acdream/docs/research/2026-09-01-overhaul/s5-consumers-material-closeout-packet.md

Campaign OVERHAUL v2 — S5 consumers, material, and closeout packet

Status: OWNER VISUAL GATE FAIL #473: exterior building sections disappear. S5-c1 through S5-c5 plus #470/#469 landed, but prior provisional graphical coverage did not establish complete exterior shells. Section 42 contracts the narrow detail-active opaque coverage repair. C1c's returned test/doc correction is frozen uncommitted pending review; geometry/membership witness, full-lane closure, connected/performance C2 and owner G4 remain. Branch: claude/campaign-w-retail-frame-walk. Gate: G4 remains unpassed. Nothing merges to main before G4.

This packet decomposes plan S5 into bounded chunks. The lead writes each contract, one bounded OpenAI implementation agent changes only that contract, the lead verifies every retail claim against the named pseudo-C and the paired executable/PDB, and independent sequential OpenAI review lenses run before landing. Per the owner's 2026-09-04 overrides, no remaining campaign step uses Claude Code, Anthropic models, or Anthropic credentials, and a chunk may receive at most ten review passes. Each code finding still receives a bounded contract; documentation-only findings may be corrected directly by the lead. The chunk stops before an eleventh review. Every surviving deviation is entered or corrected in the divergence register in the same implementation commit.

1. Current boundary after S4

S4-c3b is landed and the lead G3 matrix is a provisional PASS; owner inspection and the owner-only G3 rows remain. S5 must not reopen the green walk, portal depth, or two-FIFO alpha ports without new evidence.

The landscape half is already present and exact:

• WalkLandscape.CheckBlocks / LandCellCheck port LScape::draw_check_blocks @0x00505F80 and LScape::landcell_check @0x005050A0;
• WalkVisibilityMath owns the ported get_clip_height / block_check math;
• WalkFrameDriver.VisitedLandscapeCellIds is populated by the same one walk that emits the retail-ordered terrain/object stream.

S5-c1 therefore changes the consumers and deletes the competing fallback. It does not rewrite the landscape calculation.

2. Retail facts for S5-c1 (lead-verified 2026-09-04)

The executable is C:\Users\erikn\Downloads\acclient.exe. Its CodeView record is GUID {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1, matching refs/acclient.pdb.

2.1 ShouldDrawParticles is distance AND the cell virtual

Named pseudo-C at CPhysicsObj::ShouldDrawParticles @0x0050FE60 reads:

if examination: true
if CYpt > degrade_distance: false
if cell == null: false
if cell->IsInView() == 0: false
true

The paired bytes are the same: fld [ecx+0x24], fcomp [esp+4], the x87 test ah,0x41 gate, null-check of [ecx+0x90], then the virtual call through vtable slot +0x68. ParticleEmitter::UpdateParticles @0x0051D180 calls that function at 0x0051D1A1; false enters the SetNoDraw(1) / degraded_out=1 arm, while true clears that state and updates/emits particles.

Preserve the existing x87-compatible comparison, including inclusive equality, unordered admission, raw negative/zero/NaN/infinity authored distances, and the deliberate AP-116 range multiplier (Retail=1, default Extended=2).

2.2 outdoor and indoor cells have different IsInView semantics

• CLandCell::IsInView @0x00532CB0 returns the 32-bit field at +0x104. The paired body is exactly mov eax,[ecx+0x104]; ret. Landscape drawing stamps that field, so particle update consumes the previous completed render frame's landscape answer.
• CEnvCell::IsInView is the PDB-vtable slot at 0x007C8D00, pointing to the ICF-folded body 0x005269F0. The paired body is exactly mov eax,1; ret. Thus an indoor cell with a non-null owner is always PARTIALLY_INSIDE for the update-time check; its particle drawing remains separately controlled by the cell walk.

AC cell identity already has a production-pinned discriminator: low = cellId & 0xFFFF; outdoor land cells have 0 < low < 0x0100, EnvCells have low >= 0x0100, and zero is no cell.

2.3 point lights do not consume the camera walk

Retail collects point lights from the DBObj-load/flush-bounded resident CEnvCell::visible_cell_table, not from the current camera portal flood. Current LightManager.BuildPointLightSnapshot(playerWorldPos) likewise uses the resident registry. RuntimeWorldFrameEnvironmentPreparation's ObserveDrawableCells / ClearDrawableCells methods are now no-ops, while AP-85 still describes the deleted last-frame filter. The methods and the stale claim are tombstones, not behavior.

2.4 the null-root terrain reconstruction is not a retail answer

In-world retail has a viewer-cell root. acdream's null-root path is the AD-21 streaming-gap/debug safety draw. TerrainModernRenderer.CollectVisibleCells manufactures 64 land-cell ids per retained landblock from camera-frustum AABBs and publishes them through TerrainVisibleCellIds. That is the only remaining AP-117 reconstruction. A safety draw with no walk product must publish no outdoor IsInView answer; it must not invent one.

3. S5-c1 contract — typed IsInView consumers and fallback deletion

3.1 C1 — publish the landscape half explicitly

Extend the borrowed RetailPViewFrameResult with the exact landscape land-cell set from WalkFrameDriver.VisitedLandscapeCellIds. Keep DrawableCells for EnvCell shell preparation and keep the existing union VisibleCells only for diagnostics that compare the two products. Do not re-filter, re-walk, sort, or derive the landscape set from projection/entity ids.

Rename the particle handoff to make the type visible in the API, for example MarkVisibleLandscapeCells. It accepts only outdoor land-cell ids and copies them into the controller's building frame. Passing zero or an EnvCell id is a contract violation, not something to silently reinterpret.

The completed frame remains the sole retained owner. AbortFrame preserves the prior completed product, CompleteFrame publishes the new product, and Reset removes both generations. The update thread continues to call Apply before the next render, preserving retail's previous-frame timing.

3.2 C2 — evaluate the correct virtual by cell family

Change ParticleSystem.ApplyRetailView so a world-policy emitter is eligible only when all of the following are true:

hasCompletedView
ownerCellId != 0
(owner is EnvCell OR exact completed landscape set contains ownerCellId)
retail x87-compatible distance predicate

EnvCell means low >= 0x0100; landscape means 0 < low < 0x0100. Examination and dedicated-pass policies keep their existing bypass. This is an update/degrade correction only: do not alter emitter-own-cell draw membership, per-cell particle turns, cone admission, queue routing, alpha order, lifetime, or tick order.

A completed null-root safety frame has an empty landscape set. EnvCell owners still see their constant virtual result; outdoor owners fail closed. Login and portal-space frames still carry hasCompletedView=false and reject ordinary world-policy emitters.

3.3 C3 — delete AP-117's remaining reconstruction

Delete the complete TerrainModernRenderer.CollectVisibleCells route, including _visibleCellIds, VisibleCellIds, BeginVisibilityFrame, IWorldScenePassExecutor.TerrainVisibleCellIds, the null-root publication in WorldSceneRenderer, and the reconstruction-only tests. The flat terrain draw itself remains; only its fabricated visibility side channel goes.

After this deletion, AP-117 is retired: the walk path publishes the ported landscape product, and frames without that product publish none. Update AD-21 in the same commit so it no longer claims the login screen shows live sky and states that the safety draw cannot publish cell visibility.

3.4 C4 — delete the dead point-light feedback seam

Delete ObserveDrawableCells and ClearDrawableCells from IWorldRenderFrameBuilder, IWorldFrameEnvironmentPreparation, their runtime implementations, all calls, fakes, and tests. Keep point-light snapshot selection exactly resident-registry based. Correct AP-85 in the same commit to the code that actually remains: one resident, player-nearest 128-cap pool instead of retail's separate 7-dynamic/40-static pools and DBObj-granular residency. AP-68's owner-approved always-lit-interior policy is unchanged.

3.5 Explicit non-changes

S5-c1 must not change:

• WalkLandscape, WalkVisibilityMath, block/cell order, landscape event order, terrain draws, membership, portal flood, depth, alpha, shaders, RHI, DAT/package code, or streaming ownership;
• point-light capacity, sort anchor, curves, cell/object selection, or AP-68;
• directional-shadow selection (S5-c2 owns that consumer and its retained topology/per-frame visibility design);
• building degrade/complete-body selection (later S5 chunk);
• translucent-detail material combine/AP-232 (later S5 chunk);
• Facility probe and broader cleanup inventory (later S5 cleanup chunk).

No graphical client is launched from the implementation or review worktree.

4. Allowed files

Production changes are limited to the directly affected files:

• src/AcDream.Core/Vfx/ParticleSystem.cs;
• src/AcDream.App/Rendering/Vfx/ParticleVisibilityController.cs;
• src/AcDream.App/Rendering/RetailPViewRenderer.cs;
• src/AcDream.App/Rendering/WorldSceneRenderer.cs;
• src/AcDream.App/Rendering/WorldScenePassExecutor.cs;
• src/AcDream.App/Rendering/WorldRenderFrameBuilder.cs;
• src/AcDream.App/Rendering/TerrainModernRenderer.cs;
• comment-only truth correction in WalkFrameDriver.cs if required.

Tests may change in the directly affected Core/App VFX, renderer, frame-builder, and terrain-visibility files, plus compile-fallout fakes for the deleted interfaces. Documentation is limited to this packet, the plan ledger, acdream-architecture.md, oh1-construction-landscape-contract.md, and the divergence register. If implementation requires another production owner or a new deviation, stop and return the fact before expanding scope.

5. Tests and mutation evidence

Extend production-facing tests to prove:

1. an outdoor emitter is admitted only by the exact completed landscape set;
2. an EnvCell emitter remains update-eligible at authored range even when no indoor cell is in that set;
3. zero cell and no completed world view reject both cell families;
4. inclusive/unordered/raw-distance behavior and AP-116 Retail/Extended multipliers remain unchanged;
5. WorldSceneRenderer hands only RetailPViewFrameResult's landscape set to the particle owner, never the EnvCell set or diagnostic union;
6. abort/complete/reset preserve the previous-frame transaction;
7. no production CollectVisibleCells, TerrainVisibleCellIds, ObserveDrawableCells, or ClearDrawableCells symbol remains;
8. point-light snapshots still include resident lights regardless of the removed feedback set;
9. the warmed production particle-view path allocates 0 managed bytes.

Every new pin gets a real sabotage and exact first failure in the implementer commit body. At minimum mutate independently and restore exactly:

• make EnvCell eligibility depend on set membership;
• make outdoor eligibility constant true;
• feed the union instead of the landscape set at the renderer call site;
• restore one CollectVisibleCells production symbol;
• restore one ObserveDrawableCells production symbol;
• invert or exclude the inclusive authored-distance boundary.

6. Automated return and reviews

Implementer return:

• git diff --check;
• Release solution build, 0 warnings / 0 errors;
• focused Core VFX and App particle/frame/renderer/terrain tests;
• the real warmed 0-B particle-view pin;
• official hermetic lane;
• InstalledDat lane with exactly the documented global failure/skip set and no new failure;
• one clean commit, exact files/counts, and all mutation first failures.

Sequential review 1 — retail fidelity: re-check the named pseudo-C and paired bytes above, the CEnvCell vtable/ICF identity, previous-frame timing, cell-id discriminator, and every preserved x87/AP-116 edge. Review 2 — architecture, production, and gate honesty: prove one retained product, typed call-site reachability, no reconstructed/null-root answer, no point-light behavior change, reset/abort/lifecycle correctness, 0-B steady state, allowed scope, all register prose, all gate counts, and at least three mutation claims. A failed lens receives one bounded fix contract; a third fix round stops the chunk.

7. Remaining S5 decomposition after c1

1. S5-c2: exact landscape visibility consumption by directional-shadow caster selection without creating a second set or rebuilding retained topology on every camera-only change.
2. S5-c3: retail DrawBuilding degrade selection and complete-body null gate.
3. S5-c4: translucent detail single-stage framebuffer equivalence; retire AP-232.
4. S5-c5: delete Facility probes, production PortalVisibilityBuilder residue, obsolete fallbacks/flags/tests/claims; add architecture guards.
5. S5 closeout: full automated/lifecycle/performance program, G4 owner matrix, documentation closeout, then and only then merge to main.

8. Pre-review gate correction — retired-row count

The first official hermetic lane is retained as a failed artifact: 16,759 of 16,760 tests passed. The only failure is WalkStaticStreamPopulatorTests.WorldAlphaCyptDocumentationAndRegister_PinPerCellTruthAndThreeResiduals: its literal expected 162 active AP rows, while this chunk correctly retires AP-117 and leaves 161. This is a coupled documentation-test correction, not a renderer finding and not a review fix round.

The bounded correction may change only tests/AcDream.App.Tests/Rendering/Walk/WalkStaticStreamPopulatorTests.cs, replacing the stale active-row count with 161. Do not add a fabricated register row and do not change the three AP-241/AP-242/AP-243 assertions. Run the exact failed test first, then a fresh official hermetic lane under a new artifact name and the required InstalledDat lane. Preserve the original failed artifact and record both identities in the implementer return.

9. S5-c1 implementation result — 2026-09-04

The bounded implementation publishes WalkFrameDriver.VisitedLandscapeCellIds as the typed landscape product, retains it transactionally in the particle visibility owner, and applies the retail cell-family virtual: membership for land cells, constant true for non-null EnvCells. The null-root terrain reconstruction and the dead point-light drawable-cell feedback chain are deleted. AP-117 is retired; AP-85 and AD-21 now describe the surviving code.

The real warmed allocation pin initially exposed that enumerating the retained SortedSet<int> of world-simulation handles allocated on every Apply. The owner is now a sorted List<int> maintained at lifecycle mutation time, so the production Apply loop preserves stable handle order and measures 0 B without changing queue, router, draw, or particle tick behavior. This is an implementation-mechanism correction, not a retail behavior deviation.

Focused returns before the official lanes: Core VFX 111/111, App particle / frame / renderer / terrain 146/146, and the real warmed production allocation pin 1/1 at 0 B. Release built with 0 warnings / 0 errors. The first official hermetic artifact, artifacts/s5-c1-hermetic-20260904, is deliberately preserved at 16,759/16,760: its sole failure was the stale 162-row test literal after AP-117's retirement. Section 8 authorized only that coupled test correction; the exact failed pin then passed 1/1 with the truthful 161-row header and physical count. The one-shot corrected official lane at artifacts/s5-c1-hermetic-corrected-20260904 then passed 16,760/16,760, 0 skipped, across 14 assemblies. The inclusive InstalledDat lane at artifacts/s5-c1-installed-20260904 produced the documented global set: 385 passed, 10 failed, 1 skipped. The failures are TowerAscent, the two #383 layout sweeps, #458 Oh_doorway_still_first_frame_diff, and the six AlphaFlushCounts_* transcript Facts; the skip is Sweep_the_lookin_gate_decodes_against_the_street_fixture. No new failure or skip identity appeared.

Independent mutation ledger (each mutation restored exactly before the next):

1. EnvCell eligibility made set-dependent: ApplyRetailView_UsesLandscapeMembershipButEnvCellConstantVirtual first failed Assert.True, expected true / actual false, at ParticleSystemTests.cs:553.
2. Outdoor eligibility made constant true: the same test first failed Assert.False, expected false / actual true, at ParticleSystemTests.cs:559.
3. Renderer fed the diagnostic union: PViewWorld_PublishesOnlyLandscapeCellsToParticleVisibility first failed the HashSet equality at WorldSceneRendererTests.cs:279, expected [16842755], actual [16843008, 16842755].
4. A production CollectVisibleCells symbol was restored: Production_source_has_no_reconstructed_particle_visibility_feedback first failed at TerrainParticleCellVisibilityTests.cs:37, naming TerrainModernRenderer.cs.
5. A production ObserveDrawableCells symbol was restored: the same source guard first failed at line 37, naming WorldRenderFrameBuilder.cs.
6. The inclusive boundary was changed from <= to <: ApplyRetailView_UsesOwnerVisibilityAndInclusiveAuthoredDistance first failed Assert.True, expected true / actual false, at ParticleSystemTests.cs:519.

10. Sequential review 1 — retail lens and fix round 1

The retail lens found no behavioral retail-fidelity defect. It independently matched the paired executable/PDB identity and bytes for ShouldDrawParticles, UpdateParticles, both cell-family virtuals, the previous-completed-frame transaction, the low-word discriminator, examination bypass, x87 distance edges, AP-116, the exact landscape handoff, and unchanged particle draw/queue/tick behavior. The lens returned FAIL on comment truth only:

1. ParticleVisibilityController.UseWorldView still says an outdoor fallback can publish the authoritative product, although S5-c1 deleted it.
2. WalkFrameDriver.CopyVisibleCellsTo still calls the diagnostics union the complete CObjCell::IsInView answer and says particles, lights, and shadows consume it. Particles now consume only the landscape half, EnvCell particle eligibility is constant true, point lights use the resident registry, and directional shadows remain S5-c2.
3. ParticleSystem calls the sorted-list lifecycle insertion/removal cost binary even though only the insertion search is binary and list shifts / removal are linear. Its adjacent blanket O(log E) lifecycle sentence must remain scoped to the SortedSet indexes rather than the new list.

Fix round 1 is comment-only. It may change exactly ParticleVisibilityController.cs, WalkFrameDriver.cs, and ParticleSystem.cs, plus this packet's result section. Do not change behavior, tests, register rows, architecture prose, or any other file. Correct the three descriptions to the surviving ownership/cost model, run git diff --check and the same focused retail-review classes (47 Core particle tests, 38 App visibility/terrain/frame/renderer tests, and 3 AP-116 settings/live-object tests), commit once, then return to a narrow retail comment-truth re-review. The production/gate-honesty lens remains undispatched until that re-review passes. A third fix round still stops the chunk.

10.1 Fix-round-1 implementation result

The three stale descriptions are corrected without behavior or assertion changes. CopyVisibleCellsTo describes a diagnostic union and names the distinct particle, point-light, and future directional-shadow consumers. ParticleSystem scopes the logarithmic lifecycle statement to its SortedSet indexes and records the sorted list's binary-search plus linear-shift insertion and linear search/compaction removal costs. Focused gate results: Core ParticleSystemTests 47/47, App visibility/terrain/frame/renderer 38/38, and AP-116 settings/live-object 3/3; git diff --check is clean. The first narrow re-review found the UseWorldView result sentence still misstated null-root transaction state; fix round 2 below supersedes that sentence.

11. Retail narrow re-review — fix round 2 (last allowed)

The narrow retail re-review passed the four-file scope, behavior/test/register invariance, diagnostic-union wording, sorted-list cost wording, diff check, and the focused 47 + 41 tests. It found one remaining MINOR comment-truth error: ParticleVisibilityController.UseWorldView and §10.1 say the null-root safety draw omits/excludes the completed product. Production begins visibility before root resolution and calls UseWorldView for every non-login built frame, so a null-root safety frame completes hasCompletedView=true with an empty landscape set. Login/portal frames carry hasCompletedView=false. This distinction is already the bound §3 behavior: null-root invents no fallback cells.

Fix round 2 is the last allowed round and is prose-only. It may change exactly the UseWorldView XML comment in ParticleVisibilityController.cs and this packet's result prose. State that non-login world frames participate in the completed transaction; the retail walk publishes its exact landscape set when present, while null-root completes an empty set without reconstruction. Do not change code behavior, tests, register/architecture prose, or any other file. Run git diff --check, Core particle 47/47, and the combined App/AP-116 41/41; commit once and return to the same narrow retail lens. Any further finding that would require a third fix round stops S5-c1 and is written up.

11.1 Fix-round-2 implementation result

UseWorldView now states the production transaction exactly: every non-login world frame participates; a PView walk contributes its exact landscape set, while a null-root safety frame completes hasCompletedView=true with an empty set and no reconstructed fallback. Login and portal-space frames retain hasCompletedView=false. No behavior or assertion changed. Core particle tests passed 47/47, the combined App visibility/terrain/frame/renderer plus AP-116 lane passed 41/41, and git diff --check is clean.

12. Owner-authorized documentation/evidence exception — 2026-09-04

The final production/gate-honesty lens found no production-code or test defect but returned FAIL after fix round 2 on two correction-worthy truth gaps:

1. architecture and AD-21 say null-root publishes no cell-visibility answer, while production completes hasCompletedView=true with an empty landscape set; and
2. the official lane summaries identify dirty bases, but the packet does not independently bind those dirty source deltas to implementation commit 9aadc917a.

Per the campaign rule, S5-c1 stopped and the campaign branch recorded that stop at efb075619. The owner then explicitly authorized a documentation/evidence-only exception: "correct docs and continue." The stop and both failed-lens results remain in history.

The exception is bounded to:

• truth-correcting the null-root sentence in docs/architecture/acdream-architecture.md;
• truth-correcting AD-21 in docs/architecture/retail-divergence-register.md;
• recording this exception and its evidence in this packet; and
• updating only the S5-c1/S5 ledger rows in docs/plans/2026-09-01-campaign-overhaul-world-solidity.md.

No production code, tests, other register row, architecture section, or prior artifact may change. The correction must state that every non-login world frame participates, a walk contributes its exact landscape set, and null-root completes an empty set without reconstruction; login/portal remain false.

After the documentation correction is committed, create fresh official evidence from that clean exact commit (not a dirty pre-commit tree):

• artifacts/s5-c1-exception-hermetic-20260904 — hermetic lane;
• artifacts/s5-c1-exception-installed-20260904 — InstalledDat lane.

Both summaries must record the correction commit and WorktreeDirty=false; their manifests must verify completely. The older dirty-base artifacts remain preserved as historical evidence but are superseded for landing provenance. One narrow independent production/gate-honesty re-review verifies only the authorized documentation diff, exact clean artifact identity/counts/hashes, and absence of code/test changes. PASS permits landing and the graphical gate; any behavioral change or further correction-worthy finding stops again.

12.1 Exception implementation result — clean evidence complete

The authorized documentation correction aligns the architecture and AD-21 with production's existing transaction without changing code or tests: every non-login normal-world frame participates, the walk contributes its exact landscape set when present, and null-root completes hasCompletedView=true with an empty set and no reconstruction; login and portal-space retain hasCompletedView=false.

The pre-exception official artifacts remain preserved as historical evidence, including their dirty-base identities. They do not become clean commit-bound evidence by prose assertion. Both replacement lanes ran from exact correction commit d6592d3ac56bc400bfdaab7cff59306319b5b96d with WorktreeDirty=false and now supersede the older dirty artifacts for landing provenance:

• artifacts/s5-c1-exception-hermetic-20260904 — PASS, 16,760 passed, 0 failed, 0 skipped across 14 assemblies. Its 32-entry SHA-256 manifest verifies with zero missing or mismatched files.
• artifacts/s5-c1-exception-installed-20260904 — 385 passed, the same 10 documented failures, and the same 1 documented skip across 14 assemblies. Its 30-entry SHA-256 manifest verifies with zero missing or mismatched files. Compare-Object over every non-passing TRX identity against the historical inclusive artifact returned zero differences.

The first clean InstalledDat invocation omitted ACDREAM_RUN_INSTALLED_DAT_TESTS=1; 97 live-DAT tests therefore self-skipped with their explicit opt-in message. That invalid evidence is preserved at artifacts/s5-c1-exception-installed-invalid-missing-env-20260904 (291 passed / 8 failed / 97 skipped) and is not used for acceptance. The canonical invocation pinned both ACDREAM_RUN_INSTALLED_DAT_TESTS=1 and ACDREAM_DAT_DIR=C:\\Turbine\\Asheron's Call; it produced the exact documented identity above without a product change or product retry.

Production and tests remain byte-identical to the authorized contract parent. The plan ledger therefore advances to clean evidence complete, with only the narrow independent production/gate-honesty review pending before landing and the graphical gate.

13. S5-c1 landing and lead graphical gate — 2026-09-04

S5-c1 is LANDED. The mandatory stop remains in campaign history at efb075619; the owner-authorized continuation was not used to rewrite it. Reviewed scratch commits 9aadc917a → afaebcad6 → 74a2e4c48 → ed8200664 → a28384d80 → b7a7eb9e2 → d6592d3ac → b2d56f9e3 map to campaign commits 94a6b5ef3 → 282fe87fb → 4d1110812 → 3f17c9131 → 6bbb9e117 → 36569c0b0 → ad115141a → 1718832e2. The integrated tree is byte-identical to reviewed scratch tip b2d56f9e3.

The one narrow independent exception re-review returned PASS with no finding. It verified the exact four-document authorized scope, the corrected architecture/AD-21 transaction, no src/ or tests/ diff, both clean summary identities and counts, hermetic 32/32 plus InstalledDat 30/30 manifest verification, zero non-passing-identity difference from the historical inclusive InstalledDat artifact, and honest exclusion of the missing-opt-in attempt.

Fresh campaign verification at 1718832e2: Release solution build PASS with 0 warnings / 0 errors; Core VFX 111/111; focused particle-visibility/frame 38/38; warmed production particle-view allocation plus AP-116 settings/live object 4/4. The worktree was clean before launch.

The lead graphical gate is PROVISIONAL PASS pending owner inspection. Before launch, ACE was listening on UDP 9000 as PID 13340 and neither acdream nor retail client was running. One Release client ran tools/overhaul-selfgate/route-portal-haze.txt from clean 1718832e2, exited 0, confirmed graceful logout, and left no client process. Evidence root: logs/selfgate-20260904-171137-s5c1-particle-visibility.

