Support parented camera capture matrices

1 files changed, 530 insertions, 33 deletions

diff --git a/tools/native-frame-capture/NativeFrameCapture.Readback.cs b/tools/native-frame-capture/NativeFrameCapture.Readback.cs
index 872487b..35b1844 100644
--- a/tools/native-frame-capture/NativeFrameCapture.Readback.cs
+++ b/tools/native-frame-capture/NativeFrameCapture.Readback.cs
@@ -14,6 +14,7 @@ using System.Drawing.Imaging;
 internal static partial class NativeFrameCapture
 {
     private const uint NgiRendererGlobalRva = 0x3A460;
+    private const uint NgiLastErrorGlobalRva = 0x3A464;
     private const uint NgiDeviceGlobalRva = 0x3A488;
     private const uint NgiRendererVtableRva = 0x315E0;
     private const uint NgiWindowedPresentRva = 0x6E1B;
@@ -55,9 +56,12 @@ internal static partial class NativeFrameCapture
     private const uint CameraSetterMatrixOffset = 64;
     private const uint CameraTransformInterfaceVtableRva = 0x66558;
     private const uint CameraTransformSetterRva = 0x54C70;
+    private const uint CameraTransformGetterRva = 0x55110;
     private const uint CameraTransformInvalidatorRva = 0x55280;
     private const uint CameraTransformSetterSlotOffset = 0x1C;
+    private const uint CameraTransformGetterSlotOffset = 0x20;
     private const uint CameraTransformInvalidatorSlotOffset = 0x30;
+    private const uint CameraSetterWorldMatrixPointerOffset = 128;
     private const uint RenderFunctionStackFrameBytes = 0x70;
 
     [StructLayout(LayoutKind.Sequential)]
@@ -125,6 +129,8 @@ internal static partial class NativeFrameCapture
     private sealed class CameraReadback
     {
         public uint Camera;
+        public uint Parent;
+        public bool Parented;
         public uint Vtable;
         public uint TransformInterface;
         public uint TransformVtable;
@@ -133,13 +139,21 @@ internal static partial class NativeFrameCapture
         public uint ReturnAddress;
         public uint SelectorField;
         public uint[] Words;
+        public uint[] EffectiveWorldWords;
         public byte[] EntryMatrixBytes;
         public byte[] ProjectionMatrixBytes;
+        public byte[] EntryEffectiveWorldMatrixBytes;
+        public byte[] ProjectionEffectiveWorldMatrixBytes;
         public bool CurrentAtProjectionVerified;
+        public bool EffectiveWorldAtProjectionVerified;
         public bool WordsChangedAtProjection;
+        public bool EffectiveWorldChangedAtProjection;
         public string EntryMatrixSha256;
         public string ProjectionMatrixSha256;
+        public string EntryEffectiveWorldMatrixSha256;
+        public string ProjectionEffectiveWorldMatrixSha256;
         public bool MatrixFinite;
+        public bool EffectiveWorldMatrixFinite;
         public bool LayoutVerified;
         public string Failure;
     }
@@ -147,8 +161,13 @@ internal static partial class NativeFrameCapture
     private sealed class SelectedCameraInput
     {
         public string Path;
+        public bool Synthetic;
+        public bool ParentedCamera;
+        public bool UsedEffectiveWorldMatrix;
         public byte[] MatrixBytes;
         public uint[] MatrixWords;
+        public byte[] Selector0MatrixBytes;
+        public uint[] Selector0MatrixWords;
         public string MatrixSha256;
         public int[] Viewport;
         public float Near;
@@ -539,17 +558,92 @@ internal static partial class NativeFrameCapture
         return result;
     }
 
-    private static RemoteCode BuildCameraSetterStub(uint allocationBase, uint transformInterface)
+    // Boundary tracing only asks the already-active D3D7 device for its current
+    // render target, records the returned interface pointer, and balances the
+    // COM AddRef with Release. It deliberately never locks or reads pixels.
