# OH1 — retail outside-view and depth lifecycle

**Date:** 2026-09-01

**Campaign:** OVERHAUL, OH1 evidence slice

**Scope:** the complete retail `PView::DrawCells` outside-view/depth lifecycle, from the roots that can reach it through landscape/building/cell order, including the persistent portal-draw counter, render frame stamp, far-Z building punches, true-depth exit seals, and the corresponding acdream implementation.
**Production changes:** none. This file is the only artifact produced by this audit.

## Verdict

The current acdream walk is not executing retail's depth lifecycle. The largest semantic differences are deterministic, not visual guesses:

1. Retail wraps **landscape draw, alpha flush, an additional mid-frame render-stamp increment, previous-call counter consumption/reset, optional full depth clear, and current exit seals** in one `outside_view.view_count != 0` block. acdream emits `ClearInteriorDepth` and `ExitSeals` for every interior root, including `outside_view == 0`.
2. Retail's `portalsDrawnCount` is a persistent `uint16` populated only by non-far portal-mask attempts. An eligible `DrawCells` consumes and clears the value produced by the **previous eligible outside-view call**, then the current true-depth exit-seal attempts repopulate it. acdream has no equivalent state and clears on the first eligible frame even when retail would not.
3. Retail normally advances `RenderDevice::m_nFrameStamp` once per present in `RenderDeviceD3D::Flip @0x0059FE50/0x0059FEC8`. `DrawCells @0x005A4885` performs an **additional conditional mid-frame increment** only after an outside landscape and alpha flush, immediately before the counter/clear. That second barrier re-arms landscape-admitted content for the root repaint; it is not the ordinary frame-start/present increment. acdream's CPU stamp mirror is near the second turn, but is not tied to the missing counter state and operates at collection time rather than at the GPU call boundary.
4. Retail's far punch uses exact depth bits `0x3F7FFFEF` (`0.999998987f`) and rejects a whole polygon if all **local input vertices, before `xformStart`,** lie on any `x/y == +/-12` boundary plane. acdream uses `0.99999988`, lacks that whole-polygon reject, and relies on a capped GPU clip-distance approximation.
5. Retail interleaves `DrawLandCell` then `DrawSortCell` per landscape cell. acdream knowingly emits all terrain before all building/static turns. This changes the position of building far-Z punches relative to terrain depth.

These differences are sufficient to produce both opposite failure modes seen during the campaign: clearing/sealing where retail does neither can remove valid walls; failing to reproduce the previous-call gate and exact punch/seal production can leave stale or misplaced depth that exposes geometry behind walls.

## Evidence method and arbitration rule

The primary source was the named retail corpus, searched before any fresh disassembly:

- `docs/research/named-retail/acclient_2013_pseudo_c.txt`
  - `PView::DrawCells` around lines 432709–432889
  - `DrawPortalPolyInternal` around lines 424490–424698
  - `PView::ClipPortals`, both `ConstructView` overloads, `DrawInside`, and `DrawPortal`
- `docs/research/named-retail/acclient.h`
  - `portal_view_type` around lines 32346–32355
  - `PView` around lines 45934–45944
  - `RenderDevice` around lines 38988–39016

Every behavior-changing branch sense reported below was then checked against the local Ghidra service on port 8081 with `decompile_function` and `disassemble_function`. Global producer/consumer claims were checked with `xrefs_to`; callers were checked with `function_xrefs`/`xrefs_to`. The decisive Ghidra functions were:

| Function | Address |
|---|---:|
| `SmartBox::RenderNormalMode` | `0x00453AA0` |
| `LScape::draw` | `0x00506330` |
| `PView::ClipPortals` | `0x005A5520` |
| `PView::ConstructView(CEnvCell)` | `0x005A57B0` |
| `PView::DrawInside` | `0x005A5860` |
| `PView::ConstructView(CBldPortal)` | `0x005A59A0` |
| `PView::DrawPortal` | `0x005A5AB0` |
| `PView::DrawCells` | `0x005A4840` |
| `DrawPortalPolyInternal` | `0x0059BC90` |
| `RenderDeviceD3D::Clear` | `0x0059FD30` |
| `RenderDeviceD3D::Flip` | `0x0059FE50` (`m_nFrameStamp` store at `0x0059FEC8`) |
| `RenderDeviceD3D::DrawBlock` | `0x005A17C0` |
| `RenderDeviceD3D::DrawSortCell` | `0x0059F140` |
| `RenderDeviceD3D::DrawBuilding` | `0x0059F2A0` |
| `RenderDeviceD3D::DrawMeshInternal` | `0x0059F360` |
| `RenderDeviceD3D::DrawEnvCell` | `0x0059F170` |

## Retail state layout

The offsets below come from the named header where available and were cross-checked against the access widths/strides in Ghidra.