All ten PNGs were captured:

• artifacts/screenshots/h00-before.png;
• Facility sequence: h01-arrive-0ms.png, h02-arrive-400ms.png, h03-arrive-1000ms.png, h04-arrive-2000ms.png, h05-arrive-4000ms.png;
• Holtburg sequence: h11-arrive-0ms.png, h12-arrive-400ms.png, h13-arrive-1000ms.png, h14-arrive-2000ms.png.

Lead inspection: both arrival sequences show the authored magenta materialization particles at 400 ms, the particle effect clears normally by the later frames, and Facility/Holtburg geometry and actors remain intact with no obvious visibility regression. This is not owner acceptance. G4 remains unpassed, nothing may merge to main, and S5-c2 is next.

14. S5-c2 contract — exact landscape visibility for the opt-in shadow pack

14.1 Retail and deviation boundary (lead-verified 2026-09-04)

This chunk ports one retail input, not a retail shadow-map algorithm. Retail has no cascaded real-time directional shadow map; acdream's selected atmospheric pack is the explicit IA-24 deviation. Pack-off remains the retail path and must not build, select, upload, or draw directional-shadow work.

The retail input is the completed landscape in_view product:

• named LScape::draw_check_blocks @0x00505F80 writes a non-OUTSIDE block result and calls LScape::landcell_check @0x005050A0; the latter stamps each CLandCell::in_view from the same portal-view interval walk;
• named CLandCell::IsInView @0x00532CB0 returns that field at +0x104;
• the paired Sept-2013 executable is SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1. Its CodeView GUID {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1, matches the PDB, and its relevant bytes are 8B 81 04 01 00 00 C3 at 0x00532CB0; landcell_check begins 55 8B EC 83 EC 1C 53 56 at 0x005050A0. The ICF body used by the CEnvCell::IsInView vtable remains B8 01 00 00 00 C3 at 0x005269F0.

Because the directional-shadow prepass runs after enhanced-world preparation but before the current frame's PView walk, it consumes the previous successfully completed landscape product, exactly as S5-c1's retained owner already exposes to update-time consumers. An aborted frame preserves that product; completion replaces it; reset removes it. A first/login/portal-space frame has no completed world view. A completed null-root safety frame has an empty set and may not manufacture a resident/frustum fallback.

IA-24 must be amended in the implementation commit to state this selection adaptation plainly: the opt-in non-retail shadow map borrows retail's prior completed landscape visibility and exact S2 object membership. That amendment does not make the shadow map retail behavior and does not authorize a new fallback or a pack-off change.

14.2 C1 — borrow the one completed visibility product

Publish a typed one-frame RetailLandscapeVisibilityFrame (name may vary only to fit existing conventions) from the existing completed visibility owner. It contains:

• the exact completed HashSet<uint>/IReadOnlySet<uint> by reference, with no copy, union, sort, reconstruction, or second retained set; and
• the completed-world-view flag needed to distinguish an authoritative empty answer from no answer.

WorldRenderFrameBuilder captures that borrowed fact before the current frame can complete and attaches it to WorldRenderFrame as a pack-only input. The reference remains valid through the shadow prepass and is not retained after the prepared world is consumed/cancelled. Do not rename the product into a current-camera claim: on camera-only movement it is deliberately one completed frame behind.

The membership side of the selector borrows S2's existing ShadowObjectRegistry.TryGetRetailCellArray; do not copy the registry rows into the frame and do not add a render-owned cell dictionary. A narrow typed read seam over that owner is allowed so tests need not construct PhysicsEngine.

14.3 C2 — exact terrain and object selection

Build one reusable, allocation-free per-frame selection over the retained shadow topology:

1. If HasCompletedWorldView is false, select zero terrain commands and zero world casters. An authoritative empty landscape set also selects zero.
2. A loaded terrain slot is selected iff at least one of its authored 8x8 outdoor land-cell ids occurs in the exact completed set. Scan the borrowed set/slot facts directly; no visible-landblock HashSet is permitted.
3. A non-building caster is selected iff its non-empty retail CELLARRAY from TryGetRetailCellArray(LocalEntityId) contains at least one outdoor land cell in the exact completed set. A missing/empty registry product fails closed. ParentCellId, EffectCellId, render bounds, origin cell, resident landblock, and camera frustum are not substitutes.
4. Building shells are intentionally absent from ShadowObjectRegistry in retail's building channel. Select a shell by its exact outdoor placement cell, RenderSourceMetadata.EffectCellId; do not test its EnvCell BuildingShellAnchorCellId. Zero/non-land placement fails closed.
5. Multi-cell objects select once, stable retained caster order is preserved, and a visibility-only change does not touch membership, render-scene registration, caster classification, material classification, mesh lookup, or transform-journal ownership.

Reusable bool/generation-mark arrays keyed by existing caster/terrain slots are selection scratch, not a second visibility answer, and are allowed. Another HashSet<uint>, dictionary keyed by cell, LINQ materialization, or per-frame collection allocation is not.

14.4 C3 — project visibility without rebuilding retained topology

DirectionalShadowCasterFrame.BuildSequence and the prepared material/mesh-topology DirectionalShadowPreparedDraws.BuildSequence remain keyed only by their existing scene/mesh/fade topology inputs. A camera-only visibility change must leave both sequences unchanged and report zero topology classification/mesh-resolution work.

Project the selection into reusable active draw products instead. For world draws, arbitrary selected/unselected instances inside one prepared material group must be represented exactly. A permitted implementation keeps the retained transform array and emits allocation-free contiguous selected runs with adjusted BaseInstance/InstanceCount, duplicating the already-classified batch metadata for split runs. Equivalent retained-index/mask machinery is acceptable only if GPU tests prove unselected instances cannot reach the depth map. Merely changing one group's prefix count while leaving interleaved unselected instances addressable is incorrect.

The active command/batch/run product gets its own per-frame selection sequence for GPU publication. Rebuilding or re-uploading that bounded indirect product is not a topology rebuild; re-running TryBegin classification, mesh lookup, or changing the topology build sequence is. Preserve the one N.5 transform address space and all existing dynamic-transform journal/replay semantics. Terrain may rebuild its bounded indirect command list from selected retained slots each frame, but must not rebuild/upload terrain geometry or slot topology.

Diagnostics must distinguish resident/prepared topology counts from active selected caster/instance/command counts. Existing celestial direction, cascade fit/quality, day/night/indoor/portal gates, cutout/translucency/fade, foliage wind, transform churn, and two-frame topology-deferral policy remain unchanged.

14.5 Allowed files and explicit non-changes

Production changes are limited to the directly affected owners:

• Rendering/Vfx/ParticleVisibilityController.cs;
• Rendering/WorldRenderFrameBuilder.cs and composition compile fallout;
• Rendering/Scene/DirectionalShadowCasterFrame.cs (selection only; existing topology admission and revision semantics stay fixed);
• Rendering/Wb/WbDrawDispatcher.DirectionalShadows.cs;
• Rendering/TerrainModernRenderer.DirectionalShadows.cs;
• Rendering/DirectionalSunShadowRenderer.cs;
• the built-in and declared directional-shadow pack graphs.

Tests may change only in the corresponding frame-builder, visibility, directional-shadow caster/prepared/GPU/terrain/pack test files and compile- fallout fakes. Documentation is limited to this packet, the S5 ledger row, the architecture statement if its shared visibility-owner wording requires a truth correction, and IA-24. If exact selection requires a production owner outside this list, a shader/pipeline-layout change, a new divergence, or any change to ShadowObjectRegistry, stop and return the fact before expanding.

Do not change WalkLandscape, PView ordering/products, terrain/world ordinary draws, S2 membership mutation, render-scene indices, streaming, portal/depth/ alpha, particle/light behavior, shadow source/quality/cascade math, shader ABI, RHI contracts, DAT/package formats, or any pack-off pixels/work. No graphical client is launched from implementation or review worktrees.

14.6 Tests, mutations, automated return, and reviews

Production-facing tests must prove:

1. the frame builder borrows the exact prior completed set reference and flag; current Begin does not turn it into a current-camera product;
2. complete/abort/reset and first/login/portal/null-root cases have the stated transaction semantics;
3. exact CELLARRAY intersection selects multi-cell outdoor static, dynamic, and child casters once, while missing membership and ParentCell-only impostors fail closed;
4. a building shell selects by outdoor EffectCellId, not its EnvCell anchor;
5. terrain selects only loaded slots reached by exact land cells;
6. alternating visible/invisible instances in one material group produce only the correct active instance ranges and stable order;
7. camera-only visibility changes alter active output while both retained topology build sequences, classification counts, mesh lookups, geometry, and dynamic-transform mappings remain unchanged;
8. topology rebuild, transform journal refresh, fade/mesh-availability retry, generation reset, and the existing two-frame deferral still converge;
9. built-in and declared packs consume the same typed selector; pack-off does no shadow work;
10. the warmed production selection path allocates 0 managed bytes and retained scratch remains streaming-bounded.

At minimum sabotage and restore exactly: replace CELLARRAY with ParentCell; select all resident terrain; use building anchor instead of effect cell; admit missing membership; feed current building scratch instead of the completed product; change a visibility-only frame so it advances the retained topology sequence; and collapse an alternating group into a prefix InstanceCount. Record each exact first failure in the implementer commit body.

Implementer return: git diff --check; Release solution build 0W/0E; focused visibility/frame/shadow caster/prepared/GPU/terrain/pack tests; the real warmed 0-B pin; official hermetic lane; inclusive InstalledDat lane with exactly the documented global failure/skip identities; one clean commit and exact file/ count/mutation report.

Sequential review 1 — retail/deviation fidelity: re-check §14.1 against the named decomp and paired executable/PDB, prior-completed timing, CELLARRAY and building-channel sources, IA-24 truth, and pack-off non-participation. Sequential review 2 — architecture/GPU/gate honesty: one borrowed set, no cell reconstruction, arbitrary-instance correctness, no topology rebuild on camera motion, transform/GPU flight safety, 0-B steady state, lifecycle/deferral, allowed scope, counts, and at least three mutation claims. A failed lens gets one bounded fix contract; a third fix round stops and is written up.

14.7 S5-c2 implementation result — clean evidence complete; fix round 1 implemented

The bounded implementation is complete for review. The selected atmospheric pack now borrows the existing visibility controller's exact prior-completed set and completed-view flag by reference. The frame captures that fact before the current transaction begins and borrows S2's retained CELLARRAY owner through a typed read-only adapter. No second visibility set, cell index, or fallback was added.

The retained caster and terrain products now have separate active-selection projections. Ordinary casters intersect their non-empty retail CELLARRAY with the completed landscape set; building shells use outdoor EffectCellId; missing membership and no/empty completed views fail closed. The established outdoor family remains low != 0 && low < 0x0100 (including 0x41), while a terrain slot scans only its authored 1..64 cells. Arbitrary selected instances inside one material command are emitted as exact contiguous BaseInstance/InstanceCount runs. Active indirect publication advances its own sequence; caster, prepared-draw, and terrain topology sequences remain unchanged on visibility-only frames. Terrain snapshot publication also marks an aborted build invalid so the next frame retries rather than accepting a partially written snapshot.

Built-in and declared directional-shadow graphs call the same typed selector and pass the same prior product into terrain selection. The existing production pack-off integration remains unchanged and proves no active pack runtime, shadow resource, or shadow work. IA-24 now states the prior-view/S2 selection adaptation and keeps the shadow map explicitly non-retail.

Pre-commit automated evidence:

• Release solution build: PASS, 0 warnings / 0 errors.
• focused visibility/frame/caster/prepared/GPU/terrain/built-in/declared/ pack-off/long-cycle lane: 137 passed, 0 failed, 0 skipped;
• warmed production selection: caster selector, arbitrary-run projection, and terrain projection each measured 0 managed bytes while retained scratch and topology build sequences stayed stable;
• git diff --check: PASS.

The required mutations were each built, run against the named production pin, and restored exactly. Their actual first failures were:

1. CELLARRAY → ParentCellId: PriorLandscapeSelection_UsesExactCellArrayAndBuildingEffectCell, first Assert.Equal expected [201, 202, 203, 205], actual [204, 205].
2. Select every resident terrain range: PriorLandscapeSelection_ScansExactAuthoredEightByEightCells, first Assert.Single found 3 commands.
3. Building anchor → placement effect cell: PriorLandscapeSelection_UsesExactCellArrayAndBuildingEffectCell, first Assert.Equal expected [201, 202, 203, 205], actual [201, 202, 203, 206].
4. Admit missing membership: the same caster pin's first Assert.Equal expected [201, 202, 203, 205], actual [201, 202, 203, 204, 205].
5. Publish current building scratch instead of the completed product: BorrowedLandscapeFrame_TracksOnlyCompletedTransactionsByReference, first Assert.True expected HasCompletedWorldView=true, actual false after the completed empty frame.
6. Advance retained caster topology during selection: PriorLandscapeSelection_UsesExactCellArrayAndBuildingEffectCell, first topology Assert.Equal expected BuildSequence=1, actual 2.
7. Collapse alternating selection into one prefix instance count: AlternatingCasterSelection_EmitsExactContiguousInstanceRuns, first active-command-count Assert.Equal expected 3, actual 1.

The bounded implementation is commit 603d4bbb05ebc3e840b5d6e66a20a4c9d3cecc8a. All three official summaries name that exact commit and record WorktreeDirty=false; their existing SHA-256 manifests verify without a missing or mismatched file:

• artifacts/s5-c2-hermetic-20260904 — 16,768 passed, 0 failed, 0 skipped; manifest 32/32 present and matching.
• artifacts/s5-c2-installed-20260904 — the first, deliberately preserved broader run used the literal Lane=InstalledDat filter and produced 468 passed, 10 failed, 1 skipped; manifest 30/30 present and matching. It is valid additional evidence, but it is not renamed or presented as the canonical comparison.
• artifacts/s5-c2-installed-canonical-20260904 — the distinct canonical comparison used the same accepted S5-c1 project filter, Lane=InstalledDat&Purpose!=Diagnostic, and produced 385 passed, 10 failed, 1 skipped; manifest 30/30 present and matching.

Both S5-c2 InstalledDat artifacts contain the same 11 nonpassing TRX identities as the accepted S5-c1 canonical artifact. The broad-versus-S5-c1 and canonical-versus-S5-c1 Compare-Object comparisons each returned zero differences. Their different passing totals remain explicit because the two intentional filters are not interchangeable.

Sequential retail/deviation review returned PASS without a production correction. Sequential architecture/GPU/gate-honesty review found the code, architecture, GPU-flight safety, lifecycle, allocation, and implementation scope otherwise passing, but returned FAIL because this result and the campaign plan still described clean evidence as pending and named only the broader InstalledDat run. Fix round 1 changes only those two evidence/status documents and is implemented pending narrow re-review. The stationary three-buffer per-frame publication is real, explicitly permitted by §14.4, and bounded by Vulkan's two-flight retirement fence; it is a performance note, not a correction and not the #350 mechanism.

15. S5-c2 production-review fix round 1 — evidence provenance only

Retail/deviation review passed the exact implementation commit 603d4bbb05ebc3e840b5d6e66a20a4c9d3cecc8a without a correction. The subsequent architecture/GPU/gate-honesty review found no production-code, test, lifecycle, allocation, GPU-flight, or scope defect. It returned FAIL on one documentation-only truth gap: §14.7 and the plan still say clean evidence is pending and name only the first, broader InstalledDat run, while two clean InstalledDat artifacts now exist with different intentional filters.

This is fix round 1. It is bounded to evidence provenance and status text:

1. Change §14.7's heading and tail from pending/future tense to the exact clean results already on disk. Name the implementation commit and WorktreeDirty=false.
2. Record the hermetic artifact artifacts/s5-c2-hermetic-20260904: 16,768 passed, 0 failed, 0 skipped; SHA-256 manifest 32/32 present and matching.
3. Preserve and explain the first InstalledDat artifact rather than hiding, renaming, replacing, or calling it canonical: artifacts/s5-c2-installed-20260904 ran the literal filter Lane=InstalledDat and produced 468 passed, 10 failed, 1 skipped; manifest 30/30 present and matching.
4. Name the distinct canonical comparison artifact artifacts/s5-c2-installed-canonical-20260904. It ran the same accepted project filter used by S5-c1, Lane=InstalledDat&Purpose!=Diagnostic, and produced 385 passed, 10 failed, 1 skipped; manifest 30/30 present and matching.
5. State that both S5-c2 InstalledDat artifacts have the same 11 nonpassing identities as the accepted S5-c1 canonical artifact and that both exact Compare-Object comparisons returned no differences. Do not collapse the two passing counts into one claim.
6. Record both sequential review outcomes honestly: retail PASS; production FAIL on this evidence-text defect only, with code/architecture/GPU-flight otherwise passing. The stationary three-buffer per-frame publication is real, explicitly permitted by §14.4, and bounded by Vulkan's two-flight retirement fence; it is a performance note, not a correction or #350 mechanism.
7. Update only the S5-c2/S5 status text in the campaign plan to say fix round 1 is documentation-only and implemented/pending narrow re-review. Do not mark the chunk landed, review-closed, self-gated, or user-accepted.

Allowed files are exactly this packet and docs/plans/2026-09-01-campaign-overhaul-world-solidity.md. No source, test, register, architecture, artifact, manifest, filter, or client change is authorized. Do not rerun a lane or launch the graphical client. Return one clean docs-only commit, git diff --check, exact file/count report, and prove every named artifact/manifest/count/filter directly from its existing files.

One narrow independent production/gate-honesty re-review then checks only the two corrected documents against the three clean artifact directories and the two recorded review verdicts. A new correction-worthy finding would be fix round 2; a third fix round still stops S5-c2 and is written up.

16. S5-c2 review closeout, landing, and lead graphical A/B — 2026-09-04

The narrow independent production/gate-honesty re-review returned PASS with no finding. It checked the two-document fix-round scope, all three clean artifact directories and manifests, both InstalledDat filters and counts, the two unchanged nonpassing-identity comparisons, and the recorded sequential review verdicts. No production or test file changed in fix round 1.

The reviewed scratch stack maps to the campaign branch as follows:

• implementation 603d4bbb05e -> a4de2efc4;
• lead fix-round contract 0025bb2c097 -> 048027e71;
• evidence/status correction 521f5edda54 -> ef819eedf.

The integrated campaign tree at ef819eedf is byte-identical to reviewed scratch tip 521f5edda54. Fresh campaign verification passed: Release solution build 0 warnings / 0 errors and the affected 137-test lane 137/137. The official clean evidence remains §14.7's hermetic 16,768/16,768, broader InstalledDat 468 pass / 10 documented fail / 1 skip, and canonical InstalledDat 385 pass / the same 10 documented fail / 1 skip, with all manifests and nonpassing identities verified.

The first graphical run at logs/selfgate-20260904-182320-s5c2-shadow-selection captured all seven transition PNGs and reached its checkpoint without a fatal log entry, but its route omitted close-client. GLFW exposes no main-window handle to the runner, so the runner's graceful external close could not succeed. The owner was away from the computer and explicitly directed the lead to close it; after the graceful path was exhausted, the lead terminated only the verified campaign PID. This run is retained as visual evidence but its teardown is FAIL, not the valid c2 gate.

The lead then added an out-of-tree A/B route with an in-client close-client step and built exact parent 5c106bcdf in detached worktree s5-c2-ab-parent (Release 0 warnings / 0 errors). Before each run ACE was UP on UDP 9000 as PID 13340 and no graphical client was running. Exact evidence:

• parent: s5-c2-ab-parent/logs/selfgate-20260904-183815-s5c2-parent-shadow-ab;
• candidate: logs/selfgate-20260904-183925-s5c2-candidate-shadow-ab at clean ef819eedf.

Both runs produced all seven PNGs, exited 0, logged graceful logout confirmed, left no client process, and contained no fatal/unhandled/device-lost/validation match. Candidate metadata shows exact active selection rather than retained topology fallback: 2,500 selected casters on the first high frame and 3,087 after re-enable, with four cascades and 26 draws; pack-off reports zero pack work. Terrain, buildings, actors, UI, weather transitions, resize, and pack off/on recovery remain present. The lead verdict for S5-c2's own scope is PROVISIONAL PASS pending owner inspection.

The A/B also proves a conspicuous darkening on atmospheric re-enable is pre-existing: exact parent and candidate both reproduce it. The receiver shaders switch outdoor directional lighting from authored -uLights[0].dirAndRange to uShadowLightDirectionAndSource whenever the shadow flag becomes nonzero; the shadow-strength weight does not blend that lighting-direction change. This is not an S5-c2 regression, but it is not silently accepted as a solid-renderer result: issue #469 records it and IA-24 now names the gate-visible discontinuity. It must be resolved or explicitly owner-accepted before G4. S5-c3 is next; G4 remains unpassed and nothing may merge to main.

17. S5-c3 contract — exact building degrade selection and complete-body gate

This chunk is deliberately bounded to the building part-0 path named by S5. It replaces the capture-specific fixed +0.99 selection, preserves the selected GfxObj identity separately from its optional drawing BSP, draws that selected shell, and makes the three already-authored Config preferences live. It does not add generic entity LOD, change S5-c1 particle visibility, change S5-c2 shadow selection, or implement the fixed-function material work reserved for c4.

17.1 Lead-verified retail and paired-binary facts

The paired executable is C:\Users\erikn\Downloads\acclient.exe, SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1. Its CodeView record remains GUID {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1, matching refs/acclient.pdb. Fresh read-only Ghidra output was checked against the named pseudo-C. Exact function byte ranges are:

Function	VA / file offset / length	SHA-256
SceneTool::UpdateFPSCounter	0x0043E510 / 0x0003E510 / 176	4B49B883F2F03284F08BAF70716F2AFFAA6591EAD4142D8D5A68879F79CA9DA2
CPhysicsPart::Draw	0x0050D7A0 / 0x0010D7A0 / 192	965E1E6208DF662EE3466AA455CFF57BBDEA8AA3751E4DE2F5FD30C3842661FA
CPhysicsPart::UpdateViewerDistance	0x0050E030 / 0x0010E030 / 384	30F0EEA8829728497E1D00E0D9737DF9EB112CC6643A24ED6150F1350D29D49D
GfxObjDegradeInfo::get_degrade	0x0051E4B0 / 0x0011E4B0 / 400	E0FE4A2BC79F108985B84DDBA44460B8B80809AE81088779D02C2FEF6CCDD8B7
Render::SetDegradeLevelInternal	0x0054C3C0 / 0x0014C3C0 / 240	9A59895EC901ABA75584EA5B059222C00CC9CF2B7AF54F5FB7C2A2CF444D83E4
Render::CalcDegLevel	0x0054CAF0 / 0x0014CAF0 / 736	607DC8B8DBAAB9498C163241CE535E14751378A7EC06DFFD724BB68910C7BB08
RenderDeviceD3D::DrawBuilding	0x0059F2A0 / 0x0019F2A0 / 177	0FEC14C65D32DACEA0344A9F347937A2588CE3D14694AC658607BDFE5ACDE125

RenderDeviceD3D::DrawBuilding @0x0059F2A0 always publishes the building's outdoor portal list and calls UpdateViewerDistance(parts[0]). Its complete body is gated only by parts[0]->gfxobj[parts[0]->deg_level] != nullptr. Inside that gate retail sets building/detail state, calls FlushAlphaList(0f), calls CPhysicsPart::Draw(part0, 1) for the portal-only walk, sets the building flag, calls CPhysicsPart::Draw(part0, 0) for the selected shell, clears the flag, and clears detail state. A non-null selected GfxObj whose drawing_bsp is null therefore still crosses the alpha barrier and draws its shell; only the portal-only sub-walk naturally emits nothing. The current acdream if (bsp is null) return conflates those facts and is wrong.

CPhysicsPart::Draw @0x0050D7A0 normalizes its local level to zero when the part has no degrade descriptor or its stored level is outside the loaded Gfx array, then indexes gfxobj[level]. A null selected GfxObj returns; a non-null one reaches DrawMesh. UpdateViewerDistance @0x0050E030 measures from the viewer to the base GfxObj's sort center after component-wise part scale, stores CYpt and heading, selects level zero/mode one for a missing ladder or the player, otherwise calls get_degrade(CYpt / gfxobj_scale.z), and calculates a draw frame only when the selected GfxObj is non-null.

GfxObjDegradeInfo::get_degrade @0x0051E4B0 uses max(0, abs(distance) - Render::s_rDegradeDistance). With automatic degrades enabled it uses Render::deg_mul; otherwise it uses Render::s_rUserSuppliedDegradeBias. For a nonnegative multiplier the strict threshold is ideal - (ideal - max) * multiplier; for a negative multiplier it is ideal + (ideal - min) * multiplier. The first strict effective < threshold match wins; equality advances; no match selects the last level. degrades_disabled forces level zero and that level's mode; a forced level is clamped to the last slot. This chunk has no production force-level or global disable control, but its pure selector must keep those two explicit inputs so the retail branches are pinned and no future caller must fork the algorithm.

The binary statics are s_rDegradeDistance=50, max_framerate=20, min_framerate=8, ideal_framerate=10, auto_update_deg_mul=1, manual bias 0, and initial deg_mul=0. The Config UI's authored defaults are separately automatic=false, bias=0, distance=50; production follows the persisted UI preference, not a capture's transient multiplier.

SceneTool::UpdateFPSCounter @0x0043E510 sums the prior 20 frame-duration slots, publishes FPS as zero when the sum is not strictly greater than 0.000199999995f, otherwise publishes 20/sum, then shifts the history and inserts the just-finished duration. Preserve this retail one-sample ordering, the 20-slot warmup contents, and single-precision behavior.

