Command & Conquer: Tiberian Sun demo

October 8: campaign COM fault could not be reproduced on the fresh box

Sole worker on explicit a21a7c308 reused accepted module 6adb4387…, authenticated all125 source checks/478 runtime pins/29 aliases, and retained original SUN f70dcf32… and media. Three bounded fresh-box runs are 20261008T0314Z-tiberian-campaign-com, 20261008T0317Z-tiberian-campaign-com and 20261008T0321Z-tiberian-campaign-com. Each has190 actual full/range producer hashes with zero drift and five explicitly optional shell404s. The prior0256 loading/error evidence remains valid historical evidence; these new runs do not reproduce its campaign dialog1000c or Titan loading.

The first run had two refused input commands lacking required reviewed-scene metadata and closed its observer at click cleanup. Those limitations are retained. The second keeps independent API/fault budgets through ordinary quit. The third preserves the prior pump/paint navigation harness and adds only a reserved cxx_throw hook. Both corrected runs observe no COM throw; their final receipts and personally inspected screenshots are retained. Ordinary New Campaign and750ms Enter remain at the original menu/gray menu surface. No further paint/selector repair or forced state was attempted.

An authenticated startup CoCreateInstance return at original5ec3e3 reports 0x80040154 (REGDB_E_CLASSNOTREG), followed by S_OK at the same caller. This recovered startup failure is not the campaign HRESULT. Other CoCreateInstance handler-exit values occur during deferred activation and must not be labelled final guest-call results. No owning campaign exception object/caller/HRESULT was captured, and no engine change is justified.

The preparation helper now audits accepted6adb closure/module instead of the obsoletebd5 reference. A bounded fault observer and meaningful exhausted API-lane/forwarding/throw/restoration test are available, but diagnostic tooling is not a campaign repair. All three browsers quit before their unchanged300s deadlines; independent PID/socket/pin checks and evidence retrieval precede owned-prefix removal. Fresh no-env bx_fugmje42 lifecycle is retained by root, expiry03:52:10.007 UTC. Gameplay/FPS/audio remain unknown. See campaign COM handoff.

October 8: explicit validation repair passes the menu blocker

Reserved owning host.invalidate evidence in 20261008T0251Z-tiberian-writer finds alternate10003's original581010→581022 InvalidateRect(NULL,FALSE). All64 live code spans authenticate original SUNf70dcf32. Original5812cc ValidateRect(NULL) succeeds but retains full640×480 damage. USER limited NULL validation to host geometry and did not consume child paint requests. Generic repair6dd5f4bc7 clears the entire NULL update region and clears paint when validation empties it; partial rectangles preserve remaining damage. Real nested x86 callback regression fails before and passes after, including ESP/depth, ownership, partial damage and later invalidation; full build and existing paint-order suite pass. No prevalidation or application bypass.

Actual candidate 20261008T0256Z-tiberian-validation-candidate, source6dd5f4bc7, fresh module6adb43872bf4d48bbbbc09967b3e8e1baaf59be7d4ac6b1a414aad13d2a944e0, original SUN/media unchanged: ordinary reviewed New Campaign now empties the pump and shows dialog1000c. Ordinary Enter reaches Titan campaign loading, then the game's "unable to continue normally" error. Console _com_error obj074fefa8/EIP0 is unowned page evidence, not an authenticated fault address. Five inspected images,216 served hashes/zero drift,125 source checks/478pins, clean ordinary quit/independent PID/socket release. Gameplay/FPS/audio unknown. Next reserve owning first failing HRESULT and original callback/exception context during loading. Exact identities, integrity correction, tests and lifecycle: renewing-writer handoff.

October 8: native paint validation succeeds, full damage returns

Fresh isolated paint investigation off explicit coordinator 0ab392bcd uses unchanged original SUN f70dcf32…, accepted reference module bd5c84ca…, all125 build-source checks/478 runtime pins/29 aliases. No engine repair or rebuild. Runs 20261008T0232Z-tiberian-paint and 20261008T0237Z-tiberian-paint-target each pass checked HTTP preflight before Chrome,190 actual served hashes, ordinary quit and independent cleanup.

The first run's paint target10003 differs from the observer's assumed10002; zero paint rows are an observer limitation. The changed second hypothesis binds to actual post-anchor MSG target10002. It records18 native-dialog chains with nested original ValidateRect(hwnd,NULL) at return58cae6: full299×202 damage becomes empty, native marker exit also sees it empty, and the next captured same-target paint again has full damage. Four live caller spans match original bytes. Native default chaining and validation therefore occur in these cycles; the renewing writer remains unknown. Raw DLGPROC BOOL/retired guest return is unmeasured. No blanket prevalidation.