| Owner | Offset/address | Type | Meaning |
|---|---:|---|---|
| `PView` | `+0x00` | `portal_view_type` | `outside_view` |
| `PView` | `+0x38` | `uint32` | `outside_view.view_count` |
| `PView` | `+0x48` | `int32` | `draw_landscape` |
| `PView` | `+0x4C` | pointer | `outdoor_portal_list` |
| `PView` | `+0x50` | DArray | `cell_draw_list` |
| `PView` | `+0x60` | `uint32` | `cell_draw_num` |
| `PView` | `+0x64` | DArray | `cell_todo_list` |
| `PView` | `+0x74` | `uint32` | `cell_todo_num` |
| `PView` | `+0x78` | pointer | `lscape` |
| `portal_view_type` | `+0x00` | DArray | portal refs |
| `portal_view_type` | `+0x10` | `uint32` | total view-poly vertex count |
| `portal_view_type` | `+0x14` | DArray | view polygons |
| `portal_view_type` | `+0x24` | DArray | view vertices |
| `portal_view_type` | `+0x34` | float | `max_indist` |
| `portal_view_type` | `+0x38` | `uint32` | `view_count` |
| `portal_view_type` | `+0x3C` | `uint32` | `cell_view_done` |
| `portal_view_type` | `+0x40` | `uint32` | `view_timestamp` |
| `portal_view_type` | `+0x44` | `uint32` | `update_count` |
| `CEnvCell` | `+0x100` | pointer | `structure` |
| `CEnvCell` | `+0x108` | `uint32` | `num_portals` |
| `CEnvCell` | `+0x10C` | pointer | `CCellPortal[]` |
| `CEnvCell` | `+0x130` | `uint32` | current render-frame stamp |
| `CEnvCell` | `+0x134` | `uint16` | `num_view` |
| `CEnvCell` | `+0x138` | DArray | portal views |
| `CCellPortal` | `+0x00` | `uint32` | `other_cell_id`; `0xFFFFFFFF` means outside |
| `CCellPortal` | `+0x04` | pointer | `other_cell_ptr` |
| `CCellPortal` | `+0x08` | pointer | portal polygon |
| `CCellPortal` | `+0x0C` | scalar | portal side |
| `CCellPortal` | `+0x10` | scalar | other portal id |
| `CCellPortal` | `+0x14` | scalar | exact-match flag |
| `RenderDevice` | `+0xB0` | `uint32` | `m_nFrameStamp` |
| global | `0x008719B4` | `uint16` | `portalsDrawnCount`, initialized zero |
| global | `0x008ED824` | `int32` | `forceClear`, initialized zero |
| global | `0x00820E14` | mode | `maxZ2 == 6`, true-depth mode |
| global | `0x00820E18` | mode | `maxZ1 == 7`, far-Z mode |
| data | `0x007E5450` | float bits | far-Z `0x3F7FFFEF` = `0.999998987f` |

`portal_view_type` is `0x48` bytes and `CCellPortal` is `0x18` bytes. Those sizes matter because `DrawCells` indexes the top portal view and walks portal arrays by those exact strides.

## Caller/callee order

### Root selection

`SmartBox::RenderNormalMode @0x00453AA0` decides from the camera cell id:

- low 16 bits `< 0x100`: outdoor root. It updates landscape/viewpoint state and calls `LScape::draw`. It does **not** call top-level `PView::DrawCells`; consequently there is no top-level full depth clear and no exit-seal loop.
- low 16 bits `>= 0x100`: indoor root. It establishes the viewpoint and reaches `RenderDeviceD3D::DrawInside`, which calls `PView::DrawInside` on the indoor PView.
- after either root, `FlushAlphaList` occurs at the top level.

Retail creates two different PViews during render-device initialization:

- indoor PView: constructed with `draw_landscape = 1`;
- outdoor/building-look-in PView: constructed with `draw_landscape = 0`.

This distinction is binding. Only the indoor PView can accumulate `outside_view` from portals whose `other_cell_id == 0xFFFFFFFF`.

### Indoor root

`PView::DrawInside @0x005A5860` performs:

1. push/add the root view and stab views;
2. copy the current full view into the root cell's top view;
3. `ConstructView(root, 0xFFFF)`;
4. `DrawCells(this, 0)`;
5. pop/remove the temporary views.

`PView::ConstructView(CEnvCell) @0x005A57B0` clears `outside_view.view_count`, increments the separate `PView::master_timestamp`, clears the todo/draw counts, and floods through `ClipPortals`. `PView::master_timestamp` is not `RenderDevice::m_nFrameStamp`; it is a visibility-construction generation used by this flood.

`PView::ClipPortals @0x005A5520` installs the current cell's top portal view, accepts only live views, resolves ordinary neighbor cells, and handles an outside portal as follows:

- if `other_cell_id != 0xFFFFFFFF`, clip/propagate to the neighbor;
- if `other_cell_id == 0xFFFFFFFF` and `draw_landscape != 0`, append the clipped portal view (or full view when `cliplandscape == 0`) to `outside_view`;
- if `draw_landscape == 0`, do not produce an outside view.