Render::CalcDegLevel @0x0054CAF0 first shifts its 30-slot candidate history. With automatic degrades off it stores the unchanged current automatic multiplier and returns. With automatic degrades on it evaluates retail's exact five-weight piecewise formula from current FPS and the 8/10/20 rates, adds the current multiplier, clamps to [-1,+1], and calls SetDegradeLevelInternal(candidate) only after all 30 prior history slots are within the strict retail abs(slot-candidate) < 0.01 band; it finally stores the resulting current multiplier. Port this body as one testable pure routine from the named function and paired bytes. A proportional controller, moving average substitute, time-based debounce, modern clamp, or reordered history is not equivalent.

Render::SetDegradeLevelInternal @0x0054C3C0 also derives retail object, particle, static-light, and dynamic-light budgets. S5-c3 changes only the building consumer of deg_mul: TS-15, AP-116, and AP-85 already own the surviving non-building LOD, particle-range, and light-pool differences and must be amended in the same implementation commit to name that uncoupled adaptive-budget fact. Do not perturb those already-landed policies here.

Finally, CBuildingObj::makeBuilding @0x006B53A0 calls InitPartArrayObject(model, 1). That path accepts either a direct GfxObj or a Setup, but DrawBuilding still uses only parts[0]. A Setup-backed building therefore resolves the existing SetupMesh.Flatten/Resting placement part zero and its transform; it never flattens every Setup part into the building shell draw. The installed-DAT census below contains no Setup building, so this branch is a synthetic structural pin, not an installed-population claim.

17.2 Installed-DAT population pin

The lead scanned the installed land/cell/portal DATs through the legal DatCollection reader before this contract. Record and reproduce these exact facts in an InstalledDat test or an existing InstalledDat census surface:

• 1,639 landblocks contain 6,979 building instances across 398 distinct models;
• all 6,979 installed building models are direct GfxObjs; zero are Setup or another type;
• all 6,979 resolve part-zero GfxObj data; none are missing;
• 6,760 instances have degrade ladders, containing 27,859 level slots across 350 distinct ladder models;
• every one of those 6,760 ladders has exactly one zero-id slot and it is the final slot; no nonzero slot is missing and all 21,099 nonzero slots have a drawing BSP;
• level-count histogram: 2→196, 3→216, 4→4,964, 5→1,341, 6→43;
• there are no duplicate building-anchor groups.

Thus the complete-body null-selected-Gfx path is real and widespread, while the non-null-Gfx/null-BSP path requires a synthetic pin even though its retail behavior is unambiguous. Do not “repair” the authored final zero slots, clamp to the last nonzero slot, or use BSP presence as a body-existence proxy.

17.3 One typed selection, one shared degrade owner

Replace BSP-only selection with one value that carries at least the selected GfxObj id, nullable drawing BSP, degrade level, and degrade mode. The base direct-Gfx path carries its own GfxObj id even with no ladder. Ladder entries carry the authored GfxObj id and mode as well as min/ideal/max and the optional BSP. A selected GfxObj id of zero is the exact complete-body failure. A nonzero id with null BSP is an admitted complete body with no portal walk. HasGeometry, the fixed DefaultDegradeMultiplier=0.99, and the erroneous default distance 100 are deleted, not retained as fallback truths.

Create one renderer-lifetime degrade owner, passed/borrowed through normal composition: no static mutable global, service locator, duplicate UI mirror, or second ticker. It owns the 20 frame-time slots, 30 candidate slots, current automatic multiplier, exact rolling FPS, and the current persisted settings view. It advances exactly once per accepted graphical render callback using that callback's real delta; world replacement/portal travel does not recreate or double-tick it. Settings changes are observed on the next frame:

• automatic=false → building selection and the FPS panel's DEG field use the persisted manual GraphicsPerformance bias;
• automatic=true → they use the exact current automatic multiplier;
• both modes use the persisted DegradeDistance;
• the FPS panel's FPS field borrows this same retail rolling-FPS value, not a second cadence, while its authored show/hide option remains unchanged.

The controller must define and pin initial/warmup behavior, zero and tiny deltas, NaN/infinity input, settings toggle transitions, and exact float ordering. It may fail closed or sanitize only where the retail x87 comparison would do so identically; any modern safety divergence must receive a register row in this same commit. No allocation is permitted after warmup.

17.4 Exact building body, portal, and selected-shell execution

At DrawBuilding entry retain the unconditional BLD transcript event and portal-list publication. Then select part zero once and use that same immutable selection for every downstream action:

1. selected GfxObj id zero: return after entry publication; no alpha barrier, portal walk, look-in draw, or shell;
2. selected id nonzero: emit the existing alpha barrier first;
3. if the selection's BSP is non-null, run the existing pass-1/pass-2 portal walk through each active view; if null, emit no portal work but continue;
4. submit the shell after the portal walk using exactly the selected GfxObj id.

Thread the typed selection through OnBuildingShellTurn and the production world/populator/dispatcher seam. Do not mutate the retained RenderProjectionRecord, rebuild retained topology, clone a record per frame, or silently keep the base shell's MeshRefs. Classification must preserve the retained building's scene/lifecycle identity, root transform, material/ surface overrides, detail state, effect/anchor membership, and picking facts, while replacing the part-zero GfxObj with the selected one. Direct-Gfx models use identity part transform. Setup models use exactly the precomputed part-zero placement/default-scale transform, and portal projection, sort-center distance, and shell submission must agree on the same composed part-zero frame.

The building path submits exactly one selected part-zero mesh. If its render mesh is not resident, request/load that selected id through the existing asynchronous mesh seam and draw no shell for that frame; never fall back to the base GfxObj, block on DAT access, or query DAT from the renderer. Retry on the following frame through existing residency behavior. Zero retained shell records during a streaming boundary remains an empty shell turn; multiple matching retained shell records for one committed building is a fail-loud ownership error. No new dictionary, cell scan, or linear model search may run per building per frame.

17.5 Config and deviation truth

Render_AutomaticDegrades, Render_GraphicsPerformance, and Render_DegradeDistance become live rows and must no longer receive storeOnly:true or cite AP-198. Update the exact Config dim-set test and all comments/counts that pin it. AP-198 narrows from its current residual set by those three rows; do not disturb the already-live landscape-radius and building-detail controls. Keep AD-78's count and description mechanically consistent with the actual controller test.

Narrow TS-15 explicitly to non-building parts. Amend AP-85 to say its fixed one-list light cap is not driven by SetDegradeLevelInternal's multiplier, and AP-116 to say the explicit Retail/Extended particle-range choice is not the adaptive multiplier's object/particle distance budget. Those existing rows cover every intentionally uncoupled SetDegradeLevelInternal consumer; add no duplicate row. If implementation discovers another surviving deviation, add or correct its row in the same commit. The active-row total must change only if a row is actually added or retired; narrowing does not change it.

17.6 Allowed scope and explicit nonchanges

Allowed production scope is the existing building walk/factory/registry, frame-driver world-data/populator/dispatcher classification seam, the one renderer/frame-root composition seam needed for the shared controller, the FPS retained-UI binding, DisplaySettings comments, and the Config row dimming flags. One focused App-layer controller file may be added. Tests may change only for those surfaces, the exact retail math, installed census, composition identity, residency retry, lifecycle, and allocation. The only authorized documentation file in the implementation commit is docs/architecture/retail-divergence-register.md.

Do not change portal admission, BSP traversal, alpha FIFO routing, material blend/state, particle update/range, point-light selection, terrain/shadow selection, streaming radii, generic entity/scenery/creature LOD, DAT reader, RHI/shaders, login/network/runtime gameplay, self-gate scripts, artifacts, or this packet/plan. Do not add a base-shell fallback. No graphical client is launched by the implementer.

17.7 Required automated proof, mutations, and return

Focused tests must prove at minimum:

1. direct base Gfx and ladder selections carry exact id/BSP/level/mode;
2. positive and negative multiplier arms, strict threshold equality, last slot, disable, forced-level clamp, scaled sort-center/CYpt, zero/negative/ NaN/infinity inputs match a literal independent retail oracle;
3. the prior-20 FPS ordering and the complete 30-slot CalcDegLevel formula, stability gate, clamp, manual arm, warmup, and settings transitions match fixed expected sequences—not implementation self-comparison;
4. zero selected Gfx emits BLD only; nonzero/null-BSP emits BLD → alpha barrier → selected shell with no portal events; nonzero/BSP preserves BLD → barrier → portal passes/look-ins → selected shell;
5. a far selected LOD changes the submitted GfxObj id while all retained ownership, transform, surface/detail, effect-cell, picking, and ordering facts remain exact; no base fallback occurs while the selected mesh is unavailable, and the same selection appears after residency succeeds;
6. a synthetic Setup building draws only transformed part zero and uses the identical composed transform for distance, portal clip, and shell;
7. Config's three rows are live-colored, persist exact values, and the one composed controller instance is borrowed by both renderer and FPS panel;
8. publish/retire/revisit/reset and first/login/portal/null-root frames neither duplicate nor recreate the controller and leave existing building lifecycle behavior intact;
9. the installed census equals §17.2 exactly; and
10. the warmed selection/controller/classification path allocates 0 managed bytes and does not advance retained topology or materialize records.

Sabotage and restore at least these exact mutations, recording each first failing test/assertion in the implementation commit body: use BSP-null as the complete-body gate; clamp the final zero slot to the prior nonzero slot; use the base GfxObj for shell submission; change strict < to <=; feed the manual bias while automatic is enabled; update FPS after inserting the current sample; allow one stable history slot instead of all 30; fall back to base when the selected mesh is unavailable; and recreate the shared owner for the FPS binding. Include an allocation sabotage that constructs or clones per building and prove the 0-B pin catches it.

Implementer return: git diff --check; Release solution build 0W/0E; focused building/walk/driver/dispatcher/settings/UI/composition tests; exact math and 0-B lanes; official hermetic lane; inclusive InstalledDat lane with the campaign's accepted exclusions and explicit documented global identities; one clean commit; exact file/count/mutation report; no client run.

Sequential review 1 — retail/deviation fidelity: re-check every §17.1 byte/ named fact, the §17.2 census, selection math, FPS/auto controller, complete- body gate/order, Setup part zero, selected shell, Config/register truth, and all mutations. Sequential review 2 — architecture/production/gate honesty: one shared owner/tick, one typed selection, no retained mutation/base fallback/ renderer DAT read/topology rebuild, async residency, transform/material/ lifecycle identity, allocation, allowed scope, build/lane provenance, and at least three reproduced sabotage claims. Reviews run sequentially. A failed lens gets one bounded fix contract. Under the owner override, S5-c3 may use at most ten review passes and stops before an eleventh; documentation-only findings may be corrected directly by the lead.

18. S5-c3 fix round 1 — x87 store schedule and register truth

The first sequential OpenAI retail/deviation review returned FAIL on the uncommitted scratch implementation: one MAJOR exact-arithmetic defect and one MINOR pre-existing register-truth defect. Everything else in §17 passed. This is the first bounded fix round; it does not reopen selection ownership, building traversal, residency, Config wiring, or any S5-c1/S5-c2 behavior.

The reviewer independently re-confirmed the executable SHA, CodeView GUID/age, all seven §17.1 byte-range hashes, the named-decomp semantics, the complete §17.2 census, the complete-body order, Setup part zero, selected-shell identity and surface preservation, no base fallback, scope, lifecycle wiring, the other register edits, and every required mutation. Its clean focused return was 64/64, and the scratch state was restored exactly.

18.1 F1 — preserve retail's x87/store boundaries

The candidate currently rounds arithmetic too early in three places. Repair only these exact boundaries, allocation-free:

1. SceneTool::UpdateFPSCounter @0x0043E510 sums the 20 stored single-precision frame durations in x87 precision and divides before narrowing once at the published FPS store. Accumulating into a C# float is not equivalent. Use a wider accumulator that exactly sums the 20 binary32 inputs, perform the division wide, then narrow once to float. Restore retail's physical history direction: shift old slots 0..18 to 1..19, then store the just-finished binary32 duration at slot 0. The prior-20-before-insert order remains unchanged.
2. Render::CalcDegLevel @0x0054CAF0 evaluates its five membership weights, weighted numerator/denominator, addition, and clamp in x87 precision except at the explicit binary32 stores visible in the named function. Re-express the pure calculation with wide intermediates fed by the exact binary32 constants (-0.150000006f, -0.02f, 0.01f, 0.1f) and narrow only at retail's candidate store. The stability comparison promotes each binary32 history slot and candidate and compares against the executable's qword 0.01, not 0.01f. Keep the existing shift-before-evaluate and final current-multiplier store order.
3. GfxObjDegradeInfo::get_degrade @0x0051E4B0 stores the effective distance after abs(distance)-DegradeDistance, but evaluates each positive/negative threshold in x87 precision and compares the stored binary32 effective value against that wide threshold. Do not round the threshold to float before the strict comparison. Disable/force precedence, strict <, equality advance, final slot, modes, and NaN/infinity behavior stay unchanged.

Add bit-exact independent assertions for all three proven witnesses:

• FPS history [0.001f, 0.005f] × 10 publishes bits 0x43A6AAAB (333.333344f), not the candidate's 0x43A6AAAC;
• CalculateCandidate(14f, 0f) publishes bits 0x3BB2BC0A, not 0x3BB2BC0B;
• with ideal/max 24f/48f, multiplier 0.0020020019728690386f, and effective distance 24.04804801940918f (0x41C06267), retail's wide threshold remains strictly greater and selects the first level.

Also pin the qword stability edge directly and the slot direction without reflection-only self-comparison. Each of these changes needs a named mutation and actual first failing assertion: restore float FPS accumulation; restore float CalcDeg intermediates or 0.01f; restore a rounded selector threshold; reverse the FPS slot direction. Restore every mutation before return.

18.2 F2 — correct AP-198's already-live landscape radius

AP-198 is stale independently of this chunk: Render_LandscapeDrawDistance already feeds RuntimeSettingsController's live far radius, and the Config controller maps its persisted default 8 to the selected Medium entry. Remove that control from AP-198, change every six-row statement to five, and delete the obsolete no-highlight sub-note. Keep the actual Config dim set at 16/27; S5-c3 still changes only Automatic Degrades, Graphics Performance, and Degrade Distance from store-only to live. No row is added or retired, so active table counts do not change. Add or update a truth pin that fails on the old six-row wording or the obsolete no-highlight statement.

18.3 Scope, return, and review order

Production edits are limited to BuildingDegradeController.cs and Walk/WalkBuilding.cs. Test edits are limited to their existing focused test files plus the existing Config/register truth pin if required. The only documentation edit in the implementation remains docs/architecture/retail-divergence-register.md. Do not change controller ownership/tick placement, selection/result shapes, building factory or transforms, portal walk/order, shell classification, residency, materials, surface overrides, UI wiring, RHI/shaders, DAT readers, or any other register row. No graphical client.

Return the exact changed-file list; git diff --check; Release solution build 0W/0E; the bit-exact math/selector/controller and Config/register focused lanes; the original S5-c3 focused lane; official hermetic lane; inclusive InstalledDat lane with exactly the documented global identities; and the new mutation ledger. Do not commit—the lead owns the reviewed landing commit under the owner's OpenAI-only process override.

The same OpenAI retail lens narrowly re-reviews F1/F2 and regression evidence first. Only its PASS unlocks the sequential OpenAI architecture/production/ gate-honesty review over the entire S5-c3 stack. Each further code finding receives its own bounded contract; S5-c3 stops before an eleventh review pass. Documentation-only findings may be corrected directly by the lead.

19. S5-c3 fix round 2 — CalcDegLevel's four intermediate stores

OpenAI retail review pass 2/10 returned FAIL on one remaining MAJOR F1 defect. Fix round 1 otherwise passed: the FPS witness is 0x43A6AAAB, the 14-FPS candidate is 0x3BB2BC0A, the selector boundary stays at level zero, the qword 0.01 edge and physical FPS slot direction pass, and AP-198 now states the exact five-row residual while AD-78 is corrected to 16/27. The reviewer also re-confirmed the paired executable/PDB identity, clean allowed scope, the exact installed census, and the official evidence identities.

19.1 R2-F1 — reproduce every executable-visible numerator store

The remaining defect is only BuildingDegradeController.CalculateCandidate. Its combined float weightedNumerator narrows once after all five terms. The paired Render::CalcDegLevel @0x0054CAF0 bytes instead store the evolving numerator to binary32 four times: after w0 at 0x0054CC14, after the negative w1 term at 0x0054CC61, after the zero-weight w2 term at 0x0054CCA6, and after the positive w3 term at 0x0054CCEB. Retail then promotes that fourth stored value, adds the w4 term wide at 0x0054CD3F, divides wide, adds/clamps wide, and narrows only at the final candidate store.

Implement that literal schedule allocation-free. Each of the first four stages must be an explicit float store followed by promotion for the next stage; do not algebraically combine, reassociate, or eliminate the +0*w2 store. Feed every term with the existing exact binary32 coefficient. Keep the five membership weights, denominator, history/stability behavior, clamp, exceptional-value behavior, and every other fix-round-1 change untouched.

Add an independent bit-exact assertion:

• CalculateCandidate(16.25f, 0f) must publish 0x3CA3D70A; the current combined store publishes 0x3CA3D70B.

Sabotage by recombining the five terms into one store and record this witness as the first failure, then restore it. Re-run the three §18 witnesses, qword edge, FPS slot-direction pin, complete controller/selector lane, original S5-c3 focused surface, allocation lane, official hermetic lane, and inclusive InstalledDat lane with the same documented nonpassing identities.

19.2 Scope and review order

Production scope is exactly src/AcDream.App/Rendering/BuildingDegradeController.cs; test scope is exactly tests/AcDream.App.Tests/Rendering/BuildingDegradeControllerTests.cs. No other production, test, register, packet, plan, UI, renderer, RHI, shader, DAT, or lifecycle behavior changes. No graphical client and no commit; the lead owns landing.

Return the exact two-file diff, git diff --check, Release solution build 0W/0E, every lane above, and the mutation's first failure. The same OpenAI retail lens performs narrow review pass 3/10 over §19 first. Only its PASS unlocks the sequential full architecture/production/gate-honesty review.

20. S5-c3 fix round 3 — ladder ownership, retry rearm, and tick proof

OpenAI retail review pass 3/10 returned PASS after independently pairing the exact executable and PDB and confirming the literal four-store CalcDeg schedule. The sequential OpenAI architecture/production/gate-honesty review pass 4/10 returned FAIL on two production lifecycle defects and one non-discriminating test. Typed selection, complete-body gating/order, selected transform and surface borrowing, Config wiring, exact installed census, allocation-free controller/selector/classifier paths, and the restored retail math witnesses otherwise passed. This bounded round does not reopen retail selection math or rendering policy.

20.1 R3-A — own every nonzero building ladder mesh

Selected non-base degrade meshes are requested through WbMeshAdapter.EnsureLoaded, but asynchronous publication is admitted only while ObjectMeshManager sees an ownership reference. Landblock registration owns retained base MeshRefs and prepared EnvCell geometry, not the nonzero GfxObj IDs in building degrade ladders. A selected ladder ID can therefore remain permanently non-drawable unless an unrelated owner happens to hold it.

Carry the unique nonzero ladder GfxObj IDs derived from the worker-built EnvCellLandblockBuild.WalkBuildings through the existing landblock publication/lifetime transaction as ordinary mesh ownership, distinct from prepared EnvCell IDs. Requirements:

1. exclude the retail zero sentinel and deduplicate ladder IDs, including any overlap with retained base MeshRefs;
2. acquire them through the existing IncrementRefCount/ordinary desired and held path before readiness can complete; do not treat them as prepared EnvCell pins and do not acquire them from the per-frame classifier;
3. balance ownership across initial publication, Far-to-Near promotion, Near-to-Far retirement, full unload, replacement, partial publication failure, reset, and same-location revisit, without duplicate increments;
4. preserve selected-only submission: an unavailable selected mesh remains a skipped shell, never a resident-base fallback; and
5. keep the carrier precomputed/immutable and the frame walk allocation-free.

Add a production-path proof using the real ObjectMeshManager and WbMeshAdapter, without direct ObjectRenderData injection: a non-base selected ladder dependency becomes owned, its valid prepared result reaches upload/publication, and a later frame can submit it. Add focused lifecycle proofs for balanced release, cancellation/partial failure, reset, and revisit. Sabotage by dropping ladder dependency publication and by dropping one release edge; record the first failing assertions and restore both mutations.

20.2 R3-B — rearm mesh-miss requests at the real walk-frame boundary

WbDrawDispatcher clears _missRequested only from the legacy flat/entity dispatch boundary. Normal PView walk frames use BeginWalkPartFrame, so a once-missed selected ID remains suppressed across later frames and after cancellation, eviction, or revisit.

Clear _missRequested once at the successful BeginWalkPartFrame boundary, after its double-open guard has accepted the new frame. Preserve _missLogged as the once-per-lifetime diagnostic set. Prove that the same ID requested twice in one frame emits one preparation request, the next accepted frame can request it again, and cancellation/eviction/revisit converge without an unbounded request-dedup set. Sabotage by deleting the frame-boundary clear and record the first failure, then restore it.

20.3 R3-C — make exactly-once tick and ordering discriminating

The production orchestrator contains one accepted-frame degrade tick, but its test uses constant 0.05 samples and checks only eventual 20 FPS; duplicating the production tick survives that proof.

Strengthen the orchestrator lane with an independent call-count and order recorder: each accepted nonzero-area render frame ticks the one shared owner exactly once, a zero-area/rejected frame ticks zero times, and the tick occurs before BeginFrame and downstream walk work. Use a nonuniform, hard-coded duration sequence with exact expected published FPS bits so a duplicate or shifted sample changes the result. Sabotage by duplicating the tick and independently moving it after BeginFrame; both mutations must fail at named assertions and then be restored.

20.4 Lead-owned documentation corrections

The lead may directly repair the Config controller prose to describe the three now-live degrade controls; pin AP-198's five residual rows; correct the Config dim set and AD-78 count to 16/27; change both portal-gate diagnostic effective- distance calculations to use the selected distance 50 rather than 100; and add a Config-test aggregate pin that exactly 16 rows remain store-only.

20.5 Scope, return, and review order

Production scope is limited to the worker-built ladder dependency carrier, the landblock publication receipt and ordinary/prepared ownership split through GpuWorldState/LandblockSpawnAdapter, the successful walk-frame boundary, and the existing render orchestrator seam needed for a discriminating order test. Tests may extend the corresponding focused build, publication, dispatcher, classifier, and orchestrator suites. Do not change retail degrade math, selector thresholds, complete-body logic, transforms, surfaces, fallback policy, RHI/shaders, DAT readers, or unrelated lifecycle owners. No client, commit, campaign-doc edit, or subagent; the lead owns those actions.

Return the exact changed-file list, git diff --check, Release solution build 0W/0E, the focused ownership/lifecycle/retry/order lanes, all prior S5-c3 math/selection/census/allocation lanes, official hermetic lane, inclusive InstalledDat lane with every documented nonpassing identity, and the five required mutation failures. The same OpenAI production lens performs narrow review pass 5/10 over §20 and the full corrected stack. Its PASS, together with retail pass 3, unlocks lead integration and the clean-HEAD graphical self-gate; any further code finding receives another bounded contract, with a hard stop before review pass 11.

21. S5-c3 review closeout, landing, and lead graphical gate — 2026-09-04

OpenAI production narrow re-review pass 5/10 returned PASS with no finding. The reviewer independently reproduced all five §20 mutations, named the first failed assertion for each, restored all 41 changed paths byte-for-byte, and re-ran Release plus focused ownership/publication evidence. OpenAI retail pass 3/10 remains the independent paired-executable/PDB verdict for the exact x87 schedule and building-selection semantics.

The reviewed scratch implementation is 01e5a15d0b4efc73882634899bf5af500168fafe; it landed on the campaign branch as c673f767e968a85a898b4a3aebb03781060efe06. Fix round 3 now:

• carries every unique nonzero ladder GfxObj as ordinary landblock-lifetime ownership, distinct from prepared EnvCell ownership, with balanced publication, replacement, retirement, failure, reset, and revisit edges;
• clears only _missRequested at each successful BeginWalkPartFrame, after the double-open guard, so a miss deduplicates within one frame and rearms on the next; and
• proves one degrade tick per accepted nonzero-area frame, zero on a rejected zero-area frame, before BeginFrame, using nonuniform samples.

Fresh clean-HEAD campaign evidence at c673f767e:

• Release solution build: 0 warnings / 0 errors;
• exact focused campaign lane: 101/101;
• official hermetic artifact artifacts/s5-c3-campaign-hermetic-20260904: 16,811/16,811, zero fail/skip, WorktreeDirty=false, exact commit/branch, manifest 30/30;
• inclusive InstalledDat artifact artifacts/s5-c3-campaign-installed-inclusive-20260904: 469 pass / the same documented 10 fail / 1 skip, WorktreeDirty=false, exact commit/branch, manifest 30/30. The nonpassing identities are unchanged: TowerAscent, the main-game/chat-input and invisible-widget fixture drifts, Oh doorway first- frame drift, and the six documented AlphaFlushCounts; the sweep look-in gate remains the one documented skip.

