acdream/docs/plans/2026-07-27-vulkan-campaign.md

Campaign V — OpenGL → Vulkan rendering migration

Status: Active. V0 (pinned RHI contract) landed 2026-07-27. V1 (GL backend implementation, dark) landed 2026-07-27. V2 (shader dialect + texture-index migration on GL, three sub-commits) landed 2026-07-27. Scope: Windows x64 + Linux x64. No macOS. End state: one Vulkan 1.3 backend; the OpenGL backend is deleted.

---

1. Why

acdream's mandatory modern GL path (GL 4.3 core + ARB_bindless_texture + ARB_shader_draw_parameters + MDI + SSBOs, with no fallback) is built on an API that is no longer evolving, and its hardware floor is narrow: bindless textures are absent on Intel integrated GPUs and on every Mesa software / D3D12 stack. That floor is exactly what parked Slice L at its L1 checkpoint — WSLg correctly rejects our renderer because Mesa's D3D12 and llvmpipe drivers do not advertise GL_ARB_bindless_texture.

Vulkan 1.3 makes the same rendering strategy portable: descriptor indexing (the bindless replacement) is a core feature, not a vendor extension, and it works on RADV, NVIDIA, Intel, and lavapipe. Two secondary wins follow: explicit present control (a direct lead on issue #235's capped/RDP cadence alias) and lower CPU cost per frame, because per-frame data can be written straight into mapped memory instead of copied through BufferSubData.

This is a compatibility and efficiency campaign, not a rescue. The GL path works and is fast. Nothing here changes what the game looks like.

---

2. Goal and acceptance

Replace the OpenGL renderer with a single Vulkan 1.3 backend, preserving retail pixels exactly and improving cost.

Dimension	GL baseline	Campaign target	Cutover floor
CPU frame p50	1.869 ms	≤ 1.60 ms	≤ 1.869 ms
GPU frame p50	1.096 ms	≤ 1.00 ms	≤ 1.096 ms
Working set	652 MiB	≤ 600 MiB	≤ 652 MiB
Private set	928 MiB	≤ 860 MiB	≤ 928 MiB
Managed alloc / frame	~0 B	0 B	0 B
CPU/GPU p99	measured at V8	≤ GL p99	≤ GL p99

Pixel acceptance: dotnet AcDream.Cli.dll compare-screenshots expected.png actual.png out.json at channel tolerance 2 and maximum differing fraction 0.001, MSAA off, ACDREAM_DAY_GROUP pinned, at every deterministic checkpoint of the connected lifecycle route.

Out of scope (user decision, 2026-07-27): the ImGui developer stack (AcDream.UI.ImGui, ImGuiBootstrapper, the DevTools menu bar) is not ported, and UI Studio (StudioWindow, PanelFbo) is parked. Both are deleted at V11 and remain recoverable from git. A follow-up issue tracks re-homing the Settings and Debug panels onto the retained UI through a new IPanelRenderer implementation — the panels themselves need no rewrite because they already target only AcDream.UI.Abstractions. Until that lands, keybind remapping falls back to editing keybinds.json.

---

3. Architecture: a Vulkan-shaped RHI, implemented by GL first

3.1 The decision

The renderers port one at a time onto a minimal Vulkan-shaped RHI while GL is still the shipping backend. Each port slice is pixel-gated against its parent commit on the same backend, so a divergence is attributed to one slice rather than discovered at a big-bang integration. Only then does the Vulkan backend implement the same interfaces, gated by a GL-versus-Vulkan differential.

The alternatives were rejected for concrete reasons:

• Per-renderer duplication (WbDrawDispatcherVk beside the GL one) would fork roughly 15,000 lines of CPU logic — bucketing, RetailAlphaQueue ordering, LRU eviction, arena management — that has nothing to do with the graphics API and everything to do with retail fidelity. WbDrawDispatcher is 4,449 + 809 lines but holds only ~62 GL call sites, clustered in the per-frame uploads, the two multi-draw brackets, and teardown. The API surface is small; the fidelity logic is large. Forking the wrong one of those is how subtle regressions enter.
• A serialized command IR adds a third representation and a per-frame translation cost, against the efficiency goal, for generality nothing asked for. The RHI is the prepared-frame-data seam, expressed as typed calls.

GL 4.3 implements every Vulkan-shaped concept cheaply: pipelines become a program bind plus a cached state apply; ring allocations sit on the existing fence-bounded dynamic buffers; a descriptor-table index becomes an indirection through a storage buffer of bindless handles; passes are a no-op bracket. The GL backend is deliberately behaviour-preserving and never improved — it keeps BufferSubData — which is precisely what makes each port slice's pixel gate a strict identity check. The efficiency wins land in the Vulkan backend only.

3.2 Location and isolation

Namespaces inside AcDream.App, not a new project:

• AcDream.App.Rendering.Gpu — the contract (landed at V0)
• AcDream.App.Rendering.Gpu.Gl — GL backend (deleted at V11)
• AcDream.App.Rendering.Gpu.Vk — Vulkan backend

A separate project would force a public surface or InternalsVisibleTo churn for twelve internal renderers, and its only benefit — compile-time proof that renderers cannot reach GL — arrives anyway at V11 when the Silk.NET.OpenGL package reference is dropped. Until then the guarantee comes from an architecture test added at V4h that asserts no type outside Gpu.Gl and a small allowlist references Silk.NET.OpenGL. Deletion at cutover is one directory and one PackageReference.

3.3 The contract (pinned at V0)

src/AcDream.App/Rendering/Gpu/:

Type	Responsibility
IGpuDevice	Resource creation, the global texture table, frame lifecycle, the deferred device-action queue (replaces QueueGLAction), backbuffer capture, retirement queue.
IGpuFrame	One frame: ring allocations, BeginPass, submit/present on End.
IGpuPassEncoder	Records one pass: bind pipeline/buffers, push constants, dynamic cull/front-face/depth-write, viewport/scissor, Draw, DrawIndexed, MultiDrawIndexedIndirect, timer scopes.
GpuRingAllocation	A ref struct slice of the frame's upload ring: buffer, aligned offset, CPU-writable span. Replaces every per-frame BufferSubData.
IGpuBuffer / IGpuTexture / IGpuSampler	Resources. Disposal routes through the retirement queue, never freeing under a live frame.
IGpuPipeline + GpuPipelineDescription	Shader pair plus all state Vulkan bakes: blend, depth, cull default, front face, alpha-to-coverage, topology, sample count.
GpuPassDescription	Attachments with load/store ops, clear values, sample count, resolve.
IGpuRenderTarget	Offscreen colour(+depth) whose colour is sampleable after the pass.
IGpuTimerPool	GPU timings from retired frames.
GpuCapabilityRecord	Backend-neutral capability view; computes SupportFailures, feeding the existing exit-code-4 contract.
GpuTextureSlot	Index into the global texture table — the backend-neutral replacement for a bindless handle.
RecordingGpuDevice (in the test project)	In-memory double: records calls in order and backs ring allocations with real memory, so renderer tests run with no GPU.

Design notes worth keeping in mind while implementing:

• GpuTextureSlot.Unassigned is a loud sentinel (uint.MaxValue), never a usable slot, and must never reach a shader. Renderers needing a fallback take IGpuDevice.DefaultTextureSlot, a really registered 1×1 white texture. This is deliberate: silently resolving an unset index to slot 0 is the failure mode that produced the magenta 1×1 UI placeholder bug.
• GpuRingAllocation is a ref struct so the compiler forbids storing it past the frame that owns the memory.
• Renderers always speak GL conventions for winding and viewport origin. The Vulkan backend renders with a negative viewport height and inverts front-face in exactly one mapping function. No renderer performs that flip itself.

3.4 The binding model (GpuBindingModel)

Dual-legal for GL GLSL and Vulkan GLSL, exploiting GL_KHR_vulkan_glsl's rule that an omitted set qualifier means set 0.

• set 0 — storage buffers, bindings 0–8 exactly as the shaders declare them today (instances, batches, clip regions, clip slots, global lights, instance light sets, instance indoor, instance alpha, selection lighting), plus binding 9 = texture table, which is the GL-only emulation (a buffer of uvec2 bindless handles) and is deleted with the GL backend.
• set 1 — uniform buffers. SceneLighting keeps binding = 1. Today mesh_modern relies on GL keeping SSBO and UBO binding tables separate so the BatchBuffer SSBO and the SceneLighting UBO can both be binding 1. Vulkan has one binding namespace per set, so moving UBOs to their own set preserves both numbers and removes the collision.
• set 2 — the global sampled-texture descriptor array: variable count, partially bound, update-after-bind, capacity 16384.
• Push constants — one shared 96-byte GpuPushConstants block (of the 128 Vulkan guarantees): ViewProjection, DrawIdOffset, LightingMode, RenderPass, LightDebug, TextureIndexA/B, two spare scalars. One shared block means one pipeline layout, so switching pipelines mid-pass does not invalidate bound descriptors. The GL backend maps each field to the correspondingly named uniform and skips those a program does not declare.

BatchData's uvec2 textureHandle becomes uint textureIndex plus a pad word at V2. The 16-byte std430 stride is unchanged, so every existing CPU writer keeps its offsets. That single change is what makes the CPU-side data model backend-neutral, and it lands on GL, pixel-gated, long before Vulkan exists.

---

4. Vulkan technical decisions

4.1 Floor

Vulkan 1.3 core plus VK_KHR_swapchain (and the platform surface extensions). Optional and never required: VK_EXT_memory_budget (telemetry), VK_EXT_debug_utils (object naming in dev builds), VK_KHR_present_wait (an issue #235 experiment).

Required device features, each with a reason:

Feature	Why
multiDrawIndirect	The three MDI dispatch sites are the entire draw architecture.
drawIndirectFirstInstance	Indirect commands carry a non-zero firstInstance as the per-group instance base.
shaderDrawParameters	gl_DrawID. Resets per vkCmdDrawIndexedIndirect exactly as GL's does, so the issue #52 uDrawIDOffset pattern carries over unchanged.
shaderClipDistance (≥ 8)	Phase U.3's per-cell screen-space clip gate.
textureCompressionBC	DXT1/3/5 DAT surfaces upload as BC1/2/3 with no transcode.
samplerAnisotropy	Sampler-quality parity.
timelineSemaphore	One monotonic serial replaces the GL fence array; the existing retirement ledger keeps its serial keys.
hostQueryReset	Reset timestamp pools from the CPU instead of burning command-buffer calls.
descriptor-indexing set (runtimeDescriptorArray, descriptorBindingPartiallyBound, …SampledImageUpdateAfterBind, …UpdateUnusedWhilePending, …VariableDescriptorCount)	The global texture table replacing bindless handles.
dynamicRendering, synchronization2, maintenance4	No render-pass/framebuffer objects; barrier2; relaxed shader interface rules.

Explicitly not required: bufferDeviceAddress (every buffer is descriptor bound; it would buy nothing and costs capture-tool compatibility), any compute/geometry/tessellation feature (acdream has no such shaders), fillModeNonSolid (debug lines use LINE_LIST topology).

Limits to assert in the probe: maxPushConstantsSize ≥ 128, timestampComputeAndGraphics, maxDescriptorSetUpdateAfterBindSampledImages ≥ 16384, maxPerStageDescriptorUpdateAfterBindSampledImages ≥ 16384.

4.2 Bindings layer

Silk.NET.Vulkan + Silk.NET.Vulkan.Extensions.KHR at 2.23.0, matching the pinned Silk family. It is blittable-struct and function-pointer based, so with stackalloc/fixed for the small arrays passed to submits and barriers it allocates nothing per frame — which the 0 B/frame target requires.

No VMA dependency. Silk does not ship it, third-party .NET bindings are a native-binary and maintenance liability across win-x64/linux-x64/CI-lavapipe, and acdream's allocation profile is tame: two mesh arena buffers, one staging ring, a handful of per-frame buffers, ~4 render targets, and a texture pool. A custom allocator (~400 lines, first-fit free list over 128 MiB device-local blocks per memory type, dedicated allocations at ≥ 32 MiB) keeps vkAllocateMemory counts two orders of magnitude below the limit and plugs straight into GpuMemoryTracker for exact accounting, which VMA would obscure.

4.3 Memory

• Mesh arena — two DEVICE_LOCAL buffers mirroring GlobalMeshBuffer exactly: 384 MiB vertex, 128 MiB index (VK_INDEX_TYPE_UINT16; the existing cap is already expressed in sizeof(ushort)). Keep the reclaimable-range allocator, growth quanta, budgeted incremental grow-and-copy (now vkCmdCopyBuffer), retirement-ledger deletes, and the 896 MiB dual-generation ceiling.
• Staging ring — one persistently mapped HOST_VISIBLE|COHERENT buffer (48 MiB), watermarked per flight slot, recycled when the slot retires. Oversized uploads take a temporary dedicated buffer retired through the ledger.
• Per-frame data — the CPU win. Each MDI renderer gets, per flight slot, one persistently mapped buffer holding its instance/batch/clip/light/indoor/alpha/ selection sections at fixed aligned offsets, plus indirect commands and the SceneLighting block. Prefer DEVICE_LOCAL|HOST_VISIBLE (ReBAR — present on the RX 9070 XT, RADV, and modern NVIDIA), fall back to HOST_VISIBLE|COHERENT. The bucketing code writes structs directly into mapped memory; today's write-to-array-then-BufferSubData (driver validation, copy, rename tracking) simply stops existing.
• Textures — device-local pool. Formats stay UNORM (BC1/2/3_UNORM, R8G8B8A8_UNORM, R8_UNORM), matching GL exactly. There is no sRGB anywhere in the pipeline — not on upload, not in the shaders, not at the framebuffer (V3 audit, §4.10). 2D arrays are allocated full-size and filled incrementally, mirroring ManagedGLTextureArray.
• Mip generation — DAT surfaces ship no mips. Uncompressed formats get a vkCmdBlitImage chain at upload. BC formats cannot be blit targets, so their chains are built on the CPU at decode time (box filter + a small managed BC encoder, deterministic and unit-testable) — which also replaces today's driver-defined behaviour for glGenerateMipmap on compressed arrays. Escape hatch if encoder quality ever trips the pixel gate: store the affected textures as RGBA8 and blit their mips.

4.4 Descriptors

Two persistent sets, one shared pipeline layout, zero descriptor writes per frame.

• Set 0 — one COMBINED_IMAGE_SAMPLER binding, 16384 variable count, PARTIALLY_BOUND | UPDATE_AFTER_BIND | UPDATE_UNUSED_WHILE_PENDING, fragment stage. A slot is a (view, sampler) pair — exact parity with bindless handles, which are also per texture+sampler. Registration appends one descriptor write; eviction returns the slot to a free list gated on frame retirement, and the slot is defensively overwritten with a dummy before reuse. This removes the entire MakeTextureHandleResident churn.
• Set 1 — per-renderer, per-flight-slot storage buffers at the nine GpuBindingModel bindings plus the SceneLighting UBO, all pointing into that renderer's mapped per-slot buffer at fixed offsets. Written once at startup; rewritten only when a buffer grows, gated on that slot's retirement. Bindings a given renderer does not use still bind a shared dummy range so there is one layout and no permutations.

4.5 Pipelines

Core 1.3 dynamic state covers viewport, scissor, cull mode, front face, depth test/write/compare, stencil test/ops, and topology class — which folds the GL pass matrix's cull/depth-mask/stencil toggles into command-time calls. Blend and alpha-to-coverage are not dynamic, so they define the pipeline list: mesh opaque / alpha / additive, terrain, sky, particle alpha / additive, particle-mesh alpha / additive, debug line, UI text, plus offscreen variants only where the target's format or sample count differs. Expect 11–14 pipelines.

All are known statically and built at startup against a VkPipelineCache persisted to ApplicationPathSet.CacheDirectory (validated by header UUID). First launch pays a few hundred milliseconds once; later launches are milliseconds, and no frame ever compiles — which also removes GL's hidden first-draw driver-recompile hitches.

Depth/stencil: prefer D32_SFLOAT_S8_UINT, fall back D24_UNORM_S8_UINT. The stencil aspect is required by #117's portal punch.

4.6 Shaders

The eight GLSL pairs stay the single source of truth. Vulkan-dialect changes: set/binding qualifiers per §3.4; texture(uTextures[nonuniformEXT(idx)], …) replacing the bindless sampler2DArray(handle) reconstruction; gl_DrawIDARB → gl_DrawID; gl_BaseInstanceARB + gl_InstanceID → gl_InstanceIndex (Vulkan's already includes firstInstance); the loose uniforms move into the push-constant block. std430 SSBO layouts, the std140 SceneLighting block, and gl_ClipDistance[8] port byte-identically.

nonuniformEXT is required, not optional: within one MDI dispatch different draws read different Batches[] entries, and "dynamically uniform" is defined over the whole dispatch on some implementations. The qualifier costs nothing measurable on RDNA or NVIDIA and removes a class of silent corruption.

Compilation: committed .spv artifacts produced by tools/compile-shaders.ps1 (glslang/glslc), plus a test that hashes the GLSL sources into a committed manifest and fails when they drift. CI runners have no Vulkan SDK, and runtime shaderc would add a native dependency and startup cost for shaders that never change at runtime.

4.7 Clip space — no projection change needed

Verified: acdream's cameras already build projections with Matrix4x4.CreatePerspectiveFieldOfView, which is D3D convention with NDC z in [0, 1] — documented at src/AcDream.App/Rendering/PortalProjection.cs:12-13, where the GL-convention near test was previously a real bug. Vulkan's clip convention is [0, 1], so the matrices are consumed as-is. The GL path has been compressing [0, 1] clip z into the upper half of the depth buffer, so Vulkan doubles effective depth precision for free.

Consequence to expect at V7: window-space depth values shift, so z-fight patterns on near-coplanar retail geometry may differ. This is the one pre-approved divergence class; each instance gets a compare mask or a per-stop relaxation plus a divergence-register row.

Y-flip is handled by a negative viewport height (core since 1.1), which keeps winding and cull semantics identical to GL. Reversed-Z remains an easy future option and is explicitly not required for parity.

4.8 Sync and the frame

Two frames in flight; one primary command buffer per frame from a per-slot vkResetCommandPool; no secondary buffers (single render thread); one graphics+present queue with transfers riding it (an async transfer queue is a deferred option, not a need — uploads are already budget-throttled). Per-slot binary acquire semaphores, per-image binary render-done semaphores, and one timeline semaphore whose value is the frame serial — so GpuFrameFlightController ports almost mechanically, its SortedDictionary<long, List<Action>> retirement ledger keeping its keys.

Frame skeleton (synchronization2 throughout): wait timeline ≥ serial − 2 → run retirements → reset pool → write per-frame data into mapped slot buffers → acquire → record [uploads: copies, one batched image barrier to TRANSFER_DST, copies/blits, one batched barrier to SHADER_READ_ONLY plus a buffer barrier to vertex/indirect stages] → [offscreen passes] → [main pass: MSAA colour CLEAR/DONT_CARE resolving to the swapchain, transient depth CLEAR/DONT_CARE, sky → terrain → entities → envcells → particles → weather → UI] → [optional screenshot copy] → barrier to PRESENT_SRC → submit → present. Budget: roughly 4–6 batched vkCmdPipelineBarrier2 calls per frame.

4.9 Swapchain, present, pacing

Surface through Silk windowing (GraphicsAPI.DefaultVulkan, IWindow.VkSurface) so the existing GLFW platform selection, ACDREAM_DISPLAY_PROTOCOL, and window lifecycle are unchanged. Format B8G8R8A8_UNORM — see §4.10, this was corrected at V3 and is the single highest-severity finding of the audit. Screenshots swizzle BGRA→RGBA on the CPU to preserve FrameScreenshotController's RGBA byte contract. Present modes: FIFO when VSync is on; IMMEDIATE preferred then MAILBOX when off, with FramePacingController and its platform waiters continuing to drive the software cap. OUT_OF_DATE recreates immediately, SUBOPTIMAL at the next frame boundary, both through FramebufferResizeController.

4.10 V3 audit findings (2026-07-27)

Slice V3 audited every projection producer, every depth-range assumption, the clip-plane derivation, the sRGB path, and MSAA control. The central claim held — but one plan assumption was wrong, and catching it is why V3 exists.

Confirmed. Every projection that reaches a shader is built by Matrix4x4.CreatePerspectiveFieldOfView (world, portal tunnel, paperdoll, appraisal cameras; terrain, mesh, particles, debug lines and sky all consume the same matrices). There are no orthographic projections in production code at all — the retained UI's ui_text.vert converts pixel coordinates straight to NDC with a constant z = 0, so V4a has no matrix to convert, only a Y-sign to check. So: no projection rework, exactly as designed.

SkyProjection.WithDepthRange is the only hand-written matrix edit, assigning M33/M43 directly. It re-derives the same D3D-convention near/far mapping (it even throws on an orthographic input) rather than a GL-style 2/(f-n) scale — correct, but the sharpest edge in the codebase and a required cross-check at V6.