+    private static RemoteCode BuildSurfaceProbeStub(uint allocationBase, uint device)
     {
+        uint data = unchecked(allocationBase + RemoteDataOffset);
+        uint statusAddress = unchecked(data + RemoteDataStatusOffset);
+        uint getHrAddress = unchecked(data + RemoteDataGetHrOffset);
+        uint releaseAddress = unchecked(data + RemoteDataReleaseCountOffset);
+        uint surfaceAddress = unchecked(data + RemoteDataSurfaceOffset);
+        X86CodeBuilder code = new X86CodeBuilder();
+        code.Emit(0xBE); code.EmitU32(device); // mov esi, device
+        code.Emit(0x8B, 0x06);                 // mov eax, [esi]
+        code.Emit(0x8D, 0x3D); code.EmitU32(surfaceAddress); // lea edi, [surface]
+        code.PushReg(0x57); code.PushReg(0x56); // push output; push this
+        code.CallStdCall(8, 0xFF, 0x50, (byte)D3dDeviceGetRenderTargetOffset);
+        code.Emit(0xA3); code.EmitU32(getHrAddress); // mov [getHr], eax
+        code.Emit(0x85, 0xC0);                 // test eax,eax
+        code.JumpIf(0x89, "get_succeeded");   // jns
+        code.Emit(0xC7, 0x05); code.EmitU32(statusAddress); code.EmitU32(9);
+        code.Jump("release_surface");
+        code.Mark("get_succeeded");
+        code.Emit(0x8B, 0x35); code.EmitU32(surfaceAddress); // mov esi,[surface]
+        code.Emit(0x85, 0xF6);                 // test esi,esi
+        code.JumpIf(0x84, "no_surface");
+        code.Emit(0xC7, 0x05); code.EmitU32(statusAddress); code.EmitU32(8);
+        code.Jump("release_surface");
+        code.Mark("no_surface");
+        code.Emit(0xC7, 0x05); code.EmitU32(statusAddress); code.EmitU32(10);
+        code.Jump("stop");
+        code.Mark("release_surface");
+        code.Emit(0x8B, 0x35); code.EmitU32(surfaceAddress);
+        code.Emit(0x85, 0xF6);
+        code.JumpIf(0x84, "stop");
+        code.Emit(0x8B, 0x06);
+        code.PushReg(0x56);
+        code.CallStdCall(4, 0xFF, 0x50, (byte)DdSurfaceReleaseOffset);
+        code.Emit(0xA3); code.EmitU32(releaseAddress);
+        code.Mark("stop");
+        code.EmitTerminalInt3();
+        byte[] bytes = code.Finish();
+        code.AssertTerminalControlFlow(bytes, 6);
+        if (code.MaxCallStackBytes != 12 || bytes.Length > RemoteCodePage)
+            throw new InvalidOperationException("Surface probe stub has an unexpected stack footprint or size.");
+        RemoteCode result = new RemoteCode();
+        result.Base = allocationBase;
+        result.DataBase = data;
+        result.Bytes = bytes;
+        result.CallInstructionOffsets = code.CallInstructionOffsets;
+        result.MaxCallStackBytes = code.MaxCallStackBytes;
+        result.TrapAddress = unchecked(allocationBase + (uint)code.TerminalOffset);
+        return result;
+    }
+
+    private static byte CameraSetterMode(CameraSetterPhase phase)
+    {
+        // Native setter mode 2 treats the supplied matrix as world space and
+        // converts it relative to camera+0x0C. Restoring a captured +0x20
+        // selector-0 value must use local mode 1.
+        return phase == CameraSetterPhase.Apply ? (byte)2 : (byte)1;
+    }
+
+    private static RemoteCode BuildCameraSetterStub(uint allocationBase, uint transformInterface, byte mode)
+    {
+        if (mode != 1 && mode != 2)
+            throw new ArgumentOutOfRangeException("mode", "Only verified local and world camera setter modes are supported.");
         uint dataBase = unchecked(allocationBase + RemoteDataOffset);
         uint matrixAddress = unchecked(dataBase + CameraSetterMatrixOffset);
         X86CodeBuilder code = new X86CodeBuilder();
         code.Emit(0xBE); code.EmitU32(transformInterface); // mov esi, transform interface
         code.Emit(0x8B, 0x0E);                           // mov ecx, [esi] (verified vtable)
         code.PushImm32(matrixAddress);                   // argument 3: 64-byte transform
-        code.PushImm8(1);                                // argument 2: mode 1
+        code.PushImm8(mode);                             // argument 2: native transform space
         code.PushReg(0x56);                              // argument 1: this
         code.CallStdCall(12, 0xFF, 0x51, (byte)CameraTransformSetterSlotOffset);
+        if (mode == 2)
+        {
+            // Mode 2 stores a parent-relative local matrix and invalidates the
+            // effective-world cache at transformInterface+0x11C (camera+0x120). The selector-2 getter
+            // recomputes camera+0x60 before the caller verifies the new pose.
