( + renderData, batchIdx, in entity, meshRef, paletteIdentity, + opacityMultiplier, entityHasCutoutSubset, + out GroupKey key, out bool compositePending); if (compositePending) allTexturesReady = false; - // Campaign V slice V4t: an unassigned slot is the "no texture yet" - // case a zero handle used to signal. It is a real sentinel - // (GpuTextureSlot.Unassigned == ACDREAM_TEXTURE_NONE), not the - // default value, so nothing here can silently resolve to slot 0. - if (!texture.Slot.IsAssigned) continue; - GpuTextureSlot texSlot = texture.Slot; - uint texLayer = texture.Layer; - - // Campaign VM VM6 review fix round: classify BEFORE constructing - // the key and fold the result INTO the key (rather than - // stamping it onto whatever group the key already resolves to). - // Classification is from the RAW (pre-#188-promotion) - // batch.Translucency — a mid-fade trunk is still a trunk, it - // just landed in the alpha-blend group instead of opaque. This - // is what keeps a scenery instance and a non-scenery instance - // of the identical mesh subset in two SEPARATE groups instead of - // coalescing into one group whose classification depends on - // whichever entity classified it last. - uint foliageFlags = FoliageWindClassification.Classify( - entity.LocalEntityId, - FoliageWindExclusions.Contains(meshRef.GfxObjId), - batch.Translucency, - entityHasCutoutSubset); - var key = new GroupKey( - batch.FirstIndex, (int)batch.BaseVertex, - batch.IndexCount, texSlot, texLayer, translucency, - FoliageFlags: foliageFlags, - CullMode: batch.CullMode); + if (!survives) + continue; + GpuTextureSlot texSlot = key.TextureSlot; InstanceGroup grp = GetOrCreateInstanceGroup(key); grp.Matrices.Add(model); diff --git a/src/AcDream.App/Rendering/WorldDepthContract.cs b/src/AcDream.App/Rendering/WorldDepthContract.cs new file mode 100644 index 00000000..e0c260be --- /dev/null +++ b/src/AcDream.App/Rendering/WorldDepthContract.cs @@ -0,0 +1,47 @@ +using AcDream.App.Rendering.Gpu; + +namespace AcDream.App.Rendering; + +/// +/// Campaign FW stage FW2: the one depth-compare operator every world-space +/// pipeline uses, named instead of repeated as a literal at each of the +/// world's own pipeline-creation sites. +/// +/// Why , not +/// 's/GpuDepthState's own +/// LessOrEqual convention default: the GL-era world frame ran under +/// GL_LESS and never called glDepthFunc to change it, so every +/// world-space renderer inherited GL_LESS by omission rather than by +/// design. LessOrEqual would flip which of two exactly-coplanar retail +/// surfaces wins the depth test — visible wherever terrain meets a road or a +/// building footing, or wherever two retail-authored polygons share a plane. +/// FW2's decomp verification (plan §FW2, read 2026-08-30) confirms retail's +/// own world raster state is D3DCMP_LESS: the .data default +/// Render::zfuncVal @0x00820e1c is 0x2, and +/// RenderDeviceD3D::SetDepthBufferMode @0x005a2d10 writes that enum +/// value DIRECTLY as D3DRS_ZFUNC (render state 0x17) — the enum IS +/// D3DCMPFUNC, so 0x2 = D3DCMP_LESS. The surface-state applier +/// @0x0059c80a–0x0059c866 applies it to all world geometry with Z-write +/// toggled by blend state (on for opaque, off for blended), exactly this +/// pipeline set's per-variant depthWrite. The DEPTHTEST_LESSEQUAL +/// sites in the decomp are SKY-local (GameSky::Draw @0x00506ff0, drawn +/// at 4× zfar) — never world state. So Less is not merely "what the +/// port happened to inherit" — it is retail's actual world depth-compare +/// operator, now named as a citable contract instead of a bare literal +/// repeated at each call site. +/// +/// Scope: WORLD-SPACE geometry only (terrain, EnvCell shells, entity +/// meshes, particles, portal punches, the directional shadow caster/receiver +/// pair). The two RetailDetail pipelines +/// ('s Equal/LessOrEqual +/// pair, used by the building-detail overlay replay) are a documented +/// exception with their own citation and are untouched by this contract. +/// +internal static class WorldDepthContract +{ + /// Retail's world-space depth-compare operator. See the type + /// doc comment for the full citation; every world pipeline site should + /// reference this constant rather than spelling GpuCompareOp.Less + /// again. + public const GpuCompareOp WorldCompare = GpuCompareOp.Less; +} diff --git a/src/AcDream.App/Streaming/LandblockBuildFactory.cs b/src/AcDream.App/Streaming/LandblockBuildFactory.cs index 5654ebb8..9712df86 100644 --- a/src/AcDream.App/Streaming/LandblockBuildFactory.cs +++ b/src/AcDream.App/Streaming/LandblockBuildFactory.cs @@ -178,6 +178,15 @@ public sealed class LandblockBuildFactory worldOffset, _heightTable)); var envCellBuild = new AcDream.App.Rendering.Wb.EnvCellLandblockBuildBuilder(landblockId); + // Campaign FW3.1: the walk landscape's per-block z-slab + // (CLandBlock::calc_lighting-adjacent unpack @0x0052f1d0). Every + // near-tier landblock has outdoor terrain heights regardless of + // whether it has interior cells or buildings, so this is + // unconditional — unlike WalkBuildings (added below, inside + // BuildInteriorEntitiesForStreaming, where LandBlockInfo is already + // in hand). + (float walkMaxZ, float walkMinZ) = ComputeWalkZSlab(baseLoaded.Heightmap.Height); + envCellBuild.SetWalkZSlab(walkMaxZ, walkMinZ); merged.AddRange(BuildInteriorEntitiesForStreaming( landblockId, lbX, @@ -448,6 +457,17 @@ public sealed class LandblockBuildFactory (lbY - origin.CenterY) * 192f, 0f); + // Campaign FW3.1: the walk's building placements (portals + drawing + // BSP + degrade ladder + sort center), read from the SAME + // LandBlockInfo.Buildings this method already fetched above — no + // extra DAT read. This closes the gap where Wb.BuildingLoader + // .AddBuilding (update thread, no DAT access) keeps only + // ModelId/Frame/portal-flags/stab-lists for its own BFS seeding and + // drops everything the frame walk needs. + envCellBuild.AddWalkBuildings( + AcDream.App.Rendering.Walk.WalkBuildingFactory.Build( + _dats, landblockId, lbInfo.Buildings, lbOffset)); + // Per-landblock id namespace — see AcDream.Core.World.InteriorEntityIdAllocator // for the full bit layout + history. Distinct from scenery (0x80000000+) and // landblock stabs (0xC0000000+, ids from LandblockLoader). @@ -512,21 +532,20 @@ public sealed class LandblockBuildFactory // Static objects inside the cell continue to flow through the dispatcher // as WorldEntity records below — they have real GfxObj MeshRefs that work // fine; EnvCellRenderer receives only the completed shell transaction. - // Transforms — needed by the portal-visibility cell (unlifted) AND the + // Transforms — needed by the portal-visibility cell AND the // render/physics path. Computed for EVERY cell with a valid cellStruct, - // not just drawable ones. Keep the small render lift out of physics; retail - // BSP contact planes use the EnvCell origin verbatim. The lift constant is - // shared with every draw-space consumer of portal polygons (OutsideView - // gate, seal/punch fans) — PortalVisibilityBuilder.ShellDrawLiftZ (#130). + // not just drawable ones. Campaign FW3.3 (2026-08-30): the +0.02 m + // ShellDrawLiftZ render lift is RETIRED (register row AP-32 deleted) — + // retail draws cell geometry at the dat EnvCell origin verbatim, and the + // coplanar tie-breaks the lift stood in for are owned by the walk's + // retail draw order under depth Less. Render and physics now share the + // one verbatim transform. var physicsCellOrigin = envCell.Position.Origin + lbOffset; - var cellOrigin = physicsCellOrigin + new System.Numerics.Vector3( - 0f, 0f, AcDream.App.Rendering.PortalVisibilityBuilder.ShellDrawLiftZ); + var cellOrigin = physicsCellOrigin; var cellTransform = System.Numerics.Matrix4x4.CreateFromQuaternion(envCell.Position.Orientation) * System.Numerics.Matrix4x4.CreateTranslation(cellOrigin); - var physicsCellTransform = - System.Numerics.Matrix4x4.CreateFromQuaternion(envCell.Position.Orientation) * - System.Numerics.Matrix4x4.CreateTranslation(physicsCellOrigin); + var physicsCellTransform = cellTransform; // PORTAL VISIBILITY: register EVERY cell with a valid cellStruct, regardless // of whether CellMesh.Build produced drawable sub-meshes. A portals-only @@ -649,6 +668,24 @@ public sealed class LandblockBuildFactory } + /// Campaign FW3.1: retail's per-block z-slab + /// (WalkLandscapeDatBuilder's port target — + /// CLandBlock::calc_lighting-adjacent unpack @0x0052f1d0): + /// max_zval = heightTable[maxByte] + 200, + /// min_zval = heightTable[minByte] - 1, over the landblock's own + /// 81-byte heightmap. Uses — already a + /// constructor field, so this needs no additional DAT read. + private (float MaxZ, float MinZ) ComputeWalkZSlab(byte[] heights) + { + byte maxByte = 0, minByte = 255; + foreach (byte h in heights) + { + if (h > maxByte) maxByte = h; + if (h < minByte) minByte = h; + } + return (_heightTable[maxByte] + 200f, _heightTable[minByte] - 1f); + } + private static float SampleTerrainZ(DatReaderWriter.DBObjs.LandBlock block, float[] heightTable, float localX, float localY) { uint landblockX = (block.Id >> 24) & 0xFFu; diff --git a/src/AcDream.App/Streaming/LandblockPresentationPipeline.cs b/src/AcDream.App/Streaming/LandblockPresentationPipeline.cs index ab09145f..b0e13f41 100644 --- a/src/AcDream.App/Streaming/LandblockPresentationPipeline.cs +++ b/src/AcDream.App/Streaming/LandblockPresentationPipeline.cs @@ -76,6 +76,11 @@ public sealed class LandblockPresentationPipeline private readonly Action? _publishBeforeSpatialCommit; private readonly LandblockRenderPublisher? _renderPublisher; + + /// Campaign FW3.2b-2: the render publisher, exposed so the + /// frame composition can hand its walk world-data registries + /// (WalkBuildings/WalkLandscape) to the PView renderer. + internal LandblockRenderPublisher? RenderPublisher => _renderPublisher; private readonly LandblockPhysicsPublisher? _physicsPublisher; private readonly LandblockStaticPresentationPublisher? _staticPublisher; private readonly GpuWorldState _state; diff --git a/src/AcDream.App/Streaming/LandblockRenderPublisher.cs b/src/AcDream.App/Streaming/LandblockRenderPublisher.cs index 5578bc1a..8b5ff5c0 100644 --- a/src/AcDream.App/Streaming/LandblockRenderPublisher.cs +++ b/src/AcDream.App/Streaming/LandblockRenderPublisher.cs @@ -3,6 +3,7 @@ using System.Diagnostics; using System.Numerics; using AcDream.App.Rendering; using AcDream.App.Rendering.Wb; +using AcDream.App.Rendering.Walk; using AcDream.Core.Terrain; namespace AcDream.App.Streaming; @@ -102,6 +103,17 @@ public sealed class LandblockRenderPublisher private readonly Action? _prepareEnvCells; private readonly Action? _removeEnvCells; private readonly Dictionary _buildingRegistries = new(); + // Campaign FW3.1: the walk's production world-data siblings of + // _buildingRegistries. Owned here (not injected) exactly like + // _buildingRegistries — no caller constructs a LandblockRenderPublisher + // with pre-existing walk state. Committed/retired at the same points as + // the building registry (see AdvanceCompleteOne / RemoveBuildingRegistry + // below) because both come from the same landblock's BuildingInfo array + // at the same commit. No frame reads these yet (FW3.2 wires the walk + // into the render loop) — publication happens now so FW3.1's + // conformance gate exercises the production commit path. + private readonly WalkBuildingRegistry _walkBuildingRegistry = new(); + private readonly WalkLandscapeAssembler _walkLandscape = new(); private long _beginCount; private long _completeCount; @@ -148,6 +160,15 @@ public sealed class LandblockRenderPublisher public IReadOnlyCollection BuildingRegistries => _buildingRegistries.Values; + /// Campaign FW3.1: the walk's production building placements, + /// keyed by landblock, committed alongside . + public WalkBuildingRegistry WalkBuildings => _walkBuildingRegistry; + + /// Campaign FW3.1: the walk's production viewer-centred + /// landscape grid, fed from the same landblock commits as + /// . + public WalkLandscapeAssembler WalkLandscape => _walkLandscape; + public LandblockRenderPublisherDiagnostics Diagnostics => new( _beginCount, _completeCount, @@ -339,6 +360,21 @@ public sealed class LandblockRenderPublisher _buildingRegistries[registryKey] = completedBuildings.Registry; } + // Campaign FW3.1: publish this landblock's walk world data in + // the same step — build.EnvCells carries WalkBuildings/WalkMaxZ + // /WalkMinZ (computed worker-side by LandblockBuildFactory) for + // every near-tier build, even one with zero interior cells + // (the z-slab is unconditional; WalkBuildings is naturally empty + // when LandBlockInfo has none). + if (build.EnvCells is { } walkEnvCells) + { + _walkBuildingRegistry.Publish(landblockId, walkEnvCells.WalkBuildings); + _walkLandscape.PublishLandblock( + landblockId, + walkEnvCells.WalkMaxZ, + walkEnvCells.WalkMinZ, + walkEnvCells.WalkBuildings); + } publication.BuildingRegistryCommitted = true; } else if (publication.EnvCellPublication is { } envCellPublication @@ -397,6 +433,14 @@ public sealed class LandblockRenderPublisher public void RemoveBuildingRegistry(uint landblockId) { _buildingRegistries.Remove(landblockId & 0xFFFF0000u); + // Campaign FW3.1: retire the walk's siblings at the SAME retirement + // stage — they were committed together above, so they retire + // together (no new LandblockRetirementStage; folding into the + // existing BuildingRegistry stage keeps the retirement ticket state + // machine unchanged, which is the minimal/additive choice for a + // slice that does no frame wiring yet). + _walkBuildingRegistry.Retire(landblockId); + _walkLandscape.RetireLandblock(landblockId); _buildingRegistryRemovalCount++; } diff --git a/src/AcDream.Core/Rendering/RenderingDiagnostics.cs b/src/AcDream.Core/Rendering/RenderingDiagnostics.cs index 634627f4..49c846a3 100644 --- a/src/AcDream.Core/Rendering/RenderingDiagnostics.cs +++ b/src/AcDream.Core/Rendering/RenderingDiagnostics.cs @@ -160,6 +160,43 @@ public static class RenderingDiagnostics public static bool ProbeClipRouteEnabled { get; set; } = Environment.GetEnvironmentVariable("ACDREAM_PROBE_CLIPROUTE") == "1"; + /// + /// Campaign FW3.2b-2 flip apparatus (2026-08-30): when true and the walk + /// registries are wired, RetailPViewRenderer runs the PRODUCTION retail + /// frame walk per frame in SHADOW (no draws change) and emits one + /// [walk-shadow] line per frame whose cell/building sets diverge from the + /// old visibility path — the I5 dual-shadow pattern applied to the FW3 + /// static cutover. Throwaway apparatus — dies with the flip commit. + /// + public static bool ProbeWalkShadowEnabled { get; set; } = + Environment.GetEnvironmentVariable("ACDREAM_PROBE_WALK_SHADOW") == "1"; + + /// + /// FW3 visual-gate apparatus (2026-08-30, throwaway — dies with the + /// stairwell-transition fix): when true, RetailPViewRenderer prints one + /// [walk-root] line per frame for the 8 frames after every + /// interior/outdoor ROOT flip — viewer cell, resolution, slice count, + /// and the walk's visited cell list — pinning which frames draw grass + /// over floor openings during a doorway crossing and why. + /// + public static bool ProbeWalkRootEnabled { get; set; } = + Environment.GetEnvironmentVariable("ACDREAM_PROBE_WALK_ROOT") == "1"; + + /// Companion scratch for + /// (throwaway, same investigation): the frame phase relative to the + /// interior depth clear ("pre"/"post"), stamped by the pass executor so + /// particle/alpha probe lines can tag WHEN a submission or drain ran. + /// Written only while the probe is on. + public static string WalkRootPhase = ""; + + /// Companion scratch for + /// (throwaway, same investigation): true on the frames (~every 90th) + /// where the walk's PView logs its per-portal seen/in-view/clip + /// decisions as [walk-portal] lines — pins WHY an exit view + /// collapses at a given camera pose. Set by the renderer before + /// Collect; read by WalkPView. + public static bool WalkPortalProbeThisFrame; + /// /// Bounded-propagation port apparatus (2026-06-08). When true, PortalVisibilityBuilder.Build emits /// one [portal-churn] summary line per call: per-cell pop count (re-pops = churn), total re-enqueues, diff --git a/src/AcDream.Core/Vfx/ParticleSystem.cs b/src/AcDream.Core/Vfx/ParticleSystem.cs index 818587e6..07a17a30 100644 --- a/src/AcDream.Core/Vfx/ParticleSystem.cs +++ b/src/AcDream.Core/Vfx/ParticleSystem.cs @@ -321,6 +321,9 @@ public sealed class ParticleSystem : IParticleSystem rangeMultiplier = 1f; LastRetailViewEmitterVisitCount = 0; + _probeAdmissionDumpThisCall = + AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled + && ++_probeAdmissionCallCounter % 120 == 0; foreach (int handle in _worldSimulationHandles) { if (!_byHandle.TryGetValue(handle, out ParticleEmitter? emitter)) @@ -346,9 +349,33 @@ public sealed class ParticleSystem : IParticleSystem || float.IsNaN(maxDistance) || distance <= maxDistance); RefreshRenderableIndex(emitter, wasRenderable); + + // ACDREAM_PROBE_WALK_ROOT companion (Phase I cathedral + // instrumentation, throwaway): admission verdicts for the F418 + // watch set — the real falls owners 0xCF418000-13 and every + // F418-cell emitter — every ~120th ApplyRetailView pass. + if (_probeAdmissionDumpThisCall + && AcDream.Core.Rendering.RenderingDiagnostics.ProbeWalkRootEnabled + && ((emitter.AttachedObjectId >= 0xCF418000u + && emitter.AttachedObjectId <= 0xCF418014u) + || (emitter.OwnerCellId >> 16) == 0xF418u)) + { + Console.WriteLine( + $"[falls-adm] owner={emitter.AttachedObjectId:x} " + + $"cell={emitter.OwnerCellId:x8} " + + $"pos=({emitter.OwnerPosition.X:F1},{emitter.OwnerPosition.Y:F1},{emitter.OwnerPosition.Z:F1}) " + + $"dist={distance:F1} max={maxDistance:F1} " + + $"inSet={(visibleCellIds.Contains(emitter.OwnerCellId) ? 1 : 0)} " + + $"eligible={(emitter.ViewEligible ? 1 : 0)} " + + $"active={emitter.ActiveCount} pass={emitter.RenderPass}"); + } } } + // Phase I instrumentation rate limiter (see the probe block above). + private static uint _probeAdmissionCallCounter; + private static bool _probeAdmissionDumpThisCall; + /// /// Changes only render presentation. Logical lifetime is unaffected. /// diff --git a/tests/AcDream.App.Tests/Rendering/Issue130DoorwayStripTests.cs b/tests/AcDream.App.Tests/Rendering/Issue130DoorwayStripTests.cs index e606e75c..22c32fc3 100644 --- a/tests/AcDream.App.Tests/Rendering/Issue130DoorwayStripTests.cs +++ b/tests/AcDream.App.Tests/Rendering/Issue130DoorwayStripTests.cs @@ -57,7 +57,7 @@ public class Issue130DoorwayStripTests } [Fact] - public void ExitDoorTopEdge_GateCoversLiftedApertureWithinPixelTolerance() + public void ExitDoorTopEdge_GateCoversTheDrawnApertureWithinPixelTolerance() { var datDir = CornerFloodReplayTests.ResolveDatDir(); if (datDir is null) { _out.WriteLine("SKIP: dats unavailable"); Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory; see docs/release-gate.md."); } @@ -78,16 +78,15 @@ public class Issue130DoorwayStripTests Assert.True(exitIdx >= 0, "0x0170 has no exit portal polygon"); var localPoly = root.PortalPolygons[exitIdx]; - // DRAWN space: the shell that rasterizes the aperture (and the seal fan) - // draws +ShellDrawLiftZ above the physics transform — the gate must be - // compared against the drawn hole, not the physics polygon (#130: the - // unlifted gate left a 2 cm background strip under the drawn lintel). + // Campaign FW3.3: ShellDrawLiftZ is retired — shells, seal fans, and + // the gate all live in the ONE dat space, so the drawn aperture IS + // the physics polygon. This test survives as the coverage proof + // (gate covers the drawn hole within tolerance across the sweep); + // the historical lifted-vs-unlifted strip test's premise (two + // spaces) no longer exists and that test is deleted. var worldPoly = new Vector3[localPoly.Length]; for (int i = 0; i < localPoly.Length; i++) - { worldPoly[i] = Vector3.Transform(localPoly[i], root.WorldTransform); - worldPoly[i].Z += PortalVisibilityBuilder.ShellDrawLiftZ; - } Vector3 centroid = Vector3.Zero; foreach (var w in worldPoly) centroid += w; @@ -146,7 +145,7 @@ public class Issue130DoorwayStripTests aperture[i] = new Vector2(clip[i].X / clip[i].W, clip[i].Y / clip[i].W); var pv = PortalVisibilityBuilder.Build(root, eye, Lookup, viewProj, - buildingMembership: null, drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); var asm = ClipFrameAssembler.Assemble(ClipFrame.NoClip(), pv); if (asm.OutsideViewSlices.Length == 0) { @@ -203,103 +202,6 @@ public class Issue130DoorwayStripTests $"plane gate under-covers the aperture top edge by {worstPlaneGapPx:F2}px @ {worstDesc}")); } - /// Sensitivity proof + regression documentation: a gate built in - /// PHYSICS space (drawLiftZ 0) against the DRAWN (lifted) aperture shows a - /// multi-pixel strip at a close doorway — the user-visible #130 strip - /// (f35cb8b split the lift out of the visibility transform; the OutsideView - /// kept gating drawn color in unlifted space). If this stops failing-by-gap, - /// the lift is gone and the production drawLiftZ plumbing can go too. - [Fact] - public void UnliftedGate_LeavesTheStripAtTheDrawnTopEdge() - { - var datDir = CornerFloodReplayTests.ResolveDatDir(); - if (datDir is null) { _out.WriteLine("SKIP: dats unavailable"); Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory; see docs/release-gate.md."); } - - using var dats = new DatCollection(datDir, DatAccessType.Read); - var cells = CornerFloodReplayTests.LoadBuilding(dats); - var root = cells[ExitCellId]; - LoadedCell? Lookup(uint id) => cells.TryGetValue(id, out var c) ? c : null; - - int exitIdx = -1; - for (int i = 0; i < root.Portals.Count; i++) - { - if (root.Portals[i].OtherCellId == 0xFFFF && i < root.PortalPolygons.Count - && root.PortalPolygons[i].Length >= 3) - { exitIdx = i; break; } - } - Assert.True(exitIdx >= 0); - - var localPoly = root.PortalPolygons[exitIdx]; - var worldPoly = new Vector3[localPoly.Length]; - Vector3 centroid = Vector3.Zero; - for (int i = 0; i < localPoly.Length; i++) - { - worldPoly[i] = Vector3.Transform(localPoly[i], root.WorldTransform); - worldPoly[i].Z += PortalVisibilityBuilder.ShellDrawLiftZ; // drawn space - centroid += worldPoly[i]; - } - centroid /= worldPoly.Length; - - var plane = root.ClipPlanes[exitIdx]; - var worldNormal = Vector3.TransformNormal(plane.Normal, root.WorldTransform); - var cellCenterWorld = Vector3.Transform( - (root.LocalBoundsMin + root.LocalBoundsMax) * 0.5f, root.WorldTransform); - if (Vector3.Dot(worldNormal, cellCenterWorld - centroid) < 0) - worldNormal = -worldNormal; - worldNormal = Vector3.Normalize(worldNormal); - - // d=2.4 m, eye low (0.9 m above the opening's base), gaze at the - // centroid — the main sweep's clean case, where the aperture top edge - // projects ON SCREEN (y≈0.79; a closer/higher eye pushes the lintel - // past the screen top and the seam becomes unmeasurable). - var eye = centroid + worldNormal * 2.4f; - eye.Z = centroid.Z - 1.0f + 0.9f; - var viewProj = ViewProjFor(eye, centroid); - - var clip = new Vector4[worldPoly.Length]; - for (int i = 0; i < worldPoly.Length; i++) - clip[i] = Vector4.Transform(new Vector4(worldPoly[i], 1f), viewProj); - var aperture = new Vector2[clip.Length]; - for (int i = 0; i < clip.Length; i++) - aperture[i] = new Vector2(clip[i].X / clip[i].W, clip[i].Y / clip[i].W); - - var pvUnlifted = PortalVisibilityBuilder.Build(root, eye, Lookup, viewProj); // drawLiftZ 0 - var asmUnlifted = ClipFrameAssembler.Assemble(ClipFrame.NoClip(), pvUnlifted); - Assert.True(asmUnlifted.OutsideViewSlices.Length > 0); - (float unliftedGapPx, _, _) = MeasureTopEdgeGap(aperture, asmUnlifted.OutsideViewSlices, 1920, 1080); - - var pvLifted = PortalVisibilityBuilder.Build(root, eye, Lookup, viewProj, - buildingMembership: null, drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); - var asmLifted = ClipFrameAssembler.Assemble(ClipFrame.NoClip(), pvLifted); - Assert.True(asmLifted.OutsideViewSlices.Length > 0); - (float liftedGapPx, _, _) = MeasureTopEdgeGap(aperture, asmLifted.OutsideViewSlices, 1920, 1080); - - _out.WriteLine(FormattableString.Invariant( - $"top-edge gap vs the DRAWN aperture at d=2.4 m: unliftedGate={unliftedGapPx:F2}px liftedGate={liftedGapPx:F2}px")); - var dbg = new System.Text.StringBuilder(" aperture(LIFTED):"); - foreach (var v in aperture) dbg.Append(FormattableString.Invariant($" ({v.X:F4},{v.Y:F4})")); - _out.WriteLine(dbg.ToString()); - foreach (var poly in pvUnlifted.OutsideView.Polygons) - { - var sb = new System.Text.StringBuilder(" unliftedGatePoly:"); - foreach (var v in poly.Vertices) sb.Append(FormattableString.Invariant($" ({v.X:F4},{v.Y:F4})")); - _out.WriteLine(sb.ToString()); - } - foreach (var poly in pvLifted.OutsideView.Polygons) - { - var sb = new System.Text.StringBuilder(" liftedGatePoly:"); - foreach (var v in poly.Vertices) sb.Append(FormattableString.Invariant($" ({v.X:F4},{v.Y:F4})")); - _out.WriteLine(sb.ToString()); - } - - // The strip the user saw: physics-space gate vs drawn hole, several px. - Assert.True(unliftedGapPx > 2.0f, FormattableString.Invariant( - $"expected the unlifted gate to show the strip (>2px), got {unliftedGapPx:F2}px")); - // The fix: a gate in drawn space covers the drawn hole. - Assert.True(liftedGapPx <= 1.2f, FormattableString.Invariant( - $"lifted gate still under-covers by {liftedGapPx:F2}px")); - } - private static string DescribePolys(CellView view) { var parts = new List(); diff --git a/tests/AcDream.App.Tests/Rendering/Issue131SetupProbeTests.cs b/tests/AcDream.App.Tests/Rendering/Issue131SetupProbeTests.cs index 6a544e6d..12012f04 100644 --- a/tests/AcDream.App.Tests/Rendering/Issue131SetupProbeTests.cs +++ b/tests/AcDream.App.Tests/Rendering/Issue131SetupProbeTests.cs @@ -48,8 +48,7 @@ public class Issue131SetupProbeTests var root = cells[0xA9B40171u]; var pv = AcDream.App.Rendering.PortalVisibilityBuilder.Build( root, eye, Lookup, viewProj, - buildingMembership: null, - drawLiftZ: AcDream.App.Rendering.PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); _out.WriteLine(FormattableString.Invariant( $"main flood={pv.OrderedVisibleCells.Count} outPolys={pv.OutsideView.Polygons.Count}")); diff --git a/tests/AcDream.App.Tests/Rendering/Issue176177FacilityHubFloodReplayTests.cs b/tests/AcDream.App.Tests/Rendering/Issue176177FacilityHubFloodReplayTests.cs index 573ec736..3412fc32 100644 --- a/tests/AcDream.App.Tests/Rendering/Issue176177FacilityHubFloodReplayTests.cs +++ b/tests/AcDream.App.Tests/Rendering/Issue176177FacilityHubFloodReplayTests.cs @@ -19,7 +19,7 @@ namespace AcDream.App.Tests.Rendering; /// where its geometry was; stair cells failing admission = the pop). /// /// Production-matched inputs: Build(root, eye, lookup, viewProj, -/// buildingMembership: null, drawLiftZ: ShellDrawLiftZ) — the drawLiftZ +/// buildingMembership: null) — the production call shape (FW3.3 retired drawLiftZ) /// mirrors RetailPViewRenderer.DrawInside. /// /// Scenarios: @@ -54,8 +54,7 @@ public class Issue176177FacilityHubFloodReplayTests Func lookup = id => cells.TryGetValue(id, out var c) ? c : null; var frame = PortalVisibilityBuilder.Build( cells[rootId], eye, lookup, ViewProjFor(eye, gazeDir), - buildingMembership: null, - drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); var result = new List(frame.OrderedVisibleCells); result.Sort(); return result; diff --git a/tests/AcDream.App.Tests/Rendering/Issue177StairDescentCameraFloodTests.cs b/tests/AcDream.App.Tests/Rendering/Issue177StairDescentCameraFloodTests.cs index 6262ee7f..32435cbd 100644 --- a/tests/AcDream.App.Tests/Rendering/Issue177StairDescentCameraFloodTests.cs +++ b/tests/AcDream.App.Tests/Rendering/Issue177StairDescentCameraFloodTests.cs @@ -207,7 +207,7 @@ public class Issue177StairDescentCameraFloodTests string admit = "?"; if (viewer != 0u && renderCells.TryGetValue(viewer, out var rc)) { - var f = PortalVisibilityBuilder.Build(rc, eye, lookup, cam.View * cam.Projection, null, PortalVisibilityBuilder.ShellDrawLiftZ); + var f = PortalVisibilityBuilder.Build(rc, eye, lookup, cam.View * cam.Projection, null); var s = f.OrderedVisibleCells; admit = string.Concat(stair.Select(low => (s.Contains(FacilityHub | low) ? "1" : "0"))); } @@ -259,7 +259,7 @@ public class Issue177StairDescentCameraFloodTests for (int i = 0; i < 140; i++) cam.Update(playerPos, yaw, Vector3.Zero, true, Vector3.UnitZ, 1f / 60f, pcell, 0x5000000A); uint viewer = cam.ViewerCellId; if (viewer == 0u || !renderCells.TryGetValue(viewer, out var rc)) continue; - var f = PortalVisibilityBuilder.Build(rc, cam.Position, lookup, cam.View * cam.Projection, null, PortalVisibilityBuilder.ShellDrawLiftZ); + var f = PortalVisibilityBuilder.Build(rc, cam.Position, lookup, cam.View * cam.Projection, null); int c = f.OrderedVisibleCells.Count; sum += c; n++; if (c > maxCells) { maxCells = c; bestViewer = viewer; bestSet = CellSet(f.OrderedVisibleCells.OrderBy(v => v)); } } @@ -326,7 +326,7 @@ public class Issue177StairDescentCameraFloodTests float d = PortalPlaneDistance(root, upIdx, eye); var frame = PortalVisibilityBuilder.Build( root, eye, lookup, ViewProj(eye, gaze), - buildingMembership: null, drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); var vis = frame.OrderedVisibleCells.OrderBy(v => v).ToList(); bool up = vis.Contains(upperId); string admit = up ? "ADMITTED" : "DROPPED"; @@ -339,8 +339,8 @@ public class Issue177StairDescentCameraFloodTests // spiral, root 0x01C8, portals off-screen/sliver, camera NOT collision-jammed). // Kept as a mechanism pin: an eye exactly in the ceiling-portal plane drops the upper // cell (edge-on → <3 clip), an eye 0.4 m off admits it via the normal clip. - var fEdge = PortalVisibilityBuilder.Build(root, eyeEdgeOn, lookup, ViewProj(eyeEdgeOn, gaze), null, PortalVisibilityBuilder.ShellDrawLiftZ); - var fOff = PortalVisibilityBuilder.Build(root, eyeOffPlane, lookup, ViewProj(eyeOffPlane, gaze), null, PortalVisibilityBuilder.ShellDrawLiftZ); + var fEdge = PortalVisibilityBuilder.Build(root, eyeEdgeOn, lookup, ViewProj(eyeEdgeOn, gaze), null); + var fOff = PortalVisibilityBuilder.Build(root, eyeOffPlane, lookup, ViewProj(eyeOffPlane, gaze), null); Assert.DoesNotContain(upperId, fEdge.OrderedVisibleCells); // edge-on drops (mechanism) Assert.Contains(upperId, fOff.OrderedVisibleCells); // off-plane admits (control) } @@ -438,7 +438,7 @@ public class Issue177StairDescentCameraFloodTests var vp = cam.View * cam.Projection; if (viewer != 0u && renderCells.TryGetValue(viewer, out var rootCell)) { - var f = PortalVisibilityBuilder.Build(rootCell, eye, lookup, vp, null, PortalVisibilityBuilder.ShellDrawLiftZ); + var f = PortalVisibilityBuilder.Build(rootCell, eye, lookup, vp, null); var vis = f.OrderedVisibleCells.OrderBy(v => v).ToList(); string flags = $"0178={(vis.Contains(FacilityHub | 0x0178u) ? "Y" : "-")} 0182={(vis.Contains(FacilityHub | 0x0182u) ? "Y" : "-")} 0183={(vis.Contains(FacilityHub | 0x0183u) ? "Y" : "-")} 0181={(vis.Contains(FacilityHub | 0x0181u) ? "Y" : "-")}"; _out.WriteLine(FormattableString.Invariant( @@ -519,7 +519,7 @@ public class Issue177StairDescentCameraFloodTests { var frame = PortalVisibilityBuilder.Build( rootCell, eye, lookup, viewProj, - buildingMembership: null, drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); var vis = frame.OrderedVisibleCells.OrderBy(v => v).ToList(); floodStr = $"{vis.Count,2} [{CellSet(vis)}]"; bool ramp = vis.Contains(FacilityHub | 0x0182u); diff --git a/tests/AcDream.App.Tests/Rendering/Issue181VisFlapReplayTests.cs b/tests/AcDream.App.Tests/Rendering/Issue181VisFlapReplayTests.cs index dc0a69dd..13f4c827 100644 --- a/tests/AcDream.App.Tests/Rendering/Issue181VisFlapReplayTests.cs +++ b/tests/AcDream.App.Tests/Rendering/Issue181VisFlapReplayTests.cs @@ -46,8 +46,7 @@ public class Issue181VisFlapReplayTests Func lookup = id => cells.TryGetValue(id, out var c) ? c : null; var frame = PortalVisibilityBuilder.Build( cells[rootId], eye, lookup, ViewProjFor(eye, gazeDir), - buildingMembership: null, - drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); var result = new List(frame.OrderedVisibleCells); result.Sort(); return result; @@ -88,8 +87,7 @@ public class Issue181VisFlapReplayTests { var frame = PortalVisibilityBuilder.Build( cells[LiveRoot], eye, lookup, ViewProjFor(eye, gaze), - buildingMembership: null, - drawLiftZ: PortalVisibilityBuilder.ShellDrawLiftZ); + buildingMembership: null); if (!frame.CellViews.TryGetValue(flapper, out var view) || view.IsEmpty) { diff --git a/tests/AcDream.App.Tests/Rendering/RenderScenePViewFrameProductTests.cs b/tests/AcDream.App.Tests/Rendering/RenderScenePViewFrameProductTests.cs index b8d560ba..eba4ea90 100644 --- a/tests/AcDream.App.Tests/Rendering/RenderScenePViewFrameProductTests.cs +++ b/tests/AcDream.App.Tests/Rendering/RenderScenePViewFrameProductTests.cs @@ -14,326 +14,33 @@ public sealed class RenderScenePViewFrameProductTests private static readonly RenderSceneGeneration Generation = RenderSceneGeneration.FromRaw(1); - [Fact] - public void Builder_PreservesPViewRoutesAndExcludesShellsAndWithdrawnOwners() - { - using var scene = new ArchRenderScene(Generation); - RenderProjectionRecord outdoor = Record( - 0x0100_0000_0000_0001, - RenderProjectionClass.OutdoorStatic); - RenderProjectionRecord buildingShell = Record( - 0x0100_0000_0000_0008, - RenderProjectionClass.OutdoorStatic, - isBuildingShell: true); - RenderProjectionRecord hidden = Record( - 0x0100_0000_0000_0002, - RenderProjectionClass.OutdoorStatic, - flags: RenderProjectionFlags.Hidden - | RenderProjectionFlags.SpatiallyResident); - RenderProjectionRecord withdrawn = Record( - 0x0100_0000_0000_0003, - RenderProjectionClass.OutdoorStatic, - flags: RenderProjectionFlags.Draw); - RenderProjectionRecord shell = Record( - 0x0200_0000_0000_0004, - RenderProjectionClass.IndoorCellStatic, - parentCell: Cell); - RenderProjectionRecord cellStatic = Record( - 0x0100_0000_0000_0005, - RenderProjectionClass.IndoorCellStatic, - parentCell: Cell); - RenderProjectionRecord outdoorDynamic = Record( - 0x0300_0000_0000_0006, - RenderProjectionClass.LiveDynamicRoot); - RenderProjectionRecord cellDynamic = Record( - 0x0300_0000_0000_0007, - RenderProjectionClass.LiveDynamicRoot, - parentCell: Cell); - RenderProjectionRecord[] records = - [ - outdoor, - buildingShell, - hidden, - withdrawn, - shell, - cellStatic, - outdoorDynamic, - cellDynamic, - ]; - var deltas = new RenderProjectionDelta[records.Length]; - for (int index = 0; index < records.Length; index++) - { - deltas[index] = RenderProjectionDelta.Register( - Generation, - (ulong)index + 1, - records[index]); - } - scene.Apply(deltas); - - PortalVisibilityFrame portal = Portal(Cell); - ClipFrameAssembly clip = FullScreenClip(Cell); - ViewconeCuller viewcone = - ViewconeCuller.Build(clip, Matrix4x4.Identity); - var exchange = new RenderFrameExchange(); - var builder = new RenderScenePViewFrameBuilder(); - RenderSceneDigest digest = - scene.BuildDigest(new RenderSceneDigestBuffer()); - var input = new RenderScenePViewBuildInput( - scene.OpenQuery(), - digest, - portal, - clip, - viewcone, - [], - [Cell], - EmptyCellSource.Instance, - [], - RootIsOutdoor: true); - - builder.Build(exchange, frameSequence: 1, in input); - RenderFrameView view = exchange.BorrowLatest(Generation, 1); - try - { - Assert.Equal( - [outdoor.Id, hidden.Id, buildingShell.Id], - view.OutdoorStaticCandidates.ToArray() - .Select(static item => item.Id)); - Assert.Equal( - [cellStatic.Id], - view.CellStaticCandidates.ToArray() - .Select(static item => item.Id)); - Assert.Equal( - [outdoorDynamic.Id, cellDynamic.Id], - view.DynamicCandidates.ToArray() - .Select(static