Before the lead launch, ACE was UP on UDP 9000 as PID 13340 and no acdream or retail graphical client was running. Exactly one Release self-gate command ran and closed its own client gracefully:

logs/selfgate-20260904-223345-s5c3-building-degrade

It produced 00-login.png, 01-cathedral-stairs.png, 02-facility-stairs.png, 03-holtburg-house.png, and 04-holtburg-terrain-leak.png, exited 0, confirmed graceful logout, logged no fatal/unhandled/device-lost error, and left no client process. Cathedral, Facility, Holtburg shell geometry, and the terrace hill are intact. The c3 selected-building scope is therefore PROVISIONAL PASS pending owner inspection.

The Holtburg screenshot is not a controlled old/new pixel comparison: the old frame is retail/off at 1760x990 while this run starts with the persisted High atmospheric pack at 1024x768, and neither records the exact camera eye. Static DAT inspection nevertheless disproves a c3 part-zero explanation: cell 0xA9B4013F's 16 props are independent EnvCell statics and ordinary cell records never receive buildingSelection.

That audit found a separate pre-existing production defect: ordered draws use an absolute shared-arena transform base with the ordinary shader's locally based alpha/selection/light sidecars and omit the active atmospheric receiver pipeline/bindings. It exists at least at S4-c2 252886e84, is filed as #470, and must be repaired before renderer-solid/G4. S5-c4 is next; #469/#470, c5, the closeout program, and G4 remain. Nothing merges to main before G4.

22. S5-c4 contract — exact one-pass detail material and ordered production closure

This chunk replaces the acdream-only base-plus-mesh_detail replay with the single fragment retail emits when the hardware single-pass detail path is available. It applies to detail-active building and EnvCell subsets in every current world submission path: classic grouped, walk-ordered, immediate alpha, deferred alpha, and EnvCell opaque/transparent replay. One source subset must produce one physical draw and one (rgb, alpha) result while retaining that subset's existing queue position, blend family, alpha-test/depth state, cull, geometry, transform, material overrides, fog policy, sampler, and mip chain.

The production audit found that the walk-ordered path currently uploads building detail categories and forces them into solo runs but issues only the base draw. That omission is filed as #471 and is part of this chunk: the new one-pass detail result must be armed on that existing base draw. Do not add a blended overlay after the run. An overlay would preserve AP-232, create a new terrain/StreamMark flush obligation, and remain unlike retail.

22.1 Lead-verified retail and paired-binary facts

The paired executable is C:\Turbine\Asheron's Call\acclient.exe, SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1. Its CodeView identity remains GUID {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1, matching the named PDB. The named pseudo-C and fresh paired-executable disassembly agree on these exact ranges:

Fact	VA range / length	SHA-256
SetSurface detail stages	0x0059C4D0..0x0059C5B5 / 229	090E24BE542E9DA4F77B547D091F5C2E676109495919BEA70027AD2B89E11426
SetSurface blend/alpha/depth state	0x0059C6C5..0x0059C866 / 417	1F077DA1BB09FBAC0EAF7522E125C716AAF499DFA8763DD3DDF29CCC6A76C382
RenderMeshSubset single-pass arm	0x0059CA10..0x0059CAF0 / 224	64A988D4B1611CEEA6DE135FF52CDF30FE1AFDAAFF5E3B76751FFA7FC833CC53
DrawMesh detail/alpha routing	0x0059D4A0..0x0059D5A5 / 261	20B1E5D1E90C9E19C62047AF521F817CF6700B5FEA68CE78C7404CD238862CB3

Named anchors are D3DPolyRender::SetSurface @0x0059C4D0 (acclient_2013_pseudo_c.txt lines 425083–425303), RenderMeshSubset @0x0059CA10 (lines 425382–425450), DrawMesh @0x0059D4A0, RenderDeviceD3D::DrawEnvCell @0x0059F170, and DrawBuilding @0x0059F2A0. The live capability result remains the VM2 CDB record in 2026-08-22-vm2-retail-detail-path-cdb.md: retail takes the single-pass path, not its fallback.

Let B be the sampled base RGB, D the active diffuse/lighting RGB, a the active diffuse/material alpha, and Q=(q,qA) the sampled detail texel. At 0x0059C51C/52B/53A/549 retail programs:

• stage 0 colour C0 = B * D;
• stage 0 alpha PREMODULATE(DIFFUSE,DIFFUSE), whose visible stage-0 result is a but whose stage-1 CURRENT alpha is premultiplied by the next texture, a*qA;
• stage 1 colour BLENDCURRENTALPHA(TEXTURE,CURRENT); and
• stage 1 alpha MODULATE(TEXTURE,CURRENT).

Therefore the exact pre-fog fragment is:

w = a * qA
C = q * w + (B * D) * (1 - w)
X = a * qA * qA

The square in X is mandatory. Base texture alpha does not participate in the detail-active final alpha. Fog is applied to C after the combine wherever the subset's fixed-function policy enables fog; it never changes X.

SetBlendFunction @0x005A2B90 writes one colour/alpha factor set, so the framebuffer equations for destination F are:

Raw family	Result RGB	Result alpha
Alpha	C*X + F.rgb*(1-X)	X*X + F.a*(1-X)
Alpha + Additive	C*X + F.rgb	X*X + F.a
Additive without Alpha	C + F.rgb	X + F.a
InverseAlpha	C*(1-X) + F.rgb*X	X*(1-X) + F.a*X
InverseAlpha + Additive	C*(1-X) + F.rgb	X*(1-X) + F.a
pure CLIP survivor	C + F.rgb*(1-X)	X + F.a*(1-X)

Pure CLIP rejects iff X < r, with r=100/255 for paletted and r=200/255 for DDS/non-paletted input; equality survives. CLIP combined with an Alpha/Additive/Inverse family keeps that family's factors and applies the same test. The later TRANSLUCENT branch at 0x0059C767..0x0059C7A6 then matters: ordinary T and T|Alpha are straight-alpha; T|Additive and T|InverseAlpha retain their respective family unless the skip arm applies; every T|CLIP combination is forced to straight-alpha and CLIP is disabled. Do not replace that table with a universal straight-alpha assumption.

a is the active material alpha, including authored 1-Surface.Translucency on a Translucent surface and the current object/part fade multiplier. The lead's installed Surface census found 261/261 Translucent-flagged surfaces carry nonzero authored translucency, including real 0.25, 0.5, 0.75, and 1.0 values. Treating a as always one is disproven. Current prepared Wb payloads discard that scalar while the decoded base image bakes it into base alpha; because retail detail excludes base alpha, it cannot be recovered from the sampled texel. The implementation must carry authored surface opacity explicitly from extraction through the prepared payload and GPU batch data, multiply it by the existing live instance opacity, and use the product as a. Guessing from texture alpha, querying DAT from the renderer, or using base.a is forbidden.

22.2 One draw, one material result

Implement the combine in the ordinary and atmospheric world-mesh fragment families, sharing one source include or otherwise proving their arithmetic textually and numerically identical. The base texture remains the batch-owned array sample. A detail-active exact command supplies the category texture slot and tiling in the existing push fields; zero tiling is the unarmed value. The per-draw GPU batch record supplies authored surface opacity. The vertex stage passes that scalar without interpolation; the fragment multiplies it by the existing instance-opacity varying to obtain a.

The prepared contract must gain the scalar without ambiguity:

• MeshExtractor computes it from the resolved source Surface for ordinary GfxObj and CellStruct batches using the existing OpacityFromSurfaceTranslucency rule;
• TextureBatchData, its deterministic serializer, and ObjectRenderBatch preserve it exactly;
• this is a prepared-payload schema change, so advance the bake-tool recipe identity and update every recipe/round-trip/compatibility pin in the same commit; an old recipe must be rejected clearly, never misread; and
• the GPU batch ABI carries it explicitly with layout/stride tests for both built-in shader families. Do not introduce a renderer-side surface table, per-frame dictionary, or DAT lookup.

For a detail-active fragment, compute (C,X) before the current discard/fog tail. Alpha testing uses X, not sampled base alpha. For detail-off fragments, preserve the current byte-for-byte logical path: base-alpha discard/reference, RGB lighting/fog, and base.a * instanceOpacity output alpha. The debug-light mode remains a deliberate diagnostic bypass and must not sample detail.

At each production draw site:

1. arm detail only when the existing Building Detail Textures option is on, the correct category binding is resident, tiling is nonzero, and the exact command/subset belongs to the building or EnvCell detail category;
2. set the detail slot/tiling and draw that source subset exactly once through its original base pipeline family;
3. preserve its original queue position, blend, depth test/write/reference, alpha test, cull, geometry, draw-id offset, absolute transform base, local sidecars, selected building GfxObj, palette/original-texture override, lighting, fog enable, and atmospheric receiver choice; and
4. restore neutral detail push fields before the next non-detail draw.

Delete every now-unreachable RetailDetail/RetailDetailTransparent pipeline, GpuBlendMode.RetailDetail, DrawBuildingDetailRangeRhi-style replay helper, mesh_detail.vert/.frag, compiled SPIR-V entries, manifest entries, and stale two-draw comments/tests. Keep CPU detail-category ownership only where it still selects exact eligible commands. Do not delete or weaken the building-detail setting, category textures, repeat/linear sampler, full mip chain, S4's two FIFO queues, AD-120 immediate placement, AP-238 token granularity, AP-239 raw mask residual, or AP-240 ordinary-GfxObj ClipMap placement.

The ordered-path repair for #471 is a one-pass arm on the existing solo base run. It adds no second draw and therefore leaves WalkFrameDriver's opaque/no-blended-overlay StreamMark terrain-flush premise true. Tests must prove that premise rather than adding a compensating terrain flush.

22.3 Audited policy table and explicit nonchanges

Add one data-driven policy test/table spanning Building and EnvCell × Opaque, Alpha, Additive, InverseAlpha, paletted CLIP, and DDS CLIP × detail on/off. For each row pin physical draw count, source order/FIFO, pipeline blend/depth/alpha test/reference, detail arm, emitted (C,X), and framebuffer result on a nontrivial destination. Add raw Translucent combinations sufficient to pin the later override described in §22.1. Existing AP-238/AP-239/AP-240 facts remain visible in the table instead of being silently relabelled exact.

This chunk does not change FIFO classification/token granularity, portal or terrain ordering, building-degrade selection, visibility/membership, directional-shadow caster selection, #469's lighting-direction transition, or #470's general ordered atmospheric sidecar/receiver defect. It must implement the same material arithmetic in the atmospheric shader so the later #470 repair cannot expose a second result. No graphical client is launched by the implementer.

Allowed production scope is the prepared mesh batch/extractor/serializer and bake-recipe identity; world GPU batch ABI and built-in ordinary/atmospheric mesh shaders; Wb/EnvCell detail draw/pipeline ownership; shader compiler outputs/manifest; and the smallest render-pack ABI pins required by those shader changes. Tests may change for those surfaces, deterministic prepared round trips, state/pixel equations, command transcripts, allocation, shader ABI, and package compatibility. The only authorized documentation file in the implementation commit is docs/architecture/retail-divergence-register.md: strike AP-232 with the exact new mechanism/evidence and amend counts; add or correct a row in the same commit for every discovered surviving deviation. Do not edit this packet, the plan, issues, architecture prose, scripts, or generated evidence reports.

22.4 Required proof, mutations, and return

Focused proof must include at least:

1. independent CPU fixtures over nontrivial base/detail RGBA, diffuse colour, authored opacity, live fade, fog, destination RGBA, and every §22.1 state; they must distinguish a*qA² from a*qA, base.a*a*qA², and today's two draws;
2. pure/paletted/DDS CLIP values immediately below, equal to, and above the final-X reference plus Translucent|CLIP's disabled-test override;
3. extraction and prepared serialization round trips for opacity 1, 0.75, 0.5, 0.25, and 0, a bumped recipe identity, deterministic bytes, and clear rejection of recipe 8 by the recipe-9 build;
4. GPU ABI pins proving the batch scalar reaches both ordinary and atmospheric fragments, detail-off never samples the category texture, and debug-light mode stays independent;
5. real Wb classic, walk-ordered, immediate-alpha, and delayed-alpha command recordings proving one detail-active subset draw, original pipeline state, exact slot/tiling/material alpha, no replay, and no stale detail arm on an adjacent ordinary draw;
6. real EnvCell opaque, Alpha, Additive, and both CLIP-reference recordings with the same one-draw/state/order proof;
7. production ordered sequence ordinary → opaque building detail → ClipMap building detail → ordinary with exact one-draw adjacency and no added terrain flush, closing #471;
8. active/inactive atmospheric receiver shader/pipeline recordings proving identical material equations while leaving #470's separate general repair boundary explicit;
9. setting-off and unavailable-category identity, selected-surface override, sampler/mip, fog-after-combine, draw-id/transform-prefix, cull, and lifecycle/reset/revisit preservation; and
10. warmed extraction-free draw/classification paths at 0 managed bytes after warmup, with no per-frame material lookup/table/allocation.

Sabotage and restore at least these mutations, recording the first failing test/assertion for each in the implementation commit body: change X to a*qA; multiply X by base alpha; test CLIP against base alpha or 0.05; restore any second detail draw; bind straight alpha instead of the original subset family; omit the walk-ordered detail arm; omit the atmospheric combine; drop authored opacity during prepared serialization; and leave the detail push fields armed for the following ordinary draw. Include one allocation sabotage that builds a per-frame surface map and prove the 0-B pin catches it.

Implementer return: one clean commit; exact changed-file and line-count list; all mutation first failures; git diff --check; Release solution build 0W/0E; shader compilation plus manifest/SPIR-V validation; focused content/serializer, renderer/state/pixel/command/allocation suites; official hermetic lane; and an inclusive InstalledDat lane with every accepted nonpassing identity named. If the package recipe changes, also return the exact deterministic bake command, artifact identity/size, and compatibility result. No client run.

Sequential review 1 — retail/material/deviation fidelity: re-check the named and paired bytes, PREMODULATE semantics, squared alpha, every framebuffer and CLIP/Translucent row, authored opacity provenance, fog placement, AP-232 retirement, AP-238/239/240 preservation, and all retail-facing mutations. Sequential review 2 — architecture/production/gate honesty: one physical draw, all five production paths including #471, prepared-schema compatibility, no renderer DAT lookup or per-frame map, shader/pack ABI, state/order/reset, allocation, build/lane/artifact provenance, and at least three independently reproduced sabotages. Reviews run sequentially. Every code finding receives a bounded fix contract and narrow re-review; documentation-only findings may be corrected directly by the lead. At most ten c4 review passes may run; stop before an eleventh. Nothing lands or launches graphically until both lenses pass.

23. S5-c4 fix round 1 — production SetSurface state reaches the one-pass draw

23.1 Review result and independently re-verified retail boundary

Retail/material review pass 1/10 returned FAIL on clean implementation tip 91fb80de6e0f536819100890ebc218169070aadc. The shared one-pass material equation is correct, but three production-state gaps make several §22 rows model-only rather than rendered truth:

1. production collapses raw Additive, Alpha|Additive, and InvAlpha|Additive into one TranslucencyKind.Additive / Vulkan SRCALPHA,ONE pipeline. Retail instead uses ONE,ONE, SRCALPHA,ONE, and INVSRCALPHA,ONE respectively. EnvCell additionally chooses its raw IsAdditive bucket before the already-resolved translucent override and owns no inverse pipeline, so both ordinary inverse alpha and Translucent|ClipMap|Additive can reach the wrong base state;
2. building/Wb commands never set push ParamB, so a detail-active ClipMap fragment falls back to 0.05 rather than retail's final-X reference of 100/255 for paletted input or 200/255 for DDS/non-paletted input. The command also lacks the state needed for ClipMap combined with another blend family; and
3. both one-pass fragment families always apply fog, although retail disables fixed-function fog whenever the raw Additive bit is present, including a row whose later Translucent branch changes its blend family.

The existing RetailDetailTextureContractTests policy table did not expose these failures: it omitted Additive-without-Alpha and InverseAlpha-with-Additive, computed framebuffer results only through a CPU oracle, and returned expected pipeline values without invoking extraction or a production draw owner. EnvCellAlphaDrawSourceTests also synthesized IsAdditive from the collapsed TranslucencyKind, unlike real extraction.

The lead independently re-read named D3DPolyRender::SetSurface @0x0059C4D0 lines 425083–425303 and re-hashed the paired executable and all four §22 ranges. The executable remains SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1; the four range hashes remain exactly those in §22.1. Paired bytes and named pseudo-C agree:

• the Alpha arm selects SRCALPHA,(Additive ? ONE : INVSRCALPHA);
• the neither-Alpha-nor-InvAlpha arm selects ONE,(Additive ? ONE : ZERO);
• the InvAlpha arm selects INVSRCALPHA,(Additive ? ONE : SRCALPHA);
• ClipMap enables GREATER_EQUAL with the palette/DDS reference while retaining a pre-existing blend family, except that a pure ClipMap supplies ONE,INVSRCALPHA;
• the later Translucent branch forces every Translucent|ClipMap combination to straight alpha and disables its alpha test, but otherwise retains an established Additive or InvAlpha family; and
• the raw Additive bit disables fixed-function fog independent of that later blend override.

For the review's nontrivial §22 fixture, X=0.11532 and C=(0.3534682,0.2330118,0.5438054). Against F.rgb=(0.17,0.37,0.71), retail raw Additive produces (0.5234682,0.6030118,1.2538054), while the collapsed current pipeline produces approximately (0.21076195,0.39687092,0.77271164); InverseAlpha+Additive produces approximately (0.48270625,0.57614088,1.19109376). The current 0.05 Wb ClipMap fallback also lets X=0.11532 survive where retail rejects it at both real references. The installed portal Surface census contains real Additive-only and Alpha+Additive families, so the distinction is not synthetic.

23.2 Bounded production repair

Carry one immutable, deterministic resolved SetSurface material state from the resolved source Surface at extraction time through TextureBatchData, recipe-9 serialization, ObjectRenderBatch, grouping/ordered-command data, and the exact Wb/EnvCell draw command. It must distinguish at least:

• opaque; straight alpha; alpha-additive (SRCALPHA,ONE); raw additive (ONE,ONE); inverse alpha (INVSRCALPHA,SRCALPHA); inverse-additive (INVSRCALPHA,ONE); and pure ClipMap (ONE,INVSRCALPHA);
• alpha test disabled, paletted 100/255, or DDS/non-paletted 200/255; and
• fixed-function fog enabled versus raw-Additive-disabled.

Resolve the complete precedence once from raw Surface.Type, actual texture presence/palette class, and the later Translucent rule. Do not infer it later from TranslucencyKind, IsAdditive, sampled alpha, texture-table identity, or a renderer-side DAT lookup. TranslucencyKind remains the existing queue/list-membership classification; the new state must not change the two FIFO queues, AP-239 raw-mask residual, AP-240 ordinary-Gfx ClipMap placement, or terrain/portal ordering.

For a detail-active Wb or EnvCell command, select the pipeline for that resolved family, including new ONE,ONE and INVSRCALPHA,ONE Vulkan variants; arm ParamB with the resolved final-X alpha-test reference when enabled; and bypass post-combine fog exactly when the resolved state says raw Additive disabled it. One explicit existing deviation remains binding: a pure-ClipMap ordinary-Gfx/building Wb command keeps AP-240's immediate opaque/A2C pipeline and placement while gaining the correct final-X ParamB; only EnvCell uses retail's pure-ClipMap ONE,INVSRCALPHA pipeline. EnvCell must otherwise use the resolved family rather than raw IsAdditive precedence and must have a real inverse path. Combined ClipMap families retain their blend factors and use the same final-X comparison; the Translucent+ClipMap override uses straight alpha with the test disabled. The ordinary and atmospheric shaders must implement the same fog decision.

Keep the §22.2 detail-off fragment arithmetic and its existing production selection unchanged. If the smallest implementation cannot restrict a newly exact state transition to the detail-active path without altering detail-off rendering, stop and return the exact call/data reason rather than silently expanding this fix round. Any now-proven detail-off raw-state mismatch that therefore remains must receive a precise active deviation-register row in the same implementation commit. AP-232 may retire only the old two-draw overlay and the exact detail-active mechanism actually proved; remove its current overclaim of complete framebuffer/ClipMap closure and none residual unless the production evidence truly supports those words.

Do not change the correct shared w=a*qA, C, or X=a*qA*qA equations; authored/live opacity multiplication; one-draw placement; #471's ordered arm; geometry, transform, local sidecars, cull, selection, lighting, sampler/mips, or debug-light bypass. Do not repair #469 or #470 here. Do not add a surface dictionary, per-frame map/allocation, DAT query, second draw, overlay, terrain flush, queue kind, or new ordering owner. Recipe identity remains 9 unless the serialized byte shape must change incompatibly; if it does, advance the recipe and every migration/compatibility pin together and return a fresh deterministic bake.

Allowed production scope is the §22 prepared material chain and serializer; the smallest exact material-state type; Wb/EnvCell batch/group/ordered data and pipeline selection; GPU blend enum/mapping and required pipeline variants; ordinary/atmospheric fragment state input; compiled SPIR-V and manifest; and the directly affected render-pack validator/ABI. Tests may change only for those production surfaces. The only documentation allowed in the implementation commit is docs/architecture/retail-divergence-register.md, including every required correction/new row. Do not edit this packet, plan, issues, handoff, evidence, or unrelated architecture prose.

23.3 Discriminating proof and mutation return

Replace the model-only claim with production extractor-to-command recordings for both Building/Wb and EnvCell, detail on and off, covering at minimum:

• Opaque, Alpha, Alpha|Additive, Additive without Alpha, InvAlpha, and InvAlpha|Additive;
• each applicable family with ClipMap, with both paletted and DDS reference classes and final X immediately below/equal/above the reference;
• Translucent, Translucent|Additive, Translucent|InvAlpha, and at least Translucent|ClipMap|Additive, proving the late override and independent fog disable; and
• ordinary versus atmospheric selection with an adjacent non-detail command, proving no stale blend/reference/fog state.

Each detail-active row must prove one physical draw, source FIFO/order, concrete production pipeline blend factors, depth write/test, alpha-test enable/reference in push data, detail slot/tiling, emitted (C,X), fog choice, and framebuffer result on the §23.1 destination. Each detail-off row must prove the current logical path was not changed. Use a real extracted fixture or the same production construction seam extraction uses; do not set IsAdditive or the resolved state from the expected TranslucencyKind in the fixture. Round-trip and equality tests must prove every new state bit survives prepared serialization and reaches both ObjectRenderBatch consumers.

Apply and independently restore at least these additional mutations, recording the first failure in the fix commit body:

1. collapse raw Additive back to SRCALPHA,ONE;
2. collapse InverseAlpha+Additive to either existing additive pipeline;
3. remove EnvCell's inverse-family selection;
4. restore raw IsAdditive precedence over the Translucent+ClipMap override;
5. zero Wb ParamB for a paletted row and separately substitute 0.05 for a DDS row;
6. remove alpha testing from an Alpha+ClipMap combined row;
7. always fog a raw-Additive row; and
8. disable fog from a non-Additive row.

The original ten §22 mutations remain green and restored. Return one clean fix commit atop 91fb80de6; exact file/line counts; git diff --check; Release solution 0W/0E; shader compilation and manifest/SPIR-V validation; focused content/serialization, production renderer/state/pixel/command/allocation and GPU mapping suites; the official hermetic lane; and inclusive InstalledDat with every accepted nonpassing identity named. No client launch.

Retail/material narrow re-review is pass 2/10 and must independently reproduce the raw-state mappings, CLIP reference, fog rule, register truth, and at least three new mutations. Only after it passes may the full production/gate-honesty lens run. Nothing lands or launches graphically before both lenses pass.

24. S5-c4 fix round 2 — alpha-tested blend families write depth

24.1 Retail/material re-review pass 2/10

Retail/material re-review of clean fix-round-1 tip 70751ef0e81200282323c0b08c6c52f40036ecd9 returned FAIL on one production state and one documentation-only correction. The reviewer and lead independently reproduced the code finding against the named retail decomp and paired executable:

• D3DPolyRender::SetSurface @0x0059C4D0 first selects the framebuffer blend family. Its ClipMap arm at 0x0059C724..0x0059C761 retains an already-selected blend family, except for the pure-Clip ONE,INVSRCALPHA case, and enables GREATER_EQUAL alpha testing with the palette/DDS reference;
• after the later Translucent override, the normal depth-state arm at 0x0059C7EE..0x0059C801 selects depth-write 1 whenever alpha testing is still enabled or blending is disabled, otherwise depth-write 0;
• SetSurface @0x0059C85E..0x0059C866 passes that byte to RenderDeviceD3D::SetDepthBufferMode @0x005A2D10; the callee at 0x005A2D4B..0x005A2D6E stores the third argument as m_State.DepthWriteEnable and programs D3D render state 0x0E; and
• therefore Alpha+Clip, Alpha+Additive+Clip, raw Additive+Clip, InvAlpha+Clip, and InvAlpha+Additive+Clip all retain their blend factors and alpha reference with depth writes ON. The corresponding non-Clip blended rows write no depth. Translucent|ClipMap is also depth-write off because retail's late override disables its alpha test. Opaque and pure Clip remain depth-write on.

Fix round 1 instead creates all five blended Wb pipeline families with depthWrite:false in WbDrawDispatcher.Rhi.cs and selects only by blend family; EnvCell repeats the same collapse. Its three production-transcript oracles also encode the false rule that only Opaque/pure Clip writes depth. The result has the right blend, final-X cutoff, fog decision, and single-draw position, but accepted blended+Clip fragments do not populate depth as retail does.

