acdream/docs/research/2026-09-01-overhaul/s3-walk-ownership-map.md

S3 — Walk: exact PView views, leaf admission, and interleave — ownership map and chunk plan

Status: DRAFT packet written 2026-09-03 at the S2 closeout, BEFORE the owner's §7 capture session. Every retail claim below is decomp-verified (named pseudo-C + Ghidra bridge, cited by address); the capture session adds the per-frame TRANSCRIPT the automated gate needs and may amend §3 (marked "capture-owned"). Nothing in this packet is implemented yet.

Plan: docs/plans/2026-09-01-campaign-overhaul-world-solidity.md §9 S3. Binding inputs: oh1-retail-world-contract.md §4–§5 (view/frame order), oh1-built-mesh-view-contract.md (caller order, stamps, direct answers, binding constraints), 2026-08-30-fw-flood-pseudocode-appendix.md, the FW plan's verified seam map (docs/plans/2026-08-30-campaign-fw-frame-walk.md §"Verified seam map"), and S2's ownership truth (s2-membership-ownership-map.md §9: the registry is the only membership source; the walk reads GetRetailPartEntriesInCell).

1. What S3 changes (behavior)

WalkPView owns retail's exact per-frame state — the portal-view lists, the view/update counts, the todo order, the draw list, and the stamps — and each content category follows its retail leaf rule. Terrain is emitted as ordered landcell events interleaved with buildings and object lists in retail far-to-near order. DrawBuilding is one semantic sequence. The "all terrain first" simplification and every generic GPU clip rule that retail does not have are deleted. S3 ships no evidence infrastructure beyond the one print-only transcript emitter its own gate consumes (rule §5).

2. Retail truth (decomp-verified; addresses are the Sept 2013 build)

Retail function	Address	What it decides	Verified in
PView::InitCell / InsCellTodoList	(walk root; see flood appendix)	seeds the flood from the viewer cell, orders the todo list	flood appendix
PView::ClipPortals / AddViewToPortals / ConstructView	PView::GetClip → polyClipFinish @0x006B6D00	builds CHILD VIEWS by polygon-clipping PORTAL polygons — the only polygon clip in the walk	built-mesh contract §"What polygon-clips?"
Render::copy_view	0x0054dfc0	copies the view polygon, derives edge planes (0x48 semantic fields, prune, cap 31)	built-mesh contract ledger
Render::set_view	0x0054d0e0	installs the view in render globals; NO scissor, NO general mesh clip	idem
Render::obj_view_set	0x0054b9b0	transforms the active planes/sphere through FrameCurrent, publishes local_object_center/radius	idem (side effects unrepresented — Medium row)
Render::viewconeCheck	0x0054c250	the ordinary sphere admission: strict-outside / inclusive-partial	WalkVisibilityMath pins
CPhysicsPart::Draw	0x0050d7a0	outer part-stamp skip (+0xdc vs device +0xb0); force bypasses; local player bypasses the inner stamp	idem
RenderDeviceD3D::DrawMeshInternal	0x0059f360	first admitted view stamps the non-player part and submits the WHOLE eligible mesh once; later views return	idem
RenderDeviceD3D::DrawEnvCell	0x0059f170	no sphere admission; cell stamp (+0x130) gate; whole shell once per stamp	idem
RenderDeviceD3D::DrawBuilding	0x0059f2a0	detail state → FlushAlphaList(0) → CPhysicsPart::Draw(part,1) portal-only BSP pass → flag → Draw(part,0) ordinary shell	idem
PView::DrawCells	0x005a4840	outside-view branch (sunlight, LScape::draw, alpha flush, device-stamp advance @0x005a4886, counter consume/clear, exit seals) then reverse shells (CEnvCell::setup_view @0x0052c430 per live view + DrawEnvCell) then reverse object lists (DrawObjCellForDummies)	retail-world contract §5.2
LScape::draw_check_blocks / landcell_check / grab_visible_cells / draw / calc_draw_order	(landscape walk)	admitted land cells in retail FAR-TO-NEAR order; per admitted cell DrawLandCell THEN DrawSortCell (building pass / look-in / shell / object turn)	retail-world contract §5.2; capture-owned: the exact calc_draw_order sequence at the four poses
DrawObjCellForDummies	(object-list path)	installs the cell's top portal_view_type as PortalList, walks the cell's shadow part list (CShadowPart::insertion_sort by CYpt) and draws each part through the view loop	built-mesh contract §"object-list path"

Facts already PROVED and binding (do not re-derive, do not weaken):

• the built cell shell is stamped and submitted whole once after Boolean admission;
• portal polygons, not built meshes, are polygon-clipped;
• DrawCells draws all shells then all object lists, both in reverse draw-list order, views ascending;
• device, cell-shell and part stamps persist with the local-player bypass;
• the "first view clips the shell" hypothesis is RETIRED.

