acdream/docs/plans/2026-09-01-campaign-overhaul-world-solidity.md

Campaign OVERHAUL — retail world construction and render solidity

Status: ACTIVE — v2 rescope 2026-09-02. Five production slices replace the twelve-stage v1 plan. S1 is the current slice. See §13 for the ledger and §15 for what v2 changed and why.

Campaign code: OH.

Worktree (binding): C:\Users\erikn\source\repos\acdream\.claude\worktrees\peaceful-blackburn-5333f0

Branch (binding): claude/campaign-w-retail-frame-walk. This is the long-lived renderer integration branch. It carries all of Campaign FW (101 commits over origin/main at e102fb36). Nothing merges to main until the final gate passes; origin/main is merged INTO this branch at every slice boundary so it never drifts.

v2 base: 5d907ae9 (docs(render): define OH1 retail world contract), tree clean. The uncommitted OH1/T3 evidence grammar (~32K lines) is parked verbatim on quarantine/oh1-evidence-grammar-2026-09-02 (see its QUARANTINE-README.md). Do not merge that branch.

Recovery anchors: b3b7d922 is the checkpoint that committed the pre-overhaul investigation candidates, including the Facility Hub stair fix (recipe 7 authored drawing sphere, static render-shadow membership, per-part stamps). b8befded is the user-gated FW closeout. Both are history, not permission to discard later work. No history rewrite, ever.

One-sentence goal: recreate retail's single coherent world-cell graph and its exact per-frame world walk up to a narrow Vulkan translation boundary, so walls, terrain, buildings, objects, particles, transparency, and portal transitions remain stable at every camera position without scene-specific suppression, guessed tolerances, or corrective overdraw.

---

1. Why this campaign exists

Campaign FW replaced the legacy visibility product with a retail-derived frame walk and fixed several defects. It did not make the world pipeline retail-identical. The client still reconstructs relationships retail owns directly:

• prepared cell meshes are separate from portal topology;
• building shells are separate from building portal ownership;
• render projections are separate from physics CELLARRAY membership;
• static visual membership is rebuilt from visual bounds in an App-owned model that competes with the physics registry;
• terrain is submitted as a complete slice before per-cell object turns;
• alpha uses a modern scope-global queue rather than retail's exact cell/list ownership;
• the interior depth clear is unconditional although retail latches it on the previous frame's portalsDrawnCount;
• CellStruct face selection uses the AP-234 NoPos proxy rather than the surface-type decision retail makes;
• some accepted object parts are duplicated through Vulkan clip slots without proof that retail clips them.

These explain why local fixes oscillate between opposite failure modes. The precedent is physics: incremental collision patching never converged; the faithful retail port did. The renderer gets the same treatment.

Owner-observed symptom family: cathedral walls/wall-textured triangles over floating stairs; stair slabs appearing/disappearing by camera angle; the cathedral exterior ramp absent; textures bleeding through opaque surfaces; the local character chopped at cathedral and Facility Hub seams; remote actors and particles through walls; waterfalls vanishing by angle; outdoor groups disappearing after small turns; landscape draw-range regressions; spell effects lingering.

---

2. Definition of success

1. One authoritative, generation-scoped cell graph supplies portal topology, building ownership, drawable CellStruct identity, and render/physics cross-cell part membership. No production consumer rebuilds a competing answer.
2. CellStruct mesh extraction selects sides and subsets from the same authored data retail uses, including exact surface-type handling. AP-234 is retired.
3. The per-frame transcript matches retail's captured transcript for the same root and camera pose at the depth the capture records: landscape/building order, portal views, cell order, object-list turns, shell/part draws, depth events, alpha inserts and flushes.
4. Every leaf category has a proven retail contract: EnvCell shell, building shell, landblock static, indoor static, dynamic object, particle, terrain, punch, seal, transparent subset.
5. Vulkan receives an ordered list of already-decided retail draw operations. It may batch adjacent compatible work; it decides nothing.
6. No scene-specific suppression, shell lift, bias, fallback flood, corrective redraw, or behavior-changing diagnostic flag remains in production.
7. The owner acceptance matrix (§10) passes.
8. The complete Release suite, installed-DAT lane, connected lifecycle route, R6 route, and performance checkpoint pass on the exact gated binary.
9. Architecture, inventory, divergence register, launch options, memory, and milestone ledgers describe the code that ships.

"Looks fixed at one camera angle" is never a completion condition.

---

3. Scope and non-goals

In scope: CellStruct/EnvCell geometry construction; the canonical cell/building/portal/part-membership graph; static and dynamic cross-cell render membership; retail PView view ownership and leaf contracts; landscape, building, cell-shell, object, particle, depth, and alpha ordering; portal punch and exit-seal lifecycle; retail landscape in_view and its particle/light/ shadow consumers; material behavior needed for solid composition (AP-232 residual); minimal per-slice instrumentation; deletion of superseded reconstruction and diagnostic apparatus; docs and regression coverage.

Out of scope: replacing Vulkan; recreating C++ pointer layouts; changing streaming strategy, budgets, reveal radii, the mmap package model, or GPU resource lifetime except the S1 recipe bump; increasing draw distance; a lighting redesign; physics not required for exact membership; new graphics features; removing the user-requested Extended particle-range option.

---

4. Binding engineering rules

1. Retail makes every world decision. Modern code may represent a result differently but may not invent an additional visibility, membership, ordering, clipping, or depth decision.
2. A slice ships a production behavior change or it is not a slice. Evidence tooling is built inside the slice that consumes it, to the depth that slice needs, never as its own stage.
3. Evidence before code, contract already written. The OH1 research contracts (§6) and the retail capture (§7) are the evidence. No slice starts from a screenshot theory; no slice builds a new evidence language.
4. Named retail first; Ghidra arbitrates branch sense. Any condition whose polarity affects admission, clipping, depth, ordering, or lifetime is cross-checked in Ghidra (patchmem, port 8081) before implementation.
5. DAT identity is exact. A trace reaches owner → Setup → part → GfxObj → polygon/surface before assigning a visual carrier. Aggregate owner IDs do not identify content.
6. No symptom-site fixes. Cell/building/GfxObj IDs and camera poses are for diagnosis only.
7. No silent drop. Every rejected cell/view/part/mesh has a diagnostic reason available during a slice; production diagnostics are removed or made print-only at slice close.
8. No competing production owner. A cutover slice deletes the route it replaces within the slice.
9. Whole-mechanism fixes. Never patch a downstream draw when retail owns the decision upstream.
10. Build before launch; exact binary for gates. Commit hash, package recipe, flags, and log path are recorded before every owner gate.
11. Client process safety. Never kill the client.
12. Preserve unrelated work. No reset --hard, checkout --, clean, or bare stash. Rollback is a normal revert of a named commit.
13. Register discipline. Deviations filed/retired in the same commit.
14. Docs are tested truth. Architecture text and code agree at slice close.
15. Time-box. A chunk that needs a third fix round stops and goes to the user with its evidence. No agent decides it needs more infrastructure.

---

5. Working model

The v1 failure was one agent given the whole campaign for eighteen hours. v2 keeps the lead in the loop at every chunk.

Role	Who	Does	Never
Lead / architect	the main session (Fable)	writes each chunk contract (files, retail functions + addresses, acceptance tests); dispatches one bounded chunk; verifies every claim against source; runs gates; commits; merges main in at slice boundaries	hands off "complete the slice"
Implementer	Sonnet, one dispatch per chunk	one file cluster + its tests; build and test green is the return condition; returns a diff summary and open questions	commits; adds evidence infrastructure; starts a third fix round; touches files outside its contract
Retail reviewer	Opus, one pass per slice on the production port	checks each ported branch against the named decomp with addresses; findings as file:line + decomp citation	reviews tooling
Architecture reviewer	Opus, only at the two cutover slices (S2, S5)	one owner per fact; layering; lifetime; performance shape
Finding verification	the lead, against the source	each reviewer finding is checked by the lead against the decomp/contract/code before it is acted on; at most one Opus skeptic, and only for a blocking finding the lead cannot settle	spawns a skeptic per finding (the S1 review fanned out to ~30 agents this way on 2026-09-02; never again)

Agent budget per slice: implementers as needed (one per chunk, serial for coupled files); reviewers two (retail lens, and the architecture lens only at S2/S5); skeptics at most one per blocking finding. Anything that would spawn more than five agents in one step is wrong and stops.

Chunk contracts state explicit stop conditions: build red after two attempts → return; contract ambiguity → return with the question; any need for a third round → return. Coupled files go to one agent serially against a pinned contract; only genuinely independent chunks run in parallel worktrees. Agents write incremental output to disk; a silent agent is stopped and inspected, not waited on.

---

6. Evidence hierarchy and products

When sources disagree, in this order:

1. Live retail binary behavior captured at named functions (§7).
2. Named retail PDB/header identity and Ghidra-arbitrated decompilation.
3. Byte-exact installed DAT structure and geometry.
4. Existing FW0 cdb traces in docs/research/2026-08-30-fw-walk-oracle/.
5. Deterministic acdream replay of the same input.
6. Render/API captures.
7. acdream diagnostic logs.
8. Visual observation — to discover symptoms and accept final pixels, never to infer identity or branch logic.

Research contracts already written (committed at 5d907ae9, binding): oh1-retail-world-contract.md, oh1-construction-landscape-contract.md, oh1-built-mesh-view-contract.md, oh1-alpha-list-contract.md, oh1-depth-lifecycle.md, oh2-cellstruct-surface-contract.md, and the corrected 2026-08-30-fw-flood-pseudocode-appendix.md. The retail facts the v1 T3 reviews established are carried in 2026-09-02-campaign-overhaul-handoff.md §5.3 and are binding inputs to S3/S4.

Evidence products, minimal by design:

Product	Form	Used by
Geometry conformance	installed-DAT scans + synthetic fixtures + a two-run SHA-256 over the emitted CellStruct subset records	S1
Membership conformance	typed expected cell lists per fixture object + installed-DAT comparator between the canonical graph and the old builders (comparator lives and dies inside S2)	S2
Frame transcript	the FW0 line format (F/P/LS/BLD/DI/DC) extended with the OH line kinds the capture scripts emit; parsed by the existing test-side WalkOracleTrace parser, extended in place; acdream emits the same lines behind ONE print-only flag inside the slice that needs it	S3, S4
Framebuffer equivalence	offscreen fixture renders compared to the retail formula	S5

Pointer values, Vulkan handles, and allocation addresses are excluded from equality. No canonical JSONL, no semantic validator: structure is checked in the parser, semantics in the port and in the compare against retail.

---

7. Retail capture session (owner action, before S3)

The one owner action in the campaign apart from gates. Scripts live in tools/walk-oracle/oh/ (recon, three capture templates, runner, README).

Pose	Root	Why
holtburg-doorway-still	interior a9b4013f	the flap scene; three consecutive look-in punches of one cell
terrace-edge	outdoor	the #456 pose; far building drawn and depth-covered
cathedral-arrival	interior f4180106	interior root, landscape through the exit view, culled roster
foundry-deep	interior a9b40176	deep chain with ov=1; landscape and 12 buildings drawn from the basement

Per pose, three short attaches in order, each auto-detaching after its frame budget: walk (cell granularity: FW0 lines plus DrawEnvCell and object-cell turns, 5 frames), parts (CPhysicsPart::Draw candidates and DrawMeshInternal actual draws with GfxObj ids, 3 frames), alpha/depth (AddMeshToAlphaList, FlushAlphaList with site, depth-clear latch and portalsDrawnCount, 5 frames). Still poses repeat bit-for-bit per frame (FW0 finding 6), so few frames suffice and the ACE-timeout risk from per-hit .printf stays bounded. Budget: one hour.

Procedure: recon attach first (no breakpoints; dt/x dumps verify every offset the templates assume); PDB pairing check before every attach; qd only at top level after the terminal-hit fall-through. Logs land in docs/research/<date>-oh-walk-oracle/ and become S3/S4 fixtures.