The paint observer has six distinct rows/13,833 read bytes/error0, then reaches 20,000 hooks; negatives stop there. The read-only reader uses checked regions directly: exported update_rect_lt/rb can clear empty-but-flagged damage and must not be used for a non-mutating observer. JS ownership/nesting/damage, caps, actual generated Worker targeting and exception-safe final receipt contracts pass. Both inspected ordinary after-click images remain menu; campaign/gameplay/FPS/audio stay unqualified.

Next capture actual-target host.invalidate with owning EIP/ESP/stack and ShowWindow/SetWindowPos/MoveWindow boundaries to locate the first internal writer renewing validated damage. Exact identities, absent stale paths, caps and lifecycle: paint handoff.

October 8: post-selector paint repeats inside the earlier show pump

Run 20261008T0152Z-tiberian-menu-consumer-runtime executes source e13aa2e4b with accepted reference modulebd5c84ca and original SUNf70dcf32, without rebuild. Checked sequential JS HTTP preflight passes507HEAD/5GET/range before Chrome; failed-preflight→no-Chrome tests cover the actual generated launch expression. All478 pins/125 build-source entries/29 aliases verify. Current reviewed native point317,213 resolves parent10002/button10004 before the ordinary page306,455 New Campaign click. Exact original command/selector1 is used only as an anchor.

The approximately6-second post-anchor owning slot0/tid1 receipt reports236 each of Peek1/Get1/Dispatch-handler-exit0 for HWND10002/WM_PAINT000f/zero parameters. Five rows/33048 read bytes/errors0/no caps; no first-empty, DestroyWindow or new-dialog entry in that bounded window. Four live32-byte API caller spans match original SUN. Handler exits do not establish guest callback return.

Actual frame base074ff434 has words+44..+60 4f3f05,10002,58ca9e,0,4de732. It fails the anticipated58cdb5/4de743 frame. Aligned original4f3ee0 calls562830 at4f3f00;58ca80 calls4f3ee0 at58ca99 after ShowWindow/SetForegroundWindow; menu4de72d calls58ca80. Thus this is the earlier show pump before4de73e/4de9dd, rather than measured execution of the selector consumer. The original relative-call bytes and owning stack shape are checked; intermediate original code is static PE evidence, not another live snapshot. Three reviewed captures remain menu; no campaign/mission/gameplay qualifies.

Accepted Get/Peek intentionally retain subclass/application damage, while native unsubclassed controls prevalidate. DefWindowProc validates default WM_PAINT. dialog_proc_result already clears damage when a DLGPROC leaves WM_PAINT unhandled. Existing test-parent-child-paint-order.js checks retained damage for a nonvalidating subclass and validation after native CallWindowProc chaining; it was inspected, not executed under this phase's no-native/build constraint. Repeated paint is measured, but actual subclass/default validation versus renewed invalidation remains unknown. No production repair or starvation claim.

Next observe the owning paint chain/default epilog/BeginPaint/ValidateRect and reinvalidation at the actual show frame, with independent reserved budgets. Require a generic demonstrated regression before any repair and root grant before native/build work. Do not revisit delivery/selector or repeat ordinary clicks. Details: consumer handoff.

Actual browser01:54:21–ordinary quit01:57:35.113, original deadline01:59:21.455. Chrome0/errors0/streams0;190 actual served hashes have zero drift. All17 artifacts copied/hashchecked;34672/34701 absent/noChrome/exact baseline/all478 pins verify at01:58:06.671. Prefix removed01:58:06.796, sole remote released01:58:34 to root. Root owns bx_jk5sz7qx/Puppeteer; worker owns no remaining runtime jobs.

October 8 focused command: selector 1 authenticated, consumer progress unresolved

Run 20261008T0126Z-tiberian-focused-command uses source b4acd9812 (explicit base b095c5def), accepted module bd5c84cae31e5fd8ecc27f4305fce607a203a67ef4fcfd1907e01d1e3bb08fc9 and original SUN f70dcf32a25fe63cde2dd16bcf60feea93a98c94fc371ee97446df247160414b. No rebuild or production repair. Unique validated prefix preparation uses normal baseline extraction and a sealed overlay. All 125 build-source entries, 478 runtime pins and 29 aliases match; generated Worker/Link, guard/forwarding, fresh-prefix and actual old-helper/current-helper 500-paint controls pass.

The ordinary reviewed click at page (306,455) targets HWND 10004. At 01:29:41.123, owning slot0/tid1 records original subclass caller 57eec7 chaining parent 580ac0, then caller 580bed chaining native dialog ffff0004. Original DLGPROC GetWindowLongA return 4dea72, HWND 10002, extra index8 has coherent callback arguments [10002,111,1559,10004]. It returns pointer 074ff488, initially9; the next selector-change receipt reads 1 at that pointer. Three caller spans and the 96-byte DLGPROC span match immutable original PE bytes exactly. This authenticates command delivery and the resulting selector value, unlike the earlier initial9 observation. Handler exit alone still does not establish callback return.