3. Current acdream owners (functions, not line numbers — re-locate at chunk time)

Retail mechanism	Current owner	Assessment (from the built-mesh comparison at eaea8776, re-checked against c94a1a40 file list)	S3 action
view polygon / planes	WalkViews	strong match	keep; pin
viewcone sense	WalkVisibilityMath	exact	keep
flood + todo order	WalkFrameDriver (flood turns, VisitedCells, OnLandscape)	order proven for shells/objects; _skyDrawnThisFrame is a PROXY for retail's outside_view.view_count != 0	chunk 2 replaces the proxy with the real outside-view count
whole-mesh admission at slot 0	WbDrawDispatcher.WalkClassify (ResolveWalkLightSet, part stamps, RetailWholeMeshSlot)	correct	keep; chunk 4 deletes the still-translated clip slots per category
part stamp identity	(RenderProjectionId, PartIndex)	retail identity is the CPhysicsPart*; S2 made per-cell membership registry-borrowed, so one logical part now reaches the classifier from EVERY cell it is in with the SAME projection id — the identity audit the contract asked for is now structurally answered; pin it	chunk 2 pin
cell shell once per stamp + mid-frame re-arm	WalkFrameDriver shell loop, RetailPViewPassExecutor.WalkLeaf	correct	keep; re-arm gate moves to the real outside-view count
building sequence	WalkFrameDriver building turn, RetailFrameWalk	matches alpha barrier → portal pass → shell	keep; pin as ONE sequence
terrain emission	RetailPViewPassExecutor landscape stage (whole-stage terrain event before building/object turns)	DIVERGES: retail is DrawLandCell then DrawSortCell PER admitted land cell, far-to-near	chunk 3
landscape leaf's use of the installed outside-view list	TerrainModernRenderer visible cells + WalkFrameDriver.VisitedLandscapeCellIds	top-level ownership proven; per-leaf pixel use is an S3 audit item	chunk 3 audit (bounded: one pose)
generic GPU clip rules for categories retail never clips	Vulkan clip slots on look-in / straddling / building categories (RetailPViewPassExecutor, UseIndoorMembershipOnlyRouting)	retail clips only portal polygons	chunk 4 delete, with a CPU/GPU equivalence pin for any category that must keep a translated clip
obj_view_set side effects	not represented (world-space sphere vs captured planes)	mathematically aligned for affine transforms	out of S3 unless the capture shows a consumer
missing SelectionSphere fallback	"any view → whole mesh"	not a retail branch	keep as a corruption fallback, outside parity claims (register row if it survives S5)

4. Chunks (bounded; one Sonnet agent each; stop on a third round)

Chunk 1 — transcript emitter + parser + fixture import (needs §7 captures). One print-only flag (documented in docs/launch-options.md in the same commit) emits the OH line kinds the capture templates produce (tools/walk-oracle/oh/*.template: walk / parts / alpha-depth) from the production walk; the existing FW0-style test-side parser is extended for the new kinds; the four captured pose logs are imported as fixtures. Gate: the emitter's lines parse with the same parser as the retail logs; NO validator, NO canonical JSONL (rule §5, feedback-evidence-infrastructure-sink). BLOCKED until the owner runs the capture session.

Chunk 2 — exact PView state. WalkPView (new, App/Rendering/Walk) owns: the live view list per cell (retail portal_view_type lists), the outside-view count, the view/update counts, the todo order, the draw list and the two stamps. _skyDrawnThisFrame and every other proxy for outside_view.view_count != 0 is replaced by the real count. Per-category leaf contract pinned: whole-once (built shell), Boolean sphere (ordinary part), actual polygon clip (portal polygons only), repeated submission (local player). Part identity pin: the same logical part reached from two cells classifies once per stamp. Can start before the capture (decomp oracle); the capture confirms.

Chunk 3 — interleave. Terrain becomes ordered landcell events: for each admitted land cell in retail far-to-near order, DrawLandCell (that cell's terrain range) then DrawSortCell (building pass 1 / look-in work / building shell / land-cell object turn). Per-landcell terrain ranges come from the existing terrain mesh layout (index ranges per landcell — verify TerrainModernRenderer exposes them; if not, the chunk adds the range table at bake/upload time, not a per-frame rebuild). The whole-stage terrain event is deleted in chunk 4, not here (two-step so the pixel gate can bisect). Gate: terrain pixels/mesh counts unchanged when no interleave is present; dense-outdoor p50/p99 recorded before/after.

Chunk 4 — deletions. The whole-stage terrain event; the generic clip rules on categories retail never clips (Vulkan clip slots removed from those categories); any residual "first view clips the shell" code path. Gate: no duplicate draw of a stamped part across a pan/zoom replay; membership/draw count changes only at a retail view boundary.