Phase U.3's clip planes are derived and consumed entirely in clip space with plane.z always 0, so they are insensitive to both the depth convention and the viewport Y flip. No change needed.

Corrected — sRGB. The plan previously specified a B8G8R8A8_SRGB swapchain "matching the GL FramebufferSrgb contract." That contract does not exist. EnableCap.FramebufferSrgb is enabled only inside the throwaway 2×2 capability probe (GraphicalGlFunctionProbe.cs:419-429) and disabled immediately; it is never enabled on the real backbuffer. No texture is uploaded in an sRGB internal format (TextureFormatExtensions has none), and no shader performs any gamma conversion. The renderer is plain UNORM end to end. The correct Vulkan swapchain format is B8G8R8A8_UNORM; shipping _SRGB would have applied an unwanted encode to already-display-space values — a global brightening across every frame, and precisely the failure mode §6 lists as "cannot pass silently." It would have passed silently right up to V7.

Separately: the capability gate requires sRGB-framebuffer support that the renderer never uses. Harmless today, but the Vulkan gate must not carry the stale requirement forward.

MSAA. ACDREAM_MSAA_SAMPLES overrides the quality preset (QualityPreset.cs:43-59) and 0 forces MSAA off, but it is read at window creation and cannot change mid-session. The V7 differential script must therefore launch both backends with ACDREAM_MSAA_SAMPLES=0 rather than toggling a setting.

Two concrete acceptance items carried to V6/V7.

1. Scissor Y convention. NdcScissorRect.ToPixels emits GL bottom-left-origin pixel rectangles. Vulkan's vkCmdSetScissor is always top-left-origin — the negative viewport height does not flip the scissor. The contract already says callers keep GL convention and the backend converts (IGpuPassEncoder.SetScissor), so the Vulkan encoder must do that flip. A scissored aperture — a doorway — is the right differential-gate target.
2. FrustumCuller near plane extracts col4 + col3, the GL [-1,1] Gribb- Hartmann formula, against [0,1]-convention matrices; the correct extraction is col3 alone. Proven over-inclusive rather than over-culling, so it is not a visibility bug, and it is pure CPU math untouched by the backend swap. Filed as a tracked issue rather than fixed here — it is not Campaign V's scope.

4.11 Capability gate

Mirrors the GL three-layer shape exactly — passive record, active probes, an Evaluate that throws NotSupportedException → Program.cs exit code 4 → an atomic graphical-capabilities.json. The Vulkan active probe is stronger than the GL one: it creates the real device with the production feature chain, builds the real descriptor layouts and one real pipeline from the committed .spv, and renders a 64×64 offscreen triangle sampling a table slot, then reads the pixels back. Device selection: discrete > integrated > virtual > CPU, tie-broken by largest device-local heap, with an ACDREAM_VULKAN_DEVICE override recorded in the report.

---

5. Slice sequence

Every slice ends with dotnet build and the App test suite green, its gate passed, and one commit. GL remains the default backend through V9; all Vulkan work is dark behind ACDREAM_RENDER_BACKEND (default gl).

Run the suite in Release: dotnet test … -c Release. Some tests assert Release-only behaviour and legitimately fail in Debug — LandblockBuildOriginTests.FarLoad_StripsEnvCellsAndPhysicsEvenWhenEntityListIsAlreadyEmpty covers the far-tier strip that LandblockStreamer.cs:505 deliberately turns into a loud Debug.Assert in Debug builds. A Debug run therefore shows one failure that is neither a regression nor yours. The V0 baseline is 3,785 passed / 3 skipped in Release (3,763 pre-campaign plus 22 contract tests).

5.1 The offline pixel gate

"Pixel gate" means tools/run-offline-pixel-gate.ps1: capture at the parent commit, capture at slice HEAD, compare with the compare-screenshots CLI at tolerance 2 / fraction 0.001.

The client is launched without ACDREAM_LIVE, so it renders the world straight from the DATs. No session is created and no ACE state can be disturbed, which means this gate runs unattended — it needs neither the live server nor the user. That matters: seven slices (V2, V4a–V4g) are renderer ports whose whole acceptance criterion is "no pixel changed."

tools/run-offline-pixel-gate.ps1 -Out artifacts/gate-base            # at the parent commit
tools/run-offline-pixel-gate.ps1 -Out artifacts/gate-head -Baseline artifacts/gate-base

Determinism was measured, not assumed. Two captures at the same commit initially differed in 0.29% of pixels — far above the 0.001 threshold. The differences were confined to the top ~180 rows: the sky animates (clouds scroll, the sun moves) and the Dereth clock advances with wall time, so two launches can never agree there. Everything below the horizon was stable. With the top 280 rows masked, two independent same-commit pairs differ by 15 and 17 pixels out of 563,200 compared — a fraction of 0.000027, roughly a 33× margin under the threshold. The gate is a strict identity check on everything it covers, rather than a loose tolerance that would hide real regressions.

Noise band re-measured 2026-07-28, after the capture began resolving the multisampled default framebuffer instead of reading it through an unspecified operation (see §5.5). Two fresh same-commit control pairs — one at fed636b9, one at the resolve commit — differ by 17 and 23 pixels, fractions 3.02e-05 and 4.08e-05. The change itself measured 4.08e-05 against fed636b9, i.e. exactly its own same-commit control and therefore indistinguishable from ambient noise. The band is now 15–23 differing pixels, fraction ≤ 4.1e-05, a ~24× margin under the 0.001 threshold. Two facts are worth keeping: the resolve moved essentially nothing in this scene, which says AMD's unspecified read was usually returning the resolved image already; and "usually" is exactly the property that makes an unspecified read useless as an instrument.

Coverage. Terrain and terrain blending, scenery, static world meshes, water, fog, and the entire retained UI (vitals, spell bar, toolbar, chat, radar).

Not covered — these still need a user visual gate: sky (masked), EnvCell interiors, particles, and the paperdoll/appraisal viewports, because the offline scene is a fixed outdoor view with no camera control.

Accumulated user-gate debt. Each of these landed with its automated gate green but part of its surface unproven. They should be checked together, in one connected session, rather than one at a time:

Slice	What the offline gate could not prove
V2c	Particle texture-index migration — no particles in the captured scene
V4c	EnvCellRenderer — zero EnvCell activity in the capture. Dungeon interiors are half of that slice and are entirely unproven. Also the paperdoll/appraisal/portal-tunnel views, which is precisely what §5.4's BeginPass change protects
V4e	Particles (again)
V4f	Sky — deliberately masked for determinism
V4g	Paperdoll and appraisal viewports, portal transit
V6d	The paperdoll/appraisal viewport sprite. It is the one retained-UI texture the gate's scene never draws, and V6d changed how every UI texture is sampled — from a bound texture unit to a table slot. The seam that registers it (GlGpuDevice.RegisterExternalColorTexture) is unchanged and its handle is now simply encoded rather than resolved back to a GL name, but that path is unproven by anything automated. Check it with the dungeon/portal pass above rather than on its own
V6e	Particles, again — and now sky. The particle half is V2c's and V4e's debt restated: the offline scene draws no particles, so nothing automated saw the varying retype or the ACDREAM_TEXTURE_NONE sentinel. The sky half is new and larger: V6e moved a dozen loose uniforms into a SkyParams uniform buffer and moved the sky's texture from a bound unit-0 texture-plus-sampler to a bindless (texture, wrap) table slot, and the gate masks the sky band for determinism. What WAS checked, and should be read as bounding the risk rather than closing it: a base-versus-head offline capture at all seven day groups, matching in gradient, cloud sheet, horizon band and fog on every one — including day group 2's salmon cloud band and day group 6's green band, which exercise texture sampling, tint, blend and fog together — plus 3/3 RENDERED on the desktop-witness repeat gate. What remains unproven is pixel-exactness and the parts of the dome the fixed outdoor camera cannot see: the sun and moon (additive surfaces high in the sky) and the rain cylinder, which is the one sky mesh that surrounds the camera and the one whose REPEAT wrap mode is most visible. Stand outside at dawn or dusk, and stand in rain
V6k	The sky band and the paperdoll — both CHECKED rather than banked, and recorded here so the next slice does not re-open them. Commit 1 carries a seven-day-group before-and-after comparison on GL (V6e's method) because the gate masks the sky; commit 2 carries a connected run that presses ToggleInventoryPanel and captures the doll through the new render target (artifacts/v6k-paperdoll). What remains uncovered: the creature-appraisal viewport, which is the same class and the same code as the paperdoll but was not itself driven; and the sun, moon and rain cylinder, which V6e already filed and a fixed outdoor camera at one time of day still cannot see
V6l	The Vulkan paperdoll and a particle effect — both CHECKED rather than banked, and both connected, because the offline gate reaches neither. The doll capture (artifacts/v6l-vk-paperdoll3 against artifacts/v6l-gl-paperdoll) is also the no-regression check for making the viewport's V orientation backend-derived. The particle capture (artifacts/v6l-vk-poi against artifacts/v6l-gl-poi) is Holtburg's forge plume and glint field, cropped 4× at artifacts/crop-vk-glow.png / crop-gl-glow.png. What remains uncovered: the creature-appraisal viewport, which is the same class and the same code as the paperdoll but was again not itself driven — V6k's half-discharge, carried forward unchanged; and the portal depth mask, which drew no pixel in either capture because neither run entered a building aperture. Check it with the dungeon/doorway pass above
V6m	The portal tunnel, the creature-appraisal viewport and an interior EnvCell — all three CHECKED, connected, on BOTH backends, because the offline gate reaches none of them. artifacts/v6m-gl-tunnel versus artifacts/v6m-vk-tunnel: ten transit frames, the examination window over a Brown Rabbit, and the Facility Hub's interior. This discharges V6k's and V6l's carried appraisal-viewport half-discharge — the view that shares the paperdoll's class and code has now been driven itself. What remains uncovered: the portal DEPTH MASK still drew no pixel, because none of these runs stood in a building aperture either; and the interior pair is eyes-on only, because the indoor spring-arm camera settled to different distances in the two runs (31.2% differing, a route defect rather than a renderer one — see §5.5.18)
V6f	Terrain seen through a doorway clip region. The offline gate covers terrain heavily — blending, road overlays and the water edge are most of the frame, and every one of those samples goes through terrainTiling(), so the std140 stride and the new ACDREAM_SAMPLE_ARRAY reads are well proven. What it cannot see is the one terrain path with its own binding: the clip UBO at binding 2, exercised when terrain is viewed through a doorway. Binding 3 now sits beside it and is rebound per draw, so a bind-order mistake would show exactly there. Check it with the dungeon/doorway pass above

The user confirmed on 2026-07-27 that the local ACE server is always available and they will verify visually on request. That converts this table from deferred debt into a real gate, and it should be used rather than banked: a slice whose uncovered surface is checked while the change is fresh costs minutes, whereas the same defect found at the V7 differential is a bisect across a dozen commits.

The checklist, in the order that exercises the most per minute:

Look at	Proves
A dungeon interior — walk in, look along a corridor and through a doorway	EnvCellRenderer, the per-cell clip gate, portal visibility. Half of V4c, currently unproven by anything.
A portal transit	The portal tunnel presentation and the depth/stencil mask
The paperdoll, then examine an item	The two offscreen viewports — and §5.4's BeginPass change exists precisely to keep these off the backbuffer
Cast a spell	Particles, and the inverse-alpha blend added at V4c
Stand outside at dawn or dusk	Sky, which the offline gate masks for determinism

Worth noting: no connected route used to visit an interior, and one does now. Every stop in connected-r6-soak.route.txt is outdoor, which is why EnvCell coverage was missing from the automated gates too and not just the offline one. V6m added the interior stop to the new connected-backend-differential.route.txt — the Facility Hub's cell 0x164, which is >= 0x100 and therefore indoor. Two corrections to the earlier claim, both worth keeping straight: connected-world-lifecycle.route.txt has in fact carried a Facility Hub stop all along, so the lifecycle gate did reach an interior even though nothing compared its pixels; and reaching one is not the same as being able to compare it, because the indoor spring-arm camera settles to a slightly different distance per run (§5.5.18).

MSAA is left at the quality preset for GL-versus-GL self-differentials, where it is deterministic. The V7 GL-versus-Vulkan differential must force MSAA off, because sample positions are not specified across implementations.

Slice	Scope	Gate
V0 ✅	Pinned RHI contract, RecordingGpuDevice, contract tests, this document, roadmap entry.	build + tests + contract tests
V1 ✅	GL backend: GlGpuDevice (no Chorizite inheritance), buffers (BufferSubData, behaviour-preserving), ring over the existing fence-bounded pattern, textures + the binding-9 handle table, samplers, pipelines, timers, backbuffer capture. Constructed in composition (HostInputCameraCompositionPhase, right after the frame-flight controller); no consumers yet.	build + tests + GL unit tests + pixel gate (trivially identical — a tripwire)
V2 ✅	Shader dialect + texture-index migration on GL: uvec2 textureHandle → uint textureIndex, a binding-9 handle table, common.glsl preamble, CPU batch-struct change. Sub-commits: V2a mesh (d365476e), V2b terrain (1f1f6c08), V2c particles (a85743f7). Each renderer (WbDrawDispatcher, EnvCellRenderer, TerrainModernRenderer, ParticleRenderer) owns its own GlBindlessHandleTable rather than one shared TextureCache-owned instance — see the note below, which the per-slice commit messages elaborate on.	pixel gate per sub-commit (V2a 2.84e-05, V2b 2.49e-05 differing-pixel fraction against parent, both well under the 0.001 threshold and within the documented ~33x same-commit noise margin). V2c has no automated pixel coverage (particles are outside the offline gate's fixed view) — flagged for a user visual check.
V3	Clip-space and sRGB audit: verify every projection producer is [0,1] convention, confirm clip-plane derivation, record the sRGB swapchain decision and the depth-precision divergence class here.	pixel gate + connected lifecycle
V4a	TextRenderer (three fence-buffered VBO sets → ring allocations), BitmapFont, DebugLineRenderer, the UI RenderSurface upload path, UiViewport's texture handoff.	pixel gate (UI-heavy checkpoints)
V4b	GlobalMeshBuffer + ObjectMeshManager onto IGpuBuffer; arena, LRU and ledger logic untouched.	pixel gate
V4c ⏸ PARKED — §5.5.5	The large one. WbDrawDispatcher + EnvCellRenderer: per-frame uploads → rings, MDI brackets → pipelines + MultiDrawIndexedIndirect, loose uniforms → push constants, timer scopes. RetailAlphaQueue and all bucketing untouched. Narrowed after the V4c scouting report — see §5.3.	pixel gate at several checkpoints + connected lifecycle
V4t ✅	World texture stack (added 2026-07-27, see §5.3; reported in §5.5.11). Two commits: 1 the GL device's world-handle seam plus TerrainAtlas/TerrainModernRenderer (b8bcaa3e); 2 CompositeTextureArrayCache, the particle arrays, ObjectMeshManager's material path, and the retype of GroupKey, CachedBatch and ObjectRenderBatch from ulong bindless handle to GpuTextureSlot, retiring the interim tables in WbDrawDispatcher, EnvCellRenderer, TerrainModernRenderer and ParticleRenderer (565c351f). Narrowed from the original scope in one way: the caches still create and own their GL textures and residency — the device owns only the table entry — so ManagedGLTextureArray and the raw Texture2D upload path are untouched and IGpuTexture creation moves with the Vulkan world arm. SkyRenderer keeps its own table; see §5.5.11.	pixel gate per commit (3.02e-05; 5.50e-05 and 3.91e-05 on two captures against a 19 px same-commit control), App tests, 3/3 desktop-witness connected run per commit, one validation-layer Vulkan run per commit
V4d ⏸ PARKED — §5.5.5	TerrainModernRenderer only — TerrainAtlas belongs to V4t with the rest of the texture stack. Two sub-commits: first the uView/uProjection → uViewProjection shader convergence on its own pixel gate (it moves a matrix product from per-vertex GPU to a CPU multiply, so its rounding effect must be attributable alone), then the plumbing. Terrain has no GPU timer to port — its diagnostics use a CPU Stopwatch.	pixel gate per sub-commit
V4e ✅ landed in V6l	ParticleRenderer, as the Vulkan arm (b1ad1d48); reported in §5.5.17. Unblocked by amendment 1 — a second vertex binding at VK_VERTEX_INPUT_RATE_INSTANCE / divisor 1, §5.5.16's option (i) — plus GpuVertexFormat.UInt1 for particle.vert's scalar uint slot, so no shader was edited.	GL pixel gate, 3-run connected, validation-clean Vulkan run, and a connected GL-versus-Vulkan particle capture
V4f ✅ landed in V6k	SkyRenderer + weather, as the Vulkan arm (22aa2edc); reported in §5.5.16.	seven-day-group GL comparison, GL pixel gate, 3-run connected, validation-clean Vulkan run
V4g ✅ completed in V6l	PrivateEntityViewportRenderer → IGpuRenderTarget at V6k (eb7e6b4e), which also discharged §5.4; PortalDepthMaskRenderer (eced67d0) and both offscreen viewports on the Vulkan arm (2e8b8b91) at V6l, reported in §5.5.17. Unblocked by amendment 2 (a stencil dimension on GpuPipelineDescription plus IGpuPassEncoder.SetStencil) and amendment 3 (a layered sampled view per render target, sample-count pipeline variants). PortalTunnelPresentation needed no port — it draws into the backbuffer — and still has no Vulkan arm; see §5.5.17's V7 list.	GL pixel gate, 3-run connected, validation-clean Vulkan run, and connected paperdoll + particle captures on both backends
V4h ↻ re-sequenced — §5.5.5	Frame-spine formalization: pass executors emit real declared BeginPass/EndPass (clears and framebuffer management move out of the spine and into pass load/store ops), flight/screenshot/resize/profiler move onto the RHI, OpenGLGraphicsDevice's live role retires, Chorizite consumers are audited, and the architecture test lands. Milestone: seam complete.	pixel + connected lifecycle + R6 soak + complete Release suite + interim perf (RHI-on-GL CPU p50 ≤ 1.95 ms)
V5 ✅	Vulkan bring-up, dark: ACDREAM_RENDER_BACKEND, surface/instance/device/queues/swapchain, the capability record/probe/guard with the exit-4 contract, a clear-colour loop with screenshot and clean shutdown.	VK boots to clear on the RX 9070 XT; forced-unsupported knob → exit 4
V6	Vulkan RHI backend, dark, four sequential commits: a ✅ allocator/buffers/staging/rings/timeline (fb9c6693); b ✅ textures/BC mips/samplers/descriptor table/render targets/MSAA resolve (9eae4963); c ✅ .spv toolchain, pipelines, pipeline cache, negative viewport, push constants, timestamps, readback, debug names (234fe91d); d ✅ first production renderers — TextRenderer and DebugLineRenderer on both backends, the colour-format contract amendment, and the retained UI drawn on Vulkan; e ✅ every remaining production shader crosses the dialect — mesh_modern (935f4dc3), both particle pairs (602bc9dd) and sky — leaving 8/9 pairs compiling to SPIR-V. Milestone deferred: "full game frame on Vulkan" is not reachable while V4c/V4d are parked and the world renderers plus TextureCache are still raw GL, so V6 delivers the backend, the two renderers that can use it today, and the shaders the Vulkan world path will be built on.	per-commit build + tests; V6d additionally pixel-gates GL and captures a Vulkan UI frame; V6e pixel-gates GL per commit and adds a seven-day-group sky comparison plus a 3-run desktop-witness gate
V6f ✅	terrain_modern crosses the dialect, in three separately gated commits: 1 uView/uProjection → uViewProjection (5e13b45f); 2 uTexTiling[36] → the UniformTerrainTiling std140 buffer (fac09407); 3 the atlas reads → ACDREAM_SAMPLE_ARRAY (30e94da6). Every production shader acdream draws with is now Vulkan-expressible. The slice also measured the Vulkan world path and found it blocked — see §5.5.7.	pixel gate per commit (3.91e-05, 3.73e-05, 2.13e-05; cumulative 3.91e-05 against 7faaaa34), App tests, one 3/3 desktop-witness connected run, one validation-layer Vulkan run

The one production pair still not Vulkan-expressible after V6e was terrain_modern, blocked on exactly the two things V4d was going to do: uView/uProjection are two loose mat4 uniforms (128 bytes — they cannot both fit the 96-byte push block, which is why V4d's first sub-commit converged them into one uViewProjection on its own pixel gate), and uTexTiling[36] is the 144-byte array UniformTerrainTiling was reserved for. V6e left it alone because converging the matrices moves a multiply from per-vertex GPU to a CPU multiply — a real numeric change that the plan requires be attributable on its own gate, and one that belongs to whoever re-lands V4d's content rather than to a shader dialect slice. V6f closed all three (the third was the frag's GL-only sampler2DArray(handle) construction), so 8/9 pairs now compile. mesh is a tenth pair with no consumer at all; see the V6e report.