Selector1 is observed with reported EIP 56291b, ESP 074ff41c, in the original message pump's block after DispatchMessage and containing PeekMessage. This getter is not an instruction-retirement trace. Original menu entry 4de670 initializes9, installs the stack-local pointer with SetWindowLongA at 4de6d1, calls pump 58cdb0 at 4de73e, then checks selector at 4de9dd. Once non9, it calls dialog teardown 58c960 and returns the selector. Its sole matched relative caller 4dbf4b selects return1 via jump-table index2 at 4dcdc0, reaching 4dbf8a; the subsequent static path creates resource94 with DLGPROC 4dce30 at 4dbfc0. This is static interpretation, not measured execution of the consumer or campaign dialog. Heuristic find_fn suggested interior 4de6a8; the full aligned listing starts at the actual 4de670 entry. An exploratory listing at 562900 is misaligned before 56291b; the aligned instruction at the measured boundary is independently decoded.

All three personally reviewed ordinary captures remain the six-button main menu, including a later capture about65 seconds after the click. Campaign, mission and player-controlled gameplay remain unqualified. The observer retains 8 rows, then reaches its 64KiB read cap after recording selector1; worker1 has 0 rows/48 reads. No absence after that cap proves missing teardown or consumer execution. Next use a bounded owning import observer focused on the 562830 pump's Get/Peek/Dispatch results and caller stack after selector1, with reserved budget for the first empty queue result, DestroyWindow and new-dialog creation. Measure pump return versus continued messages before considering a generic fix.

Actual served full/range producer hashes verify184 bodies with zero drift, including module and both Worker loads. Five optional shell assets return expected404 without runtime errors. Fresh local matching HTTP passes before launch. An extra remote test incorrectly queries every plan path including unpinned optional build-info.js; it fails404 and the shell launches anyway. Corrected matching source/alias preflight passes507HEAD/5GET/range/404/drain at 01:29:20, ten seconds after launch and before any input. This preflight ordering error is retained explicitly; it does not satisfy the requested remote-before- launch ordering. Future control must refuse launch after any preflight failure.

Actual runtime 01:29:10–01:31:04.295, original deadline01:34:10 preserved. Ordinary quit yields Chromeexit0/errors0/streams0. Independent01:31:12 verifies driver34662/Chrome34674 absent, noChrome, exact baseline sockets and all478pins. All15 actual files are copied and hash-verified before scoped prefix removal 01:31:12.442; root adopts box bx_qms4q3z7 and retained Puppeteer. Sole remote slot released to root/queued Warcraft III. Detailed continuation: focused command handoff.

October 8 accepted dialog module: original campaign still unchanged

Matching source b1d78b9f0, accepted retained module bd5c84ca…, current committed hosts and immutable original SUN f70dcf32… run ordinarily after Crimsonland cleanup. All 125 checked build-source entries match the retained accepted closure; 478 runtime pins/29 aliases pass HTTP and remote hashes. There is no rebuild, guest/media mutation or emulator source change.

Run 20261008T0108Z-tiberian-original-runtime starts01:09:05 UTC. The reviewed six-button menu receives one ordinary current-scene New Campaign click306,455. The after-click screenshot remains the menu; no campaign/mission/gameplay is qualified. Owning GetWindowLongA at original return4dea72 obtains HWND10002 extra-index8 selector074ff488, observed9. Four96-byte live DLGPROC spans match original4dea40 exactly. The broad observer consumes128rows/5088bytes without retaining the owning command message/branch; initial9 is not a command result. Earlier missing-UP/WM_COMMAND1559 hypotheses remain ruled out; actual command callback arguments, selector write and callback return remain unmeasured.

Original prefilter58caa0 statically declines WM_COMMAND111 via58cd99/FALSE/ret8. Original DLGPROC then reads HWND extra8; command1559 selects4deae5, writes1 at 4deae6 and returnsFALSE at4deaf3. Static interpretation is not dynamic proof. No further generic/game fix is justified by this incomplete receipt.

Final read-only diagnostic filters to original4dea72/index8 and owning callback arguments at APIESP+50, retaining WM_COMMAND111. An actual old-helper control with500mock paints exhausts128rows and loses the command; final emits0paintrows and retains command1559 in3rows. Guard/error/cleanup and generated Worker/Link JS tests pass. Focused run 20261008T0113Z-tiberian-focused-runtime retains tar-option/nonempty-directory extraction errors; both478-pin closures reverify unchanged. It preserves the original01:14:05.572 aggregate deadline, but the reviewed-input reserve expires before another click. No focused command outcome is claimed. Use a standard fresh-prefix baseline/full-overlay extraction next.