Everything else audited in fix round 1 passed: the shared PREMODULATE RGB and X=a*qA*qA result; 100/255 versus 200/255 final-X references; raw-Additive fog suppression; Translucent precedence; actual texture/palette provenance; recipe-10 state packing; Wb/EnvCell ordered state and reset; detail-off invariance; and AP-238/AP-239/AP-240/AP-244 preservation. Clean exact-tip evidence was also verified: focused App 242, Content 92, and Launcher 8 tests; hermetic 16,959/16,959; inclusive InstalledDat 469 pass / the same documented 10 fail / 1 skip; and byte-identical 3/8-worker recipe-10 bakes with SHA-256 0D3194A3B834DC1E0DCF67647402723B30BD758A268B8E909EC737369B911FA7. The register header in the fix commit says 160 active AP rows even though the physical table and existing recount establish 161, and its AP-232 correction temporarily overclaims exact combined-Clip state despite this depth mismatch.

24.2 Bounded production repair

On top of 70751ef0e, add/select a depth-write-ON variant of every blended SetSurface family used by a detail-active alpha-tested command:

1. Wb StraightAlpha, AlphaAdditive, raw Additive, InverseAlpha, and InverseAdditive, across both backbuffer/offscreen sample counts and the ordinary/atmospheric receiver pipeline sets; and
2. the same five families in EnvCell.

Select the depth-writing variant from the already-carried RetailSetSurfaceMaterialState.AlphaTestEnabled, not from raw Clip bits, TranslucencyKind, queue identity, a DAT lookup, or a second state owner. A blend family with alpha testing disabled keeps its existing depth-write-OFF pipeline. Preserve Wb pure Clip on AP-240's opaque/A2C pipeline and EnvCell pure Clip on its existing ONE,INVSRCALPHA, depth-write-ON pipeline. Preserve the late Translucent|ClipMap override on straight alpha, test disabled, depth write off. Depth compare remains the existing world compare; this round changes only the write-enable bit.

Do not change extraction, raw-state resolution, recipe-10 bytes, grouping or FIFO membership, draw count/order, ParamB, detail slot/tiling, fog flag, shared material equations, shader discard/equality behavior, geometry, transforms, local sidecars, cull, lighting, sampler/mips, #469, or #470. Do not add a per-frame allocation, map, DAT query, second draw, or overlay. Dispose every new pipeline in all ordinary/atmospheric and sample-count owners, with the existing partial-construction rollback behavior intact.

Correct the AP header to the physical 161-row count and narrow the AP-232 correction so it does not claim combined-Clip depth exactness until this fix is present. No new deviation row is needed: this is a required correction, while AP-240 and AP-244 remain the disclosed placement/detail-off residuals. The only documentation permitted in the implementation commit remains docs/architecture/retail-divergence-register.md.

Allowed production scope is Wb/EnvCell pipeline-set construction, exact material-pipeline selection and disposal. Tests may change only for the directly affected production pipeline/state transcripts. No shader/SPIR-V, prepared-data, recipe, queue, routing, or unrelated documentation change is authorized; if one proves necessary, stop and return the exact reason.

24.3 Discriminating proof and review return

Correct the three false depth-write oracles and prove actual production pipeline descriptors, not a parallel policy model, for both Wb and EnvCell:

• all five blended families with ClipMap/paletted or DDS alpha testing select their exact blend factors, existing cutoff, and depth-write ON;
• the same five families without alpha testing select the same factors and depth-write OFF;
• Translucent|ClipMap selects straight alpha, test disabled, depth-write OFF;
• Wb pure Clip still selects its opaque/A2C, depth-write-ON AP-240 path, while EnvCell pure Clip still selects premultiplied ONE,INVSRCALPHA, depth-write ON; and
• ordinary versus atmospheric Wb and an adjacent non-detail command select the same write rule without stale pipeline/reference/fog state.

Apply and independently restore at least these mutations, recording each first discriminating failure in the fix commit body:

1. collapse one Wb blended+Clip row back to its depth-write-OFF variant;
2. collapse a different EnvCell blended+Clip family to depth-write off;
3. incorrectly select depth-write ON for the corresponding non-Clip blend; and
4. incorrectly make the late Translucent|ClipMap override write depth.

Return one clean fix-round-2 commit atop 70751ef0e; exact file/line counts; git diff --check; Release solution 0W/0E; focused Wb/EnvCell material, pipeline-descriptor, ordered/atmospheric, disposal/rollback, allocation, shader invariance, and register-count tests; official hermetic lane; and inclusive InstalledDat with every accepted nonpassing identity named. The recipe remains 10, so no fresh bake is required unless an unauthorized prepared-data change is discovered. No graphical client launch.

Retail/material narrow re-review is pass 3/10 and must independently reproduce the depth-write rule from the paired binary, inspect real production pipeline descriptors, verify AP truth, and reproduce at least three new mutations. Only after it passes may the full production/gate-honesty lens run over the complete S5-c4 stack. Nothing lands or launches graphically before both lenses pass.

25. S5-c4 fix round 3 — restore classic/private detail-off state

25.1 Full production review pass 4/10

Retail/material re-review pass 3/10 returned PASS on clean fix-round-2 tip 472dc4fb7fd246a6efe6ed4ed20ffc26419c9ffa. It independently re-derived the Clip/depth-write rule from named D3DPolyRender::SetSurface @0x0059C4D0 and paired bytes, inspected all ordinary/atmospheric Wb and EnvCell pipeline descriptors, reproduced three mutations, and found no retail/material issue.

The subsequent full production/gate-honesty review returned FAIL on one P2 regression and no other code finding. Before c4, DrawImmediateTransparentRhi always bound pipelines.AlphaBlend for the classic grouped path's non-detail transparent commands and coalesced adjacent non-detail commands without a blend-family split. C4 instead binds PipelineForBlend(pipelines, blend) and adds Translucency equality to that run boundary. This changes detail-disabled/unavailable Additive and InvAlpha compositing and splits a previously coalesced run.

This is reachable production behavior, not a dead compatibility arm: PrivateEntityViewportRenderer.Draw calls the classic dispatcher without a collecting world-alpha queue, which reaches ExecuteClassifiedGroups -> SubmitRhi -> DrawImmediateTransparentRhi. The reviewer drove that exact path with detail disabled and one ordinary instance. Additive expected wb-mesh-alpha-1x but recorded wb-mesh-additive-1x; InvAlpha expected wb-mesh-alpha-1x but recorded wb-mesh-inverse-1x. Each case issued exactly one physical MDI. Temporarily changing only the false arm back to pipelines.AlphaBlend made both witnesses pass, and the reviewer restored the worktree byte-exactly afterward.

The rest of the complete-stack audit passed: opacity and immutable material state reach recipe-10 publication and every consumer; the 16-byte GPU batch ABI, shared shaders, one-pass equations, overlay deletion, #471 ordered arm, all five depth-write pairs, disposal/rollback, allocation, migration and artifact provenance are sound. Restored focused suites passed App 265/265, Content 92/92, and Launcher 8/8. The exact-tip hermetic artifact is 16,964/16,964 with manifest 32/32; InstalledDat is the unchanged documented 469 pass / 10 accepted fail / 1 accepted skip with manifest 30/30. The scratch worktree returned clean at 472dc4fb7.

The review also corrected the chunk boundary: c4 necessarily repairs the receiver half of #470 by selecting the frame-aware atmospheric ordered pipeline and binding its receiver resources. That is valid support for the required atmospheric one-pass path and must remain. #470 stays open because mesh_modern.vert still uses the absolute transform index for locally based alpha/selection/light/detail sidecars. Describe #470 as narrowed at landing; do not claim c4 left all of it untouched or closed it.

25.2 Bounded production repair

On top of 472dc4fb7, restore the pre-c4 detail-off behavior in DrawImmediateTransparentRhi only:

1. when the current command has no active detail material, bind pipelines.AlphaBlend regardless of its TranslucencyKind or carried raw SetSurface state;
2. restore the prior coalescing rule for consecutive non-detail transparent commands: do not split a run merely because TranslucencyKind changes; when detail is enabled, the next detail-bearing command remains a boundary;
3. keep each detail-active command on the exact PipelineForMaterial(pipelines, materialState, pipelines.Opaque) result, armed once on its existing physical draw, with neutral push state restored afterward; and
4. preserve cull-run splitting inside DrawIndirectRangeRhi; this repair restores only the outer material-run boundary that c4 changed.

Do not generalize this into a detail-off retail correction. AP-244 remains the truthful disclosure for the existing detail-off Wb/EnvCell collapses. Do not change deferred-alpha submission, ordered-stream submission, EnvCell, extraction, recipe 10, GPU batch ABI, shaders/SPIR-V/manifest, blend enums or pipeline construction, alpha-test/depth/fog/reference state, queue membership, FIFO order, transforms/sidecars, lighting, allocation ownership, #469, or the remaining #470 sidecar-index repair. In particular, retain c4's frame-aware ordered receiver selection/bindings.

Allowed production change: only src/AcDream.App/Rendering/Wb/WbDrawDispatcher.Rhi.cs. Tests may change only in the directly affected existing Wb production-transcript suite. No register change is expected because this restores the disclosed prior behavior; if a new deviation or wider production dependency is discovered, stop and return the exact fact before expanding scope. No packet, plan, issue, architecture, package, artifact, or evidence file is changed by the implementer.

25.3 Discriminating proof and return

Add permanent tests through the actual classic production path, without a collecting alpha queue:

1. with detail disabled, one Additive and one InvAlpha ordinary instance each bind wb-mesh-alpha-1x and issue exactly one physical MDI;
2. with the detail category unavailable, the same two rows retain that result;
3. adjacent same-cull Alpha -> Additive -> InvAlpha detail-off commands remain one outer material run/MDI range rather than three blend-family runs;
4. detail enabled with an eligible command still selects its exact carried detail-active material pipeline and arms slot/tiling/reference/fog once;
5. non-detail -> detail -> non-detail adjacency does not leak detail state and preserves the two required boundaries; and
6. existing deferred-alpha, ordered ordinary/atmospheric, EnvCell, depth-pair, disposal/rollback, allocation, shader/ABI and recipe-10 pins remain green.

Apply and independently restore these mutations, recording the first failing test/assertion for each:

1. restore PipelineForBlend(pipelines, blend) on the non-detail arm;
2. restore the TranslucencyKind equality run split while leaving the pipeline arm correct; and
3. force the detail-active command onto pipelines.AlphaBlend.

Return one clean fix-round-3 commit atop 472dc4fb7; exact changed-file and line counts; mutation first failures; both git diff --check forms; Release solution build 0W/0E; focused classic/private material and complete affected Wb/EnvCell/ordered/content/launcher suites; exact-tip clean official hermetic and inclusive InstalledDat artifacts with manifests and every accepted nonpassing identity named. Recipe 10 is unchanged, so no bake is required. No graphical client launch.

Because this repair restores a production-only frozen detail-off path and changes no retail/material fact, the next review is the narrow production/ gate-honesty pass 5/10 over this finding and its non-change boundary; no new retail lens is required. A PASS unlocks landing the complete c4 stack and its lead graphical gate. A FAIL receives another bounded contract within the owner-authorized ten-pass limit. Nothing lands or launches before that result.

26. S5-c4 landing, review closeout, and lead graphical gate — 2026-09-05

S5-c4 is LANDED + REVIEW-CLOSED. The reviewed scratch stack maps to the campaign branch as follows:

1. one-pass detail material 91fb80de6 -> 75664805f;
2. resolved SetSurface material state 70751ef0e -> 15ed57a1e;
3. alpha-tested blended depth-write variants 472dc4fb7 -> d5cfd1c91; and
4. classic/private detail-off restoration db8136448 -> 03a108ffa.

Retail/material pass 3/10 returned PASS after independently checking the named decomp, paired executable/PDB bytes, all five blend families, Clip references, Translucent override, fog, depth-write rule, real descriptors, register truth, and three mutations. Full production pass 4/10 found only §25's reachable classic/private detail-off regression. Fix round 3 changed exactly one production method plus its real-path transcript tests. Narrow production pass 5/10 reproduced all three mutations and returned PASS with no finding. C4's frame-aware ordered receiver selection/binding is retained; #470 is narrowed, not closed, because the ordinary shader's local-sidecar index is still wrong.

The campaign src/tests tree at 03a108ffa is byte-identical to reviewed scratch db8136448. Fresh campaign verification passed: Release solution build 0 warnings / 0 errors; focused App material/ordered/EnvCell/shader suite 245/245; focused Content extraction/serialization/package suite 71/71. The authoritative scratch artifacts remain exact, clean db8136448: hermetic 16,971/16,971 with manifest 32/32; InstalledDat 469 pass / the unchanged ten accepted failures / one accepted skip with manifest 32/32.

Because the existing self-gate package was recipe 8, the lead did not launch against stale prepared content or overwrite it. A separate full recipe-10 bake from the campaign Release binary completed in 30.8 seconds with zero failures: 2,237,865 keys, 786,891 physical blobs, 597,482,264 bytes, SHA-256 4E0FA6C589ECE12E13099A56385077964961EC52F888BC9161C6F5D34829B59B. It is artifacts/s5-c4-recipe10-full-20260905/acdream.pak; header format 2 / recipe 10, TOC count 2,237,865. The gate session points only at this separate package.

The lead graphical gate is PROVISIONAL PASS pending owner inspection. Before launch, ACE was listening on UDP 9000 as ACE.Server.exe PID 13340; neither acdream nor retail client was running; the campaign worktree was clean; and the Release build above was green. Exactly one Release client ran tools/overhaul-selfgate/route-g3.txt with Building Detail Textures enabled and the High atmospheric pack. It exited 0 through the route's own close-client, logged graceful logout confirmed, and left no client process. The log contains no fatal, unhandled, device-lost, or validation failure. Evidence root: logs/selfgate-20260905-020703-s5c4-onepass-detail.

All 13 requested 1024x768 PNGs were produced:

1. artifacts/screenshots/00-login.png;
2. artifacts/screenshots/01-cathedral-stairs.png;
3. artifacts/screenshots/02-facility-stairs.png;
4. artifacts/screenshots/03-holtburg-house.png;
5. artifacts/screenshots/04-holtburg-terrain-leak.png;
6. artifacts/screenshots/05-cathedral-south-0106.png;
7. artifacts/screenshots/06-cathedral-south-0104.png;
8. artifacts/screenshots/07-cathedral-stairs-0107.png;
9. artifacts/screenshots/08-cathedral-stairs-0112.png;
10. artifacts/screenshots/09-cathedral-terrace-edge.png;
11. artifacts/screenshots/10-facility-015E.png;
12. artifacts/screenshots/11-facility-015F.png; and
13. artifacts/screenshots/12-nanto-falls.png.

Lead inspection finds detailed cathedral, Facility, Holtburg, terrain, and waterfall surfaces present; the player and expected shells/slabs/props remain whole; and no new double-draw ghost, alpha/depth inversion, stale detail arm, terrain bleed, or missing waterfall is visible. The separate known #469 lighting transition and #470 local-sidecar defect remain G4 blockers and are not waived by this scope gate. #471 is closed by the ordered one-pass arm. Nothing has merged to main.

27. S5-#470 contract — split shared transform and local sidecar indices

27.1 Lead-verified production boundary

This is a modern Vulkan ownership/indexing repair, not a new retail algorithm. No AC-specific material, lighting, visibility, or ordering fact changes. The named-retail facts already carried by the existing light/opacity/selection ports remain untouched; the paired retail binary has no analogue for acdream's shared Vulkan frame-ring layout.

The production defect is exact and bounded:

1. PrepareOrderedStream writes this stream's transforms through WriteWorldTransformSection, which appends them to the shared directional-shadow/world transform arena and returns a possibly nonzero transformBaseInstance.
2. WriteIndirectCommands adds that prefix to every indirect command's BaseInstance, and DrawOrderedRange publishes the same prefix in GpuPushConstants.TextureIndexB.
3. The alpha, selection-lighting, per-instance light-set, indoor, detail, and dormant clip-slot sections are separate ring sections whose descriptor offsets already point at element zero for this ordered submission.
4. mesh_atmospheric.vert therefore correctly names two indices: absolute transformIndex = gl_BaseInstanceARB + gl_InstanceID, and local instanceIndex = transformIndex - int(uTextureIndexB). It reads only the transform with the former and every live per-instance sidecar with the latter.
5. mesh_modern.vert instead uses the absolute value as instanceIndex for both domains. Any nonzero transform prefix therefore reads beyond or into unrelated local sidecar elements. This affects the ordinary ordered path; S5-c4 already repaired and proved atmospheric receiver selection/binding.

The batch array is a third, already-correct domain indexed by uDrawIDOffset + gl_DrawIDARB; the global-light array is indexed by values stored in the local light-set sidecar. The clip-slot buffer is still bound and written but no world shader reads it after S3; do not reintroduce a clip read or use its dead payload to justify wider work.

27.2 Bounded production repair

Make mesh_modern.vert use the same explicit split as mesh_atmospheric.vert:

• add/read the existing push member as uniform uint uTextureIndexB;
• compute absolute transformIndex from base-instance plus instance-id;
• compute local instanceIndex by subtracting uTextureIndexB;
• index Instances[] only with transformIndex; and
• index alpha, selection lighting, indoor, the eight-entry light-set, and detail category only with instanceIndex.

Correct the two shaders' comments so they describe the shared-transform/local- sidecar ownership rather than claiming that every buffer uses an identical index. Recompile the committed shader set and update only the generated SPIR-V and manifest/hash pins that the source change requires.

Do not change PrepareOrderedStream, ring-allocation ownership, descriptor offsets, indirect command construction, push-constant ABI/size/offsets, pipeline choice, atmospheric receiver binding, render-pack policy, SetSurface state, detail equations, alpha queues/FIFO order, walk stages, batching, cull, depth, blend, fog, transforms, sidecar contents, texture/batch indices, geometry, DAT/package recipe, #469 lighting direction, or any unrelated renderer. Do not add a second data owner, copy the local sidecars into the shared transform arena, zero the transform prefix, special-case atmospheric mode, or add a per-frame allocation. No divergence-register row is expected: this restores intended production indexing without changing retail-visible policy. If any wider production change proves necessary, stop and return the exact dependency before expanding scope.

Allowed production scope is the ordinary vertex shader plus regenerated shader outputs. Tests may add the smallest production-path recording and offscreen proof needed below. The implementer changes no packet, plan, issue, architecture, package, gate artifact, or campaign memory file.

27.3 Discriminating proof and review return

Add permanent proof that fails on the pre-fix shader and exercises the real ordered preparation/draw seam:

1. deliberately consume enough shared frame-ring transform space before PrepareOrderedStream that its transform prefix is nonzero;
2. record two ordered instances with deliberately distinct transform, alpha, selection-lighting, light-set, indoor, and detail values;
3. assert the uploaded indirect commands carry the nonzero absolute BaseInstance, the push block carries that exact prefix, and each local sidecar descriptor section still begins at its own element zero;
4. compile/inspect the production ordinary SPIR-V and prove the source/ABI has one absolute transform lookup and local lookup for every live sidecar;
5. add an offscreen pixel witness through the production ordinary shader at a nonzero transform prefix. Its two instances must encode distinguishable sidecar-driven output so using the absolute index for either domain changes the readback; a source-string-only or parallel-policy oracle is not this witness; and
6. prove active and inactive directional-shadow receiver states still select and bind the same ordinary/atmospheric pipelines as before.

Apply and independently restore at least these mutations, recording the first discriminating failure for each in the commit body:

1. make the transform lookup use local instanceIndex;
2. make at least one live local sidecar lookup use absolute transformIndex;
3. omit or zero the pushed transform prefix while keeping the shader split;
4. force the inactive receiver state onto the atmospheric pipeline, then force the active receiver state onto the ordinary pipeline; and
5. point the offscreen witness at a copied/test shader instead of the committed production ordinary SPIR-V.

Return one clean implementation commit atop this contract; exact changed-file and line counts; all mutation first failures; both git diff --check forms; Release solution build with zero warnings/errors; focused ordered-stream, receiver, shader ABI/manifest/SPIR-V, offscreen, allocation, material, and render-pack tests; official hermetic lane; and inclusive InstalledDat with all accepted nonpassing identities named. Recipe 10 and prepared content are unchanged, so no bake is required. No graphical client launch.

Review stays sequential. Retail/behavior pass 1/10 first verifies that no retail-visible algorithm or state changed, the existing named-retail sidecar meanings remain intact, and the proof actually distinguishes both index domains. Only after PASS does production/gate-honesty pass 2/10 inspect the complete data/descriptor/push/SPIR-V path, reproduce at least three mutations, and rule on gate sufficiency. A failed pass receives a bounded fix contract; the owner-authorized ceiling is ten review passes. Nothing lands or launches graphically before both lenses pass.

28. S5-#470 fix round 1 — keep the hardware witness out of the portable lane

28.1 Retail/behavior review pass 1/10

Review of clean implementation 51f974da4f2262e6afdd336774326f29fb2aec33 returned FAIL on one blocking gate-portability defect and found no renderer, retail-behavior, shader, descriptor, or proof-mechanism defect.

The production repair is correct: the ordinary shader uses the absolute base-instance domain only for Instances[], subtracts the exact pushed prefix for all five live local sidecar bindings, preserves draw-ID batch indexing and global-light indirection, and regenerates the committed module exactly. The reviewer reproduced the compiled SHA-256 6194193764616BC88BF967D1FDC2BEA5F6F2D1EC2EF94FD492922137503F56E4, ran the production headless Vulkan witness successfully, and independently restored mutations to both index domains. The named-retail sidecar meanings and paired-binary anchors are unchanged.

The defect is test placement. MeshModernSharedIndexOffscreenTests is an ordinary untagged Fact, so tools/run-release-gate.ps1 includes it in the complete portable Release lane. It unconditionally needs a Vulkan loader, 1.3-capable physical device/graphics queue, and coherent host-visible readback memory. The reviewer forced a nonexistent ICD and reproduced a hard vkCreateInstance ErrorIncompatibleDriver, not a skip. GitHub's complete-release Windows runner installs none of those prerequisites; only the existing linux-vulkan job installs lavapipe. Consequently the local 16,975-pass artifact is hardware-conditioned and cannot be credited as a portable hermetic gate until the witness has an explicit capability lane.

28.2 Bounded evidence-lane repair

Keep every byte of the renderer, GLSL, SPIR-V, manifest, command-recording proof, SPIR-V structural proof, and hardware witness logic unchanged. Change only its ownership and execution:

1. mark the offscreen witness with one explicit Lane=Vulkan trait;
2. exclude Lane=Vulkan in the default filter of tools/run-release-gate.ps1, alongside the existing platform/capability lanes, so a machine with no Vulkan loader/device can run the truthful portable gate;
3. split the existing linux-vulkan test step into the platform-independent Vulkan tests (FullyQualifiedName~...Gpu.Vk&Lane!=Vulkan) and a separately named Lane=Vulkan step after lavapipe installation. The latter must run the real offscreen test and fail on absence or render/readback mismatch; do not turn missing capability into a pass; and
4. update docs/release-gate.md narrowly to name the Vulkan lane, its required capability, its portable exclusion, the existing lavapipe CI owner, and the exact local command for running it.

Add a small contract test that reads the real test source, portable-gate script, and headless-portability workflow and fails if any of the three sides drift: the hardware witness loses its trait, the portable filter admits it, or the lavapipe job stops invoking it explicitly. This test itself stays portable and must not initialize Vulkan.

No product source, shader/generated output, test project option, recipe, package, register, issue, plan, campaign packet beyond this lead-owned section, or unrelated workflow/tool/doc changes are permitted. No dynamic success on missing hardware, broad Gpu.Vk exclusion, OS-name proxy, environment-only hidden gate, duplicated pixel oracle, copied shader, or second witness. No graphical client launch.

28.3 Proof and narrow re-review

Apply and restore these mutations, recording the first failure in the fix commit body:

1. remove the witness's Lane=Vulkan trait;
2. remove Lane!=Vulkan from the portable Release filter;
3. remove or weaken the explicit lavapipe Lane=Vulkan invocation; and
4. point the dedicated invocation at a class/name filter that could miss the trait-owned witness.

Return one clean fix-round-1 commit atop 51f974da4; exact changed-file and line counts; all mutation first failures; both diff-check forms; the portable contract test; the explicitly filtered Lane=Vulkan test on the current physical device; Release solution build 0W/0E; a new clean official portable hermetic artifact (the Vulkan witness excluded); and inclusive InstalledDat with every accepted nonpassing identity named. The original exact-tip hardware result remains supporting evidence, but the fixed exact tip must run the dedicated lane again. No bake or graphical gate.

Because pass 1 found no renderer or retail-behavior defect, the next review is a narrow retail/gate-honesty re-review pass 2/10 of this one finding. It must reproduce at least mutations 1–3, prove the ordinary portable suite no longer depends on Vulkan, and prove the dedicated local and lavapipe routes cannot silently omit or pass the hardware witness. A PASS unlocks the full production review as pass 3/10; a FAIL receives another bounded contract within the ten- pass ceiling. Nothing lands or launches before both sequential lenses pass.

29. S5-#470 fix round 2 — make the pixel readback host-visible

29.1 Review result through pass 3/10

Fix-round-1 scratch tip 2cad9c84c7508f714823d2bd44199071ac8d74f7 passed the narrow retail/gate-honesty re-review at pass 2/10. The reviewer proved the five-file change was evidence-only, ran the portable Gpu.Vk&Lane!=Vulkan set successfully with an invalid ICD, ran the exact Lane=Vulkan witness successfully on the current AMD device, proved the same dedicated lane fails rather than skips with an invalid ICD, and reproduced the trait, portable-filter, and dedicated-workflow mutations. The renderer, GLSL, SPIR-V, manifest, and witness body remained byte-identical to implementation 51f974da4.