+            code.Emit(0x8B, 0x0E);                       // mov ecx, [esi] (verified vtable)
+            code.PushImm32(unchecked(dataBase + CameraSetterWorldMatrixPointerOffset));
+            code.PushImm8(2);                            // selector 2: effective world matrix
+            code.PushReg(0x56);                          // argument 1: transform interface
+            code.CallStdCall(12, 0xFF, 0x51, (byte)CameraTransformGetterSlotOffset);
+        }
         code.EmitTerminalInt3();
         byte[] bytes = code.Finish();
         code.AssertTerminalControlFlow(bytes, 0);
@@ -575,16 +669,19 @@ internal static partial class NativeFrameCapture
         bool modeRead = ReadExact(process, unchecked(camera + 0x1A0), modeBytes);
         uint transformVtable = ReadU32(process, transformInterface);
         uint setter = ReadU32(process, unchecked(transformVtable + CameraTransformSetterSlotOffset));
+        uint getter = ReadU32(process, unchecked(transformVtable + CameraTransformGetterSlotOffset));
         uint invalidate = ReadU32(process, unchecked(transformVtable + CameraTransformInvalidatorSlotOffset));
         bool valid = terrainBase != 0
             && primaryVtable == unchecked(terrainBase + ExternalCameraVtableRva)
             && transformVtable == unchecked(terrainBase + CameraTransformInterfaceVtableRva)
             && setter == unchecked(terrainBase + CameraTransformSetterRva)
+            && getter == unchecked(terrainBase + CameraTransformGetterRva)
             && invalidate == unchecked(terrainBase + CameraTransformInvalidatorRva)
             && selector == 0xFFFFFFFF && modeRead && modeBytes[0] == 0;
         evidence = "camera=0x" + camera.ToString("X8") + " primaryVtable=0x" + primaryVtable.ToString("X8")
             + " transform=0x" + transformInterface.ToString("X8") + " transformVtable=0x" + transformVtable.ToString("X8")
-            + " setter=0x" + setter.ToString("X8") + " invalidator=0x" + invalidate.ToString("X8")
+            + " setter=0x" + setter.ToString("X8") + " getter=0x" + getter.ToString("X8")
+            + " invalidator=0x" + invalidate.ToString("X8")
             + " selector=0x" + selector.ToString("X8")
             + " mode=" + (modeRead ? modeBytes[0].ToString(CultureInfo.InvariantCulture) : "unreadable")
             + " valid=" + valid;
@@ -603,8 +700,11 @@ internal static partial class NativeFrameCapture
         uint transformInterface;
         if (!VerifyCameraSetterAbi(process, terrainBase, camera, out transformInterface, out abiEvidence))
             throw new InvalidOperationException("Camera setter ABI refused: " + abiEvidence);
+        byte setterMode = CameraSetterMode(phase);
         Log("verified native camera setter ABI " + abiEvidence + " slot=+0x1C this=0x"
-            + transformInterface.ToString("X8") + " mode=1 matrixBytes=64 ret=0x0C");
+            + transformInterface.ToString("X8") + " mode=" + setterMode
+            + " matrixSpace=" + (phase == CameraSetterPhase.Apply ? "world" : "local")
+            + " matrixBytes=64 ret=0x0C");
 
         uint expectedEip = unchecked(resumeBreakpoint.Address + 1);
         uint originalEip = BitConverter.ToUInt32(originalContext, ContextEipOffset);
@@ -639,7 +739,7 @@ internal static partial class NativeFrameCapture
         {
             uint safeEsp = ComputeSafeNativeStackPointer(process, thread, originalContext);
             region = AllocateReadbackRegion(process);
-            RemoteCode code = BuildCameraSetterStub(region, transformInterface);
+            RemoteCode code = BuildCameraSetterStub(region, transformInterface, setterMode);
             WriteRemoteStub(process, code, false);
             UIntPtr written;
             if (!WriteProcessMemory(process, Ptr(unchecked(code.DataBase + CameraSetterMatrixOffset)), matrixBytes,
@@ -732,6 +832,46 @@ internal static partial class NativeFrameCapture
         return matrix;
     }
 
+    private static uint ReadCameraParent(IntPtr process, uint camera)
+    {
+        if (camera == 0 || camera > UInt32.MaxValue - 0x0C)
+            throw new InvalidOperationException("Camera pointer is outside the verified parent-field range.");
+        return ReadU32(process, unchecked(camera + 0x0C));
+    }
+
+    private static byte[] ReadEffectiveWorldCameraMatrix(IntPtr process, uint camera)
+    {
+        byte[] matrix = new byte[64];
+        if (camera == 0 || camera > UInt32.MaxValue - 0x60
+            || !ReadExact(process, unchecked(camera + 0x60), matrix))
+            throw new InvalidOperationException("Could not read the native effective-world camera matrix at camera+0x60.");
+        return matrix;
+    }
+
+    private static uint[] MatrixWords(byte[] matrixBytes)
+    {
+        if (matrixBytes == null || matrixBytes.Length != 64)
+            throw new ArgumentException("A camera matrix must contain exactly 64 bytes.", "matrixBytes");
+        uint[] words = new uint[16];
+        for (int i = 0; i < words.Length; i++)
+            words[i] = BitConverter.ToUInt32(matrixBytes, i * 4);
+        return words;
+    }
+
+    private static bool CameraMatricesNearlyEqual(byte[] left, byte[] right)
+    {
+        if (left == null || right == null || left.Length != 64 || right.Length != 64) return false;
+        const double absoluteTolerance = 0.001;
+        for (int i = 0; i < 16; i++)
+        {
+            float a = BitConverter.ToSingle(left, i * 4);
+            float b = BitConverter.ToSingle(right, i * 4);
+            if (!IsFinite(a) || !IsFinite(b) || Math.Abs((double)a - b) > absoluteTolerance)
+                return false;
+        }
+        return true;
+    }
+
     private static bool CameraFunctionStackMatches(CameraSetterPhase phase, byte[] stackWords,
         uint expectedReturnAddress, uint camera)
     {
@@ -891,6 +1031,7 @@ internal static partial class NativeFrameCapture
             session.OriginalContext = originalContext;