First ordinaryquit01:11:42.983; focused deadline cleanup01:14:05.572. Independent 01:14:42 verifies allfourPIDs absent/noChrome/baselinesockets/pins unchanged, Chromeexit0/errors0/streams0, durable22diagnostics and scopedprefix removal. Remote released to queuedAlienShooter; coordinator owns box/tools. Root15:40 requests phase exit with immutable evidence; the lane remains incomplete. Full next boundary and preservation instructions: original runtime handoff.

Generic subclassed-dialog continuation regression, October 8

On coordinator base ac8c4c8ff, executable x86 subclass code calling CallWindowProc(native DefDlgProc marker) from WM_COMMAND opens a real DialogBoxIndirectParamA. The current synchronous path incorrectly resumes the subclass while the nested dialog remains open. The negative control fails the explicit suspension assertion. This proves a generic emulator defect, not its causal role in SUN.EXE's unchanged New Campaign menu.

The marker path now removes only CallWindowProc's extra previous-proc argument and delegates to DefDlgProc. Its existing modal-capable tail dispatch preserves the callback stack. The regression verifies real nested WM_INITDIALOG, suspension, EndDialog result 99, original subclass/caller resumption and exact ESP, through both CallWindowProcA/W. Synchronous WM_INITDIALOG BOOL, WM_ERASEBKGND nonzero DWL_MSGRESULT, and no-DLGPROC WM_NULL result/24-byte cleanup are also sealed. Relevant custom-dispatch/IDOK/null-proc/end-dialog regressions and the full canonical build pass. Evidence and retained modules are in scratch/runs/20261008-tiberian-dialog-continuation (local Node/WATX only).

Next: coordinator review/integration, then an explicitly granted ordinary game run with owning DLGPROC entry/return evidence. Original stored DLGPROC4dea40's selector write and actual campaign/gameplay remain unmeasured; no game offsets, forced commands, browser probe or new-game qualification were added here.

Refill selection and original closure, October 7

Darkstone was excluded after recovering its existing controlled Town captures; Tiberian Sun replaces that lane. Latest remote main 1fba75144006e74fd44efd396ecb59e1260c417d has neither title in DESKTOP_APPS and no Tiberian Sun APPS registration. Retained board entries from October 6 record a live main menu and a grey campaign panel, not qualified gameplay. The old resource wait for a temporary boat is resolved by the current remote queue; no user pause is inferred from its superseded priority handoff.

The original self-extracting archive is test/binaries/win98-games-a-d/CnC-TiberianSUn-ts_demo-SW.exe; its existing 26-file extraction is CnC-TiberianSun-demo-SW/extracted/. A read-only ZIP catalog audit verified every extracted file's size and CRC against the original archive. SHA-256 pins are retained for all files and the archive in scratch/runs/20261007-tiberian-sun-preparation/original-fixture-closure.json. Original SUN.EXE is 3,256,592 bytes, SHA-256 f70dcf32a25fe63cde2dd16bcf60feea93a98c94fc371ee97446df247160414b. The original readme explicitly permits launching Sun.exe after extraction; no invented installer registry or settings are required by this preparation.

Prepared ordinary browser environment

Reuse exact existing source 0cbc1c6ffd997f5ab31142b4f2d9d57b318d05c6 and module 7c6864f8e224a0d42c6743b3c088ce79349101182295b79b1e4fa8a4c3911cc0. Only a private app registration overlay differs. There is no emulator fix, guest patch, asset replacement or settings change. The normal recursive DLL graph includes the game's BLOWFISH.DLL and native OLEAUT32/COMCTL32; the available system stdole2.tlb is included. SHELL32/OLE32 have no native URL in the normal registry; their ordinary WAT fallback remains intact. All 26 payload files, these two system DLLs and the TLB form 29 fixture pins, alongside 326 source/module pins. Full graph probes and hashes are in the contained preparation run's loader-closure.json, browser-pins.json and READY.json.

Offline LANGUAGE.DLL dialog decoding identifies original main-menu template 226: Exit Game 1006 at y117; New Campaign 1559 at y12; Load Mission 1561 at y33; Multiplayer 1562 at y54; Intro 1003 at y75; Options 1372 at y96. Campaign template 148 contains list 1109, OK 1, Cancel 2 and difficulty slider 1295. These are resource units, not reviewed screen coordinates. The prior owner corrected the hit-test hypothesis: New Campaign was delivered as WM_COMMAND 1559; the grey campaign panel and displaced captions still need actual current-run evidence before attributing a generic defect.

Source preparation initially queued behind Antara and corrected Winamp on bx_d8nw3e8t. The prepared driver enforces a 600-second session, 2 GiB disk floor, current personally reviewed screenshots before ordinary clicks/held keys, and terminal browser/server cleanup. No gameplay or FPS qualification follows from this source preparation.

