Correct GPU timing readback and transmitted-shadow reconstruction

docs/evidence/windows-profiler-integrity-v1.md

@@ -0,0 +1,105 @@
+# Windows GPU profiler integrity
+
+## Result and scope
+
+The Windows Radeon 760M/Vulkan profiler returned the previous frame's query
+values, including stale buffer contents in the first frame. Submitting the
+readback copy after the renderer's query-resolve submission repairs that
+behavior. An independent resolve of the same query events matches the reported
+current frame from its first sample.
+
+This is observed with wgpu 29.0.1 and AMD driver 24.12.1 (LLPC). The evidence
+identifies resolve-to-copy visibility/order behavior on this configuration; it
+does not establish an upstream driver or library defect. The fix retains the
+existing blocking map and adds one profiler-only copy submission. Normal
+rendering with profiling disabled is unaffected.
+
+## Diagnosis and controls
+
+The initial timing-only regression records four frames with each of three fresh
+profilers. Against production source `64d5eed`, all 12 samples mismatch the
+independent query values. For example, expected frame durations start at
+53.72, 53.96, 68.52, and 53.84 microseconds; the old profiler reports 0, 53.72,
+53.96, and 68.52. Recreating the profiler can reuse the preceding instance's
+last buffer contents. The fixed implementation passes the same comparison.
+
+Diagnostic captures distinguish the stages:
+
+- Mapping and polling both report success even when the normal readback is stale.
+- A later independent copy of the resolve buffer has the current query values.
+- Re-reading the normal readback retains the old values.
+- Explicit zero initialization only makes the first bad sample zero; it does
+  not remove the one-frame delay.
+- Moving the copy into the following queue submission makes the two captures
+  equal without an additional CPU wait.
+
+`current-frame-before.log` and `current-frame-before-test.rs` retain the initial
+negative control. The final GPU regression also verifies reporting coverage
+and rejects a reserved but unresolved frame. Temporary diagnostic instrumentation
+is retained in the evidence directory and is absent from production.
+
+## Reporting changes
+
+Map or poll failures no longer read an unmapped buffer. Missing resolves,
+backwards query pairs, invalid timestamp periods, and exhausted query budgets
+produce incomplete frames. Rolling pass means drop unavailable latest samples
+and no longer reuse overwritten ring entries or average missing samples as zero.
+
+The native report distinguishes timestamp capability from valid measurement
+coverage using `timing_window_frames`, `gpu_timing_valid_frames`, and
+`gpu_timing_valid`. GPU aggregates exclude incomplete frames; the qualification
+runner rejects an incomplete or unverified window. The window is the most recent
+120 frames at most, not an all-session percentile claim. Non-finite timing,
+timestep, render-scale, and hard-budget numbers also fail qualification.
+Existing telemetry without coverage fields needs recapture for timing acceptance.
+
+## Validation
+
+The complete shared release suite passed on the physical Radeon/Vulkan adapter:
+487 library tests, 90 golden tests, device startup, four focused PT temporal
+tests, and the remaining enabled runtime/invariance suites. There were no test
+failures. Existing exclusions remain: one library ignore, four golden ignores,
+two documentation ignores, and external-input early returns (two Bistro golden
+cases plus detailed virtual geometry, large virtual stress, and full Bistro
+visibility fixtures). These returns do not qualify those external scenes.
+
+The repository contracts, lint lane, and quality-contract lane also passed,
+including 25 quality-runner unit tests. The current-frame GPU regression also
+passes on the Radeon through DX12. The regression compares actual query
+events instead of imposing a GPU-duration threshold. The new SSGI measurement
+assertion requires all 120 measured GPU frames to be complete.
+
+## Corrected SSGI comparison
+
+Both frozen executables use the corrected profiler and identical fixture code.
+Only the two SSGI shader source files differ, using the same before/after shader
+snapshots as the earlier stationary-SSGI report. Each resolution has five
+alternating process pairs, with 24 warm-up and 120 measured frames. No local
+build or other GPU test runs during the measurement sequence. The reported
+cost is the sum of the five probe passes; blocking instrumentation means these
+figures do not establish uninstrumented frame throughput.
+
+| Resolution | Before median (range), ms | After median (range), ms | Median delta |
+| --- | --- | --- | --- |
+| 256 | 0.098082 (0.097440-0.101088) | 0.106680 (0.100892-0.107854) | +0.008598 ms |
+| 1280x720 | 0.396267 (0.387516-0.397251) | 0.439799 (0.431261-0.440850) | +0.043532 ms |
+
+The old shader's stationary-image assertion still fails; these failures are
+retained as controls. The fixed shader passes, and all timing windows on both
+sides contain 120 complete frames. The earlier SSGI timing table predates this
+profiler correction and is superseded by this comparison. Its image evidence
+and the outstanding HD TAA-jitter failure are independent of timestamp readback.
+
+## Evidence and remaining work
+
+Raw commands, logs, source snapshots, frozen executables, timing records, and
+SHA-256 receipts are published with the
+[profiler evidence prerelease](https://github.com/Bloom-Engine/engine/releases/tag/quality-evidence-profiler-windows-vulkan-20260910).
+The source branch is `codex/windows-profiler-integrity`, based on #155 at
+`64d5eedd71e4249edfef8977af9c0e4a944753d3`; the release tag identifies the final
+report commit and its archive manifest hashes every retained file.
+
+This closes the observed current-frame readback defect on the tested adapter.
+The two Windows portable-image discrepancies, HD temporal stability, the
+representative scene/performance corpus, and other hardware/platform acceptance
+remain open. No image baseline, visual threshold, or performance budget changes.

docs/evidence/windows-ssgi-stationary-v1.md

@@ -51,6 +51,10 @@ updating the two shader-source assertions for repeated phase validation.
 