             session.PresentStackArguments = presentStackArguments;
             session.PresentStackArgumentsIntact = true;
+            session.ValidatePresentStackArguments = true;
             session.RemoteContextIntact = true;
             session.PresentBreakpoint = present;
             session.Frame = frame;
@@ -915,6 +1056,188 @@ internal static partial class NativeFrameCapture
         finally { CloseHandle(thread); }
     }
 
+    private static RemoteReadbackSession StartRemoteBoundaryReadback(IntPtr process, uint threadId,
+        uint ngiBase, BreakpointInfo boundary, FrameSnapshot frame, string outputJson,
+        BreakpointInfo[] allBreakpoints)
+    {
+        uint device;
+        uint getRenderTarget;
+        string evidence;
+        if (!VerifyD3d7GetRenderTarget(process, ngiBase, out device, out getRenderTarget, out evidence))
+            throw new InvalidOperationException("D3D7 EndScene render-target readback was refused: " + evidence);
+        uint renderer = ReadU32Exact(process, unchecked(ngiBase + NgiRendererGlobalRva));
+        if (frame == null || frame.Projection == null || !frame.Projection.Verified
+            || frame.Projection.Renderer != renderer
+            || ReadU32Exact(process, renderer) != unchecked(ngiBase + NgiRendererVtableRva))
+            throw new InvalidOperationException("EndScene readback renderer changed since the selected projection snapshot.");
+        if (ReadU32Exact(process, unchecked(renderer + 0x114)) == 0)
+            throw new InvalidOperationException("Ngi32 is not in the verified windowed render-target path.");
+
+        IntPtr thread = OpenThread(ThreadGetContext | ThreadSetContext | ThreadQueryInformation, false, threadId);
+        if (thread == IntPtr.Zero)
+            throw new InvalidOperationException("OpenThread for selected EndScene readback failed: " + Marshal.GetLastWin32Error());
+        uint region = 0;
+        try
+        {
+            byte[] originalContext = GetFullX86Context(thread);
+            if (boundary == null || BitConverter.ToUInt32(originalContext, ContextEipOffset)
+                != unchecked(boundary.Address + 1))
+                throw new InvalidOperationException("Selected EndScene EIP did not match its verified post-call boundary.");
+            uint safeEsp = ComputeSafeNativeStackPointer(process, thread, originalContext);
+            region = AllocateReadbackRegion(process);
+            RemoteCode acquire = BuildReadbackStub(region, device, false);
+            WriteRemoteStub(process, acquire, true);
+            BreakpointInfo[] suspended;
+            if (!SuspendBreakpointsWhileStopped(process, allBreakpoints, out suspended))
+                throw new InvalidOperationException("Could not suspend every armed breakpoint before EndScene readback.");
+            RemoteReadbackSession session = new RemoteReadbackSession();
+            session.Acquire = acquire;
+            session.Region = region;
+            session.ThreadId = threadId;
+            session.SafeEsp = safeEsp;
+            session.OriginalContext = originalContext;
+            session.PresentStackArgumentsIntact = true;
+            session.ValidatePresentStackArguments = false;
+            session.RemoteContextIntact = true;
+            session.PresentBreakpoint = boundary;
+            session.ResumeBreakpoint = boundary;
+            session.SuspendedBreakpoints = suspended;
+            session.Frame = frame;
+            session.Generation = frame.CameraGeneration;
+            session.OutputJson = outputJson;
+            session.OutputPng = Path.ChangeExtension(outputJson, ".png");
+            session.DeadlineUtc = DateTime.UtcNow.AddSeconds(5);
+            session.Phase = RemoteReadbackPhase.Acquire;
+            session.PixelBoundary = "Ngi32 EndScene after selected World3D projection, before Present";
+            Log("BOUNDARY_READBACK_STARTED kind=" + boundary.Name + " tid=" + threadId
+                + " device=0x" + device.ToString("X8") + " renderer=0x" + renderer.ToString("X8")
+                + " generation=" + session.Generation + " stub=0x" + acquire.Base.ToString("X8")
+                + " suspendedBreakpoints=" + suspended.Length + " presentStackArgs=not-applicable");
+            SetFullX86Context(thread, ContextForRemoteCode(originalContext, acquire.Base, safeEsp));
+            return session;
+        }
+        catch
+        {
+            if (region != 0) VirtualFreeEx(process, Ptr(region), UIntPtr.Zero, 0x8000);
+            throw;
+        }
+        finally { CloseHandle(thread); }
+    }
+
+    private static bool SuspendBreakpointsWhileStopped(IntPtr process, BreakpointInfo[] candidates,
+        out BreakpointInfo[] suspended)
+    {
+        List<BreakpointInfo> active = new List<BreakpointInfo>();
+        if (candidates != null)
+            for (int i = 0; i < candidates.Length; i++)
+            {
+                BreakpointInfo breakpoint = candidates[i];
+                if (breakpoint == null || !breakpoint.Armed || active.Contains(breakpoint)) continue;
+                active.Add(breakpoint);
+                if (!WriteByte(process, breakpoint.Address, breakpoint.OriginalByte))
+                {
+                    bool rollbackSucceeded = true;
+                    foreach (BreakpointInfo suspendedBreakpoint in active)
+                    {
+                        if (!WriteByte(process, suspendedBreakpoint.Address, 0xCC))
+                        {
+                            rollbackSucceeded = false;
+                            Log("FATAL boundary probe could not roll back breakpoint suspension for "
+                                + suspendedBreakpoint.Name + " error=" + Marshal.GetLastWin32Error());
+                        }
+                        // Leave this true even after a failed write so final cleanup retries
+                        // restoring the original byte before any detach.