Actual ordinary browser result: main menu remains unusable

The coordinator's October 7 22:31:45 UTC grant moved this title ahead of Winamp to preserve the temporary box's lifetime. Independent preflight found the prior owner's PIDs absent, no Chrome process and 49 GB free. Transfer verified all 355 runtime pins before launch. All attempts shared the first launch's absolute deadline, 22:43:58.973 UTC; actual browser activity was 22:33:58–22:41:25, under the 600-second aggregate limit.

The first two attempts are preserved harness failures, not compatibility results. First, the private APPS entry was missing from the visible HTML selector, and Puppeteer's unchecked select() launched Notepad (404). The second added the visible option and checked selection, but lacked the normal binaries/... URL aliases for the pinned test/binaries/... files, producing SUN.EXE 404. Both were stopped and terminal cleanup verified. The corrected third attempt includes all 29 fixture aliases, the visible selector option and a fail-closed selector assertion. Emulator source, module, original files and settings remain unchanged.

Attempt 3 loads the original title/background and creates the 640×480 main window plus a visible grey rectangle at guest x171/y187, 299×202. Startup, settled and final captures show no usable menu controls or captions. An ordinary 200 ms Escape press logs WM_KEYDOWN, WM_CHAR and WM_KEYUP, with no visible menu response. No invisible menu control was clicked. New Game, player control and gameplay were not reached; FPS was not measured.

The visible built-in Thread State button was clicked normally. Its popup reported main EIP 0x004230e2, yield 0; static original disassembly places this inside the bitmap row loop 0x423074–0x423111. Repeated popup samples alone do not prove a stopped loop. A bounded read-only sample using existing Worker getters observed EIP 0x4230cb then 0x4230d9, different register values and ongoing slice activity. Additional existing guest_read32 calls sampled twelve stack fields without writing guest memory; these reads are not atomic with the getter snapshots and cannot establish a zero-height underflow. No hook replacement, execution forcing or state bypass occurred.

The first failed user-visible contract is main-menu painting. This is not proved to be a missing asset, missing native DLL, stopped CPU, input-routing bug or owner-draw callback defect. The exact creation/paint cause remains unmeasured. The next causal step is to observe original template 226 control creation and its first native/guest painting callbacks before proposing a generic repair. No speculative emulator change was made.

Evidence: scratch/runs/20261007-tiberian-sun-preparation/investigation.json, with separate evidence/, attempt2/ and attempt3/ outputs. Six reviewed final-attempt images include the ordinary Thread State popup; no image is marked gameplay. The contained artifact index covers 91 files; all 184 served GET/range producer hashes match their pinned source bytes, including the full 1,720,920-byte module's SHA-256. The server records cannot prove client consumption of every stream. All 26 payload hashes and original archive hash remained unchanged after the run.

No candidate-corpus manifest entry exists for this title. Its local app ID is tiberian_sun_demo; investigation metadata explicitly leaves candidateId null and is retained in these notes rather than attaching dashboard result.json to an unrelated candidate.

Ordinary quit closed browser and server, Chrome exited 0, pending streams were 0 and cleanup errors were 0. Independent checks found all six attempt driver/Chrome PIDs absent and no remaining Chrome or owned port 39265 at 22:41:39 UTC. The worker's unique remote prefix was removed at 22:43:50, after evidence collection; the box was retained for the coordinator's Winamp run. Shared HEAD/index, local native/build ownership, Arx and public deployment were untouched.

Coherent creation and bitmap observation, October 7 22:58 UTC

After Antara's explicit release and the coordinator's next-slot grant, an independent preflight verified actual prior PIDs absent, no Chrome, the released socket baseline and 49.7 GB free on temporary box bx_7qga8j7x. The box had no /home/user/wine-assembly/node_modules/puppeteer; the harness used the retained handoff dependency at /home/user/antara-resource-tools-20261007/node_modules/puppeteer. All 355 runtime pins and 29 fixture aliases verified before launch. Original module 7c6864f8 / source 0cbc1c6ff stayed intact.

Private Worker SHA-256 is b426f3f20413c578629ac59abe514846f89e1bfcc78cc979dcf685f9632fe52b. The observer forwards original imports, receivers, arguments and results, changing only existing diagnostic trace flags. Register/stack samples occur synchronously inside the owning Worker at block-entry imports, without guest writes or separate RPC getter calls. Unit tests and the transformed Worker's actual init/slice/receipt/close RPC tests pass.

CreateDialogIndirectParamA receives the original menu's in-memory template at guest 0x00e89050, with caller EBP 226. At dialog_loaded, HWND 0x10002 has six correct button IDs, styles, geometry and captions. USER window-title copies and native ButtonState text agree: 0x10003 / 1006 is “Exit Game”, 0x10004 / 1559 is “New Campaign”, then 1561 “Load Mission”, 1562 “Multiplayer Game”, 1003 “Intro / Sneak Peek” and 1372 “Options”. The creation-time caption displacement is not reproduced; later text mutations remain unmeasured. $title_table_set owns a copied heap buffer, so freeing the parser's temporary string is not itself a defect.