item => item.Id)); - Assert.Equal(6, view.Transforms.Length); - Assert.Equal(6, view.RouteCandidates.Length); - Assert.Equal(3, view.RouteRanges.Length); - RenderFrameCandidateRange outdoorRange = Assert.Single( - view.RouteRanges.ToArray(), - range => range.Route - == RenderFrameCandidateRoute.LandscapeOutdoorStatic); - Assert.Equal(3, outdoorRange.Count); - Assert.Contains( - view.RouteCandidates.Slice( - outdoorRange.Offset, - outdoorRange.Count).ToArray(), - item => item.Id == buildingShell.Id); - Assert.DoesNotContain( - view.RouteRanges.ToArray(), - range => range.Route - == RenderFrameCandidateRoute.LandscapeBuildingShell); - Assert.DoesNotContain( - view.RouteCandidates.ToArray(), - item => item.Id == withdrawn.Id || item.Id == shell.Id); - Assert.Equal( - new RenderFrameDiagnosticCounts( - OutdoorStaticCandidates: 3, - CellStaticCandidates: 1, - DynamicCandidates: 2, - TransformCount: 6, - OpaqueClassificationCount: 0, - AlphaClassificationCount: 0, - LightSetCount: 0, - SelectionPartCount: 0, - RouteCandidateCount: 6, - EntityCandidateCount: 6, - MeshPartCount: 6), - view.DiagnosticCounts); - Assert.Equal(6, view.EntityCandidates.Length); - Assert.Equal(6, view.MeshParts.Length); - Assert.Same(portal, view.PortalFrame); - Assert.Same(clip, view.ClipAssembly); - Assert.Equal(digest, view.SourceDigest); - } - finally - { - exchange.Release(in view); - } - } - - [Fact] - public void Builder_OrdersMultiSliceBuildingShellsAfterLookIns() - { - using var scene = new ArchRenderScene(Generation); - RenderProjectionRecord outdoor = Record( - 0x0100_0000_0000_0101, - RenderProjectionClass.OutdoorStatic); - RenderProjectionRecord buildingShell = Record( - 0x0100_0000_0000_0102, - RenderProjectionClass.OutdoorStatic, - isBuildingShell: true, - buildingShellAnchorCellId: Cell); - RenderProjectionRecord lookInObject = Record( - 0x0100_0000_0000_0103, - RenderProjectionClass.IndoorCellStatic, - parentCell: Cell); - scene.Apply( - [ - RenderProjectionDelta.Register(Generation, 1, outdoor), - RenderProjectionDelta.Register(Generation, 2, buildingShell), - RenderProjectionDelta.Register(Generation, 3, lookInObject), - ]); - - PortalVisibilityFrame portal = Portal(Cell); - PortalVisibilityFrame lookIn = Portal(Cell); - lookIn.SourceBuildingKey = 2u; - lookIn.SourceBuildingLandblockId = Cell & 0xFFFF0000u; - var anchorCell = new LoadedCell - { - CellId = Cell, - BuildingId = 2u, - }; - ClipFrameAssembly clip = TwoSliceClip(Cell); - clip.LookInCellToViewSlices[new LookInClipCell(0, Cell)] = - [clip.CellIdToViewSlices[Cell][0]]; - ViewconeCuller viewcone = - ViewconeCuller.Build(clip, Matrix4x4.Identity); - var exchange = new RenderFrameExchange(); - var builder = new RenderScenePViewFrameBuilder(); - RenderSceneDigest digest = - scene.BuildDigest(new RenderSceneDigestBuffer()); - var input = new RenderScenePViewBuildInput( - scene.OpenQuery(), - digest, - portal, - clip, - viewcone, - [lookIn], - [Cell], - new DictionaryCellSource(anchorCell), - [], - RootIsOutdoor: true); - - builder.Build(exchange, frameSequence: 1, in input); - RenderFrameView view = exchange.BorrowLatest(Generation, 1); - try - { - Assert.Equal( - [ - (RenderFrameCandidateRoute.LandscapeOutdoorStatic, 0, 0u), - (RenderFrameCandidateRoute.LandscapeOutdoorStatic, 1, 0u), - (RenderFrameCandidateRoute.LookInObject, 0, Cell), - (RenderFrameCandidateRoute.LandscapeBuildingShell, 0, 0u), - (RenderFrameCandidateRoute.LandscapeBuildingShell, 1, 0u), - (RenderFrameCandidateRoute.CellStatic, 0, 0u), - ], - view.RouteRanges.ToArray().Select(static range => - (range.Route, range.RouteIndex, range.CellId))); - } - finally - { - exchange.Release(in view); - } - } - - [Fact] - public void Builder_InterleavesEachLookInWithItsOwnPackedBuildingShellRoutes() - { - const uint secondCell = 0xA9B40180u; - using var scene = new ArchRenderScene(Generation); - RenderProjectionRecord firstShell = Record( - 0x0100_0000_0000_0201, - RenderProjectionClass.OutdoorStatic, - isBuildingShell: true, - buildingShellAnchorCellId: Cell); - RenderProjectionRecord secondShell = Record( - 0x0100_0000_0000_0202, - RenderProjectionClass.OutdoorStatic, - isBuildingShell: true, - buildingShellAnchorCellId: secondCell); - RenderProjectionRecord firstObject = Record( - 0x0100_0000_0000_0203, - RenderProjectionClass.IndoorCellStatic, - parentCell: Cell); - RenderProjectionRecord secondObject = Record( - 0x0100_0000_0000_0204, - RenderProjectionClass.IndoorCellStatic, - parentCell: secondCell); - scene.Apply( - [ - RenderProjectionDelta.Register(Generation, 1, firstShell), - RenderProjectionDelta.Register(Generation, 2, secondShell), - RenderProjectionDelta.Register(Generation, 3, firstObject), - RenderProjectionDelta.Register(Generation, 4, secondObject), - ]); - - PortalVisibilityFrame portal = Portal(Cell); - PortalVisibilityFrame firstLookIn = Portal(Cell); - firstLookIn.SourceBuildingKey = 2u; - firstLookIn.SourceBuildingLandblockId = Cell & 0xFFFF0000u; - PortalVisibilityFrame secondLookIn = Portal(secondCell); - secondLookIn.SourceBuildingKey = 3u; - secondLookIn.SourceBuildingLandblockId = secondCell & 0xFFFF0000u; - var firstAnchor = new LoadedCell - { - CellId = Cell, - BuildingId = 2u, - }; - var secondAnchor = new LoadedCell - { - CellId = secondCell, - BuildingId = 3u, - }; - ClipFrameAssembly clip = TwoSliceClip(Cell); - clip.LookInCellToViewSlices[new LookInClipCell(0, Cell)] = - [clip.CellIdToViewSlices[Cell][0]]; - clip.LookInCellToViewSlices[new LookInClipCell(1, secondCell)] = - [clip.CellIdToViewSlices[Cell][0]]; - ViewconeCuller viewcone = - ViewconeCuller.Build(clip, Matrix4x4.Identity); - var exchange = new RenderFrameExchange(); - var builder = new RenderScenePViewFrameBuilder(); - RenderSceneDigest digest = - scene.BuildDigest(new RenderSceneDigestBuffer()); - var input = new RenderScenePViewBuildInput( - scene.OpenQuery(), - digest, - portal, - clip, - viewcone, - [firstLookIn, secondLookIn], - [Cell], - new DictionaryCellSource(firstAnchor, secondAnchor), - [], - RootIsOutdoor: true); - - builder.Build(exchange, frameSequence: 1, in input); - RenderFrameView view = exchange.BorrowLatest(Generation, 1); - try - { - Assert.Equal( - [ - (RenderFrameCandidateRoute.LookInObject, 0, Cell), - (RenderFrameCandidateRoute.LandscapeBuildingShell, 0, 0u), - (RenderFrameCandidateRoute.LandscapeBuildingShell, 1, 0u), - (RenderFrameCandidateRoute.LookInObject, 1, secondCell), - (RenderFrameCandidateRoute.LandscapeBuildingShell, 2, 0u), - (RenderFrameCandidateRoute.LandscapeBuildingShell, 3, 0u), - ], - view.RouteRanges.ToArray() - .Where(static range => - range.Route is RenderFrameCandidateRoute.LookInObject - or RenderFrameCandidateRoute.LandscapeBuildingShell) - .Select(static range => - (range.Route, range.RouteIndex, range.CellId))); - } - finally - { - exchange.Release(in view); - } - } + // Campaign FW3.2b-2 (adjudicated 2026-08-30): Builder_PreservesPViewRoutesAndExcludesShellsAndWithdrawnOwners, + // Builder_OrdersMultiSliceBuildingShellsAfterLookIns, and + // Builder_InterleavesEachLookInWithItsOwnPackedBuildingShellRoutes are + // DELETED — all three asserted route-range interleaving for + // LandscapeOutdoorStatic/LandscapeBuildingShell/CellStatic, which + // RenderScenePViewFrameBuilder no longer emits at all (WalkFrameDriver + // draws every outdoor static, building shell, and cell static — look-in + // included — directly through OrderedDrawStream; plan §FW3 + // "FW3.2b-2 — the production rooting", item 3). There is no successor + // assertion to write: the routes themselves are retired, not relocated. [Fact] public void Builder_ReusesOrderedIndicesWhileRefreshingDirtyRecords() { + // Campaign FW3.2b-2 (adjudicated 2026-08-30): re-expressed against + // the DYNAMIC index (LiveDynamicRoot / DynamicCandidates) instead of + // the now-dead OutdoorStatic index — LoadSceneIndices' dirty-record + // refresh + sort-key reorder mechanism this test proves is SHARED + // between the two indices; the OutdoorStatic side was deleted along + // with BuildOutdoorRoutes (its only reader). using var scene = new ArchRenderScene(Generation); RenderProjectionRecord later = Record( 0x0100_0000_0000_0012, - RenderProjectionClass.OutdoorStatic); + RenderProjectionClass.LiveDynamicRoot); RenderProjectionRecord earlier = Record( 0x0100_0000_0000_0011, - RenderProjectionClass.OutdoorStatic); + RenderProjectionClass.LiveDynamicRoot); scene.Apply( [ RenderProjectionDelta.Register(Generation, 1, later), @@ -353,7 +60,7 @@ public sealed class RenderScenePViewFrameProductTests { Assert.Equal( [earlier.Id, later.Id], - first.OutdoorStaticCandidates.ToArray() + first.DynamicCandidates.ToArray() .Select(static record => record.Id)); } finally @@ -401,7 +108,7 @@ public sealed class RenderScenePViewFrameProductTests projected.Transform.LocalToWorld); Assert.Equal( [earlier.Id, later.Id], - second.OutdoorStaticCandidates.ToArray() + second.DynamicCandidates.ToArray() .Select(static record => record.Id)); } finally @@ -431,7 +138,7 @@ public sealed class RenderScenePViewFrameProductTests { Assert.Equal( [later.Id, earlier.Id], - third.OutdoorStaticCandidates.ToArray() + third.DynamicCandidates.ToArray() .Select(static record => record.Id)); } finally @@ -455,7 +162,8 @@ public sealed class RenderScenePViewFrameProductTests [Cell], EmptyCellSource.Instance, [], - RootIsOutdoor: true); + RootIsOutdoor: true, + RootFloodCells: new HashSet { Cell }); builder.Build(exchange, frameSequence, in input); } } @@ -463,14 +171,18 @@ public sealed class RenderScenePViewFrameProductTests [Fact] public void Controller_MatchesCurrentPViewThenNamesAWithdrawnCandidate() { - WorldEntity outdoor = Entity(10, serverGuid: 0, parentCell: null); - WorldEntity cellStatic = Entity(11, serverGuid: 0, parentCell: Cell); + // Campaign FW3.2b-2 (adjudicated 2026-08-30): no static entities here + // — LandscapeOutdoorStatic/CellStatic no longer flow through the + // packed product at all (WalkFrameDriver owns every static now), so + // a static observed on the LEGACY oracle side with nothing on the + // packed side would report a permanent mismatch unrelated to what + // this test is proving (withdrawal detection on the SURVIVING + // DynamicLast route). WorldEntity outdoorDynamic = Entity(1_000_012, 0x8000_0012, parentCell: null); WorldEntity cellDynamic = Entity(1_000_013, 0x8000_0013, parentCell: Cell); - WorldEntity[] entities = - [outdoor, cellStatic, outdoorDynamic, cellDynamic]; + WorldEntity[] entities = [outdoorDynamic, cellDynamic]; var oracle = new CurrentRenderSceneOracle(); var partition = new InteriorEntityPartition.Result(); InteriorEntityPartition.Partition( @@ -479,16 +191,6 @@ public sealed class RenderScenePViewFrameProductTests [Entry(entities)], oracle); oracle.BeginPViewFrame(); - oracle.ObservePViewBucket( - CurrentRenderPViewRoute.LandscapeOutdoorStatic, - 0, - 0, - [outdoor]); - oracle.ObservePViewBucket( - CurrentRenderPViewRoute.CellStatic, - 0, - 0, - [cellStatic]); oracle.ObservePViewBucket( CurrentRenderPViewRoute.DynamicLast, 0, @@ -496,14 +198,6 @@ public sealed class RenderScenePViewFrameProductTests [outdoorDynamic, cellDynamic]); oracle.CompletePViewFrame(); oracle.BeginDispatcherFrame(); - oracle.ObserveDispatcherDraw( - WbDrawDispatcher.EntitySet.All, - entitiesWalked: 1, - [(outdoor, 0, Landblock)]); - oracle.ObserveDispatcherDraw( - WbDrawDispatcher.EntitySet.All, - entitiesWalked: 1, - [(cellStatic, 0, Landblock)]); oracle.ObserveDispatcherDraw( WbDrawDispatcher.EntitySet.All, entitiesWalked: 2, @@ -544,15 +238,15 @@ public sealed class RenderScenePViewFrameProductTests Assert.True(matched.Enabled); Assert.Equal(1uL, matched.ComparisonCount); Assert.Equal(1uL, matched.SuccessfulComparisonCount); - Assert.Equal(4, matched.ExpectedCandidateCount); - Assert.Equal(4, matched.ActualCandidateCount); + Assert.Equal(2, matched.ExpectedCandidateCount); + Assert.Equal(2, matched.ActualCandidateCount); Assert.Equal(0, matched.MismatchCount); Assert.Null(matched.FirstMismatch); Assert.Equal(matched.ExpectedDigest, matched.ActualDigest); Assert.Equal(1uL, matched.PackedInputComparisonCount); Assert.Equal(1uL, matched.PackedInputSuccessfulComparisonCount); - Assert.Equal(4, matched.PackedInputExpectedCount); - Assert.Equal(4, matched.PackedInputActualCount); + Assert.Equal(2, matched.PackedInputExpectedCount); + Assert.Equal(2, matched.PackedInputActualCount); Assert.Equal(0, matched.PackedInputMismatchCount); Assert.Null(matched.PackedInputFirstMismatch); Assert.Equal( @@ -581,10 +275,10 @@ public sealed class RenderScenePViewFrameProductTests Assert.Equal(2uL, mismatch.ComparisonCount); Assert.Equal(1uL, mismatch.SuccessfulComparisonCount); Assert.Equal(1, mismatch.MismatchCount); - Assert.Contains("field=count expected=4 actual=3", mismatch.FirstMismatch); + Assert.Contains("field=count expected=2 actual=1", mismatch.FirstMismatch); Assert.Equal(1, mismatch.PackedInputMismatchCount); Assert.Contains( - "field=count expected=4 actual=3", + "field=count expected=2 actual=1", mismatch.PackedInputFirstMismatch); Assert.Equal(2, logs.Count); } diff --git a/tests/AcDream.App.Tests/Rendering/RetailChaseCameraTests.cs b/tests/AcDream.App.Tests/Rendering/RetailChaseCameraTests.cs index 84283765..9cba7c08 100644 --- a/tests/AcDream.App.Tests/Rendering/RetailChaseCameraTests.cs +++ b/tests/AcDream.App.Tests/Rendering/RetailChaseCameraTests.cs @@ -876,9 +876,15 @@ public class RetailChaseCameraTests isOnGround: true, contactPlaneNormal: Vector3.UnitZ, dt: 1f / 60f, cellId: 0x100, selfEntityId: 0x5); - Step(); // frame 1: total fallback — viewer snaps to the player, cell 0 + Step(); // frame 1: total fallback — viewer snaps to the player Assert.Equal(Vector3.Zero, cam.Position); - Assert.Equal(0u, cam.ViewerCellId); + // FW3 visual-gate correction: retail's set_viewer(&player-> + // m_position, 1) copies the WHOLE Position — objcell_id included + // — so the fallback viewer inherits the PLAYER'S cell (0x100 + // here), never 0. Rooting those frames on 0 made the walk treat + // a doorway-graze frame as outdoor (grass over the stairwell — + // the #119 family's transition arm). + Assert.Equal(0x100u, cam.ViewerCellId); Step(); // frame 2: the sweep target re-extends FROM the player float reach = Vector3.Distance(probe.Requests[1], Vector3.Zero); diff --git a/tests/AcDream.App.Tests/Rendering/RetailPViewPassExecutorTests.cs b/tests/AcDream.App.Tests/Rendering/RetailPViewPassExecutorTests.cs index 36628dbf..48b7dd51 100644 --- a/tests/AcDream.App.Tests/Rendering/RetailPViewPassExecutorTests.cs +++ b/tests/AcDream.App.Tests/Rendering/RetailPViewPassExecutorTests.cs @@ -24,8 +24,12 @@ public sealed class RetailPViewPassExecutorTests "begin", "assemble", "append-look-in-clips", - "prepare-clip:3", + // FW4 slice 1: the clip-region publication moved below the + // walk block (a walk-rooted interior frame re-derives the + // outside-view slices from the walk's own views first, and + // the appended slots must join the same single publication). "indoor-routing", + "prepare-clip:3", "prepare-cells", "diagnostics", "terrain-clip", @@ -196,10 +200,15 @@ public sealed class RetailPViewPassExecutorTests [Fact] public void DrawInside_production_product_supplies_the_ordered_entity_routes() { + // Campaign FW3.2b-2: no cell-static entity here (adjudicated + // 2026-08-30) — CellStatic no longer flows through the packed + // product at all (WalkFrameDriver owns every cell static now, via + // OrderedDrawStream, not this route); a static entity registered on + // the LEGACY side with nothing on the packed side would report a + // permanent MismatchCount, which is not what this test is proving. + // The route-consumption-order assertion below still exercises the + // one route that DID survive the cutover (DynamicLast). LoadedCell interior = InteriorWithExit(0xA9B40100u); - WorldEntity cellStatic = Entity( - 30u, - parentCellId: interior.CellId); WorldEntity dynamic = Entity( 31u, serverGuid: 0x80000031u, @@ -208,17 +217,6 @@ public sealed class RetailPViewPassExecutorTests var oracle = new CurrentRenderSceneOracle(); using var shadow = new RenderSceneShadowRuntime( RenderSceneGeneration.FromRaw(1)); - RenderProjectionRecord staticRecord = - RenderProjectionRecordFactory.ProjectEntity( - StaticRenderProjectionJournal.StaticEntityId( - landblockId, - cellStatic.Id), - RenderProjectionClass.IndoorCellStatic, - RenderOwnerIncarnation.FromRaw(cellStatic.Id), - landblockId, - interior.CellId, - cellStatic, - spatiallyVisible: true); RenderProjectionRecord dynamicRecord = RenderProjectionRecordFactory.ProjectEntity( LiveRenderProjectionJournal.ProjectionId(dynamic.Id), @@ -228,7 +226,6 @@ public sealed class RetailPViewPassExecutorTests interior.CellId, dynamic, spatiallyVisible: true); - shadow.Journal.Register(in staticRecord); shadow.Journal.Register(in dynamicRecord); shadow.DrainUpdateBoundary(); var product = new RenderScenePViewFrameProductController( @@ -238,13 +235,12 @@ public sealed class RetailPViewPassExecutorTests using var executor = new RecordingExecutor(); renderer.DrawInside( - Frame(interior, [cellStatic, dynamic]), + Frame(interior, [dynamic]), executor); AssertAppearsInOrder( string.Join('|', executor.Operations), "entity-frame-begin", - "entity-route:CellStatic:0:00000000", "entity-route:DynamicLast:0:00000000", "entity-frame-complete"); Assert.Equal(0, product.Snapshot.MismatchCount); diff --git a/tests/AcDream.App.Tests/Rendering/Walk/LandWalkOrderTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/LandWalkOrderTests.cs new file mode 100644 index 00000000..76009bbf --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/LandWalkOrderTests.cs @@ -0,0 +1,141 @@ +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class LandWalkOrderTests +{ + [Theory] + [InlineData(5, 5, 11)] // retail defaults: mid_width 11, viewer centered + [InlineData(0, 0, 11)] // viewer at a grid corner + [InlineData(10, 3, 11)] // viewer at an edge + [InlineData(1, 1, 3)] + public void Block_order_covers_every_slot_exactly_once_viewer_first( + int vx, int vy, int width) + { + Span order = new int[width * width]; + + int count = LandWalkOrder.GetBlockOrder(vx, vy, width, order); + + Assert.Equal(width * width, count); + Assert.Equal(vx * width + vy, order[0]); + var seen = new HashSet(); + foreach (int slot in order) + Assert.True(seen.Add(slot), $"slot {slot} emitted twice"); + } + + [Fact] + public void Block_order_is_ring_monotone_near_to_far() + { + const int width = 11; + const int vx = 5, vy = 5; + Span order = new int[width * width]; + LandWalkOrder.GetBlockOrder(vx, vy, width, order); + + int previousRing = 0; + foreach (int slot in order) + { + int ring = Math.Max(Math.Abs(slot / width - vx), Math.Abs(slot % width - vy)); + Assert.True(ring >= previousRing, "a later entry moved to a NEARER ring"); + previousRing = ring; + } + } + + [Fact] + public void Block_order_ring_one_matches_the_decoded_slot_pattern() + { + // Hand-expanded from the byte-decoded tables for ring 1, step 0: + // (0,+1) (-1,0) (0,-1) (+1,0) (+1,+1) (-1,+1) (-1,-1) (+1,-1) + // — cardinals first (N W S E), then diagonals (NE NW SW SE). + const int width = 3; + Span order = new int[9]; + LandWalkOrder.GetBlockOrder(1, 1, width, order); + + int[] expected = + [ + 1 * 3 + 1, // viewer + 1 * 3 + 2, // (0,+1) + 0 * 3 + 1, // (-1,0) + 1 * 3 + 0, // (0,-1) + 2 * 3 + 1, // (+1,0) + 2 * 3 + 2, // (+1,+1) + 0 * 3 + 2, // (-1,+1) + 0 * 3 + 0, // (-1,-1) + 2 * 3 + 0, // (+1,-1) + ]; + Assert.Equal(expected, order.ToArray()); + } + + [Theory] + [InlineData(0, 0, 8)] + [InlineData(7, 7, 8)] + [InlineData(3, 5, 8)] + [InlineData(0, 0, 1)] + public void Cell_order_fills_exactly_and_ends_at_the_closest_cell( + int cx, int cy, int side) + { + Span order = new int[side * side]; + order.Fill(-1); + + LandWalkOrder.FillCellOrderFarToNear(cx, cy, side, order); + + Assert.Equal(cx * side + cy, order[^1]); + var seen = new HashSet(); + foreach (int slot in order) + { + Assert.InRange(slot, 0, side * side - 1); + Assert.True(seen.Add(slot), $"slot {slot} written twice"); + } + } + + [Fact] + public void Cell_order_forward_walk_is_far_to_near() + { + const int side = 8; + const int cx = 2, cy = 6; + Span order = new int[side * side]; + LandWalkOrder.FillCellOrderFarToNear(cx, cy, side, order); + + int previousRing = int.MaxValue; + foreach (int slot in order) + { + int ring = Math.Max(Math.Abs(slot / side - cx), Math.Abs(slot % side - cy)); + Assert.True(ring <= previousRing, "a later entry moved to a FARTHER ring"); + previousRing = ring; + } + } + + [Theory] + [InlineData(0, 0, LandDirection.InViewerBlock)] + [InlineData(0, 3, LandDirection.North)] + [InlineData(0, -1, LandDirection.South)] + [InlineData(2, 0, LandDirection.East)] + [InlineData(-4, 0, LandDirection.West)] + [InlineData(-1, 1, LandDirection.NorthWest)] + [InlineData(-2, -2, LandDirection.SouthWest)] + [InlineData(3, 1, LandDirection.NorthEast)] + [InlineData(1, -5, LandDirection.SouthEast)] + public void Direction_mapping_matches_get_dir(int dx, int dy, LandDirection expected) + => Assert.Equal(expected, LandWalkOrder.GetDirection(dx, dy)); + + [Theory] + [InlineData(LandDirection.InViewerBlock, 5, 3, 8, 5, 3)] + [InlineData(LandDirection.North, 5, 3, 8, 5, 0)] // block north: south edge faces viewer + [InlineData(LandDirection.South, 5, 3, 8, 5, 7)] + [InlineData(LandDirection.East, 5, 3, 8, 0, 3)] // block east: west edge faces viewer + [InlineData(LandDirection.West, 5, 3, 8, 7, 3)] + [InlineData(LandDirection.NorthWest, 5, 3, 8, 7, 0)] + [InlineData(LandDirection.SouthWest, 5, 3, 8, 7, 7)] + [InlineData(LandDirection.NorthEast, 5, 3, 8, 0, 0)] + [InlineData(LandDirection.SouthEast, 5, 3, 8, 0, 7)] + public void Closest_cell_matches_the_direction_switch( + LandDirection dir, int sqx, int sqy, int side, int expectedX, int expectedY) + => Assert.Equal((expectedX, expectedY), LandWalkOrder.ClosestCell(dir, sqx, sqy, side)); + + [Fact] + public void Closest_cell_scales_the_viewer_coordinate_for_low_resolution_blocks() + { + // side_cell_count < 8: retail divides the viewer's cell coord by 8/side. + Assert.Equal((2, 1), LandWalkOrder.ClosestCell(LandDirection.InViewerBlock, 5, 3, 4)); + Assert.Equal((0, 0), LandWalkOrder.ClosestCell(LandDirection.InViewerBlock, 7, 7, 1)); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/OrderPreservingSubmitterTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/OrderPreservingSubmitterTests.cs new file mode 100644 index 00000000..1108d0e3 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/OrderPreservingSubmitterTests.cs @@ -0,0 +1,789 @@ +using System.Collections.ObjectModel; +using System.Diagnostics.CodeAnalysis; +using System.Numerics; +using AcDream.App.Rendering; +using AcDream.App.Rendering.Gpu; +using AcDream.App.Rendering.Gpu.Vk; +using AcDream.App.Rendering.Wb; +using AcDream.App.Rendering.Walk; +using AcDream.App.Tests.Rendering.Gpu; +using AcDream.Content; +using AcDream.Core.Meshing; +using DatReaderWriter; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Enums; +using DatReaderWriter.Lib.IO; +using Microsoft.Extensions.Logging.Abstractions; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Campaign FW stage FW2: +/// (pure CPU merge-run legality) and, from Campaign FW stage FW3.4a, +/// + +/// (the same legality proven +/// through actual recorded RHI calls against , +/// replacing the single SubmitOrderedStream call those two now split). +/// +public sealed class OrderPreservingSubmitterTests +{ + private static OrderedDrawCommand MakeCommand( + int index, + WalkDrawStage stage = WalkDrawStage.Terrain, + TranslucencyKind translucency = TranslucencyKind.Opaque, + CullMode cullMode = CullMode.CounterClockwise, + uint detailCategory = 0) => + new( + Key: new GroupKey( + FirstIndex: (uint)index * 3, + BaseVertex: index * 4, + IndexCount: 3, + TextureSlot: new GpuTextureSlot((uint)index), + TextureLayer: 0, + Translucency: translucency, + FoliageFlags: 0, + CullMode: cullMode), + Transform: Matrix4x4.CreateTranslation(index, index * 2, index * 3), + Stage: stage, + CellId: 0x8C040100u + (uint)index, + ClipSlot: 0, + Lights: WbDrawDispatcher.InstanceLightSet.Disabled, + IndoorFlag: 0, + Alpha: 1f, + SelectionLighting: Vector2.Zero, + DetailCategory: detailCategory); + + private static OrderedDrawStream StreamOf(params OrderedDrawCommand[] commands) + { + var stream = new OrderedDrawStream(); + foreach (OrderedDrawCommand command in commands) + stream.Append(command); + return stream; + } + + // ── Pure BuildOrderedMergeRuns — no GPU device ───────────────────────── + + [Fact] + public void BuildOrderedMergeRuns_MergesThreeAdjacentSameStateCommandsIntoOneRun() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0), MakeCommand(1), MakeCommand(2)); + + List runs = + WbDrawDispatcher.BuildOrderedMergeRuns(stream); + + WbDrawDispatcher.OrderedMergeRun run = Assert.Single(runs); + Assert.Equal(0, run.FirstCommand); + Assert.Equal(3, run.CommandCount); + } + + [Fact] + public void BuildOrderedMergeRuns_SplitsOnAPipelineBucketChange() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0, translucency: TranslucencyKind.Opaque), + MakeCommand(1, translucency: TranslucencyKind.Opaque), + MakeCommand(2, translucency: TranslucencyKind.AlphaBlend)); + + List runs = + WbDrawDispatcher.BuildOrderedMergeRuns(stream); + + Assert.Equal( + [ + new WbDrawDispatcher.OrderedMergeRun(0, 2), + new WbDrawDispatcher.OrderedMergeRun(2, 1), + ], + runs); + } + + [Fact] + public void BuildOrderedMergeRuns_SplitsOnACullModeChange() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0, cullMode: CullMode.None), + MakeCommand(1, cullMode: CullMode.None), + MakeCommand(2, cullMode: CullMode.Clockwise)); + + List runs = + WbDrawDispatcher.BuildOrderedMergeRuns(stream); + + Assert.Equal( + [ + new WbDrawDispatcher.OrderedMergeRun(0, 2), + new WbDrawDispatcher.OrderedMergeRun(2, 1), + ], + runs); + } + + /// + /// The load-bearing new assertion: two commands whose material state + /// (bucket, cull mode, detail category) is IDENTICAL still split into two + /// runs when their differs. Nothing about the + /// deferred-alpha template this submitter borrows from ever had to + /// consider stage — walk order introduces it. + /// + [Fact] + public void BuildOrderedMergeRuns_SplitsOnAStageChangeEvenWithIdenticalMaterialState() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0, stage: WalkDrawStage.Terrain), + MakeCommand(1, stage: WalkDrawStage.CellStatic)); + + List runs = + WbDrawDispatcher.BuildOrderedMergeRuns(stream); + + Assert.Equal( + [ + new WbDrawDispatcher.OrderedMergeRun(0, 1), + new WbDrawDispatcher.OrderedMergeRun(1, 1), + ], + runs); + } + + [Fact] + public void BuildOrderedMergeRuns_ADetailCategoryCommandIsAlwaysSolo() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0), + MakeCommand(1, detailCategory: 1), + MakeCommand(2)); + + List runs = + WbDrawDispatcher.BuildOrderedMergeRuns(stream); + + Assert.Equal( + [ + new WbDrawDispatcher.OrderedMergeRun(0, 1), + new WbDrawDispatcher.OrderedMergeRun(1, 1), + new WbDrawDispatcher.OrderedMergeRun(2, 1), + ], + runs); + } + + [Fact] + public void BuildOrderedMergeRuns_ThrowsNotSupportedForAPortalPunchCommand() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0, stage: WalkDrawStage.Terrain), + MakeCommand(1, stage: WalkDrawStage.PortalPunch)); + + Assert.Throws( + () => WbDrawDispatcher.BuildOrderedMergeRuns(stream)); + } + + [Fact] + public void BuildOrderedMergeRuns_EveryCommandBelongsToExactlyOneRunInOrderWithNoGaps() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0, stage: WalkDrawStage.Terrain, translucency: TranslucencyKind.Opaque, cullMode: CullMode.None), + MakeCommand(1, stage: WalkDrawStage.Terrain, translucency: TranslucencyKind.Opaque, cullMode: CullMode.None), + MakeCommand(2, stage: WalkDrawStage.Terrain, translucency: TranslucencyKind.AlphaBlend, cullMode: CullMode.None), + MakeCommand(3, stage: WalkDrawStage.Terrain, translucency: TranslucencyKind.AlphaBlend, cullMode: CullMode.Clockwise), + MakeCommand(4, stage: WalkDrawStage.CellStatic, translucency: TranslucencyKind.AlphaBlend, cullMode: CullMode.Clockwise), + MakeCommand(5, stage: WalkDrawStage.CellStatic, translucency: TranslucencyKind.AlphaBlend, cullMode: CullMode.Clockwise, detailCategory: 1), + MakeCommand(6, stage: WalkDrawStage.CellStatic, translucency: TranslucencyKind.AlphaBlend, cullMode: CullMode.Clockwise)); + + List runs = + WbDrawDispatcher.BuildOrderedMergeRuns(stream); + + int coveredThrough = 0; + int totalCommands = 0; + foreach (WbDrawDispatcher.OrderedMergeRun run in runs) + { + Assert.Equal(coveredThrough, run.FirstCommand); + Assert.True(run.CommandCount > 0); + coveredThrough = run.FirstCommand + run.CommandCount; + totalCommands += run.CommandCount; + } + Assert.Equal(stream.Count, coveredThrough); + Assert.Equal(stream.Count, totalCommands); + } + + // ── PrepareOrderedStream + DrawOrderedRange — recorded RHI calls against + // RecordingGpuDevice. Campaign FW3.4a replaced the single + // SubmitOrderedStream call with this pair (prepare the whole stream once, + // draw it via one or more ranges) — every test below that used to call + // SubmitOrderedStream now calls Prepare once and Draw the WHOLE stream as + // ONE range, which is exactly SubmitOrderedStream's old behavior; the + // "several ranges" and "bind once" shapes get their own tests further + // down since they have no FW2 analogue. ──────────────────────────────── + + private static void PrepareAndDrawWhole(WbDrawDispatcher dispatcher, DrawScope draw, OrderedDrawStream stream) + { + dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity); + if (stream.Count > 0) + dispatcher.DrawOrderedRange(draw.Pass, 0, stream.Count); + } + + [Fact] + public void PrepareThenDraw_AlternatingStateCommandsRecordOneDrawEachInOrder() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0, translucency: TranslucencyKind.Opaque), + MakeCommand(1, translucency: TranslucencyKind.AlphaBlend), + MakeCommand(2, translucency: TranslucencyKind.Opaque), + MakeCommand(3, translucency: TranslucencyKind.AlphaBlend)); + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + List<(int Start, int Count)> ranges = DecodeDrawRanges(fx.Device); + Assert.Equal([(0, 1), (1, 1), (2, 1), (3, 1)], ranges); + } + + [Fact] + public void PrepareThenDraw_MergesAdjacentSameStateCommandsIntoOneMultiDrawIndirect() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0), MakeCommand(1), MakeCommand(2)); + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + List<(int Start, int Count)> ranges = DecodeDrawRanges(fx.Device); + Assert.Equal([(0, 3)], ranges); + } + + [Fact] + public void PrepareThenDraw_CullModeChangeRecordsSeparateCullCallsAndSplitsTheDraw() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0, cullMode: CullMode.None), + MakeCommand(1, cullMode: CullMode.None), + MakeCommand(2, cullMode: CullMode.Clockwise)); + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + Assert.Equal([(0, 2), (2, 1)], DecodeDrawRanges(fx.Device)); + + List cullCalls = + [.. fx.Device.Calls.OfType().Select(c => c.CullMode)]; + // ApplyCullModeRhi: CullMode.None -> GpuCullMode.None, CullMode.Clockwise -> GpuCullMode.Front. + Assert.Equal([GpuCullMode.None, GpuCullMode.Front], cullCalls); + } + + [Fact] + public void PrepareThenDraw_StageChangeSplitsTheDrawEvenWithIdenticalMaterialState() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0, stage: WalkDrawStage.Terrain), + MakeCommand(1, stage: WalkDrawStage.CellStatic)); + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + Assert.Equal([(0, 1), (1, 1)], DecodeDrawRanges(fx.Device)); + } + + [Fact] + public void PrepareThenDraw_ADetailCategoryCommandRecordsItsOwnSoloDraw() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0), + MakeCommand(1, detailCategory: 1), + MakeCommand(2)); + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + Assert.Equal([(0, 1), (1, 1), (2, 1)], DecodeDrawRanges(fx.Device)); + } + + [Fact] + public void PrepareThenDraw_OpaqueRunUsesRenderPassZeroAndAlphaBlendRunUsesRenderPassOne() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0, translucency: TranslucencyKind.Opaque), + MakeCommand(1, translucency: TranslucencyKind.AlphaBlend)); + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + List<(GpuPushConstants Constants, int Start, int Count)> runs = DecodeRuns(fx.Device); + Assert.Equal(2, runs.Count); + Assert.Equal(0, runs[0].Constants.RenderPass); + Assert.Equal(1, runs[1].Constants.RenderPass); + } + + [Fact] + public void PrepareOrderedStream_ThrowsNotSupportedForAPortalPunchCommandBeforeAnyDraw() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0, stage: WalkDrawStage.PortalPunch)); + + Assert.Throws( + () => fx.Dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity)); + + Assert.Empty(fx.Device.Calls.OfType()); + Assert.Empty(fx.Device.Calls.OfType()); + } + + [Fact] + public void PrepareOrderedStream_EmptyStreamRecordsNoDraws() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + fx.Dispatcher.PrepareOrderedStream(draw.Frame, new OrderedDrawStream(), Matrix4x4.Identity); + + Assert.Empty(fx.Device.Calls.OfType()); + } + + // ── Campaign FW3.4a — the shapes with no FW2 analogue: drawing the SAME + // prepared stream as several ranges, the bind-once optimization, the + // fail-loud range check, and the assert-don't-slice straddle guard. ─── + + /// + /// The whole point of the split: drawing the SAME stream as TWO ranges + /// (with the boundary between them supplied to Prepare, exactly as + /// WalkFrameDriver.Replay supplies its recorded mark positions) produces + /// the identical total recorded draw/cull/push-constant calls as drawing + /// it as one range — the range split changes nothing about what reaches + /// the GPU, only how many DrawOrderedRange calls got there. + /// + [Fact] + public void DrawOrderedRange_AsTwoRangesAtASegmentBoundary_MatchesOneRangeOverTheWholeStream() + { + OrderedDrawStream stream = StreamOf( + MakeCommand(0, translucency: TranslucencyKind.Opaque), + MakeCommand(1, translucency: TranslucencyKind.Opaque), + MakeCommand(2, translucency: TranslucencyKind.Opaque), + MakeCommand(3, translucency: TranslucencyKind.Opaque)); + + using var wholeFx = new DispatcherFixture(); + using (DrawScope draw = wholeFx.BeginDraw()) + { + wholeFx.Dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity); + wholeFx.Dispatcher.DrawOrderedRange(draw.Pass, 0, stream.Count); + } + List<(int Start, int Count)> wholeRanges = DecodeDrawRanges(wholeFx.Device); + + using var splitFx = new DispatcherFixture(); + using (DrawScope draw = splitFx.BeginDraw()) + { + // Command 2 is a segment boundary (mirrors a mark WalkFrameDriver + // would record there, e.g. a cell shell between two same-state + // segments) — without it, all four commands would merge into ONE + // run; the boundary forces two. + splitFx.Dispatcher.PrepareOrderedStream( + draw.Frame, stream, Matrix4x4.Identity, forcedBreaksAscending: [2]); + splitFx.Dispatcher.DrawOrderedRange(draw.Pass, 0, 2); + splitFx.Dispatcher.DrawOrderedRange(draw.Pass, 2, 2); + } + List<(int Start, int Count)> splitRanges = DecodeDrawRanges(splitFx.Device); + + // The split path draws two runs where the whole-range path drew one + // (the forced boundary is the only difference) — but every command + // reaches the GPU exactly once, in order, with identical coverage. + Assert.Equal([(0, 4)], wholeRanges); + Assert.Equal([(0, 2), (2, 2)], splitRanges); + } + + /// + /// The FW3.4a perf shape itself: the nine per-instance storage binds plus + /// the warm-up pipeline bind happen on the FIRST DrawOrderedRange call in + /// a frame only — a second call over the same prepared payload issues no + /// further StorageBind calls, which is the whole reason this stage exists + /// (the old SubmitOrderedStream rebound everything on every call). + /// + [Fact] + public void DrawOrderedRange_EveryCallRebindsTheStorageSections() + { + // The corrected FW3.4a contract (the dense-Arwic device-lost fix): + // between ordered ranges the walk's leaf draws and RetailAlphaQueue + // flushes rebind the SAME set-0 slots to THEIR sections, so every + // DrawOrderedRange call must re-bind its own — a latched skip draws + // the next range against foreign buffers. Only the ring WRITES are + // once-per-frame (PrepareOrderedStream); binds repeat per range, + // exactly like DrawPreparedAlphaBatchRhi. + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf( + MakeCommand(0, stage: WalkDrawStage.Terrain), + MakeCommand(1, stage: WalkDrawStage.CellStatic)); + + fx.Dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity); + fx.Dispatcher.DrawOrderedRange(draw.Pass, 0, 1); + int boundAfterFirst = fx.Device.Calls.OfType().Count(); + Assert.True(boundAfterFirst > 0); + + fx.Dispatcher.DrawOrderedRange(draw.Pass, 1, 1); + int boundAfterSecond = fx.Device.Calls.OfType().Count(); + + Assert.Equal(boundAfterFirst * 2, boundAfterSecond); + // Both commands drew; the rebinds changed nothing about coverage. + Assert.Equal([(0, 1), (1, 1)], DecodeDrawRanges(fx.Device)); + } + + /// + /// Fail-loud range check (mirrors DrawPreparedAlphaBatchRhi's): a range + /// outside what PrepareOrderedStream uploaded throws rather than drawing + /// garbage or silently clamping — including a draw attempted before ANY + /// Prepare call this frame. + /// + [Fact] + public void DrawOrderedRange_RangeExceedingThePreparedPayload_Throws() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + OrderedDrawStream stream = StreamOf(MakeCommand(0)); + fx.Dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity); + + Assert.Throws( + () => fx.Dispatcher.DrawOrderedRange(draw.Pass, 0, 2)); + Assert.Throws( + () => fx.Dispatcher.DrawOrderedRange(draw.Pass, 1, 1)); + } + + [Fact] + public void DrawOrderedRange_BeforeAnyPrepareCallThisFrame_Throws() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + Assert.Throws( + () => fx.Dispatcher.DrawOrderedRange(draw.Pass, 0, 1)); + } + + /// + /// The plan's "assert it" rule: a range that does not align with a merge + /// run boundary throws rather than silently slicing the run — proven + /// directly here (skipping the boundary a real WalkFrameDriver mark would + /// supply) since production code always supplies the boundary and would + /// never exercise this path. + /// + [Fact] + public void DrawOrderedRange_RangeStraddlingAMergeRun_Throws() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + // All four commands share stage/bucket/cull — ONE merge run [0, 4) — + // and no forced break is supplied, so a [0, 2) range straddles it. + OrderedDrawStream stream = StreamOf( + MakeCommand(0), MakeCommand(1), MakeCommand(2), MakeCommand(3)); + fx.Dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity); + + Assert.Throws( + () => fx.Dispatcher.DrawOrderedRange(draw.Pass, 0, 2)); + } + + /// + /// Fail-loud invariant: whatever the state pattern, the recorded + /// MultiDrawIndirect calls' DrawCounts always sum to the stream's Count — + /// no command is ever silently skipped, and none is drawn twice. + /// + [Fact] + public void PrepareThenDraw_TotalRecordedDrawCountAlwaysEqualsTheStreamCount() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + var stream = new OrderedDrawStream(); + var stages = new[] { WalkDrawStage.Terrain, WalkDrawStage.CellStatic, WalkDrawStage.BuildingShell }; + var blends = new[] + { + TranslucencyKind.Opaque, TranslucencyKind.AlphaBlend, + TranslucencyKind.Additive, TranslucencyKind.InvAlpha, + }; + var culls = new[] { CullMode.None, CullMode.Clockwise, CullMode.CounterClockwise }; + const int commandCount = 11; + for (int i = 0; i < commandCount; i++) + { + stream.Append(MakeCommand( + i, + stage: stages[i % stages.Length], + translucency: blends[i % blends.Length], + cullMode: culls[i % culls.Length], + detailCategory: i == 5 ? 