5. Review (one Opus retail lens + one shader/perf lens at the S3 boundary)

• retail lens on every stamp/view loop branch and on the call order against the capture transcript and the decomp;
• shader review of clip-space sign, y inversion, W plane, plane count and scissor for the categories that KEEP a translated clip;
• performance review: the command-count increase from interleaving is measured (dense outdoor p50/p99), not hidden by reordering. Lead verifies every finding against the source before an edit (S2 precedent: 19 findings, 4 blocking, all real; see s2-membership-ownership-map.md §9).

6. Automated gate (S3 has no standalone owner gate; folds into G3)

• transcript equality with the §7 captures at the captured depth for all four poses plus the FW0 still fixtures;
• tests distinguish whole-shell-once, Boolean part admission and actual polygon clipping;
• pan/zoom replay changes membership/draw count only at a retail view boundary;
• no duplicate draw of a stamped part;
• terrain pixels/mesh counts unchanged when no interleave is present;
• self-gate route (tools/overhaul-selfgate/) at the three owner poses + the four capture poses, pixel-diffed against the G2 candidate run logs/selfgate-20260903-010022-s2-review-fixes-3 — the per-region diff, not the eye, is the verdict (feedback-deleted-fallback-carried-population).

6b. Capture session progress (2026-09-03)

• Recon PASSED against the live 2013 client (logs/oh-capture/oh-recon.log): every template offset and breakpoint address matches; globals sane.
• Pose cathedral-leak (extra, owner-chosen): standing on the cathedral stairs where the outside structure leaks into the interior — RETAIL SHOWS THE ARTIFACT (2013 and EoR clients both). Transcript: logs/oh-capture/cathedral-leak.walk.log (5 frames: DI f4180108, DC with ov=4, EC/OC stamps, 531 LC/SC land-cell draws per frame in far-to-near order over landblocks f3–fe × 00–18), cathedral-leak.parts.log (3 frames, 5,933 PD / 965 DM), cathedral-leak.alphadepth.log (5 frames, 1,407 AM / 2,856 FL / 28 PM / 16 PC). Owner's retail screenshot (2026-09-03, 2013 client, SAVED at logs/oh-capture/cathedral-leak.retail.png, lead-verified): standing on the floating stairs in f4180108, a large slab of the EXTERIOR wall (arched exterior stone texture) cuts diagonally through the stair chamber from the upper left, drawn over the interior landings and ramps that remain visible around it — the same leak acdream shows at the same spot. This pose is S3/S4's primary oracle: the target is to reproduce retail's frame at it, leak included.
• Pose cathedral-arrival (owner "ready" 2026-09-03 06:58): transcript logs/oh-capture/cathedral-arrival.walk.log (5 frames, 5,604 lines: main PView 009d4f48 DI f4180108, DC ov=3 n=2 f4180108 f4180107; a SECOND PView 009d4530 with ov=0 draws cells f4180113/f4180112/f4180114 each frame with no DI of its own — RESOLVED (§8 R1): it is RenderDeviceD3D::outdoor_pview's look-in DrawCells, driven by PView::DrawPortal from the building pass; 454 LC + 619 SC per frame, 40 EC / 40 OC total), cathedral-arrival.parts.log (3 frames, 7,822 PD / 1,240 DM), cathedral-arrival.alphadepth.log (5 frames, 1,735 AM / 3,570 FL / 35 PM / 19 PC). NOTE: the kit README expected DI f4180106 (FW0's arrival still); the live client reported f4180108, the stair-chamber cell — the owner's actual standing cell, recorded as-is.
• Chunk-3 oracle read off the two cathedral transcripts (frame 2 of each, viewer in f4180108): after the root DI/DC and ONE LS, retail emits LC <cell> then SC <cell> for every admitted land cell in STRICT alternation (LSLSLS…, never two LC in a row) — DrawLandCell then DrawSortCell per cell, exactly the per-cell interleave chunk 3 ports. Block order is far-to-near from the far corner: rows y=00…0d each walked x=fe→f6, then from the Chebyshev-10 ring inward the column and row interleave diagonally (fe0e fd0e fe0f fc0e fe10 fb0e fe11 …), ending at … f417 f318 f418; the exact rule is LScape::calc_draw_order's and the transcript pins it. Far blocks draw ONE cell (xx000001, side count 1); near the viewer SC fires for all 64 cells of the block while LC fires only for the in-view ones (f418: 16 LC / 64 SC; f417: 56 / 64; f318: 3 / 64) — DrawSortCell runs under alwaysDrawObjects for every cell of an in-view block, DrawLandCell only for in-view cells (RenderDeviceD3D::DrawBlock @0x005a19d9 — chunk 3 re-reads the exact gate). Per frame: leak pose 531 LC / 757 SC / 16 BLD; arrival pose 533 LC / 698 SC / 14 BLD.
• Remaining poses per the kit README: holtburg-doorway-still, terrace-edge, foundry-deep.