Full production/gate-honesty review pass 3/10 then returned FAIL on one P2 test-harness synchronization defect only. It found no renderer, descriptor- domain, shader, lane-ownership, allocation, or production-path defect. In MeshModernSharedIndexOffscreenTests.ReadBack, the image-to-buffer copy is followed by command-buffer completion, QueueWaitIdle, mapping, and a CPU read, but there is no device memory dependency from the transfer write to the host read. Host-coherent memory removes the need for invalidation; it does not make a transfer write available/visible to the host. Queue-idle/fence completion likewise does not replace that dependency. The locally passing pixel witness may therefore read stale data on another conformant device.

The review independently restored both shader index-domain mutations and the lane-trait mutation, regenerated exact ordinary shader SHA-256 6194193764616BC88BF967D1FDC2BEA5F6F2D1EC2EF94FD492922137503F56E4, passed the restored focused portable set 363/363, the dedicated witness 1/1, the invalid-ICD portable structural/ownership set 2/2, and a Release build at 0 warnings / 0 errors. Both official manifests verify 30/30. The exact hermetic artifact is 16,975/0/0. The exact InstalledDat artifact used the canonical-inclusive filter Lane=InstalledDat&Purpose!=Diagnostic and is 386 passed / the unchanged 10 accepted failures / 1 accepted skip; it is not the broader diagnostic-inclusive 469-pass lane.

29.2 Bounded harness-only repair

Change only the offscreen witness and its smallest test-side proof. Immediately after CmdCopyImageToBuffer and before EndCommandBuffer, record one CmdPipelineBarrier2 whose actual BufferMemoryBarrier2 covers the readback buffer and exact copied byte range:

• source stage CopyBit, source access TransferWriteBit;
• destination stage HostBit, destination access HostReadBit;
• both queue-family indices QueueFamilyIgnored;
• offset zero and size equal to the mapped/copied byte count; and
• the exact readback buffer handle.

Keep QueueWaitIdle, the host-visible/coherent allocation, map/unmap, copy geometry, render submission, pixel oracle, physical-device selection, and cleanup unchanged. Do not add an invalidate call to coherent memory, a second submission/fence, a staging owner, a production RHI helper, a device-specific workaround, or a skip/pass on unavailable Vulkan. Do not change renderer source, GLSL, SPIR-V, manifests, lane ownership, workflow, release-gate tool or documentation, package/recipe, issue/register policy, or graphical behavior.

Add a portable, no-Vulkan-initialization guard over the live readback path. It must inspect the actual barrier descriptor and prove every stage/access, queue-family, buffer, offset, and size value above, and it must prove the live command order is copy -> that barrier -> end/submit. A source-only assertion that can be satisfied by an unused lookalike descriptor is insufficient.

29.3 Fix return and narrow production re-review

Apply and restore at least these mutations, recording the first discriminating failure for each in the fix commit body:

1. remove the post-copy host-read barrier from the live readback path;
2. change either side of the dependency (for example TransferWriteBit to TransferReadBit, or HostReadBit to HostWriteBit); and
3. move the otherwise-correct barrier before CmdCopyImageToBuffer.

Return one clean fix-round-2 commit atop 2cad9c84; exact changed-file and line counts; mutation first failures; both diff checks; the portable descriptor/order guard; the exact dedicated Lane=Vulkan witness on the current device; focused structural, recording, receiver, lane-ownership, and Vulkan-portable tests; Release solution build 0W/0E; a clean exact-tip portable hermetic artifact; and canonical-inclusive InstalledDat with all ten accepted failures and the one accepted skip named. No bake or graphical client launch.

Because pass 3 found no production renderer or retail-behavior defect, only a narrow production/gate-honesty re-review runs next as pass 4/10. It must inspect the live recorded dependency and order, reproduce mutations 1–3, rerun the dedicated witness, verify the prior index-domain and lane-ownership proofs remain intact, and verify exact clean artifact provenance. A PASS unlocks landing and the pinned graphical A/B. A FAIL receives the next bounded contract within the owner-authorized ten-pass ceiling. Nothing lands or launches before PASS.

30. S5-#470 landing, review closeout, and lead graphical A/B — 2026-09-05

S5 issue #470 is LANDED + REVIEW-CLOSED. Reviewed scratch implementation 51f974da4, evidence-lane fix 2cad9c84, and readback-barrier fix 98c004aa7 map to campaign commits 15a796c3a, 7506e5f14, and b333edb4f. Lead contracts are campaign 67a8bc21f, 011ab1c18, and 56837f547; fixed-pose gate route commit is 19b44e5e3.

Retail/behavior pass 1/10 found no renderer or retail-policy defect and found the hardware witness incorrectly owned by the portable lane. The evidence- lane repair then passed narrow pass 2/10. Full production pass 3/10 verified the complete transform/sidecar/descriptor/push/SPIR-V path but found one P2 in the witness: coherent memory plus queue idle did not replace a transfer-write to host-read dependency. Fix round 2 added that exact live buffer barrier and a portable descriptor/order guard. Narrow production pass 4/10 returned PASS with no remaining finding, independently reproduced all three barrier mutations, ran the physical pixel witness, and confirmed every renderer/shader/lane byte outside the bounded stack stayed unchanged.

Exact reviewed evidence at scratch 98c004aa7:

• Release solution build 0 warnings / 0 errors;
• portable Vulkan set 228/228, ordered/receiver set 41/41, and physical Lane=Vulkan witness 1/1;
• reviewer-focused Vulkan/transform/ordered/receiver set 258/258 and the restored witness 1/1;
• artifacts/s5-470-fix2-hermetic-clean-98c004aa7: 16,976 passed / 0 failed / 0 skipped, exact clean tip, manifest 30/30; and
• artifacts/s5-470-fix2-installeddat-inclusive-clean-98c004aa7: canonical Lane=InstalledDat&Purpose!=Diagnostic, 386 passed / the unchanged 10 accepted failures / 1 accepted skip, exact clean tip, manifest 30/30.

Fresh campaign verification after integration: src, tests, workflow, release-gate tool/doc, GLSL, generated SPIR-V, and shader manifest were byte-identical to reviewed scratch; Release built at 0 warnings / 0 errors; and the combined transform/sidecar, barrier, lane, ordered-stream, and receiver set passed 48/48. No recipe or bake changed.

The lead graphical gate is PROVISIONAL PASS pending owner inspection. The first launch attempt at logs/selfgate-20260905-032058-s5-470-pinned-shadow-ab failed before the route and produced zero PNGs because the default session named a stale recipe-8 package while the build requires recipe 10. It exited with the managed- exception code, left no client, and is excluded from renderer acceptance.

The corrected one-run gate used the already verified recipe-10 package artifacts/s5-c4-recipe10-full-20260905/acdream.pak, SHA-256 4E0FA6C589ECE12E13099A56385077964961EC52F888BC9161C6F5D34829B59B. Before launch, Release was green, the campaign tree at 19b44e5e3 was clean, ACE listened on UDP 9000 as PID 13340, and neither acdream nor retail client was running. tools/overhaul-selfgate/route-s5-470-shadow-ab.txt established the framebuffer and camera before acceptance, then captured retail/off -> High -> retail/off without movement or resize. The run exited 0, confirmed graceful logout, and left no client:

• logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1/artifacts/screenshots/s5-470-retail-before.png;
• logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1/artifacts/screenshots/s5-470-high.png;
• logs/selfgate-20260905-032132-s5-470-pinned-shadow-ab-r1/artifacts/screenshots/s5-470-retail-after.png.

Lead inspection finds the player and ordinary scene geometry present in all three frames with no disappearing/corrupted static, transform displacement, alpha/selection/detail sidecar corruption, or failure to restore the retail frame. High retains the separately registered #469 lighting-direction shift; that known blocker is neither waived nor attributed to #470. #470 changes no retail-visible policy and requires no divergence-register row. Next is #469, then S5-c5, closeout, and G4. Nothing has merged to main.

31. S5-#469 contract — keep retail world lighting stable across the opt-in shadow gate

31.1 Lead-recovered retail and binary boundary

Issue #469 is not an ambiguous art-direction choice. Retail owns exactly one outdoor directional-light channel, authored by SkyTimeOfDay; the atmospheric pack's visible sun/moon choice is an acdream-only shadow-projection input and must not replace that lighting channel.

The lead re-read the named retail decomp and its verbatim type header before writing this contract:

• SkyTimeOfDay contains dir_bright, dir_heading, dir_pitch, and dir_color (acclient.h lines 53124–53137).
• SkyDesc::GetLighting @0x00500A80 interpolates those fields between the two surrounding authored time-of-day records, constructs one directional vector, and returns one directional colour.
• LScape::set_landscape_lighting @0x005054D0 copies that vector and colour to LScape::sunlight and then Render::world_lights.sunlight; it has no shadow- gate or celestial-mesh selection input.
• PrimD3DRender::UpdateLightsInternal @0x0059AED0, specifically 0x0059B4ED–0x0059B5CE, derives the D3D sunlight colour and direction from that same Render::world_lights.sunlight. It does not replace the direction when any drawing feature is enabled or disabled.

The paired executable was independently verified again with tools/pdb-extract/check_exe_pdb.py: C:\Users\erikn\Downloads\acclient.exe is PE32 v11.4186, whole-file SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1, CodeView GUID {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1, and matches C:\Users\erikn\source\repos\acdream\refs\acclient.pdb. Exact function-range SHA-256 anchors are:

Function	File range	Bytes	SHA-256
SkyDesc::GetLighting	0x00100A80..0x00100CDF	608	9D82E8EDDBD66C52DBD3F08D07D661482DB545C4F513E81AB4F16E4EDF410188
LScape::set_landscape_lighting	0x001054D0..0x0010565F	400	DF3FD816845AE0F6E2423442A325CE43A44A8204E1B857D7674BBB8F4640D0CB
PrimD3DRender::UpdateLightsInternal	0x0019AED0..0x0019B5DF	1,808	E18FD7AD9A8EB819AB9602D25DE5D1BB99FADD1D439B35140E443EB1E0437F84

This agrees with the pre-existing static source study docs/research/2026-08-22-dereth-celestial-shadow-sources.md: celestial meshes supply only the opt-in shadow direction; colour and energy remain retail's single authored channel; existing retail scene lighting remains driven by SkyStateProvider.

The current atmospheric receiver shaders violate that declared boundary. When shadow flag bit 0 is clear they use the plain pipeline's authored -uLights[].dirAndRange.xyz; when it is set they abruptly use normalized uShadowLightDirectionAndSource.xyz. Shadow strength is blended later, so this binary vertex-light switch produces the whole-world relight captured in both the exact parent and S5-c2 candidate A/Bs. It is not absent shadow work and it is not caused by S5-c2.

31.2 Bounded production repair and IA-24 correction

Restore one stable lighting owner in both atmospheric vertex receivers:

1. mesh_atmospheric.vert computes every outdoor directional-light Ldir with the exact plain-mesh expression -uLights[i].dirAndRange.xyz in every shadow-gate state. Preserve its unnormalized value and its per-light loop.
2. terrain_atmospheric.vert computes surfaceToLight with the exact plain- terrain expression -uLights[0].dirAndRange.xyz in every shadow-gate state. Preserve MIN_FACTOR, authored colour/energy, and the split directional varying used by the fragment receiver.
3. Delete the obsolete shadowGatedOff branches and replace their comments with the retail ownership above.
4. Keep uShadowLightDirectionAndSource unchanged for cascade projection, receiver depth/bias/PCF, and atmospheric volumetrics. The optional shadows may therefore be geometrically directed at the selected visible celestial source while the receiver's base lighting remains the authored retail direction. That separation is deliberate and was already the original IA-24 research boundary.
5. Recompile the committed shader set and update only the generated atmospheric vertex SPIR-V and manifest/hash entries required by those source changes.
6. Amend IA-24 in the same implementation commit: remove its statement that receiver lighting switches to the celestial direction while shadows render; state instead that authored uLights remains the sole base-light direction in every gate state, while the selected celestial source drives only the opt-in shadow/volumetric projection. Explicitly record the possible visual light/shadow-angle separation as the cost of preserving retail lighting and eliminating the binary relight. This is the required deviation-register update; add no second row.

Do not change SceneLighting, SkyStateProvider, the celestial-source resolver or its sun/moon priority, shadow strength/fades, cascade matrices, shadow caster selection, receiver binding/descriptor ABI, fragment shadow lookup, PCF/bias, volumetric policy, render-pack selection, plain shaders, materials, fog, tone mapping, colour/energy, terrain MIN_FACTOR, indoor lighting, point/spot lights, visibility, geometry, package recipe, or any unrelated renderer. Do not normalize the authored direction, blend the two directions, invent another runtime state owner, hide the switch behind a threshold, or add per-frame work/allocation. If any wider production change is needed, stop and return the exact dependency before expanding scope.

Allowed production scope is the two atmospheric vertex shader sources, their regenerated SPIR-V/manifest pins, and the IA-24 row. Tests may add only the smallest structural and real-shader proof below. The implementer changes no packet, plan, issue, package, gate artifact, architecture text outside IA-24, or campaign memory.

31.3 Discriminating proof, mutations, and return

Permanent proof must establish both halves of the boundary rather than merely matching a copied CPU formula:

1. compile and inspect the committed production atmospheric vertex SPIR-V and prove mesh and terrain take their diffuse-light direction only from the corresponding authored uLights member, with the exact unnormalized plain- shader expressions and no shadow-flag/celestial-direction selection;
2. exercise the committed production atmospheric receiver shaders in a real offscreen Vulkan pixel witness for both mesh and terrain. Holding authored light/material/geometry constant while toggling only shadow flag and celestial direction must leave the unshadowed base directional-light result invariant; choose inputs for which the pre-fix branch gives a different pixel. The witness is explicitly Lane=Vulkan, uses the existing dedicated lavapipe/local lane, and fails rather than skips when that lane lacks Vulkan;
3. prove the committed fragment receiver and volumetric shaders still consume uShadowLightDirectionAndSource for opt-in shadow projection/bias/visibility, so the repair cannot silently disable or redirect shadows;
4. prove active and inactive receiver states still select/bind the same atmospheric/plain pipelines and descriptors as before;
5. pin that neither plain shader source/SPIR-V nor any pipeline-selection or renderer source changed from the contract parent; and
6. read the live IA-24 row and fail if it again claims celestial direction owns base receiver lighting or omits the explicit light/shadow separation.

Apply and independently restore at least these mutations, recording the first discriminating failure for each in the implementation commit body:

1. restore the shadow-flag/celestial-direction branch in mesh_atmospheric.vert;
2. restore it in terrain_atmospheric.vert;
3. normalize either authored vertex-light direction;
4. redirect a fragment shadow/volumetric use from the celestial source to the authored light, or remove its celestial-source read; and
5. restore IA-24's old assertion that pack-active base lighting follows the celestial source.

Return one clean implementation commit atop this contract; exact changed-file and line counts; all mutation first failures; both git diff --check forms; exact shader compiler command and generated hashes; the dedicated physical Lane=Vulkan result; focused atmospheric shader/receiver/manifest/source- resolver tests; Release solution build with zero warnings/errors; official hermetic lane; and canonical-inclusive InstalledDat with every accepted nonpassing identity named. Recipe 10 and prepared content are unchanged, so no bake is required. No graphical client launch.

Review is sequential. Retail/deviation pass 1/10 first verifies the three named-retail functions and paired bytes, the stable authored-light rule, IA-24 truth, pack-off preservation, and that the pixel/structural tests actually fail on both old branches. Only after PASS does production/gate-honesty pass 2/10 inspect the complete source-to-SPIR-V-to-pipeline path, run the real Vulkan witness, reproduce at least mutations 1–4, and rule on portable/dedicated-lane ownership and full gate sufficiency. A failed pass receives one bounded fix contract. The owner-authorized ceiling is ten review passes. Nothing lands or launches graphically before both lenses pass.

After landing, the lead repeats the exact fixed-pose retail/off -> High -> retail/off plus dusk transition used to file #469, with Release green, a clean tree, UDP/client preflight, one background command, and graceful self-owned shutdown. PASS requires no whole-world base-light jump as shadow work gates, while pack-active shadow direction/visibility still changes and the final retail frame restores. Record exact PNG paths; the result remains provisional until owner inspection.

32. S5-#469 landing, review closeout, and graphical transition — 2026-09-05

S5 issue #469 is LANDED + REVIEW-CLOSED. Contract 809887524; reviewed scratch implementation c09b6cf0f; campaign implementation 94ddde69a; fixed- pose route 62efc72cb.

The implementation removes the binary shadow-gate/celestial-direction branch from both atmospheric vertex receivers. Mesh now always uses the exact unnormalized -uLights[i].dirAndRange.xyz; terrain always uses the exact unnormalized -uLights[0].dirAndRange.xyz. Fragment receiver shadow projection/bias/PCF and atmospheric volumetrics continue to use the selected celestial direction. IA-24 was amended in the same implementation commit to record that ownership and its possible light/shadow-angle separation.

Retail/deviation review pass 1/10 returned PASS with no findings after independently verifying SkyDesc::GetLighting, LScape::set_landscape_lighting, and PrimD3DRender::UpdateLightsInternal against the matching 2013 executable/PDB and reproducing both old receiver branches plus the old IA-24 assertion. Production/gate-honesty pass 2/10 returned PASS with no findings after inspecting the complete source -> compiler -> SPIR-V -> pipeline/descriptor -> pixel/readback path, independently reproducing all four code mutations, and proving the dedicated Vulkan lane fails rather than skips without a driver.

Exact reviewed scratch evidence at c09b6cf0f:

• compiled 23/23 shader pairs; mesh vertex SPIR-V SHA-256 AB642649B055A564B49C088BEAC9601593508CAB69778B71719C66C9A812CD3C and terrain vertex SPIR-V SHA-256 7DE30E426401F637A28C1F1F8D69D1A465462AD7A5CEE1927FAE7E1BA5355B1F;
• Release solution build 0 warnings / 0 errors;
• implementer-focused 64/64 and reviewer-focused 126/126;
• physical Lane=Vulkan 2/2, including the committed production mesh+terrain lighting witness;
• artifacts/s5-469-hermetic-c09b6cf0f: 16,983 passed / 0 failed / 0 skipped, exact clean tip, manifest 32/32; and
• artifacts/s5-469-installeddat-c09b6cf0f: canonical Lane=InstalledDat&Purpose!=Diagnostic, 386 passed / the unchanged ten accepted failures / one accepted skip, exact clean tip, manifest 30/30.

The lead independently rechecked the executable/PDB identity and all three function-range hashes, inspected the production/test diff, reproduced the generated hashes, and verified both artifact manifests with zero bad entries. Fresh campaign verification after integration: Release 0 warnings / 0 errors; focused atmospheric/receiver/manifest/source-resolver set 82/82; physical Lane=Vulkan 2/2. Recipe 10 and prepared content are unchanged.

The lead graphical transition is PROVISIONAL PASS pending owner inspection at clean 62efc72cb. Before launch, ACE listened on UDP 9000 as PID 13340 and neither acdream nor retail client was running. One route used the verified recipe-10 session, established authored time, 1024 x 768 framebuffer, and camera before acceptance, then held pose/camera/framebuffer fixed across retail/off -> High -> retail/off -> High and advanced the authored light once for the final High frame. Run logs/selfgate-20260905-040449-s5-469-lighting-transition-r1 produced five PNGs, exited 0, confirmed graceful logout, emitted no fatal/validation match, left no client, and left ACE running:

• artifacts/screenshots/s5-469-noon-retail-before.png;
• artifacts/screenshots/s5-469-noon-high.png;
• artifacts/screenshots/s5-469-noon-retail-after.png;
• artifacts/screenshots/s5-469-noon-high-repeat.png; and
• artifacts/screenshots/s5-469-dusk-high.png.

Both High noon metadata rows prove active shadow work: 2,500 selected casters, four cascades, 26 pack draws, no failure, and directional-shadow strengths 0.5429/0.5300. The dusk High row is likewise active and whole: 2,500 casters, four cascades, 26 draws, strength 0.5760. Lead original-resolution inspection finds the terrain, buildings, foliage, local player, equipment, and ordinary sidecars present in every frame. The former near-black binary whole-world relight is gone; the retail-before/after frames restore, while High retains its expected shadows and post-processing. This closes #469; no new divergence row is required beyond the truthful IA-24 amendment. Next is S5-c5, then closeout and G4. Nothing has merged to main.

33. S5-c5 contract — delete the superseded visibility/probe apparatus and pin the final graph

This is a deletion-and-architecture chunk. It changes no retail draw decision, no membership result, no event order, no alpha route, no material state, and no shader. The retained production authority is the already-reviewed RetailFrameWalk/WalkFrameDriver path. The work removes the independently compiled research path and output-only diagnostics that can otherwise be mistaken for production owners.

33.1 Lead-verified boundary

The named Sept-2013 retail decomp has one normal-world call chain:

• SmartBox::RenderNormalMode @0x00453AA0 calls LScape::draw;
• LScape::draw @0x00506330 reaches the retained PView path;
• PView::DrawCells @0x005A4840 owns the landscape/cell-pass boundary; and
• PView::DrawInside @0x005A5860 constructs and draws the one PView graph.

These anchors were re-read in docs/research/named-retail/acclient_2013_pseudo_c.txt at lines 92635/92683, 267912, 432709/432719, and 433793/433819. The paired executable was re-hashed before this contract: C:\Users\erikn\Downloads\acclient.exe, SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1, paired with refs/acclient.pdb, SHA-256 B1AA774B458C7EFDED9F3BB7E1B18B31A508514D6F2089800629B1B51C154925 (the already-verified CodeView identity is {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1). The first 64 bytes at the four executable anchors hash respectively to B69DF08F6B30118463B6148A09CEAF2D47F640303039912224DB4D29FCB93FC7, 9319B607C0505D0656935719C27E9F7C00B5281574643614A367C02C88EA7CC3, 16E12B476CDABE0F7CD0B1380A31EF194B00901A76D5AFB295CD0C30B4DB36CC, and DE6E16EC73EDFC04632E2C7A059AB26519099391637318805EF15AB6DBA682C4.

Current-source reachability was also checked independently. Outside its own file, production contains no construction or call of PortalVisibilityBuilder, PortalVisibilityFrame, IndoorDrawPlan, or ViewconeCuller. The only surviving PortalVisibilityFrame production uses are the dead ClipFrameAssembler.Assemble overload and IndoorDrawPlan.ShellPass; both are called only by tests. The live assembler entry points are BeginWalkFrame and ReassembleOutsideViewFromWalk. RetailFrameWalk alone retains the interior/outdoor WalkPView objects, and RetailPViewRenderer alone retains the RetailFrameWalk/WalkFrameDriver frame owner.

Therefore this chunk is not a new retail port. Its retail claim is narrower: deleting an unreachable competing implementation cannot alter the one live walk. If a compile repair would change a live walk, draw, queue, material, or shader method, stop and return that fact instead of widening this contract.

33.2 C1 — remove the independently compiled portal-BFS research path

Delete these production artifacts outright:

• Rendering/PortalVisibilityBuilder.cs, including PortalVisibilityFrame and ExteriorPortalSeed;
• Rendering/IndoorDrawPlan.cs, including CellDrawEntry;
• Rendering/ViewconeCuller.cs; and
• the ClipFrameAssembler.Assemble(ClipFrame, PortalVisibilityFrame, ...) overload and its builder-only comments.

Keep LoadedCell, CellVisibility, PortalView/CellView, PortalProjection, ClipPlaneSet, ClipFrame, BeginWalkFrame, and ReassembleOutsideViewFromWalk: the current walk, portal fan, and preparation paths still consume those primitives. Rewrite their stale comments to name the walk rather than the deleted builder; comments must not imply the synthetic outdoor node performs a second portal flood.

Delete old-builder-only tests rather than keeping a second implementation alive as test code. This includes the dedicated builder/robustness/flood-replay, IndoorDrawPlan, ViewconeCullerReuse, and TowerAscentReplay files, plus the builder-only cases in mixed files. Preserve the first two live ClipFrameAssemblerTests (BeginWalkFrame outdoor/interior reset) and every WalkOutsideViewReassemblyTests case by driving BeginWalkFrame directly. OutdoorCellNodeTests keeps its construction invariant and drops only the deleted-builder assertion. A currently live CELLARRAY/walk assertion may be moved to a focused file if it is unique; do not retain a builder dependency to save a redundant diagnostic test.

33.3 C2 — remove obsolete renderer probes and their hidden frame cost

Delete the complete Facility stair family named by the plan:

• RenderingDiagnostics.ProbeFacilityStairsEnabled and the environment read;
• WbDrawDispatcher.FacilityStairProbe.cs;
• all Facility/cathedral signature, classifier, ordered-stream, upload, and submission probe fields/methods/call sites in RetailPViewRenderer, WalkPView, WalkProductionWorldData, WalkStaticStreamPopulator, and WbDrawDispatcher.OrderedStream/WalkClassify; and
• the probe-only WalkProductionWorldData.StaticBucketContains method and [walk-membership] print. Keep UnregisteredRenderMembershipCount itself and its exact tests: it remains a cheap invariant/result, not a logging owner.