1u : 0u)); + } + + PrepareAndDrawWhole(fx.Dispatcher, draw, stream); + + List<(int Start, int Count)> ranges = DecodeDrawRanges(fx.Device); + int sum = ranges.Sum(r => r.Count); + Assert.Equal(commandCount, sum); + + int coveredThrough = 0; + foreach ((int start, int count) in ranges) + { + Assert.Equal(coveredThrough, start); + coveredThrough += count; + } + Assert.Equal(commandCount, coveredThrough); + } + + // ── Decode helpers ────────────────────────────────────────────────────── + + private static List<(int Start, int Count)> DecodeDrawRanges(RecordingGpuDevice device) => + [.. DecodeRuns(device).Select(r => (r.Start, r.Count))]; + + private static List<(GpuPushConstants Constants, int Start, int Count)> DecodeRuns( + RecordingGpuDevice device) + { + GpuPushConstants? lastConstants = null; + uint? commandBase = null; + var result = new List<(GpuPushConstants, int, int)>(); + foreach (var call in device.Calls) + { + if (call is GpuRecordedPushConstants pc) + { + lastConstants = pc.Constants; + } + else if (call is GpuRecordedMultiDrawIndirect mdi) + { + Assert.Equal((uint)WbDrawDispatcher.DrawCommandStride, mdi.StrideBytes); + commandBase ??= mdi.OffsetBytes; + int start = (int)((mdi.OffsetBytes - commandBase.Value) / mdi.StrideBytes); + Assert.NotNull(lastConstants); + result.Add((lastConstants!.Value, start, (int)mdi.DrawCount)); + } + } + return result; + } + + // ── Fixture: a real WbDrawDispatcher against RecordingGpuDevice ───────── + + private readonly struct DrawScope : IDisposable + { + private readonly IDisposable _publication; + private readonly IGpuPassEncoder _pass; + + public DrawScope(IGpuFrame frame, IGpuPassEncoder pass, IDisposable publication) + { + Frame = frame; + _pass = pass; + _publication = publication; + } + + public IGpuFrame Frame { get; } + + public IGpuPassEncoder Pass => _pass; + + public void Dispose() + { + _publication.Dispose(); + _pass.Dispose(); + } + } + + private sealed class DispatcherFixture : IDisposable + { + private readonly WbMeshAdapter _meshAdapter; + private readonly TextureCache _textures; + + public DispatcherFixture() + { + Device = new RecordingGpuDevice(); + FrameLifetime = new GpuDeviceFrameLifetime(Device); + Scope = new VulkanWorldPassScope(sampleCount: 1); + _textures = new TextureCache(Device, new NoopDatReaderWriter()); + _meshAdapter = new WbMeshAdapter( + Device, + new NoopDatReaderWriter(), + new NullPreparedAssetSource(), + NullLogger.Instance, + Device.Retirement); + var entitySpawnAdapter = new EntitySpawnAdapter( + _textures, + _ => throw new NotSupportedException( + "Not exercised by SubmitOrderedStream tests.")); + + Dispatcher = new WbDrawDispatcher( + Device, + FrameLifetime, + Scope, + _textures, + _meshAdapter, + entitySpawnAdapter, + new EntityClassificationCache(), + new AcDream.Core.Rendering.TranslucencyFadeManager()); + } + + public RecordingGpuDevice Device { get; } + + public GpuDeviceFrameLifetime FrameLifetime { get; } + + public VulkanWorldPassScope Scope { get; } + + public WbDrawDispatcher Dispatcher { get; } + + /// Opens a frame and a backbuffer pass, publishes it on + /// , then clears the recorded calls so a test only + /// sees what its own SubmitOrderedStream call produced. + public DrawScope BeginDraw() + { + FrameLifetime.BeginFrame(); + IGpuFrame frame = FrameLifetime.CurrentFrame!; + IGpuPassEncoder pass = frame.BeginPass( + GpuPassDescription.BackbufferClear( + "fw2-ordered-stream-test", Vector4.Zero, sampleCount: 1)); + IDisposable publication = Scope.Publish(pass); + Device.Clear(); + return new DrawScope(frame, pass, publication); + } + + public void Dispose() + { + Dispatcher.Dispose(); + _meshAdapter.Dispose(); + _textures.Dispose(); + Device.Dispose(); + } + } + + private sealed class NullPreparedAssetSource : IPreparedAssetSource + { + public PreparedAssetSourceStats Stats => default; + + public CacheStats DecodedTextureCacheStats => default; + + public PreparedAssetPresence Probe( + AcDream.Content.Pak.PakAssetType type, + uint sourceFileId) => + PreparedAssetPresence.Missing; + + public PreparedAssetReadResult Read( + in PreparedAssetRequest request, + CancellationToken cancellationToken = default) => + PreparedAssetReadResult.Missing; + + public void Dispose() + { + } + } + + private sealed class NoopDatReaderWriter : IDatReaderWriter + { + private readonly StubDatabase _portal = new(); + private readonly StubDatabase _highRes = new(); + private readonly StubDatabase _language = new(); + private readonly StubDatabase _cell = new(); + + public string SourceDirectory => string.Empty; + + public IDatDatabase Portal => _portal; + + public IDatDatabase Cell => _cell; + + public ReadOnlyDictionary CellRegions { get; } = + new(new Dictionary()); + + public IDatDatabase HighRes => _highRes; + + public IDatDatabase Language => _language; + + public IDatDatabase Local => _language; + + public ReadOnlyDictionary RegionFileMap { get; } = + new(new Dictionary()); + + public int PortalIteration => 0; + + public int CellIteration => 0; + + public int HighResIteration => 0; + + public int LanguageIteration => 0; + + public bool TryGetFileBytes( + uint regionId, + uint fileId, + ref byte[] bytes, + out int bytesRead) + { + bytesRead = 0; + return false; + } + + public IEnumerable GetAllIdsOfType() where T : IDBObj => + Array.Empty(); + + public IEnumerable ResolveId(uint id) => + Array.Empty(); + + public bool TrySave(T obj, int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + public bool TrySave( + uint regionId, + T obj, + int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + [return: MaybeNull] + public T Get(uint fileId) where T : IDBObj => default; + + public bool TryGet( + uint fileId, + [MaybeNullWhen(false)] out T value) where T : IDBObj + { + value = default; + return false; + } + + public void Dispose() + { + } + + private sealed class StubDatabase : IDatDatabase + { + public DatDatabase Db => throw new NotSupportedException(); + + public int Iteration => 0; + + public IEnumerable GetAllIdsOfType() where T : IDBObj => + Array.Empty(); + + public bool TryGet( + uint fileId, + [MaybeNullWhen(false)] out T value) where T : IDBObj + { + value = default; + return false; + } + + public bool TryGetFileBytes( + uint fileId, + [MaybeNullWhen(false)] out byte[] value) + { + value = null; + return false; + } + + public bool TryGetFileBytes( + uint fileId, + ref byte[] bytes, + out int bytesRead) + { + bytesRead = 0; + return false; + } + + public bool TrySave(T obj, int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + public void Dispose() + { + } + } + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/OrderedDrawStreamTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/OrderedDrawStreamTests.cs new file mode 100644 index 00000000..b79158a3 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/OrderedDrawStreamTests.cs @@ -0,0 +1,169 @@ +using System.Numerics; +using AcDream.App.Rendering.Gpu; +using AcDream.App.Rendering.Wb; +using AcDream.App.Rendering.Walk; +using AcDream.Core.Meshing; +using DatReaderWriter.Enums; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Campaign FW stage FW2: pure data-structure tests for +/// . No GPU device, no dispatcher — this is the +/// append-only struct-of-arrays storage on its own. +/// +public sealed class OrderedDrawStreamTests +{ + private static OrderedDrawCommand MakeCommand( + int index, + WalkDrawStage stage = WalkDrawStage.Terrain, + TranslucencyKind translucency = TranslucencyKind.Opaque, + CullMode cullMode = CullMode.CounterClockwise, + uint detailCategory = 0) => + new( + Key: new GroupKey( + FirstIndex: (uint)index * 3, + BaseVertex: index * 4, + IndexCount: 3, + TextureSlot: new GpuTextureSlot((uint)index), + TextureLayer: 0, + Translucency: translucency, + FoliageFlags: 0, + CullMode: cullMode), + Transform: Matrix4x4.CreateTranslation(index, index * 2, index * 3), + Stage: stage, + CellId: 0x8C040100u + (uint)index, + ClipSlot: (uint)index + 1, + Lights: WbDrawDispatcher.InstanceLightSet.Disabled, + IndoorFlag: (uint)(index % 2), + Alpha: 1f - index * 0.01f, + SelectionLighting: new Vector2(index, index + 1), + DetailCategory: detailCategory); + + [Fact] + public void EmptyStream_HasZeroCount() + { + var stream = new OrderedDrawStream(); + + Assert.Equal(0, stream.Count); + Assert.Empty(stream.Keys); + Assert.Empty(stream.Transforms); + Assert.Empty(stream.Stages); + Assert.Empty(stream.CellIds); + Assert.Empty(stream.ClipSlots); + Assert.Empty(stream.Lights); + Assert.Empty(stream.IndoorFlags); + Assert.Empty(stream.Alphas); + Assert.Empty(stream.SelectionLighting); + Assert.Empty(stream.DetailCategories); + } + + [Fact] + public void Append_GrowsCountAndEveryParallelListInLockstep() + { + var stream = new OrderedDrawStream(); + + for (int i = 0; i < 5; i++) + stream.Append(MakeCommand(i)); + + Assert.Equal(5, stream.Count); + Assert.Equal(5, stream.Keys.Count); + Assert.Equal(5, stream.Transforms.Count); + Assert.Equal(5, stream.Stages.Count); + Assert.Equal(5, stream.CellIds.Count); + Assert.Equal(5, stream.ClipSlots.Count); + Assert.Equal(5, stream.Lights.Count); + Assert.Equal(5, stream.IndoorFlags.Count); + Assert.Equal(5, stream.Alphas.Count); + Assert.Equal(5, stream.SelectionLighting.Count); + Assert.Equal(5, stream.DetailCategories.Count); + } + + [Fact] + public void Append_PreservesEveryFieldAtItsIndex() + { + var stream = new OrderedDrawStream(); + OrderedDrawCommand[] commands = + [ + MakeCommand(0, WalkDrawStage.Terrain), + MakeCommand(1, WalkDrawStage.CellStatic), + MakeCommand(2, WalkDrawStage.BuildingShell), + ]; + + foreach (OrderedDrawCommand command in commands) + stream.Append(command); + + for (int i = 0; i < commands.Length; i++) + { + Assert.Equal(commands[i].Key, stream.Keys[i]); + Assert.Equal(commands[i].Transform, stream.Transforms[i]); + Assert.Equal(commands[i].Stage, stream.Stages[i]); + Assert.Equal(commands[i].CellId, stream.CellIds[i]); + Assert.Equal(commands[i].ClipSlot, stream.ClipSlots[i]); + Assert.Equal(commands[i].Lights, stream.Lights[i]); + Assert.Equal(commands[i].IndoorFlag, stream.IndoorFlags[i]); + Assert.Equal(commands[i].Alpha, stream.Alphas[i]); + Assert.Equal(commands[i].SelectionLighting, stream.SelectionLighting[i]); + Assert.Equal(commands[i].DetailCategory, stream.DetailCategories[i]); + } + } + + [Theory] + [InlineData(WalkDrawStage.Terrain)] + [InlineData(WalkDrawStage.CellStatic)] + [InlineData(WalkDrawStage.BuildingShell)] + [InlineData(WalkDrawStage.PortalPunch)] + [InlineData(WalkDrawStage.LookInStatic)] + [InlineData(WalkDrawStage.Dynamic)] + internal void Append_AcceptsEveryStageIncludingPortalPunch(WalkDrawStage stage) + { + // The stream itself is a dumb data structure — it accepts every stage + // unconditionally. Only the SUBMITTER rejects PortalPunch (see + // OrderPreservingSubmitterTests), so stage-separation gates can + // exercise the boundary at the stream level too. + var stream = new OrderedDrawStream(); + + stream.Append(MakeCommand(0, stage)); + + Assert.Equal(1, stream.Count); + Assert.Equal(stage, stream.Stages[0]); + } + + [Fact] + public void Reset_ClearsEveryParallelListToZeroCount() + { + var stream = new OrderedDrawStream(); + for (int i = 0; i < 7; i++) + stream.Append(MakeCommand(i)); + Assert.Equal(7, stream.Count); + + stream.Reset(); + + Assert.Equal(0, stream.Count); + Assert.Empty(stream.Keys); + Assert.Empty(stream.Transforms); + Assert.Empty(stream.Stages); + Assert.Empty(stream.CellIds); + Assert.Empty(stream.ClipSlots); + Assert.Empty(stream.Lights); + Assert.Empty(stream.IndoorFlags); + Assert.Empty(stream.Alphas); + Assert.Empty(stream.SelectionLighting); + Assert.Empty(stream.DetailCategories); + } + + [Fact] + public void Reset_ThenAppend_StartsAFreshInOrderSequence() + { + var stream = new OrderedDrawStream(); + stream.Append(MakeCommand(0, WalkDrawStage.Terrain)); + stream.Append(MakeCommand(1, WalkDrawStage.Terrain)); + stream.Reset(); + + stream.Append(MakeCommand(9, WalkDrawStage.Dynamic)); + + Assert.Equal(1, stream.Count); + Assert.Equal(WalkDrawStage.Dynamic, stream.Stages[0]); + Assert.Equal(0x8C040100u + 9u, stream.CellIds[0]); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/RetailFrameWalkTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/RetailFrameWalkTests.cs new file mode 100644 index 00000000..a969c34f --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/RetailFrameWalkTests.cs @@ -0,0 +1,225 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class RetailFrameWalkTests +{ + private sealed class Recorder : IWalkEventSink + { + public readonly List Events = new(); + public void Emit(in WalkEvent walkEvent) => Events.Add(walkEvent); + + public string Signature() + => string.Join("|", Events.Select(e => e.Kind switch + { + WalkEventKind.Landscape => "LS", + WalkEventKind.Building => $"BLD:{e.CellId:x8}", + WalkEventKind.DrawInside => $"DI:{e.CellId:x8}", + WalkEventKind.DrawCells => + $"DC:ov={e.OutsideViewCount}:{string.Join(',', e.Cells.Select(c => c.ToString("x8")))}", + _ => "?", + })); + } + + private sealed class Caster : IWalkRayCaster + { + public Vector3 RayThrough(float screenX, float screenY) + => new(screenX, screenY, 100f); + } + + private sealed class TestContext : IWalkFrameContext, IRetailFrameWalkContext + { + public readonly Dictionary Cells = new(); + private readonly Matrix4x4 _viewProj; + + public TestContext() + { + Matrix4x4 view = Matrix4x4.CreateLookAt( + Vector3.Zero, new Vector3(0, 0, -1), Vector3.UnitY); + Matrix4x4 proj = Matrix4x4.CreatePerspectiveFieldOfView(1.2f, 1f, 0.1f, 1000f); + _viewProj = view * proj; + } + + public Vector3 ViewpointIn(WalkCell cell) => Vector3.Zero; + public Matrix4x4 ObjectToClip(WalkCell cell) => _viewProj; + public WalkCell? GetVisible(uint cellId) => Cells.GetValueOrDefault(cellId); + public IWalkRayCaster Rays { get; } = new Caster(); + public Vector3 WorldViewpoint => Vector3.Zero; + public float ViewportWidth => 640f; + public float ViewportHeight => 480f; + + public Vector3 ViewpointInBuilding(WalkBuilding building) => Vector3.Zero; + public float ViewerDistanceTo(WalkBuilding building) => 0f; + public IWalkFrameContext CellContext => this; + // Permissive near plane: every column wholly inside. + public WalkPlane CyPlane => new(new Vector3(0, 0, 1), 0f); + public void SetActiveView(WalkPortalView views, int index) { } + + public int ClipBuildingPolygon( + WalkBuilding building, WalkPolygon polygon, int side, Span output) + => 0; // no BSP-driven look-ins in these composition fixtures + } + + private static WalkPolygon Quad(float z, bool facingViewer = true) => new() + { + Vertices = + [ + new Vector3(-0.5f, -0.5f, z), new Vector3(0.5f, -0.5f, z), + new Vector3(0.5f, 0.5f, z), new Vector3(-0.5f, 0.5f, z), + ], + Plane = new WalkPlane(new Vector3(0, 0, facingViewer ? 1f : -1f), facingViewer ? -z : z), + }; + + private static WalkLandscape Landscape3x3() + { + var landscape = new WalkLandscape + { + MidWidth = 3, + Blocks = new WalkLandBlock?[9], + ViewerBlockX = 1, + ViewerBlockY = 1, + ViewerCellX = 0, + ViewerCellY = 0, + }; + for (int i = 0; i < 9; i++) + { + landscape.Blocks[i] = new WalkLandBlock { MaxZ = 10f, MinZ = 0f }; + landscape.Blocks[i]!.EnsureCellArrays(); + } + return landscape; + } + + [Fact] + public void Outdoor_frame_emits_landscape_then_buildings_far_to_near() + { + var ctx = new TestContext(); + WalkLandscape landscape = Landscape3x3(); + // A building in ring-1 block (0,0), and two in the viewer block: + // one at the block's far corner, one at the viewer's closest cell. + var ringBuilding = new WalkBuilding { PositionCellId = 0xAAAA0001 }; + var farBuilding = new WalkBuilding { PositionCellId = 0xBBBB0002 }; + var nearBuilding = new WalkBuilding { PositionCellId = 0xCCCC0003 }; + landscape.Blocks[0]!.CellBuildings[0] = ringBuilding; // block (0,0) + WalkLandBlock viewerBlock = landscape.Blocks[1 * 3 + 1]!; + viewerBlock.CellBuildings[7 * 8 + 7] = farBuilding; // far corner cell + viewerBlock.CellBuildings[0] = nearBuilding; // the closest cell (viewer at 0,0) + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + // ViewCount == 0 exercises the CY-only visibility arm deterministically. + walk.DrawLandscape(landscape, new WalkPortalView(), ctx, recorder); + + Assert.Equal( + "LS|BLD:aaaa0001|BLD:bbbb0002|BLD:cccc0003", + recorder.Signature()); + } + + [Fact] + public void Degraded_building_still_emits_its_entry_event() + { + var ctx = new TestContext(); + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + var building = new WalkBuilding { PositionCellId = 0xF518002E, HasGeometry = false }; + + walk.DrawBuilding(building, new WalkPortalView(), ctx, recorder); + + Assert.Equal("BLD:f518002e", recorder.Signature()); + } + + [Fact] + public void Interior_frame_without_exit_views_skips_the_landscape() + { + var ctx = new TestContext(); + // One facing portal only: the flood stays in the cell, no exit view. + var cell = new WalkCell + { + CellId = 0xA9B40178, + Portals = [new WalkCellPortal + { + OtherCellId = 0xA9B40179, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + ctx.Cells[cell.CellId] = cell; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(cell.CellId, cell, Landscape3x3(), ctx, recorder); + + Assert.Equal("DI:a9b40178|DC:ov=0:a9b40178", recorder.Signature()); + } + + [Fact] + public void Interior_frame_with_an_exit_view_draws_the_landscape_through_it() + { + var ctx = new TestContext(); + var cell = new WalkCell + { + CellId = 0xA9B40150, + Portals = [new WalkCellPortal + { + OtherCellId = 0xFFFFFFFF, PolygonIndex = 0, PortalSide = 0, OtherPortalId = -1, + }], + PortalPolygons = [Quad(-2f)], + }; + ctx.Cells[cell.CellId] = cell; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + var landscape = new WalkLandscape + { + MidWidth = 1, + Blocks = new WalkLandBlock?[1], + ViewerBlockX = 0, + ViewerBlockY = 0, + }; + + walk.WalkFrame(cell.CellId, cell, landscape, ctx, recorder); + + Assert.Equal("DI:a9b40150|DC:ov=1:a9b40150|LS", recorder.Signature()); + } + + [Fact] + public void Outdoor_camera_cell_roots_the_landscape_walk() + { + var ctx = new TestContext(); + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + // Low word < 0x100 = an outdoor landcell id. + walk.WalkFrame(0xA9B40015, null, Landscape3x3(), ctx, recorder); + + Assert.StartsWith("LS", recorder.Signature()); + } + + [Fact] + public void View_state_unwinds_completely_after_an_interior_frame() + { + var ctx = new TestContext(); + var stabCell = new WalkCell { CellId = 0xA9B40151 }; + var cell = new WalkCell + { + CellId = 0xA9B40150, + StabList = [0xA9B40151u], + Portals = [new WalkCellPortal + { + OtherCellId = 0xA9B40151, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + stabCell.Portals = [new WalkCellPortal + { + OtherCellId = 0xA9B40150, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0, + }]; + stabCell.PortalPolygons = [Quad(-2f)]; + ctx.Cells[cell.CellId] = cell; + ctx.Cells[stabCell.CellId] = stabCell; + var walk = new RetailFrameWalk(); + + walk.WalkFrame(cell.CellId, cell, Landscape3x3(), ctx, new Recorder()); + + Assert.Equal(0, cell.NumView); + Assert.Equal(0, stabCell.NumView); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingJoinDiagnosticTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingJoinDiagnosticTests.cs new file mode 100644 index 00000000..98c00214 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingJoinDiagnosticTests.cs @@ -0,0 +1,78 @@ +using AcDream.App.Tests.Rendering; +using AcDream.App.Rendering.Walk; +using DatReaderWriter; +using DatReaderWriter.Options; +using System.Text; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// FW1 look-in adjudication instrument: retail's street-outdoor trace +/// punched look-ins ONLY at buildings a9b4001a (cells 16e,16a,16c) and +/// a9b40022 (164,162,167,169). This pins the data-side join: those cells +/// must be reachable through the respective building's portal table, and +/// every drawing-BSP PortalRef must index INTO that table. A failure +/// message carries the full dump for adjudication. +/// +[Trait("Lane", "InstalledDat")] +public sealed class WalkBuildingJoinDiagnosticTests +{ + [Theory] + [InlineData(0xA9B4001Au, new uint[] { 0xA9B4016Eu, 0xA9B4016Au, 0xA9B4016Cu })] + [InlineData(0xA9B40022u, new uint[] { 0xA9B40164u, 0xA9B40162u, 0xA9B40167u, 0xA9B40169u })] + public void Traced_lookin_cells_are_reachable_through_the_building_portal_table( + uint buildingCellId, uint[] tracedLookInCells) + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory."); + } + using var dats = new DatCollection(datDir!, DatAccessType.Read); + List entries = + WalkWorldDatAdapter.BuildBuildings(dats, 0xA9B40000u); + WalkBuilding building = Assert.Single( + entries, e => e.Building.PositionCellId == buildingCellId).Building; + + var dump = new StringBuilder(); + dump.AppendLine($"building {buildingCellId:x8}: {building.Portals.Length} portals"); + var directCells = new HashSet(); + for (int i = 0; i < building.Portals.Length; i++) + { + ref WalkBldPortal p = ref building.Portals[i]; + directCells.Add(p.OtherCellId); + dump.AppendLine( + $" portal[{i}]: side={p.PortalSide} exact={p.ExactMatch} " + + $"other={p.OtherCellId:x8} otherPortal={p.OtherPortalId} " + + $"stabs=[{string.Join(',', p.StabList.Select(s => s.ToString("x8")))}]"); + } + var bspJoins = new List(); + CollectPortalIndices(building.DrawingBsp, bspJoins); + dump.AppendLine($" BSP PortalRef indices: [{string.Join(',', bspJoins)}]"); + + // Every BSP portal ref must join into the portal table. + Assert.All(bspJoins, i => Assert.InRange(i, 0, building.Portals.Length - 1)); + + // Every traced look-in cell must be directly behind a portal or in a + // portal's stab list (the flood reaches deeper cells through those). + var reachable = new HashSet(directCells); + foreach (WalkBldPortal p in building.Portals) + foreach (uint stab in p.StabList) + reachable.Add(stab); + foreach (uint traced in tracedLookInCells) + { + Assert.True( + reachable.Contains(traced), + $"traced look-in cell {traced:x8} is not reachable\n{dump}"); + } + } + + private static void CollectPortalIndices(WalkBspNode? node, List into) + { + if (node is null) return; + if (node.InPortals is not null) + into.AddRange(node.InPortals.Select(p => p.PortalIndex)); + CollectPortalIndices(node.PosNode, into); + CollectPortalIndices(node.NegNode, into); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingPortalTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingPortalTests.cs new file mode 100644 index 00000000..ad790ba2 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingPortalTests.cs @@ -0,0 +1,218 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class WalkBuildingPortalTests +{ + private sealed class RecordingSink : WalkBuildingPortals.IWalkPortalPassSink + { + public readonly List Punches = new(); + public readonly List DrawCells = new(); + + public void OnPunch(WalkPolygon polygon) => Punches.Add(polygon); + + public void OnDrawCells(WalkPView pview) + => DrawCells.Add(pview.CellDrawList.Select(c => c.CellId).ToArray()); + } + + private sealed class Caster : IWalkRayCaster + { + public Vector3 RayThrough(float screenX, float screenY) + => new(screenX, screenY, 100f); + } + + private sealed class TestContext : IWalkFrameContext, IWalkBuildingFrameContext + { + public readonly Dictionary Cells = new(); + private readonly Matrix4x4 _viewProj; + private static readonly Vector2[] RootQuad = + [ + new(0, 480), new(640, 480), new(640, 0), new(0, 0), + ]; + + public TestContext() + { + Matrix4x4 view = Matrix4x4.CreateLookAt( + Vector3.Zero, new Vector3(0, 0, -1), Vector3.UnitY); + Matrix4x4 proj = Matrix4x4.CreatePerspectiveFieldOfView(1.2f, 1f, 0.1f, 1000f); + _viewProj = view * proj; + } + + public Vector3 ViewpointIn(WalkCell cell) => Vector3.Zero; + public Matrix4x4 ObjectToClip(WalkCell cell) => _viewProj; + public WalkCell? GetVisible(uint cellId) => Cells.GetValueOrDefault(cellId); + public IWalkRayCaster Rays { get; } = new Caster(); + public Vector3 WorldViewpoint => Vector3.Zero; + public float ViewportWidth => 640f; + public float ViewportHeight => 480f; + + public Vector3 ViewpointInBuilding(WalkBuilding building) => Vector3.Zero; + public float ViewerDistanceTo(WalkBuilding building) => 0f; + public IWalkFrameContext CellContext => this; + + public int ClipBuildingPolygon( + WalkBuilding building, WalkPolygon polygon, int side, Span output) + { + Span projected = stackalloc WalkScreenPoint[polygon.Vertices.Length]; + for (int i = 0; i < polygon.Vertices.Length; i++) + projected[i] = WalkScreenClip.TransformToScreen( + polygon.Vertices[i], _viewProj, ViewportWidth, ViewportHeight); + if (side != 0) + projected.Reverse(); + return WalkScreenClip.ClipAgainstView(projected, RootQuad, output); + } + } + + private static WalkPolygon Quad(float z, float half = 0.5f, bool facingViewer = true) => new() + { + Vertices = + [ + new Vector3(-half, -half, z), new Vector3(half, -half, z), + new Vector3(half, half, z), new Vector3(-half, half, z), + ], + Plane = new WalkPlane(new Vector3(0, 0, facingViewer ? 1f : -1f), facingViewer ? -z : z), + }; + + private static WalkBspNode PortalNode(WalkPlane plane, params WalkPortalRef[] portals) + => new() { SplittingPlane = plane, InPortals = portals }; + + // ---- the BSP portal-only walk ---- + + [Fact] + public void Bsp_walk_emits_the_far_side_first() + { + var farPortal = new WalkPortalRef { PortalIndex = 0, Polygon = Quad(-4f) }; + var nearPortal = new WalkPortalRef { PortalIndex = 1, Polygon = Quad(-2f) }; + // Splitting plane x = 0; viewer at x = +5 (side 0) → NEG child first. + var root = new WalkBspNode + { + SplittingPlane = new WalkPlane(new Vector3(1, 0, 0), 0f), + NegNode = PortalNode(new WalkPlane(new Vector3(0, 0, 1), 100f), farPortal), + PosNode = PortalNode(new WalkPlane(new Vector3(0, 0, 1), 100f), nearPortal), + }; + var emitted = new List(); + + WalkBuildingPortals.BuildDrawPortalsOnly( + root, 1, new Vector3(5, 0, 0), (p, _) => emitted.Add(p.PortalIndex)); + Assert.Equal(new[] { 0, 1 }, emitted); + + emitted.Clear(); + WalkBuildingPortals.BuildDrawPortalsOnly( + root, 1, new Vector3(-5, 0, 0), (p, _) => emitted.Add(p.PortalIndex)); + Assert.Equal(new[] { 1, 0 }, emitted); + } + + [Fact] + public void In_plane_portal_node_emits_nothing() + { + // BSPPORTAL::portal_draw_portals_only @0053d870, GHIDRA-verified + // 2026-08-30: |d| ≤ ε (side 2) visits POS and emits NOTHING; the + // NEGATIVE arm (side 1) is the one that emits. (A BN flag-mush + // re-read briefly swapped these arms and broke four fixtures — + // never swap them again without Ghidra + fixture proof.) + var portal = new WalkPortalRef { PortalIndex = 0, Polygon = Quad(-2f) }; + // Viewer exactly on the node's splitting plane (|d| <= epsilon). + WalkBspNode root = PortalNode(new WalkPlane(new Vector3(1, 0, 0), 0f), portal); + var emitted = new List(); + + WalkBuildingPortals.BuildDrawPortalsOnly( + root, 1, Vector3.Zero, (p, _) => emitted.Add(p.PortalIndex)); + + Assert.Empty(emitted); + } + + // ---- ConstructView(CBldPortal) + DrawPortal ---- + + private static (TestContext ctx, WalkBuilding building, WalkCell interior, WalkPortalRef portalRef) + BuildLookInFixture(int portalSide = 0) + { + var ctx = new TestContext(); + var interior = new WalkCell + { + CellId = 0x104, + Portals = [new WalkCellPortal + { + OtherCellId = 0xFFFFFFFF, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + ctx.Cells[interior.CellId] = interior; + var building = new WalkBuilding + { + PositionCellId = 0xA9B4000Fu, + Portals = + [ + new WalkBldPortal + { + PortalSide = portalSide, OtherCellId = 0x104, OtherPortalId = 0, + StabList = [0x104u], + }, + ], + }; + var portalRef = new WalkPortalRef { PortalIndex = 0, Polygon = Quad(-2f) }; + return (ctx, building, interior, portalRef); + } + + [Fact] + public void Pass_one_punches_and_appends_the_view_without_flooding() + { + (TestContext ctx, WalkBuilding building, WalkCell interior, WalkPortalRef portalRef) + = BuildLookInFixture(); + var pview = new WalkPView(); + var sink = new RecordingSink(); + + bool ok = WalkBuildingPortals.DrawPortal(pview, building, portalRef, 1, ctx, sink); + + Assert.True(ok); + Assert.Single(sink.Punches); + Assert.Empty(sink.DrawCells); + Assert.Empty(pview.CellDrawList); + Assert.Equal(0, interior.NumView); // stab views popped back + } + + [Fact] + public void Pass_two_floods_the_interior_and_emits_the_draw_cells_event() + { + (TestContext ctx, WalkBuilding building, WalkCell interior, WalkPortalRef portalRef) + = BuildLookInFixture(); + var pview = new WalkPView(); + var sink = new RecordingSink(); + + bool ok = WalkBuildingPortals.DrawPortal(pview, building, portalRef, 2, ctx, sink); + + Assert.True(ok); + Assert.Empty(sink.Punches); // pass 2 never draws the poly + Assert.Single(sink.DrawCells); + Assert.Equal(new[] { 0x104u }, sink.DrawCells[0]); + } + + [Fact] + public void Wrong_viewer_side_rejects_the_look_in() + { + // portal_side = 1 requires side NEGATIVE; the fixture eye computes + // side POSITIVE → rejected: no punch, no view, no flood. + (TestContext ctx, WalkBuilding building, WalkCell interior, WalkPortalRef portalRef) + = BuildLookInFixture(portalSide: 1); + var pview = new WalkPView(); + var sink = new RecordingSink(); + + Assert.False(WalkBuildingPortals.DrawPortal(pview, building, portalRef, 1, ctx, sink)); + Assert.Empty(sink.Punches); + Assert.Empty(sink.DrawCells); + } + + [Fact] + public void Unloaded_destination_skips_the_punch_silently() + { + (TestContext ctx, WalkBuilding building, WalkCell interior, WalkPortalRef portalRef) + = BuildLookInFixture(); + ctx.Cells.Remove(0x104); // destination not Visible + + var pview = new WalkPView(); + var sink = new RecordingSink(); + + Assert.False(WalkBuildingPortals.DrawPortal(pview, building, portalRef, 1, ctx, sink)); + Assert.Empty(sink.Punches); // no fallback seal on the outdoor path + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingRegistryTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingRegistryTests.cs new file mode 100644 index 00000000..84a50776 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkBuildingRegistryTests.cs @@ -0,0 +1,75 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// Campaign FW3.1 — hermetic (no DAT) coverage of the walk's +/// production building registry: landblock-keyed publish/retire and the +/// O(1) reverse index relies on. +public sealed class WalkBuildingRegistryTests +{ + private static WalkBuildingFactory.Entry Entry(uint positionCellId) => + new(new WalkBuilding { PositionCellId = positionCellId }, Matrix4x4.Identity, Matrix4x4.Identity); + + [Fact] + public void Publish_MakesBuildingsFindableByLandblockAndByReference() + { + var registry = new WalkBuildingRegistry(); + WalkBuildingFactory.Entry entry = Entry(0xA9B40001u); + + registry.Publish(0xA9B4FFFFu, new[] { entry }); + + Assert.Same(entry, Assert.Single(registry.GetBuildings(0xA9B40100u))); + Assert.True(registry.TryGetEntry(entry.Building, out var found)); + Assert.Same(entry, found); + Assert.Equal(1, registry.LandblockCount); + } + + [Fact] + public void Publish_ReplacesThePreviousLandblockAndDropsItsReverseIndexEntries() + { + var registry = new WalkBuildingRegistry(); + WalkBuildingFactory.Entry first = Entry(0xA9B40001u); + WalkBuildingFactory.Entry second = Entry(0xA9B40002u); + registry.Publish(0xA9B4FFFFu, new[] { first }); + + registry.Publish(0xA9B4FFFFu, new[] { second }); + + Assert.Same(second, Assert.Single(registry.GetBuildings(0xA9B4FFFFu))); + Assert.False(registry.TryGetEntry(first.Building, out _)); + Assert.True(registry.TryGetEntry(second.Building, out _)); + Assert.Equal(1, registry.LandblockCount); + } + + [Fact] + public void Retire_RemovesTheLandblockAndItsReverseIndexEntries() + { + var registry = new WalkBuildingRegistry(); + WalkBuildingFactory.Entry entry = Entry(0xA9B40001u); + registry.Publish(0xA9B4FFFFu, new[] { entry }); + + registry.Retire(0xA9B40100u); // any id sharing the landblock prefix + + Assert.Empty(registry.GetBuildings(0xA9B4FFFFu)); + Assert.False(registry.TryGetEntry(entry.Building, out _)); + Assert.Equal(0, registry.LandblockCount); + } + + [Fact] + public void Retire_UnknownLandblockIsANoOp() + { + var registry = new WalkBuildingRegistry(); + + registry.Retire(0xA9B4FFFFu); + + Assert.Equal(0, registry.LandblockCount); + } + + [Fact] + public void GetBuildings_UnpublishedLandblockReturnsEmpty() + { + var registry = new WalkBuildingRegistry(); + + Assert.Empty(registry.GetBuildings(0xA9B4FFFFu)); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkCopyViewTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkCopyViewTests.cs new file mode 100644 index 00000000..6d26600e --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkCopyViewTests.cs @@ -0,0 +1,163 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class WalkCopyViewTests +{ + private sealed class LinearRayCaster : IWalkRayCaster + { + public Vector3 RayThrough(float screenX, float screenY) + => new(screenX, screenY, 100f); + } + + private static readonly LinearRayCaster Rays = new(); + private static readonly Vector3 Eye = new(1f, 2f, 3f); + + private static WalkScreenPoint Pt(float x, float y, float w = 1f) + => new(x * w, y * w, 0f, w); + + [Fact] + public void Full_viewport_quad_appends_retails_root_view() + { + var dest = new WalkPortalView(); + + bool ok = WalkCopyView.AppendFullViewportQuad(dest, Rays, Eye, 640f, 480f); + + Assert.True(ok); + Assert.Equal(1, dest.ViewCount); + WalkViewPoly poly = dest.View.Polys[0]; + Assert.Equal(4, poly.VertexCount); + Assert.Equal(0, poly.VertexIndex); + Assert.Equal((0f, 640f, 0f, 480f), (poly.XMin, poly.XMax, poly.YMin, poly.YMax)); + // Vertex order (0,H)(W,H)(W,0)(0,0) + the closing duplicate. + Assert.Equal(new Vector2(0, 480), dest.View.Vertices[0].Point); + Assert.Equal(new Vector2(640, 480), dest.View.Vertices[1].Point); + Assert.Equal(new Vector2(640, 0), dest.View.Vertices[2].Point); + Assert.Equal(new Vector2(0, 0), dest.View.Vertices[3].Point); + Assert.Equal(dest.View.Vertices[0].Point, dest.View.Vertices[4].Point); + Assert.Equal(5, dest.View.VertexCountTotal); + } + + [Fact] + public void Collinear_midpoint_on_an_edge_is_pruned() + { + var dest = new WalkPortalView(); + Span square = + [ + Pt(0, 0), Pt(50, 0), Pt(100, 0), Pt(100, 100), Pt(0, 100), + ]; + + bool ok = WalkCopyView.Append(dest, square, Rays, Eye); + + Assert.True(ok); + Assert.Equal(4, dest.View.Polys[0].VertexCount); + Assert.Equal(new Vector2(0, 0), dest.View.Vertices[0].Point); + Assert.Equal(new Vector2(100, 0), dest.View.Vertices[1].Point); + Assert.Equal(new Vector2(100, 100), dest.View.Vertices[2].Point); + Assert.Equal(new Vector2(0, 100), dest.View.Vertices[3].Point); + } + + [Fact] + public void Near_duplicate_points_within_one_pixel_are_dropped() + { + var dest = new WalkPortalView(); + Span poly = + [ + Pt(0, 0), Pt(0.5f, 0.5f), Pt(100, 0), Pt(50, 100), + ]; + + bool ok = WalkCopyView.Append(dest, poly, Rays, Eye); + + Assert.True(ok); + Assert.Equal(3, dest.View.Polys[0].VertexCount); + } + + [Fact] + public void Fewer_than_three_survivors_reject_and_leave_dest_untouched() + { + var dest = new WalkPortalView(); + Span tiny = + [ + Pt(0, 0), Pt(0.5f, 0f), Pt(0f, 0.5f), + ]; + + bool ok = WalkCopyView.Append(dest, tiny, Rays, Eye); + + Assert.False(ok); + Assert.Equal(0, dest.ViewCount); + Assert.Empty(dest.View.Polys); + Assert.Empty(dest.View.Vertices); + Assert.Equal(0, dest.View.VertexCountTotal); + } + + [Fact] + public void Homogeneous_points_are_perspective_divided_before_storage() + { + var dest = new WalkPortalView(); + Span tri = + [ + Pt(0, 0, w: 2f), Pt(100, 0, w: 2f), Pt(50, 100, w: 2f), + ]; + + bool ok = WalkCopyView.Append(dest, tri, Rays, Eye); + + Assert.True(ok); + Assert.Equal(new Vector2(0, 0), dest.View.Vertices[0].Point); + Assert.Equal(new Vector2(100, 0), dest.View.Vertices[1].Point); + Assert.Equal(new Vector2(50, 100), dest.View.Vertices[2].Point); + } + + [Fact] + public void Edge_planes_are_next_cross_current_normalized_through_the_eye() + { + var dest = new WalkPortalView(); + Span tri = [Pt(0, 0), Pt(100, 0), Pt(50, 100)]; + + Assert.True(WalkCopyView.Append(dest, tri, Rays, Eye)); + + // Edge k starts at vertex k: plane N = normalize(cross(ray[k+1], ray[k])). + Vector3 ray0 = Rays.RayThrough(0, 0); + Vector3 ray1 = Rays.RayThrough(100, 0); + Vector3 expected = Vector3.Normalize(Vector3.Cross(ray1, ray0)); + WalkPlane plane = dest.View.Vertices[0].Plane; + Assert.Equal(expected.X, plane.Normal.X, 5); + Assert.Equal(expected.Y, plane.Normal.Y, 5); + Assert.Equal(expected.Z, plane.Normal.Z, 5); + Assert.Equal(-Vector3.Dot(expected, Eye), plane.D, 3); + } + + [Fact] + public void Pool_resets_when_view_count_returns_to_zero() + { + var dest = new WalkPortalView(); + Span tri = [Pt(0, 0), Pt(100, 0), Pt(50, 100)]; + Assert.True(WalkCopyView.Append(dest, tri, Rays, Eye)); + int firstTotal = dest.View.VertexCountTotal; + + dest.ResetForPush(); // curr_view_push: ViewCount back to 0 + Span tri2 = [Pt(0, 0), Pt(200, 0), Pt(100, 200)]; + Assert.True(WalkCopyView.Append(dest, tri2, Rays, Eye)); + + Assert.Equal(1, dest.ViewCount); + Assert.Single(dest.View.Polys); + Assert.Equal(firstTotal, dest.View.VertexCountTotal); // pool restarted at 0 + Assert.Equal(0, dest.View.Polys[0].VertexIndex); + } + + [Fact] + public void Second_append_extends_the_shared_pool() + { + var dest = new WalkPortalView(); + Span tri = [Pt(0, 0), Pt(100, 0), Pt(50, 100)]; + Assert.True(WalkCopyView.Append(dest, tri, Rays, Eye)); + Span tri2 = [Pt(0, 0), Pt(200, 0), Pt(100, 200)]; + + Assert.True(WalkCopyView.Append(dest, tri2, Rays, Eye)); + + Assert.Equal(2, dest.ViewCount); + Assert.Equal(2, dest.View.Polys.Count); + Assert.Equal(4, dest.View.Polys[1].VertexIndex); // after tri's 3 + dup + Assert.Equal(8, dest.View.VertexCountTotal); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkFrameDriverTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkFrameDriverTests.cs new file mode 100644 index 00000000..6c88a97e --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkFrameDriverTests.cs @@ -0,0 +1,871 @@ +using System.Collections.Concurrent; +using System.Collections.ObjectModel; +using System.Diagnostics.CodeAnalysis; +using System.Numerics; +using System.Reflection; +using AcDream.App.Rendering; +using AcDream.App.Rendering.Gpu; +using AcDream.App.Rendering.Gpu.Vk; +using AcDream.App.Rendering.Scene; +using AcDream.App.Rendering.Wb; +using AcDream.App.Rendering.Walk; +using AcDream.App.Tests.Rendering.Gpu; +using AcDream.Content; +using AcDream.Core.Meshing; +using AcDream.Core.World; +using DatReaderWriter; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Enums; +using DatReaderWriter.Lib.IO; +using Microsoft.Extensions.Logging.Abstractions; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Campaign FW stage FW3.2b-1: 's headless +/// referee suite — proves that driving with the +/// driver as its produces retail's own turn +/// order (shell-then-contents per cell, flush-before-every-leaf-action, +/// content-before-punch) through the REAL +/// onto a — never a mock of the submission +/// path itself. No production wiring is exercised (WorldSceneRenderer +/// still does not construct this driver); every world-data/leaf-renderer +/// dependency here is a synthetic fake per plan §FW3.2b-1. +/// +public sealed class WalkFrameDriverTests +{ + // ── Shared ordered log: BOTH the fake leaf renderer and the fake trace + // write into ONE list, so a single sequence assertion proves the FULL + // interleave (stream flushes interleaved with sky/terrain/shell/punch/ + // alpha-barrier), not just each half in isolation. ───────────────────── + + private sealed class RecordingLeafRenderer(List log) : IWalkFrameLeafRenderer + { + public readonly List Punches = new(); + + public void DrawSky() => log.Add("SKY"); + + public void DrawTerrainSlice(int sliceIndex) => log.Add($"TERRAIN:{sliceIndex}"); + + public void DrawCellShell(uint cellId) => log.Add($"SHELL:{cellId:x8}"); + + public void ClearInteriorDepth() => log.Add("CLEAR"); + + public void DrawExitSeals() => log.Add("SEALS"); + + public void DrawPunchFan(WalkPolygon worldPolygon, int activeViewIndex) + { + Punches.Add(worldPolygon); + log.Add($"PUNCH:{worldPolygon.Vertices.Length}@v{activeViewIndex}"); + } + + public void AlphaBarrier(float viewerDistance) => log.Add($"ALPHA:{viewerDistance:F2}"); + + public void DrawStaticParticles(IReadOnlySet ownerIds) + { + var sorted = new List(ownerIds); + sorted.Sort(); + log.Add($"PARTICLES:{string.Join(",", sorted.ConvertAll(o => o.ToString("x")))}"); + } + } + + private sealed class RecordingTrace(List log) : IWalkFrameDriverTrace + { + public void OnFlush(int commandCount, IReadOnlyList stages) => + log.Add($"FLUSH:{commandCount}:{string.Join(',', stages.Distinct())}"); + } + + private sealed class FakeWorldData : IWalkFrameWorldData + { + public readonly Dictionary CellStaticsByCell = new(); + public readonly Dictionary OutdoorStaticsByCell = new(); + public readonly Dictionary ShellByBuilding = new(); + public readonly Dictionary WorldTransformByBuilding = new(); + + public WalkFrameStaticRecords GetCellStatics(uint cellId) => + CellStaticsByCell.GetValueOrDefault(cellId, WalkFrameStaticRecords.Empty); + + public WalkFrameStaticRecords GetOutdoorStatics(uint cellId) => + OutdoorStaticsByCell.GetValueOrDefault(cellId, WalkFrameStaticRecords.Empty); + + public WalkFrameStaticRecords GetBuildingShellStatics(WalkBuilding building) => + ShellByBuilding.GetValueOrDefault(building, WalkFrameStaticRecords.Empty); + + public Matrix4x4 GetBuildingWorldTransform(WalkBuilding building) => + WorldTransformByBuilding.GetValueOrDefault(building, Matrix4x4.Identity); + } + + // ── The walk-level test context (interior flood + building portal pass) ─ + + private sealed class Caster : IWalkRayCaster + { + public Vector3 RayThrough(float screenX, float screenY) => new(screenX, screenY, 100f); + } + + private sealed class TestContext : IWalkFrameContext, IRetailFrameWalkContext + { + public readonly Dictionary Cells = new(); + public readonly Dictionary ViewerDistances = new(); + private readonly Matrix4x4 _viewProj; + private static readonly Vector2[] RootQuad = + [ + new(0, 480), new(640, 480), new(640, 0), new(0, 0), + ]; + + public TestContext() + { + Matrix4x4 view = Matrix4x4.CreateLookAt( + Vector3.Zero, new Vector3(0, 0, -1), Vector3.UnitY); + Matrix4x4 proj = Matrix4x4.CreatePerspectiveFieldOfView(1.2f, 1f, 0.1f, 1000f); + _viewProj = view * proj; + } + + public Vector3 ViewpointIn(WalkCell cell) => Vector3.Zero; + public Matrix4x4 ObjectToClip(WalkCell cell) => _viewProj; + public WalkCell? GetVisible(uint cellId) => Cells.GetValueOrDefault(cellId); + public IWalkRayCaster Rays { get; } = new Caster(); + public Vector3 WorldViewpoint => Vector3.Zero; + public float ViewportWidth => 640f; + public float ViewportHeight => 480f; + + public Vector3 ViewpointInBuilding(WalkBuilding building) => Vector3.Zero; + + public float ViewerDistanceTo(WalkBuilding building) => + ViewerDistances.GetValueOrDefault(building, 0f); + + public IWalkFrameContext CellContext => this; + public WalkPlane CyPlane => new(new Vector3(0, 0, 1), 0f); + public void SetActiveView(WalkPortalView views, int index) { } + + public int ClipBuildingPolygon( + WalkBuilding building, WalkPolygon polygon, int side, Span output) + { + Span projected = stackalloc WalkScreenPoint[polygon.Vertices.Length]; + for (int i = 0; i < polygon.Vertices.Length; i++) + projected[i] = WalkScreenClip.TransformToScreen( + polygon.Vertices[i], _viewProj, ViewportWidth, ViewportHeight); + if (side != 0) + projected.Reverse(); + return WalkScreenClip.ClipAgainstView(projected, RootQuad, output); + } + } + + private static WalkPolygon Quad(float z, bool facingViewer = true) => new() + { + Vertices = + [ + new Vector3(-0.5f, -0.5f, z), new Vector3(0.5f, -0.5f, z), + new Vector3(0.5f, 0.5f, z), new Vector3(-0.5f, 0.5f, z), + ], + Plane = new WalkPlane(new Vector3(0, 0, facingViewer ? 1f : -1f), facingViewer ? -z : z), + }; + + // ── Deliverable: RunFrame drives an interior two-cell flood; shell + // precedes contents per cell, and a flush happens exactly at the point + // the NEXT cell's shell needs the stream clear (never before, never + // batched across cells within this stage's turn-by-turn discipline). ── + + // ── Deliverable (2026-08-30 decomp correction): PView::DrawCells + // @0x005a4840's actual DRAW order for an interior root's OWN flood is + // NOT the order its DrawInside/DrawCells EVENTS fire in (breakpoint- + // entry order, matching the FW0 oracle traces) — retail draws + // LScape::draw FIRST (pc:432719, only when exit views survived), then + // the depth clear (pc:432731-432732), then the exit-portal seals + // (pc:432785-432786), and ONLY THEN the flood's own cells far-to-near. + // This case has a surviving exit view (ov=1): DC records the flood list + // (no draw), the landscape turn runs (flush no-op, sky, terrain), THEN + // clear, seals, and the two flood cells shell-then-contents. ────────── + + [Fact] + public void RunFrame_InteriorFloodWithExitView_DrawsLandscapeThenClearSealsThenFloodCells() + { + using var fx = new DispatcherFixture(); + var log = new List(); + const ulong gfxObjA = 0x0200_0001UL; + const ulong gfxObjB = 0x0200_0002UL; + InjectRenderData(fx.Manager, gfxObjA, MakeFlatMesh( + MakeBatch(0x08100001u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + InjectRenderData(fx.Manager, gfxObjB, MakeFlatMesh( + MakeBatch(0x08100002u, TranslucencyKind.Opaque, 3, 4, 3, 2))); + + var ctx = new TestContext(); + var cell1 = new WalkCell + { + CellId = 0x100, + StabList = [0x101u], + Portals = + [ + new WalkCellPortal + { + OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0, + }, + // The exit portal (retail's "world beyond the door") — this + // is what raises ov to 1 and makes DrawInside run the + // landscape turn before clear+seals+the flood cells. + new WalkCellPortal + { + OtherCellId = 0xFFFFFFFF, PolygonIndex = 1, PortalSide = 0, OtherPortalId = -1, + }, + ], + PortalPolygons = [Quad(-2f), Quad(-3f)], + }; + var cell2 = new WalkCell + { + CellId = 0x101, + Portals = [new WalkCellPortal + { + OtherCellId = 0x100, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + ctx.Cells[cell1.CellId] = cell1; + ctx.Cells[cell2.CellId] = cell2; + + var worldData = new FakeWorldData(); + worldData.CellStaticsByCell[0x100] = new WalkFrameStaticRecords( + new[] { MakeRecord(101, 0, Vector3.Zero, [new MeshRef((uint)gfxObjA, Matrix4x4.Identity)]) }, 0x8C04u); + worldData.CellStaticsByCell[0x101] = new WalkFrameStaticRecords( + new[] { MakeRecord(102, 0, Vector3.Zero, [new MeshRef((uint)gfxObjB, Matrix4x4.Identity)]) }, 0x8C04u); + + var leaf = new RecordingLeafRenderer(log); + var trace = new RecordingTrace(log); + var driver = new WalkFrameDriver(fx.Dispatcher, leaf, worldData, trace); + var walk = new RetailFrameWalk(); + // A minimal, no-op landscape (1x1 window, the one slot unpublished) + // — matches RetailFrameWalkTests' own exit-view fixture. LScape::draw + // still runs its full turn (sky/terrain) against it; there's simply + // nothing published to iterate blocks/cells/buildings for. + var landscape = new WalkLandscape { MidWidth = 1, Blocks = new WalkLandBlock?[1] }; + + using DrawScope draw = fx.BeginDraw(); + driver.RunFrame( + walk, cameraCellId: cell1.CellId, cameraCell: cell1, landscape: landscape, + ctx, draw.Frame, draw.Pass, Matrix4x4.Identity, cameraWorldPosition: Vector3.Zero); + + Assert.Equal( + new[] + { + "SKY", "TERRAIN:0", "CLEAR", "SEALS", + "SHELL:00000100", "FLUSH:1:CellStatic", "SHELL:00000101", "FLUSH:1:CellStatic", + }, + log); + + List mdiCalls = + [.. fx.Device.Calls.OfType()]; + Assert.Equal(2, mdiCalls.Count); + Assert.All(mdiCalls, c => Assert.Equal(1u, c.DrawCount)); + // Nothing dropped: every populated record reached exactly one indirect draw. + Assert.Equal(2, mdiCalls.Sum(c => (int)c.DrawCount)); + } + + // ── Deliverable: the ov==0 interior case — no exit view survives, so + // DrawInside never runs the landscape turn at all; retail's clear+seals + // still run unconditionally for the interior root's own flood, straight + // after the (draw-nothing) DC event. ─────────────────────────────────── + + [Fact] + public void RunFrame_InteriorFloodWithNoExitView_SkipsLandscapeButStillClearsAndSeals() + { + using var fx = new DispatcherFixture(); + var log = new List(); + const ulong gfxObjA = 0x0200_0003UL; + const ulong gfxObjB = 0x0200_0004UL; + InjectRenderData(fx.Manager, gfxObjA, MakeFlatMesh( + MakeBatch(0x08100003u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + InjectRenderData(fx.Manager, gfxObjB, MakeFlatMesh( + MakeBatch(0x08100004u, TranslucencyKind.Opaque, 3, 4, 3, 2))); + + var ctx = new TestContext(); + var cell1 = new WalkCell + { + CellId = 0x100, + StabList = [0x101u], + Portals = [new WalkCellPortal + { + OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + var cell2 = new WalkCell + { + CellId = 0x101, + Portals = [new WalkCellPortal + { + OtherCellId = 0x100, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + ctx.Cells[cell1.CellId] = cell1; + ctx.Cells[cell2.CellId] = cell2; + + var worldData = new FakeWorldData(); + worldData.CellStaticsByCell[0x100] = new WalkFrameStaticRecords( + new[] { MakeRecord(101, 0, Vector3.Zero, [new MeshRef((uint)gfxObjA, Matrix4x4.Identity)]) }, 0x8C04u); + worldData.CellStaticsByCell[0x101] = new WalkFrameStaticRecords( + new[] { MakeRecord(102, 0, Vector3.Zero, [new MeshRef((uint)gfxObjB, Matrix4x4.Identity)]) }, 0x8C04u); + + var leaf = new RecordingLeafRenderer(log); + var trace = new RecordingTrace(log); + var driver = new WalkFrameDriver(fx.Dispatcher, leaf, worldData, trace); + var walk = new RetailFrameWalk(); + + using DrawScope draw = fx.BeginDraw(); + driver.RunFrame( + walk, cameraCellId: cell1.CellId, cameraCell: cell1, landscape: new WalkLandscape(), + ctx, draw.Frame, draw.Pass, Matrix4x4.Identity, cameraWorldPosition: Vector3.Zero); + + // No SKY/TERRAIN — ov==0 means DrawInside never calls DrawLandscape + // at all — but CLEAR/SEALS still fire unconditionally. + Assert.Equal( + new[] { "CLEAR", "SEALS", "SHELL:00000100", "FLUSH:1:CellStatic", "SHELL:00000101", "FLUSH:1:CellStatic" }, + log); + + List mdiCalls = + [.. fx.Device.Calls.OfType()]; + Assert.Equal(2, mdiCalls.Count); + Assert.All(mdiCalls, c => Assert.Equal(1u, c.DrawCount)); + // Nothing dropped: every populated record reached exactly one indirect draw. + Assert.Equal(2, mdiCalls.Sum(c => (int)c.DrawCount)); + } + + // ── Deliverable: a building turn's alpha barrier precedes its portal + // pass (retail RenderDeviceD3D::DrawBuilding @0x0059f2a0: + // FlushAlphaList(0f) -> CPhysicsPart::Draw(parts,1) [the portal walk] + // -> CPhysicsPart::Draw(parts,0) [the shell] @0x0059f30b-0x0059f345); + // the punch pass runs with nothing of THIS building's own queued yet + // (the shell is not appended until the whole portal pass completes); + // the look-in DC turn draws shell-then-contents exactly like an ordinary + // interior flood; the building's own shell content is appended and + // flushed only AFTER the portal pass, at frame end; and the punch + // polygon reaches the leaf renderer transformed building-local -> + // world. ───────────────────────────────────────────────────────────── + + [Fact] + public void BeginEndFrame_BuildingTurnWithPunchAndLookIn_OrdersAlphaBarrierPortalPassThenShell() + { + using var fx = new DispatcherFixture(); + var log = new List(); + const ulong shellGfxObj = 0x0200_0010UL; + const ulong interiorGfxObj = 0x0200_0011UL; + InjectRenderData(fx.Manager, shellGfxObj, MakeFlatMesh( + MakeBatch(0x08100010u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + InjectRenderData(fx.Manager, interiorGfxObj, MakeFlatMesh( + MakeBatch(0x08100011u, TranslucencyKind.Opaque, 3, 4, 3, 2))); + + var ctx = new TestContext(); + var interior = new WalkCell + { + CellId = 0x104, + Portals = [new WalkCellPortal + { + OtherCellId = 0xFFFFFFFF, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0, + }], + PortalPolygons = [Quad(-2f)], + }; + ctx.Cells[interior.CellId] = interior; + + var building = new WalkBuilding + { + PositionCellId = 0xA9B4000Fu, + Portals = + [ + new WalkBldPortal + { + PortalSide = 0, OtherCellId = 0x104, OtherPortalId = 0, + StabList = [0x104u], + }, + ], + // Viewpoint (0,0,0) is on the NEGATIVE side of this splitting + // plane (d=-5): the single PORT node's side==1 arm emits its + // portal exactly once per pass (WalkBuildingPortals.Walk). + DrawingBsp = new WalkBspNode + { + SplittingPlane = new WalkPlane(new Vector3(1, 0, 0), -5f), + InPortals = [new WalkPortalRef { PortalIndex = 0, Polygon = Quad(-2f) }], + }, + }; + ctx.ViewerDistances[building] = 12.5f; + + var worldData = new FakeWorldData(); + worldData.ShellByBuilding[building] = new WalkFrameStaticRecords( + new[] { MakeRecord(201, 0, Vector3.Zero, [new MeshRef((uint)shellGfxObj, Matrix4x4.Identity)]) }, 0x8C04u); + worldData.CellStaticsByCell[0x104] = new WalkFrameStaticRecords( + new[] { MakeRecord(202, 0, Vector3.Zero, [new MeshRef((uint)interiorGfxObj, Matrix4x4.Identity)]) }, 0x8C04u); + Matrix4x4 buildingWorld = Matrix4x4.CreateTranslation(10f, 0f, 0f); + worldData.WorldTransformByBuilding[building] = buildingWorld; + + var leaf = new RecordingLeafRenderer(log); + var trace = new RecordingTrace(log); + var driver = new WalkFrameDriver(fx.Dispatcher, leaf, worldData, trace); + var walk = new RetailFrameWalk(); + + var activeView = new WalkPortalView(); + activeView.ResetForPush(); + WalkCopyView.AppendFullViewportQuad( + activeView, ctx.Rays, ctx.WorldViewpoint, ctx.ViewportWidth, ctx.ViewportHeight); + Assert.Equal(1, activeView.ViewCount); + + using DrawScope draw = fx.BeginDraw(); + driver.BeginFrame(ctx, Matrix4x4.Identity, Vector3.Zero); + walk.DrawBuilding(building, activeView, ctx, driver); + driver.EndFrame(); + driver.Replay(draw.Frame, draw.Pass); + + Assert.Equal( + // FW4 #132 positional invariant: the building's shell emitters + // submit at the shell turn, after the shell content flushes. + new[] + { + "ALPHA:12.50", "PUNCH:4@v0", "SHELL:00000104", + "FLUSH:1:LookInStatic", "FLUSH:1:BuildingShell", "PARTICLES:c9", + }, + log); + + // The punch polygon reached the leaf renderer in WORLD space: the + // building-local Quad(-2f) vertex (-0.5,-0.5,-2) translates by + // (10,0,0) under the caller-supplied building world transform. + WalkPolygon punch = Assert.Single(leaf.Punches); + Assert.Equal(new Vector3(9.5f, -0.5f, -2f), punch.Vertices[0]); + + List mdiCalls = + [.. fx.Device.Calls.OfType()]; + Assert.Equal(2, mdiCalls.Count); + Assert.Equal(2, mdiCalls.Sum(c => (int)c.DrawCount)); + } + + // ── Fail-loud: a DrawCells turn with no preceding DrawInside/Building + // turn is a walk/driver desync, not a silent skip. ───────────────────── + + [Fact] + public void Emit_DrawCellsBeforeAnyDrawInsideOrBuildingTurn_ThrowsRatherThanSilentlyDropping() + { + using var fx = new DispatcherFixture(); + var log = new List(); + var ctx = new TestContext(); + var driver = new WalkFrameDriver(fx.Dispatcher, new RecordingLeafRenderer(log), new FakeWorldData()); + + using DrawScope draw = fx.BeginDraw(); + driver.BeginFrame(ctx, Matrix4x4.Identity, Vector3.Zero); + + Assert.Throws( + () => ((IWalkEventSink)driver).Emit(WalkEvent.DrawCells(0, [0x100u]))); + } + + // ── Fail-loud: BeginFrame is not re-entrant. ──────────────────────────── + + [Fact] + public void BeginFrame_CalledWhileAFrameIsAlreadyOpen_Throws() + { + using var fx = new DispatcherFixture(); + var log = new List(); + var ctx = new TestContext(); + var driver = new WalkFrameDriver(fx.Dispatcher, new RecordingLeafRenderer(log), new FakeWorldData()); + + using DrawScope draw = fx.BeginDraw(); + driver.BeginFrame(ctx, Matrix4x4.Identity, Vector3.Zero); + + Assert.Throws( + () => driver.BeginFrame( + ctx, Matrix4x4.Identity, Vector3.Zero)); + + driver.EndFrame(); + // EndFrame cleared the open-frame guard: BeginFrame is usable again. + driver.BeginFrame(ctx, Matrix4x4.Identity, Vector3.Zero); + driver.EndFrame(); + } + + // ── Campaign FW3.4a fail-loud: Replay without a completed Collect (no + // BeginFrame/EndFrame at all, or BeginFrame with no matching EndFrame) + // has nothing recorded to draw — throw rather than silently drawing + // nothing, which would look like an empty frame instead of a misuse. ── + + [Fact] + public void Replay_WithNoPrecedingCollect_Throws() + { + using var fx = new DispatcherFixture(); + var log = new List(); + var driver = new WalkFrameDriver(fx.Dispatcher, new RecordingLeafRenderer(log), new FakeWorldData()); + + using DrawScope draw = fx.BeginDraw(); + Assert.Throws(() => driver.Replay(draw.Frame, draw.Pass)); + } + + [Fact] + public void Replay_WhileCollectIsStillOpen_Throws() + { + using var fx = new DispatcherFixture(); + var log = new List(); + var ctx = new TestContext(); + var driver = new WalkFrameDriver(fx.Dispatcher, new RecordingLeafRenderer(log), new FakeWorldData()); + + using DrawScope draw = fx.BeginDraw(); + driver.BeginFrame(ctx, Matrix4x4.Identity, Vector3.Zero); + + Assert.Throws(() => driver.Replay(draw.Frame, draw.Pass)); + } + + // ── Deliverable: Collect + Replay called as the SPLIT PAIR (never + // RunFrame) — the shape RetailPViewRenderer uses, since it must run other + // frame work (PrepareCellBatches/BuildAndBorrow) between the two. Proves + // the pair alone — with no GPU work happening until Replay — reproduces + // the same turn order RunFrame's combined call would. ────────────────── + + [Fact] + public void CollectThenReplay_AsSeparateCalls_PerformsNoGpuWorkUntilReplay() + { + using var fx = new DispatcherFixture(); + var log = new List(); + var ctx = new TestContext(); + var driver = new WalkFrameDriver( + fx.Dispatcher, new RecordingLeafRenderer(log), new FakeWorldData(), new RecordingTrace(log)); + var walk = new RetailFrameWalk(); + // Outdoor root (camera cell low word < 0x100): a minimal, no-op + // landscape — LScape::draw still runs its sky/terrain turn against + // it even though nothing is published to walk cells/buildings for. + var landscape = new WalkLandscape { MidWidth = 1, Blocks = new WalkLandBlock?[1] }; + + using DrawScope draw = fx.BeginDraw(); + driver.Collect( + walk, cameraCellId: 0u, cameraCell: null, landscape, ctx, + Matrix4x4.Identity, cameraWorldPosition: Vector3.Zero); + + // No GPU calls at all yet — Collect is CPU-only. + Assert.Empty(log); + Assert.Empty(fx.Device.Calls); + + driver.Replay(draw.Frame, draw.Pass); + + Assert.Equal(new[] { "SKY", "TERRAIN:0" }, log); + } + + // ── Deliverable: an outdoor landscape-cell turn with no building appends + // straight to the stream (no shell call — outdoor cells have no EnvCell + // shell), and the accumulated content flushes at frame end. ─────────── + + [Fact] + public void OnLandscapeCellTurn_AppendsOutdoorStaticsWithNoShellCallAndFlushesAtFrameEnd() + { + using var fx = new DispatcherFixture(); + var log = new List(); + const ulong gfxObj = 0x0200_0020UL; + InjectRenderData(fx.Manager, gfxObj, MakeFlatMesh( + MakeBatch(0x08100020u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + + var ctx = new TestContext(); + var worldData = new FakeWorldData(); + worldData.OutdoorStaticsByCell[0x8C040005u] = new WalkFrameStaticRecords( + new[] { MakeRecord(301, 0, Vector3.Zero, [new MeshRef((uint)gfxObj, Matrix4x4.Identity)]) }, 0x8C04u); + + var driver = new WalkFrameDriver( + fx.Dispatcher, new RecordingLeafRenderer(log), worldData, new RecordingTrace(log)); + + using DrawScope draw = fx.BeginDraw(); + driver.BeginFrame(ctx, Matrix4x4.Identity, Vector3.Zero); + ((IWalkEventSink)driver).OnLandscapeCellTurn(0x8C040005u); + Assert.Empty(log); // no GPU work at Collect time; nothing recorded to the log yet + driver.EndFrame(); + Assert.Empty(log); // still nothing — EndFrame closes Collect, it does not Replay + driver.Replay(draw.Frame, draw.Pass); + + // FW4 #132 positional invariant: the cell's emitters submit at its + // own landscape turn, after its meshes flush. + Assert.Equal(new[] { "FLUSH:1:OutdoorStatic", "PARTICLES:12d" }, log); + GpuRecordedMultiDrawIndirect mdi = Assert.Single(fx.Device.Calls.OfType()); + Assert.Equal(1u, mdi.DrawCount); + } + + // ── Fixture (mirrors WalkStaticStreamPopulatorTests' DispatcherFixture — + // FW3.2a's own referee) ───────────────────────────────────────────────── + + private static RenderProjectionRecord MakeRecord( + uint localEntityId, + uint serverGuid, + Vector3 position, + IReadOnlyList meshRefs, + bool isBuildingShell = false, + uint parentCellId = 0u) => + new( + Id: RenderProjectionId.FromRaw(localEntityId), + ProjectionClass: RenderProjectionClass.OutdoorStatic, + OwnerIncarnation: RenderOwnerIncarnation.FromRaw(1), + Transform: new RenderTransform(Matrix4x4.CreateTranslation(position)), + PreviousTransform: default, + MeshSet: default, + Material: default, + Residency: default, + Bounds: default, + Flags: RenderProjectionFlags.Draw, + DegradeState: default, + SortKey: new RenderSortKey(0), + DirtyMask: default, + Source: new RenderSourceMetadata( + LocalEntityId: localEntityId, + ServerGuid: serverGuid, + SourceId: 0, + ParentCellId: parentCellId, + EffectCellId: 0, + BuildingShellAnchorCellId: 0, + TransformFingerprint: default, + GeometryFingerprint: default, + AppearanceFingerprint: default), + EntityPayload: new RenderEntityPayload( + MeshRefs: meshRefs, + PaletteOverride: null, + IsBuildingShell: isBuildingShell)); + + private static ObjectRenderBatch MakeBatch( + uint surfaceId, + TranslucencyKind translucency, + uint firstIndex, + int baseVertex, + int indexCount, + uint textureSlotIndex, + uint textureLayer = 0, + CullMode cullMode = CullMode.CounterClockwise) => + new() + { + Key = new TextureKey { SurfaceId = surfaceId, IsSolid = false }, + Translucency = translucency, + FirstIndex = firstIndex, + BaseVertex = (uint)baseVertex, + IndexCount = indexCount, + TextureSlot = new GpuTextureSlot(textureSlotIndex), + TextureIndex = (int)textureLayer, + }; + + private static ObjectRenderData MakeFlatMesh(params ObjectRenderBatch[] batches) => + new() { Batches = new List(batches) }; + + private static void InjectRenderData(ObjectMeshManager manager, ulong id, ObjectRenderData data) + { + FieldInfo field = typeof(ObjectMeshManager).GetField( + "_renderData", BindingFlags.NonPublic | BindingFlags.Instance) + ?? throw new InvalidOperationException( + "ObjectMeshManager._renderData field not found — test relies on this exact name."); + var dict = (ConcurrentDictionary)field.GetValue(manager)!; + dict[id] = data; + } + + private readonly struct DrawScope : IDisposable + { + private readonly IDisposable _publication; + private readonly IGpuPassEncoder _pass; + + public DrawScope(IGpuFrame frame, IGpuPassEncoder pass, IDisposable publication) + { + Frame = frame; + _pass = pass; + _publication = publication; + } + + public IGpuFrame Frame { get; } + + public IGpuPassEncoder Pass => _pass; + + public void Dispose() + { + _publication.Dispose(); + _pass.Dispose(); + } + } + + private sealed class DispatcherFixture : IDisposable + { + private readonly WbMeshAdapter _meshAdapter; + private readonly TextureCache _textures; + + public DispatcherFixture() + { + Device = new RecordingGpuDevice(); + FrameLifetime = new GpuDeviceFrameLifetime(Device); + Scope = new VulkanWorldPassScope(sampleCount: 1); + _textures = new TextureCache(Device, new NoopDatReaderWriter()); + _meshAdapter = new WbMeshAdapter( + Device, + new NoopDatReaderWriter(), + new NullPreparedAssetSource(), + NullLogger.Instance, + Device.Retirement); + var entitySpawnAdapter = new EntitySpawnAdapter( + _textures, + _ => throw new NotSupportedException("Not exercised by these tests.")); + + Dispatcher = new WbDrawDispatcher( + Device, + FrameLifetime, + Scope, + _textures, + _meshAdapter, + entitySpawnAdapter, + new EntityClassificationCache(), + new AcDream.Core.Rendering.TranslucencyFadeManager()); + } + + public RecordingGpuDevice Device { get; } + + public GpuDeviceFrameLifetime FrameLifetime { get; } + + public VulkanWorldPassScope Scope { get; } + + public WbDrawDispatcher Dispatcher { get; } + + public ObjectMeshManager Manager => _meshAdapter.MeshManager!; + + public DrawScope BeginDraw() + { + FrameLifetime.BeginFrame(); + IGpuFrame frame = FrameLifetime.CurrentFrame!; + IGpuPassEncoder pass = frame.BeginPass( + GpuPassDescription.BackbufferClear( + "fw3-2b-1-walk-frame-driver-test", Vector4.Zero, sampleCount: 1)); + IDisposable publication = Scope.Publish(pass); + Device.Clear(); + return new DrawScope(frame, pass, publication); + } + + public void Dispose() + { + Dispatcher.Dispose(); + _meshAdapter.Dispose(); + _textures.Dispose(); + Device.Dispose(); + } + } + + private sealed class NullPreparedAssetSource : IPreparedAssetSource + { + public PreparedAssetSourceStats Stats => default; + + public CacheStats DecodedTextureCacheStats => default; + + public PreparedAssetPresence Probe( + AcDream.Content.Pak.PakAssetType type, + uint sourceFileId) => + PreparedAssetPresence.Missing; + + public PreparedAssetReadResult Read( + in PreparedAssetRequest request, + CancellationToken cancellationToken = default) => + PreparedAssetReadResult.Missing; + + public void Dispose() + { + } + } + + private sealed class NoopDatReaderWriter : IDatReaderWriter + { + private readonly StubDatabase _portal = new(); + private readonly StubDatabase _highRes = new(); + private readonly StubDatabase _language = new(); + private readonly StubDatabase _cell = new(); + + public string SourceDirectory => string.Empty; + + public IDatDatabase Portal => _portal; + + public IDatDatabase Cell => _cell; + + public ReadOnlyDictionary CellRegions { get; } = + new(new Dictionary()); + + public IDatDatabase HighRes => _highRes; + + public IDatDatabase Language => _language; + + public IDatDatabase Local => _language; + + public ReadOnlyDictionary RegionFileMap { get; } = + new(new Dictionary()); + + public int PortalIteration => 0; + + public int CellIteration => 0; + + public int HighResIteration => 0; + + public int LanguageIteration => 0; + + public bool TryGetFileBytes( + uint regionId, + uint fileId, + ref byte[] bytes, + out int bytesRead) + { + bytesRead = 0; + return false; + } + + public IEnumerable GetAllIdsOfType() where T : IDBObj => + Array.Empty(); + + public IEnumerable ResolveId(uint id) => + Array.Empty(); + + public bool TrySave(T obj, int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + public bool TrySave( + uint regionId, + T obj, + int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + [return: MaybeNull] + public T Get(uint fileId) where T : IDBObj => default; + + public bool TryGet( + uint fileId, + [MaybeNullWhen(false)] out T value) where T : IDBObj + { + value = default; + return false; + } + + public void Dispose() + { + } + + private sealed class StubDatabase : IDatDatabase + { + public DatDatabase Db => throw new NotSupportedException(); + + public int Iteration => 0; + + public IEnumerable GetAllIdsOfType() where T : IDBObj => + Array.Empty(); + + public bool TryGet( + uint fileId, + [MaybeNullWhen(false)] out T value) where T : IDBObj + { + value = default; + return false; + } + + public bool TryGetFileBytes( + uint fileId, + [MaybeNullWhen(false)] out