| V6g | The four Vulkan validation defects §5.5.7 and its log left open: the dynamic-descriptor split (an architect decision, §5.5.8 item 1), per-pass depth-format pipeline variants, first-use backbuffer attachment layout transitions, and a backbuffer capture that no longer reads a presented swapchain image. Confined to Gpu/Vk/; the GL backend executes not one changed statement. | validation-clean bring-up run (0 errors / 0 warnings over 39,855 frames, against 7 VUIDs + 1 UNASSIGNED at the parent), App tests, GL offline pixel gate 4.08e-05 — its own same-commit control value | | V6h ✅ | The Vulkan composition host, specified by §5.5.9 and reported in §5.5.10. ACDREAM_RENDER_BACKEND=vulkan runs the real GameWindow composition — DAT load, streaming, camera, entity table, session, and the real retained UiHost through the RHI — with no world renderers. Three seams: the already-generic platform acquisition now publishes a GameWindowGraphics; VulkanHostInputCameraCompositionFactory is the host-phase fork; the frame root gains a Vulkan arm. VulkanBringUpHost is reduced to the capability-probe harness over the extracted VulkanGraphicsContext. | offline Vulkan launch reaching the real composition with the client's own UI captured, one validation-layer run at 0 errors / 0 warnings, converging ownership ledger, App tests 4,075/3, complete Release suite 9,138/5, GL offline pixel gate 1.78e-05 | | V6i ✅ | The world arm's prerequisites, in two parts. V6i-1 (df6e2a79, reported in §5.5.12) closed §5.5.8's one-binding-two-buffers hazard with one descriptor-set pair per renderer scope, derived from the descriptor state rather than declared, and measured the ordered remainder list the world arm still needed. V6i-2 (reported in §5.5.13) took items 1, 2 and 6 of that list in three gated commits: 1 the TerrainClip descriptor-set fix plus set 1's missing bindings 2 and 4, proven by spirv-dis and now gated by a SPIR-V-reading contract test (f7344758); 2 world texture CREATION crosses to IGpuTexture — IWorldTextureArray over TextureAtlasManager/ManagedGLTextureArray, TerrainAtlas's second construction path, and ICompositeTextureArrayBackend's RHI arm — with the Vulkan arm exercised at startup (c8d0f70b); 3 IMeshPipelineDevice decouples ObjectMeshManager/WbMeshAdapter from OpenGLGraphicsDevice. Items 3–5 — the submission arms, RetailPViewPassExecutor, and the pass-structure merge — are the next slice's. | pixel gate per commit (3.02e-05, 3.20e-05, 1.60e-05 vs 0ca802cd), App tests 4,109/3 and complete Release suite 9,172/5, 3/3 desktop-witness connected run at commits 2 and 3, one validation-layer Vulkan run per commit | | V6i-3 | The mesh pipeline runs on both arms, and the Vulkan frame gets a world pass, reported in §5.5.14. Two commits: 1 GlobalMeshBuffer takes GL? and publishes VertexStore/IndexStore, ObjectMeshManager's RequireGl narrows to the unreachable legacy upload, VulkanMeshPipelineDevice is IMeshPipelineDevice's second implementation, and NullWbMeshAdapter is deleted (fe8abacf); 2 the clear merges into the world pass with Store = Resolve and descriptor sets bind at draw time (887de4ae). The world renderers' submission arms and RetailPViewPassExecutor did NOT land — §5.5.14 enumerates what they still need. | pixel gate per commit (4.44e-05, 3.73e-05 vs 579e0b7f), App tests 4,112/3, one 3/3 desktop-witness connected run at HEAD, one validation-layer Vulkan run per commit, and a bit-identical (0/921,600) Vulkan capture across the pass merge | | V6j ✅ | The world arm, whole, reported in §5.5.15. Two commits: 1 VulkanViewportMapping stops inverting the front face — the world arm is the mapping's first culling consumer and measured that the inversion culls terrain outright and turns every closed shell inside-out (81fe5e1b); 2 the three renderers' RHI submission arms as a SECOND arm per §5.5.6, both pass executors made backend-neutral behind IWorldPassSurface, VulkanWorldPassScope publishing the frame's one pass, WorldFrameSections carrying the three frame-global sections, and the composition that reaches them (f84eef32). ACDREAM_RENDER_BACKEND=vulkan renders Dereth: terrain, blending, roads, water, statics, scenery and the retained UI. Sky stays fog until V4f. | GL pixel gate 5.50e-05 vs 847f14ae with a characterised 12–31 px noise distribution, App tests 4,112/3, complete Release suite 9,175/5, GL connected -Runs 3 at 3/3 on both columns, one validation-layer Vulkan run at 0 errors / 0 warnings, and the world PNG inspected in §5.5.15 | | V6k ✅ | Sky, viewports, and §5.4, reported in §5.5.16. Two commits: 1 SkyRenderer's RHI arm — V4f's content, two blend pipelines, SkyParams as a per-draw ring slice, the first Vulkan consumer of set 1 binding 4 — plus the retirement of the last interim GlBindlessHandleTable (22aa2edc); 2 PrivateEntityViewportRenderer onto IGpuRenderTarget, the deletion of §7.1's external-texture seam, and §5.4's obligation discharged (eb7e6b4e). Particles did not land: the pinned contract cannot express instanced vertex input, which is what both particle pipelines are built on. | GL pixel gate 4.43e-05 then 4.08e-05 (25 and 23 px, band 9–31), App tests 4,109/3, complete Release suite 9,172/5, GL connected -Runs 3 at 3/3 on both columns per commit, one validation-layer Vulkan run at 0 errors / 0 warnings per commit, a seven-day-group GL sky comparison, a connected paperdoll capture, and a GL-versus-Vulkan inspection in §5.5.16 | | V6l ✅ | Particles, the portal mask and the viewports, reported in §5.5.17. Three commits, one per contract amendment: 1 instanced vertex input (GpuVertexLayout per-binding stride and input rate, BindVertexBuffer(binding, …), GpuVertexFormat.UInt1) plus ParticleRenderer's RHI arm, the standalone particle texture cache on both arms, and the stride-equals-the-uploaded-record gate for every RHI vertex layout (b1ad1d48); 2 the stencil dimension (StencilTest + GpuStencilState + SetStencil), portal_depth as a committed shader pair, PortalDepthMaskRenderer's RHI arm, and the ambient stencil/colour-mask restore (eced67d0); 3 a layered sampled view per Vulkan render target, sample-count pipeline variants for WbDrawDispatcher, the composite texture cache on both arms, and the backend-derived viewport V orientation (2e8b8b91). | GL pixel gate per commit (3.20e-05, 2.31e-05, 3.55e-05; band 9–31 px), App tests 4,121/4,129/4,129 and complete Release suite 9,184/9,192/9,192, GL connected -Runs 3 at 3/3 on both columns per commit, one validation-layer Vulkan run at 0 errors / 0 warnings per commit, and connected Vulkan paperdoll and particle captures inspected against GL | | V6m ✅ | Portal space, and V7's instrument, reported in §5.5.18. Two commits: 1 PortalTunnelPresentation's RHI arm — the last raw-GL world-adjacent renderer — as a backbuffer pass published on IWorldPassScope, clearing to retail's opaque portal-space black rather than loading it, plus the deletion of NullLocalPlayerTeleportPresentation (59c6b2ae); 2 tools/run-backend-differential-gate.ps1 and connected-backend-differential.route.txt, with MSAA forced off on both launches, the repeat gate's desktop-witness guards, and an interior EnvCell stop — §5.1's durable fix for the campaign's oldest coverage gap (a99f517e). One smoke pair was run and is reported in full. | GL pixel gate 4.97e-05 (28 px) vs 280f3b3f against a 3.55e-05 (20 px) same-commit control, band 9–31; App tests 4,132/3 and complete Release suite 9,195/5; GL connected -Runs 3 at 3/3 on both columns; one validation-layer Vulkan run at 0 errors / 0 warnings; connected portal-tunnel, creature-appraisal and interior-EnvCell captures on BOTH backends, inspected in §5.5.18 | | V7 | GL-versus-Vulkan differential: tools/run-backend-differential-gate.ps1 (built at V6m), strict paired-PNG compare, divergences fixed in the Vulkan backend only, then lifecycle + R6 soak natively on Vulkan, one validation-layer-clean run, one RenderDoc capture. Milestone: parity. Starting distance, measured at V6m: 18.52% of the frame at the first stop, 1.17% with the sky band and the animated portal masked, with the 2-D retained UI already inside the threshold on its own. | every differential checkpoint passes; both connected routes green on VK | | V8 | Perf gate on the RX 9070 XT, uncapped, both backends, same route. | §2 acceptance table; parity is the floor | | V9 | Linux + CI: X11/Wayland surfaces; a linux-vulkan job on lavapipe (probe accepts on a real 1.3 software device, a short real render under xvfb, forced-unsupported → exit 4, .spv freshness). Physical Linux GPU row deferred post-cutover, as for Slice L. | CI green including the new job | | V10 | Cutover: Vulkan default, GL reachable by env var for one slice, gate scripts default to VK. | complete Release suite + retail expected PNGs on VK (baselines not regenerated) + both connected routes + user visual sign-off | | V11 | GL deletion and closeout: delete Gpu/Gl, OpenGLGraphicsDevice, ManagedGL*, GLSLShader, GLHelpers, GLStateScope, RenderStateCache, BindlessSupport, GraphicalGlFunctionProbe, the GL branch in GameWindow, the ImGui project and Studio; drop the GL and (if the audit is clean) Chorizite packages; file the retained-UI dev-panels follow-up; swap CI assertions to VK; update the divergence register, architecture doc, code-structure doc, and rendering memory crib; re-measure memory. | complete Release suite + both connected routes + working-set re-measure |

5.2 Why V2's handle table is not the device's table

The obvious reading of V2 — "have the texture caches call IGpuDevice.RegisterTexture" — does not work at V2, and the reason is worth recording so nobody re-derives it later.

GlGpuDevice flushes its dirty texture table immediately before each draw it records. At V2 the draws still go through raw GL inside WbDrawDispatcher, which the device knows nothing about, so the device would never flush — the table would be stale on the GPU. Making it work would need a manual FlushTextureTable() escape hatch plus a way to bind the device's buffer from raw GL code, which leaks the backend straight back through the seam we are building.

So V2 keeps the indirection entirely inside the existing GL world: the texture caches own a small handle-table storage buffer at binding 9 and flush it on their existing schedule. V4c then deletes that interim table when WbDrawDispatcher moves onto the encoder and the device's table — with its retirement-gated slot recycling — becomes reachable. Two small, separately pixel-gated changes beat one entangled one; separating the data-model change from the RHI plumbing change is precisely what de-risks V4c, the largest slice in the campaign.

5.3 Why V4c was narrowed, and where V4t came from

A scouting pass over V4c (2026-07-27) stopped before writing code and reported two structural blockers. Both were verified against source; both were real.

The contract was missing a blend mode. WbDrawDispatcher.ApplyRetailBlend (WbDrawDispatcher.cs:3191) selects one of three blend functions from each DAT surface's TranslucencyKind: AlphaBlend → (SrcAlpha, OneMinusSrcAlpha), Additive → (SrcAlpha, One), and InvAlpha → (OneMinusSrcAlpha, SrcAlpha). The V0 contract shipped GpuBlendMode with only the first two. Blend is baked into the pipeline and is not dynamic, so this could not be worked around at the encoder; mapping InvAlpha onto StraightAlpha would have silently changed how every inverse-alpha surface composites. ParticleRenderer hits the same wall twice, so V4e was blocked on it too. Fixed by adding GpuBlendMode.InverseAlpha to the contract with a test asserting all three retail kinds are representable. This is the correct outcome of a pinned contract meeting reality: the contract grew, in one reviewed commit, rather than a slice inventing a workaround.

Retiring the interim handle table is its own slice. §5.2 assumed V4c could switch to the device's texture table. It cannot: the renderers do not own the bindless handles, they only intern them. A raw ulong is produced by TextureCache, CompositeTextureArrayCache, ManagedGLTextureArray and TerrainAtlas, baked into ObjectRenderBatch, and carried by GroupKey — the bucketing key V4c is explicitly forbidden to change — and by CachedBatch, where it is compared for cache validity. Switching to GpuTextureSlot therefore means porting the whole texture stack and retyping three data-model records, which is most of V4d and V4e plus work no slice contained. That is now V4t, with its own pixel gate. Until it lands, V4c/V4d/V4e bind their existing interim tables through the encoder as ordinary storage buffers at binding 9 — no new escape hatch.

Also deferred to V4h: ClipFrame's region buffer (binding 2) is read by terrain as well, and the SceneLighting UBO (binding 1) by terrain and the four viewport and portal renderers. GL binding points are global, so the safe move while those consumers are still raw GL is to leave both bound as they are and convert them with the spine.

5.5 The V4c/V4d revert (2026-07-27) and the re-land conditions

V4c and V4d were reverted at 543bc79f/b537f3a9/ad61f250 after the first connected sessions showed a blank world — UI rendered, sounds played, the log was clean, world-reveal reported visible=True, and the user hit one AMD driver timeout. The offline gate had passed both slices at noise level.

What the debugging established, with the connected screenshot-probe apparatus: the defect is intermittent (~1 in 3 at the worst location, 0 of 7 at the V4c parent) and scene-dependent; after the first world frame the default framebuffer's colour reads return garbage (float depth bytes) and glClear stops having any effect, with glGetError clean throughout — a GPU-side fault, not an API error. Every added CPU↔GPU sync point monotonically suppresses it, which also made the mechanism unprovable in situ. Best-supported cause: the frame ring performs 10–40 partial glBufferSubData updates per frame into a buffer object that already-submitted same-frame draws are still reading; the offline flat path issues 2–4 such updates, the connected PView path dozens — which is exactly the offline/connected axis. This likely also explains the TDR.

The contract amendments (111e7236 InverseAlpha, c7f5f251 integer vertex attributes + tiling binding) were kept — they are dark, test-covered, and correct.

Re-land conditions, binding:

1. The GL ring's write path moves to glMapBufferRange(WRITE | UNSYNCHRONIZED | INVALIDATE_RANGE) — the canonical GL ring idiom, which states the non-overlap invariant to the driver instead of leaving glBufferSubData-into-an-in-use- buffer to driver heuristics.
2. V4c and then V4d re-land as reverts-of-the-reverts plus the ring change, each gated by tools/run-repeat-connected-gate.ps1 at 10/10 rendered — a single connected run passes a broken binary ~70% of the time and gates nothing.
3. The offline pixel gate still passes, and the gate location stays pinned (failure rate is location-sensitive; stray input moves the character).

5.5.1 What the connected investigation established (2026-07-27/28)

Condition 1 landed at 8dec163f and did not fix the defect. The ring's glBufferSubData hazard is therefore falsified as the cause; the map change is kept because it is the correct idiom regardless, but the paragraph above naming it "best-supported cause" is superseded by what follows.

The defect does follow the V4c binary. Blank rate drifts with machine state — the same binary measured 3/10 in one block and 5/5 in another — so consecutive blocks of A then B confound the change with the drift, and the first attributions were made that way. tools/run-blank-world-ab-probe.ps1 interleaves the two builds inside one block so the drift is shared: 4/5 blank in the V4c arm versus 0/5 in the parent arm, p ≈ 0.024. That is the attribution; everything below is about mechanism.

What a blank frame actually looks like, from outside the process. tools/run-blank-world-surface-probe.ps1 grabs the composited window off the desktop with CopyFromScreen — a witness that shares nothing with the renderer below the compositor. On a blank frame the desktop shows the atmosphere clear colour and the complete retained UI, with all 3-D absent — including the raw-GL terrain and sky that V4c does not touch. So the frame is drawn and presented; what is missing is every depth-tested draw, and only those.

Meanwhile ACDREAM_PROBE_FLAP reports, on those same blank frames, 3,331 statics dispatched, the correct PView branch, fbo=0, the full viewport, scissor off, and zero GL errors. The CPU decided to draw the world and the GL calls were accepted.

Falsified: the ring glBufferSubData hazard; a capture-FBO binding leak; reveal ordering; the AMD TDR; and CPU-side visibility. Observed and unexplained: glReadPixels probes heal the bug, while glGetIntegerv-shaped state queries do not — so any instrument that reads pixels changes the thing it measures.

The verdicts themselves were unsound until 2026-07-28. The window is created with the quality preset's MSAA sample count, so the default framebuffer is 4x multisampled, and glReadPixels against a multisampled read framebuffer is undefined per the GL spec. Every automated pixel gate and every blank/rendered verdict in this campaign came through that read. FrameScreenshotController now blit-resolves the default framebuffer into a single-sampled RGBA8 framebuffer and reads that; a single-sampled default framebuffer keeps the original direct read. GlGpuDevice.CaptureBackbuffer routes through the same path, so there is one backbuffer read in the process rather than two instruments to keep sound. The offline gate's re-measured noise band is in §5.1: the resolve moved 23 pixels out of 563,200, exactly its own same-commit control, which says AMD's unspecified read was usually already returning the resolved image — and "usually" is what made it worthless as an instrument.

5.5.2 The shared-3-D-state hypothesis is falsified (2026-07-28)

The natural reading of "all 3-D dies, depth-disabled UI survives, the atmosphere clear shows" is that something shared by every depth-tested draw — and by no UI draw — is poisoned. Four candidates were tested against a V4c build staged from git revert --no-commit 543bc79f (never committed) with log-only glGet* probes at the frame clear and at world-pass entry/exit. All four are dead.

Candidate	How it was tested	Result
Depth plane (mask latched off across the clear, poisoned glClearDepth/glDepthFunc/depth range)	State sampled at pre-clear, post-clear, landscape-in, landscape-out	Bit-identical on blank and rendered frames. DEPTH_TEST=on, DEPTH_WRITEMASK=on, DEPTH_FUNC=GL_LESS, DEPTH_CLEAR_VALUE=1.0, range [0,1], viewport 0,0,1280,720, colour mask 1111, scissor/stencil/blend/cull off, MSAA on, no clip distances enabled
Camera constants	ViewProjection and eye logged at world-pass entry	Sane and advancing on blank frames; determinant -1.688e-01, eye stable at the pinned cell
gl_ClipDistance (all MaxPlanes are enabled unconditionally around sky/terrain/entities, so an unwritten distance would clip everything 3-D and nothing 2-D)	EnableClipDistances forced to a no-op	Blank rate 3/5, i.e. unchanged
GPU context reset (the "GPU-side fault" reading)	glGetGraphicsResetStatus in the same probe	1,814 samples across four blank runs: NO_ERROR every time

Two new facts were established, and they are sharper than anything before them.

1. Zero 3-D fragments are rasterized — the world is not drawn-then-hidden. Replacing only the frame clear colour with magenta (nothing else) makes a blank frame come back uniformly magenta with the complete retained UI on top. So the world is not being shaded to the fog colour, not being fogged out, and not being overdrawn: between the clear and the UI, not one 3-D fragment reaches the default framebuffer — while the CPU has dispatched the draws, GL accepted them, and every piece of state above is correct.

2. The in-process capture does not observe the presented surface at all. On a blank run the desktop grab shows the magenta clear plus the complete UI, and at that same moment the client's own capture of framebuffer 0 is RGBA(0,0,0,0) in every pixel — including the pixels where the UI is visibly on screen. This survives the §5.5.1 resolve fix, so it is a second, independent instrument fault: on a blank run, reading framebuffer 0 returns nothing even for content that demonstrably reached the display. Any verdict derived from screenshot bytes is therefore reporting the readback, not the renderer, and the MinRenderedBytes test in run-repeat-connected-gate.ps1 / run-blank-world-ab-probe.ps1 conflates the two. The desktop witness is currently the only trustworthy verdict and should be what those gates assert on.

The failure reproduces readily with a visible window (WasIconic=False throughout), so it is not a pixel-ownership artefact of the minimized gate window: 5/6, 4/5, 3/5 and 4/4 blank across four blocks at the pinned cell.

Where this leaves the mechanism. It is not renderer state and not a context reset; clears and UI draws reach the display while 3-D draws and pixel reads against the same framebuffer both come back empty. That combination points below the API — at how the default framebuffer's colour is being handled for this context — rather than at anything V4c writes. V4c has therefore not been re-landed, and no fix was attempted: the re-land conditions in §5.5 stand, but condition 2's gate must first be re-armed on the desktop witness, because the screenshot-byte verdict it uses is now known to be measuring the wrong thing. The next instrument should be an occlusion query (GL_SAMPLES_PASSED) around the world pass, read back a frame later so it adds no sync point — that separates "the draws never executed" from "they executed and their output was discarded", which is the remaining fork. That instrument was built and run — see §5.5.3, which supersedes this section's "shared 3-D state" framing.