The remaining renderer flags explicitly documented as throwaway, relic, or closed-investigation probes are deleted in the same sweep:

• ProbeIndoorWalkEnabled, ProbeIndoorLookupEnabled, ProbeIndoorUploadEnabled, ProbeIndoorXformEnabled, ProbeIndoorCullEnabled, and their IndoorAll cascade;
• ProbeVisibilityEnabled/EmitVis and ProbeEnvCellEnabled;
• ProbeFlapEnabled, ProbePvInputEnabled, ProbeGlStateEnabled, ProbeClipRouteEnabled, and ProbePortalChurnEnabled;
• ProbeIndoorLightEnabled/EmitIndoorLight; and
• ProbeSeamDrawEnabled/SeamDrawTargetCells and their parse/format helpers.

Remove every production output branch and scratch field used only by those flags, including the [flap*], [pv-input], [render-sig], [vis], [gl-state*], [clip-route*], [indoor-*], [envcells], [light], [seam-*], and [facility-*] families. WorldRenderDiagnostics keeps its terrain timing/publication responsibility but loses the dead raw-GL reader, state/scissor records, and the obsolete render-probe methods. WorldSceneDiagnosticsController keeps collision/debug-fact publication but loses the two probe-only interface methods and the post-world GL sample.

Delete the corresponding tests and docs/launch-options.md rows. Historical research/capture documents remain historical evidence and are not rewritten. Comments in still-live production code may describe a historical capture, but must not cite a deleted runtime flag or claim a deleted probe remains callable.

The retained diagnostics are explicit nonchanges: RenderingDiagnostics.LightDebugMode, ShouldRenderIndoor, FrameProfEnabled, and DumpWalkTranscriptEnabled. In particular, ACDREAM_DUMP_WALK_TRANSCRIPT is the plan's one retained, typed, print-only retail-conformance flag; c5 must not remove or weaken its existing pins. Physics/audio/streaming probes outside the renderer cleanup inventory are also out of scope.

33.4 C3 — make architecture and register prose match the landed renderer

Update docs/architecture/acdream-architecture.md so it states that the old builder is deleted, not merely callerless. Replace the stale three-item “known non-retail order” paragraph with the landed S3/S4 facts: per-landcell terrain and sort-cell turns, outside-view/latch-gated clear+seals, and the two bounded CLIP/ALPHA FIFO lists drained at exact barriers. Name the still-live AP-238 through AP-243 residuals without resurrecting the superseded model.

Update docs/architecture/worldbuilder-inventory.md to remove the deleted [walk-membership]/Facility flag claim while retaining the UnregisteredRenderMembershipCount invariant and its AD-116 meaning. Amend AD-116 accordingly in retail-divergence-register.md. Retire AP-19 in the same commit because its only implementation, the deleted builder's 1 cm epsilon, no longer exists; do not reuse its id. AP-238–AP-243 remain active. Remove stale current claims from docs/launch-options.md; do not erase old research or the superseded ledger history.

33.5 C4 — architecture guards

Add one focused compiled/source architecture test file with these discriminating guards:

1. the App assembly contains no PortalVisibilityBuilder, PortalVisibilityFrame, ExteriorPortalSeed, IndoorDrawPlan, CellDrawEntry, or ViewconeCuller type;
2. only RetailFrameWalk declares WalkPView fields and only RetailPViewRenderer declares a RetailFrameWalk field; the renderer owns exactly one such field;
3. the frame-time walk/renderer/submitter owner types have no raw DatCollection/IDatReaderWriter field, property, parameter, or return dependency. Construction-time DAT adapters such as WalkBuildingFactory remain outside this frame-time list;
4. no consumer reconstructs a second portal visibility result: production source has no banned old type/symbol and no call/new edge to a second graph builder;
5. WbDrawDispatcher.OrderedStream.cs contains no Sort, OrderBy, or equivalent cross-stream reorder; existing merge-run tests continue to prove adjacent-only, order-preserving batching across semantic boundaries; and
6. production source contains none of the deleted probe symbols or environment names listed in §33.3, while the retained walk transcript symbol is still present and its flag-off and transcript-conformance tests still run.

The guards may read repository source where absence itself is the contract, but paths are resolved from the solution root and comparisons are explicit. Do not use brittle line numbers or broad words such as probe/visibility that would outlaw retained production concepts.

Required mutations, each restored exactly before return:

• restore one deleted old type name: guard 1/4 fails;
• restore ACDREAM_PROBE_FACILITY_STAIRS: guard 6 fails;
• add a second RetailFrameWalk owner field: guard 2 fails;
• add OrderBy to WbDrawDispatcher.OrderedStream.cs: guard 5 fails; and
• add an IDatReaderWriter parameter to a listed frame-time owner: guard 3 fails.

33.6 Scope, gates, return, and reviews

Production edits are limited to the deleted/residual files and direct probe or compile-fallout sites named in §§33.2–33.3. Test edits are limited to deleting old research tests, preserving/adapting the named live tests, simplifying direct probe-constructor fixtures, and adding the architecture guard. Documentation edits are limited to this packet, the plan ledger, docs/launch-options.md, the two architecture documents, the divergence register, and Current memory. No shader, prepared-content, wire, physics, membership, walk-order, material, or queue behavior change is allowed. If a deletion exposes a live dependency outside these bounds, stop and report it.

Return one implementation commit with every documentation/register change in the same commit as the deletion. Required evidence:

• git diff --check and a Release solution build with zero warnings/errors;
• focused architecture, walk transcript, BeginWalkFrame, outside-view, ordered-stream, membership, terrain diagnostics, and directly affected suites;
• official hermetic and canonical InstalledDat lanes, with exact pass/fail/skip identities and SHA manifests;
• source/type absence searches for every deleted family; and
• all five mutation transcripts.

Review is sequential. Lens 1 checks retail/deletion faithfulness, retained walk primitives, AP-19/AD-116/register truth, and absence of a second graph. Lens 2 checks production reachability, hidden-cost removal, architecture-test non-vacuity, order/DAT boundaries, allowed scope, and gate provenance. A failed lens gets one bounded fix contract. Review stops only after pass 10.

After review and campaign landing, the lead runs a fresh Release/focused gate, checks tree/ACE/client state, and performs one graphical smoke route over an outdoor town, Facility stairs, and one interior/portal transition. It must exit gracefully, leave no client, emit no deleted probe prefix, and record exact PNG paths. Visual status remains provisional until the owner inspects it.

34. S5-c5 fix round 1 contract — static owner fields must not evade the final graph guard

Production/gate-honesty review pass 2/10 found one MINOR test-only defect and no production behavior finding. WalkFrameOwners_AreUnique builds its shared field flags from BindingFlags.Instance but omits BindingFlags.Static. Consequently, a static WalkPView field outside RetailFrameWalk, or a static RetailFrameWalk field outside RetailPViewRenderer, can create a second owner while the §33.5 guard remains green. The implementation itself contains no such field; this is a non-vacuity hole in the permanent architecture proof.

34.1 Bounded correction

Edit only tests/AcDream.App.Tests/Rendering/Walk/WalkRendererArchitectureGuardTests.cs:

• include both BindingFlags.Instance and BindingFlags.Static in the field scan shared by the WalkPView and RetailFrameWalk owner assertions;
• keep DeclaredOnly, public/non-public coverage, the exact two-PView count, the exact RetailFrameWalk declaring owner, and Assert.Single unchanged; and
• do not replace the compiled reflection proof with a source-word count or a narrower naming convention.

No production, renderer, walk, queue, material, shader, prepared-content, membership, launch-option, architecture, or register edit is authorized. This test-only correction creates no retail deviation, so it creates no register row.

34.2 Discriminating proof and return

Run both mutations separately and restore each exactly:

1. add a static WalkPView field to any App type other than RetailFrameWalk; WalkFrameOwners_AreUnique must first fail on the wrong declaring owner and/or count; and
2. add a static RetailFrameWalk field to any App type other than RetailPViewRenderer; the same test must first fail on the second owner.

Return one fix commit with clean git diff --check, a zero-warning Release solution build, the architecture guard plus the complete §33 focused set, and fresh clean-tip hermetic and canonical InstalledDat evidence (the latter with ACDREAM_RUN_INSTALLED_DAT_TESTS=1 and the explicit installed-DAT directory). The InstalledDat nonpassing identities must remain the accepted nine failures plus one look-in skip. Production/gate-honesty review then resumes as pass 3/10; the already-passed retail/deletion lens is not repeated because this round changes no production or retail claim.

35. S5-c5 landing, review closeout, and lead graphical smoke — 2026-09-05

CLOSED AND LANDED; GRAPHICAL PASS IS PROVISIONAL PENDING OWNER INSPECTION. The reviewed implementation stack in s5-c5-openai-impl is 36bea55f337c010683263a2eb315514c47121e9f -> 2886091aa92f62ceec8c16d4fd5b2dd6056eb5b8 -> 158656f0df3edd5e28ac3a9ed743f4c435e321f9. It maps to the campaign stack bf53e2ad6 -> e625dc4e6 -> 1b7ee4e58 on top of contract b77989c32. The final campaign commit is 1b7ee4e58100b27a55063e0bd462f54c589b1d7e.

The deletion removes the callerless portal-BFS research graph and its tests, the complete Facility-stair instrumentation family, the obsolete renderer probe/output branches and hidden scratch, and the raw-GL diagnostic reader. The live RetailFrameWalk/WalkFrameDriver, BeginWalkFrame, outside-view reassembly, two FIFO lists/router/material/shader paths, typed walk transcript, frame profiler, terrain diagnostics, and UnregisteredRenderMembershipCount remain. Architecture and inventory now state one production graph; AP-19 is retired, AD-116 is amended, and AP-238--AP-243 remain active.

Sequential review closed in three passes. Retail/deletion pass 1/10 returned PASS with no finding after independently rechecking the named functions and the paired binary/PDB identity. Production/gate-honesty pass 2/10 found one MINOR test-only non-vacuity hole: the unique-owner reflection scan omitted static fields. Fix round 1 added BindingFlags.Static. The lead reproduced both required static-owner mutations and their intended first failures, then restored them exactly. Production re-review pass 3/10 returned PASS with no remaining finding; the production source tree was unchanged by the fix.

Exact reviewed-tip evidence is hermetic 16,921 passed / 0 failed / 0 skipped, canonical InstalledDat 368 passed / the accepted nine failures / one accepted look-in skip, and both manifests 30/30. Fresh campaign-tip verification passed Release at 0 warnings / 0 errors, App focused 146/146, and Core focused 8/8. The campaign tree was clean before the graphical gate.

The first smoke attempt is excluded as environment preflight evidence. It opened the default machine-local acdream.pak, rejected recipe 8 against the recipe-10 client, emitted no PNG, exited with the .NET unhandled-exception code, and left no client. Log: logs/selfgate-20260905-051948-s5-c5-landed. No renderer assertion was reached. The lead then ran the repository's validated transactional bake to a new path, leaving the recipe-8 package untouched. Recipe-10 output: 2,237,865 keys, zero failures, 597,482,264 bytes, SHA-256 4E0FA6C589ECE12E13099A56385077964961EC52F888BC9161C6F5D34829B59B.

The one corrected smoke run began with ACE listening on UDP 9000, zero client processes, a clean campaign tree, and the already-green Release binary. It ran tools/overhaul-selfgate/route.txt once against the new package, exited 0, confirmed graceful logout, and left zero client processes. The log contains no crash, invariant failure, device-loss/screenshot failure, or deleted probe prefix. Exact evidence root: logs/selfgate-20260905-052130-s5-c5-landed-v10. PNGs:

• artifacts/screenshots/00-login.png;
• artifacts/screenshots/01-cathedral-stairs.png;
• artifacts/screenshots/02-facility-stairs.png;
• artifacts/screenshots/03-holtburg-house.png; and
• artifacts/screenshots/04-holtburg-terrain-leak.png.

Lead original-resolution inspection and comparison with logs/selfgate-20260905-020703-s5c4-onepass-detail found the same intact cathedral, Facility, house-portal, and outdoor-terrain geometry; only authored time/weather changed. Verdict: PASS, provisional until the owner inspects the PNGs. S5-c5 is closed. S5 automated/performance closeout and G4 remain; never merge to main before G4.

36. S5 closeout C1 contract — offline correctness and evidence map

Base is clean campaign commit 29c05e48c8379678603efb8715f86ede04c775ea. This is an evidence-only closeout chunk: it changes no production, test, fixture, register, shader, prepared package, or gate script. One OpenAI implementer runs the bounded matrix below and returns artifacts plus an exact coverage map; the lead independently verifies every count, nonpassing identity, manifest, and claimed fixture. The lead alone writes and commits the result.

1. Run tools/run-release-gate.ps1 once to a new, absent artifact directory with the plan's literal filter Lane!=InstalledDat&Lane!=Linux&Lane!=Manual&Lane!=Timing&Lane!=Live&Lane!=PreparedPackage. Do not silently substitute the narrower ordinary release-gate default. A nonpassing test is evidence to classify, not permission to retry or edit.
2. Run one canonical InstalledDat artifact with ACDREAM_RUN_INSTALLED_DAT_TESTS=1, explicit installed DAT directory, and Lane=InstalledDat&Purpose!=Diagnostic. Preserve the accepted nine failures plus one look-in skip only if the exact identities match c5; any new or missing identity is a finding.
3. Produce an exact test-to-requirement map for the focused App, Content, Core, Runtime, and Launcher coverage; all committed OH walk/parts/ alpha-depth fixtures; BeginWalkFrame/outside-view reassembly; per-cell geometry and membership; FIFO/barrier/order; material; building degrade; visibility consumers; reset/abort/dispose; architecture guards; and real warmed allocation pins. Reuse already-executed tests from items 1--2 where their TRX identity proves coverage; run only a genuinely missing focused class once.
4. Identify the existing executable witness, if any, for the plan's “two deterministic geometry/membership runs with equal hashes” requirement. Run it exactly twice from the same clean commit and compare its declared product hash. A hash of source files, TRX files, logs, or the prepared pak is not this witness. If no current gate emits a canonical runtime geometry/membership product hash, stop this item and report that contract gap; do not invent a surrogate or modify code without a new lead contract.
5. Verify git diff --check, exact HEAD/branch, zero tracked or untracked source change, and every artifact SHA manifest. No graphical client launch, connected route, package rebake, commit, cleanup, retry, or mutation is authorized in C1.

Return the exact commands, artifact paths, pass/fail/skip counts and identities, manifest verification, fixture list and the requirement map. The retail/transcript lens reviews fixture completeness and whether the purported deterministic witness proves the retail products. Only after that PASS does the production/gate-honesty lens review filters, provenance, manifests, negative results, and absence of retries. Any missing witness becomes a separately contracted narrow harness chunk; otherwise C1 closes and C2 runs the connected lifecycle/performance program.

37. S5 closeout C1 result and C1a narrow harness contract — 2026-09-05

37.1 C1 result: the offline matrix is green and two evidence gaps are real

Section 36's code base was 29c05e48c8379678603efb8715f86ede04c775ea; the executed clean contract tip was aa51cb88b00c843f87aa48047f9f3ce939755909. One OpenAI implementer ran each official gate exactly once, with no retry, edit, client launch, package bake, surrogate witness, or cleanup:

& tools/run-release-gate.ps1 `
  -ArtifactsDirectory artifacts/s5-closeout-c1-hermetic-aa51cb88b `
  -TestFilter 'Lane!=InstalledDat&Lane!=Linux&Lane!=Manual&Lane!=Timing&Lane!=Live&Lane!=PreparedPackage'

$env:ACDREAM_RUN_INSTALLED_DAT_TESTS='1'
$env:ACDREAM_DAT_DIR='C:\Users\erikn\Documents\Asheron''s Call'
& tools/run-release-gate.ps1 `
  -ArtifactsDirectory artifacts/s5-closeout-c1-installeddat-aa51cb88b `
  -SkipRestore -SkipBuild `
  -TestFilter 'Lane=InstalledDat&Purpose!=Diagnostic'

The two temporary environment variables were removed after the second gate.

• literal hermetic artifact artifacts/s5-closeout-c1-hermetic-aa51cb88b: Release build 0 warnings / 0 errors, 16,942 passed / 0 failed / 0 skipped, manifest 32/32;
• canonical InstalledDat artifact artifacts/s5-closeout-c1-installeddat-aa51cb88b: 368 passed / the accepted nine failures / one accepted look-in skip, manifest 30/30.

The nonpassing identities match S5-c5 exactly. The skip is WalkLookInGateSweepTests.Sweep_the_lookin_gate_decodes_against_the_street_fixture. The failures are WalkTraceConformanceTests.AlphaFlushCounts_CathedralArrival_MatchesRetailFrame2, WalkTraceConformanceTests.AlphaFlushCounts_CathedralLeak_MatchesRetailFrame2, WalkTraceConformanceTests.AlphaFlushCounts_CathedralStairArch_MatchesRetailFrame2, WalkTraceConformanceTests.AlphaFlushCounts_FoundryDeep_MatchesRetailFrame2, WalkTraceConformanceTests.AlphaFlushCounts_HoltburgDoorwayStill_MatchesRetailFrame2, WalkTraceConformanceTests.AlphaFlushCounts_TerraceEdge_MatchesRetailFrame2, WalkTraceConformanceTests.Oh_doorway_still_first_frame_diff, LayoutImporterInvisibleSweepTests.EveryAuthoredInvisibleWidget_StartsHiddenAcrossAllLayouts, and LayoutImporterMediaBearingChildSweepTests.MainGameUiAndChatInput_MediaBearingChildrenNowBuildAsRealWidgets. The two summary JSON files identify the exact HEAD/branch, report WorktreeDirty=false, and their SHA manifests independently re-verify.

The TRX map covers the focused App, Content, Core, Runtime, and Launcher requirements, including BeginWalkFrame, outside-view reassembly, retail membership, FIFO/barrier/order, material, degrade, visibility consumers, reset/abort/dispose, architecture guards, and the real warmed-allocation pins. It also proved two missing witnesses rather than hiding them:

1. cathedral-stair-arch.walk.log is the only committed OH walk transcript with no test consumer. Its .alphadepth sibling is consumed, but that is a different product and cannot stand in for the walk transcript.
2. No executable gate hashes a canonical runtime geometry product together with the committed retail membership product. The existing installed-DAT CellStruct hash covers counts/metadata rather than vertex/index values, transforms, or membership; the scene digest is synthetic; and the existing retail comparator uses test-assembled terrain and copied publication dispatch. Equal source, package, log, or TRX hashes are not substitutes.

These are test-harness gaps, not evidence of a renderer behavior defect. C1 therefore closes as an honest offline inventory and C1a below is the required narrow correction before connected/performance C2.

37.2 C1a scope: consume the sixth walk fixture

Edit only the following walk tests for this half:

• add (OhRoot, "cathedral-stair-arch.walk") to WalkOracleTraceTests.AllFixtures, so the ordinary complete-frame parser contract consumes the checked-in walk log; and
• add a dedicated installed-DAT conformance test shaped like Oh_foundry_deep_reproduces_every_complete_frame_exactly in WalkTraceConformanceTests. Replay every complete marked stair-arch frame and compare the complete eight-kind Signature8 exactly. A row in Still_fixture_first_frame_reproduces_exactly is insufficient because that theory checks only frames[1]. Do not compare only event counts or borrow the alpha-depth transcript.

The new row must load the existing committed file. Do not recapture, rewrite, normalize, or manufacture a fixture. If the production replay cannot reproduce the row under the same adapter used by the other OH rows, return the exact first divergence as a finding; do not weaken the signature.

37.3 C1a scope: canonical runtime geometry/membership product witness

Add one InstalledDat App test class, plus at most one test-only data adapter if the class cannot remain readable. Production source, fixtures, package files, gate scripts, shaders, and register documents are out of scope. Each of two independent runs inside the test must open a fresh installed DatCollection and construct fresh extraction, physics, and membership owners. Use canonical cathedral landblock 0xF418FFFF with origin (0xF4,0x18), real region height data, complete EnvCells, and independent interior statics.

Build through the real LandblockBuildFactory.Build. A test-only IPreparedCollisionSource may translate installed GfxObj, Setup, EnvCell, and CellStruct records through the existing FlatCollisionAssetBuilder flattening methods, but it may not compute membership. Read actual ordered EnvCell shell geometry through DatPreparedAssetSource.Read with the same PreparedAssetRequest.EnvCellGeometry product consumed by ObjectMeshManager; read every referenced Setup/GfxObj product through the same production extractor, including ordered Setup part placements. Publish membership through the real no-window production sequence on LandblockPhysicsContentBuilder: BuildTerrainSurface, PublishPreparedCells, CacheBuildings, CachePreparedObjects, PhysicsEngine.AddLandblock, then PublishStaticCollision. The test must not copy this branch dispatch or call ShadowObjectRegistry.Register* to construct the expected membership.

Serialize a version-tagged binary product with explicit lengths and raw IEEE float bits, then SHA-256 it. The product must include:

• geometry identities; every emitted vertex position, normal, and UV; every index; semantic subset order and SourceSurfaceIndex, RawSurfaceType, RetailSurfaceMask, and IsCellShell; ordered Setup part ids and full transforms; and the actual placed cell/static transforms;
• for every published owner, its RetailCellArrayRoute, its ordered CELLARRAY from TryGetRetailCellArray, and every ordered per-cell RetailPartEntry from GetRetailPartEntriesInCell: EntityId, PartIndex, GfxObjId, CellId, and ClipPlanesRequired.

Canonicalize only outer maps whose production semantics are unordered. CELLARRAY order, Setup-part order, subset order, index order, publication order, and per-cell entry order remain exact. Assert real shell geometry for cell 0xF4180104 with nonzero vertices/subsets/indices. Assert the production-built cathedral ramp Setup 0x020009A2 exists and that its seven parts produce 21 entries across the exact ordered CELLARRAY [0xF4180112, 0xF4180113, 0xF4180009], all with ClipPlanesRequired=true. Assert at least one multi-cell product and one BoundingBox route. Return the per-domain counts plus geometry, membership, and combined hashes.

Two fresh in-test runs must produce the same three hashes and exact counts. The focused test must also be run in two fresh test processes at the same clean commit, and its labeled digest/count output must agree. Equality only proves determinism, so pin the clean installed-DAT combined hash and the exact cathedral semantic facts above as correctness witnesses. If installed DAT identity differs from the campaign's accepted corpus, fail explicitly rather than refreshing the golden silently.

The retail meaning remains the already-landed S2 contract: whole-part-array CELLARRAY calculation and ordered part insertion, anchored by named retail CPhysicsObj::AddPartToShadowCells (0x00510e00), CPhysicsObj::add_shadows_to_cells (0x00514ae0), CObjCell::find_cell_list (0x0052b4e0), and CELLARRAY::add_cell (0x006b4ff0). C1a changes no AC algorithm.

37.4 Required discrimination, gates, and return

Before committing, run and restore these mutations one at a time, recording the exact first failing assertion:

1. change one serialized vertex float bit while preserving counts;
2. swap two real subset indices while preserving counts;
3. reverse two real ordered CELLARRAY cells or Setup parts before publication;
4. flip the cathedral ramp's real ClipPlanesRequired value; and
5. redirect the new stair-arch row to a nonexistent fixture.

Each product mutation must be reached by the canonical corpus and must fail the pinned product proof, not merely a self-comparison. Restore every file byte-for-byte and prove git diff --check clean. Return one test-only commit, the exact changed-file list, all mutation transcripts, a zero-warning Release solution build, the new fixture-consumer and product-hash focused tests, then fresh official literal hermetic and canonical InstalledDat artifacts with verified manifests and exact nonpassing identities. Any production edit, fixture edit, hash-field omission, copied membership construction, new nonpassing identity, or inability to form a non-vacuous real product stops the chunk and returns a finding. No graphical client is authorized for C1a.

Review is sequential. Retail/transcript pass 1 checks the exact committed fixture, Signature8, named-retail product/order meaning, field completeness, and golden discrimination. Production/gate-honesty pass 2 checks fresh-owner independence, real factory/mesh/publication reachability, absence of copied registration dispatch, canonicalization boundaries, InstalledDat lane provenance, manifest truth, and allowed scope. A failed lens gets one bounded fix contract; review stops only after pass 10. After C1a lands, C2 runs the connected lifecycle/performance closeout and G4 follows.

38. S5 closeout C1a stopped result — one observer defect and one unrecoverable static fact

38.1 The contracted exact transcript gate stopped before landing

The OpenAI implementer worked in the clean scratch worktree s5-closeout-harness at contract base 4237a6b2b3d4e51ec0948257e2ff6f951b08c97c. The ordinary parser consumer for cathedral-stair-arch.walk.log passed, and a draft of the independent geometry/membership digest formed a real product, but the required every-frame Signature8 comparison failed. Section 37.4 says that inability to reproduce the committed fixture stops the whole chunk. The implementer therefore made no commit, ran no official gate or mutation, changed no production source or fixture, launched no client, and restored the scratch worktree clean at the contract base. The draft product hash is not evidence and is deliberately not landed or quoted as a golden.

All four complete marked frames have the same exact alignment:

• retail tokens: 2,158; replay tokens: 2,158; LCS: 2,156;
• tokens 0 through 374 agree;
• replay inserts LC:e2290001 and SC:e2290001 at replay positions 375–376;
• retail contains a second consecutive EC:f4180106 at retail position 2,126 and another at 2,141; replay emits one at each site.

Per-frame WalkLandscapeDatBuilder.SetViewer, one discarded same-pose warmup, and both together produce the identical edit script in every frame. This is not stale viewer state, a first-frame-only effect, or a broad sequence shift.