byte[] value) + { + value = null; + return false; + } + + public bool TryGetFileBytes( + uint fileId, + ref byte[] bytes, + out int bytesRead) + { + bytesRead = 0; + return false; + } + + public bool TrySave(T obj, int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + public void Dispose() + { + } + } + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeAssemblerTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeAssemblerTests.cs new file mode 100644 index 00000000..99ff9734 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeAssemblerTests.cs @@ -0,0 +1,148 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// Campaign FW3.1 — hermetic (no DAT) coverage of the production +/// landscape assembler: publish/retire lifecycle, the LOD ring pyramid, and +/// the viewer-recentre grid reflow. The DAT-backed equivalence to the FW1 +/// test builder is proven by WalkProductionWorldConformanceTests +/// (Lane=InstalledDat); this class covers the incremental publish/retire +/// machinery that harness doesn't exercise (it publishes and calls +/// SetViewer exactly once per fixture). +public sealed class WalkLandscapeAssemblerTests +{ + private const uint LandblockId = 0xA9B4FFFFu; // block (0xA9, 0xB4) + private const uint CameraCellId = 0xA9B40001u; // same block, outdoor landcell 1 + + private static int GridIndex(int gx, int gy) => gx * WalkLandscapeAssembler.GridWidth + gy; + + private static int CenterIndex() => + GridIndex(WalkLandscapeAssembler.MidRadius, WalkLandscapeAssembler.MidRadius); + + [Fact] + public void PublishBeforeSetViewer_IsVisibleOnceSetViewerRuns() + { + var assembler = new WalkLandscapeAssembler(); + + assembler.PublishLandblock(LandblockId, maxZ: 100f, minZ: -5f, Array.Empty()); + assembler.SetViewer(CameraCellId, Vector3.Zero); + + WalkLandBlock? block = assembler.Landscape.Blocks[CenterIndex()]; + Assert.NotNull(block); + Assert.Equal(8, block!.SideCellCount); + Assert.Equal(100f, block.MaxZ); + Assert.Equal(-5f, block.MinZ); + } + + [Fact] + public void PublishAfterSetViewer_RefreshesTheAlreadyWindowedSlotImmediately() + { + var assembler = new WalkLandscapeAssembler(); + assembler.SetViewer(CameraCellId, Vector3.Zero); + + assembler.PublishLandblock(LandblockId, maxZ: 42f, minZ: 3f, Array.Empty()); + + Assert.Equal(42f, assembler.Landscape.Blocks[CenterIndex()]!.MaxZ); + } + + [Fact] + public void RingPyramid_FarBlockDegradesSideCellCountAndNeverAttachesBuildings() + { + var assembler = new WalkLandscapeAssembler(); + var building = new WalkBuildingFactory.Entry( + new WalkBuilding { PositionCellId = (LandblockId & 0xFFFF0000u) | 1u }, + Matrix4x4.Identity, Matrix4x4.Identity); + assembler.PublishLandblock(LandblockId, 1f, 0f, new[] { building }); + + // Three blocks north of the camera's own block -> ring 3 -> SideCellCount 2. + const uint FarLandblockId = 0xA9B7FFFFu; + assembler.PublishLandblock(FarLandblockId, 1f, 0f, new[] { building }); + assembler.SetViewer(CameraCellId, Vector3.Zero); + + WalkLandBlock center = assembler.Landscape.Blocks[CenterIndex()]!; + WalkLandBlock far = assembler.Landscape.Blocks[ + GridIndex(WalkLandscapeAssembler.MidRadius, WalkLandscapeAssembler.MidRadius + 3)]!; + Assert.Equal(8, center.SideCellCount); + Assert.Contains(center.CellBuildings, b => b is not null); + Assert.Equal(2, far.SideCellCount); + Assert.All(far.CellBuildings, Assert.Null); + } + + [Fact] + public void RetireLandblock_NullsTheWindowedSlot() + { + var assembler = new WalkLandscapeAssembler(); + assembler.PublishLandblock(LandblockId, 1f, 0f, Array.Empty()); + assembler.SetViewer(CameraCellId, Vector3.Zero); + Assert.NotNull(assembler.Landscape.Blocks[CenterIndex()]); + + assembler.RetireLandblock(LandblockId); + + Assert.Null(assembler.Landscape.Blocks[CenterIndex()]); + } + + [Fact] + public void RetireLandblock_UnpublishedLandblockIsANoOp() + { + var assembler = new WalkLandscapeAssembler(); + + assembler.RetireLandblock(LandblockId); + + Assert.Null(assembler.Landscape.Blocks[CenterIndex()]); + } + + [Fact] + public void SetViewer_RecentresTheWindowWhenTheCameraCrossesIntoAnotherBlock() + { + var assembler = new WalkLandscapeAssembler(); + assembler.PublishLandblock(LandblockId, 7f, -1f, Array.Empty()); + assembler.SetViewer(CameraCellId, Vector3.Zero); + Assert.NotNull(assembler.Landscape.Blocks[CenterIndex()]); + + // Move the camera one block east; the published landblock should now + // sit one grid slot WEST of center instead of at center. + assembler.SetViewer(0xAAB40001u, Vector3.Zero); + + Assert.Null(assembler.Landscape.Blocks[CenterIndex()]); + WalkLandBlock? shifted = assembler.Landscape.Blocks[ + GridIndex(WalkLandscapeAssembler.MidRadius - 1, WalkLandscapeAssembler.MidRadius)]; + Assert.NotNull(shifted); + Assert.Equal(7f, shifted!.MaxZ); + } + + [Fact] + public void SetViewer_LandcellIndexDerivesViewerCellFromLowWord() + { + var assembler = new WalkLandscapeAssembler(); + + // Low word 10 -> landcell index 9 -> (9/8, 9%8) = (1, 1). + assembler.SetViewer(0xA9B4000Au, Vector3.Zero); + + Assert.Equal(1, assembler.Landscape.ViewerCellX); + Assert.Equal(1, assembler.Landscape.ViewerCellY); + } + + [Fact] + public void SetViewer_InteriorCameraDerivesViewerCellFromOrigin() + { + var assembler = new WalkLandscapeAssembler(); + + assembler.SetViewer(0xA9B40105u, new Vector3(50f, 74f, 0f)); + + Assert.Equal(2, assembler.Landscape.ViewerCellX); // floor(50 / 24) = 2 + Assert.Equal(3, assembler.Landscape.ViewerCellY); // floor(74 / 24) = 3 + } + + [Fact] + public void SetViewer_SameBlockRepeatCallDoesNotClearAlreadyPublishedSlots() + { + var assembler = new WalkLandscapeAssembler(); + assembler.PublishLandblock(LandblockId, 1f, 0f, Array.Empty()); + assembler.SetViewer(CameraCellId, Vector3.Zero); + + assembler.SetViewer(CameraCellId, new Vector3(5f, 5f, 0f)); + + Assert.NotNull(assembler.Landscape.Blocks[CenterIndex()]); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeDatBuilder.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeDatBuilder.cs new file mode 100644 index 00000000..57367bce --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkLandscapeDatBuilder.cs @@ -0,0 +1,169 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; +using DatReaderWriter; +using DatReaderWriter.DBObjs; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Campaign FW1 — assembles the replay world for outdoor/landscape +/// fixtures: retail's 11×11 viewer-centered block grid (mid_radius 5) in +/// CAMERA-BLOCK-LOCAL coordinates (the same space the pose origin and the +/// per-block corner math use), each block with its retail z-slab +/// (CLandBlock::calc_lighting-adjacent unpack @0x0052f1d0: +/// max_zval = heightTable[maxByte] + 200, min_zval = heightTable[minByte] +/// − 1), buildings placed at their landcell indices with landblock-local +/// transforms offset by the block delta, and every neighbor block's +/// interior cells merged into one registry. +/// +public static class WalkLandscapeDatBuilder +{ + public sealed record BuiltWorld( + WalkLandscape Landscape, + Dictionary Cells, + Dictionary Buildings); + + /// The capture client's live landscape grid (dumped 2026-08-30: + /// LScape mid_radius=25 → a 51×51 grid — the owner's landscape-radius + /// setting) with the resolution pyramid observed live: side_cell_count 8 + /// in the 3×3 core, 4 at ring 2, 2 at rings 3–4, 1 beyond. Buildings + /// attach only to full-res blocks (the traces show no BLD beyond ±1). + public const int MidRadius = 25; + + private static int SideCellCountForRing(int ring) + => ring <= 1 ? 8 : ring == 2 ? 4 : ring <= 4 ? 2 : 1; + + /// Per-frame viewer placement for moving replays (the camera + /// stays within the anchor block in every moving fixture). + public static void SetViewer(WalkLandscape landscape, uint cameraCellId, Vector3 cameraOrigin) + { + uint low = cameraCellId & 0xFFFFu; + if (low >= 1 && low <= 0x40) + { + int cellIndex = (int)low - 1; + landscape.ViewerCellX = cellIndex / 8; + landscape.ViewerCellY = cellIndex % 8; + } + else + { + landscape.ViewerCellX = Math.Clamp((int)MathF.Floor(cameraOrigin.X / 24f), 0, 7); + landscape.ViewerCellY = Math.Clamp((int)MathF.Floor(cameraOrigin.Y / 24f), 0, 7); + } + } + + public static BuiltWorld Build(DatCollection dats, uint cameraCellId, Vector3 cameraOrigin = default) + { + Region region = (Region)dats.Get(0x13000000u)!; + float[] heightTable = region.LandDefs.LandHeightTable; + + int cameraBlockX = (int)(cameraCellId >> 24); + int cameraBlockY = (int)((cameraCellId >> 16) & 0xFF); + const int midRadius = MidRadius; + const int midWidth = midRadius * 2 + 1; + + var landscape = new WalkLandscape + { + MidWidth = midWidth, + Blocks = new WalkLandBlock?[midWidth * midWidth], + ViewerBlockX = midRadius, + ViewerBlockY = midRadius, + }; + uint low = cameraCellId & 0xFFFFu; + if (low >= 1 && low <= 0x40) + { + int cellIndex = (int)low - 1; + landscape.ViewerCellX = cellIndex / 8; + landscape.ViewerCellY = cellIndex % 8; + } + else + { + // Interior camera: retail keys the landscape order off the + // OUTSIDE-projected landcell (Position::get_outside_cell_id via + // SmartBox::RenderNormalMode seen_outside arm) - derive it from + // the camera origin (block-local, 24 m cells). + landscape.ViewerCellX = Math.Clamp((int)MathF.Floor(cameraOrigin.X / 24f), 0, 7); + landscape.ViewerCellY = Math.Clamp((int)MathF.Floor(cameraOrigin.Y / 24f), 0, 7); + } + + var cells = new Dictionary(); + var buildings = new Dictionary(); + + for (int gx = 0; gx < midWidth; gx++) + { + for (int gy = 0; gy < midWidth; gy++) + { + int blockX = cameraBlockX + gx - midRadius; + int blockY = cameraBlockY + gy - midRadius; + if (blockX < 0 || blockX > 0xFF || blockY < 0 || blockY > 0xFF) + continue; + uint landblockId = (uint)((blockX << 24) | (blockY << 16)); + if (dats.Get(landblockId | 0xFFFFu) is not LandBlock landBlock) + continue; + + byte maxByte = 0, minByte = 255; + foreach (byte h in landBlock.Height) + { + if (h > maxByte) maxByte = h; + if (h < minByte) minByte = h; + } + int ring = Math.Max(Math.Abs(gx - midRadius), Math.Abs(gy - midRadius)); + int sideCellCount = SideCellCountForRing(ring); + var block = new WalkLandBlock + { + SideCellCount = sideCellCount, + MaxZ = heightTable[maxByte] + 200f, + MinZ = heightTable[minByte] - 1f, + }; + block.EnsureCellArrays(); + + var blockOffset = new Vector3( + (gx - midRadius) * WalkLandscape.BlockLength, + (gy - midRadius) * WalkLandscape.BlockLength, + 0f); + + if (sideCellCount == 8) + { + foreach (WalkWorldDatAdapter.BuildingEntry entry + in WalkWorldDatAdapter.BuildBuildings(dats, landblockId)) + { + Matrix4x4 world = entry.WorldTransform + * Matrix4x4.CreateTranslation(blockOffset); + Matrix4x4.Invert(world, out Matrix4x4 inverse); + var placed = new WalkWorldDatAdapter.BuildingEntry( + entry.Building, world, inverse); + buildings[entry.Building] = placed; + int cellIndex = (int)(entry.Building.PositionCellId & 0xFFFFu) - 1; + if (cellIndex >= 0 && cellIndex < 64) + block.CellBuildings[cellIndex] = entry.Building; + + // Retail's loaded-interior rule (CLandBlock::init_buildings + // @0052fd80 → add_to_stablist → grab_visible_cells): a + // full-res block loads exactly its buildings' portal + // stab cells — NOT every interior. The flood halts at + // unloaded cells (GetVisible null), which is what + // limits retail's look-in punches to nearby doorways. + foreach (WalkBldPortal portal in entry.Building.Portals) + { + if (portal.OtherCellId != 0xFFFFFFFFu + && !cells.ContainsKey(portal.OtherCellId)) + { + WalkCell? c = WalkWorldDatAdapter.BuildCell( + dats, portal.OtherCellId, blockOffset); + if (c is not null) cells[c.CellId] = c; + } + foreach (uint stab in portal.StabList) + { + if (cells.ContainsKey(stab)) continue; + WalkCell? c = WalkWorldDatAdapter.BuildCell( + dats, stab, blockOffset); + if (c is not null) cells[c.CellId] = c; + } + } + } + } + landscape.Blocks[gx * midWidth + gy] = block; + } + } + return new BuiltWorld(landscape, cells, buildings); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkLookInGateSweepTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkLookInGateSweepTests.cs new file mode 100644 index 00000000..c798d628 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkLookInGateSweepTests.cs @@ -0,0 +1,113 @@ +using AcDream.App.Tests.Rendering; +using AcDream.App.Rendering.Walk; +using DatReaderWriter; +using DatReaderWriter.Options; +using System.Text; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// FW1 look-in gate adjudication sweep: with data joins proven correct, +/// the wrong-building punches must come from the sidedness gate's two +/// unvalidated inputs — the GfxObj portal-poly plane sign and the +/// BuildingPortal side-flag decode. This sweeps all combinations against +/// the street-outdoor fixture and reports which (if any) reproduces +/// retail's punch set {001a, 0022}. Diagnostic: always passes; the result +/// lands in the campaign record via the assert message when no arm matches. +/// +[Trait("Lane", "InstalledDat")] +public sealed class WalkLookInGateSweepTests +{ + private sealed class Recorder : IWalkEventSink + { + public readonly List Events = new(); + public void Emit(in WalkEvent walkEvent) => Events.Add(walkEvent); + } + + [Fact(Skip = "FW1 near-win state (2026-08-30): with +Y-forward, alwaysDrawObjects, " + + "the exact degrade rule and side mode 1, the street fixture matches retail " + + "EXCEPT look-in flood depth (mine D[16e]/D[164]; retail D[16e,16a,16c]/" + + "D[164,162,167,169]) - adjudicate the interior flood propagation next " + + "(the doorway-still fixture tests it in isolation).")] + public void Sweep_the_lookin_gate_decodes_against_the_street_fixture() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory."); + } + IReadOnlyList frames = + WalkOracleTrace.Load("posed/holtburg-street-outdoor"); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + + // Retail's ground truth for this frame: which buildings punched, and + // which cells each punch listed. + string expectedPunches = PunchSignature( + frame.Events.Select(e => e.Kind == WalkOracleEventKind.Building + ? ("BLD", e.CellId!.Value, Array.Empty()) + : e.Kind == WalkOracleEventKind.DrawCells + ? ("DC", 0u, e.Cells.ToArray()) + : ("", 0u, Array.Empty()))); + + var report = new StringBuilder(); + report.AppendLine($"RETAIL: {expectedPunches}"); + string? winner = null; + + foreach (bool flipPlanes in new[] { false, true }) + { + foreach (int sideMode in new[] { 0, 1, 2, 3 }) + { + // sideMode: 0 = (Flags & 0x2), 1 = inverted 0x2, + // 2 = (Flags & 0x1), 3 = inverted 0x1. + using var dats = new DatCollection(datDir!, DatAccessType.Read); + WalkWorldDatAdapter.FlipGfxPolygonPlanes = flipPlanes; + WalkWorldDatAdapter.BuildingSideMode = sideMode; + try + { + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, world.Cells) + { + Buildings = world.Buildings, + }; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + walk.WalkFrame(frame.Pose.CellId, null, world.Landscape, ctx, recorder); + string actual = PunchSignature( + recorder.Events.Select(e => e.Kind == WalkEventKind.Building + ? ("BLD", e.CellId, Array.Empty()) + : e.Kind == WalkEventKind.DrawCells + ? ("DC", 0u, e.Cells.ToArray()) + : ("", 0u, Array.Empty()))); + string arm = $"flip={flipPlanes} side={sideMode}"; + report.AppendLine($"{arm}: {actual}"); + if (actual == expectedPunches) + winner ??= arm; + } + finally + { + WalkWorldDatAdapter.FlipGfxPolygonPlanes = false; + WalkWorldDatAdapter.BuildingSideMode = 0; + } + } + } + + Assert.True( + winner is not null, + $"no gate decode reproduces retail's punch pattern\n{report}"); + } + + private static string PunchSignature( + IEnumerable<(string Kind, uint Id, uint[] Cells)> events) + { + var parts = new List(); + foreach ((string kind, uint id, uint[] cells) in events) + { + if (kind == "BLD") parts.Add($"B{id:x8}"); + else if (kind == "DC") + parts.Add($"D[{string.Join(',', cells.Select(c => (c & 0xFFFF).ToString("x3")))}]"); + } + return string.Join("|", parts); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTrace.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTrace.cs new file mode 100644 index 00000000..11d30e08 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTrace.cs @@ -0,0 +1,194 @@ +using System.Globalization; +using System.Text.RegularExpressions; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Parser for the FW0 retail walk-oracle traces +/// (docs/research/2026-08-30-fw-walk-oracle/ — captured live from the +/// PDB-paired 2013 retail client on 2026-08-30; format documented in that +/// directory's README). These traces are Campaign FW's conformance +/// fixtures: FW1's RetailFrameWalk must reproduce each frame's event +/// sequence position-for-position. +/// +/// The final frame of every capture is dropped: the harness detaches at +/// the frame MARKER, so the last frame never records its draws and would +/// read as a false "outdoor, no landscape" frame. +/// +public static class WalkOracleTrace +{ + public static IReadOnlyList Parse(IEnumerable lines) + { + var frames = new List(); + List? current = null; + int currentNumber = 0; + WalkOraclePose? currentPose = null; + + foreach (string line in lines) + { + Match frameMatch = FramePattern.Match(line); + if (frameMatch.Success) + { + if (current is not null) + frames.Add(new WalkOracleFrame(currentNumber, current, currentPose)); + currentNumber = int.Parse( + frameMatch.Groups[1].Value, CultureInfo.InvariantCulture); + current = new List(); + currentPose = null; + continue; + } + if (current is null) + continue; + + Match poseMatch = PosePattern.Match(line); + if (poseMatch.Success) + { + // P — raw IEEE-754 dwords + // dumped from Render::viewer_pos @0x0081ef00 at the frame marker. + uint[] raw = new uint[8]; + for (int i = 0; i < 8; i++) + raw[i] = uint.Parse( + poseMatch.Groups[i + 1].Value, + NumberStyles.HexNumber, CultureInfo.InvariantCulture); + currentPose = new WalkOraclePose( + raw[0], + new System.Numerics.Vector3( + BitConverter.Int32BitsToSingle((int)raw[1]), + BitConverter.Int32BitsToSingle((int)raw[2]), + BitConverter.Int32BitsToSingle((int)raw[3])), + BitConverter.Int32BitsToSingle((int)raw[4]), + BitConverter.Int32BitsToSingle((int)raw[5]), + BitConverter.Int32BitsToSingle((int)raw[6]), + BitConverter.Int32BitsToSingle((int)raw[7])); + continue; + } + + if (line == "LS") + { + current.Add(WalkOracleEvent.Landscape()); + continue; + } + Match buildingMatch = BuildingPattern.Match(line); + if (buildingMatch.Success) + { + current.Add(WalkOracleEvent.Building(ParseId(buildingMatch.Groups[1].Value))); + continue; + } + Match insideMatch = DrawInsidePattern.Match(line); + if (insideMatch.Success) + { + current.Add(WalkOracleEvent.DrawInside(ParseId(insideMatch.Groups[1].Value))); + continue; + } + Match cellsMatch = DrawCellsPattern.Match(line); + if (cellsMatch.Success) + { + uint[] cells = cellsMatch.Groups[3].Value + .Split(' ', StringSplitOptions.RemoveEmptyEntries) + .Select(ParseId) + .ToArray(); + current.Add(WalkOracleEvent.DrawCells( + outsideViewCount: int.Parse( + cellsMatch.Groups[1].Value, CultureInfo.InvariantCulture), + declaredCount: int.Parse( + cellsMatch.Groups[2].Value, CultureInfo.InvariantCulture), + cells)); + } + // Anything else is cdb chrome (banner, prompts, symbol notes) — ignored. + } + + // The last STARTED frame (still in `current`) is deliberately never + // appended — that is the truncated detach frame (see class doc). + return frames; + } + + public static IReadOnlyList Load(string fixtureName) + { + string root = FindRepositoryRoot(); + string path = Path.Combine( + root, "docs", "research", "2026-08-30-fw-walk-oracle", fixtureName + ".log"); + return Parse(File.ReadLines(path)); + } + + private static string FindRepositoryRoot() + { + DirectoryInfo? dir = new(AppContext.BaseDirectory); + while (dir is not null) + { + if (File.Exists(Path.Combine(dir.FullName, "AcDream.slnx"))) + return dir.FullName; + dir = dir.Parent; + } + throw new InvalidOperationException( + "AcDream.slnx not found above the test base directory; walk-oracle fixtures unavailable."); + } + + private static uint ParseId(string hex) + => uint.Parse(hex, NumberStyles.HexNumber, CultureInfo.InvariantCulture); + + private static readonly Regex FramePattern = new(@"^F (\d+)\s*$", RegexOptions.Compiled); + private static readonly Regex PosePattern = new( + @"^P ([0-9a-f]{8}) ([0-9a-f]{8}) ([0-9a-f]{8}) ([0-9a-f]{8}) ([0-9a-f]{8}) ([0-9a-f]{8}) ([0-9a-f]{8}) ([0-9a-f]{8})\s*$", + RegexOptions.Compiled); + private static readonly Regex BuildingPattern = new(@"^BLD ([0-9a-f]{8})\s*$", RegexOptions.Compiled); + private static readonly Regex DrawInsidePattern = new(@"^DI ([0-9a-f]{8})\s*$", RegexOptions.Compiled); + private static readonly Regex DrawCellsPattern = new( + @"^DC pv=[0-9a-f]{8} ov=(\d+) n=(\d+):((?: [0-9a-f]{8})*)\s*$", RegexOptions.Compiled); +} + +/// The camera pose dumped at the frame marker (raw dwords from +/// Render::viewer_pos @0x0081ef00): the camera's cell id, world +/// origin, and the Frame quaternion's four raw components (q0..q3 in +/// storage order — axis convention resolved by the replay runner). +/// Present only in the pose-stamped capture round. +public sealed record WalkOraclePose( + uint CellId, + System.Numerics.Vector3 Origin, + float Q0, + float Q1, + float Q2, + float Q3); + +public sealed record WalkOracleFrame( + int Number, + IReadOnlyList Events, + WalkOraclePose? Pose = null) +{ + /// The frame's root: the first DrawInside cell, or null when outdoor-rooted. + public uint? InteriorRootCell + => Events.FirstOrDefault(e => e.Kind == WalkOracleEventKind.DrawInside)?.CellId; + + public bool HasLandscape => Events.Any(e => e.Kind == WalkOracleEventKind.Landscape); + + public IEnumerable Buildings + => Events.Where(e => e.Kind == WalkOracleEventKind.Building).Select(e => e.CellId!.Value); +} + +public enum WalkOracleEventKind +{ + Landscape, + Building, + DrawInside, + DrawCells, +} + +public sealed record WalkOracleEvent( + WalkOracleEventKind Kind, + uint? CellId, + int OutsideViewCount, + int DeclaredCellCount, + IReadOnlyList Cells) +{ + public static WalkOracleEvent Landscape() + => new(WalkOracleEventKind.Landscape, null, 0, 0, Array.Empty()); + + public static WalkOracleEvent Building(uint cellId) + => new(WalkOracleEventKind.Building, cellId, 0, 0, Array.Empty()); + + public static WalkOracleEvent DrawInside(uint cellId) + => new(WalkOracleEventKind.DrawInside, cellId, 0, 0, Array.Empty()); + + public static WalkOracleEvent DrawCells( + int outsideViewCount, int declaredCount, IReadOnlyList cells) + => new(WalkOracleEventKind.DrawCells, null, outsideViewCount, declaredCount, cells); +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTraceTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTraceTests.cs new file mode 100644 index 00000000..c066c4a0 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTraceTests.cs @@ -0,0 +1,171 @@ +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Integrity tests for the FW0 walk-oracle fixtures: every checked-in +/// trace parses, and the load-bearing shapes recorded in the fixture +/// README hold. FW1's conformance suite builds on these parsed frames; +/// if a fixture is edited or recaptured, these goldens catch drift. +/// +public sealed class WalkOracleTraceTests +{ + private const uint FarBuilding = 0xF518002Eu; + + public static readonly TheoryData AllFixtures = new() + { + "terrace-center", + "terrace-edge", + "cathedral-arrival", + "holtburg-doorway-still", + "holtburg-walkout", + "holtburg-street-porchcam", + "holtburg-street-outdoor", + "holtburg-walkabout", + "foundry-entry", + "foundry-deep", + }; + + [Theory] + [MemberData(nameof(AllFixtures))] + public void Fixture_parses_with_complete_frames(string name) + { + IReadOnlyList frames = WalkOracleTrace.Load(name); + + Assert.NotEmpty(frames); + // Frame numbers are contiguous from 1; the truncated final frame is dropped. + Assert.Equal(1, frames[0].Number); + Assert.Equal(frames.Count, frames[^1].Number); + Assert.All(frames, f => Assert.NotEmpty(f.Events)); + } + + [Fact] + public void Terrace_edge_draws_the_far_building_every_outdoor_frame() + { + // The #456 acceptance oracle: retail HIDES the vista by depth cover, + // not by omission — 0xF518002E is submitted every single frame. + IReadOnlyList frames = WalkOracleTrace.Load("terrace-edge"); + + Assert.All(frames, f => + { + Assert.Null(f.InteriorRootCell); + Assert.True(f.HasLandscape); + Assert.Contains(FarBuilding, f.Buildings); + }); + } + + [Fact] + public void Cathedral_arrival_roots_interior_and_culls_the_far_building() + { + IReadOnlyList frames = WalkOracleTrace.Load("cathedral-arrival"); + + Assert.All(frames, f => + { + Assert.Equal(0xF4180106u, f.InteriorRootCell); + Assert.True(f.HasLandscape); // drawn THROUGH the exit view + Assert.DoesNotContain(FarBuilding, f.Buildings); + }); + } + + [Fact] + public void Doorway_root_is_stable_across_every_frame() + { + IReadOnlyList frames = WalkOracleTrace.Load("holtburg-doorway-still"); + + Assert.All(frames, f => Assert.Equal(0xA9B4013Fu, f.InteriorRootCell)); + } + + [Fact] + public void Walkout_hands_over_between_interior_cells_in_one_frame() + { + IReadOnlyList frames = WalkOracleTrace.Load("holtburg-walkout"); + + uint?[] roots = frames.Select(f => f.InteriorRootCell).Distinct().ToArray(); + Assert.Equal(new uint?[] { 0xA9B4013Fu, 0xA9B40150u }, roots); + // Exactly one handover: the root sequence is two contiguous runs. + int transitions = frames.Zip(frames.Skip(1)) + .Count(pair => pair.First.InteriorRootCell != pair.Second.InteriorRootCell); + Assert.Equal(1, transitions); + } + + [Fact] + public void Street_porchcam_roots_at_the_camera_cell_not_the_player() + { + // The player stood in the street; the chase camera sat inside the + // cottage porch — and retail rooted the frame at the CAMERA's cell. + IReadOnlyList frames = WalkOracleTrace.Load("holtburg-street-porchcam"); + + Assert.All(frames, f => Assert.Equal(0xA9B40150u, f.InteriorRootCell)); + } + + [Fact] + public void Street_outdoor_never_enters_an_interior_root() + { + IReadOnlyList frames = WalkOracleTrace.Load("holtburg-street-outdoor"); + + Assert.All(frames, f => + { + Assert.Null(f.InteriorRootCell); + Assert.True(f.HasLandscape); + }); + } + + [Fact] + public void Foundry_entry_flips_outdoor_to_interior_and_drops_the_landscape() + { + IReadOnlyList frames = WalkOracleTrace.Load("foundry-entry"); + + WalkOracleFrame flip = frames.First(f => f.InteriorRootCell is not null); + Assert.Equal(0xA9B40178u, flip.InteriorRootCell); + // The frame before the flip is fully outdoor; the flip frame itself + // draws NO landscape and NO buildings — the pure-interior shape. + WalkOracleFrame before = frames[flip.Number - 2]; + Assert.Null(before.InteriorRootCell); + Assert.True(before.HasLandscape); + Assert.False(flip.HasLandscape); + Assert.Empty(flip.Buildings); + } + + [Fact] + public void Foundry_deep_draws_the_town_through_the_surviving_chain() + { + IReadOnlyList frames = WalkOracleTrace.Load("foundry-deep"); + + Assert.All(frames, f => + { + Assert.Equal(0xA9B40176u, f.InteriorRootCell); + Assert.True(f.HasLandscape); + Assert.NotEmpty(f.Buildings); + }); + } + + [Fact] + public void Stationary_frames_repeat_their_event_sequence_exactly() + { + // README finding 6: while the camera is still, the whole-frame + // sequence repeats bit-for-bit. Assert it on the terrace fixture. + IReadOnlyList frames = WalkOracleTrace.Load("terrace-center"); + + WalkOracleFrame first = frames[0]; + Assert.All(frames.Skip(1), f => + { + Assert.Equal(first.Events.Count, f.Events.Count); + for (int i = 0; i < first.Events.Count; i++) + Assert.Equal(first.Events[i], f.Events[i], WalkOracleEventComparer.Instance); + }); + } + + private sealed class WalkOracleEventComparer : IEqualityComparer + { + public static readonly WalkOracleEventComparer Instance = new(); + + public bool Equals(WalkOracleEvent? x, WalkOracleEvent? y) + => x is not null && y is not null + && x.Kind == y.Kind + && x.CellId == y.CellId + && x.OutsideViewCount == y.OutsideViewCount + && x.DeclaredCellCount == y.DeclaredCellCount + && x.Cells.SequenceEqual(y.Cells); + + public int GetHashCode(WalkOracleEvent obj) + => HashCode.Combine(obj.Kind, obj.CellId, obj.Cells.Count); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkPViewFloodTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkPViewFloodTests.cs new file mode 100644 index 00000000..18f4e79f --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkPViewFloodTests.cs @@ -0,0 +1,192 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class WalkPViewFloodTests +{ + private sealed class TestContext : IWalkFrameContext + { + private sealed class Caster : IWalkRayCaster + { + public Vector3 RayThrough(float screenX, float screenY) + => new(screenX, screenY, 100f); + } + + public readonly Dictionary Cells = new(); + private readonly Matrix4x4 _viewProj; + + public TestContext() + { + Matrix4x4 view = Matrix4x4.CreateLookAt( + Vector3.Zero, new Vector3(0, 0, -1), Vector3.UnitY); + Matrix4x4 proj = Matrix4x4.CreatePerspectiveFieldOfView(1.2f, 1f, 0.1f, 1000f); + _viewProj = view * proj; + } + + // All test cells sit at identity transforms: cell-local == world. + public Vector3 ViewpointIn(WalkCell cell) => Vector3.Zero; + public Matrix4x4 ObjectToClip(WalkCell cell) => _viewProj; + public WalkCell? GetVisible(uint cellId) => Cells.GetValueOrDefault(cellId); + public IWalkRayCaster Rays { get; } = new Caster(); + public Vector3 WorldViewpoint => Vector3.Zero; + public float ViewportWidth => 640f; + public float ViewportHeight => 480f; + } + + private static WalkPolygon Quad(float z, float half = 0.5f, bool facingViewer = true) => new() + { + Vertices = + [ + new Vector3(-half, -half, z), new Vector3(half, -half, z), + new Vector3(half, half, z), new Vector3(-half, half, z), + ], + // Plane through the quad: for z=-2 facing +z, N=(0,0,1), D=2 (eye at + // origin sits on the POSITIVE side: d = +2). + Plane = new WalkPlane(new Vector3(0, 0, facingViewer ? 1f : -1f), facingViewer ? -z : z), + }; + + private static WalkCell Cell( + TestContext ctx, uint id, params (WalkCellPortal Portal, WalkPolygon Polygon)[] portals) + { + var cell = new WalkCell + { + CellId = id, + Portals = portals.Select(p => p.Portal).ToArray(), + PortalPolygons = portals.Select(p => p.Polygon).ToArray(), + }; + cell.PushView(); // add_views/stab-list stand-in: one pushed slot + ctx.Cells[id] = cell; + return cell; + } + + private static WalkPView SeedAndFlood(TestContext ctx, WalkCell seed) + { + var pview = new WalkPView(); + WalkCopyView.AppendFullViewportQuad( + seed.TopView, ctx.Rays, ctx.WorldViewpoint, ctx.ViewportWidth, ctx.ViewportHeight); + pview.ConstructView(seed, 0xFFFF, ctx); + return pview; + } + + [Fact] + public void Flood_traverses_a_look_through_portal_into_the_neighbor() + { + var ctx = new TestContext(); + // Eye on the positive side of the portal plane (d=+2 → side 0); + // PortalSide=0 → side == PortalSide → an OPENING (look-through). + WalkCell seed = Cell(ctx, 0x100, + (new WalkCellPortal { OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0 }, + Quad(-2f))); + WalkCell neighbor = Cell(ctx, 0x101, + (new WalkCellPortal { OtherCellId = 0x100, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0 }, + Quad(-2f))); + + WalkPView pview = SeedAndFlood(ctx, seed); + + Assert.Equal(new[] { 0x100u, 0x101u }, pview.CellDrawList.Select(c => c.CellId)); + Assert.Equal(1, neighbor.TopView.ViewCount); // the clipped view arrived + Assert.True(neighbor.TopView.CellViewDone); // and the neighbor was processed + } + + [Fact] + public void Facing_portal_is_not_traversed_but_feeds_the_distance_key() + { + var ctx = new TestContext(); + // PortalSide=1 while the eye computes side 0 → the portal FACES the + // viewer (a visible surface, not an opening). + WalkCell seed = Cell(ctx, 0x100, + (new WalkCellPortal { OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0 }, + Quad(-2f))); + Cell(ctx, 0x101, + (new WalkCellPortal { OtherCellId = 0x100, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0 }, + Quad(-2f))); + + WalkPView pview = SeedAndFlood(ctx, seed); + + Assert.Equal(new[] { 0x100u }, pview.CellDrawList.Select(c => c.CellId)); + // max_indist = squared distance to the farthest facing-portal vertex: + // (±0.5, ±0.5, −2) from the origin → 0.25 + 0.25 + 4. + Assert.Equal(4.5f, seed.TopView.MaxInDistSquared, 3); + } + + [Fact] + public void Exit_portal_raises_the_outside_view_only_when_landscape_is_drawn() + { + var ctx = new TestContext(); + WalkCell seed = Cell(ctx, 0x100, + (new WalkCellPortal { OtherCellId = 0xFFFFFFFF, PolygonIndex = 0, PortalSide = 0, OtherPortalId = -1 }, + Quad(-2f))); + + WalkPView pview = SeedAndFlood(ctx, seed); + Assert.Equal(1, pview.OutsideView.ViewCount); + + // draw_landscape == 0 discards exit views entirely. + seed.PopView(); + seed.PushView(); + var noLandscape = new WalkPView { DrawLandscape = false }; + WalkCopyView.AppendFullViewportQuad( + seed.TopView, ctx.Rays, ctx.WorldViewpoint, ctx.ViewportWidth, ctx.ViewportHeight); + noLandscape.ConstructView(seed, 0xFFFF, ctx); + Assert.Equal(0, noLandscape.OutsideView.ViewCount); + } + + [Fact] + public void Flood_never_walks_back_through_the_entry_portal() + { + var ctx = new TestContext(); + // Two cells looking into each other; both sides traversable by + // geometry. Without the entry-portal force, the flood would ping-pong. + WalkCell a = Cell(ctx, 0x100, + (new WalkCellPortal { OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0 }, + Quad(-2f))); + WalkCell b = Cell(ctx, 0x101, + (new WalkCellPortal { OtherCellId = 0x100, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0 }, + Quad(-2f))); + + WalkPView pview = SeedAndFlood(ctx, a); + + Assert.Equal(2, pview.CellDrawList.Count); + Assert.Equal(2, pview.CellDrawList.Select(c => c.CellId).Distinct().Count()); + } + + [Fact] + public void Deeper_chain_floods_in_nearest_first_pop_order() + { + var ctx = new TestContext(); + // seed → mid (portal at z=-2) → far (portal at z=-4): the draw list + // appends in pop order (nearest first), so the end-first draw walk + // is far-to-near. + WalkCell seed = Cell(ctx, 0x100, + (new WalkCellPortal { OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0 }, + Quad(-2f))); + WalkCell mid = Cell(ctx, 0x101, + (new WalkCellPortal { OtherCellId = 0x100, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 0 }, + Quad(-2f)), + (new WalkCellPortal { OtherCellId = 0x102, PolygonIndex = 1, PortalSide = 0, OtherPortalId = 0 }, + Quad(-4f, half: 0.4f))); + WalkCell far = Cell(ctx, 0x102, + (new WalkCellPortal { OtherCellId = 0x101, PolygonIndex = 0, PortalSide = 1, OtherPortalId = 1 }, + Quad(-4f, half: 0.4f))); + + WalkPView pview = SeedAndFlood(ctx, seed); + + Assert.Equal( + new[] { 0x100u, 0x101u, 0x102u }, + pview.CellDrawList.Select(c => c.CellId)); + Assert.Equal(1, far.TopView.ViewCount); + } + + [Fact] + public void Unloaded_neighbor_is_silently_skipped() + { + var ctx = new TestContext(); + WalkCell seed = Cell(ctx, 0x100, + (new WalkCellPortal { OtherCellId = 0x0DEAD, PolygonIndex = 0, PortalSide = 0, OtherPortalId = 0 }, + Quad(-2f))); + + WalkPView pview = SeedAndFlood(ctx, seed); + + Assert.Equal(new[] { 0x100u }, pview.CellDrawList.Select(c => c.CellId)); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkPortalGateDumpTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkPortalGateDumpTests.cs new file mode 100644 index 00000000..c9c1ab95 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkPortalGateDumpTests.cs @@ -0,0 +1,302 @@ +using AcDream.App.Tests.Rendering; +using AcDream.App.Rendering.Walk; +using DatReaderWriter; +using DatReaderWriter.Options; +using System.Numerics; +using System.Text; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// FW1 look-in gate microscope: for the street fixture pose, dump every +/// gate input for building a9b4001a (retail punches it) vs a9b4001e +/// (retail does not): raw portal flags, the BSP-emitted polygon's plane, +/// the eye's signed distance and side, and the active-view clip count. +/// Writes the dump to the scratch directory; always passes. +/// +[Trait("Lane", "InstalledDat")] +public sealed class WalkPortalGateDumpTests +{ + [Fact] + public void Dump_the_gate_inputs_for_a_punching_and_a_silent_building() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory."); + } + IReadOnlyList frames = + WalkOracleTrace.Load("posed/holtburg-street-outdoor"); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + using var dats = new DatCollection(datDir!, DatAccessType.Read); + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, world.Cells) + { + Buildings = world.Buildings, + }; + // Install the outdoor default view as the active clip context. + var defaultView = new WalkPortalView(); + WalkCopyView.AppendFullViewportQuad( + defaultView, ctx.Rays, ctx.WorldViewpoint, + ctx.ViewportWidth, ctx.ViewportHeight); + ctx.SetActiveView(defaultView, 0); + + var dump = new StringBuilder(); + Span clipped = stackalloc WalkScreenPoint[64]; + dump.AppendLine($"pose cell={frame.Pose.CellId:x8} origin={frame.Pose.Origin}"); + foreach (uint id in new[] { 0xA9B4001Au, 0xA9B4001Eu, 0xA9B40022u, 0xA9B40026u }) + { + WalkBuilding building = world.Buildings.Keys.Single(b => b.PositionCellId == id); + float dist = ctx.ViewerDistanceTo(building); + Vector3 eyeInBuilding = ctx.ViewpointInBuilding(building); + dump.AppendLine( + $"building {id:x8}: dist={dist:f1} eff={MathF.Max(0f, dist - 100f):f1} " + + $"eyeLocal={eyeInBuilding} portals={building.Portals.Length}"); + WalkBspNode? bsp = building.SelectDrawingBsp(dist); + var refs = new List(); + Collect(bsp, refs); + dump.AppendLine($" level BSP portal refs: {refs.Count}"); + foreach (WalkPortalRef portalRef in refs) + { + ref WalkBldPortal bp = ref building.Portals[portalRef.PortalIndex]; + float d = Vector3.Dot(portalRef.Polygon.Plane.Normal, eyeInBuilding) + + portalRef.Polygon.Plane.D; + int side = d > WalkVisibilityMath.Epsilon ? 