 ## Isolated GPU timing
 
+The figures in this section predate the profiler readback correction. The
+[corrected comparison](windows-profiler-integrity-v1.md) supersedes them for
+timing qualification; the image evidence elsewhere in this report is retained.
+
 Five alternating before/after process pairs per size, each with 24 warm-up and
 120 profiled frames. No other local GPU test ran concurrently. These figures
 cover the sum of five probe passes, not complete frame time. Profiling uses
@@ -74,8 +78,10 @@ retained. These measurements do not establish a different adapter's budget.
   0.97931148 before and 0.97931067 after. Both shaders pass this check at 256
   square. The HD failure predates this fix and remains open; the static HD pass
   is not a claim that HD temporal qualification is complete.
-- The combined golden batch emitted invalid GPU timestamp totals. Its timing is
-  excluded from this comparison; profiler reliability still needs investigation.
+- The combined golden batch emitted invalid GPU timestamp totals. The later
+  [profiler investigation](windows-profiler-integrity-v1.md) identifies a
+  one-frame readback delay and repairs it; both SSGI shader variants have been
+  measured again with that correction.
 - The two portable-baseline Windows discrepancies, representative Bistro motion,
   other backends, and named RTX 4080 acceptance remain open.
 

docs/evidence/windows-transmitted-shadow-inverse-vp-v1.md

@@ -0,0 +1,39 @@
+# Transmitted-shadow inverse camera matrix correction
+
+The transmitted-shadow resolve uploaded the CPU inverse view-projection matrix
+without converting its storage layout for WGSL matrix-vector multiplication.
+Receiver positions were reconstructed in the wrong world coordinates, so the
+pass missed the actual glass shadow and could tint unrelated boundary pixels.
+The upload now transposes the inverse matrix, matching SSR, PT, and fog.
+
+This defect surfaced in #156's macOS shared-test lane at `73e6945`: the profiler
+regression passed, but the colored-shadow test failed with RGB losses
+`(2345, 7628, 406)`. The original test included asynchronous GI, which could
+switch from screen-space tracing to SDF tracing between its two short captures.
+GI is now disabled in this direct-shadow fixture, and failed captures are
+retained automatically. Its camera, light, material, frame counts, and assertions
+remain unchanged.
+
+The isolated fixture fails reproducibly on Radeon/Vulkan before the matrix
+correction: RGB losses are `(19510, 37818, 966)`. Correcting the upload produces
+a visible shadow on the floor beneath the glass, with 3,217 affected pixels
+and losses `(99060, 70446, 471)`. The existing cyan-transmittance assertion passes.
+A wrong-color control swaps the authored red and green attenuation values:
+losses become `(68302, 95675, 656)` and the same assertion rejects it. The
+temporary control is reverted. No approved image or assertion threshold changes.
+
+An intermediate diagnostic also tested an oblique light and a constant resolve
+strength. Those variants are retained as diagnostic evidence and are absent
+from the final change. The production correction is one matrix transpose;
+resource counts, pass structure, and shadow-map resolution are unchanged.
+
+The local command is `cargo test --release --manifest-path native/shared/Cargo.toml
+--test golden_render physical_transmission_casts_a_bounded_colored_directional_shadow
+-- --nocapture`, with `WGPU_BACKEND=vulkan` and `BLOOM_REQUIRE_GPU=1`.
+
+Raw logs, before/after PNGs, the wrong-color control, and source changes are
+retained under `tools/quality/out/windows-engine-plan/profiler-integrity/colored-shadow-stage/`
+and published with the [#156 evidence prerelease](https://github.com/Bloom-Engine/engine/releases/tag/quality-evidence-profiler-windows-vulkan-20260910).
+The initial profiler ZIP remains pinned to `73e6945`; the shadow follow-up
+archive records its own source revision and hash manifest. Hosted validation
+must be assessed against the follow-up PR head.