Original DLGPROC 0x4dea40 receives WM_INITDIALOG. Ordinary SetWindowLongA installs 0x57e790; both callback entries' 64 bytes match immutable original SUN text. The callback cap is reached during startup/custom message 0x497, before a WM_PAINT/DRAWITEM callback is captured. This is not proof of owner-draw paint delivery.

Bitmap helper 0x422c20 has a signed-positive guard at 0x423064 before storing the row counter at [ESP+0x30]. Coherent samples observe a 202-row limit, back-edge counters 201, 200, 199 and 170, then counter 0 at 0x423117 and 0x42312b, completing that call. A 12-row call also completes. These observed loops do not underflow or remain stuck. Direct-window-only snapshots omit high sparse bitmap objects, including pointers near 0x08bfb000. Actual destination pixels and presentation targets remain unmeasured.

The personally reviewed screenshot still shows title artwork and a blank grey 299×202 main-menu rectangle. No gameplay/input qualification or generic repair is claimed. Next: callback entries rather than startup block flooding, sparse bitmap objects, actual GDI geometry/target/pixel samples and raw renderer canvas layers. A composition explanation remains a hypothesis.

Self-contained evidence: scratch/runs/20261007-tiberian-paint-preparation/investigation.json and analysis.json, with 43 verified indexed artifacts, including the complete original runtime/fixture package, diagnostic/paint.json and reviewed diagnostic/01-first-paint.png. Runtime was 22:58:18–22:59:17 UTC under a 180-second guard. The 15-second observer ends without errors after 2048 bitmap / 256 callback hook caps. Close RPC on the initial blank page logs one collector ReferenceError: runningApps is not defined; the observer had already closed. Browser/server cleanup still succeeds with Chrome exit 0 and streams 0. Independent 23:00:00 checks find actual PIDs 35864/35876 absent, no Chrome and the original socket baseline. All 355 pins verify again before the owned remote prefix is removed at 23:00:24; dependency tools remain for Antara's next grant. No production repair or local native/build run was performed.

2026-10-07 first paint delivery and sparse bitmap contracts

One targeted run at 23:13:44–23:14:23 UTC used the same original payload, source 0cbc1c6ffd997f5ab31142b4f2d9d57b318d05c6 and module 7c6864f8…. Private Worker 16197636abb9cb491ed6231d0960de44b9a99a9d4c38a95a2defbf79da703a76 replaces broad callback tracing with exact callback-entry observations and reads sparse objects through the pinned pure JS address translator. All import receivers, arguments and results are forwarded; no guest bytes are written.

Original authenticated subclass 0x57e790 receives WM_PAINT for dialog 0x10002 and all six buttons. The parent calls original 0x580ac0, then the normal dialog proc 0xffff0004. The first button calls original 0x580c00 and reads its text with GetWindowTextA. Sparse bitmap-copy entries now expose the 299×202 menu and 191×26 first-button objects, each with two bytes per pixel. This establishes actual paint delivery; it does not establish correct pixel contents or composition. In particular EDI at the sampled loop is not the destination pointer, so its null byte sample cannot diagnose an empty image. Nested API entry/exit records must not be paired blindly.

The reviewed diagnostic/01-destination.png still shows the blank menu. The raw-canvas collector fails with native canvas type unavailable back: it accepts HTMLCanvasElement, whereas the renderer's _createOffscreen creates OffscreenCanvas when available. surfaces.json is absent. A prepared native OffscreenCanvas prototype read bypasses the host's flush wrappers; its focused JS mock test passes, but it has not run in a browser yet. No generic repair is demonstrated and no gameplay qualification is claimed.

Contained evidence is scratch/runs/20261007-tiberian-destination-preparation/investigation.json, analysis.json and 45 indexed artifacts, including the full pinned package. The observer stops after 15 seconds with no errors; bitmap hooks cap at 4096, callback hooks at 128, callback output at 64, and API entries/exits at 40 each. Ordinary quit closes browser/server with Chrome exit 0 and streams 0. The collector error and missing UI icon icons/apps/tiberian_sun_demo.png are retained. Independent 23:14:41 checks find PIDs 24030/24042 absent, no Chrome, and unchanged listeners. All 355 pins verify before removal of only the owned runtime prefix at 23:14:58. No missing guest fixture/DLL/TLB path was observed.

