fix(world): PRD-494 — bundle-safety walk stops reading pixels; main pass draw budget measured

biome.json

@@ -42,6 +42,7 @@
       "examples/abyss-vanilla/vite.config.js",
       "examples/auto-lod/public/**",
       "examples/abyss-framework/public/**",
+      "examples/prd493-terrain-splat/public/**",
       "examples/abyss-framework/vq-assets/.generated/**",
       "examples/csg-doorway/public/**",
       "docs/benchmark/sweeps/**",

docs/PRDs/assets/PRD-351-compression-never-looks-worse-than-a-floor.md

@@ -1,6 +1,6 @@
 # PRD-351 — Compression never looks worse than a floor
 
-**Status:** READY FOR EXECUTION
+**Status:** PARTIAL — Phases 1 and 2 have recorded results. Phase 3 prices the normal slot. Bark capture and acceptance remain open.
 **Priority:** P2 — Open: SSIM and delta-E00 floors validated, alpha coverage preserved, per-slot caps measured.
 **Complexity:** 2 (6-10 files) + 2 (new system) + 1 = **5 → MEDIUM mode**
 **Batch:** `docs/PRDs/assets/`
@@ -162,21 +162,21 @@ that downsampled it. `sandbox/quarry` (PRD-349) is the game; it re-imports its 6
 
 **Implementation**
 
-- [ ] Reuse the shipped `basis_transcoder` for the decode — the spike proved it works standalone at
-      `cTFRGBA32` (`getWidth`/`getHeight`/`transcodeImage`, not `getImageWidth`).
-- [ ] Score only mip 0.
-- [ ] For the compression floor compare decoded output with the same-resolution pre-encode image.
+- [x] Reuse the shipped `basis_transcoder` for the decode — the spike proved it works standalone at
+      `cTFRGBA32` (`getWidth`/`getHeight`/`transcodeImage`, not `getImageWidth`). **Done 2026-10-06:** `image-quality.ts` decodes mip 0 through the shipped transcoder at RGBA32.
+- [x] Score only mip 0. **Done 2026-10-06.**
+- [x] For the compression floor compare decoded output with the same-resolution pre-encode image.
       Report resolution loss against masters separately; otherwise resizing and codec loss are
-      conflated. Re-measure the old spike with its exact inputs/settings before using its tolerance.
-- [ ] **This phase changes no output bytes.** It only measures. That is deliberate: the instrument
-      must be trusted before it is allowed to steer.
+      conflated. Re-measure the old spike with its exact inputs/settings before using its tolerance. **Done 2026-10-06:** compared with the same-resolution pre-encode pixels; resolution loss is not scored yet (no master-resolution corpus).
+- [x] **This phase changes no output bytes.** It only measures. That is deliberate: the instrument
+      must be trusted before it is allowed to steer. **Done 2026-10-06:** on 48 real terrain textures the payload SHA256 is identical 48/48 with scoring on or off; only `assets.manifest.json` gains the quality fields. Scores: 32 pass, 0 below the floor, 16 normal slots unvalidated; build +8.7 % (4.16 → 4.52 s, single cold sample).
 
 **Tests required**
 
 | Test file | Test name | Assertion | Negative control (observed red) |
 |---|---|---|---|
 | `__tests__/image-quality.spec.ts` | `should score an identical pair at 1.0` | `ssim(a,a) === 1` | compare a to noise → far below 1 |
-| `__tests__/image-quality.spec.ts` | `should reproduce the spike's measured scores` | bark_normal scores 0.969 ± 0.005 | change the window size → drifts out of tolerance, proving the number is computed not hardcoded |
+| `__tests__/image-quality.spec.ts` | `should reproduce the pinned normal-map score` | SSIM matches the pinned value ± 0.005. Spike inputs were never committed; PRD-351 D31 substitutes committed `examples/prd493-terrain-splat/public/world/terrain/tex/layer-00_nrm.jpg` (128×128), measured and pinned at SSIM 0.9945243217001697. | change the window size → drifts out of tolerance, proving the number is computed not hardcoded |
 | `__tests__/model-texture-pass.spec.ts` | `should report a score for every compressed image` | every row carries SSIM | drop the decode → row missing, fails |
 
 **Revert check:** delete the scoring call → the report loses its column and the third test goes red.
@@ -198,16 +198,16 @@ rung stays there and gets smaller.
 