### Landscape and building look-ins

`LScape::draw @0x00506330` orders sky, reverse visible-block traversal, and weather. Within each block, `RenderDeviceD3D::DrawBlock @0x005A17C0` walks its authored cell order. For each land cell it calls:

1. `DrawLandCell` when the land cell is in view;
2. `DrawSortCell` when `alwaysDrawObjects != 0` (retail default is 1) or the cell is in view.

`DrawSortCell @0x0059F140` calls building draw first, then the land cell's object draw. `DrawBuilding @0x0059F2A0` does:

1. publish the outdoor PView's portal array;
2. flush alpha;
3. draw building part with portal flavor (`Draw(part, 1)`);
4. set building flag and draw shell (`Draw(part, 0)`);
5. restore the flag.

The portal-flavor `DrawMeshInternal @0x0059F360` installs `building_view`, then runs the building BSP's portal-only walk in two passes:

- pass 1: `ConstructView(CBldPortal)` emits `DrawPortalPolyInternal(poly, true)` — the colorless far-Z punch. `PView::DrawPortal` sees mode 1 and skips `DrawCells`.
- pass 2: it recursively constructs the destination cell view, and `PView::DrawPortal` calls `DrawCells` for that look-in flood.

Because this is the outdoor PView (`draw_landscape = 0`), the look-in `DrawCells` has `outside_view.view_count == 0`. It therefore skips landscape, the **additional DrawCells stamp increment**, counter consumption, full clear, and exit seals; it draws its reverse shell pass and reverse object-cell pass, resets object scale, and ends with `useSunlightSet(1)`.

### Exact whole-frame ordering

Outdoor root:

```text
LScape::draw
  sky
  each visible block (reverse block_draw_list)
    each authored land cell
      DrawLandCell
      DrawSortCell
        DrawBuilding
          alpha flush
          every building pass-1 far-Z punch
          every building pass-2 look-in DrawCells flood
            reverse shells, then reverse object cells
            reset object scale; useSunlightSet(1)
          building shell
        land-cell objects
  weather
top-level alpha flush
later RenderDeviceD3D::Flip present: m_nFrameStamp++
```

Indoor root with at least one outside view:

```text
ConstructView(root)
DrawCells(indoor PView)
  install sunlight + outside_view
  LScape::draw                 (same per-cell interleave as above)
  alpha flush
  m_nFrameStamp++
  consume/reset previous portalsDrawnCount
  full depth clear iff consumed count != 0
  current exit portals: true-depth seal attempts
  useSunlightSet(0); restore_all_lighting
  all root-flood cell shells, reverse cell_draw_list
  all root-flood object cells, reverse cell_draw_list
  reset object scale; useSunlightSet(1)
top-level alpha flush
later RenderDeviceD3D::Flip present: m_nFrameStamp++
```

Indoor root with no outside view:

```text
ConstructView(root)
DrawCells(indoor PView)
  useSunlightSet(0); restore_all_lighting
  all root-flood cell shells, reverse cell_draw_list
  all root-flood object cells, reverse cell_draw_list
  reset object scale; useSunlightSet(1)
top-level alpha flush
later RenderDeviceD3D::Flip present: m_nFrameStamp++
```

There is no landscape, intermediate alpha flush, **additional DrawCells stamp increment**, counter test/reset, clear, or seal in the last case. The normal `Flip` increment still occurs when that frame is presented.

## `PView::DrawCells` exact lifecycle

`PView::DrawCells @0x005A4840` has only two callers in the binary: `DrawInside @0x005A595B` and `DrawPortal @0x005A5B53`. Its second integer parameter is unused.