5.5.3 The occlusion-query verdict (2026-07-28): the GPU stops reporting

The instrument §5.5.2 asked for was built and run on a V4c tree staged from git revert --no-commit 543bc79f (never committed), with GL_SAMPLES_PASSED bracketing three sites — the raw-GL terrain draw, the dispatcher's entity draws, and the retained-UI flush — and the counts collected later, never in the frame that issued them. The desktop witness was the verdict throughout. All probe code was stripped before this commit; the apparatus changes that survive are the two gate scripts, now asserting on the desktop grab.

Building it turned up a fourth instrument fault, and it is the sharpest one. The obvious readback — glGetQueryObject into client memory, guarded by GL_QUERY_RESULT_AVAILABLE and read a frame late — deadlocks the client on V4c. Four consecutive runs wedged at the first frame that draws the world, and five dotnet-stack samples taken four seconds apart all show the render thread inside the driver under GlDrawCounterProbe.Drain, i.e. blocked in glGetQueryObject. It is not a probe defect: the identical probe ran 4,420 frames on the V4c parent with normal counts and a normal 5 ms frame time, and the wedge does not need the world sites at all — instrumenting only the UI flush reproduces it, while creating the query objects and never beginning one does not. So on V4c, the mere existence of an outstanding occlusion query is enough to make a CPU-side result read never return.

The way past that is to never ask the driver for a result on the CPU timeline. The query result is instead written into a persistently-mapped, coherent GL_QUERY_BUFFER: glGetQueryObject with that buffer bound performs the write on the GPU timeline, so no client wait is possible by construction, and pre-filling each slot with a sentinel makes "the GPU reported zero samples" and "the GPU never reached this command" different observations. That instrument does not wedge, and it produced the table below.

Per-frame counters, blank versus rendered, four runs on one V4c binary — three blank and one rendered on the desktop witness, both instruments agreeing on the label in every run:

	terrain	entities	UI	frames logged
Rendered run (run 3)	1,718,771	~312,600	541,445	1,068, zero no-result
Blank runs (1, 2, 4), steady state	no result	no result	no result	~950 each, every query
Blank runs, frame 43 (the one early world frame)	1,692,830	317,561	no result	—
Parent build, same probe, frame 45	1,692,830	317,561	539,0xx	4,420, zero pending

Four things follow, and they are worth separating.

1. The mission's three-way fork resolves to the third branch — but not as "submission stalls". On a blank run no query result is ever produced, at any site, for the whole run. It is emphatically not "zero samples": the sentinel is untouched, so the GPU never executed the write. And yet the process is not stalled — frame time stays at a steady 5.5 ms for ~3,700 frames, the frame-flight fences keep retiring (GpuFrameFlightController.RetireFence spins on glClientWaitSync until the fence signals, so a stalled submission would freeze the client outright), and the compositor keeps showing the clear colour and the complete retained UI. The GPU is running the frame. What has stopped is everything the GPU is asked to report.

2. The failure is total, not 3-D-specific. The UI query dies on a blank run too — in the same frames where the desktop witness plainly shows the UI on screen. §5.5.2 read the symptom as "something shared by every depth-tested draw is poisoned"; that framing is now too narrow. Every GPU→CPU reporting channel tested is dead on a blank run — glReadPixels of framebuffer 0 returns RGBA(0,0,0,0) even over visible UI pixels, a CPU query read blocks forever, a GPU-timeline query write never lands — while the two channels that carry no result, fence signalling and present, keep working. The common factor is the direction: nothing comes back.

3. The transition is a single sharp event at the first world frame, and it is irreversible. In every blank run the UI query returns normal counts (539,010) for frames 1–42, the world draws for the first time at frame 43, and from that frame on nothing is ever reported again — 924 consecutive dead frames in run 1. The rendered run has no world draw at frame 43 (its first is frame 1,080) and never loses a single result. This is the same "after the first world frame" boundary §5.5 recorded from the colour reads, now measured on a second, independent channel.

4. That first world frame rasterizes correctly — identically on both builds. Frame 43 reports 1,692,830 terrain samples and 317,561 entity samples on V4c, and the parent's first world frame reports the same two numbers. The world is drawn, in full, exactly as the good build draws it. It is the last thing the GPU ever tells this process, and V4c is what decides whether that is the last thing.

Where this leaves the mechanism. Everything now points at the GPU→CPU reporting path for this context collapsing at the first world frame, with V4c's submission pattern as the trigger and nothing in V4c's own state as the cause — V4c does not touch the terrain draw, does not touch the UI flush, and §5.5.2 already showed its renderer state is bit-identical on blank and rendered frames. A clean context with glGetGraphicsResetStatus = NO_ERROR on 1,814 samples does not lose its readback, its query results, and its ability to answer a query without blocking, all at once, because of anything expressible in the API. No fix was attempted and V4c is still not re-landed.

5.5.4 Strategic options

Three ways forward, with the evidence for each.

(A) Keep hunting for a V4c-side trigger we can remove. The attribution is solid (§5.5.1: 4/5 versus 0/5 interleaved, p ≈ 0.024), so a trigger exists in the V4c diff and removing it would restore the no-fork plan. Against it: five mechanisms have now been falsified — the ring's glBufferSubData hazard, a capture-FBO leak, reveal ordering, shared 3-D state (depth plane, camera, clip distances, context reset), and CPU-side visibility — and the two facts that remain are not expressible in the API, which is exactly the shape of a hunt with no bottom. The remaining honest step would be a RenderDoc or GPU-crash-dump capture of the frame-43 boundary, or a bisect of the V4c diff into ~6 sub-commits each measured at 5 runs, which is roughly 3 hours of connected machine time per round and pins the user's machine for it.

(B) Accept it as an AMD GL driver defect, keep the world on the legacy raw-GL path on the GL backend, and carry the V4c/V4d RHI ports forward for Vulkan only. This is what the evidence supports: a defect that (i) follows a submission-pattern change, (ii) is invisible to every API-level state query, (iii) kills three unrelated readback channels simultaneously while leaving present and fences intact, and (iv) can be induced harder by adding a perfectly legal occlusion query, is a driver defect in 26.6.4 on the RX 9070 XT, not an application bug. The cost is real and must be stated plainly: it breaks §3.1's no-fork rule for the world path, so the GL backend keeps raw-GL world renderers while Vulkan gets RHI ones, and V4h's "seam complete" milestone can no longer mean "nothing raw-GL remains". V7's GL-versus-Vulkan differential then compares a raw-GL world against an RHI world rather than one contract against two backends, which weakens it precisely where it is most valuable. It also leaves the deleted-at-V11 GL path carrying code the campaign intended to retire early.

(C) Reorder the campaign: bring Vulkan up first (V5/V6) and decide V4c afterwards. This is the option the evidence actually suggests and it is not on the original menu. The whole point of V4c is to make the world path backend-agnostic; its only consumer that matters is Vulkan. If the GL stack of this driver is what breaks, then running the same ported code on the Vulkan backend is both the cheapest test of hypothesis (B) — if the identical RHI world path renders correctly on Vulkan on the same GPU, the defect is in the driver's GL stack, conclusively and in one measurement instead of a multi-hour bisect — and the shipping path. The sequencing cost is that V5/V6 must be written against an RHI whose world-path consumer is proven only offline, and that V4c's diff sits un-landed on a branch meanwhile; the sequencing invariants in §5.4 would need V4c/V4d/V4t moved after V6, with V4a/V4b/V4e/V4f/V4g (all landed or independent) unaffected.

Recommendation: (C), with (B) as its fallback. (A) is the only option with no bounded cost and the worst prior — five falsified mechanisms and two facts that live below the API. (B) is probably the right conclusion, but adopting it now means paying the no-fork penalty on the strength of an inference; one Vulkan bring-up turns that inference into a measurement, and it is work the campaign has to do regardless. If the RHI world path renders on Vulkan on this GPU, (B) is proven and can be adopted deliberately, with the fork scoped and documented rather than assumed. If it fails on Vulkan too, then the defect is ours after all, the trigger is in code we own, and (A) becomes worth its cost because it would then have a much smaller haystack.

Re-land conditions, updated. §5.5's three conditions stand, with two amendments: condition 2's gate now asserts on the desktop witness (tools/run-repeat-connected-gate.ps1 and tools/run-blank-world-ab-probe.ps1 grab the composited window and treat the client's own capture as a recorded second column), and no re-land attempt should be made before the (C) measurement, because a 10/10 pass on this machine cannot distinguish a fix from the defect's ordinary ~1-in-5 quiet streak.

5.5.5 Decision (2026-07-28): the GL re-land of V4c/V4d is PARKED, V6 is brought forward

Option (C) of §5.5.4 is adopted. No further GL-side attempt is made to re-land V4c or V4d until the Vulkan world path has been measured. V5 landed at e8a4c1af — the capability gate passes on the RX 9070 XT, Vulkan 1.4.349, AMD driver 2.0.395, with a B8G8R8A8Unorm swapchain presenting the clear colour and the forced-unsupported knob returning exit 4. V6 follows immediately; V4c and V4d stay un-landed on their branches meanwhile.

Grounds. The evidence in §5.5.1–§5.5.3 converges on one shape, and it is not the shape of an application bug.

• The world is drawn correctly, once. §5.5.3's frame 43 reports 1,692,830 terrain samples and 317,561 entity samples on V4c and byte-matches the parent build's first world frame on both counters. Whatever goes wrong is not a rasterization difference; the ported path draws exactly what the working path draws.
• Then one irreversible event kills every GPU→CPU return channel at once. From that frame on, glReadPixels of framebuffer 0 returns RGBA(0,0,0,0) even over UI pixels the desktop witness plainly shows on screen; a guarded glGetQueryObject read never returns and deadlocks the render thread inside the driver; and a GPU-timeline GL_QUERY_BUFFER write never lands, leaving the pre-filled sentinel untouched. The transition is sharp, total, and permanent — 924 consecutive dead frames in run 1.
• Meanwhile the channels that carry no result keep working. Present and fence signalling continue at a steady 5.5 ms for ~3,700 frames. The GPU is running the frame; it has stopped reporting. The common factor is direction, not subsystem — the UI query dies alongside the world queries, so §5.5.2's "shared 3-D state" framing is superseded.
• Every API-level explanation has been eliminated. glGetError is clean throughout, and glGetGraphicsResetStatus returned NO_ERROR on 1,814 samples across four blank runs. Five mechanisms are falsified: the ring's glBufferSubData hazard (§5.5.1, and condition 1 landed at 8dec163f without fixing it), a capture-FBO binding leak, reveal ordering, shared 3-D state (depth plane bit-identical, camera sane, clip distances forced off changed nothing, no context reset), and CPU-side visibility (3,331 statics dispatched on blank frames).
• Four independent instrument faults, all below the API, all on one driver. The multisampled glReadPixels (§5.5.1), the in-process capture that cannot see the presented surface (§5.5.2), the deadlocking CPU query read and the never-executed GPU-timeline query write (§5.5.3). A perfectly legal occlusion query makes the failure worse. All of it on AMD 26.6.4, RX 9070 XT — one driver, one GPU, no second data point.

A context that loses its readback, its query results, and its ability to answer a query without blocking — simultaneously, on a clean reset status — has failed in a way not expressible in the API. Continuing to bisect the V4c diff (option A) costs roughly three hours of connected machine time per round, pins the user's machine, and has five falsified mechanisms behind it.

Decision rule. The same ported world path running on Vulkan on the same GPU is the decisive discriminator, and it yields a verdict in one measurement instead of a multi-hour bisect:

• Clean on Vulkan ⇒ the driver defect is proven. Option (B) is then adopted deliberately rather than inferred. GL keeps the legacy raw-GL world path through to V10 as a documented, scoped exception to §3.1's no-fork rule, confined to the thin submission seam — the world renderers, not the contract. The consequences must be carried explicitly: V4h's "seam complete" milestone no longer means "nothing raw-GL remains," and V7's differential compares a raw-GL world against an RHI world rather than one contract against two backends, which weakens it exactly where it is most valuable.
• Fails on Vulkan too ⇒ the trigger is ours. The defect is then in code we own, and (A) becomes worth its cost because the haystack is far smaller: a fault reproducing on both backends is a property of the ported path itself, not of a driver's GL stack.

5.5.6 Cross-vendor verdict (2026-07-28): NVIDIA renders the V4c binary 10/10

The missing second data point arrived before the Vulkan one. The exact V4c binary — published from eb2ba4e5 + git revert --no-commit 543bc79f, and verified to be the V4c build by its embedded wb-mesh-* pipeline-name literals, which the HEAD build on the AMD machine provably lacks — ran the full ten-cycle repeat-connected gate on a separate NVIDIA PC against the same ACE instance, same account, same pinned worst-case cell, desktop-witness verdict:

10/10 RENDERED. Ten clean runs bound the NVIDIA failure rate below ~4% at 90% confidence, against a measured 30%+ (up to 5-of-5) on the AMD box, where the interleaved A/B probe had already pinned the defect to this binary at p≈0.024.

Same binary, same server, same scene, two GL drivers: only AMD's fails, and it fails below the API in four independent instruments. The driver-defect conclusion is adopted as established (AMD 26.6.4 GL stack, RX 9070 XT). The Vulkan world-path measurement remains worth taking when V6 completes — as the shipping path's own proof, no longer as the discriminator. Per the §5.5.5 decision rule this selects option (B): the GL backend keeps the legacy raw-GL world path through to V10 as the documented, scoped fork exception, and the RHI world path ships on Vulkan. V4c/V4d's GL re-land is closed, not merely parked; their content returns as the Vulkan world path.

Sequencing. V5 and V6 execute next, in that order. V4t and V4e–V4h are re-sequenced after the verdict, not before it — V4h in particular cannot be specified until it is known whether "nothing raw-GL remains" is still reachable. V4a and V4b are landed and unaffected. §5.5's re-land conditions remain binding on any eventual V4c/V4d re-land, including the §5.5.4 amendment that the gate asserts on the desktop witness.

What this costs. V5 and V6 are written against an RHI whose world-path consumer is proven only offline, and V4c's diff sits un-landed on a branch for the duration. Both were accepted as the price of turning an inference into a measurement — and V6 is work the campaign has to do regardless.

5.5.7 V6f (2026-07-28): the fork cannot be built yet, and why

§5.5.6 selected option (B) — "the RHI world path ships on Vulkan", V4c/V4d's content returning as the Vulkan world path behind a fork at the thin submission seam. V6f set out to build that fork and measured, instead, that there is nothing for it to select between on the Vulkan side. The finding is recorded here so the next slice inherits it rather than rediscovering it.

The Vulkan path constructs no game state at all. GameWindow.Run branches at GameWindow.cs:683 and returns at :695 — before Window.Create, before _windowCallbacks.Attach(), and therefore before OnLoad, which is the sole caller of GameWindowCompositionPipeline.Run. On Vulkan not one composition phase executes: no DAT loading, no LandblockStreamer, no camera, no entity table, no world renderer. VulkanBringUpHost is a second main() that opens its own window and presents VulkanRhiScene + VulkanRetainedUiScene, both of which document themselves as synthetic. A V6f capture confirms it visually (artifacts/vk-world/): checkerboard mip quads, a gradient sphere, two debug polylines and a generated UI sprite with system-font glyphs. Correct, and not Dereth.

So a backend-selected fork inside WbDrawDispatcher / EnvCellRenderer / TerrainModernRenderer would today have a GL arm that runs and a Vulkan arm that nothing can reach. That is ~2,000 lines of duplicated submission code with no consumer and no gate — precisely the "unexercised second path" shape §3.1 and §7.1 rule 3 exist to prevent.

And the parked V4c/V4d code could not drive Vulkan even if reached. V4c binds its texture table as an ordinary storage buffer of packed GL_ARB_bindless_texture uvec2 handles (wb-texture-table) because §5.3 deferred the real port to V4t. ObjectRenderBatch.BindlessTextureHandle is a raw ulong, and GroupKey — the bucketing key V4c is forbidden to change — carries it. On Vulkan that buffer is meaningless: the table is set 2's opaque descriptor array. V4t is a hard prerequisite, not a parallel track, and it is ~4,400 lines across TextureCache, CompositeTextureArrayCache, ManagedGLTextureArray, TerrainAtlas and BindlessSupport, plus retyping three records that fan out into five renderers and one cache-validity comparison. Landing the fork before V4t means writing the RHI world path twice, because V4t rewrites exactly the code the fork's Vulkan arm would contain.

Two defects the validation layer found, both pre-existing V6b–V6d, both blocking the world path. One full run with VK_LAYER_KHRONOS_validation (artifacts/vk-world/client.log) reported seven distinct VUIDs:

1. VUID-VkPipelineLayoutCreateInfo-descriptorType-03032 and -pSetLayouts-03040 — "sum of dynamic storage buffer bindings among all stages (10) exceeds device maxDescriptorSetStorageBuffersDynamic limit (8)." VulkanPipelineLayouts.cs:101,108 declares all GpuBindingModel.StorageBindingCount = 10 storage bindings as StorageBufferDynamic, and the RX 9070 XT allows 8. This is the pinned binding model meeting a real device limit, and the world path is the consumer that needs all ten bindings. It wants a decision, not a patch: make the rarely-rebound bindings non-dynamic, or split them across sets. It fires today only because the verification scene builds the same layout.
2. VUID-vkCmdDraw-dynamicRenderingUnusedAttachments-08914 / -08917 — the vk-scene-line pipeline declares depthAttachmentFormat = VK_FORMAT_UNDEFINED while the pass carries a D32_SFLOAT_S8_UINT depth attachment. VulkanGpuPipeline.cs:184,187 sets the format only when Depth.Test || Depth.Write, so any depth-off pipeline in a pass that has depth is malformed. Debug lines are depth-off; so is a lot of UI.
3. VUID-vkCmdBeginRendering-pRenderingInfo-09588 / -09590 / -09592 — vk-backbuffer-depth and vk-backbuffer-msaa-color are in VK_IMAGE_LAYOUT_UNDEFINED at vkCmdBeginRendering. A missing first-use layout transition on the backbuffer attachments.

Worth recording: the render-target-view-in-table usage from V6c that §5.5.6's brief expected did not fire in this run. Either it needs the paperdoll path the bring-up host never exercises, or it is not a validation error. Do not carry it forward as a known-and-accepted item without re-checking.

Recommended sequencing. The fork is real and still the plan; it simply comes after its prerequisites, in this order:

1. A Vulkan composition host — a slice the plan has never scoped. Either GameWindow's composition becomes backend-parameterised (most of V4h) or the Vulkan host gains a world, which must borrow the same CPU owners rather than fork them.
2. The three validation defects above, since every one of them is on the path any world frame takes.
3. V4t, the texture stack. Nothing world-shaped can sample a texel on Vulkan until GpuTextureSlot replaces the ulong bindless handle end to end.
4. Then V4c/V4d's content returns as the Vulkan arm of the fork, behind a construction-time backend selection at the submission seam, with the GL arm untouched.

A cheaper intermediate milestone exists and is worth considering: terrain only on Vulkan — steps 1, 2, a partial 3 and V4d's plumbing — renders terrain, water and sky with no scenery or statics, and would be the first real evidence the Vulkan world path works. V6f's shader work is the whole of that path's shader prerequisite.

5.5.8 V6g (2026-07-28): the validation defects are closed, and a fourth was found

§5.5.7's step 2 — "the three validation defects, since every one of them is on the path any world frame takes" — is done, and the Vulkan bring-up host now runs validation-clean: zero errors and zero warnings across a 39,855-frame run with VK_LAYER_KHRONOS_validation loaded, against the same run that produced seven of them at f8dbe2ee.

1. The dynamic-descriptor limit (VUID-VkPipelineLayoutCreateInfo-descriptorType-03032 / -pSetLayouts-03040). Resolved by decision rather than patch, as §5.5.7 asked. V6b declared all ten of set 0's bindings STORAGE_BUFFER_DYNAMIC; the rule now is that a dynamic descriptor is for ring-fed data whose offset moves, and nothing else. Instances (0), batches (1), clip slots (3) and instance light sets (5) stay dynamic; global lights (4), clip regions (2), instance indoor (6), alpha (7), selection lighting (8) and the GL-only texture table (9) become plain STORAGE_BUFFER carrying their offset in the descriptor. That is four dynamic storage descriptors — not merely under the RX 9070 XT's 8 but exactly Vulkan's guaranteed minimum, so no conformant device can fail the layout, which is what V9's lavapipe row and the deferred physical Linux row depend on. The count is asserted against maxDescriptorSetStorageBuffersDynamic in the capability record, so a device that cannot serve it is rejected at startup under the exit-code-4 contract instead of failing at vkCreatePipelineLayout. Bindings 6–8 are per-instance arrays grouped with the frame-global tables because their owner writes them whole once per frame; if the Vulkan world path needs one re-pointed per draw, promoting it back is one line, with four unused dynamic slots to promote into.