2026-10-07 demonstrated covering layer and candidate generic repair

The 23:19:16–23:20:05 original run captures native OffscreenCanvas layers via OffscreenCanvas.prototype.convertToBlob, bypassing host flush wrappers. The personally reviewed ordinary screenshot still has the grey menu slab, but surface-65537-dxFrame.png shows the complete, correctly captioned menu. surface-65537-gdiChild.png contains the grey slab at that same location. The canonical DirectDraw backing (surface-65537-back.png) has title artwork. This demonstrates that original guest menu painting succeeds and the retained shared GDI child overlay covers the final DirectDraw frame. Numerical layer write ordering was not captured; no timestamp claim is made from these images.

The ordinary and post-processing compositors already omit separate child surfaces overwritten by a newer primary present, but always composite shared GDI child regions afterward. The candidate applies the same ordering rule to shared regions. Accepted GDI uploads retain non-overlapping rectangles with their write sequences; a new upload splits previously recorded coverage only where it overlaps. Lazy canvas flushes cannot revive old uploads. Only the intersection of visible native child regions and uploads newer than the primary composites. A newer control upload cannot revive another child's old background. No application name, HWND, dimensions, or guest state is special-cased. The focused pixel regression fails on the original renderer at the exact overwritten-child assertion and passes with the candidate, covering ordinary output and both post-processing routes. Root review identified a whole-canvas freshness flaw in initial candidate 5c5b128e1: repainting child A also revives stale child B. A real host-upload two-child pixel regression reproduces that exact failure and passes with rectangle coverage tracking, including both post-processing paths. Its contained first-candidate failure is scratch/runs/20261007-tiberian-repair-preparation/whole-canvas-regression-result.json. The existing nine GDI checks also pass, including upload-versus-flush order and empty-upload behavior. Coverage tracking is restricted to a canvas actually retained as the exclusive shared GDI child overlay. Ordinary desktop/window GDI surfaces keep no rectangle ledger. At primary composition boundaries, obsolete coverage is discarded; there is no rectangle cap that could lose visible pixels. A fragmented-upload regression runs 32 primary epochs with 16 distinct pixel uploads each and verifies zero old regions at each boundary and only the 16 current regions afterward. The two-child test still verifies that newer A remains visible and older B stays covered in ordinary and both post-processing outputs. This source candidate awaits a newly built, identified module and ordinary runtime/gameplay validation; it is not a completed new-game lane.

Contained evidence is scratch/runs/20261007-tiberian-composition-preparation/investigation.json and analysis.json, with 49 indexed artifacts including all three reviewed raw layers, the ordinary screenshot, complete original pinned package, and the baseline regression failure. Ordinary quit closes browser/server with Chrome exit 0, no cleanup errors and streams 0. Independent 23:20:53 checks find actual PIDs 34442/34454 absent, no Chrome and original listeners. All 355 runtime pins verify before removing only the owned prefix at 23:21:07.

2026-10-07 ordinary menu repair validated; campaign input unresolved

Source candidate 61ac72804e0c0ebd3b130fa5f098f7a94373aed4 passes the full build at 23:34:42–23:34:58. All 910 src/lib/tools/fonts hashes remain unchanged across compilation. The newly built 1,720,920-byte module hashes to 7c6864f8e224a0d42c6743b3c088ce79349101182295b79b1e4fa8a4c3911cc0, the same as baseline because this repair changes JavaScript only. The ordinary runtime uses exact committed Worker 6f42f2b0c8d67acd6f3890ad893141ed571d7543d658e8ef3917e6a8d43a88d7 and WorkerLink, with no callback/bitmap observer injection. Original private APPS/visible-option routing, all 26 original demo files, and the complete DLL/TLB closure remain unchanged; 355 runtime pins and 29 aliases verify.

The personally reviewed normal screenshot diagnostic/01-ordinary-menu.png (3631ab8e…) now displays all six original menu buttons and captions. The grey covering slab is gone. The remaining three normal screenshots also show the correct menu. This validates the generic first-paint repair in ordinary presentation; it does not qualify the new-game lane as complete.

One ordinary click at page (305,455) on the reviewed New Campaign button produces page input records WM_LBUTTONDOWN/UP for HWND 0x10004, but the screen remains at the menu. These records do not prove that the original guest callback or parent WM_COMMAND receives the event. An earlier commentary claim of command delivery was corrected. No campaign or player-controlled gameplay is observed. An Enter command queued at 23:47:25 is rejected by the input deadline reserve and is not performed; its error is retained. Next measure the owning mouse callback, native button tracking/point contract and parent command route. No additional input repair is demonstrated yet.

Contained evidence is scratch/runs/20261007-tiberian-repair-preparation/investigation.json, analysis.json, result.json and indexed artifacts, including full ordinary fixture/runtime archive, all four reviewed normal screenshots, source/build/terminal receipts and actual commands. Runtime is 23:44:36–23:47:34 under a 180-second guard. Ordinary quit closes browser/server, Chrome exits 0 and streams drain to 0. The one rejected-input guard error is a collector limitation, not an observed guest fault. Independent 23:48:48 checks find actual PIDs 24300/24312 absent, no Chrome and baseline listeners. All 355 pins verify again before removing only the owned prefix at 23:49:14 and releasing the browser slot to Winamp.