| Order | PC/range | Condition | State before | Action | State after |
|---:|---:|---|---|---|---|
| 1 | `0x5A4849–0x5A4852` | `outside_view.view_count == 0` | any pending counter | jump to `0x5A49F1` | counter and stamp unchanged **within this call**; the normal later `Flip` increment is independent |
| 2 | `0x5A485A–0x5A486B` | outside view nonzero | outside views installed by indoor flood | sunlight on; `Render::PortalList = &outside_view`; `LScape::draw(lscape)` | landscape/building/look-in depth and color exist |
| 3 | `0x5A4872` | same | alpha may be queued | `FlushAlphaList(0)` | landscape stage drained |
| 4 | `0x5A4885–0x5A4886` | same | current presented-frame render stamp | increment `RenderDevice::m_nFrameStamp` a second time, mid-frame | landscape-drawn shells/parts become eligible for interior repaint |
| 5 | `0x5A488C–0x5A48A7` | same | persistent prior counter | if shipped `forceClear == 0`, read counter, test it, and always reset it to zero | prior value retained only in a register |
| 6 | `0x5A48A9–0x5A48BD` | prior value nonzero, or theoretical `forceClear != 0` | depth contains landscape/look-ins | clear full depth attachment to 1.0 | color remains; depth is empty |
| 7 | `0x5A48C0–0x5A49EB` | cell draw list nonempty | counter now zero in shipped path | reverse cells; for each live view, draw every portal with `other_cell_id == 0xFFFFFFFF` using `DrawPortalPolyInternal(false)` | counter increments modulo 65,536 per accepted seal attempt; true depth restores outside occlusion |
| 8 | `0x5A49F1–0x5A49FB` | always | outside stage complete or skipped | sunlight off; restore lighting | indoor lighting active |
| 9 | `0x5A4A00–0x5A4ADE` | drawing BSP exists | root/look-in view list | reverse cells, each live view: `setup_view`, then `DrawEnvCell` | complete constructed shell drawn once per render stamp |
| 10 | `0x5A4ADE–0x5A4B1A` | cells exist | shells complete | reverse cells; install top portal view; `DrawObjCellForDummies` | statics/dynamics drawn through cell views |
| 11 | `0x5A4B1C–0x5A4B5D` | always | all cell passes complete | reset object scale; `useSunlightSet(1)` | sunlight is enabled before returning to the caller and its top-level alpha flush |

The full clear is a true full-viewport depth-only clear. `RenderDeviceD3D::Clear @0x0059FD30` maps engine flag 4 to `D3DCLEAR_ZBUFFER`, uses `Count=0`/`pRects=null`, and clears Z to 1.0 without clearing color.

## Persistent counter: producer, consumer, and timing

The complete Ghidra xref set for `portalsDrawnCount @0x008719B4` contains exactly three accesses:

| Access | Function/PC | Meaning |
|---|---:|---|
| read/write | `DrawPortalPolyInternal @0x0059BD74` | word increment, modulo 65,536, for an accepted non-far mask attempt |
| read | `DrawCells @0x005A4895` | consume previous value |
| write | `DrawCells @0x005A489E` | reset to zero |

There is no frame-start reset and no other producer. The exact shipped state machine is:

```text
if outside_view.view_count != 0:
    draw landscape
    flush alpha
    ++RenderDevice.m_nFrameStamp

    previous = portalsDrawnCount
    portalsDrawnCount = 0
    if previous != 0:
        clear full depth to 1.0

    for cell in reverse(cell_draw_list):
        for each live view of cell:
            setup_view(cell, view)
            for portal in cell.portals:
                if portal.other_cell_id == 0xFFFFFFFF:
                    DrawPortalPolyInternal(portal.poly, farZ=false)
                    # accepted attempt increments the uint16 counter modulo 65536

draw shells in reverse(cell_draw_list)
draw objects in reverse(cell_draw_list)
reset object scale
useSunlightSet(1)

# outside DrawCells, at the normal later present:
RenderDeviceD3D::Flip increments m_nFrameStamp once
```

`forceClear` is initialized zero and Ghidra finds no writes in this binary. If patched nonzero, it branches directly to the clear and bypasses both counter read and reset. That is a dormant/debug override, not the shipped lifecycle.

### Consecutive-call example

| Eligible call | `outside_view` | counter on entry | clear? | accepted current seals | counter on exit |
|---:|---:|---:|---|---:|---:|
| startup/N | `>0` | 0 | no | K | `K mod 65536` |
| N+1 | `>0` | K | yes if K != 0 | M | `M mod 65536` |
| N+2 | 0 | M | no; outside block skipped | none | M |
| N+3 | 0 | M | no; outside block skipped | none | M |
| N+4 | `>0` | M | yes if M != 0 | Q | `Q mod 65536` |

`K`, `M`, and `Q` are accepted-attempt counts; the stored counter is a machine `uint16`, and `INC word ptr [0x008719B4]` wraps modulo 65,536. In the pathological exactly-65,536-attempt case the stored value returns to zero and therefore does not arm the next clear.

Calling this merely “previous frame” is slightly imprecise. It is the previous **eligible outside-view `DrawCells` call**. Under the ordinary one-indoor-root-per-presented-frame path those are normally adjacent frames; a run of `outside_view == 0` frames leaves the pending count untouched.