If a static fact is later found unrecoverable from these captures, request one more exact capture with pose, action, duration, and expected trace. Never an open-ended "run around and report".

---

8. Target architecture (unchanged from v1)

DAT + prepared package
  └─ S1  CellStruct subset construction (surface-index owned, recipe 8)
World-cell graph (generation-scoped, S2)
  ├─ portal topology, building ownership, drawable cell identity
  ├─ static part-shadow membership (init_static_objects/AddPartsShadow)
  └─ dynamic/child membership (add_shadows_to_cells, one transaction)
Frame walk (per frame, S3)
  ├─ LScape::draw order → DrawBuilding sequence → look-ins
  ├─ PView views/todo/draw-list/stamps → DrawCells two-pass
  └─ leaf admission per category (whole-once / Boolean sphere / real clip)
Depth + alpha (S4)
  ├─ portalsDrawnCount latch, conditional clear, punches, seals, mid-frame stamp
  └─ retail alpha lists, per-cell insertion, FIFO flush sites, 0.75 valve
Consumers (S5)
  └─ landcell in_view → particles/lights/shadows; material/degrade policy
Vulkan encoder: ordered immutable stream; merges adjacent compatible runs only

Required properties: render and physics adapters never mutate canonical topology/membership; dynamic updates replace one object's membership transactionally with exact incarnation identity; children inherit the root's CELLARRAY by one rule; the walk owns per-frame views/todo/draw lists/stamps/ latches and never persists them in projections; the encoder cannot enlarge the visible set or reorder across a semantic boundary.

---

9. The five slices

Each slice: plan packet (already written or one short note) → implementation in bounded chunks → retail review (+ architecture review at S2/S5) → fix → automated gate → owner gate where listed → ledger update → merge origin/main in.

S1 — Geometry: exact CellStruct construction (was OH2)

Spec: oh2-cellstruct-surface-contract.md, sections 3, 8, 9, 10, 12 are the implementation contract verbatim. Retail anchors: CEnvCell::UnPack 0x0052D470, CPolygon::UnPack 0x00538650, copyVert 0x0059C080, D3DPolyRender::ConstructMesh 0x0059DFA0, D3DPolyRender::DrawMesh 0x0059D4A0, RenderDeviceD3D::DrawEnvCell 0x0059F170.

Behavior change: side candidates come only from sides_type; NoPos/ NoNeg mean UV absence only; subsets are owned and ordered by source surface index; built-EnvCell admission is (Surface.Type & 6) != 0 after surface resolution; authored sides_type is not GPU cull. AP-234 retired.

Chunks:

1. Core side-candidate descriptor (pure, allocation-free) + MeshExtractor. PrepareCellStructMeshData rewrite against it + §10.1/§10.2 tests.
2. Prepared subset record fields (source surface index, raw type, retail mask, fixed cell-shell cull) + ObjectMeshDataSerializer round-trip + PakFormat.CurrentBakeToolVersion = 8, launcher recipe 8, 7 → 8 FullRebuild step + §10.5 tests. Container format stays 2, with a test saying so.
3. CellMesh.Build routed through the same descriptor or its render role deleted; full installed-DAT scan with every admission delta explained by Surface.Type & 6; two-run deterministic hash; §10.3 canonical pins (0xF4180104: eight ST_DOUBLE clip-map polygons, 44 drawable side calls); AP-234 row deleted with addresses; inventory/architecture text.

Review: retail lens on the descriptor, mask, winding, and admission; data lens that no ordinary-GfxObj rule leaked into cells or vice versa; Surface lookup stays in Content/bake.

Automated gate: Content, Bake, Core, Launcher.Core, focused App suites green in Release; installed-DAT scan reports zero unexplained deltas; full solution build green; no per-frame allocation or DAT lookup added.

Package: rebuild the dev pak (Documents\Asheron's Call\acdream.pak) to recipe 8 through the supported bake flow; keep the recipe-7 file beside it as acdream.recipe7.pak. Note the launcher-installed pak under %LOCALAPPDATA%\acdream\pak is still recipe 6; it is not the gate binary's pak.

Owner gate G1 — geometry integrity. One exact build: cathedral exterior ramp and every floating stair slab; cathedral walls at the 0x104/0106 and 0x107/0112 seams; Facility Hub bottom/top stairs and doorway walls; two ordinary dungeons with solid-color and textured surfaces; Holtburg/Nanto shells. Pass = no missing/new wall faces, no invisible ramp/slab, no gross material substitution. Camera-dependent occlusion is not adjudicated here.

Rollback: revert the S1 behavior/schema commits; restore acdream.recipe7.pak.

S2 — World graph: one membership owner (was OH3)

Spec: oh1-construction-landscape-contract.md §construction/ownership; retail: CEnvCell::init_static_objects, CPhysicsObj::calc_cross_cells_static, CPartArray::AddPartsShadow, CPhysicsObj::add_shadows_to_cells, find_bbox_cell_list, child-list propagation and removal counterparts. Starting point: the b3b7d922 candidates (WalkProductionWorldData render index, ShadowShapeBuilder.FromStaticRenderParts, ShadowObjectRegistry.ComputeStaticRenderCells, the Facility stair pin FacilityStairAssembly_RegisterAcross015FTo015EWithoutCollisionRows). They use retail's mechanism in the wrong owner; S2 moves them, it does not delete the mechanism.

Behavior change: one generation-scoped WorldCellGraphSnapshot owns portal topology, building ownership, drawable cell identity, and typed per-part render-shadow plus object-level physics CELLARRAY outputs from one registration transaction. Every consumer borrows it; the App-owned render index, visual-AABB fallbacks, origin-cell fallbacks, and duplicate cell buckets are deleted.

Chunks (revised 2026-09-02 from the ownership trace in s2-membership-ownership-map.md):

1. Retail CELLARRAY from the whole part array (per part: physics sphere else drawing sphere, part box) computed in ShadowObjectRegistry at the same registration call as today's collision flood, retained as a new product beside _entityToCells, plus per-cell part entries (entity, part, GfxObj, cell frame, clip-planes-required) in registration order. Nothing consumes it yet; a comparator over installed-DAT fixtures reports retail vs current collision vs current render cells. Zero pixel change.
2. Render statics cut over to the registry's per-cell part entries; delete ResolveStaticRenderCells, ComputeStaticRenderCells, the fingerprint cache, and App's FromStaticRenderParts use. Fixtures: cathedral ramp/stairs/walls, Facility stairs, a 24 m cell-edge crosser, a landblock-edge object, a non-colliding decoration, a multi-part Setup whose parts cross different cells.
3. Collision cut over: _entityToCells/_cells from the same CELLARRAY. Physics suites, placement/collision replay fixtures, connected nine-stop route.
4. Dynamics and children: add_shadows_to_cells recursion at registration and movement; particles own-cell; delete the render-side parent-chain walk. Fixtures: local/remote player, NPC, projectile, spell world object, equipped child, contained child, indoor portal crossing, outdoor crossing, teardown/reconnect.
5. Consumer cutover and deletion: remaining WalkProductionWorldData buckets become borrowed views, particle owner union reads the same, duplicate dictionaries and origin-cell/visual-AABB fallbacks are deleted. Lights and directional shadows stay for S5. Topology triplication (LoadedCell / WalkCell / flat asset) is consolidated with S3's WalkPView state, not here.

Review: architecture (one authority; retry/recenter/reset safe; no per-frame rebuild) and retail (crossed cells and insertion order match the AddPartsShadow family; CellTransit prune change affects collision too and is reviewed as such).

Automated gate: comparator zero mismatch on installed-DAT canonical routes; render-shadow and physics projections each match typed expectations from the same transaction; cancellation, generation replacement, landblock retirement, reconnect, child detach converge to zero rows; full Release solution and connected headless lifecycle route green.

Owner gate G2 — membership stability. Cathedral floating stairs/ramp; move/rotate at Facility Hub stairs; circle dense Tusker groups while turning; remote player and NPC across cathedral wall cells; cast several spells. Pass = static geometry never vanishes because its origin or camera-facing cell changes; dynamics do not vanish at transitions; retired effects leave no rows.

S3 — Walk: exact PView views, leaf admission, and interleave (was OH4 + OH5)

Spec: oh1-built-mesh-view-contract.md, oh1-retail-world-contract.md, the flood appendix, handoff §5.3 facts, and the §7 capture fixtures. Retail: PView::InitCell, InsCellTodoList, ClipPortals, AddViewToPortals, ConstructView, DrawCells, Render::copy_view, set_view, obj_view_set, viewconeCheck; LScape::draw_check_blocks, landcell_check, grab_visible_cells, draw, calc_draw_order; RenderDeviceD3D::DrawBuilding, DrawEnvCell, DrawObjCellForDummies, CShadowPart::insertion_sort, CPhysicsPart::Draw, DrawMesh, DrawMeshInternal.

Binding already-proved facts: the built cell shell is stamped and submitted whole once after Boolean admission; portal polygons, not built meshes, are polygon-clipped; DrawCells draws all shells then all object lists, both in reverse draw-list order, views ascending; device, cell-shell, and part stamps persist with the local-player bypass. The "first view clips the shell" hypothesis is retired.

Behavior change: WalkPView owns retail's exact per-frame state (portal-view lists, view/update counts, todo order, draw list, stamps); each content category follows its retail leaf rule (whole-once / Boolean sphere / actual polygon clip / repeated submission) and Vulkan clip slots are removed from categories where retail does not clip; terrain is emitted as ordered landcell events interleaved with buildings and object lists in retail far-to-near order; DrawBuilding is one semantic sequence (degrade gate → full alpha barrier → look-in work → punch → own shell); the "all terrain first" simplification is deleted.

Chunks: (1) transcript emitter for the OH line kinds behind one print-only flag + parser extension + fixture import of the §7 logs; (2) exact PView state and per-category leaf contract with CPU/GPU equivalence pins for any category that still translates a clip to Vulkan; (3) landscape/building/cell/ object interleave with per-landcell terrain ranges; (4) delete disproved generic clip rules and the whole-stage terrain event.

Review: retail lens on every stamp/view loop branch (Ghidra) and on the call order against capture and decomp; shader review of clip-space sign, y inversion, W plane, plane count, scissor for remaining translated categories; performance review that command count increase is measured, not hidden by reordering.

Automated gate: transcript equality with the §7 captures at the captured depth for all four poses plus the FW0 still fixtures; tests distinguish whole-shell-once, Boolean part admission, and actual polygon clipping; pan/zoom replay changes membership/draw count only at a retail view boundary; no duplicate draw of a stamped part; terrain pixels/mesh counts unchanged when no interleave is present; dense-outdoor p50/p99 recorded.

Owner gate: none standalone; folds into G3.

S4 — Depth and alpha: latch, punches, seals, stamps, lists, flushes (was OH6 + OH7)

Spec: oh1-depth-lifecycle.md, oh1-alpha-list-contract.md, the §7 alpha/depth captures. Retail: the complete PView::DrawCells outside-view block, portalsDrawnCount producer/reset/consumer, the mid-frame stamp increment (@0x005A4886), far-Z punches, true-depth exit seals; D3DPolyRender::AddMeshToAlphaList, FlushAlphaList, CShadowPart::insertion_sort, DrawBlock's 0.75 pressure valve.

Behavior change: one frame-persistent latch owner for portalsDrawnCount; the landscape → flush → stamp → clear → seal block gated exactly as retail; WalkFrameDriver's unconditional interior clear deleted; the mid-frame stamp placed exactly so straddling parts draw in both retail scopes; exit seals from the exact current views and cell order; look-ins cannot touch the root latch. The scope-global CYpt sort is replaced by explicit retail list records with per-cell insertion order, FIFO flush, exact full-flush sites, and the 0.75 valve; transparent EnvCell subsets routed to their retail list. AP-34 retired. Vulkan keeps the already-ported state: depth ALWAYS, write ON, color OFF, no stencil; far-Z punch, true clip-space seal.