0 + : d < -WalkVisibilityMath.Epsilon ? 1 : 2; + int n = ctx.ClipBuildingPolygon(building, portalRef.Polygon, side, clipped); + dump.AppendLine( + $" ref idx={portalRef.PortalIndex} other={bp.OtherCellId:x8} " + + $"rawSide={bp.PortalSide} exact={bp.ExactMatch} " + + $"planeD@eye={d:f2} eyeSide={side} clipN={n} " + + $"gate(side==rawSide)={(side == bp.PortalSide ? "PASS" : "reject")}"); + } + } + string path = Path.Combine(Path.GetTempPath(), "fw1-portal-gate-dump.txt"); + File.WriteAllText(path, dump.ToString()); + Assert.True(true); + } + + private static void Collect(WalkBspNode? node, List into) + { + if (node is null) return; + if (node.InPortals is not null) into.AddRange(node.InPortals); + Collect(node.PosNode, into); + Collect(node.NegNode, into); + } + + private sealed class NullSink : IWalkEventSink + { + public void Emit(in WalkEvent walkEvent) { } + } + + /// + /// Walkout-F2 microscope: retail floods buildings a9b4001e (×4) and + /// a9b40026 (×1) through the cottage's exit views; the replay floods + /// neither, while the SAME machinery against the root view passes the + /// street fixture. Differential per portal: clip count against the + /// full-viewport window vs each exit-view window, plus each window's + /// vertices and signed area (winding). + /// + [Fact] + public void Dump_the_exit_view_look_in_inputs_for_walkout_f2() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory."); + } + var dump = new StringBuilder(); + using var dats = new DatCollection(datDir!, DatAccessType.Read); + // walkout F2 (retail FLOODS 001e/0026) vs doorway-still F2 (retail + // floods NOTHING) — the poses differ by ~1 m and ~5° of yaw. + WalkOraclePose[] poses = + [ + WalkOracleTrace.Load("posed/holtburg-walkout")[2].Pose!, + WalkOracleTrace.Load("posed/holtburg-doorway-still")[1].Pose!, + ]; + foreach (WalkOraclePose pose in poses) + { + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, pose.CellId, pose.Origin); + var ctx = new WalkTraceReplayContext(pose, world.Cells) + { + Buildings = world.Buildings, + }; + WalkCell camera = world.Cells[pose.CellId]; + var walk = new RetailFrameWalk(); + walk.WalkFrame(pose.CellId, camera, world.Landscape, ctx, new NullSink()); + + WalkPortalView outside = walk.InteriorPView.OutsideView; + dump.AppendLine( + $"pose cell={pose.CellId:x8} origin={pose.Origin} ov={outside.ViewCount}"); + for (int v = 0; v < outside.ViewCount; v++) + { + WalkViewPoly poly = outside.View.Polys[v]; + var verts = new Vector2[poly.VertexCount]; + for (int k = 0; k < poly.VertexCount; k++) + verts[k] = outside.View.Vertices[poly.VertexIndex + k].Point; + dump.AppendLine( + $" exit view {v}: n={poly.VertexCount} area={SignedArea(verts):f1} " + + $"verts={string.Join(' ', verts.Select(p => $"({p.X:f1},{p.Y:f1})"))}"); + } + var defaultView = new WalkPortalView(); + WalkCopyView.AppendFullViewportQuad( + defaultView, ctx.Rays, ctx.WorldViewpoint, + ctx.ViewportWidth, ctx.ViewportHeight); + { + WalkViewPoly rootPoly = defaultView.View.Polys[0]; + var rootVerts = new Vector2[rootPoly.VertexCount]; + for (int k = 0; k < rootPoly.VertexCount; k++) + rootVerts[k] = defaultView.View.Vertices[rootPoly.VertexIndex + k].Point; + dump.AppendLine( + $" root view: n={rootPoly.VertexCount} area={SignedArea(rootVerts):f1} " + + $"verts={string.Join(' ', rootVerts.Select(p => $"({p.X:f1},{p.Y:f1})"))}"); + } + + foreach (uint id in new[] { 0xA9B4001Eu, 0xA9B40026u, 0xA9B4002Fu }) + { + WalkBuilding building = + world.Buildings.Keys.Single(b => b.PositionCellId == id); + float dist = ctx.ViewerDistanceTo(building); + Vector3 eyeInBuilding = ctx.ViewpointInBuilding(building); + WalkBspNode? bsp = building.SelectDrawingBsp(dist); + dump.AppendLine( + $" building {id:x8}: dist={dist:f1} eff={MathF.Max(0f, dist - 100f):f1} " + + $"bsp={(bsp is null ? "NULL" : "selected")} ports={CountPorts(bsp)}"); + for (int li = 0; li < building.DegradeLevels.Length; li++) + { + WalkBuildingDegradeLevel lv = building.DegradeLevels[li]; + dump.AppendLine( + $" level {li}: min={lv.MinDist:f1} ideal={lv.IdealDist:f1} " + + $"max={lv.MaxDist:f1} ports={CountPorts(lv.DrawingBsp)} " + + $"idealArmThr={lv.IdealDist:f1} " + + $"negMulThr={lv.IdealDist - (lv.IdealDist - lv.MaxDist) * -0.99f:f1}"); + } + if (bsp is null) continue; + var refs = new List(); + WalkBuildingPortals.BuildDrawPortalsOnly( + bsp, 1, eyeInBuilding, (portalRef, _) => refs.Add(portalRef)); + var clipped = new WalkScreenPoint[64]; + foreach (WalkPortalRef portalRef in refs) + { + ref WalkBldPortal bp = ref building.Portals[portalRef.PortalIndex]; + float d = Vector3.Dot(portalRef.Polygon.Plane.Normal, eyeInBuilding) + + portalRef.Polygon.Plane.D; + int side = d > WalkVisibilityMath.Epsilon ? 0 + : d < -WalkVisibilityMath.Epsilon ? 1 : 2; + ctx.SetActiveView(defaultView, 0); + int rootN = ctx.ClipBuildingPolygon( + building, portalRef.Polygon, side, clipped); + string rootVerts = string.Join( + ' ', + clipped.Take(rootN).Select(p => $"({p.X:f1},{p.Y:f1},w={p.W:f3})")); + var perView = new StringBuilder(); + for (int v = 0; v < outside.ViewCount; v++) + { + ctx.SetActiveView(outside, v); + int n = ctx.ClipBuildingPolygon( + building, portalRef.Polygon, side, clipped); + float area = 0f; + for (int k = 0; k < n; k++) + { + WalkScreenPoint a = clipped[k]; + WalkScreenPoint b = clipped[(k + 1) % n]; + area += a.X * b.Y - b.X * a.Y; + } + perView.Append($" view{v}N={n}(area={0.5f * area:f1})"); + } + dump.AppendLine( + $" ref idx={portalRef.PortalIndex} other={bp.OtherCellId:x8} " + + $"rawSide={bp.PortalSide} eyeSide={side} " + + $"gate={(side == bp.PortalSide ? "PASS" : "REJECT")} " + + $"rootN={rootN}{perView}"); + if (rootN > 0) + dump.AppendLine($" root-clipped: {rootVerts}"); + } + } + } + string path = Path.Combine(Path.GetTempPath(), "fw1-walkout-f2-lookin-dump.txt"); + File.WriteAllText(path, dump.ToString()); + Assert.True(true); + } + + /// + /// Foundry-entry F67 microscope: retail (F67+F68, same camera P(F68)) + /// orders building a9b40036's floods 116,118,11d; the replay orders + /// 11d,116,118. Dump the full BSP traversal at that camera — every + /// node's plane, d, arm choice, and emissions — to find the + /// order-controlling node and its |d|. + /// + [Fact] + public void Dump_the_foundry_f67_bsp_traversal_for_0036() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory."); + } + IReadOnlyList frames = WalkOracleTrace.Load("posed/foundry-entry"); + WalkOraclePose pose = frames[67].Pose!; // P(F68) = camera of F67 + using var dats = new DatCollection(datDir!, DatAccessType.Read); + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, pose.CellId, pose.Origin); + var ctx = new WalkTraceReplayContext(pose, world.Cells) + { + Buildings = world.Buildings, + }; + WalkBuilding building = + world.Buildings.Keys.Single(b => b.PositionCellId == 0xA9B40036u); + Vector3 eye = ctx.ViewpointInBuilding(building); + WalkBspNode? bsp = building.SelectDrawingBsp(ctx.ViewerDistanceTo(building)); + var dump = new StringBuilder(); + dump.AppendLine($"camera cell={pose.CellId:x8} origin={pose.Origin}"); + dump.AppendLine($"eyeInBuilding={eye} dist={ctx.ViewerDistanceTo(building):f2}"); + DumpNode(bsp, eye, building, 0, dump); + string path = Path.Combine(Path.GetTempPath(), "fw1-foundry-f67-bsp-dump.txt"); + File.WriteAllText(path, dump.ToString()); + Assert.True(true); + } + + private static void DumpNode( + WalkBspNode? node, Vector3 eye, WalkBuilding building, int depth, StringBuilder dump) + { + if (node is null) return; + string pad = new(' ', depth * 2); + if (node.IsFail) + { + dump.AppendLine($"{pad}FAIL"); + return; + } + float d = Vector3.Dot(node.SplittingPlane.Normal, eye) + node.SplittingPlane.D; + int side = d > WalkVisibilityMath.Epsilon ? 0 + : d < -WalkVisibilityMath.Epsilon ? 1 : 2; + string ports = node.InPortals is null + ? "" + : " PORT[" + string.Join(',', node.InPortals.Select( + p => $"idx{p.PortalIndex}->{building.Portals[p.PortalIndex].OtherCellId:x8}")) + "]"; + dump.AppendLine( + $"{pad}N=({node.SplittingPlane.Normal.X:f4},{node.SplittingPlane.Normal.Y:f4}," + + $"{node.SplittingPlane.Normal.Z:f4}) D={node.SplittingPlane.D:f4} " + + $"d={d:f6} side={side}{ports}"); + DumpNode(node.PosNode, eye, building, depth + 1, dump); + DumpNode(node.NegNode, eye, building, depth + 1, dump); + } + + private static int CountPorts(WalkBspNode? node) + => node is null ? 0 + : (node.IsPortal ? 1 : 0) + CountPorts(node.PosNode) + CountPorts(node.NegNode); + + private static float SignedArea(Vector2[] verts) + { + float sum = 0f; + for (int i = 0; i < verts.Length; i++) + { + Vector2 a = verts[i]; + Vector2 b = verts[(i + 1) % verts.Length]; + sum += a.X * b.Y - b.X * a.Y; + } + return 0.5f * sum; + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkProductionFrameContextTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkProductionFrameContextTests.cs new file mode 100644 index 00000000..e8daa1dc --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkProductionFrameContextTests.cs @@ -0,0 +1,131 @@ +using System.Numerics; +using AcDream.App.Rendering; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// Campaign FW3.1 — hermetic (no DAT) coverage of the production +/// frame context: cell resolution through , +/// building resolution through , and the +/// CyPlane/ray-cast wiring. This proves the SEAM (does the context read the +/// right registries the right way); the ten-fixture conformance gate proves +/// the WORLD DATA those registries are fed is correct. +public sealed class WalkProductionFrameContextTests +{ + private static Matrix4x4 SimpleViewProjection() => + Matrix4x4.CreateLookAt(Vector3.Zero, Vector3.UnitY, Vector3.UnitZ) + * Matrix4x4.CreatePerspectiveFieldOfView(MathF.PI / 3f, 4f / 3f, 0.1f, 1000f); + + [Fact] + public void GetVisible_ResolvesThroughTheCommittedCellVisibilityRegistry() + { + var cellVisibility = new CellVisibility(); + var walkCell = new WalkCell { CellId = 0xA9B40100u }; + var loaded = new LoadedCell { CellId = 0xA9B40100u, Walk = walkCell }; + cellVisibility.CommitLandblock(0xA9B4FFFFu, new[] { loaded }); + var ctx = new WalkProductionFrameContext( + cellVisibility, new WalkBuildingRegistry(), Vector3.Zero, Vector3.UnitY, + SimpleViewProjection(), 1024f, 768f); + + Assert.Same(walkCell, ctx.GetVisible(0xA9B40100u)); + Assert.Null(ctx.GetVisible(0xA9B40101u)); + } + + [Fact] + public void GetVisible_ReturnsNullWhenTheCommittedCellHasNoWalkModel() + { + // A hand-built LoadedCell that never went through + // EnvCellLandblockBuildBuilder.BuildVisibilityCell (test-only + // shortcut some existing fixtures take) — Walk stays null. + var cellVisibility = new CellVisibility(); + var loaded = new LoadedCell { CellId = 0xA9B40100u }; + cellVisibility.CommitLandblock(0xA9B4FFFFu, new[] { loaded }); + var ctx = new WalkProductionFrameContext( + cellVisibility, new WalkBuildingRegistry(), Vector3.Zero, Vector3.UnitY, + SimpleViewProjection(), 1024f, 768f); + + Assert.Null(ctx.GetVisible(0xA9B40100u)); + } + + [Fact] + public void ObjectToClipAndViewpointIn_UseTheCellsOwnTransforms() + { + var cell = new WalkCell + { + CellId = 1, + WorldTransform = Matrix4x4.CreateTranslation(10f, 0f, 0f), + InverseWorldTransform = Matrix4x4.CreateTranslation(-10f, 0f, 0f), + }; + Matrix4x4 vp = SimpleViewProjection(); + var ctx = new WalkProductionFrameContext( + new CellVisibility(), new WalkBuildingRegistry(), new Vector3(10f, 0f, 0f), Vector3.UnitY, + vp, 1024f, 768f); + + Assert.Equal(cell.WorldTransform * vp, ctx.ObjectToClip(cell)); + Assert.Equal(Vector3.Zero, ctx.ViewpointIn(cell)); + } + + [Fact] + public void ViewpointInBuilding_ResolvesThroughWalkBuildingRegistry() + { + var registry = new WalkBuildingRegistry(); + var building = new WalkBuilding { PositionCellId = 1 }; + Matrix4x4 world = Matrix4x4.CreateTranslation(5f, 0f, 0f); + Matrix4x4.Invert(world, out Matrix4x4 inverse); + registry.Publish(0xA9B4FFFFu, new[] { new WalkBuildingFactory.Entry(building, world, inverse) }); + var ctx = new WalkProductionFrameContext( + new CellVisibility(), registry, new Vector3(5f, 0f, 0f), Vector3.UnitY, + SimpleViewProjection(), 1024f, 768f); + + Assert.Equal(Vector3.Zero, ctx.ViewpointInBuilding(building)); + } + + [Fact] + public void ViewpointInBuilding_ThrowsWhenTheBuildingIsNotCommitted() + { + // Fail loud (the PV3 post-mortem rule): a walk/registry desync must + // never resolve to a silently-skipped building. + var ctx = new WalkProductionFrameContext( + new CellVisibility(), new WalkBuildingRegistry(), Vector3.Zero, Vector3.UnitY, + SimpleViewProjection(), 1024f, 768f); + var unregistered = new WalkBuilding { PositionCellId = 1 }; + + Assert.Throws(() => ctx.ViewpointInBuilding(unregistered)); + } + + [Fact] + public void ViewerDistanceTo_MeasuresToTheBuildingsTransformedSortCenter() + { + var registry = new WalkBuildingRegistry(); + var building = new WalkBuilding { PositionCellId = 1, SortCenter = new Vector3(0f, 3f, 0f) }; + Matrix4x4 world = Matrix4x4.CreateTranslation(0f, 10f, 0f); + Matrix4x4.Invert(world, out Matrix4x4 inverse); + registry.Publish(0xA9B4FFFFu, new[] { new WalkBuildingFactory.Entry(building, world, inverse) }); + var ctx = new WalkProductionFrameContext( + new CellVisibility(), registry, Vector3.Zero, Vector3.UnitY, + SimpleViewProjection(), 1024f, 768f); + + Assert.Equal(13f, ctx.ViewerDistanceTo(building)); + } + + [Fact] + public void CyPlane_MatchesTheRetailNearPlaneFormula() + { + Vector3 forward = Vector3.UnitY; + var eye = new Vector3(0f, 5f, 0f); + var ctx = new WalkProductionFrameContext( + new CellVisibility(), new WalkBuildingRegistry(), eye, forward, + SimpleViewProjection(), 1024f, 768f); + + Assert.Equal(forward, ctx.CyPlane.Normal); + Assert.Equal(-Vector3.Dot(eye, forward) - WalkProductionFrameContext.ZNear, ctx.CyPlane.D); + } + + [Fact] + public void Constructor_RejectsANonInvertibleViewProjection() + { + Assert.Throws(() => new WalkProductionFrameContext( + new CellVisibility(), new WalkBuildingRegistry(), Vector3.Zero, Vector3.UnitY, + default, 1024f, 768f)); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkProductionWorldConformanceTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkProductionWorldConformanceTests.cs new file mode 100644 index 00000000..b78307fc --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkProductionWorldConformanceTests.cs @@ -0,0 +1,321 @@ +using AcDream.App.Rendering; +using AcDream.App.Tests.Rendering; +using AcDream.App.Rendering.Walk; +using AcDream.Content; +using DatReaderWriter; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Options; +using System.Numerics; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Campaign FW3.1's load-bearing deliverable: the ten pose-stamped oracle +/// fixtures (docs/research/2026-08-30-fw-walk-oracle/), replayed through the +/// PRODUCTION world-data builders +/// (/ +/// / — the same code +/// EnvCellLandblockBuildBuilder/LandblockBuildFactory run at +/// real landblock-build time, consuming ONLY the legal +/// seam), must reproduce the identical walk +/// output already proves against the +/// FW1 test adapter (WalkWorldDatAdapter/WalkLandscapeDatBuilder). +/// +/// This class deliberately does NOT touch +/// (frozen — must stay green untouched) but reuses its driver/signature +/// helpers verbatim: , +/// , , +/// . +/// is typed against the TEST adapter's WalkWorldDatAdapter.BuildingEntry +/// record — structurally identical to +/// (same three fields) — so below adapts +/// one into the other rather than touching the shared context type. +/// +/// mirrors the FW1 harness's +/// WalkLandscapeDatBuilder.Build loop structure and ring math +/// EXACTLY (51×51 grid, WalkLandscapeAssembler.MidRadius = 25, +/// buildings/stab-cells only at full resolution), but every DATA-BUILDING +/// step below it — cells, buildings, the drawing BSP, z-slab — calls the +/// PRODUCTION functions. That is the whole conformance claim: the grid/ring +/// assembly is proven once (FW1's existing gate, via +/// 's own port of that same math); this +/// class proves the DATA those slots are filled with is identical to the +/// FW1 test adapter's. +/// +[Trait("Lane", "InstalledDat")] +public sealed class WalkProductionWorldConformanceTests +{ + private sealed class Recorder : IWalkEventSink + { + public readonly List Events = new(); + public void Emit(in WalkEvent walkEvent) => Events.Add(walkEvent); + } + + private static DatCollection OpenDats() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory; see docs/release-gate.md."); + } + return new DatCollection(datDir!, DatAccessType.Read); + } + + /// Builds the walk's world data (landscape + interior cells + + /// buildings) for a camera pose through the PRODUCTION builders, in the + /// exact shape expects. Mirrors + /// WalkLandscapeDatBuilder.Build's grid loop; every cell/building + /// constructed inside it comes from / + /// . + private static (WalkLandscapeAssembler Assembler, Dictionary Cells, + Dictionary Buildings) + BuildProductionWorld(IDatReaderWriter dats, uint cameraCellId, Vector3 cameraOrigin) + { + int cameraBlockX = (int)(cameraCellId >> 24); + int cameraBlockY = (int)((cameraCellId >> 16) & 0xFF); + var assembler = new WalkLandscapeAssembler(); + var cells = new Dictionary(); + var buildings = new Dictionary(); + Region region = (Region)dats.Get(0x13000000u)!; + float[] heightTable = region.LandDefs.LandHeightTable; + + for (int gx = 0; gx < WalkLandscapeAssembler.GridWidth; gx++) + { + for (int gy = 0; gy < WalkLandscapeAssembler.GridWidth; gy++) + { + int blockX = cameraBlockX + gx - WalkLandscapeAssembler.MidRadius; + int blockY = cameraBlockY + gy - WalkLandscapeAssembler.MidRadius; + if (blockX < 0 || blockX > 0xFF || blockY < 0 || blockY > 0xFF) + continue; + uint landblockId = (uint)((blockX << 24) | (blockY << 16)); + if (dats.Get(landblockId | 0xFFFFu) is not LandBlock landBlock) + continue; + + byte maxByte = 0, minByte = 255; + foreach (byte h in landBlock.Height) + { + if (h > maxByte) maxByte = h; + if (h < minByte) minByte = h; + } + float maxZ = heightTable[maxByte] + 200f; + float minZ = heightTable[minByte] - 1f; + + var blockOffset = new Vector3( + (gx - WalkLandscapeAssembler.MidRadius) * WalkLandscape.BlockLength, + (gy - WalkLandscapeAssembler.MidRadius) * WalkLandscape.BlockLength, + 0f); + + var blockBuildings = new List(); + if (WalkLandscapeAssembler.SideCellCountForRing(WalkLandscapeAssembler.RingOf(gx, gy)) == 8) + { + LandBlockInfo? info = dats.Get(landblockId | 0xFFFEu); + blockBuildings = WalkBuildingFactory.Build(dats, landblockId, info?.Buildings, blockOffset); + foreach (WalkBuildingFactory.Entry entry in blockBuildings) + { + buildings[entry.Building] = new WalkWorldDatAdapter.BuildingEntry( + entry.Building, entry.WorldTransform, entry.InverseWorldTransform); + + // Retail's loaded-interior rule (CLandBlock::init_buildings + // @0052fd80 -> add_to_stablist -> grab_visible_cells): a + // full-res block loads exactly its buildings' portal stab + // cells, matching WalkLandscapeDatBuilder's harness scope. + foreach (WalkBldPortal portal in entry.Building.Portals) + { + if (portal.OtherCellId != 0xFFFFFFFFu && !cells.ContainsKey(portal.OtherCellId)) + { + WalkCell? c = WalkCellFactory.BuildCell(dats, portal.OtherCellId, blockOffset); + if (c is not null) cells[c.CellId] = c; + } + foreach (uint stab in portal.StabList) + { + if (cells.ContainsKey(stab)) continue; + WalkCell? c = WalkCellFactory.BuildCell(dats, stab, blockOffset); + if (c is not null) cells[c.CellId] = c; + } + } + } + } + assembler.PublishLandblock(landblockId, maxZ, minZ, blockBuildings); + } + } + assembler.SetViewer(cameraCellId, cameraOrigin); + return (assembler, cells, buildings); + } + + [Fact] + public void Street_outdoor_first_frame_diff() + { + IReadOnlyList frames = WalkOracleTrace.Load("posed/holtburg-street-outdoor"); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + using var adapter = new DatCollectionAdapter(dats); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + (WalkLandscapeAssembler assembler, Dictionary cells, + Dictionary buildings) = + BuildProductionWorld(adapter, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, cells) { Buildings = buildings }; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, null, assembler.Landscape, ctx, recorder); + + string expected = WalkTraceReplayContext.Signature(frame); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + Assert.True( + expected == actual, + $"production walk diverged from the FW1 test adapter\nEXPECTED: {expected}\nACTUAL: {actual}"); + } + + [Fact] + public void Doorway_still_first_frame_diff() + { + IReadOnlyList frames = WalkOracleTrace.Load("posed/holtburg-doorway-still"); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + using var adapter = new DatCollectionAdapter(dats); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + (WalkLandscapeAssembler assembler, Dictionary cells, + Dictionary buildings) = + BuildProductionWorld(adapter, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, cells) { Buildings = buildings }; + WalkCell camera = Assert.Contains(frame.Pose.CellId, cells); + // Matches WalkTraceConformanceTests.Doorway_still_first_frame_diff: + // this capture ran under cdb load with Render::deg_mul depressed to + // the portless-arm threshold. Same environment pin, same reason. + var walk = new RetailFrameWalk { DegradeMultiplier = 0f }; + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, camera, assembler.Landscape, ctx, recorder); + + string expected = WalkTraceReplayContext.Signature(frame); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + Assert.True( + expected == actual, + $"production walk diverged from the FW1 test adapter\nEXPECTED: {expected}\nACTUAL: {actual}"); + } + + [Theory] + [InlineData("posed/terrace-center")] + [InlineData("posed/terrace-edge")] + [InlineData("posed/cathedral-arrival")] + public void Still_fixture_first_frame_reproduces_exactly(string fixture) + { + IReadOnlyList frames = WalkOracleTrace.Load(fixture); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + using var adapter = new DatCollectionAdapter(dats); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + (WalkLandscapeAssembler assembler, Dictionary cells, + Dictionary buildings) = + BuildProductionWorld(adapter, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, cells) { Buildings = buildings }; + WalkCell? camera = (frame.Pose.CellId & 0xFFFFu) >= 0x100 + ? Assert.Contains(frame.Pose.CellId, cells) + : null; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, camera, assembler.Landscape, ctx, recorder); + + string expected = WalkTraceReplayContext.Signature(frame); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + Assert.True( + expected == actual, + $"production walk diverged from the FW1 test adapter ({fixture})\nEXPECTED: {expected}\nACTUAL: {actual}"); + } + + [Fact] + public void Foundry_entry_reproduces_every_frame_before_the_f67_order_segment() + { + // Same F67-F79 parked segment as WalkTraceConformanceTests (the + // building-a9b40036-root-plane viewpoint question is a walk/ported- + // algorithm question, not a world-data question — out of scope for + // this class). Frames 1-66 must still reproduce exactly. + MovingFixtureReplay("posed/foundry-entry", stopBeforeFrame: 67); + } + + [Theory] + [InlineData("posed/holtburg-walkout")] + [InlineData("posed/holtburg-transitions")] + [InlineData("posed/holtburg-walkabout")] + public void Moving_fixture_reproduces_every_pairable_frame(string fixture) + => MovingFixtureReplay(fixture); + + private void MovingFixtureReplay(string fixture, int stopBeforeFrame = int.MaxValue) + { + IReadOnlyList frames = WalkOracleTrace.Load(fixture); + Assert.True(frames.Count >= 3); + using DatCollection dats = OpenDats(); + using var adapter = new DatCollectionAdapter(dats); + WalkOraclePose anchor = frames[1].Pose!; + (WalkLandscapeAssembler assembler, Dictionary cells, + Dictionary buildings) = + BuildProductionWorld(adapter, anchor.CellId, anchor.Origin); + var walk = new RetailFrameWalk(); + + for (int n = 1; n < frames.Count - 1; n++) + { + WalkOracleFrame frame = frames[n]; + if (frame.Number >= stopBeforeFrame) break; + string expected = WalkTraceReplayContext.Signature(frame); + string? firstActual = null; + bool matched = false; + foreach (WalkOraclePose pose in new[] { frames[n + 1].Pose!, frame.Pose! }) + { + Assert.NotNull(pose); + assembler.SetViewer(pose.CellId, pose.Origin); + var ctx = new WalkTraceReplayContext(pose, cells) { Buildings = buildings }; + WalkCell? camera = null; + if ((pose.CellId & 0xFFFFu) >= 0x100) + { + Assert.True( + cells.TryGetValue(pose.CellId, out camera), + $"frame {frame.Number}: interior camera cell {pose.CellId:x8} not loaded"); + } + var recorder = new Recorder(); + walk.WalkFrame(pose.CellId, camera, assembler.Landscape, ctx, recorder); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + firstActual ??= actual; + if (actual == expected) + { + matched = true; + break; + } + } + Assert.True( + matched, + $"frame {frame.Number} diverged under both adjacent poses ({fixture})\n" + + $"EXPECTED: {expected}\nACTUAL: {firstActual}"); + } + } + + [Fact] + public void Foundry_deep_reproduces_every_complete_frame_exactly() + { + IReadOnlyList frames = WalkOracleTrace.Load("posed/foundry-deep"); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + using var adapter = new DatCollectionAdapter(dats); + Dictionary cells = + WalkCellFactory.BuildInteriorCells(adapter, 0xA9B40000u, Vector3.Zero); + var landscape = new WalkLandscape { MidWidth = 1, Blocks = new WalkLandBlock?[1] }; + + foreach (WalkOracleFrame frame in frames) + { + Assert.NotNull(frame.Pose); + WalkCell camera = Assert.Contains(frame.Pose!.CellId, cells); + var ctx = new WalkTraceReplayContext(frame.Pose, cells); + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, camera, landscape, ctx, recorder); + + Assert.Equal( + WalkTraceReplayContext.Signature(frame), + WalkTraceReplayContext.Signature(recorder.Events)); + } + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkScreenClipTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkScreenClipTests.cs new file mode 100644 index 00000000..99bbaa4e --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkScreenClipTests.cs @@ -0,0 +1,94 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class WalkScreenClipTests +{ + private const float W = 640f, H = 480f; + + // The root full-viewport quad in retail's vertex order (0,H)(W,H)(W,0)(0,0). + private static readonly Vector2[] RootQuad = + [ + new(0, H), new(W, H), new(W, 0), new(0, 0), + ]; + + private static WalkScreenPoint Pt(float x, float y, float w = 1f) + => new(x * w, y * w, 0f, w); // homogeneous: screen * w + + [Fact] + public void Transform_maps_clip_center_to_screen_center_with_y_flip() + { + Matrix4x4 identity = Matrix4x4.Identity; + + WalkScreenPoint center = WalkScreenClip.TransformToScreen( + Vector3.Zero, identity, W, H); + Assert.Equal(W / 2, center.X); + Assert.Equal(H / 2, center.Y); + Assert.Equal(1f, center.W); + + // Clip y = +1 (top of clip space) lands at screen y = 0 (top-left origin). + WalkScreenPoint top = WalkScreenClip.TransformToScreen( + new Vector3(0, 1, 0), identity, W, H); + Assert.Equal(0f, top.Y); + } + + [Fact] + public void Fully_inside_polygon_survives_unchanged_with_original_winding() + { + Span tri = [Pt(100, 100), Pt(300, 120), Pt(200, 300)]; + Span outPts = stackalloc WalkScreenPoint[16]; + + int n = WalkScreenClip.ClipAgainstView(tri, RootQuad, outPts); + + Assert.Equal(3, n); + Assert.Equal(100f, outPts[0].X); + Assert.Equal(300f, outPts[1].X); + Assert.Equal(200f, outPts[2].X); + } + + [Fact] + public void Polygon_straddling_the_left_edge_is_clipped_at_x_zero() + { + Span tri = [Pt(-100, 100), Pt(100, 100), Pt(100, 300)]; + Span outPts = stackalloc WalkScreenPoint[16]; + + int n = WalkScreenClip.ClipAgainstView(tri, RootQuad, outPts); + + Assert.True(n >= 3); + for (int i = 0; i < n; i++) + Assert.True(outPts[i].X / outPts[i].W >= -0.001f, $"vertex {i} left of x=0"); + // Something was actually cut (an intersection vertex exists at x≈0). + bool touchesEdge = false; + for (int i = 0; i < n; i++) + if (MathF.Abs(outPts[i].X / outPts[i].W) < 0.001f) touchesEdge = true; + Assert.True(touchesEdge); + } + + [Fact] + public void Polygon_fully_outside_one_edge_returns_zero() + { + Span tri = [Pt(-300, 100), Pt(-100, 100), Pt(-200, 300)]; + Span outPts = stackalloc WalkScreenPoint[16]; + + Assert.Equal(0, WalkScreenClip.ClipAgainstView(tri, RootQuad, outPts)); + } + + [Fact] + public void W_plane_clips_points_behind_the_eye() + { + // One vertex behind the eye (w < cdstW); survivors get intersections + // at w == cdstW rather than dropping the polygon. + Span tri = + [ + Pt(100, 100), Pt(300, 100), new WalkScreenPoint(200, 200, 0, -0.5f), + ]; + Span outPts = stackalloc WalkScreenPoint[16]; + + int n = WalkScreenClip.ClipAgainstView(tri, RootQuad, outPts); + + Assert.True(n >= 3); + for (int i = 0; i < n; i++) + Assert.True(outPts[i].W >= WalkScreenClip.MinW - 1e-6f); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkStaticStreamPopulatorTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkStaticStreamPopulatorTests.cs new file mode 100644 index 00000000..4bd0f689 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkStaticStreamPopulatorTests.cs @@ -0,0 +1,638 @@ +using System.Collections.Concurrent; +using System.Collections.ObjectModel; +using System.Diagnostics.CodeAnalysis; +using System.Numerics; +using System.Reflection; +using AcDream.App.Rendering; +using AcDream.App.Rendering.Gpu; +using AcDream.App.Rendering.Gpu.Vk; +using AcDream.App.Rendering.Scene; +using AcDream.App.Rendering.Selection; +using AcDream.App.Rendering.Wb; +using AcDream.App.Rendering.Walk; +using AcDream.App.Tests.Rendering.Gpu; +using AcDream.Content; +using AcDream.Core.Meshing; +using AcDream.Core.World; +using DatReaderWriter; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Enums; +using DatReaderWriter.Lib.IO; +using Microsoft.Extensions.Logging.Abstractions; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Campaign FW stage FW3.2a: the walk→draw population layer's data- +/// equivalence referee. Covers +/// (the shared per-entity classify seam), +/// (opaque → , translucent → the alpha queue, +/// selection publish), and the FW3.2a own-cull-scratch fix to the ordered +/// submitter (PrepareOrderedStream/DrawOrderedRange as of +/// Campaign FW stage FW3.4a). +/// +public sealed class WalkStaticStreamPopulatorTests +{ + // ── Test doubles ──────────────────────────────────────────────────────── + + private sealed class RecordingSelectionSink : IRetailSelectionRenderSink + { + public readonly List<(uint ServerGuid, uint LocalEntityId, int PartIndex, uint GfxObjId, Matrix4x4 LocalToWorld)> + Calls = new(); + + public void AddVisiblePart( + uint serverGuid, uint localEntityId, int partIndex, uint gfxObjId, Matrix4x4 partWorld) => + Calls.Add((serverGuid, localEntityId, partIndex, gfxObjId, partWorld)); + } + + // ── Synthetic RenderProjectionRecord construction ────────────────────── + + private static RenderProjectionRecord MakeRecord( + uint localEntityId, + uint serverGuid, + Vector3 position, + IReadOnlyList meshRefs, + bool isBuildingShell = false, + uint parentCellId = 0u) => + new( + Id: RenderProjectionId.FromRaw(localEntityId), + ProjectionClass: RenderProjectionClass.OutdoorStatic, + OwnerIncarnation: RenderOwnerIncarnation.FromRaw(1), + Transform: new RenderTransform(Matrix4x4.CreateTranslation(position)), + PreviousTransform: default, + MeshSet: default, + Material: default, + Residency: default, + Bounds: default, + Flags: RenderProjectionFlags.Draw, + DegradeState: default, + SortKey: new RenderSortKey(0), + DirtyMask: default, + Source: new RenderSourceMetadata( + LocalEntityId: localEntityId, + ServerGuid: serverGuid, + SourceId: 0, + ParentCellId: parentCellId, + EffectCellId: 0, + BuildingShellAnchorCellId: 0, + TransformFingerprint: default, + GeometryFingerprint: default, + AppearanceFingerprint: default), + EntityPayload: new RenderEntityPayload( + MeshRefs: meshRefs, + PaletteOverride: null, + IsBuildingShell: isBuildingShell)); + + private static ObjectRenderBatch MakeBatch( + uint surfaceId, + TranslucencyKind translucency, + uint firstIndex, + int baseVertex, + int indexCount, + uint textureSlotIndex, + uint textureLayer = 0, + CullMode cullMode = CullMode.CounterClockwise) => + new() + { + Key = new TextureKey { SurfaceId = surfaceId, IsSolid = false }, + Translucency = translucency, + FirstIndex = firstIndex, + BaseVertex = (uint)baseVertex, + IndexCount = indexCount, + TextureSlot = new GpuTextureSlot(textureSlotIndex), + TextureIndex = (int)textureLayer, + }; + + private static ObjectRenderData MakeFlatMesh(params ObjectRenderBatch[] batches) => + new() { Batches = new List(batches) }; + + // ── Reflection seam: ObjectMeshManager owns no test-injection API, and + // driving real GPU/GfxObj upload for a unit test is out of this stage's + // scope — ObjectRenderData/ObjectRenderBatch are plain settable classes, + // so this seeds the manager's private cache directly. ────────────────── + + private static void InjectRenderData(ObjectMeshManager manager, ulong id, ObjectRenderData data) + { + FieldInfo field = typeof(ObjectMeshManager).GetField( + "_renderData", BindingFlags.NonPublic | BindingFlags.Instance) + ?? throw