## Far-Z punches and true-depth exit seals

Both use `DrawPortalPolyInternal @0x0059BC90`, but the boolean selects materially different depth:

| Use | Call site | Boolean | Mode | Depth | Counter delta |
|---|---|---:|---:|---|---:|
| building portal pass 1 | `ConstructView(CBldPortal) @0x5A5A7B` | true | 7 / `maxZ1` | exact far Z, bits `0x3F7FFFEF` | 0 |
| outside exit seal | `DrawCells @0x5A49B7` | false | 6 / `maxZ2` | true projected `z/w` | +1 after boundary reject, before clip |
| failed mode-3 portal fallback | `DrawPortal @0x5A5B7C` | false | 6 | true projected `z/w` | +1 if reached/accepted; not used by the two-pass building walker |

The common polygon path is:

1. initialize four whole-polygon predicates: every local input vertex on `x == +12`, `x == -12`, `y == +12`, or `y == -12`;
2. for each original `CVertex`, compare its local `x/y` values first (`0x59BCD6–0x59BD20`), then call `xformStart` for that same vertex at `0x59BD28`;
3. after all vertices, return without count/draw if any local-input predicate remains true;
4. if boolean is false, increment `portalsDrawnCount` modulo 65,536;
5. `polyClipFinish` against the installed render view;
6. return if clipped vertex count `< 3`;
7. submit a triangle fan with no texture, alpha test off, blend `SRCALPHA`/`INVSRCALPHA`/`ADD`, depth test `ALWAYS`, depth write on, cull none, and normal/default color writes still enabled. Modes 6 and 7 build vertices with source alpha zero, so blending preserves destination color even though the color attachment is writable.

The counter therefore records accepted **attempts**, not successful GPU fans: an exit polygon that passes the boundary test but clips to fewer than three vertices still increments the next-call clear gate. Far-Z punches never increment it.

## Ghidra branch arbitration table

This table records the behavior-changing senses used in the findings. It is intentionally more precise than the named pseudo-C wherever a decompiler inversion could matter.

| PC | Ghidra instruction/sense | Retail behavior |
|---:|---|---|
| `0x5A484C` / `0x5A4852` | `TEST EAX,EAX`; `JBE 0x5A49F1` | zero outside views skip the entire outside/depth stage |
| `0x5A4891` / `0x5A4893` | test `forceClear`; `JNZ 0x5A48A9` | nonzero override goes straight to clear and bypasses counter reset |
| `0x5A489C` / `0x5A48A7` | test prior counter; reset store occurs before `JZ 0x5A48C0` | shipped path always resets, and clears only when prior count was nonzero |
| `0x5A48C3` / `0x5A48C9` | test reverse-list count; `JBE 0x5A49F1` | no exit-seal traversal when draw list empty |
| `0x5A496C` / `0x5A496F` | test top view count; `JBE` | no seal work for cells without live views |
| `0x5A49A9` / `0x5A49AF` | compare portal other id with `-1`; `JNZ` skips | only outside portals are sealed |
| `0x59BCD6–0x59BD28`, then `0x59BD40–0x59BD66` | each source vertex's local `x/y` is compared before its `xformStart`; four final predicate tests branch to return | whole poly on any local-input `x/y == +/-12` boundary is rejected before count/clip |
| `0x59BD70–0x59BD74` | test boolean; nonzero jumps past `INC word ptr [0x8719B4]` | false/true-depth seals increment modulo 65,536; true/far punches do not |
| `0x59BDBC–0x59BDBF` | compare clipped count with 3; `JL` return | fewer than 3 clipped vertices submit no fan, after possible increment |
| `0x5A5666–0x5A566C` | compare `other_cell_id` with `-1`; `JNZ` neighbor path | `0xFFFFFFFF` is outside path |
| `0x5A5671–0x5A5673` | test `draw_landscape`; zero skips | only the indoor PView accumulates outside view |
| `0x5A5A6E–0x5A5A7B` | mode 2 skips punch; mode 1 falls through to `DrawPortalPolyInternal(true)` | building pass 1 punches; pass 2 constructs destination |
| `0x5A5B46–0x5A5B53` | success then compare mode 1; mode 1 skips `DrawCells` | far-punch pass has no look-in draw; later pass does |
| `0x5A5B74–0x5A5B7C` | on failure, only mode 3 draws false-mode portal poly | failure fallback is true-depth only for mode 3 |
| `0x59FEC0–0x59FEC8` | unconditional load, `INC`, store after the present/reset tail in `Flip` | normal per-present `m_nFrameStamp` advancement is independent of DrawCells' conditional mid-frame increment |

## Render-frame stamp versus visibility timestamp

Retail maintains two unrelated generation variables:

- `PView::master_timestamp @0x008ED6B8` increments in every `ConstructView(CEnvCell)` and drives visibility construction.
- `RenderDevice::m_nFrameStamp @ RenderDevice+0xB0` is the render dedupe stamp. It has **two** increment sites relevant here:
  1. `RenderDeviceD3D::Flip @0x0059FE50`, load/increment/store at `0x0059FEC0–0x0059FEC8`, increments once after the normal swap-chain present, texture-stage unbind, dynamic-buffer reset, and profiler-frame reset;
  2. `DrawCells @0x005A4885–0x005A4886` adds a conditional mid-frame increment after an outside landscape/alpha flush and before the counter/clear.