Chunks: (1) latch owner + conditional block + seal generation + truth-table tests; (2) alpha list records + insertion sort + flush sites + valve + ordering tests; (3) delete obsolete stencil/bias/skip paths and the CYpt sort.

Tests: truth table over root kind, draw_landscape, outside-view count, previous/current portal count → clear/seal/stamp events; two consecutive frames proving the latch is cross-frame; multiple look-ins isolated from the root; coincident cathedral exits at y≈24/48/72; outdoor root never clears interior depth; multiple translucent objects in one cell with reversed distance/insertion orders; equal-key stable tie; two cells where a global sort disagrees with traversal; particle/object/transparent-cell overlap; DrawBuilding 0f flush; pre-clear and final flush; 0.75 partial flush; alternating blend modes across Vulkan batches.

Review: retail lens tracing every state write from producer to next-frame consumer, and every list from insertion to flush; GPU lens on pipeline state after the transcript is exact; architecture lens that the latch has one frame owner and resets on generation change.

Automated gate: depth-event and alpha transcripts exact against §7 captures; focused walk/depth/alpha suites and full Release build green; AP-34 deleted; no behavior-changing probe in the cathedral replay.

Owner gate G3 — opaque solidity and transparency. Cathedral 0xF4180106 ↔ 0xF4180104 both directions with zoom/rotate; floating stairs 0xF4180107 ↔ 0xF4180112 ascend/descend/pan/zoom; exterior ramp from all angles; remote player at 0xF4180112 seen only through valid openings from 0x104, 0x101, outdoors; Facility Hub stairs at all zoom extents; cathedral waterfalls, mist, torches, lifestone/portal effects; Tusker/Nanto/Holtburg rotate in place. Pass = player whole, walls opaque, no wall-textured beam or missing slab, no terrain bleed, correct transparency order, no effect through walls.

S5 — Consumers, material, cleanup, closeout (was OH8 + OH9 + OH10 + OH11)

Spec: oh1-construction-landscape-contract.md §landscape; retail LScape::draw_check_blocks, landcell_check, get_clip_height, block_check, CLandCell::IsInView (previous-frame), CEnvCell::IsInView (constant PARTIALLY_INSIDE); DrawBuilding degrade selection; the fixed-function material stage for translucent detail (AP-232).

Behavior change: the landscape walk produces the exact retail landcell in_view set; frustum/AABB reconstruction is replaced for every IsInView consumer (particle update/degrade, point-light snapshots, directional-shadow selection); the Extended particle range remains a deliberate post-retail option, Retail mode applies no multiplier; AP-117 retired or narrowed. Building degrade selection and complete-body gate exact; translucent detail combine reproduces retail's single stage result with framebuffer-equivalence fixtures; one audited world-subset state policy table; AP-232 retired. Then delete every obsolete owner, fallback, flag, probe, and stale claim, add the architectural guards, and run the full closeout.

Cleanup inventory (delete or retire): competing membership dictionaries; origin-cell and visual-AABB fallbacks; disproved generic per-view clip rules; whole-stage terrain events; unconditional clear code; scope-global alpha ordering; ACDREAM_PROBE_CATHEDRAL_* skip flags (DELETED in S3 chunk 4, 62c2231d) and the carrier-discriminator code; ACDREAM_PROBE_FACILITY_STAIRS and WbDrawDispatcher.FacilityStairProbe with its call sites in RetailPViewRenderer, WalkPView, WalkProductionWorldData, WalkStaticStreamPopulator, WbDrawDispatcher.OrderedStream/WalkClassify; obsolete shell-lift, bias, stencil, corrective-redraw, suppression tests; PortalVisibilityBuilder research code out of production; stale launch-option rows; architecture claims contradicted by code. Guards: one WalkPView/graph owner in the production call graph; renderer cannot query DAT; consumers cannot construct independent visibility sets; the submitter cannot sort across semantic boundaries; no production reference to OH diagnostic symbols.

Automated closeout: full Release build; focused App/Content/Core/Runtime/ Launcher suites; hermetic lane Lane!=InstalledDat&Lane!=Linux&Lane!=Manual&Lane!=Timing&Lane!=Live&Lane!=PreparedPackage; installed-DAT lane with exclusions listed; two deterministic geometry/ membership runs with equal hashes; transcript equality over all fixtures; capped/uncapped lifecycle/reconnect routes; R6 nine-stop; portal in/out with long destination prep; graceful shutdown with zero retained rows.

Performance checkpoint: dense Arwic capped/uncapped, Tusker dense scene, cathedral floating stairs, Facility Hub; CPU/GPU p50/p99, FPS, draw counts, allocation/frame, memory, retained graph/membership bytes, alpha high water. A regression over 20% against the recorded pre-OH baseline triggers an explicit optimization slice (merge adjacent runs, reuse storage; never reorder, cull, or weaken the transcript).

Owner gate G4 — final matrix. Repeats G1–G3 on one clean binary and adds: two-client cathedral wall occlusion; Facility Hub stair circuit; Nanto waterfalls and town; Tusker combat/casting/rotation; Holtburg town/building/ lifestone; two ordinary dungeons chosen without code changes; portal to/from each world type; zoom/pan/rotate at seams; ten minutes of free movement. Per row PASS/FAIL with location and symptom. The final binary is not rebuilt after acceptance except for documentation-only changes.

Documentation closeout: architecture doc (actual graph and pipeline), inventory (asset extraction only, never visibility ownership), divergence register reconciliation, launch options after probe deletion, FW ledger superseded not deleted, roadmap/milestones, campaign memory. Then merge to main. Status changes to CLOSED — USER ACCEPTED only after G4 and docs match code.

---

10. Canonical scene and symptom matrix

Scene	Fixed coordinates/state	Required invariant	Slices
Cathedral south transition	0xF4180106 [37.181568 46.790077 169.804993] ↔ 0xF4180104 [37.310383 48.895710 169.804993]	Player and walls whole; no wand/body depth inversion	S3–S4
Cathedral wall actor	Observer 0x104, 0x101, outdoors; remote in 0xF4180112 [36.299465 18.594580 169.804993]	Actor visible only through a retail-valid sightline	S2–S4
Cathedral floating stairs	0xF4180107 [38.311169 24.270454 177.423584] ↔ 0xF4180112 [38.333950 23.704699 177.868729]	Every slab stable; no moving wall-textured triangles; the exterior-wall slab through the stair chamber MATCHES retail's (retail axiom 2026-09-03, logs/oh-capture/cathedral-leak.retail.png) — same slab, same extent, not absent	S1–S4
Cathedral exterior ramp	Stand on the formerly invisible ramp	Authored shell/member always renders	S1–S3
Facility Hub stairs	0x8A02015E [60.971485 -42.752495 -4.121752], 0x8A02015F [58.815380 -49.425373 -0.857726]	Stairs/player stable at bottom, side, ascent, top, zoom	S1–S4
Nanto waterfalls	0xE43D001E [93.826614 126.522484 120.005005]	Falls do not vanish while rotating; houses occlude	S4–S5
Tusker Island	Owner's dense combat route	Terrain/scenery/actors stable; spell objects retire	S2, S3, S5
Holtburg	Town route	Buildings intact; particles/lifestone obey depth	S3–S5
Ordinary dungeons	Two, chosen before code changes	No cathedral overfit; stairs/walls/portals stable	all
Cathedral stairwell, camera zoomed out (owner, 2026-09-03 night, #464)	0xF4180113 [39.502899 19.589222 181.119247] (also 0xF4180112 [39.070965 22.549135 178.781418], 0xF4180113 [39.364658 21.293159 179.773422]), third-person camera zoomed fully out and tilted slightly up	Root 0xF4180114 with 0x113/0x112 flooded draws the stairwell solid, and from an eye beyond the open y=24 face (root 0xF4180109, which retail's swept 0.3 m viewer sphere also reaches) the stairwell cells seen through the building's exterior portals draw with their walls — no vaulted hall, archway sky, balcony or floating stair slabs through the stairwell walls	S4 (owner gate G3 names zoom)

Append-only; a new symptom gets a row and an existing invariant before any fix.

---

Self-gate poses (owner-supplied 2026-09-02)

The lead may run owner gates itself: launch the Release client at a recorded commit through a session config (direct character login, no select screen), teleport with the server command below (/teleloc <cell> <x> <y> <z> <qw> <qx> <qy> <qz>), screenshot each pose into the automation artifact directory, read the PNGs, and record PASS/FAIL per pose in §13. The owner double-checks in the morning; a self-passed gate stays provisional until then.

Pose	Command
Cathedral floating stairs	/teleloc F4180112 38.999477 23.470444 178.053741 -0.980785 0.000000 0.000000 -0.195090
Facility Hub stairs	/teleloc 8A02015E 60.251431 -38.848198 -5.995000 0.995004 0.000000 0.000000 -0.099833
Holtburg house interior	/teleloc A9B4013F 134.555893 11.423566 94.005005 0.996917 0.000000 0.000000 -0.078459

Add the §10 matrix coordinates and the four retail capture poses (docs/research/2026-08-30-fw-walk-oracle/posed/, P lines: cell, origin xyz, quaternion) as further stops when a gate needs them.

---

11. Test and command policy

dotnet build AcDream.slnx -c Release
dotnet test tests\AcDream.Content.Tests\AcDream.Content.Tests.csproj -c Release --no-build
dotnet test tests\AcDream.Core.Tests\AcDream.Core.Tests.csproj -c Release --no-build
dotnet test tests\AcDream.Runtime.Tests\AcDream.Runtime.Tests.csproj -c Release --no-build
dotnet test tests\AcDream.App.Tests\AcDream.App.Tests.csproj -c Release --no-build
dotnet test tests\AcDream.Launcher.Core.Tests\AcDream.Launcher.Core.Tests.csproj -c Release --no-build

Focused --filter runs are for iteration; a slice closes on the full families above plus the hermetic lane. Record exact commands and counts in §13.

Launch discipline: every launched candidate is a green Release build from a recorded commit; all behavior-changing probes unset; the owner is told the exact commit, recipe, and log path; the owner closes the client.

---

12. Instrumentation lifecycle

• One print-only transcript flag for the frame walk, introduced in S3 chunk 1, documented in docs/launch-options.md in the same commit, output-only, never read by any draw decision.
• Slice-local comparators (S2 old-vs-new membership) live and die inside the slice.
• Existing ACDREAM_PROBE_CATHEDRAL_* / ACDREAM_PROBE_FACILITY_STAIRS flags stay unset and untouched until S5 deletes them.
• No agent adds a probe outside its chunk contract.

---

13. Execution ledger

Update immediately when a slice changes state. Chat is not the ledger.