Continuation and exact input blocker: fresh input worker handoff. Root requested thread rotation after accepting the rendering repair; no further runtime action occurs in this worker.

2026-10-08 ordinary pointer receipt and Enter performed

Fresh worker uses exact accepted source 61ac72804 and module 7c6864f8…, original Worker 6f42f2b0…, all 355 runtime pins and 29 aliases, with page-only DOM/renderer receipts. No guest CPU, memory, export, callback or return is modified or sampled. Full contained runtime archive and 13 diagnostic outputs are in scratch/runs/20261007T235800Z-tiberian-input-preparation.

Three ordinary screenshots were personally reviewed: the restored six-button main menu, after New Campaign click, and after Enter. All remain the main menu. Page (305,455) maps to native (316,213) through canvas DOM rectangle (10,224,597,511) and presentation viewport destination (0,31,597,448). The actual press targets HWND 0x10004, retaining origin (224,203) and local (92,10), lParam 0x000a005c. Both queued down and up retain that point and target. The synchronous trace confirms the native-child routing branch; the after-up queue holds WM_LBUTTONUP. This establishes the page producer contract for this click; it does not establish owning callback delivery, CallWindowProc chaining, native button tracking or parent WM_COMMAND.

Unlike the prior deadline-rejected Enter, a real 750-ms Enter down/up was performed after the reviewed after-click scene, well within the actual 180-second runtime guard. The next screenshot remains the menu. No campaign, mission, player-controlled movement or generic input fix is demonstrated. Next capture coherent import-boundary receipts in the owning Worker, including GetMessage/PeekMessage output, DispatchMessage, CallWindowProc, native button state/capture and parent command delivery. Do not infer those from the page queue or independent CPU getter samples.

Actual run: 00:03:35.994–00:05:18.675 UTC, Chrome 151.0.7922.108, ordinary Worker backend. Ordinary quit closes browser/server, Chrome exits 0, errors and remaining streams are 0. Independent 00:05:50 finds actual driver48726 and Chrome48738 absent, no Chrome and baseline listeners. All 355 runtime pins and all 13 copied diagnostics rehash unchanged before only the owned remote prefix is removed. Remote slot released to queued Quake II at 00:05:58.

2026-10-08 owning ordinary release and parent command measured

Self-contained run 20261008T002800Z-tiberian-release-preparation retains the accepted original source61ac72804/module7c6864f8 and original SUN f70dcf32, 355runtime pins (353unchanged plus two explicit read-only Worker/Link receipt overlays), baseline archive78a92aa0 and eleven-file overlayeb735bad. Browser ran00:34:48–00:36:05 UTC; two personally reviewed ordinary screenshots show the same six-button menu. One ordinary New Campaign click used page305,455, from the current reviewed scene. No campaign or movement is qualified.

Release-phase observation starts only after original check_input returns WM_LBUTTONUP. Owning slot0/tid1 records26rows over9ms: unchanged UP HWND10004/msg202/wParam0/lParam000a005c enters GetMessage and DispatchMessage; original subclass caller57eec7 chains580c00 and original button caller5812ff chainsnativeffff0002. Native flags60d become0c and capture becomes0. The native button posts parent10002/WM_COMMAND111/id1559/lParam10004. Peek/Get/Dispatch receives that command, original subclass chains parentoriginal580ac0, and that procedure chains native dialogffff0004. Missing UP or BN_CLICKED notification is therefore ruled out. Actual stored DLGPROC entry/return remains unmeasured. Handler-exit receipts do not claim the guest callback returned. The observer later consumes65532/65536 read bytes; worker1 has0rows/0reads before its release phase. No source input repair is established by this run.

Static original DLGPROC4dea40 disassembly shows WM_COMMAND1559 selects the branch4deae5, writing1 through EAX after GetWindowLongA(hwnd,8), then returning FALSE. This is a static contract, not proof that this branch ran. Root identified a generic path asymmetry: CallWindowProc's native dialog marker executes dialog_default_proc synchronously, whereas direct DispatchMessage and DefDlgProc tail-dispatch WM_COMMAND to preserve a live nested modal stack. Next reproduce this with a subclassed dialog whose stored DLGPROC enters a nested modal loop, before deciding on a generic fix or another original-game probe. Preserve original game state/results; do not force menu commands.

Actual ordinary quit closes browser/server, Chromeexit0/errors0/streams0. Independent00:36:37 verifies driver24552/Chrome24564 absent, noChrome and exact baseline sockets, all355runtime pins and12durable diagnostic copies unchanged. Only the owned runtime prefix was removed after copies. Remote slot released 00:36:51; parent owns retained box lifecycle and queued Antara priority.