The render stamp is consumed by at least:

- `CEnvCell+0x130`: `GetDrawnThisFrame @0x0052C0C0`, `SetDrawnThisFrame @0x0052C0E0`;
- `CPhysicsPart+0xDC`: `GetDrawnThisFrame @0x0050D4D0`, `SetDrawnThisFrame @0x0050D4F0`.

`DrawEnvCell @0x0059F170` begins with the stamp gate and the built-mesh path draws the complete constructed shell once for that stamp. `DrawMeshInternal @0x0059F360` applies a corresponding stamp to non-local-player physics parts. The normal `Flip` increment makes the following presented frame eligible. When an indoor outside stage runs, content admitted during landscape/building look-ins is stamped with that frame's value; the additional `DrawCells` increment then re-arms it for the root repaint after the possible clear. A faithful port therefore needs both boundaries: the ordinary per-present boundary and the conditional mid-frame barrier. Neither may be conflated with the PView flood timestamp.

## Current acdream correspondence

The inspected production locations are in the binding worktree named at the top of this report.

| Retail mechanism | Current acdream | Assessment |
|---|---|---|
| separate indoor/outdoor PViews; outdoor `DrawLandscape=false` | `src/AcDream.App/Rendering/Walk/RetailFrameWalk.cs:46–55`; `WalkPView.cs:39–50` | faithful basic ownership |
| outside-view reset and `0xFFFFFFFF` producer gated by `DrawLandscape` | `WalkPView.cs:59–75`, `175–250` | faithful basic producer |
| indoor flood calls landscape only when outside views exist | `RetailFrameWalk.cs:118–142` | faithful at walk level |
| landscape then root-flood turn | `RetailFrameWalk.cs:118–142` | faithful coarse order |
| persistent `uint16 portalsDrawnCount` across calls/frames | no production state found; source search finds only comments | **missing** |
| counter populated only by accepted false-mode attempts | `OnPunchGeometry` records only punch events; exit seal draw is a replay callback | **missing** producer semantics |
| outside-view block gates stamp, consume/reset, clear, and seals | `WalkFrameDriver.cs:1299–1339` emits clear/seals unconditionally for every interior flood | **wrong** |
| first eligible call with counter zero does not clear | `WalkFrameDriverTests.cs:260–293` expects `CLEAR` on the first outside-view fixture | **wrong test contract** |
| `outside_view==0` performs no clear/seal/**additional DrawCells stamp** | `WalkFrameDriverTests.cs:432–440` explicitly expects unconditional `CLEAR`, `SEALS` | **wrong test contract**; normal per-present frame boundary is unaffected |
| normal stamp boundary once per present | `WalkFrameDriver.BeginFrame` at `WalkFrameDriver.cs:784–818` calls `BeginWalkPartFrame` and clears shell dedupe; `Wb/WbDrawDispatcher.WalkClassify.cs:89–99` clears part dedupe | semantically represents the ordinary per-frame eligibility boundary, though it is tied to collection rather than an actual present |
| additional stamp barrier after landscape/flush and before clear | `WalkFrameDriver.cs:1304–1319` advances part-pass stamp and clears shell dedupe when `_skyDrawnThisFrame` | close in semantic placement and correctly conditional on a landscape turn; collection-time mirror, not exact GPU execution boundary |
| full Z clear to 1.0, no color | `VulkanWorldPassScope.cs:87–120` | faithful clear operation |
| shell pass then object pass, both reverse order | `WalkFrameDriver.cs:1419–1453` | faithful coarse ordering |
| far punch depth exact bits `0x3F7FFFEF` | `Shaders/portal_depth.vert:53` uses decimal `0.99999988` | **wrong constant** |
| whole-polygon **local-input, pre-`xformStart`** `x/y == +/-12` rejection | no equivalent in `PortalDepthMaskRenderer.Rhi.cs:106–156` or punch event production | **missing** |
| CPU `polyClipFinish`, count after boundary reject but before clip success | GPU `gl_ClipDistance`, capped to `ClipFrame.MaxPlanes == 8`; no clipped-vertex result | **approximation**, not byte/vertex exact |
| depth `ALWAYS`, depth write on, no cull; color writes enabled with `SRCALPHA`/`INVSRCALPHA` and source alpha zero | `PortalDepthMaskRenderer.Rhi.cs:58–104` uses `ColorWrite=false` | depth/color **outcome-equivalent**, but render state diverges from retail |
| per-landcell `DrawLandCell` then `DrawSortCell` | `WalkFrameDriver.cs:105–114`, `1345–1379` explicitly emits all terrain before per-cell building/static turns | **known wrong order** |
| `Render::PortalList=&outside_view` remains installed for the whole outside `LScape::draw` | `RetailPViewPassExecutor.WalkLeaf.cs:28–50`, `94–116` deliberately draws sky/terrain without exact slice clipping | approximation; leaf-level pixel consequence unresolved here |
| true-depth seals emitted for each outside portal of each live view, reverse flood | `RetailPViewRenderer.cs:656–685` | geometry loop is broadly shaped correctly, but called under wrong gate and has no counter feedback |

The current comments in `WalkFrameDriver.cs:138–165` accurately label the clear gate as an acknowledged approximation, but the later implementation comment at `1321–1325` calls clear/seals “both unconditional.” Ghidra proves that statement false: the entire stage is skipped when outside-view count is zero, and the clear has a second persistent prior-counter gate.

