Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bin/keepalive_f5.ahk

@@ -0,0 +1,48 @@
+; keepalive_f5.ahk
+; Sends F5 to the AC window every 60 s via SendInput so DirectInput sees it.
+; Brings AC to foreground briefly each pulse (focus-stealing is unavoidable
+; for SendInput).
+;
+; Run with: AutoHotkey64.exe bin\keepalive_f5.ahk
+
+#Requires AutoHotkey v2.0
+#SingleInstance Force
+SetTitleMatchMode 2
+
+WinTitle := "ahk_class Turbine Device Class"
+LogFile  := "C:\Users\acbot\leakhunt\artifacts\phase1\keepalive.log"
+
+LogPulse(msg) {
+    global LogFile
+    FileAppend("[" FormatTime(A_Now, "yyyy-MM-dd HH:mm:ss") "] " msg "`n", LogFile)
+}
+
+LogPulse("AHK keepalive starting, alternating z/c (2s hold) every 600s (10 min)")
+
+i := 0
+Loop {
+    if not WinExist(WinTitle) {
+        LogPulse("AC window not present - waiting 10s")
+        Sleep 10000
+        continue
+    }
+    try {
+        WinActivate(WinTitle)
+        Sleep 200
+        if (Mod(i, 2) = 0) {
+            Send("{z down}")
+            Sleep 2000
+            Send("{z up}")
+            LogPulse("pulse " i ": z held 2s")
+        } else {
+            Send("{c down}")
+            Sleep 2000
+            Send("{c up}")
+            LogPulse("pulse " i ": c held 2s")
+        }
+        i := i + 1
+    } catch as e {
+        LogPulse("ERROR: " e.Message)
+    }
+    Sleep 600000  ; 10 min production interval
+}