Slice	Status	Spec	Implementation	Reviews	Automated gate	Owner gate	Notes
v1 OH0	CLOSED	oh0-baseline.md	b3b7d922	read-only classification	Release build green; 319 focused / 1 skip	n/a	historical; candidates it committed are S1/S2 seeds
v1 OH1	SUPERSEDED	research contracts committed at 5cd4fd2c/5d907ae9 (kept, binding)	T0–T3 evidence grammar parked on quarantine/oh1-evidence-grammar-2026-09-02	reviews found the grammar a false oracle three times	n/a	n/a	see §15
S1 Geometry	CLOSED — G1 PASSED 2026-09-02	oh2-cellstruct-surface-contract.md (§3.5 arbitrated on the binary)	chunk A acf17246; chunk B b681717c; hygiene 0840d5fb; review fixes e2543d0e; G1 regression fix 8c6563ca (segment/batch pairing) + its pin test (next commit)	lead verified both chunks against the named pseudo-C and the paired binary; two Opus lens reviews, 8 findings all verified by the lead and fixed; the review round's own upload-order change desynchronized cell-shell index segments from batches (first G1 launch: magenta/stretched/missing walls in every dungeon) and was root-caused and fixed by the lead before the re-gate	build 0/0; Content 213/213 (incl. PreparedPackage on the recipe-8 pak); Core 4,948/4,948 (one load-sensitive allocation test outside S1 passes alone); Bake 21/21; Launcher.Core 365/365; Runtime 1,884/1,884; App hermetic 6,757/6,757	G1 PASS: Facility Hub stairs/doorways, Holtburg house interior, ordinary dungeon, town portal network all whole with correct materials on 8c6563ca + recipe 8; cathedral shows the ORIGINAL symptom family (neighbor-cell walls drawn through portals over the room), explicitly outside G1 and carried to S3/S4	dev pak recipe 8 (597,369,112 B; acdream.recipe7.pak kept); TOC delta explained; corpus scan old-only 3,197 (all untextured), new-only 0, unexplained 0
Capture	READY	§7 + tools/walk-oracle/oh/README.md	scripts committed ebaa41df + 14d8fe64; lead resolved DBObj::m_DID=+0x28 and the cdecl alpha-function conventions; recon attach re-confirms	—	recon dt/x/uf dumps at session start	owner session ~1 h	before S3
S2 World graph	CLOSED — G2 PASSED (owner, 2026-09-03): Facility Hub PASS, Holtburg house PASS, cathedral leak unchanged/not worse (S3/S4 target), portal haze FIXED by chunk 6 and owner-confirmed; the terrain doorway-punch finding is carried to S4; the chunk-6 retail-lens review (Opus) returned no blocking finding; its one MAJOR (a cell reached through two portals got two particle turns per frame) and the minor items are fixed in the follow-up commit: frame-scoped particle-turn dedupe beside the shell dedupe, zero-emitter cells cost one count check, the scope-cost counter maintained on the cell path, the dead OutdoorSceneParticleEntityIds stub chain deleted through the composition root, AD-117 item 4 names the owner-cell substitution and the absent per-emission AddPartToShadowCells, and a sink-level pin that an emitter's cell membership is the owner's pose cell and survives the projection-visibility switch (the review's F7 one-frame eligibility lag is the per-frame view pass, documented in the pin). RETAIL AXIOM (owner, 2026-09-03, at the capture session, 2013 v11.4186 client on local ACE): standing on the cathedral stairs, RETAIL ITSELF shows part of the same artifact — the outside structure leaking into the interior — CONFIRMED in BOTH the 2013 v11.4186 client and the 2015 EoR client (owner switched clients to check), so the cathedral leak is retail behavior S3/S4 must REPRODUCE, not remove; the retail transcript at that pose is captured as logs/oh-capture/cathedral-leak.{walk,parts,alphadepth}.log (walk 5 frames with LC/SC landscape order, parts 3 frames, alpha-depth 5 frames, recon-verified offsets); owner's retail screenshot at the pose: an exterior wall slab cutting diagonally through the stair chamber over the interior ramps (logs/oh-capture/cathedral-leak.retail.png, owner-saved)	s2-membership-ownership-map.md (e7ad25a7) + Contracts A/B; closeout evidence §8/§9	chunk 1a 059b8883; chunk 1b 5a2792d6; chunk 2 707d2803 (render statics borrow the registry's retail array; render flood deleted); chunk 3 afbd2410 (one flood per registration feeds collision rows and render entries; staged SetPosition carries both products); chunk 4 75ea269d (movement publishes from the transition's cells; children inherit at registration); chunk 5 + closeout c94a1a40 (borrowed per-cell views, render-only registration, sweeps/fallbacks deleted; reflood forwards the part array; NON-COLLIDING DAT STATICS register render-only from both publishers; the dual-review fix batch: Suspend clears the retail product, attach/detach advance the mutation revision, an attached child never floods on its own, RemoveLandblock/RetireOwnerFromLandblock prune retail rows, render-only owners move with their destination cell (retail's zero-sphere find_cell_list 0x0052b4e0, verified statically 2026-09-03 — AD-117 item 1 dropped), empty part array == null, per-move closures removed, EnvCell shells out of the entity-id index, index predicate compares the id, dead per-cell scene indices deleted)	lead corrected 1a's route decision before landing; chunk 2 verified by the lead; chunk 5's agent report missed the non-colliding-static population (found by the self-gate PIXEL DIFF, not by eye: Facility wall panels grey); S2 dual review (arch + retail lens, Opus) produced 12 + 7 findings, every one lead-verified against the source before an edit; the four BLOCKING/MAJOR lifetime gaps were real	at c94a1a40: Core 4,984/4,984; Content 214/214; Runtime 1,884/1,884; App hermetic lane 6,760/6,760; App InstalledDat 217 pass / 1 skip / 2 pre-existing #383; App Windows 1/1	G2 PROVISIONAL PASS. Self-gate runs (kit ea546f38, pwsh): logs/selfgate-20260902-231426-baseline-g1-binary (reference), …231642-s2-chunk3, …233845-s2-chunk4 (identical), logs/selfgate-20260903-002632-s2-chunk5-reflood (FAIL: Facility wall panels grey, left-wall mean RGB 29,26,23 vs baseline 65,17,21 — missing non-colliding statics), logs/selfgate-20260903-010022-s2-review-fixes-3 (candidate: panels back at 79,20,25 = chunk-3/4; cathedral 13.6% / Facility 15.0% / house 13.4% px differ vs baseline, the chunk-3/4 band; graceful logout, zero exceptions). Membership-probe run logs/selfgate-20260903-003013-s2-chunk5-membership-probe: [walk-membership] fired only on two transient Holtburg login frames, never in Facility Hub or the cathedral. Connected R6 soak on the chunk-4 build 6717a3e5 (logs/connected-r6-soak-20260902-234016.report.json): 9 destinations in 511 s, zero invariant failures, graceful exit — route PASS (its -CollisionShadowEvery referee is the obsolete I5 graph-vs-flat comparator; retire in S5). Connected R6 soak on the FINAL S2 build (logs/connected-r6-soak-20260903-010403.report.json, binary matches source, exit 0, graceful=True): 9 canonical checkpoints, 0 failures, 10 warnings (server-side population drift + DAT VFX table messages), 522 s — route PASS. OWNER G2 CHECK 2026-09-03 (client at 4b0b29e4): Facility Hub PASS, Holtburg house PASS; cathedral: the original leak unchanged, NOT worse (S3/S4 target, G2 bar met); TWO NEW OWNER FINDINGS block G2 closure — (a) parts of buildings leak through terrain outdoors in Holtburg — owner screenshot shows doorway-sized fragments of the houses on the terrace BELOW showing through the hill; mechanism identified: PortalDepthMaskRenderer draws every visited cell's OtherCellId == 0xFFFF portal fan (RetailPViewPassExecutor DrawDepthFan) with depth compare Always + depth write, so a building doorway BEHIND terrain still punches far depth through the hill and the interior draws through the hole; retail's far punch cannot be Always against terrain — the exact z-func is S4's first question (the #117 punch stencil is already on S4's delete list; the retail-world contract §5.4 wording must be re-read at the capture). Pre-existing (not an S2 regression), assigned to S4; (b) the purple portal-exit haze on the character no longer appears on arrival — ROOT CAUSE FOUND (instrumented runs logs/selfgate-20260903-053731-haze-candidate, …-054153-haze-candidate-2, chunk-4 control …/bisect-chunk4/logs/selfgate-20260903-054328-haze-chunk4): the server keeps the player Hidden until acdream sends LoginComplete at reveal complete (retail-correct); the Hidden-state script's emitters spawn in the arrival cell at materialized, are view-eligible at world-visible, and are never DRAWN (frame h02-arrive-400ms: room, no character, no cloud) because the walk draws an owner's emitters only through the owner's registry rows and a hidden owner's shadow is suspended; the deleted chunk-5 fallback used to carry them. Retail gives every emitter its OWN cell membership (add_particle_shadow_to_cell 0x00514a70, one shadow in its own cell, no clip planes, drawn at that cell's turn regardless of the parent's hidden state) — the branch AD-117 item 4 had deferred as 'no production path'. Fix = S2 chunk 6 f6b4584b (packet §10): ParticleSystem per-pass cell→handles index + DrawForCell; the walk draws particles BY CELL at the existing turns; every owner-union particle path deleted; the post-replay per-cell pass deleted (it double-submitted the root flood — the implementer flagged it, the lead verified EmitCellContentsTurn fires CellParticles for root-flood and look-in cells alike); AD-117 item 4 → port note; temporary probes removed. VERIFIED: logs/selfgate-20260903-062522-haze-chunk6 frame h02-arrive-400ms shows the purple cloud at the character in Facility Hub; three-pose self-gate logs/selfgate-20260903-062615-s2-chunk6 in the accepted band (cathedral 12.7% / Facility 15.1% / house 13.9% px vs baseline, wall-panel mean 79,20,25), zero exceptions. Gates at f6b4584b: Core 4,987/4,987; Content 214/214; Runtime 1,884/1,884; App hermetic 6,760/6,760; App InstalledDat 217 / 2 pre-existing #383. Owner re-check of the haze: CONFIRMED FIXED 2026-09-03 ("Ok yeah it is fixed now"). Morning handoff: docs/research/2026-09-01-overhaul/2026-09-03-g2-morning-handoff.md	owner double-checks G2 (handoff checklist); then the owner capture session (the S3 packet §7 names the two traces); then S3
S3 Walk	CHUNK 2 LANDED 2026-09-03 (be9b4c1f + comment 2f5373c7 + review follow-ups 434a7df2); CHUNK 3 DISPATCHED (contract §9); contracts §8–§11 written; CAPTURE SESSION COMPLETE (five poses, fixtures at docs/research/2026-09-01-overhaul/oh-capture/). Chunk 2 verification: three Opus lenses (retail decomp / driver correctness / build+test truth) all PASS — one MINOR (the off-by-default seal-skip probe had gained a second effect through the seal count → probe DELETED in 434a7df2), notes on the Collect/Replay consume-vs-re-arm split (no retail analogue, documented), the enumerated-vs-degenerate-guarded seal count (inert: the consumer is != 0), and two weak-but-in-spec pins (the interior PView flag is now wired explicitly). Implementer deviations (accepted): the two-floods-in-one-Collect whole-once test stays at ov=0 (no retail analogue for two root floods per frame); R1 pinned as field wiring, not a look-in integration fixture. Gates at be9b4c1f/434a7df2: App hermetic 6,765/6,765; focused 297/1 skip; InstalledDat 241 pass / 1 skip / 3 known (2× #383 + TowerAscent KnownFailure). Self-gate logs/selfgate-20260903-075507-s3-chunk2 at 4c364412 (four poses incl. the NEW owner-supplied Holtburg terrain-leak pose): vs the chunk-6 run 1.8% / 4.0% / 1.6% px differ — ONLY the player's idle pose, the Facility drudge, and daylight through the Holtburg doorway (diff sheet inspected), no structural change; Facility wall-panel mean (78,20,25) = panels present; zero exceptions. 