### Current event ordering that must not be mistaken for retail

Today the interior event list is effectively:

```text
BeginFrame:
    clear CPU part/shell dedupe       # ordinary presented-frame boundary analogue
if outside_view > 0:
    SKY
    TERRAIN (all terrain before buildings/statics)
if sky was emitted:
    advance CPU render-stamp mirrors # additional DrawCells barrier analogue
CLEAR                         # always, including outside_view == 0
SEALS                         # always, including outside_view == 0
reverse shells
reverse cell contents
```

Retail is:

```text
# frame starts with the stamp established by the prior Flip
if outside_view > 0:
    LANDSCAPE                 # terrain/building/object interleaved per landcell
    alpha flush
    ++render stamp             # additional mid-frame barrier
    prior = sealAttemptCount
    sealAttemptCount = 0
    if prior != 0:
        CLEAR
    SEAL CURRENT EXITS        # accepted attempts repopulate counter
reverse shells
reverse object cells
reset object scale; useSunlightSet(1)
top-level alpha flush
Flip/present: ++render stamp  # ordinary per-present boundary
```

## Required executable transcript

An implementation slice should not be visually gated before it can emit an exact, machine-assertable transcript. Aggregate owner ids are insufficient. Use one record per `DrawCells` call, one per mask attempt, and one per normal present boundary.

### DrawCells record

```text
[oh1-dc] present=<u64> call=<u64> source=inside|building-portal \
root=0x<8hex> pview=indoor|outdoor drawLandscape=0|1 outsideViews=<u32> \
counterBefore=<u16> forceClear=0|1 landscape=0|1 alphaFlush=0|1 \
stampBefore=<u32> midStampIncrement=0|1 stampAfter=<u32> \
consumed=<u16> counterReset=0|1 depthClear=0|1 \
sealAttempts=<u32> sealGpuSubmissions=<u32> counterAfter=<u16> \
shellCells=<ordered cell ids> objectCells=<ordered cell ids>
```

Assertions enabled by this line:

- `outsideViews==0` implies `landscape=alphaFlush=midStampIncrement=counterReset=depthClear=sealAttempts=0` and `stampAfter==stampBefore` within this call;
- with shipped `forceClear==0`, `outsideViews>0` implies `consumed==counterBefore`, `counterReset==1`, and `depthClear==(consumed!=0)`;
- after the reset, `counterAfter == sealAttempts mod 65536` unless another false-mode caller occurs before line emission; the general assertion is `counterAfter == (counterBase + acceptedAttempts) & 0xffff`;
- `sealGpuSubmissions` is only CPU-side submission count. It is not retail `fanDrawn`, because the current GPU clip-distance path returns no surviving-vertex or fragment result;
- shell and object lists are independently reverse ordered.

### Normal present/stamp record

```text
[oh1-present] present=<u64> flipCall=<u64> stampBefore=<u32> \
swapResult=ok|deviceLost stampAfter=<u32>
```

After `Flip`'s Present retry loop terminates, every return path executes `stampAfter == stampBefore + 1 mod 2^32` (the device-lost result sets its flag first). This is independent of the optional `midStampIncrement` in a `DrawCells` record.

### Portal mask record

```text
[oh1-mask] present=<u64> call=<u64> ordinal=<u32> \
source=building-pass1|exit-seal|mode3-fallback cell=0x<8hex> \
view=<u16> portal=<u16> other=0x<8hex> mode=far|true \
inputVerts=<u16> localBoundaryWouldReject=0|1 boundaryRejectApplied=0|1 \
gpuSubmitted=0|1 clipPath=gpu-clip-distance|retail-polyClipFinish \
counterBefore=<u16> counterDelta=0|1 counterAfter=<u16> \
depthBits=0x3f7fffef|projected depthTest=always depthWrite=1 cull=none \
retailBlend=srcalpha/invsrcalpha retailSourceAlpha=0 retailColorWrite=1 \
activeColorWrite=0|1
```

Assertions enabled by this line:

- `mode=far` always has `counterDelta=0` and exact `depthBits=0x3f7fffef`;
- `boundaryRejectApplied=1` implies `counterDelta=0` and `gpuSubmitted=0`;
- an accepted `mode=true` attempt has conceptual `counterDelta=1`, with `counterAfter == (counterBefore + 1) & 0xffff`, even if retail clipping would later remove the fan;
- the current pipeline must report `activeColorWrite=0`; a state-faithful retail port reports 1 with the listed blend/source-alpha state. Both preserve destination color, but they are not the same render state;
- only `other=0xffffffff` appears with `source=exit-seal`.