7. Open questions for the capture session (ask for exactly these two)

1. LScape::calc_draw_order sequence at each of the four poses (far-to-near land cell order) — chunk 3's oracle. Captured by the walk template's LC/SC lines (added 2026-09-03: RenderDeviceD3D::DrawLandCell 0x0059f120 / DrawSortCell 0x0059f140, one line per call with the cell's m_DID).
2. Per-frame outside_view.view_count and the device-stamp advance count at each pose — chunk 2's oracle for the re-arm gate.

8. Chunk 2 contract — exact PView state (lead, 2026-09-03, written during the capture session)

Every claim below was re-read this session in the named pseudo-C and, where BN's FPU rendering was ambiguous, in Ghidra (port 8081, patchmem.gpr, the paired 2013 build). Addresses are the Sept 2013 build.

8.1 Retail facts (verified)

• R1 — two PViews. RenderDeviceD3D::Init @0x0059efb0 constructs indoor_pview = PView(…, 1) and outdoor_pview = PView(…, 0); the ctor argument is draw_landscape (@0x005a52c1). RenderDeviceD3D::DrawInside @0x0059f0d0 tail-calls PView::DrawInside(indoor_pview, cell); RenderDeviceD3D::DrawPortal @0x0059f0e0 pins building_view = -1 around PView::DrawPortal(outdoor_pview, …). The captures' second pv with ov=0 (009d50e0 at cathedral-leak, 009d4530 at cathedral-arrival, cells f4180112/13/14, four DrawCells per frame, no DI) is outdoor_pview's look-in flood through the cathedral's exterior portals. acdream's RetailFrameWalk._outdoorPView { DrawLandscape = false } and WalkBuildingPortals.DrawPortal already model this. PIN ONLY.
• R2 — flood reset. PView::ConstructView(CEnvCell) @0x005a57b0 sets outside_view.view_count = 0, master_timestamp++, cell_todo_num = 0, cell_draw_num = 0 before InitCell. WalkPView.ConstructView matches. PIN ONLY.
• R3 — the outside_view.view_count > 0 branch encloses the whole landscape turn. PView::DrawCells @0x005a4840: from 0x005a4852 to 0x005a49eb, ALL of useSunlightSet(1), PortalList = this, LScape::draw, FlushAlphaList(0f) @0x005a4872, m_nFrameStamp += 1 @0x005a4886, the gated Z clear @0x005a4893–0x005a48a9, and the exit-seal loop @0x005a48c0–0x005a49eb (per draw-list cell far-to-near, per live view CEnvCell::setup_view @0x005a4983, then DrawPortalPolyInternal(portal_poly, 0) @0x005a49b7 for every portal whose other_cell_id == 0xffffffff) sit INSIDE if (outside_view.view_count > 0). Only useSunlightSet(0), restore_all_lighting, the reverse shell loop @0x005a4a00 and the reverse object-list loop @0x005a4ade are unconditional. DIVERGENCE TODAY: WalkFrameDriver.OnInteriorFloodDrawTurn emits ClearInteriorDepth and ExitSeals unconditionally and gates the stamp advance on the _skyDrawnThisFrame proxy; its comment and the driver's type doc claim "both unconditional for an interior root's own flood" — that claim is wrong against the decomp, and the WalkFrameDriverTests pin that reads "ov==0 … CLEAR/SEALS still fire unconditionally" pins the wrong behavior. (The plan's S5 cleanup inventory already lists "unconditional clear code"; chunk 2 retires it now.)
• R4 — the Z clear is gated by a persistent seal counter. The clear is if (forceClear != 0 || portalsDrawnCount != 0) Clear(Z), with D3DPolyRender::portalsDrawnCount (uint16 @0x008719b4) read-then-zeroed at that point (@0x005a489c–0x005a489e). forceClear (@0x008ed824) is a .data int with no write anywhere in the pseudo-C (its only references are the two reads and its definition) → the clear fires iff portalsDrawnCount != 0. The counter increments ONLY in DrawPortalPolyInternal @0x0059bc90 at 0x0059bd74, and only when its second argument is FALSE, after a degenerate-polygon guard (Ghidra: skip when every vertex has x == +12, or every x == −12, or every y == +12, or every y == −12 — an equality sentinel, NOT a ±12 clip box as BN's FPU rendering suggests) and BEFORE polyClipFinish — it counts calls, not surviving fans. False-argument callers: the exit seals (@0x005a49b7, literal 0); pass-3 ConstructView(CBldPortal) punches (@0x005a5a7b, arg5 == 1 → false for pass 3); PView::DrawPortal's arg4 == 3 failure branch (@0x005a5b7c). But DrawMeshInternal runs buildings through passes 1 and 2 only (@0x0059f3cc / @0x0059f3d9), and pass 1's punch passes TRUE (maxZ1, no increment) — so in the building path the counter is fed by EXIT SEALS ALONE. Consequence, a retail quirk to port as-is: the first ov>0 interior frame after a period without seals draws NO Z clear; every later ov>0 frame clears because the previous frame's seals armed the counter. Outdoor frames and look-in DrawCells (ov=0) neither arm nor consume it.
• R5 — punch/seal depth state. SetDepthBufferMode(DEPTHTEST_ALWAYS, (maxZ >> 2) & 1) with maxZ1 = 7 (argument true: building pass 1) and maxZ2 = 6 (argument false: seals, pass 3); both write depth. S4's terrain-punch question is untouched by chunk 2.
• R6 — part identity. Retail stamps the CPhysicsPart (+0xdc against the device's +0xb0). After S2, one logical part reaches the classifier from every cell it is in with the SAME projection id, so (RenderProjectionId, PartIndex) is the identity. PIN ONLY.