04-holtburg-terrain-leak.png shows the doorway-sized fragments through the hill = chunk 3's BEFORE reference. Chunk 3 contract finding: the ported ring order, closest-cell table and ring-to-LOD mapping reproduce every captured LC/SC sequence at both cathedral poses with zero mismatches (LOD cell ids are x*8+y+1 in LOD coordinates). Chunk 2 finding: retail gates the landscape flush, stamp advance, Z clear and exit seals on outside_view.view_count > 0 (PView::DrawCells 0x005a4840) and the Z clear additionally on the persistent seal counter D3DPolyRender::portalsDrawnCount (fed by exit seals alone in the building path) — acdream's unconditional clear/seals and the _skyDrawnThisFrame proxy are the divergence chunk 2 retires	s3-walk-ownership-map.md (retail table, current owners, four chunks, review lenses, gate, the three exact captures to ask for) + built-mesh/world contracts	—	—	—	folded into G3	CHUNK 4 IMPLEMENTED 6ba4b0b8 (cherry-picked 62c2231d): the per-slice weather loop, the dead clip routing, the slot-list classifier shape, six cathedral probes + rows, equivalence pins for the kept seal/punch clips, and chunk 1's O1–O4 (the weather OC printed at Collect time with real pins); review: retail lens PASS, build/renderer lenses FAIL on the once-per-frame weather pin (counts calls, so a loop still passes) plus leftovers → FIX ROUND 1 (§10.4 K1–K8, incl. K4: the sky drawn once unclipped like terrain/weather) = d60ca4ea0, FAILED all three lenses 2026-09-03: BLOCKING (all three) the draw-side weather gate is unpinned — restoring the round-0 gate clipAssembly.OutsideViewSlices.Length != 0 leaves every lane green, and the transcript test's doc falsely claims to be the draw-side pin; MAJOR: K4 kept BeginScissor/EndScissor/NdcScissorRect on the false comment 'ClearInteriorDepth still ends an active scissor' (zero producers remain); sky.vert:88-102 still says retail clips the sky and cites the deleted SetTerrainClip; the K6 pin runs through ClipFrameAssembler.Assemble (zero production callers; the slice construction is duplicated at :394/:533); MINOR: K3 replaced one per-frame publish with a 144-byte zeroed ring allocation per terrain flush + per sky draw, kept dead _terrainBytes state for an unfailable pin, left ClipFrame.cs:140 naming the deleted method, left Issue130DoorwayStripTests pinning the deleted scissor, no DrawWalkSky loop-shape pin, and the commit message deferred the mutation texts. → FIX ROUND 2 (§10.5 L1–L9, the LAST allowed: pin the gate's CONDITION in IL with three mutations; delete the scissor stack and the dead TerrainClip UBO from the three shaders with recompiled SPIR-V; one shared outside-view slice constructor for the K6 pin; #130 test cut to what production reads; sky loop-shape pin; every mutation text inline) contract 65675e77a; the fixer landed round 2 as 2e3ae95ff in s3-chunk4-impl (hermetic 6,827/6,827; InstalledDat 244/1/4 known; five mutation checks inline; lead-verified: the 570-line WorldScenePassExecutor.cs diff is a CRLF→LF normalization around two deleted BindTerrainClip() calls, and Vulkan legality rests on VulkanFrameBindings seeding every declared uniform binding with the dummy range). LEAD SELF-GATE of round 2 (Release at 2e3ae95ff, logs/selfgate-20260903-153812-s3-chunk4-r2-validation under the chunk-4 worktree, Khronos validation layer forced through the loader): 00-login / 01-cathedral-stairs / 02-facility-stairs / 03-holtburg-house / 04-holtburg-terrain-leak all PASS provisional — vs the chunk-3 r2 baseline the cathedral, facility and house frames differ only at actors and the player (4.4 / 1.7 / 4.5 %), the hill frame differs 80 % from a five-hour daylight shift with the terrain-punch fragments still gone and no sky through interior walls at the house pose; validation: ONE error (VUID-VkShaderModuleCreateInfo-pCode-08740, five fragment shaders declare DemoteToHelperInvocation without the feature — pre-existing, the SPIR-V set is identical on the tip; filed #459) and ten pre-existing 'vertex attribute at location 1 not consumed' perf warnings; nothing from round 2. A SAME-TIME tip baseline (logs/selfgate-20260903-154036-tip-validation-baseline, two minutes later, same validation set: 2 errors / 10 perf warnings) tightens the diff to 1.2 / 3.3 / 1.3 / 15 % with the hill's 15 % confined to the drifting sky band and the player — terrain, trees and houses identical. Three-lens re-review: FIVE attempts (Opus, then the session model, parallel then sequential) killed by API overload (529) at zero tokens over ~90 minutes. LEAD VERIFICATION instead (recorded here so the owner can audit it): L1 pin read + M1 re-performed by hand (fails Expected: typeof(WalkFrameDriver) / Actual: typeof(ClipFrameAssembly), passes restored); L4 one AppendOutsideSlice helper called from both Assemble and ReassembleOutsideViewFromWalk, the pin drives BeginWalkFrame + ReassembleOutsideViewFromWalk; L2 zero BeginScissor/EndScissor/NdcScissorRect hits, the pass encoder sets the full scissor at pass begin (VulkanGpuPassEncoder.cs:87) and nothing narrows it; L3 VulkanFrameBindings seeds every declared uniform binding with the dummy range (VulkanFrameBindings.cs:128-130), binding 2 now bound by the portal-depth clip only, the 34 shader tests (descriptor contract / manifest / SPIR-V validator / sky layout) pass; L5/L6/L7 comments truthful (sky.vert:88-99, both terrain shaders, Issue130DoorwayStripTests cut to the plane half the punch fans consume); L8 pin present; lanes reproduced (hermetic 6,827/6,827; InstalledDat 244/1/4 known); the TerrainClipMode enum stays for WorldSceneRenderer's flat-path flag (documented). CHUNK 4 LANDED on the campaign branch as ff607a1e0 (round 1) + 7df0b94c9 (round 2); the three independent lenses run POST-HOC as soon as subagent capacity returns and BEFORE the S3 review is dispatched — a blocking post-hoc finding becomes an S3-review item, not a third chunk round. POST-HOC LENSES RAN 2026-09-03 16:59–17:16 (after six overload kills): ALL THREE PASS on 2e3ae95ff — production-path safety, retail faithfulness + pin non-vacuity, build/test truth (the third lens re-performed M1 by hand and re-ran every lane). Findings are documentation/dead-state hygiene, itemized in the S3 packet §10.6: AD-17's scissor text (already rewritten on the branch at 5b43d8d55; its particle clause corrected — the walk feeds parts and particles the whole-mesh slot), the #130 harness header claiming two zero-caller stages, ClipPlaneSet's scissor-era members/docs, dead terrain-clip parameters on TerrainModernRenderer.Draw and PrepareClipFrame, several stale sentences, and a pin limit (the L1 condition pin accepts a conjoined gate). Dispatched as the landing-hygiene chunk H (one Sonnet agent in s3-hygiene at 6435655d7, one lens, no third round). CHUNK H LANDED as 99d9c6d56 (cherry-pick of faf964155): ClipPlaneSet loses ScissorNdcAabb, UseScissorFallback → IsPlaneOverflow; TerrainModernRenderer.Draw/CollectVisibleCells frustum-only, PrepareClipFrame() parameterless; TerrainClipMode.Scissor deleted; the #130 harness deleted (its two driven paths have zero production callers; ClipPlaneSet.From stays pinned through the K6 producers); the H5 pin rejects a conjoined weather gate (mutation text inline). Lens: FAIL on ONE blocking item — the EnableClipDistances doc sentence §10.6 itself prescribed ('only portal_depth.vert writes gl_ClipDistance') is false (five mesh/particle shaders still write it from the per-cell region table; dormant in the walk, live in the flat path) — plus one stale AppendSlot doc. Both are the lead's own wording errors, corrected by the lead in d0c981212 (no third round needed: no code changed). Lanes at the tip: hermetic 6,825/6,825; InstalledDat 243/1/4 known (one fewer test after H3). S3 REVIEW (two Opus lenses, 51d532320..e6f5a156b, 2026-09-03 18:27–18:45): BOTH FAIL. Retail lens BLOCKING: the punch fan indexes OutsideViewSlices by the walk's ActiveViewIndex, but ReassembleOutsideViewFromWalk appends nothing for a collapsed view polygon, so the slice array can be shorter than the view list — a fan can take the NEXT view's planes or (: default) draw UNCLIPPED (retail clips each fan under its own pinned building_view); major: the exit-seal equivalence pin drives ClipFrame.AppendSlot(ClipPlaneSet), which has zero production callers (production = WalkFrameDriver.AppendClipSlot); minor: the false 'KEEP clips bracket their draws with Enable/DisableClipDistances' comment; notes: EC printed per cell where retail's breakpoint fires per (cell × view); the conformance Recorder drops the weather OC on both sides; the weather gate reads the player cell while the print carries the viewer cell (open question). Shader/perf lens BLOCKING on EVIDENCE: the chunk-3 perf gate was recorded PASS on the turn phase only — the same two report files' stationary phase has Aerlinthe 4.00→5.80 ms GPU p50 (1.45×, +1.8 ms; p95 4.20→6.00), outside the ≤1.3× gate, and two destinations (Sawato revisit/plateau) were omitted (complete table: Caul 9.8→9.9 / Sawato 0.7→0.8 / Rynthid 1.5→1.9 (1.27×) / Aerlinthe 4.0→5.8 / Sawato revisit 0.7→0.7 / Holtburg 4.3→5.3 (1.23×) / Caul return 9.5→10.1 / Sawato plateau 0.7→0.7 / Caul plateau 9.6→10.7, stationary GPU p50 ms, S2-final → chunk-3 r2); major: WbDrawDispatcher.SetClipRouting has zero callers, so the per-cell clip-region table can NEVER be armed in ANY path — five mesh/particle pipelines write eight always-passing gl_ClipDistances per vertex for nothing (§10.6's 'live for the flat path' was wrong); minors: two order-preserving batch reductions available (skip the terrain flush when the alpha queue is empty; coalesce per-cell runs into fewer indirect commands — the indirect command count rose ~4.5× at terrace-edge) → S5 perf chunk. Chunk 3's status is corrected to STOPPED-LANDED with an open perf item (the lead's PASS was an evidence error: turn phase only). FIX ROUND 1 contract §12 (F1–F5; E1 = the lead re-measures the current tip vs S2-final in the same session) dispatched s3-review-fix1.js in s3-review-fix. E1 RE-MEASURED 2026-09-03 18:50–19:07 (same session, back to back, logs/connected-r6-soak-20260903-185034.report.json = tip a614c8fd4 vs .claude/worktrees/s2-final-ab/logs/connected-r6-soak-20260903-185904.report.json = S2-final 78068b2c; both RESULT=PASS): STATIONARY GPU p50 ms baseline→tip: Caul 5.8→6.0 (1.03×), Sawato 0.4→0.3, Rynthid 0.9→1.0 (1.11×), Aerlinthe 2.1→2.4 (1.14×), Sawato revisit 0.4→0.4, Holtburg 2.5→2.6 (1.04×), Caul return 5.7→5.9 (1.04×), Sawato plateau 0.4→0.4, Caul plateau 5.8→6.4 (1.10×) — every destination inside the §9.7 gate. The morning's Aerlinthe 1.45× does not reproduce (every morning value was ~2× these — the RDP session). TURN phase: the baseline's p50 reads 0.1 ms at Caul, Holtburg and Caul plateau (a turn window catching non-world frames — p95s 10.5/10.8, 3.0/2.8, 8.0/8.1 are within 7 %), so the 23× and 43× 'ratios' there are the soak tool's artifact, filed #463; the remaining turn rows are 0.75–1.25×. Chunk 3 returns to CLOSED on this complete, same-session evidence; the shader lens's two order-preserving reductions stay S5 perf candidates. S3 REVIEW FIX ROUND 1 = 6575cfcee (Sonnet), BOTH LENSES PASS (retail 20:00, production 20:15): F1 one index-aligned slice per walk view (a collapsed polygon = a nothing-visible slice; the punch leaf draws nothing for it and throws on an out-of-range index — never unclipped); F2 the seal pin drives CaptureViews/AppendClipSlot and reads back through InteriorFloodViewClipPlanesAt, plus both >8-vertex overflow cases (seal: four AABB planes; punch: zero planes, unclipped); F3 the false bracket comment gone with the six no-op calls; F4a EC printed once per live view; F4b the Recorder carries the weather OC and the oracle keeps it (the replay context gained the is_player_outside gate so terrace-edge still reproduces); F5 the per-cell clip routing and the five shaders' clipRegions fetch + gl_ClipDistance loops DELETED (recompiled, three retail-oracle hashes re-pinned), the ACDREAM_CLIP_DEBUG probe and a 12-test file pinning the deleted policy gone; six mutation texts inline. Lenses' leftovers, closed by the lead in the landing: AD-23 RETIRED (it described the deleted culling), AD-17 corrected (deleted, not dormant; residue = the vertex-layout slot inputs fed 0 and the CPU-side ClipRegions byte-pack/publish with no GPU reader → S5 cleanup inventory), the ProbeClipRouteEnabled doc, the per-view EC loop guarded at its call site, and the conformance harness's known limit (replay derives one EC per cell; no fixture holds a two-view flood cell → S5). One admission reading in the retail direction: the ownerless-outdoor-emitter gate now tracks outside_view.view_count > 0 like retail rather than the surviving-polygon count. LANDED as 89c4494d0 + closeout ea76a3803. S3 CLOSED (chunks 2/3/4 closed, chunk 1 stopped-landed with #458 resolved as precision, hygiene H, review round 1); the lead's validation self-gate at the closeout tip follows in this row. S3-CLOSED VALIDATION SELF-GATE (Release at 6385f4411 = code ea76a3803, logs/selfgate-20260903-201825-s3-closed-validation, Khronos validation layer on): ZERO validation errors (only the ten pre-existing unconsumed-attribute perf warnings of #459's note); graceful logout; vs the same-day tip baseline (selfgate-20260903-154036, five