2. Depth-off pipelines in depth-carrying passes (VUID-vkCmdDraw-dynamicRenderingUnusedAttachments-08914 / -08917). The backend now builds two variants of every pipeline — one declaring the pass's depth/stencil format, one declaring UNDEFINED — and binds whichever matches what vkCmdBeginRendering was actually handed. The same GpuPipelineDescription is legitimately used in both kinds of pass (ui-text opens its own depth-less pass; the world pass it composites over has depth), so the description genuinely cannot answer the question. A later slice entitled to change the contract should add a depth-format field the way V6d added ColorFormat; until then, materialising both at startup against the persisted cache is the honest expression of the gap and no frame ever compiles one.

3. Missing first-use layout transitions (VUID-vkCmdBeginRendering-pRenderingInfo-09588 / -09590 / -09592). vk-backbuffer-depth and vk-backbuffer-msaa-color are created UNDEFINED and were never moved. Both now get a barrier on every backbuffer pass: from UNDEFINED on the first use after Configure, and from the attachment-optimal layout with a write-after-write dependency thereafter — the same shape the swapchain image already had. The dependency matters independently of the layout: two passes in one frame write both images, and so does the next frame, with no implicit ordering between render-pass instances.

4. The capture path read an image it did not own (UNASSIGNED-non-acquired-swapchain-image-used). Present in V6f's log and not called out there. CaptureBackbuffer transitioned the last presented swapchain image to TRANSFER_SRC and copied out of it; after vkQueuePresentKHR that image belongs to the presentation engine and its contents are not the application's to read. The pixels were usually right — which is exactly what makes it unacceptable. This campaign spent §5.5.1–§5.5.3 discovering what a capture instrument that is "usually right" costs, and shipping the same shape on the new backend would have made every Vulkan PNG, and the V7 differential built on them, formally undefined. The frame now copies its own output into a host-readable buffer while it still owns the image, and CaptureBackbuffer reads that. Retention is opt-in (armed when an artifact directory exists) because it costs one full-res image-to-buffer copy per frame: worth nothing to a player, and the entire instrument to a gate.

Two gaps recorded, not fixed — both outside this slice's brief, both real:

• UniformSkyParams (set 1, binding 4) is not in the uniform set layout, which declares only bindings 1 and 3, and VulkanFrameBindings.UniformBindingCount is 4, so SetUniform(4, …) throws before it can be wrong. The sky pair compiles to SPIR-V declaring that binding, so whoever first draws sky on Vulkan must add it.
• A binding pointed at two different buffers within one frame silently corrupts the earlier draws, on dynamic and plain descriptors alike: SetStorage rewrites the descriptor when the buffer changes, and descriptor contents are read at execution time, not record time. No consumer does this today. The world path will: WbDrawDispatcher and EnvCellRenderer each own their own instance and batch buffers and both bind bindings 0, 1, 3, 4 and 5 in one frame. The Vulkan world arm needs one descriptor set per renderer, or per-renderer sub-ranges of one buffer, and it needs to know that before it is written.

5.5.9 The Vulkan composition host: the seam, measured (V6g)

§5.5.7's step 1 asked for "a Vulkan composition host — a slice the plan has never scoped." V6g scoped it and did not build it. What follows is the specification, so the slice that does build it starts from a file list rather than a survey. The short version: it is most of V4h, it is roughly 1,200–2,000 changed lines across ~20 files including GameWindow.cs, and it is a load-bearing slice in its own right — not a preface to one.

The fork seam is already there, in three places, and only one of them is missing.

1. Platform acquisition is already backend-neutral. GameWindowPlatformResult<TGraphics, TInput> and IGameWindowPlatformPublication<TGraphics, TInput> (Composition/GameWindowPlatformAcquisition.cs:3,11) are fully generic. Only the call sites pin TGraphics = GL. Nothing in the acquisition machinery needs changing.
2. The host phase already has a factory interface built for exactly this substitution. IHostInputCameraCompositionFactory (Composition/HostInputCameraComposition.cs:49) declares CreateViewportTarget, CreateGpuFrameFlights, CreateGpuDevice and CreateWorldRenderDiagnostics, each taking a GL, with one implementation (RetailHostInputCameraCompositionFactory). A VulkanHostInputCameraCompositionFactory returning VulkanGpuDevice is the fork, and it is a new file, not a modification. The four signatures lose their GL parameter and take the platform result instead.
3. The frame root is the seam that does not exist yet, and it is the real work. FrameRootComposition builds RuntimeRenderFrameClearPhase, RetailPViewPassExecutor, WorldScenePassExecutor and FrameProfilerGpuMeasurement from d.Gl plus six raw-GL world renderers (live.DrawDispatcher, live.EnvCellRenderer, foundation.Terrain, live.SkyRenderer, live.ParticleRenderer, live.PortalDepthMask). On Vulkan none of those exist, so the Vulkan arm is a second frame-root assembly whose render graph is the retained UI and debug lines through the RHI and nothing else. That is the slice's centre of gravity.

What the retained UI actually needs — better news than §5.5.7 implied. V6f wrote that "the retail widget tree is built from LayoutDesc and DAT chrome by TextureCache, which is still a GL type until slice V4t." That is true of the type but not of the UI's texture path, which V4a and V6d already moved onto IGpuDevice: TextureCache.UploadUiTexture (Rendering/TextureCache.cs:311) goes through CreateTexture/CreateSampler/RegisterTexture, and the public UploadRgba8 that IconComposer composes retail icons with routes into it. The raw-_gl uploads that remain are the world's Texture2D/Texture2DArray paths, which no UI draw reaches. Three things, all small, stand between the real UiHost and a Vulkan frame:

• TextureCache's constructor requires a non-null GL (:21).
• UploadUiTexture hard-casts to GlGpuTexture for VRAM accounting (Rendering/TextureCache.cs:337: uint glName = ((GlGpuTexture)texture).GlName;).
• InteractionRetainedUiComposition:533 builds the UI-probe FrameScreenshotController from d.Gl, reachable only when ACDREAM_UI_PROBE is on.

So the retained UI is not V4t-blocked; the world is. That is the one place §5.5.7's sequencing should be read more precisely: V4t is a hard prerequisite for step 4 (the world arm), not for step 1.

The mechanical remainder, for estimation: GL appears concretely in five dependency records (FrameRootDependencies.Gl, LivePresentationDependencies.Gl, InteractionRetainedUiDependencies.Gl, plus the host and settings phases), each guarded by a ReferenceEquals(_dependencies.Gl, platform.Graphics) consistency check that has to become backend-aware. SettingsDevToolsComposition is ImGui, which is not ported and is deleted at V11, so the Vulkan arm simply omits DevTools. GameWindow.Run opens a ContextAPI.OpenGL window with MSAA and stencil attributes; the Vulkan arm needs WindowOptions.DefaultVulkan and the instance/surface/device/swapchain sequence VulkanBringUpHost.CreateWindow through CreateFrameResources already performs — that code is reusable, which is the argument for reducing VulkanBringUpHost to a capability-probe harness rather than deleting it outright.

Corrected sequence, superseding §5.5.7's four steps:

1. The three validation defects — done at V6g (§5.5.8). They came first because every one is on any world frame's path, and because a host built on a frame that fails validation cannot be debugged.
2. The Vulkan composition host, as specified above, delivering DAT load, streaming, camera, entity table, session and the real retained UI on Vulkan, with no world renderers. Its gate is an offline Vulkan launch reaching the real composition with a captured UI frame, a converging ownership ledger at shutdown, and the strict GL offline gate unmoved.
3. V4t, the texture stack — done at b8bcaa3e/565c351f (§5.5.11).
4. The world arm — V4c/V4d's content behind the construction-time backend selection at the frame-root seam.

Step 2's own acceptance criterion — "the real UI renders" — is what makes it worth doing before V4t rather than after: it is the first frame acdream draws on Vulkan that is the client's frame rather than a scene written to prove the backend.

5.5.10 V6h (2026-07-28): the Vulkan composition host is built

§5.5.9's step 2 is done. ACDREAM_RENDER_BACKEND=vulkan now runs the real composition: GameWindow.Run opens a WindowOptions.DefaultVulkan window, platform acquisition publishes a Vulkan graphics handle, and every one of the nine composition phases executes. The offline log is the client's own — prepared assets: opened acdream.pak, spells: loaded 6266 entries, sky: loaded Region 0x13000000, loading world view centered on 0xA9B4FFFF, the fourteen retail LayoutDesc lines, streaming: nearRadius=4 farRadius=12 — and the captured frame is the retail retained UI: vitals window, combat/spell bar with DAT scarab icons, the nine-slot toolbar with backpack and dove chrome, the chat window with its tabs and Send button, and the radar/compass with dat-font N/E/S/W glyphs. Sampled against the GL capture the widgets agree — chat interior RGBA (25,24,27,158) versus (22,21,23,158), vitals bar (117,1,0) and toolbar slot (0,11,17) identical. The background is the atmosphere fog colour because there is no world behind it, which is the slice's declared scope.

The estimate held. §5.5.9 predicted ~1,200–2,000 lines across ~20 files including GameWindow.cs; the commit is 22 modified and 5 new files.

What the three seams became.

1. Platform acquisition publishes GameWindowGraphics — an abstract handle with an OpenGl and a Vulkan subclass — instead of a bare GL. Every phase that still speaks raw GL asks Graphics.Gl and takes its Vulkan arm when the answer is null; each such branch names the slice that will remove it. The dependency records' ReferenceEquals consistency checks are unchanged in kind, only in type.
2. VulkanHostInputCameraCompositionFactory is a new file and the whole of the Phase-1 fork. Four members differ — viewport target, frame flights, GPU device, GL state tripwire; input, camera and pointer construction delegate to the retail factory because they are platform concerns, not graphics ones. The default factory is now chosen inside the phase from the platform result rather than at the call site. HostInputCameraResult gained backend-neutral Retirement and FrameSlots views: on GL both are the fence ring, on Vulkan the device's timeline-backed queue and flight controller.
3. The frame root forks on one condition. The GL world-scene assembly is unchanged and merely wrapped in if (gl is not null); the Vulkan arm's render graph is VulkanRenderFrameClearPhase (one backbuffer clear pass computing the same RenderFrameFoundation from the same clock and weather owners) plus the private-presentation phase that composites the retained UI.

§5.5.9's three TextureCache couplings are unpicked. The constructor takes GL? and rejects a bindless argument without one; world entry points route through a Gl property that throws naming slice V4t; and the (GlGpuTexture)texture VRAM-accounting cast became a backend test, with a descending synthetic counter supplying the dictionary key off GL. Worth recording: that cast's stated reason — TextRenderer.DrawSprite's texture-unit binding — was already stale, deleted at V6d. Nothing draws with the value.

One latent Vulkan defect was exposed and fixed, and it was ours. The first composition-host frame died with ErrorDeviceLost at vkQueueSubmit2, and validation named it: VUID-vkCmdDraw-None-08600, "the VkPipeline statically uses descriptor set 2, but because a descriptor was never bound, the VkPipelineLayouts are not compatible." VulkanGpuPassEncoder bound sets 0/1/2 only as a side effect of BindStorageBuffer/BindUniformBuffer, so a pass whose pipeline samples the texture table but binds no buffer — every retained-UI and debug-line pass, whose per-draw data travels in push constants and a vertex buffer — drew with the table unbound. It survived V6c–V6g because the bring-up host always drew VulkanRhiScene first and its storage binds left all three sets bound in the same command buffer; the UI pass inherited them. The composition host has no 3-D scene, so its UI pass is first and inherits nothing. The fix is one line in the encoder's constructor, beside the viewport and scissor defaults that exist for exactly the same reason: a pass must open with complete binding state rather than depend on what preceded it in the frame. This is the third instance of the project's "latent bug masked by a wider path" class, and the first on Vulkan.

What the Vulkan arm deliberately does not have, each with the slice that brings it: the world renderers and the terrain blending tables (V4t, then the world arm — streaming still runs and builds real heightfields and collision, but publishes into no GPU state and every surface resolves to SurfaceInfo.None); DevTools, because ImGui is not ported and V11 deletes it; the GPU-timer bracket, because FrameProfiler's query ring is GL-only and IGpuDevice.Timers replaces it at V4h; and the portal tunnel, whose renderer is raw GL — the teleport owner drives a presentation reporting "no tunnel showing" while reveal generation, destination latch, placement and session run unchanged.

Gate results, at the committed b16f8206. The strict GL offline pixel gate against 46d893f7 measures 1.78e-05 (10 differing pixels of 563,200), and measured 1.24e-05 on the immediately preceding tree — both well inside the documented 15–23 px / ≤4.1e-05 band, so GL behaviour did not move. App tests 4,075 / 3 skips; complete Release suite 9,138 / 5 skips. One full Vulkan run with VK_LAYER_KHRONOS_validation: zero errors, zero warnings, an empty stderr, and the captured UI frame identical to the pre-commit one. Every Vulkan run shut down with the ownership ledger converged — no [shutdown] diagnostic on either stream, which is GameWindowLifetimeStatus.Complete. The reduced probe harness (ACDREAM_VULKAN_PROBE=1) presented 34,811 validation-clean frames and resolved its GPU timer scopes.

One pre-existing test-isolation defect was found and is not this slice's. StreamingControllerPriorityApplyTests.DungeonCollapseBeforePromotionBase_RetiresProvisionalTerrainAndPendingStatics fails when run alone under --filter and passes when its project runs whole. It does so identically at 46d893f7 with none of this slice's changes present, so it is an order dependency in the test itself, not a regression. Worth fixing on its own; a test that only passes with its siblings is not evidence.

Next is V4t, the texture stack, which the world arm cannot be written without. §5.5.9 sized it: 69 references across 9 source and 4 test files for the ulong bindless handle alone, on top of TextureCache, CompositeTextureArrayCache, ManagedGLTextureArray, TerrainAtlas and ObjectMeshManager's material path. Two things this slice learned should go into it: the composition host is now a real consumer, so V4t's Vulkan side can be exercised the moment it exists; and §5.5.8's recorded one-binding-two-buffers hazard is still unfired, because nothing on the Vulkan arm yet binds the same storage binding to two buffers in one frame. The world arm will.

5.5.11 V4t (2026-07-28): the world's data model is backend-neutral

§5.5.9's step 3 is done, in two commits — b8bcaa3e (terrain) and 565c351f (everything else). Every world batch now carries a GpuTextureSlot rather than a raw 64-bit ARB_bindless_texture handle, and the four interim GlBindlessHandleTable instances in WbDrawDispatcher, EnvCellRenderer, TerrainModernRenderer and ParticleRenderer are gone. The Vulkan world arm's prerequisite is met: its batch structs are already the shape it needs.

§5.2's reason not to reach the device's table expired rather than being worked around. That paragraph's argument was the flush — GlGpuDevice drains its dirty table runs inside FlushBeforeDraw, which only an encoder-recorded draw reaches, so a raw-GL renderer would sample a stale table. It assumed V4c would move those renderers onto the encoder. §5.5.6 closed the GL re-land, so they stay raw GL through to V10 and "wait for the encoder" became an indefinite block on the one slice the Vulkan world arm cannot be written without. The resolution is two internal members — FlushTextureTable (the drain, factored out of FlushBeforeDraw) and the already-existing TextureTableGlName — which each raw-GL renderer calls immediately before its own draw, in the exact shape its private table had. Both are deleted with the raw-GL world path.

The slice was narrower than §5.3 sized it, in a way worth recording. §5.3 wrote "porting the whole texture stack", and the V4t row said "onto IGpuTexture/IGpuSampler". What landed keeps texture CREATION and residency with the caches — ManagedGLTextureArray, CompositeTextureArrayCache's GL backend, TerrainAtlas and TextureCache's array upload all still speak raw GL — and moves only the TABLE ENTRY to the device, keyed 1:1 by the caller's already-resident handle. That is the whole of what the data model needed, and it is what let one slice retype nine source and five test files instead of rewriting three texture caches. Creating world textures through IGpuTexture is real remaining work and it belongs with the Vulkan world arm, which is the first thing that cannot use a GL handle at all.

Slot release is stricter than the tables it replaces. The interim tables never released — entries accumulated for the renderer's lifetime, by design and by comment. The device's table is capped at GpuBindingModel.TextureTableCapacity (16,384), so an unreleased entry is now a leak with an end, and every producer retires its own: the composite backend and the particle backend at MakeNonResident, and ObjectMeshManager when a retiring atlas's physical retirement completes. Teardown deliberately does not release — the device dies with its callers, and deferring through a possibly-disposed retirement queue would turn a clean shutdown into a throw.

The default value became load-bearing. BindlessTextureLocation could signal "not resolved" with handle 0 because no texture has handle 0. A slot index has no spare value — default(GpuTextureSlot) is real slot 0 — so the type is now a struct storing its slot one-based, making default exactly Unresolved, with a test pinning that a location naming slot 0 is distinguishable from it. Everywhere else the sentinel was already exact: GpuTextureSlot.Unassigned is 0xFFFFFFFF, which is common.glsl's ACDREAM_TEXTURE_NONE, so the classify path's readiness test and the particle billboard's untextured branch kept their meaning unchanged.

GroupKey ordering is preserved because the key never ordered anything. Handle→slot is a bijection, so the same (entity, batch) pairs bucket together. The key reaches equality, hashing and the scene-digest fingerprints, never a comparator: opaque and translucent groups sort by cull mode then camera distance, delayed alpha by viewer distance then submission ordinal, and group enumeration follows the dictionary's insertion order, which a changed hash does not disturb. Both sides of the render-shadow comparison hash the slot index the same way, so the digest value moving is invisible to it.

SkyRenderer keeps its GlBindlessHandleTable, which is why that class still exists. Its textures are minted by the sky renderer itself from TextureCache.GetOrUpload's raw GL texture names — the one world path this slice did not retype — so it would be the sole consumer interning handles it produced, a different shape from the rest of the stack. The offline gate also masks the sky band, so the only automated instrument available here could not see a regression in it. V4f owns that renderer and should retire the table and the class together.

Gate results. GL offline pixel gate against cb2a70b8: 3.02e-05 at b8bcaa3e, and 5.50e-05 / 3.91e-05 on two captures at 565c351f. The first of those is above the documented 15–23 px band, so a control was measured rather than assumed: two same-commit captures at 565c351f differ by 19 px, and a capture at b8bcaa3e versus one at 565c351f differs by 9 px — fewer than the same-commit control, across two different commits. Maximum channel delta is 41–52 in every pair including the controls, so the differing pixels come from one flickering population rather than from moved geometry. Both commits passed tools/run-repeat-connected-gate.ps1 -Runs 3 at 3/3 RENDERED on the desktop witness and the client capture, and one Vulkan composition-host run each with VK_LAYER_KHRONOS_validation proven inserted by the loader — zero errors, zero warnings, converged ownership ledger. App tests 4,077 / 3 skips and the complete Release suite 9,140 / 5, both baselines plus the two tests added.

One connected run died and is filed, not attributed. The first 3-run attempt at b8bcaa3e lost one run to an unhandled OpenGL returned unexpected fence wait status NoError (0x0) in the render loop. It did not reproduce in the following three runs at that tree nor in three interleaved runs at cb2a70b8, and V4t creates, deletes and waits on no fence. #251 records it with the evidence; it is the same below-the-API shape §5.5.1–§5.5.3 documented four instances of on this driver, but that is a hypothesis and the issue says so.

Next is the world arm — V4c/V4d's content behind the construction-time backend selection at the frame-root seam. Two things this slice hands it: §5.5.8's one-binding-two-buffers hazard is still unfired and the world arm is what will fire it, since WbDrawDispatcher and EnvCellRenderer each own instance and batch buffers and both bind bindings 0, 1, 3, 4 and 5 in one frame; and the world path's own texture creation still has to reach IGpuTexture, because a Vulkan draw cannot sample a GL handle.

5.5.12 V6i-1 (2026-07-28): the descriptor-set hazard is closed before the world arm fires it

§5.5.8 recorded, and deliberately did not fix, that a binding pointed at two different buffers within one frame silently corrupts the earlier draws: the backend rewrote the descriptor in place, and a descriptor set's contents are read when the command buffer EXECUTES, not when it was recorded. Nothing fired it while the Vulkan frame held only the retained UI. §5.5.11 handed it forward as the first thing the world arm would hit, because WbDrawDispatcher, EnvCellRenderer and TerrainModernRenderer each own their own instance, batch and indirect buffers and all three bind set 0 in one frame.

It is now closed, and it was closed first rather than alongside the world arm, so that a blank or corrupt Vulkan world frame cannot be this defect wearing another face.

One set pair per renderer scope, derived rather than declared. There is no longer a single (set 0, set 1) pair per flight slot; there is an arena of them. VulkanBindingScopeArena — pure bookkeeping, no Vulkan handles, unit-tested — decides which pair a bind belongs to and whether its descriptors must be written. The scope key is the descriptor state itself: the ten storage buffer identities and ranges, the plain (non-dynamic) bindings' offsets, and the two uniform buffer identities and ranges.

Deriving the scope is a decision, not an economy. The pinned contract has no place to name one — BindStorageBuffer takes a buffer, an offset and a size, and §3.3 is frozen. Deriving it from state also gives two properties a declared scope would not: a renderer cannot forget to declare one, and two renderers that genuinely share every buffer correctly share one pair instead of being told to differ. A renderer's buffers are stable for its lifetime, so "distinct descriptor state" is "renderer scope".