8.2 Production behavior change

• B1 — the real count gates the whole turn. RetailFrameWalk.DrawInside passes _interiorPView.OutsideView.ViewCount to IWalkEventSink.OnInteriorFloodDrawTurn(cells, outsideViewCount). The driver then executes retail's branch exactly: outsideViewCount > 0 → the landscape flush leaf (retail FlushAlphaList(0f) @0x005a4872 plus the pre-clear dynamics hook that RetailPViewRenderer.ClearWalkInteriorDepth bundles today), the stamp advance (AdvanceWalkPartPassStamp + the shell and particle-turn re-arms), then ClearInteriorDepth ONLY IF PortalsDrawnCount != 0 (read-then-zero, R4), then ExitSeals; outsideViewCount == 0 → none of them. _skyDrawnThisFrame is deleted; its "second landscape turn" fail-loud guard is kept on a frame-scoped count field, its "landscape ran" use is replaced by the count the sink receives.
• B2 — the counter. The driver owns PortalsDrawnCount (retail D3DPolyRender::portalsDrawnCount), retained ACROSS frames (the driver is retained by RetailPViewRenderer; never cleared by BeginFrame/ AbortFrame/EndFrame), incremented at the exit-seal turn by the number of seal polygons actually submitted: for each flood cell (far-to-near) × each live view slice × each portal with OtherCellId == 0xFFFF and ≥3 vertices — the same enumeration RetailPViewPassExecutor.DrawPortalDepthWrite performs. Implement it as a return value from the seal leaf (DrawExitSeals returns the submitted count) so the count and the draws come from ONE enumeration; the driver adds it. Never incremented by punch fans. Not touched by look-in DrawCells.
• B3 — leaf split. RetailPViewRenderer.ClearWalkInteriorDepth splits into FlushWalkLandscape (pre-clear dynamics + FlushLandscapeAlpha) and ClearWalkInteriorDepth (the Z clear only); IWalkFrameLeafRenderer gains the flush leaf and DrawExitSeals returns int; WalkFrameEventKind gains LandscapeFlush. The fake leaf in WalkFrameDriverTests logs it as "LFLUSH".
• B4 — no new owner class. The packet's "WalkPView (new)" is the EXISTING WalkPView; chunk 2 adds no class. The per-category leaf contract (whole-once built shell; Boolean sphere for ordinary parts; polygon clip for portal polygons only; repeated submission for the local player) is pinned by tests — the implementer first LISTS which of these four pins already exist (WalkFrameDriverTests, WbDrawDispatcher WalkClassify tests, WalkVisibilityMath pins) and adds ONLY the missing ones, naming the retail address in each test's comment.

8.3 Tests (flip, add, keep)

• T1 (flip): the ov==0 pin expects NO LFLUSH/CLEAR/SEALS and no stamp advance before the flood — the opposite of today's expectation.
• T2 (add): ov>0 first frame → LFLUSH, NO CLEAR, SEALS, flood; the next frame of the same driver → LFLUSH, CLEAR, SEALS, flood (armed by frame 1's seals); a driver whose flood cells have no exit portal never clears.
• T3 (add): a look-in DrawCells (ov=0, LookInStatic stage) neither arms nor consumes the counter.
• T4 (add if absent): R1 (two pviews, the outdoor one never raises an outside view) and R2 (the reset) pins.
• T5 (update): the existing direct OnInteriorFloodDrawTurn callers (WalkFrameDriverTests ≈ lines 349, 602–610, 642, 693–703) pass the count they model; the two "look-in shell repaints after the clear" tests model ov>0: one asserts the first-frame no-clear quirk explicitly, the other pre-arms the counter (a prior seal turn) and asserts the clear — both behaviors stay pinned.
• Keep: every other driver/walk pin unchanged; LaunchOptionsDocumentationTests is unaffected (no flag added or removed).