hours earlier): 01-cathedral-stairs 1.3 %, 02-facility-stairs 3.3 %, 03-holtburg-house 0.3 %, 04-holtburg-terrain-leak 18.4 % — the hill's difference is the sky band and the tree line against it after five hours of daylight plus the player (terrain, houses and hills black in the diff), the other three are actors and the player only. All four PASS provisional; the five mesh/particle shaders that lost their clip loops draw pixel-identically where the daylight allows the comparison. OWNER DOUBLE-CHECK 2026-09-03 night (interactive client at ea76a3803, launched for the owner): every pose PASS except the cathedral: at 0xF4180113 [39.502899 19.589222 181.119247] (and within a metre) the camera zoomed fully out and tilted up shows the vaulted hall, an archway with sky, a balcony and floating stair slabs through the stairwell walls; retail at the same pose keeps the eye under the stairwell ceiling with solid walls (owner's retail screenshot). Classified as the camera-versus-cell rule, NOT depth/alpha: the eye leaves the cell where retail's swept viewer sphere stops it, and the frame roots from outside. Filed #464, matrix row added (§10), read-only investigation dispatched against SmartBox::update_viewer @0x00453ce0 / CTransition::find_valid_position; it blocks G3 (zoom is a named pass criterion) and is scheduled ahead of S4 chunk 2. The S3-state G3 pre-run's cathedral rows are therefore PROVISIONAL-FAIL for the zoomed camera and PASS for the standing camera. The owner also reports problems when merely RUNNING down those stairs (symptom not yet described). Lead reproduction attempt 2026-09-03 21:14 (logs/selfgate-20260903-211420-464-stairs, code ea76a3803): a nine-step teleport ladder down the exact stair line (top F4180113 [39.50 19.59 181.12] → bottom F4180112 [39.07 22.55 178.78], facing +y, chase camera at rest) plus the G2 stairs pose — every standing frame is structurally consistent step to step (stairwell walls, the left ledge over the lower pit, the hall's arch and sky beyond), no popping walls, no floating slabs, no wall-textured triangles; the standing frames do not reproduce the running symptom, so it is motion-bound (the camera in motion, or a membership flip between frames) and needs either the owner's description/mid-run screenshot or a retail walk capture at the top pose. Side observation: the 'In Portal Space - Please Wait…' caption is still drawn 4.5 s after world-visible in every ladder frame (the G3 frames with a 6 s settle never show it) — the caption's post-arrival lifetime vs retail's is unverified; noted, not filed. Running reproduction 2026-09-03 21:19 (logs/selfgate-20260903-211930-464-run, code 590fbb66c, route route-464-run.txt; frames 0.77 s apart because the screenshot readback costs about 0.6 s): from the mid pose, the first frame after MovementForward is pressed (464-run-22.png) has the chase camera several metres above and outside the stairwell — exterior slab across the lower half, balcony wall and vaulted hall beyond, the character's head above the slab — and the next frame is clean again, so the owner's running symptom IS #464 (a transient of the same camera-outside-cell defect), which makes the camera fix the G3 blocker ahead of S4-c2; the same runs also exposed #467 (the character runs in place at the corridor mouth beyond the arches, both runs, 5+ s), a movement/collision issue outside the campaign. Four camera-cell PROBE rounds (ACDREAM_PROBE_FLAP=1; run/zoom/tilt/mid routes, 21:28–21:37) then showed the eye never leaves its cell (ok=True, eyeInRoot=Y, res=None in every frame): 0x113/0x114 are one stairwell split horizontally at z 181.89, the zoomed-out eye is pinned by the sweep 0.31 m in front of 0x114's nine-vertex EXIT portal (poly 29, plane y=16.14) — so #464 is re-read as the exit-portal seam-band family (S4 depth/alpha), not a camera-leaves-cell defect; the keyboard camera never reproduced the owner's hall view, and the owner is asked to reproduce it once with the probe on (launch line in #464). The #464 fix contract therefore waits for the investigation report AND that capture; S4-c1's landing is not blocked by it. The investigation REPORTED 21:47 (docs/research/2026-09-01-overhaul/464-camera-investigation.md): eleven sweep/root differences, each unreachable or more constrained than retail; the real-DAT replay agrees with the probe (pivot in 0x114, boom stopped on the east pier at y=16.448, walk from 0x114 floods 114/113/112 with seven exit views) — #464 reclassified as an interior-root/outside-root DRAW defect (S4), the §10 row's invariant re-worded. Then REPRODUCED at 21:51 (logs/selfgate-20260903-215041-464-arch, 464-arch-05-yawright500-out.png): the camera swung to the FRONT and zoomed out passes the open y=24 face into the hall 0xF4180109 (11.03 m, no contact — a legitimate retail eye), and the stairwell cells seen back through the building's exterior portals draw as floating slabs with no walls (0x112 visited, not root-flooded). The one retail capture to ask for: the oh-capture walk + alphadepth templates at exactly this eye. OWNER 21:55: that front-view frame EXISTS IN RETAIL TOO — a retail axiom, not a defect (no capture needed for it); the real artifact is seen "looking towards the arcs on the other side", pose to be pinned with the owner. PINNED 22:04 (owner client with both probes, lead-launched): /loc 0xF4180113 [39.502899 19.832422 180.976700] 1 0 0 0, default distance tilted slightly up, eye (39.89,17.25,182.36), root 0xF4180114, sweep uncontacted — an ordinary camera state; the owner's screenshot shows the hall's interior (cut-off columns, vault, an unsealed pink quad) above and around the bottom arch where retail shows the stairwell's solid far face, which in the DAT is 0x114's three exit portals + 0x113's two (plane y=24). FINAL classification: S4 depth/alpha — the exit-view punch/seal order at the open face (seven exit views from root 0x114); the one retail capture requested = cathedral-stair-arch (oh walk + alphadepth templates at exactly this pose). Lead transcript at the pose 22:07 (logs/selfgate-20260903-220639-464-owner; the automation cannot tilt the camera, default eye): interior DC pv=0 ov=6 n=3: 114 113 112, then the outside pass draws fifteen building-portal groups including the hall cells 0x106–0x110 — the hall IS admitted through the building's exterior portals in the outside pass; the tilted frame's difference is depth (S4 punches/seals/Z clear) or an admission retail refuses from this eye, which only the capture settles. Plan: land S4-c1 + S4-c2, add cathedral-stair-arch as the fifth transcript pose, re-gate. Owner's TILTED frame with the transcript 22:17 (docs/research/2026-09-01-overhaul/464-owner-tilted-frame.walk.txt): same admission set as the default frame plus a seventh exit view; the hall cells 0x106–0x110 draw in the outside pass under building f418000a, the interior repaint 112 113 114 last — so the artifact is what the open face SHOWS (hall interior) versus retail (the hall's exterior shell wall): the shell-versus-interior-cell order/clip at that face, S4, with a possible building-portal admission component that only the capture settles. CAPTURED cathedral-stair-arch 23:0x (4f12cd06b, walk + alphadepth, 5 frames each, retail screenshot = solid far face): retail's walk admits EXACTLY our cells and building-portal groups in the same order (admission ELIMINATED); retail's alpha-depth frame = PC ov=7 counter=8, sixteen PM mode=1 far-depth punches each immediately before its building group's PC ov=0, then eight PM mode=0 seals (counterBefore 0..7), FL 1029/11/1/1, 249 AM all clip=0. The divergence is therefore in the punch/seal machinery (AD-17's unclipped punch-fan fallback, the order against the cells, or the shell depth) — S4-c1's PM/PC gate gets this capture as its FIFTH pose and names it line by line; the fix contract follows. Lead 22:29–22:55: the gate replayed at the pose PASSES (events exact), retail's punch vertices are identical to ours (12/16 rejected by the ±12 rule on both sides), nothing authored stands above the arch (the arch is 0x109's far wall at y=38, fourteen metres beyond the open face); a mouselook automation verb (ddae5704d, Sonnet) makes the tilt scriptable, and the SCRIPTED frames reproduce it: eye 182.61 = artifact with SEVEN outside views, eye 182.32 = clean with FIVE — the admission set is retail's (retail has seven and draws clean), so the divergence is what the two extra views' content does on screen: AD-17's unclipped punch-fan fallback for a >8-edge view is the prime suspect; the per-view overflow dump is running. Overnight A/B (scratch worktree 464-ab, env-gated skips, ten runs): no clip overflow at any eye; skipping ALL delayed alpha, the interior depth clear, cell f3180105, the far-block shells, f4180104, the stairwell tower shell, cell 0x109 or EVERY hall cell leaves the hanging pieces; skipping the HALL BUILDING'S SHELL (BLD f418000a, model 0x01001FB3) removes them and the frame matches retail — the pieces are that shell's geometry showing where the corridor's vault should hide it. Degrade level (retail get_degrade rule quoted in #464) gives level 0 at this distance in both clients; both paths share the view-projection and the Less/write depth state. Not yet proven: that retail hides them at the SAME eye (the capture and the owner's screenshot are at other eyes). Morning asks in #464: RenderDoc on the scripted frame, or the owner tilting through the band in retail. #464 therefore does NOT block S4-c1's landing; it is a candidate S4/S5 item once attributed. Open S5 items from S3: the weather gate/print cell question (one retail capture), the replay-side per-view EC, the ClipRegions residue, the two perf reductions, #460–#463. Register: AD-17 rewritten and AP-117 narrowed in the landing docs commit (the scissor fallback they described no longer exists). G3 SELF-GATE part A (lead, 2026-09-03 16:20, Release at 5b43d8d55 = code 7df0b94c9, logs/selfgate-20260903-162027-g3/artifacts/screenshots/, Khronos validation layer on — same two pre-existing #459 errors, nothing new): 00-login PASS; 01-cathedral-stairs PASS (retail's own exterior slab reproduced, nothing extra); 02-facility-stairs PASS; 03-holtburg-house PASS (no sky through walls); 04-holtburg-terrain-leak PASS (no house fragments through the hill); 05-cathedral-south-0106 PASS and 06-cathedral-south-0104 PASS (player and walls whole, no depth inversion at the transition); 07-cathedral-stairs-0107 PASS and 08-cathedral-stairs-0112 PASS (every slab stable, no wall-textured triangles); 09-cathedral-terrace-edge PASS (the #456 pose: terrace, arches and the lit lantern whole, no panel loss); 10-facility-015E PASS and 11-facility-015F PASS (stairs, pillars and the drudge stable). 