Dynamic offsets stay free. A ring allocation moving between draws rides vkCmdBindDescriptorSets's dynamic-offset array, so it costs neither a new pair nor a descriptor write — §4.4's "zero descriptor writes per frame" property survives a frame now having more than one binding state in it. A steady frame rewrites nothing at all: entries are not invalidated at BeginFrame, because the slot's previous submission has retired and its descriptors still say exactly what this frame is about to say. An entry matched from the previous frame is swapped below the live cursor, so the rest of the frame cannot take it for a different state — the property nine tests pin, including the ordering case where two renderers swap their submission order between frames.

Two things the world arm still needs, unchanged from §5.5.11's handoff, plus one this slice measured:

1. World texture CREATION must reach IGpuTexture. V4t moved the table ENTRY to the device and left creation with TerrainAtlas, CompositeTextureArrayCache, ManagedGLTextureArray and TextureCache's array path. TerrainAtlas is the smallest of these and the only one terrain needs; TextureAtlasManager/ManagedGLTextureArray is the largest, and it is what statics, scenery and EnvCell shells sample through. ICompositeTextureArrayBackend is already a seam and takes an RHI backend directly; TextureAtlasManager is not, and reaches OpenGLGraphicsDevice through CreateTextureArrayInternal. BlockCompressionCodec and BlockCompressionMipChain (V6b) already supply the BC mip chains that path needs, so the missing piece is an ITextureArray implementation over IGpuTexture, not a codec.

2. terrain_modern.vert's TerrainClip block is in the wrong descriptor set, measured on the committed SPIR-V. It is declared layout(std140, binding = 2) uniform TerrainClip with no ACDREAM_UBO_SET, so under the Vulkan dialect it lands in set 0. Disassembling spv/terrain_modern.vert.spv confirms it rather than infers it: the block is OpVariable ... Uniform decorated DescriptorSet 0 / Binding 2, and set 0's layout declares binding 2 as a STORAGE buffer. A terrain pipeline built against the shared layout is therefore malformed. GL is unaffected — the macro expands to nothing and GL's UBO namespace is separate — and nothing has caught it because no terrain pipeline has ever been created on Vulkan.

   The audit is done and this is the only one. Every compiled .spv was disassembled: mesh_modern.vert's nine set-0 entries are all StorageBuffer, correctly; every other uniform block in every other shader already carries the macro. sky.vert is the precedent — it declares the SAME block as ACDREAM_UBO_SET binding = 2 — so there is no numbering question to settle, only a one-word omission to fix. The fix is that word plus declaring bindings 2 and 4 in VulkanPipelineLayouts.CreateUniformSetLayout (4 is §5.5.8's still-open UniformSkyParams, which sky.vert and sky.frag both declare) and raising DynamicUniformBindingCount accordingly — still far under Vulkan's guaranteed 8.

3. The flat-versus-PView question decides how much of the world arm is one slice. WorldSceneRenderer is already backend-neutral — it takes IWorldScenePassExecutor and IWorldScenePViewRenderer as interfaces — so the Vulkan arm reuses it whole. But WorldRenderFrame.ClipRoot is Roots.ViewerRoot ?? Buildings.OutdoorNode, and the offline gate's scene has buildings, so the offline capture takes the PView path, not the flat safety path. A Vulkan world arm that implements only WorldScenePassExecutor therefore renders nothing in the very scene the pixel gate captures. RetailPViewPassExecutor (685 lines) is on the critical path to the first Vulkan Dereth PNG, and the "terrain only" intermediate §5.5.7 suggested is consequently NOT cheaper than it looks.

Gate results. Strict GL offline pixel gate against b9ab5890: 1.60e-05 (9 differing pixels of 563,200), at the low end of the documented 9–31 px band and 62x under the 0.001 threshold — expected, since no GL file is touched. GL connected tools/run-repeat-connected-gate.ps1 -Runs 3: 3/3 RENDERED on the desktop witness and 3/3 on the client capture. One offline Vulkan run with VK_LAYER_KHRONOS_validation proven inserted by the loader (Insert instance layer "VK_LAYER_KHRONOS_validation" from VK_LOADER_DEBUG=layer): zero validation errors and zero warnings, a captured retained-UI frame, and no [shutdown] diagnostic on either stream. App tests 4,086 / 3 skips (the 4,077 baseline plus nine); complete Release suite 9,149 / 5. #250's SurfaceOverrideFingerprint_DictionaryHotPathAllocatesNothing failed once in a whole-suite run and passed run alone, exactly as that issue documents.

What this slice deliberately does NOT do: draw a world. The captured Vulkan frame is V6h's — the retained UI over the atmosphere fog clear — because no world renderer exists on the Vulkan arm yet. The arena's multi-scope path is therefore exercised only by its unit tests; the live Vulkan frame binds one scope and re-matches it every frame, which is the "rewrites nothing" case. That is the honest state and it is why the hazard was closed as its own commit: when the world arm lands and a frame first holds three renderers' buffers, a blank or corrupt result cannot be this defect.

5.5.13 V6i-2 (2026-07-28): world texture creation reaches IGpuTexture, and the mesh pipeline stops naming a backend

§5.5.12's ordered remainder list had six items. This slice is items 1, 2 and 6 — the exercisable prerequisites the world arm cannot be written without — in three separately gated commits. Items 3–5 are the next slice's and are unchanged.

1. The terrain clip block was in the wrong descriptor set, and so was the whole uniform layout (f7344758). terrain_modern.vert declared TerrainClip with no ACDREAM_UBO_SET, so the Vulkan dialect put it at set 0 binding 2 — which set 0 declares as a STORAGE buffer. spirv-dis on the committed .spv, before and after:

before   %372 = OpVariable %_ptr_Uniform__struct_370 Uniform
         OpDecorate %372 DescriptorSet 0 / Binding 2
after    OpDecorate %372 DescriptorSet 1 / Binding 2

with %_struct_370 = OpTypeStruct %int %_arr_v4float_uint_8 — the block's { int; vec4[8]; } — unchanged in both. The same commit closed §5.5.8's recorded UniformSkyParams gap, because set 1's layout declared only bindings 1 and 3 and was therefore missing BOTH. All four are now declared and dynamic, which is half Vulkan's guaranteed maxDescriptorSetUniformBuffersDynamic.

Membership AND order now come from one predicate — IsDeclaredUniformBinding — that the layout, the descriptor writes and vkCmdBindDescriptorSets's dynamic-offset array are all derived from, the shape V6g gave set 0. The three had been restated separately, which is how a fifth binding would have gone wrong the same way.

Both gaps were found by hand, months apart, and neither could fail on the shipping backend. VulkanShaderDescriptorContractTests now reads every committed .spv and asserts the partition instead: every uniform block at a declared set-1 binding, every storage block inside set 0's range, every sampled resource in the one texture table. Checked out against the pre-fix .spv, two of its four tests fail — so it is a gate, not a description.

2. World texture CREATION crosses to IGpuTexture (c8d0f70b), which is what V4t explicitly deferred and §5.5.12 item 1 handed forward. IWorldTextureArray is the seam, and the slot is what crosses it: ObjectMeshManager used to read BindlessWrapHandle/BindlessClampHandle off the concrete GL array and intern them itself, and a 64-bit ARB_bindless_texture handle has no Vulkan spelling. The array now answers ResolveSlot(wrapping) — the GL arm makes the same idempotent interning call one level down, the RHI arm returns a pair registered at construction — and ReleaseTextureSlots replaces the snapshot dictionary the manager kept, still running only once physical retirement completes.

Which implementation exists is decided ONCE, by the factory composition builds. Everything above the seam is written once: capacity policy, slot allocation, ref counting, layer retirement, empty-atlas eviction, and the whole of ObjectMeshManager's atlas policy.

Three deliberate differences, each because the backends genuinely differ. BC mip chains are CPU-built through V6b's BlockCompressionMipChain, since Vulkan cannot blit into a compressed image, while RGBA8 uses the device's blit. Filtering lives in an immutable sampler rather than a texture parameter, so both address modes are registered up front — the same reason the GL array holds two resident handles. And RGB8, A8 and Rgba32f are refused at creation with the reason named. A8 is the one worth recording: the GL array serves it by swizzling R into A, and a Vulkan swizzle lives in the image VIEW, which the pinned GpuTextureDescription does not describe. A silent substitution would render wrong and look like a shader bug. Whoever draws world materials on Vulkan either meets a real A8 atlas and extends the contract, or proves none exists.

TerrainAtlas gained the second construction path V6i drafted and reverted, with the decode factored out and shared so both arms read the same DATs in the same order with the same resize-to-max policy. ICompositeTextureArrayBackend gained its RHI arm, which is four small methods because that seam was already a seam.

The arm is EXERCISED, and that is the point. The V6i draft was reverted precisely because nothing exercised it, and §5.5.12 measured the same failure twice over in the descriptor layouts. So the composition host now builds the real terrain atlas through IGpuDevice.CreateTexture on the arm with no GL context, and creates and releases one shared array of each format family plus one composite array at startup. Creation only; nothing draws them. Releasing them in the same statement covers what a retained bundle would not — that both slot pairs come back and the images route through the retirement queue.

3. The mesh pipeline stops naming a backend (§5.5.12 item 6). That item measured the dependency and found it seven members wide out of a 760-line class: a GL context, the retirement queue, the instance VBO, and two capability flags. IMeshPipelineDevice is exactly that surface, OpenGLGraphicsDevice declares it, and every member already existed — so the GL arm executes not one changed statement. Two casts moved: the GlGpuDevice downcast left the constructor for the one property that genuinely needs it (the raw-GL renderers' handle table), and the atlas factory is selected by IWorldTextureArrayFactory.For. ObjectMeshManager now constructs against a device with no GL context at all, which is what MeshPipelineDeviceSeamTests proves; before this commit the constructor threw a cast before running a statement, and that is why NullWbMeshAdapter exists.

What this does NOT claim. The mesh pipeline does not RUN on Vulkan. Its upload bodies are still raw GL — GlobalMeshBuffer, the VAO/IBO construction, the layer transfers — and they now fail at the site that needs GL, naming the slice that owns them, instead of failing at construction. WbMeshAdapter still creates an OpenGLGraphicsDevice in its GL constructor, because there is no second implementation to create yet. A reflection test pins the seam's member set so a later slice cannot quietly widen it back out.

Gate results. Strict GL offline pixel gate against 0ca802cd: 3.02e-05, 3.20e-05 and 1.60e-05 at the three commits in order (17, 18 and 9 differing pixels of 563,200), every one inside the documented 9–31 px control band and at least 31x under the 0.001 threshold. Commit 3's 9 px is fewer than a same-commit control has measured, which is the expected shape for a change that alters no GL statement. GL connected tools/run-repeat-connected-gate.ps1 -Runs 3 at commits 2 and 3: 3/3 RENDERED on the desktop witness and 3/3 on the client capture, both times. One Vulkan composition-host run per commit with VK_LAYER_KHRONOS_validation proven inserted by the loader: zero validation errors, zero warnings, no [shutdown] diagnostic on either stream, captured frame. App tests 4,109 / 3 skips — the 4,086 baseline plus 23. The Vulkan run at commit 2 built terrain-atlas 512x512x33 with 10 mip levels, terrain-alpha-atlas 512x512x8 (4 corner, 1 side, 3 road), RGBA8 64x64x32 at slots 3/4 with 174,720 mip bytes blitted, BC1 64x64x32 at slots 5/6 with 696 mip bytes encoded, and a composite 32x32x8 at slot 7.

Two intermittent test failures, filed rather than attributed. A whole-suite run failed Issue181WallPressEquilibriumTests once; it passed alone and did not recur in five further runs. Seven test classes mutate the same process-global CameraDiagnostics switches with no xUnit collection isolation, and this slice touches no camera, visibility or physics code. Separately, a run of the UNCHANGED parent tree failed a zero-allocation test — #250's documented class, which fired on three different tests across these runs.

What the world arm still needs, and it is now exactly items 3–5. §5.5.12 item 3's flat-versus-PView question is unchanged and still decides how much of the world arm is one slice: the offline gate's scene has buildings, so WorldRenderFrame.ClipRoot takes the PView path, and RetailPViewPassExecutor (685 lines) is on the critical path to the first Vulkan Dereth PNG. Beyond that: the three world renderers' submission arms, and the mesh pipeline's raw-GL upload bodies this slice deliberately left in place.

5.5.14 V6i-3 (2026-07-28): the mesh pipeline runs, and the frame has a world pass

§5.5.13's remainder was items 3–5 — the three world renderers' submission arms, RetailPViewPassExecutor, and the pass-structure merge — plus the mesh pipeline's raw-GL upload bodies. This slice delivered the two prerequisites and did NOT deliver the world arm. Stating that first, because the slice's brief was a Dereth PNG and there is not one.

1. The mesh pipeline's upload bodies cross the seam (fe8abacf). V6i-2 cut IMeshPipelineDevice and proved the pipeline could be CONSTRUCTED without naming a backend; it said plainly it did not RUN. GlobalMeshBuffer now takes GL?. Its two backing stores were already IGpuBuffer (V4b); what still needed a context was the vertex array and its attribute pointers, which have no RHI verb because Vulkan bakes vertex input into the pipeline. A backend with none builds the stores and nothing else, publishes 0 for VAO/VBO/IBO, and publishes VertexStore/IndexStore — the same buffers, named the way a pass encoder binds them — plus HasStores, the backend-neutral form of the VAO != 0 readiness test the raw-GL draw paths make. Two bodies fork on the context: InitBuffers skips the vertex array, and CommitMigration skips the rebind, because on the encoder arm the field swap IS the atomic publication.

ObjectMeshManager's RequireGl narrowed to the LEGACY per-mesh upload — every GL statement it guarded sits inside if (!_useModernRendering), which the N.5 ship amendment makes unreachable, so the accessor survives as the guard on dead code rather than as a blocker. VulkanMeshPipelineDevice is the second implementation and is four properties and two no-ops; WbMeshAdapter selects between them once. NullWbMeshAdapter is deleted — it existed for exactly this gap — and composition builds the mesh pipeline on both arms, so streaming's publication into GPU state stops being a no-op there.

2. The clear merges into the world pass (887de4ae), which is §5.5.12 item 5. V6h's clear phase opened a backbuffer pass of its own; under MSAA that pass resolves into the swapchain image and stores DONT_CARE into the multisampled scratch, so any world pass that followed would Load undefined contents. The clear phase now publishes only the COLOUR and VulkanWorldScenePhase opens the one backbuffer pass, clearing as its load op with Store = Resolve. This is why the world renderers cannot each open their own pass on this backend, and it is the whole reason the arm is shaped differently from V4c's.

The same commit made descriptor sets bind at DRAW time rather than at bind time. V6i-1's arena derives a scope from the descriptor state, and the encoder resolved after every bind — so a renderer binding ten buffers materialised up to ten scopes per draw, nine of them PARTIAL states no draw uses, each claiming a descriptor-set pair and a round of vkUpdateDescriptorSets. Legal to defer because acdream has one pipeline layout by design (§4.4).

Gates. Release build green. App tests 4,112 / 3 skips (the 4,109 baseline plus three). Strict GL offline pixel gate against 579e0b7f: 4.44e-05 at commit 1 and 3.73e-05 at commit 2 (25 and 21 differing pixels of 563,200), both inside the documented 9–31 px control band. GL connected tools/run-repeat-connected-gate.ps1 -Runs 3 at HEAD: 3/3 RENDERED on the desktop witness and 3/3 on the client capture. One offline Vulkan run per commit with VK_LAYER_KHRONOS_validation proven inserted by the loader: zero errors, zero warnings, no [shutdown] diagnostic. The Vulkan capture at commit 2 is compared against commit 1's rather than eyeballed — 0 differing pixels of 921,600, maximum channel delta 0, bit-identical across the merge.

What the world arm still needs, measured rather than estimated. Every item below was designed and, where noted, written and then withdrawn because nothing exercised it — §7.1 rule 3. The design decisions are the expensive part and they are recorded here so the next slice does not re-derive them.

1. One pass, shared by every world renderer. V4c's renderers each opened their own Load/Store pass. On this backend they must record into the pass VulkanWorldScenePhase opens, for the resolve reason above. The seam that fits is a VulkanWorldPassScope the phase publishes the encoder on and the renderers borrow, with the phase bracketing WorldSceneRenderer.
2. Three sections are frame-global on GL and cannot be on Vulkan: the SceneLighting UBO (set 1 binding 1), the per-cell clip regions (set 0 binding 2) and the terrain clip block (set 1 binding 2). GL binds each globally and every consumer inherits it. SceneLightingUboBinding and ClipFrame need ring-writing arms that PUBLISH their sections on the scope; each renderer then binds them inside the pass, after its own binds, because its own binds are what select the descriptor scope they have to land in.
3. Retail's interior depth clear has no RHI verb. RetailPViewPassExecutor issues glClear(GL_DEPTH_BUFFER_BIT) between the landscape slice and the interior cells. Splitting the world pass to get a depth load-op is exactly what the resolve forbids, so the Vulkan arm must record vkCmdClearAttachments — reached through the scope, so the pinned contract stays frozen and the backend-only verb stays inside the backend.
4. Clip distances need no enable on Vulkan, and that is safe rather than a divergence. GL requires glEnable(GL_CLIP_DISTANCE0 + i); Vulkan activates every element the shader declares. All three vertex shaders already write 1.0 — keep everything — into every plane slot past the active count, so a frame with no clip planes clips nothing on either backend. EnableClipDistances/DisableClipDistances are no-ops on the Vulkan arm.
5. Only FOUR storage bindings can be dynamic, and the world arm re-points eight per draw. §5.5.8 offered to promote bindings 6–8 back to dynamic and said there were "four unused dynamic slots"; there are not. Vulkan's guaranteed maxDescriptorSetStorageBuffersDynamic is 4, which is exactly what V6g spends (bindings 0, 1, 3, 5). Bindings 4, 6, 7 and 8 are per-draw ring allocations too, so on Vulkan each moves the descriptor's own offset and therefore costs a descriptor write and a distinct arena entry per draw. Correct, bounded (the arena recycles entries across frames), and the reason the draw-time bind above matters: without it the cost is ten scopes per draw instead of one. A slice that wants it cheaper has to change the shaders' indexing, not the layout.
6. Pipeline SampleCount is load-bearing on Vulkan. V4c created every world pipeline with SampleCount = 1 because the GL backend ignores it. Vulkan requires the pipeline's rasterizationSamples to match the pass, and alpha-to-coverage requires MSAA, so the world pipelines must be created with the device's sample count.
7. The collision-wireframe debug lines would nest a pass. WorldSceneDiagnosticsController.DrawAndPublish flushes DebugLineRenderer INSIDE the world phase, and that renderer opens its own pass. On the Vulkan arm the diagnostics controller must be composed with a null debug-line renderer: the toggle is DevTools-only and DevTools is not composed there, so nothing is lost, but composing it would throw on the first wireframe frame rather than silently misdraw.

Beyond that the remainder is unchanged from §5.5.13: the three renderers' submission arms and RetailPViewPassExecutor, which §5.5.12 item 3 established is on the critical path because the offline gate's scene has buildings and therefore takes the PView route.

5.5.15 V6j (2026-07-28): the world arm lands, and Dereth draws on Vulkan

§5.5.14's remainder — the three renderers' submission arms, RetailPViewPassExecutor, and the frame-global sections — is done. ACDREAM_RENDER_BACKEND=vulkan renders the offline scene: terrain with blended textures and road overlays, the water edge, static world meshes, procedural scenery, and the complete retained UI, from the same camera as the GL capture (artifacts/v6j-vk2 against artifacts/v6j-head2). Sky is still the atmosphere fog clear, because SkyRenderer is raw GL until V4f.

Three predecessors stopped at this unit under §7.1 rule 3. It landed as one slice in two commits, because the rule is satisfied at SLICE granularity: the first commit's piece is unreachable on its own and the second wires it and exercises it.

1. The winding inversion was wrong, and nothing had ever asked (81fe5e1b). VulkanViewportMapping has inverted the front face since V6c, on the standard negative-viewport argument. Every Vulkan consumer through V6i declares Cull = GpuCullMode.None, so the mapping had never decided a fragment. The world arm is its first culling consumer and falsified it twice on one frame: terrain — the one single-sided surface acdream draws, FrontFace(Ccw) + Cull(Back) per ACRender::landPolysDraw's eye-side predicate — vanished entirely while issuing 190 multi-draw commands against 625 loaded landblocks, and every closed building shell rendered inside-out with its front wall culled and its interior beams visible through the gap. The identity mapping restores both at once. Two independent surfaces, one change. The viewport flip itself is untouched and still correct; what goes is the claim that a winding inversion travels with it.