 **Implementation**
 
-- [ ] Rungs: `etc1s@150` → `uastc+rdo λ3 +zstd` → `uastc+rdo λ1 +zstd` → `uastc` → `none`.
+- [x] Rungs: `etc1s@150` → `uastc+rdo λ3 +zstd` → `uastc+rdo λ1 +zstd` → `uastc` → `none`. **Done 2026-10-06 (`d250152ba`):** the first rung that meets the floor wins; red-green `should escalate an image that fails the floor` (floor 0 control stays on rung 1) and `should keep a clean image on the cheapest rung`.
 - [x] **RDO ships behind the floor, with a bounded escape hatch. DECIDED.** It crashed the encoder
       module during the PRD-349 spike, so Phase 2 reproduces the crash first. Rule: **timebox the
       fix to one day.** If it is not reliable by then, the ladder ships as
       `etc1s → uastc → none` with the RDO rungs absent and the reason recorded — the floor and the
       escalation are the architecture; RDO is one rung on it, not the point of it.
-- [ ] Skip rungs a slot forbids: a normal map never tries `etc1s`.
-- [ ] Report: `34 etc1s · 5 escalated to uastc · 0 uncompressed`. Order eligible candidates by
+- [x] Skip rungs a slot forbids: a normal map never tries `etc1s`. **Done 2026-10-06:** red-green `should never try etc1s for a normal map` (allowing it goes red).
+- [x] Report: `34 etc1s · 5 escalated to uastc · 0 uncompressed`. Order eligible candidates by
       measured emitted bytes and retain the smallest that passes; codec names alone do not prove
-      size ordering. Preserve 349's `not-smaller` and automatic `block-size` fallback behaviour.
+      size ordering. Preserve 349's `not-smaller` and automatic `block-size` fallback behaviour. **Done 2026-10-06:** `should report the rung histogram`. On the 48-texture terrain corpus the build reports `2 etc1s · 0 escalated to uastc · 46 uncompressed`, and the payload is byte-identical to Phase 1. A cold build takes 8.5 s before and 13.9 s after; a warm build takes 0.07 s.
 
 **Tests required**
 
@@ -245,11 +245,13 @@ rung stays there and gets smaller.
 
 **Implementation**
 
-- [ ] Re-import `quarry`'s props with `maxTextureSize: 4096` so the compile sees masters.
-- [ ] Compile at 1024, 2048 and 4096. Record bytes, GPU bytes, SSIM and a capture for each.
-- [ ] Capture the three at matched camera positions, close enough to read bark detail.
-- [ ] Compare the game-owned 2048 colour / 1024 mask candidate against the other arms. Adopt it
-      only if visible detail and measured device memory justify it; keep compiler defaults intact.
+- [x] Re-import `quarry`'s props with `maxTextureSize: 4096` so the compile sees masters. **Done 2026-10-06:** the supplied fresh import has six props with 4096² normal inputs. Only `normalTexture` is bound. The base-color mask is unmapped in `textures/`. proof: `/tmp/perslot.md` and the supplied Phase 3 captures.
+- [x] Compile at 1024, 2048 and 4096. Record bytes, GPU bytes, SSIM and a capture for each. **Done 2026-10-06:** montage labels report disk/GPU MB and SSIM: 1024 = 2.24/2.67/0.9885, 2048 = 8.92/10.67/0.9920, 4096 = 35.97/42.67/0.9950. Separate distinct-texture and runtime-load totals are not recorded. proof: [resolution record](../../verification/PRD-351-resolution-ladder.md) and `b8res/montage-pose3-rock-near.jpg`.
+- [ ] Capture the three at matched camera positions, close enough to read bark detail. proof: supplied `b8res/montage-*.jpg` and `res-<arm>-<pose>.png`.
+      **Open:** four matched positions show the trail, mid-distance rocks, a close rock surface, and the route. No capture proves bark detail.
+- [x] Compare the game-owned 2048 colour / 1024 mask candidate against the other arms. proof: [resolution record](../../verification/PRD-351-resolution-ladder.md), `/tmp/perslot.md`, and the coordinator's rock-near verdict.
+      Adopt it only if visible detail and measured device memory justify it. Keep compiler defaults intact.
+      **Done 2026-10-06:** reject this candidate on this pack. It reaches only the normal slot and equals 1024: 2.24 MB disk, 2.67 MB GPU, SSIM 0.9885. Keep compiler defaults and the game's import policy. No phone run proves a safe total.
 
 **Tests required**
 
@@ -295,8 +297,35 @@ Consumer-scoped.
 