8.4 Out of scope for chunk 2

Terrain interleave (chunk 3); clip-slot deletions and the ProbeCathedral* discriminators (chunk 4 / the S5 inventory); S4's punch z-func; the pre-clear dynamics hook's retail home (LScape::draw's per-cell object turn — chunk 3 places it).

8.5 Lead verification and gate

Every R-fact re-read at its address before the commit; the App hermetic lane plus the InstalledDat lane green; the three-pose self-gate plus the two captured cathedral poses pixel-diffed against logs/selfgate-20260903-062615-s2-chunk6 — the expected delta is zero at steady state (the only retail-different frame is the first ov>0 frame after a no-seal period, which no still captures); the walk transcript at cathedral-arrival must still show the root DC ov=3 and four look-in DC ov=0 turns per frame.

9. Chunk 3 contract — the landscape interleave (lead, 2026-09-03)

Written during the capture session from the two cathedral transcripts and the decomp; every fact below is verified at the cited address or against the captured sequence itself. Chunk 3 implements AFTER chunk 2 lands (it edits the same driver).

9.1 Retail facts (verified)

• R1 — the per-cell interleave. RenderDeviceD3D::DrawBlock @0x005a17c0 runs two loops over the block's draw_array (far-to-near): loop 1 (@0x005a1876) IsInView && num_shadow_objects → UpdateObjCell + CShadowPart::insertion_sort; loop 2 (@0x005a197d) if (IsInView) DrawLandCell(cell) @0x005a19c0, then if (alwaysDrawObjects != 0 || IsInView) DrawSortCell(cell) @0x005a19e6 followed by FlushAlphaList(flush) only when flush > 1. Retail defaults: alwaysDrawObjects = 1 (@0x00820ed4), flush = 0.75f (@0x00820ed0) — so DrawSortCell runs for EVERY cell of an in-view block, DrawLandCell only for in-view cells, and the per-cell alpha flush is inert. Transcript (frame 2 of both captures): one LS, then LC/SC in strict alternation, never two LC in a row; 531 LC / 757 SC (leak), 533 LC / 698 SC (arrival); SC = 64 per near block, LC = only the in-view cells.
• R2 — the order port is oracle-exact. LandWalkOrder.GetBlockOrder (LScape::get_block_order @0x00504c50, walked backwards) and FillCellOrderFarToNear + ClosestCell (CLandBlock::calc_sq_draw_order @0x0052f4a0; CLandBlock::calc_draw_order @0x00530300 is a tail call to it) reproduce the captured LC AND SC sequences for all 260 (arrival) / 256 (leak) blocks with ZERO mismatches, given two facts the check needed: (i) the captured blocks span Chebyshev ring 24, so the grid radius is ≥ 24 — WalkLandscapeAssembler.MidRadius = 25 is consistent; (ii) LOD cell ids are numbered x*8 + y + 1 in LOD coordinates (a side-2 block's cells are 1, 2, 9, 10), i.e. retail's lcell[x*side+y].m_DID. LOD by ring from the captures: ring 0–1 → side 8, ring 2 → 4, ring 3–4 → 2, ring ≥ 5 → 1 — exactly WalkLandscapeAssembler.SideCellCountForRing. The FW-era IWalkEventSink.OnLandscapeCellTurn(landblockId, side, cellIndex) already expands a coarse cell into its covered 8×8 owner buckets.
• R3 — one land cell's terrain is arithmetic on the existing mesh. DrawLandCell @0x0059f120 draws one land cell at the block's LOD. acdream's terrain mesh is 8×8 cells per landblock, cell-major (LandblockMesh.Build: cy outer, cx inner, indices[i] = i, 6 indices per cell), uploaded per slot with FirstIndex = slot * 384 (TerrainModernRenderer.IndicesPerLandblock == 384). acdream cell (cx, cy) is the contiguous run [(cy*8 + cx)*6, +6) inside the slot; a retail LOD cell (side n, LOD coords (X, Y)) covers cx ∈ [X*8/n, (X+1)*8/n), cy ∈ [Y*8/n, (Y+1)*8/n) → 8/n runs of (8/n)*6 contiguous indices (side 8: one run of 6; side 4: two runs of 12; side 2: four runs of 24; side 1: one run of 384). No range table is baked; no per-frame rebuild.
• R4 — why the interleave is a behavior change (the S4 hypothesis). The far-Z punch (DrawPortalPolyInternal, DEPTHTEST_ALWAYS + write) runs at the BUILDING's cell turn (DrawSortCell → DrawBuilding). In retail every NEARER land cell's terrain is drawn AFTER that punch and overwrites the punched depth, so a doorway behind a hill cannot show its interior through the hill. acdream draws ALL terrain first (TerrainSlice(0) at the landscape turn) and every building afterwards, so a doorway behind a hill punches through it — the doorway-sized house fragments through the Holtburg hill in the owner's G2 screenshot. Chunk 3 is expected to remove that artifact by ORDER alone; the Holtburg self-gate pose is the verdict. If it does, S4's "exact z-func" question closes with no z-func change (ledger + S4 row note). This supersedes the packet's §4 "two-step bisect" wording: the whole-stage terrain event is replaced in THIS chunk (drawing terrain twice would already hide the punch and make the gate meaningless), and chunk 4 loses that deletion.
• R5 — the sky draws TWICE, and the second pass is the WEATHER. LScape::draw @0x00506330 calls GameSky::Draw(sky, 0) @0x0050633c BEFORE draw_check_blocks, walks the blocks (DrawBlock @0x00506374), then calls GameSky::Draw(sky, 1) @0x00506396 AFTER every block. GameSky::Draw @0x00506ff0's arg2 == 1 is the weather pass, gated on SmartBox::is_player_outside @0x00451e80 (already Ghidra-arbitrated and modeled by RetailPViewPassExecutor.DrawLandscapeSliceLate's RenderWeather call — see that method's comment). Chunk 3 keeps the sky at the landscape turn's start and places the weather pass AFTER the last land cell of the turn (retail order); the implementer confirms where the late landscape slice runs relative to the new per-cell events and moves the weather call only if it currently runs before them.