new InvalidOperationException( + "ObjectMeshManager._renderData field not found — test relies on this exact name."); + var dict = (ConcurrentDictionary)field.GetValue(manager)!; + dict[id] = data; + } + + // ── Deliverable 1: ClassifyEntityForWalk data equivalence ───────────── + + [Fact] + public void ClassifyEntityForWalk_OneOpaqueAndOneTranslucentPart_YieldsBatchesInRecordOrderWithCorrectIsOpaque() + { + using var fx = new DispatcherFixture(); + const ulong opaqueGfxObj = 0x0100_0001UL; + const ulong alphaGfxObj = 0x0100_0002UL; + InjectRenderData(fx.Manager, opaqueGfxObj, MakeFlatMesh( + MakeBatch(0x08000001u, TranslucencyKind.Opaque, firstIndex: 0, baseVertex: 0, indexCount: 3, textureSlotIndex: 1))); + InjectRenderData(fx.Manager, alphaGfxObj, MakeFlatMesh( + MakeBatch(0x08000002u, TranslucencyKind.AlphaBlend, firstIndex: 3, baseVertex: 4, indexCount: 6, textureSlotIndex: 2))); + + var meshRefs = new[] + { + new MeshRef((uint)opaqueGfxObj, Matrix4x4.CreateTranslation(1, 0, 0)), + new MeshRef((uint)alphaGfxObj, Matrix4x4.CreateTranslation(0, 1, 0)), + }; + RenderProjectionRecord record = MakeRecord( + localEntityId: 100, serverGuid: 0, position: new Vector3(5, 6, 7), meshRefs); + + var batches = new List(); + var selectionParts = new List(); + fx.Dispatcher.ClassifyEntityForWalk(in record, tupleLandblockId: 0x8C04u, batches, selectionParts); + + Assert.Equal(2, batches.Count); + + WbDrawDispatcher.WalkClassifiedBatch opaque = batches[0]; + Assert.True(opaque.IsOpaque); + Assert.Equal(TranslucencyKind.Opaque, opaque.Key.Translucency); + Assert.Equal(0u, opaque.Key.FirstIndex); + Assert.Equal(3, opaque.Key.IndexCount); + Assert.Equal(1u, opaque.Key.TextureSlot.Index); + Assert.Equal(1f, opaque.Alpha); + Assert.Equal(meshRefs[0].PartTransform * record.Transform.LocalToWorld, opaque.Transform); + + WbDrawDispatcher.WalkClassifiedBatch translucent = batches[1]; + Assert.False(translucent.IsOpaque); + Assert.Equal(TranslucencyKind.AlphaBlend, translucent.Key.Translucency); + Assert.Equal(3u, translucent.Key.FirstIndex); + Assert.Equal(6, translucent.Key.IndexCount); + Assert.Equal(2u, translucent.Key.TextureSlot.Index); + Assert.Equal(meshRefs[1].PartTransform * record.Transform.LocalToWorld, translucent.Transform); + + Assert.Equal(2, selectionParts.Count); + Assert.Equal(100u, selectionParts[0].LocalEntityId); + Assert.Equal(0, selectionParts[0].PartIndex); + Assert.Equal((uint)opaqueGfxObj, selectionParts[0].GfxObjId); + Assert.Equal(opaque.Transform, selectionParts[0].LocalToWorld); + Assert.Equal(1, selectionParts[1].PartIndex); + Assert.Equal((uint)alphaGfxObj, selectionParts[1].GfxObjId); + } + + [Fact] + public void ClassifyEntityForWalk_SetupComposite_EncodesPartAndSetupPartIndexLikePackedRoute() + { + using var fx = new DispatcherFixture(); + const ulong setupGfxObj = 0x1000_0010UL; + const ulong trunkGfxObj = 0x0100_0011UL; + const ulong leavesGfxObj = 0x0100_0012UL; + + InjectRenderData(fx.Manager, trunkGfxObj, MakeFlatMesh( + MakeBatch(0x08000011u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + InjectRenderData(fx.Manager, leavesGfxObj, MakeFlatMesh( + MakeBatch(0x08000012u, TranslucencyKind.ClipMap, 3, 4, 6, 2))); + InjectRenderData(fx.Manager, setupGfxObj, new ObjectRenderData + { + IsSetup = true, + SetupParts = new List<(ulong GfxObjId, Matrix4x4 Transform)> + { + (trunkGfxObj, Matrix4x4.CreateTranslation(0, 0, 1)), + (leavesGfxObj, Matrix4x4.CreateTranslation(0, 0, 2)), + }, + }); + + var meshRefs = new[] { new MeshRef((uint)setupGfxObj, Matrix4x4.Identity) }; + RenderProjectionRecord record = MakeRecord(200, 0, Vector3.Zero, meshRefs); + + var batches = new List(); + var selectionParts = new List(); + fx.Dispatcher.ClassifyEntityForWalk(in record, 0x8C04u, batches, selectionParts); + + Assert.Equal(2, batches.Count); + Assert.Equal(2, selectionParts.Count); + // partIndex=0 (the entity's single top-level MeshRef) << 16 | setupPartIndex. + Assert.Equal(0, selectionParts[0].PartIndex); + Assert.Equal(1, selectionParts[1].PartIndex); + Assert.Equal((uint)trunkGfxObj, selectionParts[0].GfxObjId); + Assert.Equal((uint)leavesGfxObj, selectionParts[1].GfxObjId); + } + + // ── Deliverable 2: WalkStaticStreamPopulator routing ─────────────────── + + [Fact] + public void PopulateCell_OpaqueBatchAppendsOrderedDrawCommandInRecordOrderWithStageAndCellProvenance() + { + using var fx = new DispatcherFixture(); + const ulong gfxObj = 0x0100_0003UL; + InjectRenderData(fx.Manager, gfxObj, MakeFlatMesh( + MakeBatch(0x08000003u, TranslucencyKind.Opaque, 10, 2, 12, 5))); + + var record = MakeRecord(300, 0, new Vector3(1, 2, 3), new[] { new MeshRef((uint)gfxObj, Matrix4x4.Identity) }); + var populator = new WalkStaticStreamPopulator(fx.Dispatcher); + var stream = new OrderedDrawStream(); + + populator.PopulateCell( + stream, WalkDrawStage.CellStatic, cellId: 0x8C040100u, + new[] { record }, tupleLandblockId: 0x8C04u, + cameraWorldPosition: Vector3.Zero, viewProjection: Matrix4x4.Identity); + + Assert.Equal(1, stream.Count); + Assert.Equal(WalkDrawStage.CellStatic, stream.Stages[0]); + Assert.Equal(0x8C040100u, stream.CellIds[0]); + Assert.Equal(10u, stream.Keys[0].FirstIndex); + Assert.Equal(12, stream.Keys[0].IndexCount); + Assert.Equal(1f, stream.Alphas[0]); + Assert.Equal(record.Transform.LocalToWorld, stream.Transforms[0]); + } + + [Fact] + public void PopulateOutdoorStatics_UsesTheOutdoorStaticStage() + { + using var fx = new DispatcherFixture(); + const ulong gfxObj = 0x0100_0004UL; + InjectRenderData(fx.Manager, gfxObj, MakeFlatMesh( + MakeBatch(0x08000004u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + + var record = MakeRecord(400, 0, Vector3.Zero, new[] { new MeshRef((uint)gfxObj, Matrix4x4.Identity) }); + var populator = new WalkStaticStreamPopulator(fx.Dispatcher); + var stream = new OrderedDrawStream(); + + populator.PopulateOutdoorStatics( + stream, cellId: 0x8C040000u, new[] { record }, tupleLandblockId: 0x8C04u, + cameraWorldPosition: Vector3.Zero, viewProjection: Matrix4x4.Identity); + + Assert.Equal(1, stream.Count); + Assert.Equal(WalkDrawStage.OutdoorStatic, stream.Stages[0]); + } + + [Fact] + public void PopulateCell_TranslucentBatchDoesNotAppendToTheStreamAndReachesTheAlphaQueue() + { + using var fx = new DispatcherFixture(withAlphaQueue: true); + const ulong gfxObj = 0x0100_0005UL; + InjectRenderData(fx.Manager, gfxObj, MakeFlatMesh( + MakeBatch(0x08000005u, TranslucencyKind.AlphaBlend, 0, 0, 3, 1))); + + var record = MakeRecord(500, 0, new Vector3(0, 0, 10), new[] { new MeshRef((uint)gfxObj, Matrix4x4.Identity) }); + var populator = new WalkStaticStreamPopulator(fx.Dispatcher); + var stream = new OrderedDrawStream(); + + fx.AlphaQueue!.BeginFrame(); + populator.PopulateCell( + stream, WalkDrawStage.CellStatic, 0x8C040100u, new[] { record }, 0x8C04u, + cameraWorldPosition: Vector3.Zero, viewProjection: Matrix4x4.Identity); + + Assert.Equal(0, stream.Count); + Assert.Equal(1, fx.AlphaQueue.PendingCount); + fx.AlphaQueue.AbortFrame(); + } + + [Fact] + public void PopulateCell_PublishesSelectionPartsForEveryClassifiedEntity() + { + var sink = new RecordingSelectionSink(); + using var fx = new DispatcherFixture(selectionSink: sink); + const ulong gfxObj = 0x0100_0006UL; + InjectRenderData(fx.Manager, gfxObj, MakeFlatMesh( + MakeBatch(0x08000006u, TranslucencyKind.Opaque, 0, 0, 3, 1))); + + var record = MakeRecord(600, serverGuid: 0x8000_0060u, new Vector3(1, 1, 1), + new[] { new MeshRef((uint)gfxObj, Matrix4x4.Identity) }); + var populator = new WalkStaticStreamPopulator(fx.Dispatcher); + var stream = new OrderedDrawStream(); + + populator.PopulateCell( + stream, WalkDrawStage.CellStatic, 0x8C040100u, new[] { record }, 0x8C04u, + Vector3.Zero, Matrix4x4.Identity); + + var call = Assert.Single(sink.Calls); + Assert.Equal(0x8000_0060u, call.ServerGuid); + Assert.Equal(600u, call.LocalEntityId); + Assert.Equal(0, call.PartIndex); + Assert.Equal((uint)gfxObj, call.GfxObjId); + Assert.Equal(record.Transform.LocalToWorld, call.LocalToWorld); + } + + // ── SubmitWalkAlphaInstance: same viewer distance + per-instance data as + // DeferTransparentGroups, through the REAL RetailAlphaQueue. ─────────── + + [Fact] + public void SubmitWalkAlphaInstance_SubmitsTheSameViewerDistanceComputeViewerDistanceWouldProduce() + { + using var fx = new DispatcherFixture(withAlphaQueue: true); + fx.AlphaQueue!.BeginFrame(); + + var key = new GroupKey(10, 2, 6, new GpuTextureSlot(3), 1, TranslucencyKind.AlphaBlend, FoliageFlags: 0); + Vector3 localSortCenter = new(1, 2, 3); + Matrix4x4 model = Matrix4x4.CreateTranslation(4, 5, 6); + var cameraWorldPosition = Vector3.Zero; + var batch = new WbDrawDispatcher.WalkClassifiedBatch( + key, model, ClipSlot: 7, WbDrawDispatcher.InstanceLightSet.Disabled, IndoorFlag: 1, + Alpha: 0.5f, SelectionLighting: new Vector2(0.25f, 0.75f), DetailCategory: 1, + IsOpaque: false, LocalSortCenter: localSortCenter); + + fx.Dispatcher.SubmitWalkAlphaInstance(in batch, cameraWorldPosition, Matrix4x4.Identity); + + Assert.Equal(1, fx.AlphaQueue.PendingCount); + + // Same call DeferTransparentGroups makes per instance — independently + // computed here so the assertion cannot pass by construction. + float expectedDistance = RetailAlphaOrdering.ComputeViewerDistance( + localSortCenter, model, cameraWorldPosition); + + FieldInfo submissionsField = typeof(RetailAlphaQueue).GetField( + "_submissions", BindingFlags.NonPublic | BindingFlags.Instance)!; + var submissions = (List)submissionsField.GetValue(fx.AlphaQueue)!; + RetailAlphaSubmission submission = Assert.Single(submissions); + Assert.Equal(expectedDistance, submission.ViewerDistance, precision: 4); + Assert.Equal(0, submission.Token); + + fx.AlphaQueue.AbortFrame(); + } + + [Fact] + public void SubmitWalkAlphaInstance_RejectsAMismatchedViewProjectionInTheSameScope() + { + using var fx = new DispatcherFixture(withAlphaQueue: true); + fx.AlphaQueue!.BeginFrame(); + + var key = new GroupKey(0, 0, 3, new GpuTextureSlot(1), 0, TranslucencyKind.AlphaBlend, FoliageFlags: 0); + var batch = new WbDrawDispatcher.WalkClassifiedBatch( + key, Matrix4x4.Identity, 0, WbDrawDispatcher.InstanceLightSet.Disabled, 0, 1f, + Vector2.Zero, 0, IsOpaque: false, LocalSortCenter: new Vector3(0, 0, 10)); + + fx.Dispatcher.SubmitWalkAlphaInstance(in batch, Vector3.Zero, Matrix4x4.Identity); + + Assert.Throws(() => + fx.Dispatcher.SubmitWalkAlphaInstance( + in batch, Vector3.Zero, Matrix4x4.CreateTranslation(1, 0, 0))); + + fx.AlphaQueue.AbortFrame(); + } + + // ── Deliverable 3: the ordered submitter's own cull scratch ──────────── + + [Fact] + public void PrepareThenDrawOrderedStream_DoesNotReadOrCorruptTheSharedAlphaCullScratch() + { + using var fx = new DispatcherFixture(); + using DrawScope draw = fx.BeginDraw(); + + // Poison the SHARED _drawCullModes scratch the alpha path owns — the + // exact array the ordered submitter used to write into before FW3.2a. + // Under the OLD shared-scratch behavior this test's second assertion + // fails: the ordered path's own command overwrites index 0 with + // its own cull mode (Clockwise), destroying the alpha path's poison. + FieldInfo field = typeof(WbDrawDispatcher).GetField( + "_drawCullModes", BindingFlags.NonPublic | BindingFlags.Instance)!; + var poisonModes = (CullMode[])field.GetValue(fx.Dispatcher)!; + poisonModes[0] = CullMode.None; + + var stream = new OrderedDrawStream(); + stream.Append(new OrderedDrawCommand( + new GroupKey(0, 0, 3, new GpuTextureSlot(1), 0, TranslucencyKind.Opaque, FoliageFlags: 0, CullMode: CullMode.Clockwise), + Matrix4x4.Identity, WalkDrawStage.Terrain, 0, 0, + WbDrawDispatcher.InstanceLightSet.Disabled, 0, 1f, Vector2.Zero, 0)); + + fx.Dispatcher.PrepareOrderedStream(draw.Frame, stream, Matrix4x4.Identity); + fx.Dispatcher.DrawOrderedRange(draw.Pass, 0, stream.Count); + + // (1) The ordered submission's OWN recorded cull call reflects the + // STREAM's cull mode (Clockwise -> GpuCullMode.Front), not the + // poisoned shared array's (None). + List cullCalls = [.. fx.Device.Calls.OfType().Select(c => c.CullMode)]; + Assert.Equal([GpuCullMode.Front], cullCalls); + + // (2) The shared _drawCullModes scratch is UNTOUCHED — the ordered + // path never wrote through it. + var afterModes = (CullMode[])field.GetValue(fx.Dispatcher)!; + Assert.Equal(CullMode.None, afterModes[0]); + } + + // ── Fixture ───────────────────────────────────────────────────────────── + + private readonly struct DrawScope : IDisposable + { + private readonly IDisposable _publication; + private readonly IGpuPassEncoder _pass; + + public DrawScope(IGpuFrame frame, IGpuPassEncoder pass, IDisposable publication) + { + Frame = frame; + _pass = pass; + _publication = publication; + } + + public IGpuFrame Frame { get; } + + public IGpuPassEncoder Pass => _pass; + + public void Dispose() + { + _publication.Dispose(); + _pass.Dispose(); + } + } + + private sealed class DispatcherFixture : IDisposable + { + private readonly WbMeshAdapter _meshAdapter; + private readonly TextureCache _textures; + + public DispatcherFixture( + bool withAlphaQueue = false, + IRetailSelectionRenderSink? selectionSink = null) + { + Device = new RecordingGpuDevice(); + FrameLifetime = new GpuDeviceFrameLifetime(Device); + Scope = new VulkanWorldPassScope(sampleCount: 1); + _textures = new TextureCache(Device, new NoopDatReaderWriter()); + _meshAdapter = new WbMeshAdapter( + Device, + new NoopDatReaderWriter(), + new NullPreparedAssetSource(), + NullLogger.Instance, + Device.Retirement); + var entitySpawnAdapter = new EntitySpawnAdapter( + _textures, + _ => throw new NotSupportedException("Not exercised by these tests.")); + AlphaQueue = withAlphaQueue ? new RetailAlphaQueue() : null; + + Dispatcher = new WbDrawDispatcher( + Device, + FrameLifetime, + Scope, + _textures, + _meshAdapter, + entitySpawnAdapter, + new EntityClassificationCache(), + new AcDream.Core.Rendering.TranslucencyFadeManager(), + selectionSink: selectionSink, + alphaQueue: AlphaQueue); + } + + public RecordingGpuDevice Device { get; } + + public GpuDeviceFrameLifetime FrameLifetime { get; } + + public VulkanWorldPassScope Scope { get; } + + public WbDrawDispatcher Dispatcher { get; } + + public RetailAlphaQueue? AlphaQueue { get; } + + public ObjectMeshManager Manager => _meshAdapter.MeshManager!; + + public DrawScope BeginDraw() + { + FrameLifetime.BeginFrame(); + IGpuFrame frame = FrameLifetime.CurrentFrame!; + IGpuPassEncoder pass = frame.BeginPass( + GpuPassDescription.BackbufferClear( + "fw3-2a-walk-populator-test", Vector4.Zero, sampleCount: 1)); + IDisposable publication = Scope.Publish(pass); + Device.Clear(); + return new DrawScope(frame, pass, publication); + } + + public void Dispose() + { + Dispatcher.Dispose(); + _meshAdapter.Dispose(); + _textures.Dispose(); + Device.Dispose(); + } + } + + private sealed class NullPreparedAssetSource : IPreparedAssetSource + { + public PreparedAssetSourceStats Stats => default; + + public CacheStats DecodedTextureCacheStats => default; + + public PreparedAssetPresence Probe( + AcDream.Content.Pak.PakAssetType type, + uint sourceFileId) => + PreparedAssetPresence.Missing; + + public PreparedAssetReadResult Read( + in PreparedAssetRequest request, + CancellationToken cancellationToken = default) => + PreparedAssetReadResult.Missing; + + public void Dispose() + { + } + } + + private sealed class NoopDatReaderWriter : IDatReaderWriter + { + private readonly StubDatabase _portal = new(); + private readonly StubDatabase _highRes = new(); + private readonly StubDatabase _language = new(); + private readonly StubDatabase _cell = new(); + + public string SourceDirectory => string.Empty; + + public IDatDatabase Portal => _portal; + + public IDatDatabase Cell => _cell; + + public ReadOnlyDictionary CellRegions { get; } = + new(new Dictionary()); + + public IDatDatabase HighRes => _highRes; + + public IDatDatabase Language => _language; + + public IDatDatabase Local => _language; + + public ReadOnlyDictionary RegionFileMap { get; } = + new(new Dictionary()); + + public int PortalIteration => 0; + + public int CellIteration => 0; + + public int HighResIteration => 0; + + public int LanguageIteration => 0; + + public bool TryGetFileBytes( + uint regionId, + uint fileId, + ref byte[] bytes, + out int bytesRead) + { + bytesRead = 0; + return false; + } + + public IEnumerable GetAllIdsOfType() where T : IDBObj => + Array.Empty(); + + public IEnumerable ResolveId(uint id) => + Array.Empty(); + + public bool TrySave(T obj, int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + public bool TrySave( + uint regionId, + T obj, + int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + [return: MaybeNull] + public T Get(uint fileId) where T : IDBObj => default; + + public bool TryGet( + uint fileId, + [MaybeNullWhen(false)] out T value) where T : IDBObj + { + value = default; + return false; + } + + public void Dispose() + { + } + + private sealed class StubDatabase : IDatDatabase + { + public DatDatabase Db => throw new NotSupportedException(); + + public int Iteration => 0; + + public IEnumerable GetAllIdsOfType() where T : IDBObj => + Array.Empty(); + + public bool TryGet( + uint fileId, + [MaybeNullWhen(false)] out T value) where T : IDBObj + { + value = default; + return false; + } + + public bool TryGetFileBytes( + uint fileId, + [MaybeNullWhen(false)] out byte[] value) + { + value = null; + return false; + } + + public bool TryGetFileBytes( + uint fileId, + ref byte[] bytes, + out int bytesRead) + { + bytesRead = 0; + return false; + } + + public bool TrySave(T obj, int iteration = 0) where T : IDBObj => + throw new NotSupportedException(); + + public void Dispose() + { + } + } + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkTraceConformanceTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkTraceConformanceTests.cs new file mode 100644 index 00000000..3f3ba110 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkTraceConformanceTests.cs @@ -0,0 +1,243 @@ +using AcDream.App.Tests.Rendering; +using AcDream.App.Rendering.Walk; +using DatReaderWriter; +using DatReaderWriter.Options; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// FW1's conformance gate, first slice: replay pose-stamped oracle +/// fixtures through the ported walk and require the identical event +/// sequence. The projection-light interior fixtures gate first +/// (docs/research/2026-08-30-fw-walk-oracle/README.md, posed round); +/// the outdoor/landscape fixtures join as the landscape world build +/// lands. +/// +[Trait("Lane", "InstalledDat")] +public sealed class WalkTraceConformanceTests +{ + private sealed class Recorder : IWalkEventSink + { + public readonly List Events = new(); + public void Emit(in WalkEvent walkEvent) => Events.Add(walkEvent); + } + + private static DatCollection OpenDats() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory; see docs/release-gate.md."); + } + return new DatCollection(datDir!, DatAccessType.Read); + } + + [Fact] + public void Street_outdoor_first_frame_diff() + { + // The first landscape-involving conformance case: diff-first (the + // assert prints both signatures on mismatch for adjudication). + IReadOnlyList frames = + WalkOracleTrace.Load("posed/holtburg-street-outdoor"); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + WalkOracleFrame frame = frames[1]; // frame 2: pose settled (marker timing) + Assert.NotNull(frame.Pose); + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, world.Cells) + { + Buildings = world.Buildings, + }; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, null, world.Landscape, ctx, recorder); + + string expected = WalkTraceReplayContext.Signature(frame); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + Assert.True( + expected == actual, + $"walk diverged from retail\nEXPECTED: {expected}\nACTUAL: {actual}"); + } + + [Fact] + public void Doorway_still_first_frame_diff() + { + // Interior flood adjudication: DI + DC(ov=2, n=3) + the landscape + // through two exit views — tests the flood depth in isolation from + // the building look-in machinery. + IReadOnlyList frames = + WalkOracleTrace.Load("posed/holtburg-doorway-still"); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, world.Cells) + { + Buildings = world.Buildings, + }; + WalkCell camera = Assert.Contains(frame.Pose.CellId, world.Cells); + // Render::deg_mul is DYNAMIC (auto-tuned by frame load), and this + // capture ran right after the heavy terrace-edge capture with the + // multiplier depressed: at mul ≤ 0 the degrade thresholds sit at or + // below each level's ideal, so 001e (eff 29.3), 0026 (27.1), and + // 002f (43.4) all select the portless level 1 — retail's zero + // look-in floods. Every other fixture pins ≈ +0.99 (thresholds at + // max). The recon session's live dump read −0.99 under the same cdb + // load. Re-dump deg_mul per capture at the next retail session. + var walk = new RetailFrameWalk { DegradeMultiplier = 0f }; + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, camera, world.Landscape, ctx, recorder); + + string expected = WalkTraceReplayContext.Signature(frame); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + Assert.True( + expected == actual, + $"walk diverged from retail\nEXPECTED: {expected}\nACTUAL: {actual}"); + } + + [Theory] + [InlineData("posed/terrace-center")] + [InlineData("posed/terrace-edge")] + [InlineData("posed/cathedral-arrival")] + public void Still_fixture_first_frame_reproduces_exactly(string fixture) + { + IReadOnlyList frames = WalkOracleTrace.Load(fixture); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + WalkOracleFrame frame = frames[1]; + Assert.NotNull(frame.Pose); + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, frame.Pose!.CellId, frame.Pose.Origin); + var ctx = new WalkTraceReplayContext(frame.Pose, world.Cells) + { + Buildings = world.Buildings, + }; + WalkCell? camera = (frame.Pose.CellId & 0xFFFFu) >= 0x100 + ? Assert.Contains(frame.Pose.CellId, world.Cells) + : null; + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, camera, world.Landscape, ctx, recorder); + + string expected = WalkTraceReplayContext.Signature(frame); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + Assert.True( + expected == actual, + $"walk diverged from retail ({fixture})\nEXPECTED: {expected}\nACTUAL: {actual}"); + } + + [Fact] + public void Foundry_entry_reproduces_every_frame_before_the_f67_order_segment() + { + // F67–F79 (the fixture's terminal standing segment) diverge in ONE + // aspect: the flood SET through building a9b40036 is exact, but + // retail orders its DCs 116,118,11d where the replay orders + // 11d,116,118. The microscope isolates the flip to the ROOT plane + // of 0036's drawing BSP (N=(0,0,−1) D=2.8): the replay's + // building-local eye z is 2.33 (d=+0.47 → NEG-subtree first), while + // retail behaves as d<0 (POS-first) — a structural ~0.5 m frame + // question (positionPush(2) / part-scale semantics), only + // adjudicable by a live cdb dump of FrameCurrent->viewer.viewpoint + // during 0036's build_draw_portals_only (script: + // tools/walk-oracle/fw1-f67-viewpoint-probe.cdb). Frames 1–66 must + // reproduce exactly. + MovingFixtureReplay("posed/foundry-entry", stopBeforeFrame: 67); + } + + [Theory] + [InlineData("posed/holtburg-walkout")] + [InlineData("posed/holtburg-transitions")] + [InlineData("posed/holtburg-walkabout")] + public void Moving_fixture_reproduces_every_pairable_frame(string fixture) + => MovingFixtureReplay(fixture); + + private void MovingFixtureReplay(string fixture, int stopBeforeFrame = int.MaxValue) + { + // Marker timing: the pose stamped at frame N+1 is the camera state + // frame N drew with (fixture README) — pair events(N) with + // pose(N+1). One walk + one landscape carry state across frames, + // reproducing retail's cross-frame caches (the stale cell-order + // quirk included). + IReadOnlyList frames = WalkOracleTrace.Load(fixture); + Assert.True(frames.Count >= 3); + using DatCollection dats = OpenDats(); + WalkOraclePose anchor = frames[1].Pose!; + WalkLandscapeDatBuilder.BuiltWorld world = + WalkLandscapeDatBuilder.Build(dats, anchor.CellId, anchor.Origin); + var walk = new RetailFrameWalk(); + + for (int n = 1; n < frames.Count - 1; n++) + { + WalkOracleFrame frame = frames[n]; + if (frame.Number >= stopBeforeFrame) break; + string expected = WalkTraceReplayContext.Signature(frame); + // The marker dumps the PREVIOUS frame's camera, so frame N's + // true camera state lies between pose(N) and pose(N+1) — a + // capture artifact, not a port ambiguity. A frame passes when + // the replay matches under either adjacent pose. + string? firstActual = null; + bool matched = false; + foreach (WalkOraclePose pose in new[] { frames[n + 1].Pose!, frame.Pose! }) + { + Assert.NotNull(pose); + WalkLandscapeDatBuilder.SetViewer(world.Landscape, pose.CellId, pose.Origin); + var ctx = new WalkTraceReplayContext(pose, world.Cells) + { + Buildings = world.Buildings, + }; + WalkCell? camera = null; + if ((pose.CellId & 0xFFFFu) >= 0x100) + { + Assert.True( + world.Cells.TryGetValue(pose.CellId, out camera), + $"frame {frame.Number}: interior camera cell {pose.CellId:x8} not loaded"); + } + var recorder = new Recorder(); + walk.WalkFrame(pose.CellId, camera, world.Landscape, ctx, recorder); + string actual = WalkTraceReplayContext.Signature(recorder.Events); + firstActual ??= actual; + if (actual == expected) + { + matched = true; + break; + } + } + Assert.True( + matched, + $"frame {frame.Number} diverged under both adjacent poses ({fixture})\n" + + $"EXPECTED: {expected}\nACTUAL: {firstActual}"); + } + } + + [Fact] + public void Foundry_deep_reproduces_every_complete_frame_exactly() + { + IReadOnlyList frames = WalkOracleTrace.Load("posed/foundry-deep"); + Assert.NotEmpty(frames); + using DatCollection dats = OpenDats(); + Dictionary cells = + WalkWorldDatAdapter.BuildInteriorCells(dats, 0xA9B40000u); + var landscape = new WalkLandscape { MidWidth = 1, Blocks = new WalkLandBlock?[1] }; + + foreach (WalkOracleFrame frame in frames) + { + Assert.NotNull(frame.Pose); + WalkCell camera = Assert.Contains(frame.Pose!.CellId, cells); + var ctx = new WalkTraceReplayContext(frame.Pose, cells); + var walk = new RetailFrameWalk(); + var recorder = new Recorder(); + + walk.WalkFrame(frame.Pose.CellId, camera, landscape, ctx, recorder); + + Assert.Equal( + WalkTraceReplayContext.Signature(frame), + WalkTraceReplayContext.Signature(recorder.Events)); + } + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkTraceReplay.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkTraceReplay.cs new file mode 100644 index 00000000..30763590 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkTraceReplay.cs @@ -0,0 +1,159 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// The FW1 conformance replay harness: reconstructs the camera state from a +/// pose-stamped oracle frame and drives the ported walk over +/// adapter-built world data. Convention notes (adjudicate against the +/// fixtures, loudly, on any mismatch): +/// +/// The dumped quaternion is retail Frame storage order w,x,y,z +/// (q0=w) — unit-norm verified on the captures. +/// Retail's frame axes: +Y forward, +Z up (the camera looks along +/// the rotated +Y). +/// Pose origin is landblock-local, the same space the adapter's +/// cell transforms produce. +/// +/// +public sealed class WalkTraceReplayContext : IWalkFrameContext, IRetailFrameWalkContext +{ + // Retail projection globals, dumped live from the capture client + // (recon 2026-08-30 evening: Render::bw/bh/xinvscale/yinvscale/tx/ty/vdst). + public const float RetailViewportWidth = 1024f; + public const float RetailViewportHeight = 720f; + public const float RetailXInvScale = 0.00025f; + public const float RetailYInvScale = 0.00025f; + public const float RetailTx = 0.127875f; + public const float RetailTy = 0.089875f; + public const float RetailVdst = 0.1330766976f; + + private sealed class RetailRayCaster( + Vector3 right, Vector3 forward, Vector3 up) : IWalkRayCaster + { + // Retail's unproject (copy_view's ray path; equal to + // ScreenToViewTransform for these globals): + // u = sx·xinvscale − tx; w = sy·yinvscale − ty + // ray = Xaxis·u + Yaxis·vdst − Zaxis·w + public Vector3 RayThrough(float screenX, float screenY) + { + float u = screenX * RetailXInvScale - RetailTx; + float w = screenY * RetailYInvScale - RetailTy; + return right * u + forward * RetailVdst - up * w; + } + } + + private readonly Dictionary _cells; + private readonly Matrix4x4 _viewProjection; + private readonly IWalkRayCaster _rays; + + public WalkTraceReplayContext(WalkOraclePose pose, Dictionary cells) + { + _cells = cells; + WorldViewpoint = pose.Origin; + var rotation = new Quaternion(pose.Q1, pose.Q2, pose.Q3, pose.Q0); + // Basis convention RE-pinned 2026-08-30 (second pass): storage + // w,x,y,z; forward = rotated +Y — the retail Frame convention. The + // motion sweep briefly favored +X, but the walkabout camera was + // mouse-turned off the run direction; the terrace-edge fixture's + // EXTERNAL ground truth (the ledge faces the F518 vista, east) + // decodes east ONLY under +Y-forward, and +Y makes the street + // fixture's punch on/off-screen pattern match retail 4-for-4. + Vector3 forward = Vector3.Transform(Vector3.UnitY, rotation); + Vector3 up = Vector3.Transform(Vector3.UnitZ, rotation); + Vector3 right = Vector3.Transform(Vector3.UnitX, rotation); + + // The exact retail frustum: tan(halfFovY) = ty/vdst, aspect = tx/ty. + float fovY = 2f * MathF.Atan(RetailTy / RetailVdst); + Matrix4x4 view = Matrix4x4.CreateLookAt(pose.Origin, pose.Origin + forward, up); + Matrix4x4 projection = Matrix4x4.CreatePerspectiveFieldOfView( + fovY, RetailTx / RetailTy, 0.1f, 5000f); + _viewProjection = view * projection; + + ViewportWidth = RetailViewportWidth; + ViewportHeight = RetailViewportHeight; + _rays = new RetailRayCaster(right, forward, up); + + // The retail CY near plane: N = forward, d = −dot(eye, forward) − znear. + CyPlane = new WalkPlane(forward, -Vector3.Dot(pose.Origin, forward) - 0.1f); + } + + /// Building placements (camera-block-local) for the landscape + /// fixtures; empty for the interior-only ones. + public Dictionary Buildings { get; set; } + = new(); + + private Vector2[] _activeViewVerts = new Vector2[32]; + private int _activeViewVertCount; + + public Vector3 ViewpointIn(WalkCell cell) + => Vector3.Transform(WorldViewpoint, cell.InverseWorldTransform); + + public Matrix4x4 ObjectToClip(WalkCell cell) + => cell.WorldTransform * _viewProjection; + + public WalkCell? GetVisible(uint cellId) => _cells.GetValueOrDefault(cellId); + public IWalkRayCaster Rays => _rays; + public Vector3 WorldViewpoint { get; } + public float ViewportWidth { get; } + public float ViewportHeight { get; } + public WalkPlane CyPlane { get; } + public IWalkFrameContext CellContext => this; + + public void SetActiveView(WalkPortalView views, int index) + { + WalkViewPoly poly = views.View.Polys[index]; + if (_activeViewVerts.Length < poly.VertexCount) + _activeViewVerts = new Vector2[poly.VertexCount]; + for (int k = 0; k < poly.VertexCount; k++) + _activeViewVerts[k] = views.View.Vertices[poly.VertexIndex + k].Point; + _activeViewVertCount = poly.VertexCount; + } + + public Vector3 ViewpointInBuilding(WalkBuilding building) + => Vector3.Transform(WorldViewpoint, Buildings[building].InverseWorldTransform); + + public float ViewerDistanceTo(WalkBuilding building) + => Vector3.Distance( + WorldViewpoint, + Vector3.Transform(building.SortCenter, Buildings[building].WorldTransform)); + + public int ClipBuildingPolygon( + WalkBuilding building, WalkPolygon polygon, int side, Span output) + { + Matrix4x4 objectToClip = Buildings[building].WorldTransform * _viewProjection; + Span projected = stackalloc WalkScreenPoint[polygon.Vertices.Length]; + for (int i = 0; i < polygon.Vertices.Length; i++) + projected[i] = WalkScreenClip.TransformToScreen( + polygon.Vertices[i], objectToClip, ViewportWidth, ViewportHeight); + if (side != 0) + projected.Reverse(); + return WalkScreenClip.ClipAgainstView( + projected, _activeViewVerts.AsSpan(0, _activeViewVertCount), output); + } + + // ---- signatures for comparing walk output to oracle frames ---- + + public static string Signature(IEnumerable events) + => string.Join("|", events.Select(e => e.Kind switch + { + WalkEventKind.Landscape => "LS", + WalkEventKind.Building => $"BLD:{e.CellId:x8}", + WalkEventKind.DrawInside => $"DI:{e.CellId:x8}", + WalkEventKind.DrawCells => + $"DC:ov={e.OutsideViewCount}:{string.Join(',', e.Cells.Select(c => c.ToString("x8")))}", + _ => "?", + })); + + public static string Signature(WalkOracleFrame frame) + => string.Join("|", frame.Events.Select(e => e.Kind switch + { + WalkOracleEventKind.Landscape => "LS", + WalkOracleEventKind.Building => $"BLD:{e.CellId!.Value:x8}", + WalkOracleEventKind.DrawInside => $"DI:{e.CellId!.Value:x8}", + WalkOracleEventKind.DrawCells => + $"DC:ov={e.OutsideViewCount}:{string.Join(',', e.Cells.Select(c => c.ToString("x8")))}", + _ => "?", + })); +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkVisibilityMathTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkVisibilityMathTests.cs new file mode 100644 index 00000000..b1500aaa --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkVisibilityMathTests.cs @@ -0,0 +1,218 @@ +using System.Numerics; +using AcDream.App.Rendering.Walk; + +namespace AcDream.App.Tests.Rendering.Walk; + +public sealed class WalkVisibilityMathTests +{ + // ---- get_pt_limit @0x0054b840 ---- + + [Fact] + public void Up_normal_plane_encodes_inside_above_as_negative_height() + { + // Plane z >= 5 at the origin column: N=(0,0,1), d=-5 → h=5, inside above. + var plane = new WalkPlane(new Vector3(0, 0, 1), -5f); + Assert.Equal(-5f, WalkVisibilityMath.GetPointLimit(0, 0, plane)); + } + + [Fact] + public void Up_normal_plane_at_or_above_sky_height_is_outside() + { + var plane = new WalkPlane(new Vector3(0, 0, 1), -1000f); + Assert.Equal( + WalkVisibilityMath.OutsideColumn, + WalkVisibilityMath.GetPointLimit(0, 0, plane)); + } + + [Fact] + public void Up_normal_plane_with_nonpositive_height_is_wholly_inside() + { + var plane = new WalkPlane(new Vector3(0, 0, 1), 3f); // z >= -3 + Assert.Equal( + WalkVisibilityMath.InsideColumn, + WalkVisibilityMath.GetPointLimit(0, 0, plane)); + } + + [Fact] + public void Down_normal_plane_encodes_inside_below_as_positive_height() + { + // Plane z <= 7: N=(0,0,-1), d=7 → h=7, inside below. + var plane = new WalkPlane(new Vector3(0, 0, -1), 7f); + Assert.Equal(7f, WalkVisibilityMath.GetPointLimit(0, 0, plane)); + } + + [Fact] + public void Down_normal_plane_with_nonpositive_height_is_outside() + { + var plane = new WalkPlane(new Vector3(0, 0, -1), -2f); // z <= -2: nothing above ground + Assert.Equal( + WalkVisibilityMath.OutsideColumn, + WalkVisibilityMath.GetPointLimit(0, 0, plane)); + } + + [Fact] + public void Vertical_plane_uses_the_side_of_the_ground_point() + { + var plane = new WalkPlane(new Vector3(1, 0, 0), -10f); // x >= 10 + Assert.Equal( + WalkVisibilityMath.OutsideColumn, + WalkVisibilityMath.GetPointLimit(5f, 0, plane)); + Assert.Equal( + WalkVisibilityMath.InsideColumn, + WalkVisibilityMath.GetPointLimit(15f, 0, plane)); + // ON the plane (within epsilon) counts inside. + Assert.Equal( + WalkVisibilityMath.InsideColumn, + WalkVisibilityMath.GetPointLimit(10f, 0, plane)); + } + + // ---- corner_plane_check @0x0054b930 ---- + + [Theory] + [InlineData(1001f, 0f, 10f, WalkBoundingType.Outside)] // sentinel outside + [InlineData(0f, 0f, 10f, WalkBoundingType.EntirelyInside)] // sentinel inside + [InlineData(-5f, 6f, 10f, WalkBoundingType.EntirelyInside)] // inside above 5; slab [6,10] wholly above + [InlineData(-5f, 2f, 10f, WalkBoundingType.PartiallyInside)] // slab straddles 5 + [InlineData(-5f, 2f, 4f, WalkBoundingType.Outside)] // slab wholly below 5 + [InlineData(7f, 2f, 6f, WalkBoundingType.EntirelyInside)] // inside below 7; slab wholly below + [InlineData(7f, 2f, 10f, WalkBoundingType.PartiallyInside)] // slab straddles 7 + [InlineData(7f, 8f, 10f, WalkBoundingType.Outside)] // slab wholly above 7 + public void Corner_check_classifies_the_slab( + float bound, float minZ, float maxZ, WalkBoundingType expected) + => Assert.Equal(expected, WalkVisibilityMath.CornerPlaneCheck(bound, minZ, maxZ)); + + [Fact] + public void Corner_check_boundary_touch_is_out_on_the_out_side_and_in_on_the_in_side() + { + // Retail equality edges (flood appendix report 4): maxZ == h with + // inside-above rejects; minZ == h with inside-above accepts entirely. + Assert.Equal( + WalkBoundingType.Outside, + WalkVisibilityMath.CornerPlaneCheck(-5f, 2f, 5f)); + Assert.Equal( + WalkBoundingType.EntirelyInside, + WalkVisibilityMath.CornerPlaneCheck(-5f, 5f, 10f)); + // Inside-below: minZ == h rejects; maxZ == h accepts entirely. + Assert.Equal( + WalkBoundingType.Outside, + WalkVisibilityMath.CornerPlaneCheck(5f, 5f, 10f)); + Assert.Equal( + WalkBoundingType.EntirelyInside, + WalkVisibilityMath.CornerPlaneCheck(5f, 2f, 5f)); + } + + // ---- block_plane_check @0x0054d060 ---- + + [Fact] + public void Plane_check_requires_unanimity_for_outside_and_entirely_inside() + { + Assert.Equal( + WalkBoundingType.Outside, + WalkVisibilityMath.BlockPlaneCheck(1001f, 1001f, 1001f, 1001f, 0f, 10f)); + Assert.Equal( + WalkBoundingType.EntirelyInside, + WalkVisibilityMath.BlockPlaneCheck(0f, 0f, 0f, 0f, 0f, 10f)); + // 3-of-4 outside is still PARTIAL (the block may straddle the plane). + Assert.Equal( + WalkBoundingType.PartiallyInside, + WalkVisibilityMath.BlockPlaneCheck(1001f, 1001f, 1001f, 0f, 0f, 10f)); + Assert.Equal( + WalkBoundingType.PartiallyInside, + WalkVisibilityMath.BlockPlaneCheck(0f, 0f, 0f, 1001f, 0f, 10f)); + } + + // ---- block_check @0x0054dc50 ---- + + [Fact] + public void Block_check_culls_on_any_single_fully_outside_plane() + { + // Plane 0 (CY) inside everywhere; plane 1 outside at all four corners. + float[] c = [0f, 1001f]; + Assert.Equal( + WalkBoundingType.Outside, + WalkVisibilityMath.BlockCheck(c, c, c, c, planeCount: 1, maxZ: 10f, minZ: 0f)); + } + + [Fact] + public void Block_check_demotion_is_sticky_across_planes() + { + // CY entirely inside; plane 1 partial at one corner; plane 2 entirely + // inside — the partial must survive to the final result. + float[] cornerA = [0f, -5f, 0f]; // straddles h=5 for slab [2,10] + float[] cornerB = [0f, 0f, 0f]; + Assert.Equal( + WalkBoundingType.PartiallyInside, + WalkVisibilityMath.BlockCheck( + cornerA, cornerB, cornerB, cornerB, planeCount: 2, maxZ: 10f, minZ: 2f)); + } + + [Fact] + public void Block_check_is_entirely_inside_only_with_unanimity_on_every_plane() + { + float[] c = [0f, 0f, 0f]; + Assert.Equal( + WalkBoundingType.EntirelyInside, + WalkVisibilityMath.BlockCheck(c, c, c, c, planeCount: 2, maxZ: 10f, minZ: 0f)); + } + + // ---- FillClipHeights (get_clip_height @0x0054cff0) ---- + + [Fact] + public void Clip_heights_write_the_cy_plane_then_every_edge_plane() + { + var cy = new WalkPlane(new Vector3(0, 0, 1), -5f); + WalkPlane[] edges = + [ + new(new Vector3(0, 0, -1), 20f), + new(new Vector3(1, 0, 0), -100f), + ]; + Span bounds = stackalloc float[3]; + + WalkVisibilityMath.FillClipHeights(0f, 0f, cy, edges, bounds); + + Assert.Equal(-5f, bounds[0]); + Assert.Equal(20f, bounds[1]); + Assert.Equal(WalkVisibilityMath.OutsideColumn, bounds[2]); + } + + // ---- viewconeCheck @0x0054c250 ---- + + private static readonly WalkPlane Cy = new(new Vector3(0, 1, 0), 0f); // forward = +Y, eye at origin + + [Fact] + public void Sphere_fully_behind_the_near_plane_is_outside() + => Assert.Equal( + WalkBoundingType.Outside, + WalkVisibilityMath.ViewconeCheck(new Vector3(0, -5, 0), 1f, Cy, [])); + + [Fact] + public void Cull_is_strict_and_partial_is_inclusive_at_the_boundary() + { + // d == -r exactly: NOT culled (strict d < -r), and partial (d <= r). + Assert.Equal( + WalkBoundingType.PartiallyInside, + WalkVisibilityMath.ViewconeCheck(new Vector3(0, -1, 0), 1f, Cy, [])); + // d == +r exactly: tangent from inside counts PARTIAL, not entirely. + Assert.Equal( + WalkBoundingType.PartiallyInside, + WalkVisibilityMath.ViewconeCheck(new Vector3(0, 1, 0), 1f, Cy, [])); + Assert.Equal( + WalkBoundingType.EntirelyInside, + WalkVisibilityMath.ViewconeCheck(new Vector3(0, 1.01f, 0), 1f, Cy, [])); + } + + [Fact] + public void Edge_planes_cull_and_demote_like_the_cy_plane() + { + WalkPlane[] edges = [new(new Vector3(1, 0, 0), 0f)]; // inside is x >= 0 + Assert.Equal( + WalkBoundingType.Outside, + WalkVisibilityMath.ViewconeCheck(new Vector3(-3, 5, 0), 1f, Cy, edges)); + Assert.Equal( + WalkBoundingType.PartiallyInside, + WalkVisibilityMath.ViewconeCheck(new Vector3(0.5f, 5, 0), 1f, Cy, edges)); + Assert.Equal( + WalkBoundingType.EntirelyInside, + WalkVisibilityMath.ViewconeCheck(new Vector3(3, 5, 0), 1f, Cy, edges)); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapter.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapter.cs new file mode 100644 index 00000000..b0ee798a --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapter.cs @@ -0,0 +1,295 @@ +using System.Numerics; +using DatReaderWriter; +using DatReaderWriter.DBObjs; +using DatReaderWriter.Types; +using Environment = DatReaderWriter.DBObjs.Environment; + +namespace AcDream.App.Tests.Rendering.Walk; + +using AcDream.App.Rendering.Walk; + +/// +/// Campaign FW1 — builds the walk's world model from real DAT data for the +/// CONFORMANCE HARNESS (it lives in the test assembly deliberately: raw +/// DatCollection access is fenced to the content-owner seam in +/// production by RuntimeDatAccessArchitectureTests; the FW3 +/// production adapter will consume the seam instead). The library parses +/// everything the walk needs (survey 2026-08-30: PORT nodes with +/// PortalRef{PolyId, PortalIndex} in retail field order, cell +/// portal records with the PortalSide flag bit, building portals with stab +/// lists); this adapter is the previously missing consumer. +/// +/// Conventions (retail structs; the trace fixtures are the referee): +/// +/// portal_side = (Flags & 0x2) != 0 (PortalFlags.PortalSide), +/// matching EnvCellLandblockBuild's production decode. +/// Portal-polygon planes use the first-three-vertices cross with +/// d = −dot(N, p0) — the same formula the production visibility +/// cell build has always used against retail's InitCell side test. +/// A building's event id is its containing outdoor landcell: +/// low word = cellX·8 + cellY + 1 at 24 m pitch. +/// +/// +public static class WalkWorldDatAdapter +{ + /// One built building plus its landblock-local placement. + public sealed record BuildingEntry( + WalkBuilding Building, Matrix4x4 WorldTransform, Matrix4x4 InverseWorldTransform); + + public static WalkCell? BuildCell(DatCollection dats, uint cellId) + => BuildCell(dats, cellId, Vector3.Zero); + + public static WalkCell? BuildCell(DatCollection dats, uint cellId, Vector3 blockOffset) + { + if (dats.Get(cellId) is not EnvCell envCell) + return null; + if (dats.Get(0x0D000000u | envCell.EnvironmentId) is not Environment environment + || !environment.Cells.TryGetValue(envCell.CellStructure, out CellStruct? cellStruct) + || cellStruct is null) + { + return null; + } + + uint lbMask = cellId & 0xFFFF0000u; + int portalCount = envCell.CellPortals.Count; + var portals = new WalkCellPortal[portalCount]; + var polygons = new WalkPolygon[portalCount]; + for (int i = 0; i < portalCount; i++) + { + CellPortal portal = envCell.CellPortals[i]; + portals[i] = new WalkCellPortal + { + OtherCellId = portal.OtherCellId == 0xFFFF + ? 0xFFFFFFFFu + : lbMask | portal.OtherCellId, + PolygonIndex = i, + // Data-pinned 2026-08-30 (the doorway-still flood): cell + // portal_side is the INVERSE of the 0x2 bit — the same + // convention the building-portal sweep pinned. + PortalSide = ((ushort)portal.Flags & 0x2) != 0 ? 0 : 1, + ExactMatch = ((ushort)portal.Flags & 0x1) != 0, + OtherPortalId = unchecked((short)portal.OtherPortalId), + }; + polygons[i] = BuildPolygon(cellStruct, portal.PolygonId) + ?? new WalkPolygon(); + } + + Matrix4x4 worldTransform = + Matrix4x4.CreateFromQuaternion(envCell.Position.Orientation) + * Matrix4x4.CreateTranslation( + envCell.Position.Origin.X + blockOffset.X, + envCell.Position.Origin.Y + blockOffset.Y, + envCell.Position.Origin.Z + blockOffset.Z); + Matrix4x4.Invert(worldTransform, out Matrix4x4 inverse); + return new WalkCell + { + CellId = cellId, + Portals = portals, + PortalPolygons = polygons, + StabList = envCell.VisibleCells.Select(v => lbMask | v).ToArray(), + WorldTransform = worldTransform, + InverseWorldTransform = inverse, + }; + } + + public static Dictionary BuildInteriorCells( + DatCollection dats, uint landblockId) + => BuildInteriorCells(dats, landblockId, Vector3.Zero, null); + + public static Dictionary BuildInteriorCells( + DatCollection dats, uint landblockId, Vector3 blockOffset, + Dictionary? into) + { + uint lbMask = landblockId & 0xFFFF0000u; + Dictionary cells = into ?? new Dictionary(); + for (uint low = 0x0100; low <= 0xFFFD; low++) + { + WalkCell? cell = BuildCell(dats, lbMask | low, blockOffset); + if (cell is null) break; // interior cells are contiguous from 0x0100 + cells[cell.CellId] = cell; + } + return cells; + } + + /// Buildings of one landblock, with their walk event ids + /// (containing landcell), portal records, drawing-BSP portal trees, and + /// landblock-local placements. + public static List BuildBuildings(DatCollection dats, uint landblockId) + { + uint lbMask = landblockId & 0xFFFF0000u; + var result = new List(); + if (dats.Get(lbMask | 0xFFFEu) is not LandBlockInfo info + || info.Buildings is null) + { + return result; + } + + foreach (BuildingInfo buildingInfo in info.Buildings) + { + Vector3 origin = new( + buildingInfo.Frame.Origin.X, + buildingInfo.Frame.Origin.Y, + buildingInfo.Frame.Origin.Z); + int cellX = (int)MathF.Floor(origin.X / 24f); + int cellY = (int)MathF.Floor(origin.Y / 24f); + uint positionCellId = lbMask | (uint)(cellX * 8 + cellY + 1); + + var portals = new WalkBldPortal[buildingInfo.Portals.Count]; + for (int i = 0; i < portals.Length; i++) + { + BuildingPortal portal = buildingInfo.Portals[i]; + portals[i] = new WalkBldPortal + { + PortalSide = DecodeBuildingSide((ushort)portal.Flags), + ExactMatch = ((ushort)portal.Flags & 0x1) != 0, + OtherCellId = portal.OtherCellId == 0xFFFF + ? 0xFFFFFFFFu + : lbMask | portal.OtherCellId, + OtherPortalId = unchecked((short)portal.OtherPortalId), + StabList = portal.StabList.Select(s => lbMask | s).ToArray(), + }; + } + + WalkBspNode? bsp = null; + Vector3 sortCenter = Vector3.Zero; + var degradeLevels = new List(); + if (dats.Get(buildingInfo.ModelId) is GfxObj gfxObj) + { + bsp = ConvertDrawingBsp(gfxObj, gfxObj.DrawingBSP?.Root); + sortCenter = new Vector3(gfxObj.SortCenter.X, gfxObj.SortCenter.Y, gfxObj.SortCenter.Z); + if (gfxObj.DIDDegrade != 0 + && dats.Get(gfxObj.DIDDegrade) + is GfxObjDegradeInfo degradeInfo) + { + foreach (GfxObjInfo level in degradeInfo.Degrades) + { + WalkBspNode? levelBsp = null; + if (level.Id != 0 + && dats.Get((uint)level.Id) is GfxObj levelGfx) + { + levelBsp = ConvertDrawingBsp(levelGfx, levelGfx.DrawingBSP?.Root); + } + degradeLevels.Add(new WalkBuildingDegradeLevel(level.MinDist, level.IdealDist, level.MaxDist, levelBsp)); + } + } + } + + Matrix4x4 worldTransform = + Matrix4x4.CreateFromQuaternion(buildingInfo.Frame.Orientation) + * Matrix4x4.CreateTranslation(origin); + Matrix4x4.Invert(worldTransform, out Matrix4x4 inverse); + result.Add(new BuildingEntry( + new WalkBuilding + { + PositionCellId = positionCellId, + Portals = portals, + DrawingBsp = bsp, + DegradeLevels = degradeLevels.ToArray(), + SortCenter = sortCenter, + }, + worldTransform, + inverse)); + } + return result; + } + + internal static WalkBspNode? ConvertDrawingBsp(GfxObj gfxObj, DrawingBSPNode? node) + { + if (node is null) return null; + var converted = new WalkBspNode + { + SplittingPlane = new WalkPlane( + node.SplittingPlane.Normal, node.SplittingPlane.D), + IsFail = node.Type == DatReaderWriter.Enums.BSPNodeType.Leaf, + PosNode = ConvertDrawingBsp(gfxObj, node.PosNode), + NegNode = ConvertDrawingBsp(gfxObj, node.NegNode), + }; + if (node.Type == DatReaderWriter.Enums.BSPNodeType.Portal && node.Portals is not null) + { + var refs = new List(node.Portals.Count); + foreach (PortalRef portalRef in node.Portals) + { + WalkPolygon? polygon = BuildGfxPolygon(gfxObj, portalRef.PolyId); + if (polygon is not null) + refs.Add(new WalkPortalRef + { + PortalIndex = portalRef.PortalIndex, + Polygon = polygon, + }); + } + converted.InPortals = refs.ToArray(); + } + return converted; + } + + private static WalkPolygon? BuildPolygon(CellStruct cellStruct, ushort polygonId) + { + if (!cellStruct.Polygons.TryGetValue(polygonId, out Polygon? poly) + || poly is null || poly.VertexIds.Count < 3) + { + return null; + } + return BuildPolygonFromVertices( + poly.VertexIds, + id => cellStruct.VertexArray.Vertices.TryGetValue((ushort)id, out SWVertex? v) + ? new Vector3(v.Origin.X, v.Origin.Y, v.Origin.Z) + : null); + } + + /// Adjudication toggle (2026-08-30): the GfxObj portal-poly + /// plane winding vs the cell convention is under test — the street + /// fixture shows retail punching far fewer look-ins than the first-3 + /// cross convention admits. + public static bool FlipGfxPolygonPlanes; + + /// Adjudication toggle: the BuildingPortal side-flag decode. + /// 0 = (Flags & 0x2), 1 = inverted 0x2, 2 = (Flags & 0x1), + /// 3 = inverted 0x1. + public static int BuildingSideMode = 1; // data-pinned 2026-08-30: building + // portal_side = the INVERSE of the cell decode's 0x2 bit (the sweep's + // winning arm - punches land at retail's exact buildings/cells with it). + + private static int DecodeBuildingSide(ushort flags) => BuildingSideMode switch + { + 0 => (flags & 0x2) != 0 ? 1 : 0, + 1 => (flags & 0x2) != 0 ? 0 : 1, + 2 => (flags & 0x1) != 0 ? 1 : 0, + _ => (flags & 0x1) != 0 ? 0 : 1, + }; + + private static WalkPolygon? BuildGfxPolygon(GfxObj gfxObj, ushort polygonId) + { + if (!gfxObj.Polygons.TryGetValue(polygonId, out Polygon? poly) + || poly is null || poly.VertexIds.Count < 3) + { + return null; + } + WalkPolygon? built = BuildPolygonFromVertices( + poly.VertexIds, + id => gfxObj.VertexArray.Vertices.TryGetValue((ushort)id, out SWVertex? v) + ? new Vector3(v.Origin.X, v.Origin.Y, v.Origin.Z) + : null); + if (built is not null && FlipGfxPolygonPlanes) + built.Plane = new WalkPlane(-built.Plane.Normal, -built.Plane.D); + return built; + } + + private static WalkPolygon? BuildPolygonFromVertices( + IReadOnlyList vertexIds, Func resolve) + { + var vertices = new Vector3[vertexIds.Count]; + for (int i = 0; i < vertexIds.Count; i++) + { + Vector3? v = resolve(vertexIds[i]); + if (v is null) return null; + vertices[i] = v.Value; + } + Vector3 normal = Vector3.Normalize( + Vector3.Cross(vertices[1] - vertices[0], vertices[2] - vertices[0])); + return new WalkPolygon + { + Vertices = vertices, + Plane = new WalkPlane(normal, -Vector3.Dot(normal, vertices[0])), + }; + } +} diff --git a/tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapterTests.cs b/tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapterTests.cs new file mode 100644 index 00000000..ce777f60 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/Walk/WalkWorldDatAdapterTests.cs @@ -0,0 +1,114 @@ +using AcDream.App.Tests.Rendering; +using AcDream.App.Rendering.Walk; +using DatReaderWriter; +using DatReaderWriter.Options; + +namespace AcDream.App.Tests.Rendering.Walk; + +/// +/// Ground-truth conformance for the DAT adapter: every building the FW0 +/// oracle traces saw retail draw (the BLD event ids, captured live +/// 2026-08-30) must exist in the adapter's roster for its landblock with +/// the EXACT position cell id, and the look-in cells the traces name must +/// build with portals and polygons. This validates the ModelId/Frame → +/// landcell computation and the cell extraction against retail's own +/// output — no camera pose required. +/// +[Trait("Lane", "InstalledDat")] +public sealed class WalkWorldDatAdapterTests +{ + private static DatCollection OpenDats() + { + string? datDir = CornerFloodReplayTests.ResolveDatDir(); + if (datDir is null) + { + Assert.Fail("Lane=InstalledDat requires an installed retail DAT directory; see docs/release-gate.md."); + } + return new DatCollection(datDir!, DatAccessType.Read); + } + + public static readonly TheoryData TraceBuildingRosters = new() + { + { + 0xF4180000u, + new[] + { + 0xF4180011u, 0xF4180001u, 0xF4180009u, 0xF4180002u, 0xF4180004u, + 0xF4180014u, 0xF418000Au, 0xF418000Cu, 0xF418000Bu, + } + }, + { 0xF5180000u, new[] { 0xF518002Eu } }, + { 0xF4170000u, new[] { 0xF4170011u, 0xF4170012u, 0xF4170002u } }, + { 0xF3180000u, new[] { 0xF3180020u } }, + { + 0xA9B40000u, + new[] + { + 0xA9B4000Fu, 0xA9B40017u, 0xA9B4002Fu, 0xA9B40016u, 0xA9B4001Eu, + 0xA9B40026u, 0xA9B40036u, 0xA9B4001Au, 0xA9B40022u, 0xA9B40032u, + 0xA9B40031u, 0xA9B40029u, + } + }, + { 0xA9B30000u, new[] { 0xA9B3003Cu } }, + { 0xAAB50000u, new[] { 0xAAB50002u } }, + }; + + [Theory] + [MemberData(nameof(TraceBuildingRosters))] + public void Every_building_retail_drew_exists_at_its_exact_position_cell( + uint landblockId, uint[] tracedBuildingIds) + { + using DatCollection dats = OpenDats(); + + List buildings = + WalkWorldDatAdapter.BuildBuildings(dats, landblockId); + var roster = buildings.Select(e => e.Building.PositionCellId).ToHashSet(); + + foreach (uint traced in tracedBuildingIds) + Assert.Contains(traced, roster); + } + + [Fact] + public void Traced_buildings_carry_portals_with_stab_lists_and_drawing_bsp_portals() + { + using DatCollection dats = OpenDats(); + + List buildings = + WalkWorldDatAdapter.BuildBuildings(dats, 0xF4180000u); + WalkBuilding sanctuary = Assert.Single( + buildings, e => e.Building.PositionCellId == 0xF418000Au).Building; + + Assert.NotEmpty(sanctuary.Portals); + Assert.All(sanctuary.Portals, p => Assert.NotEmpty(p.StabList)); + // The look-in machinery needs PORT nodes in the drawing BSP. + Assert.NotNull(sanctuary.DrawingBsp); + Assert.True( + CountPortalRefs(sanctuary.DrawingBsp) > 0, + "the sanctuary building's drawing BSP must carry portal polygons"); + } + + [Fact] + public void The_traced_look_in_cells_build_with_portals_and_polygons() + { + using DatCollection dats = OpenDats(); + + // Cells named by the FW0 traces: the cathedral arrival root, the + // terrace cells, and the edge's extra look-in. + foreach (uint cellId in new[] { 0xF4180104u, 0xF4180106u, 0xF418010Fu }) + { + WalkCell? cell = WalkWorldDatAdapter.BuildCell(dats, cellId); + Assert.NotNull(cell); + Assert.NotEmpty(cell!.Portals); + Assert.Equal(cell.Portals.Length, cell.PortalPolygons.Length); + Assert.All(cell.PortalPolygons, p => Assert.True(p.Vertices.Length >= 3)); + Assert.NotEmpty(cell.StabList); + } + } + + private static int CountPortalRefs(WalkBspNode? node) + { + if (node is null) return 0; + int count = node.InPortals?.Length ?? 0; + return count + CountPortalRefs(node.PosNode) + CountPortalRefs(node.NegNode); + } +} diff --git a/tests/AcDream.App.Tests/Rendering/WalkOutsideViewReassemblyTests.cs b/tests/AcDream.App.Tests/Rendering/WalkOutsideViewReassemblyTests.cs new file mode 100644 index 00000000..ab07b7b6 --- /dev/null +++ b/tests/AcDream.App.Tests/Rendering/WalkOutsideViewReassemblyTests.cs @@ -0,0 +1,147 @@ +using System.Numerics; +using AcDream.App.Rendering; +using AcDream.App.Rendering.Walk; +using Xunit; + +namespace AcDream.App.Tests.Rendering; + +/// +/// Campaign FW4 slice 1 — : +/// an interior root's outside-view slices come from the walk's OWN +/// outside_view (pixel screen points, origin top-left, +Y down), +/// converted to the assembler's standard-NDC s. +/// +public class WalkOutsideViewReassemblyTests +{ + private const float W = 1024f, H = 720f; + + private sealed class StubRays : IWalkRayCaster + { + public Vector3 RayThrough(float screenX, float screenY) => + Vector3.Normalize(new Vector3(screenX - W / 2f, screenY - H / 2f, 1000f)); + } + + private static WalkPortalView WalkViewOfPixelQuads(params Vector2[][] pixelQuads) + { + var view = new WalkPortalView(); + var rays = new StubRays(); + foreach (Vector2[] quad in pixelQuads) + { + var pts = new WalkScreenPoint[quad.Length]; + for (int i = 0; i < quad.Length; i++) + pts[i] = new WalkScreenPoint(quad[i].X, quad[i].Y, 0f, 1f); + Assert.True(WalkCopyView.Append(view, pts, rays, Vector3.Zero)); + } + return view; + } + + private static ClipFrameAssembly AssembledWithOldOutside() + { + var pv = new PortalVisibilityFrame(); + pv.OutsideView.Add(new ViewPolygon(new[] + { + new Vector2(-0.9f, -0.9f), new Vector2(0.9f, -0.9f), + new Vector2(0.9f, 0.9f), new Vector2(-0.9f, 0.9f), + })); + return ClipFrameAssembler.Assemble(ClipFrame.NoClip(), pv); + } + + [Fact] + public void PixelDoorway_MapsToExpectedNdcAabbAndPlanes() + { + ClipFrameAssembly asm = AssembledWithOldOutside(); + // Pixel quad x∈[256,512], y∈[180,360] → NDC x∈[-0.5,0], y∈[0,0.5] + // (yNdc = 1 − 2·py/H flips the axis: py=180 → +0.5, py=360 → 0). + WalkPortalView walkView = WalkViewOfPixelQuads(new[] + { + new Vector2(256f, 180f), new Vector2(512f, 180f), + new Vector2(512f, 360f), new Vector2(256f, 360f), + }); + + ClipFrameAssembler.ReassembleOutsideViewFromWalk(asm, walkView, W, H); + + ClipViewSlice slice = Assert.Single(asm.OutsideViewSlices); + Assert.Equal(TerrainClipMode.Planes, asm.TerrainMode); + Assert.True(asm.OutdoorVisible); + Assert.Equal(4, asm.OutsidePlaneCount); + Assert.Equal(slice.Slot, asm.OutdoorSlot); + Assert.NotEqual(0, slice.Slot); + Assert.Equal(-0.5f, slice.NdcAabb.X, 3); + Assert.Equal(0f, slice.NdcAabb.Y, 3); + Assert.Equal(0f, slice.NdcAabb.Z, 3); + Assert.Equal(0.5f, slice.NdcAabb.W, 3); + Assert.Equal(slice.NdcAabb, asm.OutsideViewNdcAabb); + + // Every corner of the doorway satisfies every inward plane + // (n·p + d >= 0), and a point far outside fails at least one. + Vector2[] ndcCorners = + { + new(-0.5f, 0f), new(0f, 0f), new(0f, 0.5f), new(-0.5f, 0.5f), + }; + foreach (Vector2 corner in ndcCorners) + { + foreach (Vector4 plane in slice.Planes) + Assert.True(plane.X * corner.X + plane.Y * corner.Y + plane.W >= -1e-4f); + } + bool outsideFails = false; + foreach (Vector4 plane in slice.Planes) + outsideFails |= plane.X * 0.9f + plane.Y * -0.9f + plane.W < 0f; + Assert.True(outsideFails); + } + + [Fact] + public void FullViewportWalkQuad_CoversFullNdc() + { + ClipFrameAssembly asm = AssembledWithOldOutside(); + var walkView = new WalkPortalView(); + Assert.True(WalkCopyView.AppendFullViewportQuad( + walkView, new StubRays(), Vector3.Zero, W, H)); + + ClipFrameAssembler.ReassembleOutsideViewFromWalk(asm, walkView, W, H); + + ClipViewSlice slice = Assert.Single(asm.OutsideViewSlices); + Assert.Equal(new Vector4(-1f, -1f, 1f, 1f), slice.NdcAabb); + Assert.Equal(TerrainClipMode.Planes, asm.TerrainMode); + } + + [Fact] + public void EmptyWalkView_YieldsSkipMode() + { + ClipFrameAssembly asm = AssembledWithOldOutside(); + Assert.True(asm.OutdoorVisible); // the old view was visible pre-cutover + + ClipFrameAssembler.ReassembleOutsideViewFromWalk(asm, new WalkPortalView(), W, H); + + Assert.Empty(asm.OutsideViewSlices); + Assert.False(asm.OutdoorVisible); + Assert.False(asm.HasOutsideView); + Assert.Equal(TerrainClipMode.Skip, asm.TerrainMode); + Assert.Equal(0, asm.OutsidePlaneCount); + Assert.Equal(0, asm.OutdoorSlot); + } + + [Fact] + public void TwoWalkViews_ProduceTwoSlicesWithDistinctSlots() + { + ClipFrameAssembly asm = AssembledWithOldOutside(); + WalkPortalView walkView = WalkViewOfPixelQuads( + new[] + { + new Vector2(100f, 100f), new Vector2(300f, 100f), + new Vector2(300f, 300f), new Vector2(100f, 300f), + }, + new[] + { + new Vector2(600f, 400f), new Vector2(900f, 400f), + new Vector2(900f, 650f), new Vector2(600f, 650f), + }); + + ClipFrameAssembler.ReassembleOutsideViewFromWalk(asm, walkView, W, H); + + Assert.Equal(2, asm.OutsideViewSlices.Length); + Assert.NotEqual(asm.OutsideViewSlices[0].Slot, asm.OutsideViewSlices[1].Slot); + // The union AABB spans both doorways. + Assert.True(asm.OutsideViewNdcAabb.X < asm.OutsideViewSlices[0].NdcAabb.Z); + Assert.True(asm.OutsideViewNdcAabb.Z >= asm.OutsideViewSlices[1].NdcAabb.X); + } +} diff --git a/tests/AcDream.App.Tests/Streaming/LandblockBuildFactoryTests.cs b/tests/AcDream.App.Tests/Streaming/LandblockBuildFactoryTests.cs index 17a7e2ed..402c05ef 100644 --- a/tests/AcDream.App.Tests/Streaming/LandblockBuildFactoryTests.cs +++ b/tests/AcDream.App.Tests/Streaming/LandblockBuildFactoryTests.cs @@ -89,6 +89,74 @@ public sealed class LandblockBuildFactoryTests Assert.Empty(result.Collisions.EnvCells); } + [Fact] + public void BuildNear_PopulatesWalkZSlabUnconditionallyAndWalkBuildingsFromLandBlockInfo() + { + // Campaign FW3.1: EnvCellLandblockBuild.WalkMaxZ/WalkMinZ/WalkBuildings + // must be populated by the production streaming build — hermetic + // (no installed DAT needed), mirroring the RecordingDatProxy fixture + // pattern the rest of this file already uses. + var dat = CreateDat(out RecordingDatProxy proxy); + AddNearFixture(proxy, LandblockId, environmentId: 1); + var heights = new byte[81]; + Array.Fill(heights, (byte)10); + heights[0] = 200; // one outlier byte -> a distinct maxByte from the rest. + proxy.Add(LandblockId, new LandBlock { Id = LandblockId, Height = heights }); + proxy.Add( + (LandblockId & 0xFFFF0000u) | 0xFFFEu, + new LandBlockInfo + { + NumCells = 1, + Buildings = new List + { + new BuildingInfo + { + ModelId = 0x01234567u, + Frame = new Frame + { + Origin = new Vector3(12f, 12f, 0f), + Orientation = Quaternion.Identity, + }, + Portals = new List(), + }, + }, + }); + var heightTable = new float[256]; + heightTable[10] = 5f; + heightTable[200] = 40f; + var factory = new LandblockBuildFactory( + dat, TestPreparedCollisionSource.Instance, new object(), heightTable); + + LandblockBuild? result = factory.Build(Request(LandblockStreamJobKind.LoadNear)); + + Assert.NotNull(result); + var envCells = Assert.IsType( + result.EnvCells); + Assert.Equal(240f, envCells.WalkMaxZ); // heightTable[200] + 200 + Assert.Equal(4f, envCells.WalkMinZ); // heightTable[10] - 1 + AcDream.App.Rendering.Walk.WalkBuildingFactory.Entry buildingEntry = + Assert.Single(envCells.WalkBuildings); + // origin (12,12) -> cellX=cellY=0 -> low word 0*8+0+1 = 1. + Assert.Equal((LandblockId & 0xFFFF0000u) | 1u, buildingEntry.Building.PositionCellId); + } + + [Fact] + public void BuildFar_NeverPopulatesWalkDataBecauseEnvCellsIsNull() + { + // Documents the known FW3.1 scope gap: far-tier (LoadFar) landblocks + // carry no EnvCellLandblockBuild transaction at all (terrain-only), + // so their z-slab/buildings never reach WalkLandscapeAssembler until + // a follow-up wires the far-tier path too. + var dat = CreateDat(out RecordingDatProxy proxy); + proxy.Add(LandblockId, new LandBlock { Id = LandblockId }); + var factory = Factory(dat, new object()); + + LandblockBuild? result = factory.Build(Request(LandblockStreamJobKind.LoadFar)); + + Assert.NotNull(result); + Assert.Null(result.EnvCells); + } + [Fact] public void NearPreparedFaultRejectsWholeGenerationWhileFarNeverReadsCollision() { diff --git a/tools/walk-oracle/fw0-capture-cathedral.cdb b/tools/walk-oracle/fw0-capture-cathedral.cdb new file mode 100644 index 00000000..47026a75 --- /dev/null +++ b/tools/walk-oracle/fw0-capture-cathedral.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-cathedral-arrival.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-dungeon-entry.cdb b/tools/walk-oracle/fw0-capture-dungeon-entry.cdb new file mode 100644 index 00000000..aed89568 --- /dev/null +++ b/tools/walk-oracle/fw0-capture-dungeon-entry.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-dungeon-entry.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n80) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-dungeon-entry2.cdb b/tools/walk-oracle/fw0-capture-dungeon-entry2.cdb new file mode 100644 index 00000000..56cf05ce --- /dev/null +++ b/tools/walk-oracle/fw0-capture-dungeon-entry2.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-dungeon-entry2.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n80) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-dungeon.cdb b/tools/walk-oracle/fw0-capture-dungeon.cdb new file mode 100644 index 00000000..a607165c --- /dev/null +++ b/tools/walk-oracle/fw0-capture-dungeon.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-dungeon-corridor.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-edge.cdb b/tools/walk-oracle/fw0-capture-edge.cdb new file mode 100644 index 00000000..4aea6c5b --- /dev/null +++ b/tools/walk-oracle/fw0-capture-edge.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-terrace-edge.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-foundry-deep.cdb b/tools/walk-oracle/fw0-capture-foundry-deep.cdb new file mode 100644 index 00000000..c9541ccf --- /dev/null +++ b/tools/walk-oracle/fw0-capture-foundry-deep.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-foundry-deep.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-holtburg-doorway.cdb b/tools/walk-oracle/fw0-capture-holtburg-doorway.cdb new file mode 100644 index 00000000..18ba49d8 --- /dev/null +++ b/tools/walk-oracle/fw0-capture-holtburg-doorway.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-doorway.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-pose.cdb.template b/tools/walk-oracle/fw0-capture-pose.cdb.template new file mode 100644 index 00000000..14a13404 --- /dev/null +++ b/tools/walk-oracle/fw0-capture-pose.cdb.template @@ -0,0 +1,32 @@ +* FW0 pose-stamped capture TEMPLATE (2026-08-30). +* The first capture round (fw0-capture.cdb) did not record the camera pose, +* which exact FW1 replay needs. This template adds a per-frame pose dump. +* +* BEFORE USE (one recon attach, no breakpoints): +* x acclient!*viewer_pos* +* x acclient!SmartBox::viewer* +* dt acclient!Position +* to pin the viewer Position global's address and confirm the field offsets +* assumed below (Position: +4 objcell_id, Frame at +8: quat +8..+0x17, +* cached 3x3 at +0x18.., m_fOrigin at +0x3C..+0x47 -- VERIFY with dt; the +* update_viewer read said Frame origin writes land at Frame+0x34, i.e. +* Position+0x3C). +* +* Replace with the resolved address (or symbol acclient!Render::viewer_pos +* if it resolves), with the output path, then run as usual: +* cdb -pn acclient.exe -cf +* +* The P line prints raw hex dwords; decode to floats offline +* (BitConverter.Int32BitsToSingle). Order: objcell_id, origin xyz, quat wxyz. + +.logopen +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(+4), poi(+0x3c), poi(+0x40), poi(+0x44), poi(+8), poi(+0xc), poi(+0x10), poi(+0x14); .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-street.cdb b/tools/walk-oracle/fw0-capture-street.cdb new file mode 100644 index 00000000..6e44115d --- /dev/null +++ b/tools/walk-oracle/fw0-capture-street.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-street.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture-walkthrough.cdb b/tools/walk-oracle/fw0-capture-walkthrough.cdb new file mode 100644 index 00000000..cd3707e1 --- /dev/null +++ b/tools/walk-oracle/fw0-capture-walkthrough.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-holtburg-walkthrough.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n80) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-capture.cdb b/tools/walk-oracle/fw0-capture.cdb new file mode 100644 index 00000000..caa2f709 --- /dev/null +++ b/tools/walk-oracle/fw0-capture.cdb @@ -0,0 +1,11 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-cap-terrace-center.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +r $t0 = 0 +bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .if (@$t0 >= 0n40) { qd } .else { gc }" +bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc" +bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc" +bp 00506330 ".printf \"LS\\n\"; gc" +bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc" +g diff --git a/tools/walk-oracle/fw0-recon.cdb b/tools/walk-oracle/fw0-recon.cdb new file mode 100644 index 00000000..7dca5e58 --- /dev/null +++ b/tools/walk-oracle/fw0-recon.cdb @@ -0,0 +1,15 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw0-recon.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +dt acclient!PView +dt acclient!portal_view_type +dt acclient!view_type +dt acclient!CEnvCell +x acclient!SmartBox::RenderNormalMode +x acclient!PView::DrawCells +x acclient!PView::DrawInside +x acclient!LScape::draw +x acclient!RenderDeviceD3D::DrawBuilding +.logclose +qd diff --git a/tools/walk-oracle/fw1-f67-viewpoint-probe.cdb b/tools/walk-oracle/fw1-f67-viewpoint-probe.cdb new file mode 100644 index 00000000..029a82d4 --- /dev/null +++ b/tools/walk-oracle/fw1-f67-viewpoint-probe.cdb @@ -0,0 +1,28 @@ +* FW1 F67 adjudication probe (2026-08-30): the foundry-entry fixture's +* F67-F79 segment floods building a9b40036's portals in the order +* 116,118,11d while the offline replay orders 11d,116,118. The microscope +* pins the flip to the ROOT plane of 0036's drawing BSP (N=(0,0,-1) +* D=2.8): the replay's building-local eye z is 2.33 (d=+0.47), retail +* behaves as d < 0. This probe dumps the viewpoint retail's walk actually +* uses, adjudicating the ~0.5 m frame question (positionPush(2) / +* part-scale semantics). +* +* USE: stand OUTSIDE the Holtburg foundry (building a9b40036) roughly +* where foundry-entry F67+ was captured: near the entrance, close enough +* that the interior is visible through the door. Attach: +* & "C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe" ` +* -pn acclient.exe -cf tools\walk-oracle\fw1-f67-viewpoint-probe.cdb ` +* *>&1 | Tee-Object -FilePath fw1-f67-probe.log +* Auto-detaches after 40 hits. +.logopen C:\Users\erikn\source\repos\acdream\fw1-f67-probe.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe + +r $t0 = 0 +* BSPTREE::build_draw_portals_only — dump the frame's viewpoint (the +* value the plane-side tests read) plus the root node's plane. ecx = the +* BSPTREE. FrameCurrent->viewer.viewpoint: resolve the frameContext +* layout live with `dt acclient!frameContext` first if offsets drift. +bp acclient!BSPTREE::build_draw_portals_only "r $t0 = @$t0 + 1; .printf \"WALK tree=%08x pass=%d\\n\", @ecx, poi(@esp+4); .printf \" viewpoint: \"; dd poi(acclient!Render::FrameCurrent)+0x0 L0; df poi(acclient!Render::FrameCurrent)+0x40 L3; .if (@$t0 >= 40) { qd } .else { gc }" +g diff --git a/tools/walk-oracle/fw1-proj-recon.cdb b/tools/walk-oracle/fw1-proj-recon.cdb new file mode 100644 index 00000000..73812ce1 --- /dev/null +++ b/tools/walk-oracle/fw1-proj-recon.cdb @@ -0,0 +1,21 @@ +.logopen C:\Users\erikn\AppData\Local\Temp\claude\C--Users-erikn-source-repos-acdream--claude-worktrees-peaceful-blackburn-5333f0\e3dbd387-d947-4f49-964d-d454fc9c7d83\scratchpad\fw1-proj-recon.log +.sympath C:\Users\erikn\source\repos\acdream\refs +.symopt+ 0x40 +.reload /f acclient.exe +x acclient!Render::bw +x acclient!Render::bh +x acclient!Render::xinvscale +x acclient!Render::yinvscale +x acclient!Render::tx +x acclient!Render::ty +x acclient!Render::vdst +x acclient!Render::viewer_world_space +dd acclient!Render::bw L1 +dd acclient!Render::bh L1 +dd acclient!Render::xinvscale L1 +dd acclient!Render::yinvscale L1 +dd acclient!Render::tx L1 +dd acclient!Render::ty L1 +dd acclient!Render::vdst L1 +.logclose +qd