Worth generalising: this is the third defect this campaign has found in a path that compiled, validated clean, and had a test — because the test asserted the behaviour rather than the requirement, and no consumer exercised it. §5.5.12's descriptor layouts and §5.5.13's TerrainClip set were the first two.

2. The world arm (f84eef32). V4c's and V4d-2's content returns as a SECOND arm, per §5.5.6's option (B): the GL arm issues the same statements in the same order, and the encoder arm lives in three .Rhi.cs partials entered by one branch per submission site. Three differences from V4c, each because the tree moved — no binding-9 table (V4t put the slot on the device; Vulkan binds set 2), pipelines carry the device's sample count, and no renderer opens a pass.

VulkanWorldScenePhase opens the frame's one backbuffer pass, publishes the encoder on VulkanWorldPassScope for exactly the span of the inner WorldSceneRenderer, and every renderer borrows it — §5.5.14 item 1's shape, built as specified. The three frame-global sections are PUBLISHED on WorldFrameSections and each renderer binds them inside the pass after its own binds (item 2). The interior depth clear is vkCmdClearAttachments through the scope (item 3); clip distances are no-ops (item 4); the collision-wireframe DebugLineRenderer is composed null (item 7).

Both pass executors became backend-neutral rather than gaining twins. That is the one place this slice diverged from §5.5.14's sketch, and it is why the slice was tractable. Everything those two classes do is delegation to a renderer except four concerns — the clip-frame publication, the doorway scissor, gl_ClipDistance enablement and the interior depth clear — so those moved behind IWorldPassSurface and retail's ordering, which is what the classes are actually for, is written once for both backends. RetailPViewPassExecutor was on the critical path precisely because the gate's scene has buildings (§5.5.12 item 3); it now serves both arms unchanged.

The A8 question is answered. §5.5.13 and §5.5.14 asked what happens to the Phase A8 CullMode.Landblock → None override the moment world materials draw on a second backend. It carried over verbatim and is still load-bearing: EnvCellRenderer's Vulkan arm applies the same rewrite, for the same reason, and the offline scene has no interior to disprove it with. The override is therefore neither vindicated nor retired by this slice — it is now a divergence with two consumers instead of one, and the dungeon pass in §5.1's checklist is what will settle it.

Gates. Release build green. App tests 4,112 / 3 skips — the unchanged baseline; complete Release suite 9,175 / 5. Strict GL offline pixel gate against 847f14ae: 5.50e-05 (31 differing pixels of 563,200), inside the documented 9–31 band and 18x under the threshold. Characterised rather than accepted, because 31 is the band's top:

cross-commit (847f14ae vs V6j):  21, 29, 31
same-commit  (V6j vs V6j):       12, 20
maximumChannelDelta, all pairs:  46-52

The max delta is 46–52 in every comparison INCLUDING the pure same-commit controls, so the few large-delta pixels are a property of the capture. A cross-commit pair at 21 against a same-commit pair at 20 is not what a systematic shift looks like — a real one floors every cross-commit comparison above every same-commit one. GL connected tools/run-repeat-connected-gate.ps1 -Runs 3: 3/3 RENDERED on the desktop witness and 3/3 on the client capture. One offline Vulkan run with VK_LAYER_KHRONOS_validation proven inserted by the loader: zero validation errors, zero warnings, a captured world frame, graceful close. tools/run-offline-vulkan-capture.ps1 is the new script that produces it.

The Dereth PNG, inspected honestly. Right: terrain geometry, terrain blending and its T-code transitions, road overlays, the water edge and its shoreline, static world meshes with correct silhouettes and closed shells, procedural scenery, per-instance lighting, the fog colour, and the complete retained UI including the radar. The frame matches the GL capture's framing and content element for element below the horizon.

Wrong, and each already owned by a later slice: the sky is flat fog (V4f — SkyRenderer is raw GL, so there is no dome, no sun, no cloud sheet, no horizon band); no particles (V4e); no paperdoll or appraisal viewport and no portal depth mask (V4g); no GPU frame timings (NullRenderFrameGpuMeasurement until V4h). None of these is a defect in this slice — they are the renderers it deliberately does not compose.

The V7 defect list — what a differential must not be run against yet.

1. Sky, particles, viewports, portal mask — absent, not wrong. V4e/V4f/V4g.
2. §5.4's Target: null divergence is still live on GL. V7 must not run until V4g/V4h remove it, or it surfaces as an entire viewport on the wrong surface — unchanged from §5.4's own warning, and now more binding because both backends draw a world.
3. EnvCellRenderer's Vulkan arm is unproven by anything automated. The offline scene has no interior. This is V4c's exact debt, restated on the new backend.
4. The deferred-alpha path and the doorway scissor are unexercised in the offline scene: no alpha queue collects and no doorway slice is assembled, so DrawPreparedAlphaBatch's Vulkan arm and RhiWorldPassSurface.BeginScissor have run zero times.
5. MSAA must be forced off for the differential, as §5.1 already states — sample positions are not specified across implementations, and the world pipelines now genuinely differ in sample count from the UI's.
6. Bindings 4, 6, 7 and 8 cost a descriptor write per draw (§5.5.14 item 5). Correct and bounded, and a V8 perf item rather than a correctness one, but the arena's ScopeCount is the number to watch.

What this slice does NOT claim. It has not run connected on Vulkan, it has not been seen by the user, and no dungeon, portal, paperdoll or spell effect has been drawn on it. The milestone "full game frame on Vulkan" needs V4e–V4g behind it.

5.5.16 V6k (2026-07-28): the sky draws, the viewports name their targets, and particles hit the contract

Two of the three renderers §5.5.15 listed as absent are landed, §5.4's obligation is discharged, and the third renderer stopped against the pinned contract rather than working around it.

1. The sky (22aa2edc). V4f's content, as a second arm per §5.5.6. ACDREAM_RENDER_BACKEND=vulkan renders the dome quadrants, the horizon band, the cloud sheet and the fog gradient in the same place and the same colours as the GL capture of the same scene. Three differences from the GL arm, each because Vulkan bakes what GL sets: the per-submesh blend function becomes two PIPELINES; the SkyParams block becomes a ring slice taken per draw, because a descriptor's contents are read at execution time and not at record time; and the pass is borrowed from IWorldPassScope. The sky is the first Vulkan consumer of set 1 binding 4 — §5.5.8 recorded that UniformSkyParams was missing from the uniform set layout and V6i-2 added it, but nothing had ever bound it.

The fourth defect of the compiles-clean class, and the first the campaign found by capture rather than by validation. The first Vulkan sky frame drew the dome as a field of blue-white noise. The RHI vertex layout declared a 32-byte stride — position, normal, texcoord, exactly what sky.vert reads — while AcDream.Core.Terrain.Vertex is 36 bytes: it carries a fourth member, TerrainLayer, that no sky attribute names and that the GL arm never describes to a glVertexAttribPointer but does count, because it says sizeof(Vertex). No validation rule was violated, nothing else in the frame looked wrong, and the offline gate masks the sky band. SkyVertexLayoutTests now asserts the requirement — the stride is the uploaded record's footprint — rather than the number, which is the lesson §5.5.15 drew from the winding inversion applied to a different surface. Worth generalising: every .Rhi.cs arm that declares a GpuVertexLayout is restating a CPU record's footprint from memory, and only one of them has a test.

The slice also retired the last interim GlBindlessHandleTable in the tree. V4t left the sky's because the sky is the one world path that mints its own resident handles rather than interning someone else's; it now registers them through V4t's RegisterWorldTextureHandle seam, and the class and its six tests are deleted. TextureCache.RegisterWorldSurface(surfaceId, repeat) is the RHI arm's texture source: the same DecodeFromDats, created through IGpuDevice.CreateTexture and paired with a real sampler object.

2. The viewports, and §5.4 (eb7e6b4e). PrivateEntityViewportRenderer asks the device for an IGpuRenderTarget instead of hand-rolling an FBO, colour texture and depth renderbuffer; its pass DECLARES that target; and the colour attachment is registered into the global table like any other texture. That deletes the V4a pre-approved transitional seam (RegisterExternalColorTexture / TryResolveExternalColorTexture) on the slice §7.1's final paragraph named as its end, and makes both retained-UI frame views backend-neutral.

§5.4's answer is not the one that section predicted, and the distinction matters. The divergence itself — GL's BeginPass refusing to bind framebuffer 0 for a null target — has not been on the tree since the V4c revert (543bc79f) took that hunk with it. What the revert did not undo was the reason it existed: this renderer bound a framebuffer no pass had declared. It now names its target, and PortalTunnelPresentation was re-read and draws into the active viewport — the backbuffer, which is what a null target literally means. V7 is no longer blocked on §5.4.

The §5.5.7 re-check does not come back clean, and is now a loud precondition. That note asked that "the render-target-view-in-table usage from V6c did not fire" not be carried forward as accepted. It still does not fire, and now for a reason worth stating: a Vulkan render-target image is viewed as VK_IMAGE_VIEW_TYPE_2D because that is what an ATTACHMENT needs, while the texture table's descriptor array is declared sampler2DArray, so registering one is invalid usage rather than a mismatch that samples oddly. It has never fired because the only renderer with an offscreen target is composed on GL alone. VulkanGpuDevice.RegisterTexture now refuses it and names the fix — a second, layered sampled view per render target — so the slice that gives the Vulkan arm a viewport meets a precondition instead of a driver-level fault.

3. Particles are NOT landed, and the reason is the pinned contract. GpuVertexLayout has one stride and no instance divisor, and IGpuPassEncoder.BindVertexBuffer binds one buffer at VertexInputRate.VERTEX. Both particle pipelines draw with per-instance vertex attributes — particle at locations 2–6 (centre, two sheet axes, colour, texture slot) and particle_mesh at 3–7 (a mat4 model and a colour). The contract can express instanced DRAWING — Draw/DrawIndexed both take firstInstance — but not instanced vertex INPUT, which is what these two shaders are built on. Three ways out, each a decision rather than an implementation:

• (i) Grow the contract: a second vertex binding with a divisor. Smallest change at the call sites, and the same shape as the four amendments already taken (InverseAlpha, UByte4UInt, ColorFormat, the tiling binding).
• (ii) Move particle instances to a storage buffer indexed by gl_BaseInstanceARB + gl_InstanceID, which is how the world path already works. This converges the shaders rather than forking them, but it needs a storage binding, and GpuBindingModel's ten are all spoken for — reusing binding 0 would have the GL particle draw clobber WbDrawDispatcher's instance array mid-frame, which is §5.5.8's hazard in its GL form. So this is a binding-model change, i.e. also a contract change.
• (iii) CPU-expand instances to per-vertex data on the Vulkan arm only. Needs no shader, contract or GL change and would change no pixel, but it multiplies billboard vertex bandwidth about five-fold and does not scale to mesh particles at all, where it would duplicate a whole mesh per instance.

Option (ii) is the one the campaign's own architecture points at, and (i) is what makes it unnecessary. Either way, V4e stays open and the choice belongs to whoever owns §3.3.

Gates, per commit. Release build green. App tests 4,109 / 3 skips — the 4,112 baseline less the six GlBindlessHandleTable tests that went with the class, plus three vertex-layout tests; complete Release suite 9,172 / 5. Strict GL offline pixel gate: 4.43e-05 (25 px) at commit 1 against 7ae796a1 and 4.08e-05 (23 px) at commit 2 against 22aa2edc, both inside the documented 9–31 band with maximumChannelDelta 48 — the same 46–52 every control pair reports. GL connected -Runs 3: 3/3 RENDERED on the desktop witness and 3/3 on the client capture, per commit. One offline Vulkan run with VK_LAYER_KHRONOS_validation proven inserted by the loader per commit: zero validation errors, zero warnings.

Two uncovered surfaces were checked rather than banked. The sky band is masked by the pixel gate, so commit 1 carries a seven-day-group before-and-after comparison on GL — V6e's method — matching in gradient, cloud sheet, horizon band and fog on every group, including day group 2's salmon band and day group 6's green one. The offline scene never opens the inventory, so commit 2 carries a connected run that presses ToggleInventoryPanel and captures the result (artifacts/v6k-paperdoll): the doll renders through the new render target with the correct pose, orientation and alpha. That is §5.1's "the paperdoll, then examine an item" row, half-discharged — the appraisal viewport shares the same class and the same code, but was not itself driven.

The Vulkan frame, inspected against a GL capture of the same scene. Captured back to back (artifacts/v6k-vk-final versus artifacts/v6k-gl-final), both at 4× MSAA with alpha-to-coverage on, the two frames differ in 8.83% of pixels (81,359 of 921,600), mean absolute channel delta 0.82, maximum 174. The difference map (artifacts/diff-gl-vk.png) puts essentially all of it in two populations, and neither is a defect:

• Foliage and silhouette edges — 51,003 of the 81,359 differing pixels are in the top 200 rows, which is the treeline, and the map shows the population hugging every tree and building outline. These are alpha-to-coverage sample positions, which are explicitly unspecified across implementations; §5.1 already requires the V7 differential to force MSAA off for exactly this.
• The sky band's own animation — two launches cannot agree on the Dereth clock, which is why the GL gate masks the same band.

Terrain, blending, roads, the water edge and the entire retained UI are pixel-quiet: rows 300–720 contribute 980 differing pixels in total, 0.13% of the population.

The V7 defect list, updated.

1. Sky (landed), viewports (landed, GL arm), §5.4 (discharged). Particles remain absent on both the Vulkan arm and V4e, blocked on the contract question above.
2. PortalDepthMaskRenderer is unported and needs a contract dimension. Its two-pass punch (#117) is built on glStencilFunc/glStencilOp/glStencilMask and GpuPipelineDescription has no stencil state at all. It is raw GL, it works, and it is invisible to the Vulkan arm, so nothing is broken — but the V4g row's "stencil/depth-mask pipelines" cannot be written against the pinned contract as it stands.
3. The paperdoll and appraisal viewports do not exist on the Vulkan arm, and giving them one is more than composition: the offscreen target is single-sampled by contract while every world pipeline is built at the backbuffer's sample count, so WbDrawDispatcher would need sample-count pipeline variants the way §5.5.8 gave it depth-format variants. Plus the layered-view fix in item 2 of the §5.5.7 re-check above.
4. EnvCellRenderer's Vulkan arm is still unproven by anything automated (unchanged from §5.5.15), as are the deferred-alpha path and the doorway scissor.
5. MSAA must be forced off for the differential — now measured rather than predicted: it is 8.8% of the frame at 4×.
6. Bindings 4, 6, 7 and 8 cost a descriptor write per draw (unchanged; a V8 item).

5.5.17 V6l (2026-07-28): particles, the portal mask and the viewports land, and three amendments are taken

The three things §5.5.16 left on the V7 list as blocked on a contract decision are all on the Vulkan arm. Each amendment is its own reviewed commit with GpuContractTests coverage, in the same shape as InverseAlpha (V4c), UByte4UInt (V4d), ColorFormat (V6d) and UniformSkyParams (V6e).

1. Instanced vertex input, and particles (b1ad1d48). §5.5.16's option (i): GpuVertexLayout grows a per-binding notion — binding index, stride, input rate — GpuVertexAttribute names the binding it is fed from with a default of 0, and IGpuPassEncoder.BindVertexBuffer takes a binding index. Every layout written before the slice keeps its exact meaning through GpuVertexLayout.Interleaved, which is one vertex-rate binding 0, and a contract test asserts that as a requirement rather than trusting it. Both backends carry the rate natively and at no cost: VK_VERTEX_INPUT_RATE_INSTANCE on the pipeline, glVertexAttribDivisor recorded once into the pipeline's VAO where it survives every later attribute rebind.

GpuVertexFormat.UInt1 comes with it and is necessary to it: particle.vert declares layout(location = 6) in uint aTextureIndex and the amendment's whole premise is that no shader is edited. Same kind-distinction UByte4UInt was added for — GL requires glVertexAttribIPointer, Vulkan requires R32_UINT, and the float path would reinterpret the value's bits rather than approximate them.

ParticleRenderer.Rhi.cs is V4e's content as a second arm. Five pipelines replace the imperative glBlendFunc switch; the per-flight VAO/VBO pool disappears because every ring allocation inside a frame is already distinct memory that lives until the frame retires; the binding-9 table is not bound at all; the pass is borrowed from IWorldPassScope. Depth tests but does not write, compare is Less and alpha-to-coverage is off — the ambient GL state particles have always drawn under rather than a choice.

The fifth defect of the compiles-clean class, found by running rather than by validation. The first Vulkan particle frame threw: TextureCache.AcquireParticleTexture was bindless-only, so the standalone particle texture cache did not exist on a backend without GL. It exists on both arms now — everything about it that matters, the owner sharing, the bounded unowned LRU and retirement behind the frame-flight fence, was already backend-neutral, and only how one entry is created and destroyed differs, which is what IStandaloneBindlessTextureBackend is for.

The durability fix V6k earned. That slice found the sky declaring a 32-byte stride against a 36-byte AcDream.Core.Terrain.Vertex and noted that every .Rhi.cs arm restates a CPU record's footprint from memory while only sky had a test. RhiVertexLayoutStrideTests is that test for the rest — world mesh, terrain, sky, retained-UI sprite, debug line and both particle bindings, each against the record or the producer's own float count, plus two sweeps over all seven for attributes that reach past their stride or name an undeclared binding.

2. The stencil dimension, and the portal mask (eced67d0). §5.5.16 defect 2. The amendment splits the way core Vulkan 1.3 splits: the ENABLE and the attachment intent are baked as GpuPipelineDescription.StencilTest (false by default, so no pipeline changed), and the per-draw compare, three outcome ops, reference and both masks are a GpuStencilState the pipeline carries as a DEFAULT and IGpuPassEncoder.SetStencil overrides — exactly the split cull mode, front face and depth write already have. The four stencil dynamic states are declared only by a pipeline that tests stencil, because declaring one obliges every draw with that pipeline to have set it.

PortalDepthMaskRenderer gets three pipelines rather than one: depth COMPARE is not dynamic in the contract and the punch's two passes differ in it — mark tests LEQUAL and writes no depth, punch tests ALWAYS and writes — with the seal a third. All three write no colour, which is what retail's "COLOR-INVISIBLE triangle fan" means. The fan is expanded to a triangle LIST on the CPU, exactly: triangle i is (v0, v[i+1], v[i+2]).

This is the one renderer in the campaign whose two arms do not share a shader source, and the reason is worth recording. portal_depth.vert's clip planes have to travel in the TerrainClip uniform block at binding 2 — already precisely this shape, already read by terrain_modern.vert and sky.vert — but on GL that binding is held globally by ClipFrame for terrain, so a portal draw that rebound it would leave every later terrain draw in the frame reading the wrong region. The GL arm therefore keeps its inline program. PortalDepthShaderParityTests is the tripwire: retail's far-Z constant (0.99999988, DrawPortalPolyInternal 0x0059bc90), #129's capped mark-bias expression and the eight-half-plane loop are asserted to appear in both. Both are deleted at V11. 9/10 shader pairs now compile to SPIR-V.

Two GL-side gaps closed while the state was being extended, both §7.1 rule 1's class rather than new work: GlAmbientCapabilityState now saves and restores the stencil test, function, ops and both masks — the punch draws mid-frame among renderers that are still raw GL and assume the test is off — and the COLOUR MASK, which had no consumer until a colour-invisible pipeline existed and whose absence would have blacked out every raw-GL renderer after such a pass.

PortalTunnelPresentation was re-read and confirmed as V6k left it: it clears depth and draws into the active viewport, binds no framebuffer of its own, and needs no port for §5.4's sake. It remains unported on the Vulkan arm — the composition uses NullLocalPlayerTeleportPresentation there — which is an absence on the V7 list, not a defect.

3. The offscreen viewports (2e8b8b91). §5.5.16 defect 3 named two backend fixes; both are here, and running it found two more the note could not have known about.

• The layered sampled view. An attachment view must be VK_IMAGE_VIEW_TYPE_2D and the table's descriptor array is sampler2DArray, so V6k made RegisterTexture refuse the attachment view and name this fix. VulkanGpuTexture now creates a SECOND, layered view over the same image for a colour render target — one image, one allocation, two ways of looking at it, legal without any creation flag — and SampledView is what the table registers for every texture, so the question disappears rather than being answered.
• Sample-count pipeline variants. WbDrawDispatcher's five pipelines became a MeshPipelineSet with two instances, selected at bind time from the LIVE pass rather than from the scope. When the backbuffer is single-sampled the two sets are one object. The offscreen target's depth attachment also had to take the device's own combined depth/stencil format rather than the contract enum's literal D24_UNORM_S8_UINT, because a pipeline bakes one depth/stencil format and the same pipelines draw in both passes.
• Third, found by running: entity APPEARANCE composites were still bindless-only, so no entity with a palette override could be drawn on the Vulkan arm at all — the doll being one, and every creature and player besides. This is why V6j and V6k could not have run connected on Vulkan even had they tried. RhiCompositeTextureArrayBackend has existed since V6i-2 with no production consumer; it has one now, and nothing about the cache changed.
• Fourth, found by the first successful capture: the doll rendered upside down. UiViewport has flipped V since V4a because a GL framebuffer's origin is bottom-left; a Vulkan image's is top-left and the negative viewport height stores the rendered image that way round, so the same flip stands the doll on its head. That is a property of the backend that made the texture, so IUiViewportRenderer answers TextureIsBottomUp and the widget asks. The line this replaces had predicted exactly this failure since it was written.