9.2 Production behavior change

• B1 — per-cell land-cell events. RetailFrameWalk.DrawLandscape emits, per DrawArray cell in retail order: sink.OnLandCellTurn(landblockId, side, cellIndex) when CellInView[cellIndex] != Outside (R1's DrawLandCell gate), THEN the existing DrawBuilding + OnLandscapeCellTurn (the DrawSortCell half, gated by AlwaysDrawObjects || in view as today). The driver records a LandCell frame event (slot landblock id, LOD side, LOD cell index, plus the retail LOD cell id x*8+y+1 for the chunk-1 transcript) at that point in the stream, and DELETES the whole-stage TerrainSlice(0) emission and the DrawTerrainSlice leaf. The leaf DrawLandCell submits the R3 index runs through a new TerrainModernRenderer.DrawCellRuns(landblockId, side, cellIndex) (or a batched form, B2) with the same pipeline/state the whole-block draw uses, UNCLIPPED for interior roots exactly as the FW4-slice-6 comment demands (retail never view-clips terrain; the exit seals and the interior repaint own aperture exactness).
• B2 — order-preserving batching. Consecutive LandCell events of the SAME slot with no intervening non-terrain event merge into ONE indirect draw whose command list is the concatenated runs in event order; any intervening event (building alpha barrier, punch, shell, statics mark) splits the batch. Pixel-identical by construction; this is the only concession to the ~530–700 land cells per frame.
• B3 — TerrainModernRenderer.Draw(...) keeps serving non-walk callers (directional-shadow receivers etc.); the walk path stops calling it. The _walkTerrainInViewLandcells plumbing that only fed the walk draw is deleted if nothing else reads it (grep; if a shadow pass reads it, leave it and say so).
• B4 — no new class beyond the leaf/renderer entry points, no flag, no probe. The existing OnLandscapeCellTurn LOD expansion is unchanged.

9.3 Tests

• T1 (order pin, R2): LandWalkOrder + WalkLandscape.CalcDrawOrder + SideCellCountForRing reproduce frame 2's LC and SC sequences of BOTH captures. Fixture = the parsed cell-id sequences (reuse the existing test-side reader tests/AcDream.App.Tests/Rendering/Walk/WalkOracleTrace.cs for the LC/SC line kinds; no new evidence infrastructure). Viewer: block f4/18, sq cell (1, 1) (from the P line: x 36.6, y 24.0).
• T2 (interleave, R1/B1): a two-block synthetic landscape with one building and one out-of-view cell: events are SKY, LC(far)…, [LC, BLD…, statics]… with each cell's LC before its own building/statics, cells far-to-near; the out-of-view cell gets NO LC but keeps its sort turn under AlwaysDrawObjects; no TerrainSlice event exists any more.
• T3 (runs, R3): for side ∈ {1, 2, 4, 8} and every LOD cell, the runs cover exactly the covered 8×8 cells' index ranges, disjoint, total (8/n)²·6.
• T4 (batching, B2): two consecutive same-slot LC merge into one draw; an intervening building barrier splits; order inside the batch is the event order.
• T5: existing WalkFrameDriverTests / renderer pins on TERRAIN:0 updated to the per-cell events; every other pin unchanged.

9.4 Out of scope

Clip-slot deletions (chunk 4); any depth-compare change to the punch (S4 — but the Holtburg verdict is recorded and S4 re-scopes if the punch leak is gone); the pre-clear dynamics hook's home (chunk 4).