38.2 The two missing EC tokens are a test-recorder defect, not renderer behavior

Retail PView::DrawCells (0x005A4840) reads a flood cell's live view count at 0x005A4AA9 and loops setup_view plus RenderDeviceD3D::DrawEnvCell at 0x005A4AB1–0x005A4ACC; the paired bytes contain the 47 4B 75 E8 loop. Its object/OC pass remains once per cell at 0x005A4ADE–0x005A4B1A.

The InstalledDat test recorder instead calls WalkTraceReplayContext.AppendFloodTurns, which emits one EC per cell. Its own class comment already names this known limit and says S5 must remove it. Production is already correct: WalkFrameDriver.EmitFloodTurns captures each cell's route and prints one EC per SliceCount, then keeps one object turn per cell. The eventual test-only correction is bounded: while the callback still owns the live flood state, read each cell's TopView.ViewCount, emit that many EC tokens in reverse-cell order, then one OC per cell. It must not change production or weaken Signature8.

38.3 The e229 cause cannot be recovered statically

The named retail decomp and paired executable prove two distinct no-LC causes inside LScape::draw_check_blocks (0x00505F80): the land_blocks slot is null at 0x00506184, or a resident block's Render::block_check call at 0x005061DF returns OUTSIDE. The paired bytes at the latter site are E8 6C 7A 04 00 (call 0x0054DC50) followed by 85 C0 74 0E. WalkLandscape.CheckBlocks has the same control-flow shape.

The replay test builder eagerly installs every extant DAT block in its 51 × 51 grid. Production WalkLandscapeAssembler deliberately leaves unstreamed slots null. The walk transcript records only submitted LC/SC turns; it does not record retail residency or rejected block checks. Therefore absence of LC:e2290001 cannot distinguish the two retail causes from static evidence. The block is a one-cell coarse ring-18 block, so AD-118's measured D3D/x87 edge-plane boundary is the strongest hypothesis, but applying that row without the missing residency/verdict fact would be speculation. No production visibility change, KnownFailure, fixture normalization, or new divergence row is authorized.

The retail lens reverified the paired binary: executable SHA-256 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1, CodeView GUID {9E847E2F-777C-4BD9-886C-22256BB87F32}, age 1.

38.4 Exact owner capture that unblocks C1a

Issue #472 owns the stop. Reuse tools/walk-oracle/oh/oh-capture-blockset.cdb.template and oh-capture-blockcheck.cdb.template, changing the filtered DID to 0xE229FFFF, at the exact first complete-frame pose from the committed fixture:

P f4180114 421e545d 4187e406 4336c9e1 3f800000 b71e18af 30947ee4 348114b1

Keep the output as cathedral-stair-arch-e229.blockset.log and cathedral-stair-arch-e229.blockcheck.log beside the other OH captures. The blockset must prove whether retail has a resident e229 slot. If it is resident, the filtered capture must record every active-view interval vector, the z slab, and each block_check verdict. A null slot contracts a replay-residency harness correction; resident plus OUTSIDE contracts the test-recorder correction and classifies the remaining difference under AD-118. Any different result gets a new bounded contract from the observed facts.

This is the campaign's explicit “retail fact cannot be recovered statically” stop condition. C1a, connected/performance C2, and G4 do not proceed until the capture exists. Nothing has merged to main.

39. Owner capture and C1b projection diagnostic contract — 2026-09-05

39.1 New evidence removes the capture blocker, but does not yet close #472

The owner returned to the requested stairwell and authorized capture. Preflight: ACE UDP 9000/PID 13340, paired retail PID 29732, no AcDream.App or existing cdb. The live executable SHA and CodeView GUID/age match §38.3. The lead captured one complete frame with full 2,601-slot residency, all seven e229 block-check input/return sets, active screen vertices and edge planes, CY, projection globals, and the full eight-kind walk transcript. Capture: oh-capture/cathedral-stair-arch-e229.combined-r1.log, SHA-256 9E493F8ACE8CA2E939333BB8B755C218F8115658EE423F5439FCA45C3FBBA9CB. The matching .cdb script is preserved beside it. The initial combined attempt used incorrect newline escaping and is retained in the working artifact directory, excluded from conformance evidence. Every attach exited 0 through bc *, log close, and qd; no debugger remained, and the owner's retail client was left running.

The valid frame starts at: P f4180114 421e02f8 4188aa39 4337407b 3f7d4959 be14b29f 00000000 00000000. It is the same stairwell with seven exit views, but is NOT the historical fixture's exact pose. Retail slot 399 contains e229ffff, side 1, z slab bits bf800000..43890000 (-1..274). All seven block checks return OUTSIDE; no e229 LC or SC occurs. This proves residency plus rejection for this captured pose, not the cause of the old fixture's disagreement.

Marker timing matters: RenderNormalMode's entry breakpoint prints the prior Render::viewer_pos, before update_viewpoint installs this frame's viewer. All seven r1 block checks carry y bits 4188aa3a, matching the terminating F2 P rather than F1's 4188aa39. Pair F1 events with F2 pose for the actual capture comparison. The older stair fixture must also be checked with events(N) and pose(N+1); the final marker pose remains present in the raw log even though the ordinary parser discards the unfinished final frame. Section 38.4's use of F1 P as the exact original event pose was therefore too strong. Do not alter the original fixture to hide this association.

A further one-frame oh-capture/cathedral-stair-arch-e229.projection-mode.log reveals the important missing fact: newmethod @0081efe8 == 1. Named Render::copy_view @0054dfc0 branches at 0054e4e5 and calls PrimD3DRender::ScreenToViewTransform @0059aa40 at 0054e50f in that mode. This reads actual viewport dimensions, ViewToClipMatrix, and inverse WorldToViewMatrix. The existing test WalkTraceReplayContext.RetailRayCaster instead implements the other, legacy branch. Its forward projection puts the center at (512,360), while its rays put it at (511.5,359.5). Its claim that the branches are equal is false. Production already uses matrix-based rays; no production behavior change is authorized.

Captured viewport is 1024x720, aspect bits 3fb60b61, FOV bits 3f98104b, near/far bits 3dcccccd/457a0000. Row-major LH ViewToClipMatrix words:

3f854304 00000000 00000000 00000000
00000000 3fbd8723 00000000 00000000
00000000 00000000 3f8000d2 3f800000
00000000 00000000 bdccce1d 00000000

The six legacy projection globals are doubles; r1 captures all 64 bits and confirms the previous nominal values. Treat neither those constants nor AD-118's old x87 explanation as proof of the active path. AD-118 and #458's attribution need re-evaluation after the experiment below.

39.2 C1b — bounded diagnostic implementation

One OpenAI implementer works in s5-closeout-harness, fast-forwarded to this contract commit. Allowed test edits: WalkTraceReplay.cs and at most one new WalkProjectionDiagnosticTests.cs. No production, existing fixture, existing conformance expectation, KnownFailure, or default constructor behavior changes. No graphical launch, package bake, broad gate, or commit by the implementer.

Add an explicit opt-in test-context construction path using the captured D3D projection and named ScreenToViewTransform rule. Derive a coherent LH world-to-view matrix from each supplied pose (right, up, forward rows/columns as confirmed against the captured matrix); invert it for rays as retail does. Use the same projection for forward screen mapping. Do not subtract a half-pixel from production TransformToScreen or tune an epsilon. The baseline constructor remains byte-for-byte behaviorally unchanged for comparison.

Required diagnostics (tag InstalledDat/Purpose=Diagnostic and retain output):

1. At center, corners, and interior points, screen -> ray -> screen must return the original coordinate within a justified float-rounding bound. Restoring the legacy ray formula must fail at center by about half a pixel.
2. Drive real RetailFrameWalk and the existing DAT builder for the new capture and all four complete historical stair-arch frames under both baseline and matrix-corrected test contexts. Use the actual captured projection and label its application to older frames as a same-configuration hypothesis. Compare the prior same-frame pose association and the retail-correct next-marker association separately; include the final marker's raw pose without manufacturing a fifth complete event frame.
3. At OnLandscapeViews, read actual live root views and print screen points, raw edge planes, CY, e229 slot/slab, four corner intervals and per-view BlockCheck results. Compare that diagnostic admission with real WalkLandscape.InView, CellInView, LC and SC after the frame.
4. For the experimental transcript observer only, read TopView.ViewCount while callbacks own the live flood; emit EC per view and OC once per cell in the normal reverse-cell order. Preserve the current shared Recorder unchanged. Compare complete Signature8 sequences and report full aligned mismatches, never equal counts as a substitute.
5. Repeat the exact transcript comparison for existing OH fixtures, especially Holtburg doorway (#458), to distinguish a real correction from trading one boundary discrepancy for another. This is diagnostic evidence, not an automatic change to accepted failure identities.

Build only the affected Release test project and run these focused diagnostics. Record commands, exact input/output and limitations in the artifact directory. A result that does not resolve the old fixture must be reported honestly; do not widen into renderer math or silently accept a new failure. The lead writes the subsequent correction contract from the measured result; then the normal sequential retail and production reviews apply. C1a's product hash and test closure, C2, and G4 remain; no merge to main.

40. C1b result and C1c permanent replay correction contract — 2026-09-05

40.1 Measured result: both purported precision boundaries are harness defects

The frozen §39 diagnostic uses only the two authorized test files in s5-closeout-harness, based on 3f5ca9ff4; it is not a production change or an official closeout gate. Exact commands, limitations and artifact hashes: s5-c1b-projection-diagnostic.txt. Final artifact: s5-closeout-harness/artifacts/s5-c1b-projection-3f5ca9ff4/walk-diagnostic-final.trx, SHA-256 8E14F9BFFCAF57047D0990185FAB393170CEC962024C035C01422C4DC266B00E.

The lead inspected the observer, literal Signature8 comparison, LCS alignment, raw captured/candidate intervals, and final admission; independently counted all 100 rows from the complete TRX, and re-hashed both production DLL copies. The final focused run passed 2/2. The first diagnostic failure is preserved: its outdoor-camera setup wrongly required a cell in the interior dictionary; the nullable outdoor-camera repair changed only the diagnostic.

Comparison	Exact
Matrix projection + correct next-marker pose	25/25
Matrix projection across both pose associations	49/50
Legacy projection across both pose associations	26/50

The 25 correct-pose rows are all four complete frames of each of the six OH walk fixtures, plus the new complete capture. Each is a full ordered eight-kind equality, not count equality. The historical stair gives 2158/2158 for all four frames, with resident e229 now Outside at the actual walk and no LC/SC. The doorway gives 1185/1185 for all four; its frame 1 still differs if deliberately paired with the stale same-marker pose. The cathedral-leak's missing fe180001 pair also disappears. The new capture gives 2367/2367 and reproduces all seven e229 OUTSIDE decisions, though its tokens alone happen to match both projection variants.

Corrected screen/ray/screen maximum error is 0.000110485424 pixel; the legacy center maps to (512.5008,360.5003). The new captured-matrix planes retain ordinary float-rounding differences from retail; no claim of bit-identical D3D/x87 math is made. Applying this captured projection to old fixtures remains a labeled same-configuration hypothesis, now supported by their exact transcripts. It does not justify altering a different capture's configuration.

These results disprove AD-118's x87-only explanation for #458 and the proposed application of that explanation to #472. Do not preserve those failures by changing production, relaxing visibility, or accepting a new divergence. Permanent correction and review are still owed before closing the issues.

Preflight correction: retail PID 29732 remained running throughout. A mixed PowerShell table hid its fields after the UDP row; the lead's temporary “no client” report was wrong. Serialize endpoint/process records independently or as explicit JSON. No client was launched or closed. Only the test assembly was rebuilt with --no-dependencies (and explicitly /p:BuildProjectReferences=false for the final build); the referenced AcDream.App.dll copies remained SHA-256 90BB90521F8F46B3887234F9D560E33616F108492693AA7597AEE0850E87FA76. ACE remains UDP 9000/PID 13340. Do not build production or launch another graphical client beside the owner's running client.

40.2 C1c scope — permanent test-only correction

One OpenAI implementer uses the existing scratch, fast-forwarding this documentation contract without discarding the frozen diagnostic edits. Preserve §39 artifacts. No production, shader, package, captured-log, gate script, or geometry-witness change is allowed. This chunk closes the walk half of §37; its geometry/membership witness remains the next bounded chunk.

Allowed code files: WalkTraceReplay.cs, WalkOracleTrace.cs, WalkOracleTraceTests.cs, WalkTraceConformanceTests.cs and its existing partial siblings solely for necessary recorder/pose call-site changes. The diagnostic class may be removed or reduced to a narrowly useful diagnostic; at most one focused hermetic projection-test class may be added. All are under tests/AcDream.App.Tests/Rendering/Walk/. Allowed documentation: this packet's result section, docs/ISSUES.md #458/#472, and AD-118 in docs/architecture/retail-divergence-register.md. Lead owns the ledger/Current.

1. Make the proven coherent matrix projection/ray pair the ordinary replay path for this captured 1024x720 configuration. Cite named Render::copy_view @0054dfc0 and ScreenToViewTransform @0059aa40 and the captured newmethod/matrix evidence. Keep forward and inverse transforms coherent; do not subtract a half pixel, adjust epsilon, or claim that the legacy formula is equivalent. A legacy implementation may remain ONLY as an explicit negative test/diagnostic, never as a production fallback. Verify the configured matrix words against the captured fixture, not only a second copy of hardcoded constants.

2. Preserve the literal marker pose and event stream in the parser. Expose an explicit rendered/replay pose from the NEXT frame marker's P record, including the final raw marker; do not manufacture its incomplete frame. No pose selection may try both choices and accept whichever happens to pass. Migrate pose-stamped conformance consumers to the correct association; unposed fixture parsing remains supported. Add a synthetic moving-pose pin proving final-marker association and no silent same-marker fallback.

3. Correct the shared Recorder/AppendFloodTurns to read each real cell's live TopView.ViewCount at the callback that still owns the flood. Emit EC per live view in reverse-cell order, then OC once per cell in reverse-cell order. Borrow the actual cell map; no production event or driver changes. Retail anchors are PView::DrawCells @005a4ab1–005a4acc and @005a4ade–005a4b1a. Keep the oracle's EC/OC literal, never derived from DC.

4. Add the sixth stair walk to AllFixtures and permanent exact Signature8 equality over ALL four complete frames of ALL six OH walk logs, plus the new one-frame capture. Reuse the ordinary shared context/recorder, not a shadow test-only implementation with different semantics. Pin stair multi-view multiplicity and the absence of LC/SC:e2290001. Remove #458's KnownFailure trait only when its ordinary exact row passes. Existing FW0 comparisons and unrelated accepted failure identities must not be weakened or silently removed; a new mismatch is a finding.

5. Correct obsolete source/test comments and the #458/#472/AD-118 current claims. Preserve the history as explicitly superseded, not current truth. Retire AD-118 for the disproven fixture failure once the permanent proof passes; this does not promise universal bit-identical floating-point projection. No new production divergence is introduced.

40.3 Discrimination, review and gates

Permanent hermetic tests cover center/corners/interior round trips with a justified <=0.001 pixel bound for the declared finite inputs, the captured matrix binding, and explicit next-marker parsing. InstalledDat proof compares every literal event in the 25 complete frames using the real shared recorder.

Apply and restore separately, with the first exact failure recorded:

• restore the legacy ray formula while retaining matrix forward projection;
• restore one EC per cell (the stair multi-view row must fail);
• use the same-marker pose (the moving parser pin and doorway frame 1 must fail);
• alter a captured matrix coefficient while leaving the binding fixture intact;
• redirect the sixth fixture consumer to a nonexistent path.

Preserve every original capture byte and unrelated test expectation. Return the full scoped diff, test-assembly-only Release result, focused hermetic and InstalledDat conformance results, mutation first failures and restoration proof, exact source/artifact hashes, and git diff --check. While retail is running, only --no-dependencies --no-restore /p:BuildProjectReferences=false test builds are permitted, with referenced production DLL hashes checked before/after; no graphical launch or production build. The implementer returns uncommitted work; the lead commits.

Sequential retail/transcript review first verifies branch, projection, frame-marker timing, live EC multiplicity, unchanged literal fixtures and full-sequence proof against named retail and paired bytes. After PASS, production/gate-honesty review checks default-path use, parser behavior, mutations, scope, provenance and unrelated test preservation. A finding gets a bounded fix and narrow re-review; the owner's ceiling is ten review passes.

After both reviews pass, the lead commits, runs the ordinary Release and canonical conformance closure when no client is running, verifies the same nonpassing identities except the intentionally retired #458 row, and keeps the ledger current. Geometry/membership witness, final full-lane evidence, C2 and G4 remain. No merge to main.

41. Owner visual gate FAIL — exterior building sections missing (#473)

41.1 Observed result and exact session

On 2026-09-05 the owner authorized a manual graphical gate. Fresh explicit JSON preflight found ACE UDP9000/PID13340 and no retail, AcDream or debugger. A complete Release solution build at clean02219318a finished exit0, 0W/0E. One client PID18836 launched at05:22:31Z using the verified recipe10 package acdream-v10-s5-c5.pak, SHA256 4E0FA6C589ECE12E13099A56385077964961EC52F888BC9161C6F5D34829B59B. App.dll SHA256: 0EE6E74174C1E33168EA17A1DF2B592A996F3D77009F0D5A35A451E9A21DDB26. Build, logs and launch provenance: logs/owner-gate-20260905-02219318a/. There is no automated movement or shutdown script.

OWNER FAIL: exterior buildings in Holtburg and cathedral are broken; Facility Hub interiors seem correct. Original owner PNG (unaltered copy): owner-gate-20260905-holtburg-fail.png. It visibly contains incomplete roof/wall sections. World-reveal logs report completed ready/visible worlds at Holtburg, cathedral and Facility, but that is readiness evidence only. Likewise the exact walk-event replay does not prove mesh/subset completeness. No PASS or G4 acceptance is inferred. The renderer must be repaired and the owner must re-gate; no merge to main.

41.2 Bounded read-only diagnosis, before a repair contract

Freeze the uncommitted §40 C1c return in s5-closeout-harness (9 test/doc files; manifest artifacts/s5-c1c-02219318a/README.txt); do not discard or mix the renderer defect into it. C1c reviews/landing and C1 geometry/C2 closeout wait behind this owner failure.

The lead and at most two OpenAI contributors may inspect current source, history, existing tests/captures/logs, installed DATs/package and the named retail decomp plus paired binary. Trace the actual exterior-building path: DAT/Setup/GfxObj geometry and source-part order -> prepared records -> live shell/degrade choice -> classification/subset/transform/index ranges -> ordered command and shader state. Compare it with the working EnvCell path. Distinguish missing construction from admission, part/degrade selection, batch index/range errors and depth/cull/material state. Verify every claimed retail rule in named source and paired bytes. A hypothesis is not a finding until an exact reachable code/data witness supports it.

No source/test mutation, production build, package bake, graphical launch, debugger attach or user-client input/closure is authorized by this diagnostic step. Read-only lightweight inspection continues beside owner PID18836; do not run a heavy corpus/performance gate during the user's inspection. Return the concrete first divergence and smallest discriminating test/reproduction needed. Lead then writes/commits the bounded repair contract, one OpenAI implementer repairs it, sequential retail and production lenses review, and the lead verifies/commits/re-gates after graceful client closure. Any genuine unrecoverable static retail fact is reported rather than guessed. Owner's ten-review ceiling remains; documentation-only corrections are direct.

42. #473 repair contract — solid detail alpha must not become sample coverage

42.1 First reachable defect and lead verification

Diagnosis at ec8edb157 found a concrete pipeline error introduced by S5-c4's one-pass detail conversion. Both current fragment families emit retail's X = a * qA * qA through the shared detail include. Wb's detail-active PipelineForMaterial nevertheless returns the quality-selected opaque/A2C pipeline for RetailSetSurfaceBlend.Opaque. Both the actual walk-ordered caller and classic grouped opaque caller reach it. EnvCell's opaque pipeline already has A2C disabled. VulkanGpuPipeline enables hardware A2C exactly when the descriptor requests it and SampleCount > 1.

The owner's exact log records High quality, 4x MSAA, AlphaToCoverage=True, and detail category 1 resolving 05001787 -> 06006D58. The lead independently read all 65,536 installed A8R8G8B8 texels: alpha min24/max46, hence opaque final X is 0.0088581315..0.0325413303. Raw detail bytes SHA256: 925A4E7CE87B8F5582A723BCD5DE4299ADD526DC7DDE7C54D8F1D882ACD175C7. That detail alpha is not solid-surface coverage. Feeding it to A2C creates an unintended coverage reduction; exact per-sample behavior remains the GPU gate's responsibility, not a claim derived from a recording test.

Lead re-read named D3DPolyRender::SetSurface @0059C4D0: detail stages at 0059C51C/52B/53A/549 retain the squared final alpha; ordinary opaque selects ONE/ZERO, no alpha blend or alpha test (0059C6E9..0059C6F9), with the existing depth write. This is not permission to replace the fragment alpha by 1 or change the blend arithmetic. Direct PE re-hashing against the same paired 006FFEADC5D679C871497112A5BD1F87714D0E273E2166BAE5052DDE369297B1 executable reproduced every relevant section-22 range: SetSurface stages229 bytes 090E24BE542E9DA4F77B547D091F5C2E676109495919BEA70027AD2B89E11426; material state417 bytes 1F077DA1BB09FBAC0EAF7522E125C716AAF499DFA8763DD3DDF29CCC6A76C382; RenderMeshSubset single-pass224 bytes 64A988D4B1611CEEA6DE135FF52CDF30FE1AFDAAFF5E3B76751FFA7FC833CC53. The superseded two-draw port-note pseudocode is not this repair's oracle.

Independent exclusions: all 52 GfxObjs across A9B4/F418 building base and nonzero ladder levels contain zero raw-2 polygons, so UN-4's known legacy side handling is not a demonstrated explanation here. All 32 nonbase surface arrays match their slot-zero array. Fresh canonical extraction and recipe10 package full serialized bytes match for sampled C17/A2B/BC3: 135/143/98 vertices, respectively; SHA256 166091DD4A07B3DA4322D0A663AE81FCBBF3AB3B6A2E7C18A228F3E247AFCC08, AF482C163FBEB5A85A239A8DF8D0190CD37C1787527040BB710B20252D3EB227, B1288B8DC53460B220075864AE6507BA5CE9880FCF1851FBD14828CEE32FDE21. These sampled payload checks are not an all-mesh GPU completeness claim.

42.2 Bounded implementation and permanent discriminator

One OpenAI implementer changes the shared detail-active material selection: RetailSetSurfaceBlend.Opaque => pipelines.Opaque. Preserve pure Clip's opaquePipeline arm (the separately disclosed AP-240), all detail-off quality-selected pipelines, every blended family, fragment C/X, texture sampling, depth/cull, command order/count, geometry, LOD, prepared recipe and alpha queue. No shader edit, rebake, generic culling repair, or C1c change.

Correct the existing real PrepareThenDraw ordinary/detail-opaque/detail-Clip/ ordinary assertion: only the detail-opaque command binds non-A2C. Cover 1x and actual 4x, ordinary and atmospheric families, with exact pipeline descriptors, draw order/count, depth state and detail push fields. Add a classic-grouped real submission regression for the same shared selection; verify detail unavailable/disabled and quality A2C=false remain unchanged. Use existing fixtures and focused test files, not a test-only replacement of PipelineForMaterial. A mutation restoring the old one-line Opaque arm must fail the relevant ordered and classic tests; restore and re-run green. Existing pure Clip/AP-240 and blended-detail tests remain unchanged in meaning.

Update #473, register a filed-and-code-retired AP-245 row in the same fix commit, and append exact results here. The new row records the defect and its correction without pretending GPU/owner acceptance. AP-240 and AP-244 remain active. Correct source comments only where this edit makes them stale. Return all changes uncommitted for the lead. Do not touch frozen s5-closeout-harness or its nine-file C1c result. No unrelated refactoring.

42.3 Reviews, build and honest graphical gate

At 2026-09-05T07:48:08+02:00 explicit JSON preflight found zero AcDream, retail or debugger processes and ACE UDP9000 PID13340. PID18836 had exited; its log ends with graceful logout requested/confirmed. The lead did not close or control the owner's session. Check again before every build/launch; never build beside a running client. Release builds and focused tests are now authorized under this repair step. Do not launch a client as implementer.

Sequential independent OpenAI retail then production/gate-honesty review; a finding gets only a bounded fix and narrow re-review, maximum ten passes. Lead independently verifies the code, discriminating tests and paired facts, commits the reviewed change and runs a green Release build before one owned graphical run per background command. Use the same recipe10 package, 4x MSAA, A2C=true and detail ON: do not hide the bug by globally disabling detail/A2C.

The previous provisional images were insufficient: c5 03-holtburg-house.png is INSIDE, c5 04-holtburg-terrain-leak.png faces away toward a hillside, and c4 09-cathedral-terrace-edge.png does not frame the complete exterior. Their blanket intact-shell claims are superseded, not evidence against owner FAIL. The new gate must frame complete Holtburg and cathedral exteriors from more than one side and at near/far distances, and check the working Facility interior as a control. Record exact poses/settings/binary, PNG paths and PASS/FAIL; close only the lead's own session gracefully. Lead PASS remains provisional until the owner re-gates. Keep #473 open if rendered sections remain missing, even if the narrow tests pass. No merge main; C1c and all remaining closeout/G4 obligations resume only after this failure is handled.