The current GPU path cannot truthfully populate `clippedVerts` or `fanDrawn`: `gl_ClipDistance` runs after CPU submission and returns neither value. Do not synthesize them from `gpuSubmitted`. If `polyClipFinish` is ported or a retail capture is instrumented, emit a separate record:

```text
[oh1-retail-clip] present=<u64> call=<u64> ordinal=<u32> \
inputVerts=<u16> clippedVerts=<u16> fanDrawn=0|1
```

Only that audited CPU clip result may assert `fanDrawn == (clippedVerts >= 3)`. Porting or line-by-line auditing `polyClipFinish @0x006B6D00` is required before claiming exact clip/fan parity.

### Landscape ordering record

```text
[oh1-order] present=<u64> dcCall=<u64> ordinal=<u32> \
stage=sky|landcell|building-flush|punch|lookin-shell|lookin-object|building-shell|landcell-object|weather|outside-flush|mid-stamp|clear|seal|root-shell|root-object|sunlight-tail|top-alpha-flush|flip-stamp \
landblock=0x<8hex> landcell=0x<8hex> building=<stable instance key> \
cell=0x<8hex> view=<i32> portal=<i32>
```

This record makes the per-landcell interleave and punch position testable without asking a user to identify a moving slab visually.

## Implementation constraints derived from retail

This section is evidence-derived guidance, not a production edit.

1. Introduce one persistent `ushort` counter at the render/depth lifecycle owner. Do not reset it at frame start, world-walk start, or outdoor root start. Increment it with unchecked modulo-65,536 semantics.
2. Gate the entire outside stage on `outside_view.view_count != 0`.
3. Within that block preserve the exact order: landscape → alpha flush → **additional mid-frame render-stamp increment** → consume/reset counter → optional full depth clear → current true-depth exit seals.
4. Evaluate the `+/-12` whole-polygon predicate from original local input vertex `x/y` before transformation. Count accepted true-depth mask **attempts** after that rejection and before final clipping decides whether a fan exists.
5. Far punches never affect the counter. Use the exact far-Z bit pattern, not a rounded decimal approximation.
6. Preserve both render-stamp increments: the ordinary `Flip`/present increment and the conditional mid-`DrawCells` barrier. Keep that render stamp distinct from PView's flood timestamp.
7. Preserve independent reverse shell and object passes after the optional outside stage, then reset object scale and execute the final `useSunlightSet(1)` before the caller's top-level alpha flush.
8. Restore retail's state-faithful portal fan setup: color writes enabled, `SRCALPHA`/`INVSRCALPHA` blending, and source alpha zero. The current `ColorWrite=false` path is outcome-equivalent for destination color but is not the same state.
9. Port or line-by-line audit `polyClipFinish` before asserting clipped vertex counts or successful retail fan draws. Until then, trace only boundary decisions, attempt counts, and GPU submissions.
10. Restore retail's per-landcell terrain/building/object interleave before claiming full order parity. Merely fixing the counter leaves punch-versus-terrain ordering different.
11. Replace tests that demand unconditional clear/seals with a state-machine matrix: first eligible call, consecutive eligible calls, zero-outside gap, resume after gap, boundary-rejected seals, clipped-away accepted seals, far punches, and `ushort` wrap at 65,535/65,536 accepted attempts.

## Unresolved facts

1. The exact pixel-level effect of keeping `Render::PortalList = &outside_view` installed throughout retail sky/terrain rendering was not expanded through every `LScape` leaf in this slice. The top-level state and order are proven; whether each leaf clips geometry or only uses the view union requires a separate leaf audit.
2. GPU `gl_ClipDistance` may be geometrically similar to retail `polyClipFinish`, but numerical/vertex-set equivalence is not proven. The current eight-plane cap, interpolation rules, and lack of a clipped vertex count prevent a claim of byte/execution parity.
3. The dormant `forceClear` branch is fully decoded, but no write to `0x008ED824` exists in this retail binary. Its practical activation mechanism, if any, is external to the binary and irrelevant to shipped behavior.
4. The mode-3 failure fallback exists in `DrawPortal`, but the examined two-pass building BSP walk supplies modes 1 and 2. No production caller reaching mode 3 was established in this slice.

## Closeout

The decisive OH1 correction is not “find the guilty slab.” Retail has a small persistent depth state machine whose timing crosses eligible `DrawCells` calls. acdream currently substitutes unconditional per-interior-root events and a differently ordered landscape stream. The next implementation slice can be deterministic: port the state machine and exact mask predicates/constants, emit the transcript above, and only then run the cathedral visual gate.