docs/windows-engine-plan.md

@@ -14,10 +14,10 @@ first nine-scene Radeon evidence are in draft PR #154. Follow-up work starts at
 
 | Work | Required completion evidence | Current state |
 | --- | --- | --- |
-| #127 Vulkan PT correctness | Three deterministic progressive and motion runs, both negative controls, finite intermediates, reset/lighting/rigid-motion checks, retained report | Canonical hardware gate, all four focused temporal tests, and CPU reference sanity check pass on Radeon/Vulkan; [report retained](evidence/issue-127-windows-vulkan-v1.md), archive publication pending |
+| #127 Vulkan PT correctness | Three deterministic progressive and motion runs, both negative controls, finite intermediates, reset/lighting/rigid-motion checks, retained report | Canonical hardware gate, all four focused temporal tests, and CPU reference sanity check pass on Radeon/Vulkan; [report](evidence/issue-127-windows-vulkan-v1.md) and [raw evidence](https://github.com/Bloom-Engine/engine/releases/tag/quality-evidence-155-windows-vulkan-20260910) published |
 | #128 Windows image discrepancies | Identify the first incorrect stage or document a reviewed backend-specific baseline decision; rerun the full strict corpus and reproducibility checks | Sponza and skinned/alpha still fail against portable baselines; original baseline source reproduces both failures |
-| #135 / #149 temporal reconstruction | Enforced motion/producer/quality-preset corpus, representative scenes, fractional/native and frozen A/B timing, memory/resize checks, platform evidence | Device lifetime and resource gates repaired; [stationary SSGI fix](evidence/windows-ssgi-stationary-v1.md) passes 89 golden tests with 4 ignored and 2 optional external-input skips; complete-phase/lighting control and frozen A/B recorded. Existing HD TAA-jitter failure and invalid batch timestamps remain open |
-| #140 integration gates | Same required local/hosted lanes pass on exact source; release package startup and all-example evidence | Local contracts, formatting, and 484 shared tests pass. Hosted CI passes all mobile target builds, native/web builds, and browser startup. Metal texture-byte counter availability was the last failure; its repair and final source are awaiting CI |
+| #135 / #149 temporal reconstruction | Enforced motion/producer/quality-preset corpus, representative scenes, fractional/native and frozen A/B timing, memory/resize checks, platform evidence | Device lifetime and resource gates repaired; [stationary SSGI fix](evidence/windows-ssgi-stationary-v1.md) and [profiler correction](evidence/windows-profiler-integrity-v1.md) pass 90 golden tests with 4 ignored and 2 optional external-input skips. Complete-phase/lighting control and corrected frozen A/B recorded. HD TAA-jitter and the full representative corpus remain open |
+| #140 integration gates | Same required local/hosted lanes pass on exact source; release package startup and all-example evidence | All 23 hosted checks pass at #155 source `64d5eed`, including macOS shared/golden tests, all mobile target builds, native/web builds, and browser startup. Scheduled physical-hardware checks, all-example compilation, and release-install acceptance remain separate requirements |
 | #138 capability fallback | Actual constrained-adapter startup and relevant forced-tier corpus, truthful capability outputs | Existing implementation/evidence preserved; physical constrained-limit acceptance still needs proof |
 | PR integration | Reviewable changes, passing required checks, full issue evidence, merge-ready rendering branch | #147, #154, and follow-up [#155](https://github.com/Bloom-Engine/engine/pull/155) remain drafts; no merge performed |
 
@@ -54,11 +54,23 @@ audit are saved in `tools/quality/out/windows-engine-plan/plan-requirements.json
 
 ## Current next steps
 
-1. Retain the stationary software-SSGI evidence with the final #155 source. The
-   previous shader fails the new regression; the fix passes at measured cost.
-2. Obtain passing hosted checks for the final #155 source and retain the exact
-   commits and run links. The combined golden batch also exposed invalid GPU
-   timestamp totals; investigate those before accepting batch timing evidence.
-3. Resume the two Windows portable-baseline discrepancies and the representative
-   temporal/geometry corpus, then continue the engine work retained above.
-   Hardware-specific acceptance remains open while local work progresses.
+1. #155 source `64d5eed` has passing hosted checks and published evidence. The
+   archive SHA-256 is `de9c1beca73bfcf60bf79d3a612b72c072f726f6272576a7f0f60ffdbc7ce25d`.
+   CI run URLs and conclusions are in its separate `pr155-checks-64d5eed.json`
+   release asset. No draft PR has been merged.
+2. The [profiler correction](evidence/windows-profiler-integrity-v1.md) on
+   `codex/windows-profiler-integrity` passes local contracts, lint, the quality
+   lane, and the complete shared suite. Its current-frame regression rejects
+   all 12 old Vulkan samples and passes with the correction on Vulkan and DX12.
+   Corrected SSGI timing covers 20 isolated runs, each with 120 complete GPU
+   frames. Hosted Metal also passes the profiler regression. Its colored-shadow
+   failure exposed an [inverse-matrix upload defect](evidence/windows-transmitted-shadow-inverse-vp-v1.md);
+   the correction passes the isolated local check and rejects the wrong-color
+   control. Hosted CI must qualify this follow-up's exact source before integration.
+3. Diagnose Sponza and skinned/alpha against the portable baselines, then repair
+   HD temporal stability and complete the representative temporal/geometry
+   corpus. Recapture affected timing evidence with explicit coverage fields.
+4. Continue starter/all-example and release-install checks, asset/world streaming,
+   schema-generated APIs, components, and runtime UI against each issue's full
+   acceptance criteria. Hardware-specific acceptance remains open while local
+   work progresses.