+                        suspendedBreakpoint.Armed = true;
+                    }
+                    suspended = active.ToArray();
+                    Log("BOUNDARY_PROBE_SUSPEND_FAILED name=" + breakpoint.Name
+                        + " rollbackSucceeded=" + rollbackSucceeded);
+                    return false;
+                }
+                breakpoint.Armed = false;
+                Log("BOUNDARY_PROBE_BREAKPOINT_SUSPENDED " + breakpoint.Name);
+            }
+        suspended = active.ToArray();
+        return true;
+    }
+
+    private static void RearmSuspendedBreakpoints(IntPtr process, RemoteReadbackSession session)
+    {
+        if (session == null || session.SuspendedBreakpoints == null) return;
+        foreach (BreakpointInfo breakpoint in session.SuspendedBreakpoints)
+        {
+            if (breakpoint == null || breakpoint == session.ResumeBreakpoint) continue;
+            if (!WriteByte(process, breakpoint.Address, 0xCC))
+                throw new InvalidOperationException("Could not re-arm suspended boundary probe breakpoint " + breakpoint.Name);
+            breakpoint.Armed = true;
+            Log("BOUNDARY_PROBE_BREAKPOINT_REARMED " + breakpoint.Name);
+        }
+        if (session.ResumeBreakpoint != null) session.ResumeBreakpoint.Armed = true;
+    }
+
+    private static RemoteReadbackSession StartRemoteSurfaceProbe(IntPtr process, uint threadId,
+        uint ngiBase, BreakpointInfo resumeBreakpoint, FrameSnapshot frame,
+        BreakpointInfo[] allBreakpoints)
+    {
+        uint device;
+        uint getRenderTarget;
+        string evidence;
+        if (!VerifyD3d7GetRenderTarget(process, ngiBase, out device, out getRenderTarget, out evidence))
+            throw new InvalidOperationException("D3D7 surface probe refused: " + evidence);
+        uint renderer = ReadU32Exact(process, unchecked(ngiBase + NgiRendererGlobalRva));
+        if (frame == null || frame.Projection == null || !frame.Projection.Verified
+            || frame.Projection.Renderer != renderer
+            || ReadU32Exact(process, renderer) != unchecked(ngiBase + NgiRendererVtableRva))
+            throw new InvalidOperationException("Surface probe renderer did not match the verified active projection snapshot.");
+        Log("BOUNDARY_PROBE_GET_RENDER_TARGET_ABI " + evidence + " renderer=0x" + renderer.ToString("X8")
+            + " beginScene=" + (ReadU32Exact(process, unchecked(renderer + 0x118)) >> 8 & 0xFF));
+
+        IntPtr thread = OpenThread(ThreadGetContext | ThreadSetContext | ThreadQueryInformation, false, threadId);
+        if (thread == IntPtr.Zero) throw new InvalidOperationException("OpenThread for D3D7 boundary probe failed: " + Marshal.GetLastWin32Error());
+        uint region = 0;
+        try
+        {
+            byte[] originalContext = GetFullX86Context(thread);
+            if (resumeBreakpoint == null || BitConverter.ToUInt32(originalContext, ContextEipOffset)
+                != unchecked(resumeBreakpoint.Address + 1))
+                throw new InvalidOperationException("Boundary probe EIP did not match the verified breakpoint.");
+            uint safeEsp = ComputeSafeNativeStackPointer(process, thread, originalContext);
+            region = AllocateReadbackRegion(process);
+            RemoteCode code = BuildSurfaceProbeStub(region, device);
+            WriteRemoteStub(process, code, true);
+            BreakpointInfo[] suspended;
+            if (!SuspendBreakpointsWhileStopped(process, allBreakpoints, out suspended))
+                throw new InvalidOperationException("Could not suspend every armed breakpoint before the read-only surface query.");
+            RemoteReadbackSession session = new RemoteReadbackSession();
+            session.Acquire = code;
+            session.Region = region;
+            session.ThreadId = threadId;
+            session.SafeEsp = safeEsp;
+            session.OriginalContext = originalContext;
+            session.RemoteContextIntact = true;
+            session.PresentBreakpoint = resumeBreakpoint;
+            session.ResumeBreakpoint = resumeBreakpoint;
+            session.SuspendedBreakpoints = suspended;
+            session.SurfaceProbeOnly = true;
+            session.Frame = frame;
+            session.Generation = frame.CameraGeneration;
+            session.DeadlineUtc = DateTime.UtcNow.AddSeconds(5);
+            session.Phase = RemoteReadbackPhase.Acquire;
+            SetFullX86Context(thread, ContextForRemoteCode(originalContext, code.Base, safeEsp));
+            Log("BOUNDARY_PROBE_STARTED kind=" + resumeBreakpoint.Name + " tid=" + threadId