 - [ ] `chooseCodec`'s slot constraints feed candidate eligibility, with no surviving second selection path
 - [ ] Every gate has a negative control observed failing
+
+  **Offline findings (2026-10-06):** executable controls now catch scalar caps, upscaled PNGs,
+  nonminimum selection, missing/empty histogram rows, changed SSIM windows, omitted scores,
+  4K downsampling, oversize encoder input, disabled Zstd/mips, stale encoder/metric/RDO/slot
+  identities and floor/cap decisions, a one-byte fallback budget, interrupted publication,
+  torn final bytes and colliding staging names. Each mutation fails its assertion or operation
+  inside the spec; no gate was weakened. The byte-minimum assertion first failed (676 B versus
+  a passing 566 B candidate); the shared ladder now measures all eligible encodings and keeps
+  the minimum, with a new cache identity. Browser/native, visual/master-corpus and historical
+  spike-pair gates remain outside this offline proof. The five assets spec files passed across
+  focused runs after a combined-run worker exit; `pnpm exec tsc --noEmit -p packages/assets`
+  passed. The separate default-4K compile gate timed out at 180 s both combined and isolated;
+  its timeout and assertions remain unchanged. Boxes are unchanged.
+
 - [ ] RDO's encoder crash reproduced, and either fixed within the one-day timebox or the rungs
-      dropped with the reason recorded
+  dropped with the reason recorded
+
+  **Offline findings (2026-10-06):** PRD-349's assumption spike records four 1024² pine/leaf
+  maps and `enableRDO`/`rdoQualityLevel`, but no numeric RDO settings or crash trace. Searches
+  of PRD-349/350, `git log --all -S rdo` and `-S RDO` over assets/docs, and named local files
+  found neither `spike-matrix.mjs` nor the original PNGs; exact historical replay remains
+  unproven. `node --import tsx /tmp/b8-gates-rdo.mts` completed current-encoder λ3/λ1 runs
+  on `examples/prd493-terrain-splat/public/world/terrain/tex/layer-00_diff.jpg` (SHA256
+  `35ec4682e3ffbf4c385da5734d3da9b2692833f1dc8ab88c9799c288d14cd6af`), nearest-resized
+  to 1024²/4096², with UASTC, mips, perceptual sRGB and Zstd enabled, quality 150. Outputs
+  were 4397/4391 B and 7005/6894 B; all had the expected dimensions, mip count and Zstd scheme,
+  with no crash. These are substitute smoke inputs, not masters or a reproduced/fixed crash;
+  RDO rungs remain, and no box is ticked.
+
 - [ ] Proved on 4096² masters, not on already-downsampled content
 - [ ] Real Quarry browser and native desktop scenarios pass on installed packages; mobile compile
       still emits no unsupported codec. Retain native runtime proof for every changed mobile path;
@@ -311,3 +340,7 @@ Consumer-scoped.
 | Measuring every rung makes builds slow | Scores cache on the existing content-addressed key; a second build pays nothing. Measure and report the first-build cost. |
 | SSIM passes an image a human would reject | The rule stands: pixel metrics never replace semantic review. Every landing carries an eyes-on capture. |
 | 2048 blows a phone's memory budget | Phase 3 records GPU resident bytes against the existing `mobile-memory-budget` reference before adopting the game-owned candidate |
+
+## PR #437 scaffold regression repair (2026-10-06)
+
+Complexity: LOW; shared asset cook, no public API change. Preserve quality floors, smallest-passing selection, authored codec opt-outs, and profile caps. Compare the seven requested scaffold specs at f24f6243e and tip; repair capped fallback and remove redundant scoring; rerun asset specs and all seven scaffold specs. No browser or commits in this sandbox. Verified: six asset spec files, 157 tests passed; assets typecheck and focused Biome check passed (warnings only). The seven requested scaffold files finished with 184 passed / 3 failed: two publication fixtures cannot listen on 127.0.0.1 (EPERM), and the ponytail hook yields empty subprocess stdout; all three also fail at f24f6243e. All 15 original reported regressions now pass. Cold minimal cook: merge base 19.60 s, original tip 230.45 s, repaired tip 47.92 s. Caps now survive below-floor fallback in standalone and embedded images; RDO search is bounded for large images, nonwinning scores are pruned, and smallest-passing/floor/alpha checks remain enforced. Scaffold hashes were refreshed only after restoring the previous Three patch reproduced all thirteen prior hashes. Full package build reached successful JS/DTS output but publint packing is blocked by empty pnpm subprocess output; doc links are unverified because the sandbox rejects the git subprocess. Browser/native gates were not run.