IWorldPassScope.Publish is on the interface for this: the dispatcher's RHI arm borrows its pass rather than opening one, so a viewport that opens a pass of its own has to publish it for the span of the draw. It does not nest — the world phase has closed its own pass by the time private presentation runs.

Gates, per commit. Release build green. App tests 4,121 / 4,129 / 4,129 against the 4,109 baseline (three contract tests and nine layout tests at commit 1; three contract, four shader-parity and one render-state-cache test at commit 2); complete Release suite 9,184 / 9,192 / 9,192. Strict GL offline pixel gate against 08ffe141: 3.20e-05 (18 px), 2.31e-05 (13 px), 3.55e-05 (20 px) of 563,200, all inside the documented 9–31 band. GL connected -Runs 3: 3/3 RENDERED on the desktop witness and 3/3 on the client capture, per commit. One offline Vulkan run with VK_LAYER_KHRONOS_validation proven inserted by the loader per commit: zero validation errors, zero warnings. One solution-wide run at each of commits 2 and 3 reported a single App failure that did not reproduce in the App suite alone or in a second solution-wide run — the documented rerun-singly flake class; the runner did not surface the name and it is not carried forward as a claim.

The two captures the offline gate cannot reach, connected and inspected.

• The paperdoll on Vulkan (artifacts/v6l-vk-paperdoll3): upright, in armour, at the right scale, over a transparent background, and indistinguishable from the same capture on GL taken minutes later (artifacts/v6l-gl-paperdoll) — which is also the no-regression check for the V-orientation change.
• Particles on Vulkan (artifacts/v6l-vk-poi versus artifacts/v6l-gl-poi, cropped 4× at artifacts/crop-vk-glow.png and crop-gl-glow.png): Holtburg's forge plume and its field of glint sprites draw in the same places with the same alpha compositing on both backends, the puffs differing only in phase because two launches cannot agree on an emitter's age. The offline scene's emitters are outside its fixed view, which is why this is connected.

One thing the slice got for free and did not go looking for. A connected Vulkan run teleported into the Marketplace and rendered the interior — walls, floor, banners, per-cell lighting — which is the first time anything has drawn EnvCellRenderer's Vulkan arm (artifacts/v6l-vk-mp). It is a single eyes-on frame, not a gate, so §5.5.16 defect 4 is narrowed rather than closed: the arm demonstrably renders an interior, and the doorway clip, portal visibility and deferred-alpha paths remain unexercised by anything automated.

The V7 defect list, updated.

1. Particles, the portal mask, the viewports — all landed. PortalTunnelPresentation has no Vulkan arm: the composition uses NullLocalPlayerTeleportPresentation, so a portal transit shows no tunnel on that backend. Absence, not defect; it is the last raw-GL world-adjacent renderer.
2. EnvCellRenderer's Vulkan arm is proven by one eyes-on frame and nothing automated. Narrowed from §5.5.16 item 4. The deferred-alpha path and the doorway scissor are still unexercised, and no connected route visits an interior — the durable fix §5.1 already names is adding an interior stop to connected-r6-soak.route.txt.
3. MSAA must be forced off for the differential (unchanged; measured at 8.8% of the frame at 4× in §5.5.16).
4. Bindings 4, 6, 7 and 8 cost a descriptor write per draw (unchanged; a V8 item).
5. The portal depth mask's two arms do not share a shader source. Guarded by PortalDepthShaderParityTests and resolved by deletion at V11, but it is the one duplication the campaign carries and it should not be extended.
6. The paperdoll's V orientation is now backend-derived rather than constant. The appraisal viewport shares the class and the code and was still not itself driven — the same half-discharge §5.1's V6k row records, carried forward.

5.5.18 V6m (2026-07-28): portal space crosses, and the differential gets its instrument

The last raw-GL world-adjacent renderer is on both arms, and V7's instrument exists and has been fired once.

1. Portal space (59c6b2ae). PortalTunnelPresentation draws on both arms. Nothing about the scene moved — the same synthetic Setup resolved through the same client-enum mapping, the same 40 fps CSequence, the same retail rotation cadence and distant light, through the same already-dual-arm WbDrawDispatcher. What forked is where the draw is recorded: GL keeps its GLStateScope and its depth-only glClear; the RHI arm opens a backbuffer pass of its own and publishes it on IWorldPassScope for the span of the draw, which is V6l's viewport shape and required for V6l's reason — the dispatcher's RHI arm borrows its pass rather than opening one. Publication sits between BeginPass and UploadRetailLight, because publishing resets the frame-global sections and this scene wants its own light rather than the world's.

The one substantive decision is that the pass CLEARS colour rather than loading it, and it is exact rather than approximate. Retail preserves the colour target and clears only depth (UIViewportObject::DrawContent 0x006950A5 → Clear(4) = D3DCLEAR_ZBUFFER), and so does the GL arm. A Vulkan pass cannot inherit an image the way a bound framebuffer can: under MSAA the frame's world pass RESOLVES into the swapchain image and stores DontCare into the multisampled scratch, so a second multisampled pass declaring Load would load undefined contents — §5.5.12 item 5, the same hazard that merged the clear into the world pass. What makes re-clearing lossless is an invariant the frame graph already enforces: RenderFrameFoundation.PortalViewportVisible and the scene's own IsVisible are the same value read once at the top of the frame, and WorldSceneRenderer returns without drawing when it is set — so whenever portal space draws, the backbuffer holds exactly the opaque black SceneTool::BeginScene 0x0043DAD0 establishes and nothing else. The alternative, a single-sampled Load pass over the resolved image, would have been both a silent MSAA divergence and invalid, because the backbuffer's depth attachment is multisampled.

NullLocalPlayerTeleportPresentation is deleted with the backend condition that produced it, and SessionPlayerComposition's transfer is unconditional again.

2. The differential instrument (a99f517e). tools/run-backend-differential-gate.ps1 runs one connected route twice — ACDREAM_RENDER_BACKEND=gl then vulkan — pairs the PNGs by name, compares each at tolerance 2 / fraction 0.001, and writes one verdict table. ACDREAM_MSAA_SAMPLES=0 is forced on both launches, ACDREAM_DAY_GROUP is pinned on both, and the desktop witness plus its three guards (blank frame, overlapping window or locked screen, stray input) are lifted from the repeat-run gate rather than reinvented. connected-backend-differential.route.txt is written for two-launch determinism — identity quaternions on every teleloc, the client-only time-of-day override, no movement between arrival and capture — and it carries an interior EnvCell stop, which is the durable fix §5.1 names for the campaign's oldest coverage gap.

Two files, ASCII with CRLF, and that is not cosmetic. PowerShell 5.1 reads a BOM-less .ps1 as ANSI, so a UTF-8 em dash inside a double-quoted string is a parse error. The first version of the script had one and did not run.

3. The smoke pair, honestly. ONE pair, on the route's first stop, MSAA off, GL versus Vulkan at Holtburg: 170,697 of 921,600 pixels differ — 18.52%, maximum channel delta 255. Attributed with a difference map (artifacts/v6m-diff-smoke.png):

• 89% of it is in the top 240 rows. Applying the offline gate's top-280 sky mask takes the pair to 11,480 of 563,200, 2.04%. That band is the scrolling cloud sheet — which advances with WALL time, not with the Dereth clock the route pins — plus the treeline behind it.
• Masking the animated portal beside the character too takes it to 6,190 of 529,450, 1.17%, mean channel delta 0.49. A portal's scrolling texture is phase, exactly like an emitter's age.
• The 2-D retained UI is not implicated, and this is the most useful number the smoke produced. Compared over the chat panel alone — static content, same seven lines on both runs — the two backends differ in 42 pixels of 106,560, fraction 3.94e-04, maximum channel delta 3. That is inside the 0.001 threshold on its own, so TextRenderer, the sprite path and the glyph path are already at parity and a global gamma or half-pixel offset is excluded. The residual is in the 3-D pass.
• What visibly remains is thin outlines on silhouette edges throughout the frame, including static buildings, plus the vitals readouts, whose stamina and mana genuinely advanced between two logins minutes apart.

So V7's distance to 0.001 is roughly 12x with the two known phase populations removed, and the population to explain is edges in the world pass. -MaskTopPixels exists on the script for that conversation and defaults to 0: the gate is a strict identity check on the whole frame unless someone deliberately asks otherwise (§7.1 rule 2).

Gates, per commit. Release build green. App tests 4,132 / 3 skips against the 4,129 baseline (three new: the retail black constant, the RHI arm's composition precondition, and the both-arms composition assertion); complete Release suite 9,195 / 5, with one AcDream.Content failure in the solution-wide run that passes 124/124 rerun alone — the documented rerun-singly flake class, not carried forward as a claim. Strict GL offline pixel gate against 280f3b3f: 4.97e-05 (28 px of 563,200), inside the documented 9–31 band, with a same-commit control pair taken immediately afterwards at 3.55e-05 (20 px). GL connected -Runs 3: 3/3 RENDERED on the desktop witness and 3/3 on the client capture. One offline Vulkan run with VK_LAYER_KHRONOS_validation proven inserted by the loader: zero validation errors, zero warnings. Commit 2 changes no product code, so those gates stand unchanged for it; the smoke run is its own evidence, having driven a complete connected Vulkan session end to end with a graceful exit.

The three captures the offline gate cannot reach, connected and inspected.

• Portal space on both backends (artifacts/v6m-gl-tunnel versus artifacts/v6m-vk-tunnel, ten frames each at 400 ms across the transit). The retail wormhole draws on Vulkan: the same tube, the same blue-grey shading and drifting purple motes, the retained UI composited above it, and — the thing the clear decision above is about — an opaque black surround with no world bleeding through. The two runs are at different rotation and animation phases, because the rotation cadence is drawn from Random and two launches cannot agree on it, so this is an eyes-on comparison rather than a numeric one.
• The creature-appraisal viewport on both backends (artifacts/v6m-gl-tunnel/screenshots/appraisal.png versus the Vulkan counterpart). This discharges V6k's and V6l's carried half-discharge: the appraisal view shares the paperdoll's class and code and had never itself been driven. Examining a Brown Rabbit at Caul opens the examination window with the same title, the same "Rabbit / Character Level 4" header, the same nine attribute rows, and the creature rendered through the private viewport at the same scale and the right way up on both arms. A numeric pair over the window is confounded — the retail panel is semi-transparent over a swaying treeline, and the rabbit has its own animation cursor — so this too is eyes-on, as V6l's paperdoll was.
• An interior EnvCell on both backends (interior.png in the same two directories): the Facility Hub's brick walls, doorway and magenta per-cell ambient render the same on Vulkan. A numeric pair is NOT yet available and the reason is a route defect, not a renderer one: the frames differ in 31.2%, and the cause is visible on inspection — the indoor spring-arm camera had settled to slightly different distances in the two runs, which moves every near-field edge. The interior stop needs a longer settle, or a framing that does not depend on the camera collapsing, before V7 can use it as a checkpoint.

The V7 defect list, updated.

1. PortalTunnelPresentation has no Vulkan arm — landed. Every production renderer now draws on both arms.
2. EnvCellRenderer's Vulkan arm now has a connected route stop and an eyes-on pair, but no numeric one. Narrowed again from §5.5.17 item 2. The route file carries the interior stop; making it comparable needs the camera settle fixed above. The deferred-alpha path and the doorway scissor remain unexercised by anything automated.
3. MSAA is forced off by the instrument (was: must be). What the smoke measured in its place is the sky band — the cloud sheet runs on wall time and no route flag pins it, so V7 must decide between masking it, pinning the phase, or accepting it. 89% of the smoke's difference lived there.
4. Bindings 4, 6, 7 and 8 cost a descriptor write per draw (unchanged; a V8 item).
5. The portal depth mask's two arms do not share a shader source (unchanged; guarded by PortalDepthShaderParityTests, resolved by deletion at V11).
6. The appraisal viewport was never itself driven — driven on both backends and inspected, above.
7. NEW: the world pass differs at silhouette edges. With the sky band and the animated portal masked the smoke still reports 1.17%, about 12x the threshold, and the chat-panel measurement rules the 2-D path out. This is V7's first lead and it is a real one.

5.4 The null-target BeginPass divergence (V4c) — ✅ DISCHARGED at V6k

Closed 2026-07-28 by V6k commit 2 (eb7e6b4e); see §5.5.16. The answer is not the one this section predicts, and both halves are worth keeping straight. The divergence itself — GL's BeginPass refusing to bind framebuffer 0 for a null target — has not been on the tree since the V4c revert (543bc79f) took that hunk with it; GL binds the declared target today and has for a while, so the two backends already agreed about what Target: null means. What the revert did not undo was the reason the divergence existed: PrivateEntityViewportRenderer still bound a framebuffer no pass had declared. V6k ported it onto IGpuRenderTarget, so it now names its target; PortalTunnelPresentation was re-read and draws into the active viewport rather than an offscreen buffer, which is the backbuffer and therefore already means exactly what a null target means. Obligation 1 below is met, obligation 2 is moot, and V7's differential is no longer blocked on this. The rest of the section is kept for the record.

V4c had to stop GL's BeginPass from binding framebuffer 0 when a pass declares Target: null. The reason is sound: PrivateEntityViewportRenderer and PortalTunnelPresentation bind their own offscreen FBO and then call WbDrawDispatcher.Draw, so forcing framebuffer 0 would have redirected the paperdoll, appraisal and portal-tunnel views to the backbuffer. The offline gate would never have caught it — none of those surfaces appear in its scene.

But this makes GL's BeginPass diverge from the contract it implements. GpuColorAttachment documents Target: null as "the backbuffer," and the Vulkan backend must honour that literally: a null target is the acquired swapchain image (or the multisampled scratch that resolves into it), and there is no ambient "currently bound framebuffer" for it to inherit instead.

So this is a GL-only transitional behaviour, correct today and wrong at V6. Two obligations follow:

1. V4g ports those renderers onto IGpuRenderTarget, at which point they declare their target explicitly and the inheritance is no longer needed.
2. V4h restores GL BeginPass to binding the declared target, once the spine owns framebuffer management and every consumer names its own. The Vulkan backend is written against the contract, never against this divergence.

If V4h lands without removing it, the GL and Vulkan backends will disagree about what a null target means, and the V7 differential will surface it as an entire viewport rendering to the wrong surface.

Sequencing invariants. The app ships on GL until V10. The original V0→V1→V2→V3→V4a…V4h chain was strictly sequential, with the only permitted parallelism being V5 alongside V4d and/or V4f (fully disjoint files) and optionally V9's .github/tools-only work alongside V8; while V4c runs, nothing else touches Rendering/Wb.

Amended by §5.5.5 (2026-07-28). V4c/V4d are parked and V5→V6 execute next, so that chain no longer holds past V4b. Two consequences land on this section. First, V6 now arrives before V4g and V4h, so the Vulkan backend is written against the contract's literal Target: null — the acquired swapchain image — while GL still carries the transitional inheritance described above. That is tolerable only because the two backends are never live in the same process, and it makes obligations 1 and 2 above more binding, not less: whichever slice finally lands V4g/V4h still owes the removal, and until then the divergence is load-bearing on the GL side alone. Second, V7's differential must not be run until that removal has happened, or it will surface the divergence as an entire viewport rendering to the wrong surface — which, post-§5.5.5, would be indistinguishable from the fork option (B) permits.

---

6. Risk register

Risk	Mitigation
Y-flip and winding	Negative viewport height; the front-face inversion lives in one backend mapping function; the differential catches any residue.
Depth-precision shift (z-fight patterns)	The only pre-approved divergence class; each instance gets a mask or per-stop relaxation plus a divergence-register row.
sRGB mismatch (global gamma shift)	Decided at V3 from the actual GL state; a mismatch fails every pixel at V7, so it cannot pass silently.
MSAA sample positions differ across backends	Strict gates run MSAA off; MSAA on gets a relaxed (0.01) visual smoke; a register row lands at V11.
~15,000 lines of renderer churn destabilizing retail fidelity	CPU logic never forks; each port is self-differential on the still-shipping backend; V0 pins the contract so subagents never negotiate APIs; the architecture test prevents seam erosion.
Driver matrix — only one physical GPU (RX 9070 XT)	Conservative universal feature floor; lavapipe in CI as a second real implementation; one validation-layer-clean run at V7; the physical Linux row is deferred exactly as Slice L deferred it.
Swapchain lifecycle (resize, minimize, RDP)	Owned explicitly at V5 and exercised by the connected lifecycle gate.
App tests breaking as renderers change signatures	RecordingGpuDevice ships at V0; each slice updates its renderers' test constructions in the same commit.
Hidden Chorizite consumers	V1 builds the device root without Chorizite inheritance; V4h audits the remainder; the package drops at V11 only if that audit is clean.
.spv staleness	Single GLSL source, committed .spv, regeneration script, and a CI hash-freshness check.

---

7. Execution rules for slice subagents

• Sonnet implementers by default. V0, V4c, V4h, and V6 are load-bearing — their diffs are reviewed in the parent session before commit.
• One agent per slice, always. Coupled sub-slices (V2a–c, V6a–c) are sequential commits by the same agent. Never fan out across files two slices share.
• Every subagent prompt carries: this document's section numbers for the pinned contract, the slice's file list, the gate definition, "build and tests green, one commit," and the divergence-register same-commit rule.
• No slice regenerates expected retail baselines. They are immutable for the duration of the campaign.
• Connected gates need the live ACE server and the user's machine. The visual sign-off at V10 is a required user stop; there are no others besides gate failures.

7.1 Rules learned from the V4a revert (2026-07-27)

The first V4a attempt (ceec3bc4) was reverted at 9aaf97e7. Three rules come out of it, binding on every remaining slice.

1. During the transition, an RHI pass must not leak GL capability state. Every world renderer is still raw GL until V4c/V4d, so they inherit whatever capability state the previous pass left enabled. V4a deleted TextRenderGlStateScope — which saved GL_MULTISAMPLE and GL_SAMPLE_ALPHA_TO_COVERAGE, disabled them for the text pass, and restored them on exit — and baked that state into a pipeline instead, with nothing restoring it. The world then drew without multisampling from the first UI frame on, changing the silhouette edge of every object in the scene.

So: GlGpuPassEncoder.Dispose saves and restores the capability state its pipelines change, for as long as raw-GL renderers coexist. This is not a workaround; it is what keeps the GL backend's stated behaviour-preserving property true at a seam where two worlds meet. It is deleted at V4h once nothing raw-GL remains. For the same reason, the GL render-state cache must be reset at BeginPass, not merely per frame — a raw-GL renderer running between two RHI passes in the same frame desynchronises it just as effectively.

This is the third time the project has hit this exact class: see the memory notes on self-contained render state and on issue #52, where an earlier migration lost cull state the same way. Audit per-pass GL state before declaring a port done.

2. A failing gate blocks the commit. The pixel gate failed at 0.318% against a 0.001 threshold and the slice committed anyway, attributing the difference to ambient animation. The control refuted it: same-commit captures differ by 8–19 pixels at both commits, versus 1,791 across the change. If a gate fails, either find the root cause or stop and report — never rationalise past it, and never relax the threshold.

3. Stay inside the slice's file list. The brief was ~10 files; the commit touched 334, including 323 public-to-internal conversions and 55 test files, and retired two conformance tests. Out-of-scope churn makes a diff unreviewable and forces revert of good work along with bad. Do not change type visibility, do not delete or weaken tests, and do not refactor adjacent code. If the slice genuinely cannot land without one of those, stop and report instead.

Outstanding hardening from the V4a audits. Three independent audits of the reverted attempt found defects that outlive it and are tracked as #249:

1. GlGpuDevice.ReleaseTextureSlot frees the table index but never calls BindlessSupport.MakeNonResident. Deleting a texture whose handle is still resident is undefined under GL_ARB_bindless_texture, and every released slot leaks a resident handle for the process lifetime. This is V1 code, present on the current tree.
2. No test covers the Multisample render-state dimension. Mistyping the comparison in GlRenderStateCache would leave the whole suite green — the very regression that reverted V4a.
3. There is no .editorconfig charset rule and no .gitattributes text rule. The first attempt silently re-encoded 259 files and corrupted non-ASCII text in 116 of them, and no gate noticed.

Pre-approved transitional seam. The retained UI draws the paperdoll and appraisal viewport textures, which are produced by renderers that stay raw GL until V4g. The GL backend may therefore expose a documented way to register an externally-owned GL texture as a table slot, used only by that path, removed at V4g. Approved here so a slice does not have to invent it mid-implementation — which is what turned it into an undocumented escape hatch the first time.