+                + " device=0x" + device.ToString("X8") + " renderer=0x" + renderer.ToString("X8")
+                + " generation=" + session.Generation + " stub=0x" + code.Base.ToString("X8")
+                + " lockCalled=false");
+            return session;
+        }
+        catch
+        {
+            if (region != 0) VirtualFreeEx(process, Ptr(region), UIntPtr.Zero, 0x8000);
+            throw;
+        }
+        finally { CloseHandle(thread); }
+    }
+
     private static void BeginRemoteCleanup(IntPtr process, RemoteReadbackSession session)
     {
         session.Cleanup = BuildReadbackStub(session.Region, 0, true);
@@ -1337,15 +1660,18 @@ internal static partial class NativeFrameCapture
             uint returnAddress = ReadU32(process, esp);
             uint camera = ReadU32(process, unchecked(esp + 4));
             uint vtable = ReadU32(process, camera);
+            uint parent = ReadCameraParent(process, camera);
             uint transformInterface = unchecked(camera + 4);
             uint transformVtable = ReadU32(process, transformInterface);
             uint selectorField = ReadU32(process, unchecked(camera + 0x10));
             byte[] modeBytes = new byte[1];
             byte cameraMode = ReadExact(process, unchecked(camera + 0x1A0), modeBytes) ? modeBytes[0] : (byte)0xFF;
             byte[] matrixBytes = new byte[64];
-            if (camera == 0 || !ReadExact(process, unchecked(camera + 0x20), matrixBytes))
+            byte[] effectiveWorldMatrixBytes = new byte[64];
+            if (camera == 0 || !ReadExact(process, unchecked(camera + 0x20), matrixBytes)
+                || !ReadExact(process, unchecked(camera + 0x60), effectiveWorldMatrixBytes))
             {
-                result.Failure = "World3D camera argument or 64-byte selector matrix was unreadable";
+                result.Failure = "World3D camera argument, selector-0 matrix, or effective-world matrix was unreadable";
                 return result;
             }
             uint[] words = new uint[16];
@@ -1355,6 +1681,15 @@ internal static partial class NativeFrameCapture
                 words[i] = BitConverter.ToUInt32(matrixBytes, i * 4);
                 if (!IsFinite(BitConverter.ToSingle(matrixBytes, i * 4))) matrixFinite = false;
             }
+            uint[] effectiveWorldWords = MatrixWords(effectiveWorldMatrixBytes);
+            bool effectiveWorldMatrixFinite = true;
+            for (int i = 0; i < effectiveWorldWords.Length; i++)
+                if (!IsFinite(BitConverter.ToSingle(effectiveWorldMatrixBytes, i * 4)))
+                    effectiveWorldMatrixFinite = false;
+            string worldMatrixFailure = null;
+            bool effectiveWorldMatrixRigid = effectiveWorldMatrixFinite
+                && IsOrthonormalAffineCamera(effectiveWorldMatrixBytes, out worldMatrixFailure);
+            if (!effectiveWorldMatrixFinite) worldMatrixFailure = "effective-world matrix contains a nonfinite value";
             uint expectedVtable = unchecked(terrainBase + ExternalCameraVtableRva);
             uint expectedTransformVtable = unchecked(terrainBase + 0x66558);
             uint setterSlot = ReadU32(process, unchecked(transformVtable + 0x1C));
@@ -1363,6 +1698,8 @@ internal static partial class NativeFrameCapture
                 && setterSlot == unchecked(terrainBase + 0x54C70)
                 && invalidateSlot == unchecked(terrainBase + 0x55280);
             result.Camera = camera;
+            result.Parent = parent;
+            result.Parented = parent != 0;
             result.Vtable = vtable;
             result.TransformInterface = transformInterface;
             result.TransformVtable = transformVtable;
@@ -1371,14 +1708,19 @@ internal static partial class NativeFrameCapture
             result.ReturnAddress = returnAddress;
             result.SelectorField = selectorField;
             result.Words = words;
+            result.EffectiveWorldWords = effectiveWorldWords;
             result.EntryMatrixBytes = (byte[])matrixBytes.Clone();
+            result.EntryEffectiveWorldMatrixBytes = (byte[])effectiveWorldMatrixBytes.Clone();
             result.EntryMatrixSha256 = HashBytes(matrixBytes);
+            result.EntryEffectiveWorldMatrixSha256 = HashBytes(effectiveWorldMatrixBytes);
             result.MatrixFinite = matrixFinite;
+            result.EffectiveWorldMatrixFinite = effectiveWorldMatrixRigid;
             result.LayoutVerified = terrainBase != 0 && vtable == expectedVtable
-                && setterAbiVerified && cameraMode == 0
+                && setterAbiVerified && cameraMode == 0 && effectiveWorldMatrixRigid