12-nanto-falls INCOMPLETE: the reveal for 0xE43D001E outran the route's 90 s wait (probe timeout at client.log:709, readiness at :714, world-visible at :718), the probe aborted before its close-client, and the client then ignored two external close requests (filed #460); re-run as part C with a 300 s wait. NOT COVERED by the self-gate (owner items): the cathedral wall actor (two clients), the exterior ramp (no coordinates in the matrix), Tusker Island, the Holtburg town route beyond poses 03/04, and the two ordinary dungeons (unnamed). All verdicts PROVISIONAL until the owner looks. G3 SELF-GATE part B (lead, 2026-09-03 16:56, the four retail capture poses as PLAYER poses — each walk log's frame-2 P line is the camera eye, so the player lands on the floor below it with the camera's yaw; logs/selfgate-20260903-165634-g3b/artifacts/screenshots/, validation on, same #459 error only, graceful logout confirmed): 13-capture-terrace-edge PASS (cathedral exterior wall and grass whole); 14-capture-cathedral-arrival PASS (lit lantern, walls whole, retail's own exterior slab at the lower left — the axiom, nothing extra); 15-capture-holtburg-doorway PASS (the player lands outside the house: house, door, NPC, hills and water whole); 16-capture-foundry-deep PASS (walls and the portal glow whole). PROVISIONAL. G3 SELF-GATE part C (lead, 2026-09-03 17:04, Nanto with a 300 s readiness wait, three headings; logs/selfgate-20260903-170456-g3c/artifacts/screenshots/, validation on, same #459 error only, graceful logout confirmed): 12-nanto-falls PASS (hut, torches and the falls' spray at the left edge whole); 12b-nanto-falls-east PASS (the falls visible behind the pier, torches and rocks — the houses occlude, the falls persist); 12c-nanto-falls-west PASS (pagoda, trees and hills whole). The matrix invariant is sampled at three static headings, not a continuous rotation — the owner's spin is still the real test. Part C's FIRST attempt (selfgate-20260903-165745-g3c) never left portal space: the Login reveal into the foundry stalled ready=True materialized=False for 180 s (#462, intermittent — the next two logins into the same cell materialized), the aborted script requested a graceful logout, and a late local-player motion update then crashed the client on the retired movement controller (#461, exit 0xE0434352). G3 self-gate summary: 20 of 20 captured frames PASS provisional (poses 00–16 plus the two extra Nanto headings); three matrix rows remain owner-only (wall actor, exterior ramp, Tusker) and the ordinary-dungeon row is unnamed; three lifecycle defects filed from the run (#460, #461, #462) and one validation defect (#459). #459 FIXED the same evening (e33fd2472, lead — a one-feature enable in the existing Vulkan 1.3 chain plus the required-feature gate): the four-pose validation launch at that commit (logs/selfgate-20260903-171009-fix459-validation, logs/vk-validation-459.log) reports ZERO validation errors; ten pre-existing unconsumed-vertex-attribute perf warnings remain (noted in #459). The validation layer is now a clean signal for every later gate. S4 packet DRAFT written (s4-depth-alpha-packet.md): S3 chunk 2 already delivered S4's chunk-1 latch/gate/seal scope; S4's body is the two-list alpha cutover. #458 RESOLVED 2026-09-03 (37e42aafc, register AD-118): two live cdb captures at the Holtburg doorway (oh-capture-blockset / oh-capture-blockcheck templates) show retail tests a9c9 twice a frame and that acdream's replay at the same P pose reproduces the interval sentinels, the four edge planes and both verdicts — the fixture's extra LC:a9c9 is a 0.5 % edge-plane precision boundary (one far block, one corner, one plane; retail's clip heights 300.4/310.2 m vs ours 298.8/308.5 m), not a walk defect; the KnownFailure row stays as the standing example; the tip with chunk 4 cherry-picked (62c2231d, docs 386b1327) is green: hermetic 6,829/6,829, InstalledDat 244/1 skip/4 known, zero PROBE_CATHEDRAL rows. Prior: CHUNK 4 DISPATCHED (worktree s3-chunk4-impl at 38cedde0, §10 + chunk 1's carried O1–O4 on the weather path); then the S3 review round (§5; script ready) and the G3 self-gate over the §10 matrix + the four capture poses + a rainy interior pose. CHUNK 1 IMPLEMENTED 079483bb6 (worktree s3-chunk1-impl: the print-only ACDREAM_DUMP_WALK_TRANSCRIPT emitter, EC/OC parsing + parts/alpha-depth readers, the five OH captures as fixtures, the four kit poses in the still-frame conformance harness — the foundry-deep row exposed that its exit chain reaches 12 real buildings the FW0 stub landscape never had, fixed with the full DAT-built world; hermetic 6,814/6,814; InstalledDat 245/1 skip/3 known); its three-lens review FAILED on real findings → FIX ROUND 1 in progress (§11.5 G1–G10): a vacuous flag-off pin (one frame + a parser that drops the open frame), LC/SC LOD-id arithmetic outside the flag, no flag-on LC/SC/BLD round trip, and — the transcript gate's first two real catches — SC printed AFTER BLD (retail's DrawSortCell entry precedes DrawBuilding, which it calls) and the trailing outdoor OC <viewer cell> that is retail's weather pass (GameSky::Draw 0x00506ff0 → DrawObjCellForDummies(after_sky_cell) 0x005070da); every new pin now carries a mutation check. ROUND 1 LANDED (02a82881 chunk + be81475c round 1; four mutation checks documented) — MILESTONE: at the eight-kind level (LS/LC/SC/BLD/DI/DC/EC/OC) the walk reproduces retail's transcript EXACTLY for three of the four kit poses (terrace-edge, cathedral-arrival, foundry-deep); the fourth, holtburg-doorway-still frame 2, diverges at token 165: acdream admits land block a9c9 (LC/SC a9c90001) that retail does not draw at that position — a WalkLandscape.CheckBlocks block-visibility question at a LOD-ring boundary, filed as #458 and tagged Status=KnownFailure on its conformance row (the InstalledDat lane therefore shows FOUR known failures until #458 is resolved; it is an OPEN S3 item for the review round, not a chunk-1 defect). The re-review (three lenses) FAILED on: the weather OC printed per outside-view SLICE inside DrawLandscapeSliceLate (2–4 lines for an interior root with the player outside; retail prints one) with the viewer cell instead of the after-sky land cell and NO pin/mutation check; G9's second comment site untouched; the oracle side's EC/OC derived from DC lists (non-discriminating — retail's literal EC/OC lines must be compared); the unconditional OnSortCellTurn validation ahead of the flag read; the launch-options volume figure (measured ≈1,200–1,400 lines/outdoor frame). → FIX ROUND 2 (§11.6) LANDED 88c70072 (fixer ea4da8c7): H2–H6 closed with two documented mutation checks (the literal EC/OC comparison now fails on a reversed derivation at cathedral-arrival token 1241); H1's production change is retail-faithful and STAYS (the weather mesh is drawn ONCE, unclipped, after the landscape — GameSky::Draw(sky,1) 0x00506ff0 / 0x005070da — instead of N scissored per-doorway draws; the ledger notes it here because no capture/visual gate has looked at rain since; the G3 self-gate adds a rainy interior pose). The re-review (three lenses) still FAILS H1's PIN: the IL-offset order check cannot fail when DrawWeatherOnce is moved back inside the slice loop (the reviewers reproduced the round-1 regression with the suite green), nothing pins the OC's cell argument (ViewerCellId vs PlayerCellId), and for an INTERIOR root the weather OC prints at the frame's end (the Replay-time LandscapeFlush leaf) where retail prints it between the landscape and the flood — plus a dead EnableClipDistances in DrawLandscapeSliceLate. CHUNK 1 STOPS HERE per plan rule §5 (two fix rounds used) and is written up, not forced: the emitter, the parser/readers, the fixtures, the offline diff and the three exactly-reproducing poses are LANDED and useful; OPEN ITEMS carried: O1 a real once-per-frame pin for the weather OC (observe the printed lines through the executor's post-loop call, not IL offsets); O2 pin the OC cell argument = the P cell; O3 interior-root OC position (print it at the Collect-time landscape turn's end, i.e. where LandscapeFlush is emitted, so the transcript order matches retail's GameSky::Draw(1) slot; the DRAW itself stays at Replay); O4 the dead EnableClipDistances; O5 #458 (see the degrade note below). O3/O4 fall naturally to chunk 4 (it deletes the per-slice loop and gives the weather draw its single home); O1/O2 are for chunk 4's review or the S3 review round. NOTE on #458 (transcript lens): the FW0 doorway row pins DegradeMultiplier = 0f because that capture ran under cdb load with Render::deg_mul depressed; the OH doorway capture ALSO ran under cdb (this session) — the extra a9c9 block may be a degrade-level difference rather than CheckBlocks; #458 amended. Lanes at 88c70072: hermetic 6,823/6,823; InstalledDat 244/1 skip/4 known (2× #383, TowerAscent, #458). CHUNK 3 LANDED 2026-09-03 (4ee2866a implementer + 651badc2 fix round 1 + e10765aa review follow-ups). SELF-GATE logs/selfgate-20260903-100043-s3-chunk3 at e10765aa: the Holtburg terrain-punch fragments are GONE at the owner's pose (04-holtburg-terrain-leak.png, clean hill) with NO depth-function change — the §9 R4 order-only hypothesis holds; cathedral / Facility / house structurally unchanged (diffs 10.5% / 0.9% / 7.0% vs the chunk-2 run = dawn-vs-night lighting + actors; the cathedral's upper opening shows sky in both runs; Facility wall-panel mean (79,20,25)); zero exceptions. Re-review after fix round 1: three Opus lenses PASS (remaining minor/notes fixed in e10765aa: enum doc, alpha-mark comment, pending-batch clears, try/finally around the terrain-frame completion, particle doc order, the outdoor pin now observes a cell turn). Gates at e10765aa: App hermetic 6,795/6,795; focused 335/1 skip; InstalledDat 241/1 skip/3 known; Core Vfx 109/109. PERF GATE FAILED at e10765aa (soak logs/connected-r6-soak-20260903-100400 vs the S2-final …-010403, same runner, both Uncapped=false): CPU p50 31.2 ms flat at every outdoor destination (baseline 2.0–15.5), FPS 32 (baseline 51–452), GPU p50 2–4× — ~500 terrain submissions/frame because a StreamMark after nearly every land cell (scenery statics) splits the batch. FIX ROUND 2 (§9.7, the last allowed): an opaque ordered-stream flush is not a terrain flush point (opaque-vs-opaque is depth-resolved; only punches, alpha drains, clear/seals, sky, shells and emitting particle turns split), with a punch-order pin and the soak re-run as the gate. ROUND 2 LANDED (896c63fe fixer + 74ac7aa2 lead follow-up): the StreamMark arm no longer flushes the terrain batch (pipeline-state citation: the ordered stream is opaque-only, GpuBlendMode.None, depth test+write — WalkStaticStreamPopulator.cs:179, WbDrawDispatcher.OrderedStream.cs:569-571, WbDrawDispatcher.Rhi.cs:240/245/343); three lenses: driver PASS, order and build FAIL on ONE finding — the re-expressed StreamMark pin was vacuous (an empty landscape view admitted no statics, so no StreamMark fired) — fixed by the lead in 74ac7aa2 (real full-viewport view + trace: two FLUSH lines precede the merged three-cell batch); hermetic 6,796/6,796 at 74ac7aa2. GATE PASSED 2026-09-03: (a) four-pose self-gate logs/selfgate-20260903-104516-s3-chunk3-r2 at 74ac7aa2 — the Holtburg fragments still gone in full daylight, cathedral/Facility/house 2.3% / 1.3% / 1.9% px vs the chunk-3 run (actors + weather), wall-panel mean (79,20,25), zero exceptions; (b) PERF: the first two soaks (…-100400 at e10765aa, …-104718 at 674fa8e8) read a flat CPU p50 31.2 ms / 32 FPS at EVERY destination — an ENVIRONMENT signature, not a workload one: the S2 baseline soak (…-010403) ran at 01:04 on the console (only the AMD adapters listed) while today's ran under the owner's RDP session (query session → rdp-tcp#0 Active; VideoControllers gained a Microsoft Remote Display Adapter), whose presentation cadence caps every frame at ~31 ms. Honest A/B: the S2-final binary (78068b2c, worktree .claude/worktrees/s2-final-ab, kept for future same-session baselines) soaked under the SAME RDP session (s2-final-ab/logs/connected-r6-soak-20260903-105827) reads the identical 31.2 ms / 32 FPS everywhere; GPU p50 S2-final vs chunk-3 round 2: Caul 10.6→7.7, Sawato 0.6→0.6, Rynthid 1.7→2.0, Aerlinthe 2.4→3.1, Holtburg 3.8→4.4, Caul return 9.8→12.0, Caul plateau 9.5→8.6 — every destination within the §9.7 gate (≤1.3× +0.5 ms); round 2's batching cut Caul's GPU from round 1's 12.9 to 7.7. CHUNK 3 CLOSED (implementer 4ee2866a, fix round 1 651badc2+e10765aa, fix round 2 896c63fe+74ac7aa2; two fix rounds used, the plan's maximum). Lesson filed: feedback_soak_numbers_need_same_session_type. History — chunk 3 fix round 1 (worktree s3-chunk3-impl: implementer commit 671eb3ad; the three-lens review found three BLOCKING defects — terrain slot map keyed 0xXXYYFFFF vs the walk's 0xXXYY0000 (no terrain drawn at all), adjacent-same-landblock batching that can never merge because retail's own sort turn interposes a particle event after every land cell (~530 terrain submissions/frame), and the timing diagnostic moved inside the per-batch loop — plus the deleted TERRAIN:0 pins, an inverted mechanism comment, a vacuous T2 assertion and a stale oh1 row; all lead-verified real; §9.6 is the fix contract: normalized slot key, ONE pending terrain batch across landblocks flushed only before a submitting leaf with empty particle turns kept open (order-identical by construction), one timing sample per frame, LandCell driver pins). Round 1 of the two the plan allows. After it: chunk 1 (§11), chunk 4 (§10), the S3 review round (§5)
S4 Depth + alpha	PLANNED — the Holtburg terrain-punch finding carried from G2 may close in S3 chunk 3 by draw ORDER alone (retail draws every nearer land cell's terrain AFTER a farther building's far-Z punch; acdream draws all terrain first — s3-walk-ownership-map.md §9 R4); S4 re-reads its "exact z-func" question only if the Holtburg self-gate still shows the fragments after chunk 3	depth/alpha contracts + captures	—	—	—	G3	retires AP-34
S5 Consumers + closeout	PLANNED	landscape contract; AP-232	—	—	—	G4	retires AP-117/AP-232; deletes probes