9.5 Lead verification and gate

R-facts re-read at their addresses; the App hermetic + InstalledDat lanes green; the three-pose self-gate plus the Holtburg terrain-leak pose (the owner's G2 screenshot spot) plus the two cathedral poses, pixel-diffed against the chunk-2 run: the ONLY expected delta is the punch region at Holtburg (fragments gone); dense-outdoor p50/p99 recorded before/after with the existing frame-time diagnostics (no new counters).

10. Chunk 4 contract — deletions (lead draft, 2026-09-03; re-locate every owner at chunk time, after chunks 2 and 3 land)

10.1 What retail clips, and what it does not (verified)

• Retail polygon-clips exactly three things on the CPU with ACRender::polyClipFinish: portal polygons when building child views (PView::GetClip @0x005a4320 → polyClipFinish), the punch fans (DrawPortalPolyInternal @0x0059bc90 clips the fan against the installed view — building_view @0x0059f3bf during the building pass), and the exit seals (the same function under CEnvCell::setup_view per live view, @0x005a4983–0x005a49b7). Ordinary meshes, cell shells, terrain, particles and the weather are NEVER view-clipped: DrawMeshInternal @0x0059f360 submits the whole mesh after the sphere test, DrawEnvCell @0x0059f170 draws the whole shell, LScape::draw draws whole blocks, and GameSky::Draw(sky, 1) @0x00506396 runs ONCE after the blocks with only the is_player_outside gate (§9 R5).

10.2 acdream inventory (at edb32783; names, not lines)

KEEP (translated clips with a retail CPU counterpart — each gets a CPU/GPU equivalence pin if it lacks one):

• exit seals: RetailPViewRenderer.DrawWalkExitPortalMasks → DrawExitPortalMask(cell, InteriorFloodViewClipPlanesAt(...)) per (flood cell, live view) — retail's setup_view + polyClipFinish per view;
• punch fans: DrawPunchFan(worldPolygon, activeViewIndex) clipped by the pinned view's slice planes — retail's building_view clip;
• the walk's CaptureViews/AppendClipSlot slot table ONLY as far as the two consumers above need it.

DELETE (no retail counterpart):

• the whole-stage terrain event and DrawTerrainSlice leaf — already replaced by chunk 3 (§9 R4); chunk 4 verifies nothing re-grew;
• the per-outside-view-slice weather/late landscape loop (RetailPViewRenderer "GameSky's weather pass still runs through each active landscape view": SetTerrainClip + ClearClipRouting + DrawLandscapeSliceLate per slice with BeginDoorwayScissor + BindTerrainClip) — retail draws the weather ONCE, unclipped; one weather draw after the last land cell (chunk 3 places it; chunk 4 deletes the loop, the scissor, and the terrain-clip binding if no consumer remains);
• the sky-post-scene particle submission's per-slice clipSlot: slice.Slot — retail inserts emitters into one unclipped alpha list;
• RetailPViewPassExecutor.SetCellShellClipRouting (no caller in src or tests) and every SetClipRouting/ClearClipRouting/ UseIndoorMembershipOnlyRouting call that becomes a no-op once no shell or entity clip routing exists — the "first view clips the shell" residue;
• WbDrawDispatcher.WalkClassify.ResolvePartClipSlots's slot LIST return shape: it already answers "whole mesh" (RetailWholeMeshSlot) whenever any view admits the sphere; reduce it to the Boolean retail asks (SphereVisibleInLookInTurn) and delete VisibleClipSlotsInLookInTurn if the seals/punches do not use it (they read planes, not slots — verify);
• the ProbeCathedralSkip* discriminators (ProbeCathedralSkipFloatingStairSeals, …StairBuildingPunch, …FloatingStairCellShells, …SouthLookInCellShells, …LookInShellCellId, …SouthBuildingShell, ProbeCathedralShellOrderEnabled) with their docs/launch-options.md rows and RenderingDiagnostics members — the investigation they served is closed by the retail axiom (the cathedral leak is retail behavior); the S5 inventory already lists them, chunk 4 takes them because it touches every one of their call sites anyway.

10.3 Gate

• no duplicate draw of a stamped part across a pan/zoom replay (the existing replay pins); membership/draw counts change only at a retail view boundary;
• the three-pose self-gate + Holtburg + the two cathedral poses pixel-diffed against the chunk-3 run: expected delta ZERO except where a deleted per-slice scissor previously under-painted the weather at an exit-view edge (record the region if it appears; it is the deletion's intended effect, not a regression);
• LaunchOptionsDocumentationTests green with the seven probe rows and their read sites removed together (the test enforces both directions);
• the register: no row is added (every deletion removes an acdream-only rule); any KEEP item still lacking a CPU/GPU equivalence pin gets one.