                 && selectorField == 0xFFFFFFFF && matrixFinite;
             if (!result.LayoutVerified)
-                result.Failure = "external camera primary/transform vtables, setter slots, normal mode, selector field, or matrix finite check failed";
+                result.Failure = "external camera primary/transform vtables, setter slots, normal mode, selector field, local matrix, or effective-world matrix check failed"
+                    + (effectiveWorldMatrixRigid ? "" : ": " + worldMatrixFailure);
             return result;
         }
         finally
@@ -1537,26 +1879,75 @@ internal static partial class NativeFrameCapture
     private static SelectedCameraInput ParseSelectedCameraJson(string json, string sourcePath)
     {
         Dictionary<string, object> root = ParseJsonObject(json);
-        bool renderInputUsable = RequiredJsonField(root, "render_input_usable") is bool
-            && (bool)RequiredJsonField(root, "render_input_usable");
+        object renderInputUsableValue;
+        bool renderInputUsable = root.TryGetValue("render_input_usable", out renderInputUsableValue)
+            && renderInputUsableValue is bool && (bool)renderInputUsableValue;
+        object syntheticCameraValue;
+        bool syntheticCamera = root.TryGetValue("synthetic_camera", out syntheticCameraValue)
+            && syntheticCameraValue is bool && (bool)syntheticCameraValue;
+        bool nativeCapture = String.Equals(JsonStringField(root, "capture_status"),
+            "native-frame-captured", StringComparison.Ordinal) && renderInputUsable;
         if (!String.Equals(JsonStringField(root, "schema"), "fparkan-legacy-camera-v1", StringComparison.Ordinal)
-            || !String.Equals(JsonStringField(root, "capture_status"), "native-frame-captured", StringComparison.Ordinal)
-            || !renderInputUsable)
-            throw new InvalidDataException("Camera input must be a usable fparkan-legacy-camera-v1 native capture.");
+            || (!nativeCapture && !syntheticCamera))
+            throw new InvalidDataException("Camera input must be a usable native capture or an explicitly marked synthetic camera with a verified projection tuple.");
 
         SelectedCameraInput input = new SelectedCameraInput();
         input.Path = Path.GetFullPath(sourcePath);
-        object[] words = JsonArrayField(root, "selector0_words");
-        if (words.Length != 16) throw new InvalidDataException("selector0_words must contain exactly 16 uint32 values.");
-        input.MatrixWords = new uint[16];
-        input.MatrixBytes = new byte[64];
-        for (int i = 0; i < words.Length; i++)
+        input.Synthetic = syntheticCamera;
+        object parentedValue;
+        if (root.TryGetValue("parented_camera", out parentedValue))
+        {
+            if (!(parentedValue is bool))
+                throw new InvalidDataException("parented_camera must be a boolean when present.");
+            input.ParentedCamera = (bool)parentedValue;
+        }
+
+        object[] localWords = JsonArrayField(root, "selector0_words");
+        if (localWords.Length != 16) throw new InvalidDataException("selector0_words must contain exactly 16 uint32 values.");
+        input.Selector0MatrixWords = new uint[16];
+        input.Selector0MatrixBytes = new byte[64];
+        for (int i = 0; i < localWords.Length; i++)
         {
             uint word;
-            if (!TryJsonUInt32(words[i], out word))
+            if (!TryJsonUInt32(localWords[i], out word))
                 throw new InvalidDataException("selector0_words contains a value outside uint32 range.");
-            input.MatrixWords[i] = word;
-            Buffer.BlockCopy(BitConverter.GetBytes(word), 0, input.MatrixBytes, i * 4, 4);
+            input.Selector0MatrixWords[i] = word;
+            Buffer.BlockCopy(BitConverter.GetBytes(word), 0, input.Selector0MatrixBytes, i * 4, 4);
+        }
+
+        object worldSpaceValue;
+        object worldWordsValue;
+        bool hasWorldSpace = root.TryGetValue("effective_world_matrix_space", out worldSpaceValue);
+        bool hasWorldWords = root.TryGetValue("effective_world_matrix_words", out worldWordsValue);
+        if (hasWorldSpace != hasWorldWords)
+            throw new InvalidDataException("effective_world_matrix_space and effective_world_matrix_words must be supplied together.");
+        if (hasWorldSpace)
+        {
+            string worldSpace = worldSpaceValue as string;
+            if (!String.Equals(worldSpace, "world", StringComparison.Ordinal))
+                throw new InvalidDataException("effective_world_matrix_space must be 'world'.");