Rollback ledger

Slice	Commits	Last accepted gate	Revert
FW closeout	b8befded, 4808d4d1, 4683ac6f, e8808602	FW/Tusker gates	historical anchors only
v1 OH0	b3b7d922	n/a	git revert b3b7d922 removes the investigation candidates including the Facility stair fix; not a visual claim
S1	acf17246, b681717c, 0840d5fb, e2543d0e, 8c6563ca (+ pin test)	G1 PASS 2026-09-02	revert newest-first; then restore acdream.recipe7.pak over acdream.pak in the dev DAT dir (the recipe-8 consumer rejects a recipe-7 pak, and vice versa)
S2	059b8883, 5a2792d6, 707d2803, afbd2410, 75ea269d, c94a1a40, f6b4584b	G2 PASSED 2026-09-03 (owner-confirmed after the chunk-6 haze fix; terrain punch carried to S4)	revert newest-first c94a1a40 → 059b8883; the registry's retail product and the walk's borrowed views go together — do not revert a middle chunk alone
S3	chunk 2: be9b4c1f, 2f5373c7, 434a7df2; chunk 3: 4ee2866a, 651badc2, e10765aa, 896c63fe, 74ac7aa2; chunk 1: 02a82881, be81475c, 88c70072	G3	chunk 3: revert newest-first 74ac7aa2 → 4ee2866a as one unit (the per-cell terrain, the slot key, the deferred batching and the per-frame diagnostic go together); chunk 2: revert newest-first 434a7df2 → be9b4c1f (the counter, the leaf split and the flag deletion go together)
S4	—	G3	OPEN 2026-09-03 night. Packet docs/research/2026-09-01-overhaul/s4-depth-alpha-packet.md: §1 records that S3 chunk 2 already delivered S4's chunk-1 latch/gate/seal scope (the latch owner, the gated flush→stamp→clear→seal block, the counted seals); what remains of chunk 1 is small and dispatched as S4-c1 (s4-c1.js, worktree s4-c1-impl at 6385f4411, contract = packet §6): C0 the far-punch constant — portal_depth.vert carries 0.99999988 = bits 0x3F7FFFFE, retail's is 0x3F7FFFEF (15 ULPs nearer; the depth spec's "wrong constant" row was right; lead bit check 2026-09-03) → retail's exact bits + a source pin; C1 the ±12 local-input reject at both portal-polygon producers (Ghidra table row 0x59BCD6–0x59BD28); C2 the portal-depth color-state register row (ColorWrite off vs retail's zero-alpha blend, identical output); C3 the depth truth-table Theory, the cross-frame latch test, look-ins isolated from the root latch. Chunk 2 = the two-FIFO alpha-list cutover (packet §3); chunk 3 = deletions (packet §4). G3 is S4's owner gate; the lead's S3-state G3 pre-run (20/20 frames, in the S3 row) is the baseline to diff against.
S4-c2 stop	STOPPED UNLANDED 2026-09-04 — lead final-round contract ac74fbd84; evidence commit c4cbc1d0d in s4-c2-impl on cc8e5677a/048d5b12f; campaign renderer remains S4-c1 766f9e749	G3/G4 UNPASSED	Both sequential final lenses FAIL, so the required repair is the forbidden THIRD round. EnvCell transparent/ClipMap batches still draw in the opaque pass before FIFO submission and then redraw; CLIP/detail-immediate replay binds StraightAlpha with depth-write off rather than retail clip-test/depth-writing state; tests omit the preceding opaque call and pipeline descriptors. Source-owned EnvCell lists are unbounded under queue rejection, the claimed scan/filter/RHI 0-B evidence bypasses those paths, and AP-238/AP-240/result truth is false. Full file:line and gate record: S4 packet §13. No chunk cherry-pick, graphical gate, or soak. Resume only on explicit owner process change.
S4-c2 owner repair	STOPPED UNLANDED 2026-09-04 — owner-authorized implementation a094bf2b7 is clean in s4-c2-impl; packet §15 is the review record	G3/G4 UNPASSED	The repaired renderer behavior passed the retail lens: exact whole-leaf pass membership, 0x08/0x09 CLIP, row-3 override, blend/reference/depth state, sentinel separation, detail state, rollback, allocation, AP-238/AP-240. The lens still returned FAIL: commit body omitted the required per-mutation first failures, packet mutation 5 names the wrong first assertion/address, and four source/test comments are stale. Sequential production lens therefore did not run. Correcting those items is a post-review fourth repair, which §14 does not authorize. Nothing landed or graphically gated; resume only by explicit owner process decision.
S4-c2 attempts 1–5	ATTEMPT 1/5 CONSUMED; ATTEMPT 2/5 PASSED AND LANDED 2026-09-04 — reviewed implementation daaeab0ba; campaign stack 89f1e2676 → 9ccb61a8e → 0aa166aa0 → 252886e84; packet §17	G3/G4 UNPASSED	Sequential retail/evidence then production/gate-honesty PASS. Fresh: Release 0W/0E; shader 32/32; affected 37/37; real allocation 2/2 at 0 B; production 239/239. Official no-retry hermetic 16,734/1: sole unchanged global Console.Out capture race, exact theory 2/2 isolated. InstalledDat 255/10 documented/1. Validation routes selfgate-20260904-115818-s4c2-landed-route and selfgate-20260904-120025-s4c2-landed-g3b PASS provisional. First soak failed on known #461/#462; retry and S4-c1 control both 9/9 graceful; stationary averages CPU p95 −0.01 ms, GPU p95 +0.16 ms, alloc p50 +1.2 KiB, update p95 −0.12 ms. Three attempts remain unused.
S4-c3a	ATTEMPT 3 RETAIL FAIL; §19 FIX ROUND 1 IMPLEMENTED — REVIEW PENDING. Candidate 44e2bc227b used the billboard's rendered/AABB-derived center instead of GfxObj's authored sort center, reserved prepared payload before queue visibility, did not bound the new retained preparation list, and misstated static-record ordering. The §19 repair now keeps authored and visual centers distinct, applies scale/orientation to the authored CYpt point, reserves and exactly rolls back at Append, caps preparation at 3,000 CLIP + 3,000 ALPHA, preserves immediate duplicates, and corrects the comment. Return gates: Release 0W/0E; focused 95/95; register pin 1/1; real allocation 2/2 at 0 B; shader/manifest 32/32; hermetic 16,751/16,751; InstalledDat 385 pass / 10 expected fail / 1 skip with the exact documented set; eight discriminating mutations recorded in packet §19.5.	G3/G4 UNPASSED	Retail re-review F1/paired bytes/F3 and unchanged S4-c2 behavior, then production/gate-honesty review of the full c3a stack with special attention to F2. One bounded fix round remains after §19; a further finding stops the chunk. c3b remains locked.
S5	—	G4	fill

---

14. Risk register (condensed)

• R1 second scene graph. Graph records own only topology/membership facts; mesh/entity state is borrowed. Consumer deletion is inside S2.
• R2 over-porting C++ mechanics. Port observable ordering, ownership, stamps, and transitions into retained arrays; equality by transcript.
• R3 Vulkan reorders. Immutable stream; only adjacent compatible runs merge; tests place merge-compatible draws around alpha/depth boundaries.
• R4 package churn. S1 owns one recipe bump with strict rejection, migration, rollback, corruption tests, launcher coverage.
• R5 oracle incompleteness. The §7 capture is the answer key; a missing fact gets one exact additional capture, never an approximation.
• R6 scene overfitting. Production guards reject scene IDs; installed-DAT sampling and ordinary-dungeon gates are mandatory.
• R7 per-cell command cost. Correctness-first; the 20% rule triggers an explicit optimization slice.
• R8 stale docs. S5 cannot close until architecture text is checked against production call sites.
• R9 evidence sink (new). Rule 2 and rule 15. A slice with no production change after its first chunk is a red flag, not progress.

---

15. v2 rescope record (2026-09-02)

What happened. v1's OH1 ("upgrade the oracle first") ran unsupervised for eighteen hours and produced ~32K lines of uncommitted canonical-JSONL evidence grammar plus 142 tests, three review rounds each finding the grammar encoded wrong retail semantics, and zero production change. The grammar re-encoded PView inside a validator, making it a second port that needed the same retail review; it also validated "strong" evidence that neither the retail captures nor the acdream recorder produced. The one unlocking item, extending the cdb capture templates, was never started.

What v2 keeps. All committed research contracts; the FW0 capture corpus and its proven line-format + parser + replay pattern (which reached 9/10 conformant fixtures in FW1); the b3b7d922 candidates as S1/S2 seeds; the retail facts the T3 reviews established (handoff §5.3).

What v2 parks. The evidence grammar, recorder hooks, importer, manifest command, and their docs, verbatim, on quarantine/oh1-evidence-grammar-2026-09-02.

Stage mapping. OH2 → S1; OH3a–d → S2; OH4 + OH5 → S3; OH6 + OH7 → S4; OH8–OH11 → S5. Owner gates: G1 after S1, G2 after S2, G3 after S4, G4 final.

Process changes. Rules 2 and 15; the §5 working model; the §7 single capture session; evidence products limited to what each slice consumes.

Memory: claude-memory/feedback_evidence_infrastructure_sink.md; claude-memory/project_overhaul_campaign.md is the START HERE.