+            IList worldWordList = worldWordsValue as IList;
+            if (worldWordList == null || worldWordList.Count != 16)
+                throw new InvalidDataException("effective_world_matrix_words must contain exactly 16 uint32 values.");
+            input.MatrixWords = new uint[16];
+            input.MatrixBytes = new byte[64];
+            for (int i = 0; i < 16; i++)
+            {
+                uint word;
+                if (!TryJsonUInt32(worldWordList[i], out word))
+                    throw new InvalidDataException("effective_world_matrix_words contains a value outside uint32 range.");
+                input.MatrixWords[i] = word;
+                Buffer.BlockCopy(BitConverter.GetBytes(word), 0, input.MatrixBytes, i * 4, 4);
+            }
+            input.UsedEffectiveWorldMatrix = true;
+        }
+        else
+        {
+            if (input.ParentedCamera)
+                throw new InvalidDataException("A parented camera requires its effective world matrix; selector0_words is local space.");
+            input.MatrixWords = (uint[])input.Selector0MatrixWords.Clone();
+            input.MatrixBytes = (byte[])input.Selector0MatrixBytes.Clone();
+            input.UsedEffectiveWorldMatrix = false;
         }
         string matrixFailure;
         if (!IsOrthonormalAffineCamera(input.MatrixBytes, out matrixFailure))
@@ -1628,11 +2019,49 @@ internal static partial class NativeFrameCapture
             + "\"viewport\":[0,0,1280,1024],\"near_plane\":0.5,\"far_plane\":700,"
             + "\"field_of_view_radians\":1.04,\"projection_mode_byte\":1}";
         SelectedCameraInput parsed = ParseSelectedCameraJson(valid, "input.json");
-        if (parsed.MatrixBytes.Length != 64 || parsed.Viewport[2] != 1280 || parsed.MatrixSha256.Length != 64)
+        if (parsed.MatrixBytes.Length != 64 || parsed.Selector0MatrixBytes.Length != 64
+            || parsed.Viewport[2] != 1280 || parsed.MatrixSha256.Length != 64
+            || parsed.UsedEffectiveWorldMatrix || parsed.MatrixWords[3] != parsed.Selector0MatrixWords[3])
             throw new InvalidOperationException("Camera JSON parser self-check failed on a valid rigid transform.");
+        string parentedWorld = valid.Replace("\"viewport\":",
+            "\"parented_camera\":true,\"effective_world_matrix_space\":\"world\","
+            + "\"effective_world_matrix_words\":[1065353216,0,0,1092616192,0,1065353216,0,1101004800,"
+            + "0,0,1065353216,1106247680,0,0,0,1065353216],\"viewport\":");
+        SelectedCameraInput parsedParentedWorld = ParseSelectedCameraJson(parentedWorld, "parented.json");
+        if (!parsedParentedWorld.ParentedCamera || !parsedParentedWorld.UsedEffectiveWorldMatrix
+            || parsedParentedWorld.MatrixWords[3] != 1092616192
+            || parsedParentedWorld.Selector0MatrixWords[3] != 1065353216)
+            throw new InvalidOperationException("Camera JSON parser did not prefer the effective world matrix while preserving selector-0 local words.");
+        if (CameraMatricesNearlyEqual(parsedParentedWorld.MatrixBytes,
+                parsedParentedWorld.Selector0MatrixBytes)
+            || parsedParentedWorld.Selector0MatrixWords[3] != 1065353216)
+            throw new InvalidOperationException("Camera setter self-check did not keep the original local matrix distinct for restore.");
+        bool rejected;
+        string parentedWithoutWorld = valid.Replace("\"viewport\":", "\"parented_camera\":true,\"viewport\":");
+        rejected = false;
+        try { ParseSelectedCameraJson(parentedWithoutWorld, "bad-parented.json"); }
+        catch (InvalidDataException) { rejected = true; }
+        if (!rejected) throw new InvalidOperationException("Camera JSON parser accepted a parented camera without an effective world matrix.");
+        string wrongWorldSpace = parentedWorld.Replace("\"effective_world_matrix_space\":\"world\"",
+            "\"effective_world_matrix_space\":\"local\"");
+        rejected = false;
+        try { ParseSelectedCameraJson(wrongWorldSpace, "bad-space.json"); }
+        catch (InvalidDataException) { rejected = true; }
+        if (!rejected) throw new InvalidOperationException("Camera JSON parser accepted a non-world effective matrix marker.");
+        string synthetic = valid.Replace("\"capture_status\":\"native-frame-captured\",",
+                "\"capture_status\":\"synthetic-camera-plan\",\"synthetic_camera\":true,")
+            .Replace("\"render_input_usable\":true,", "");
+        SelectedCameraInput parsedSynthetic = ParseSelectedCameraJson(synthetic, "synthetic-input.json");
+        if (!parsedSynthetic.Synthetic || parsedSynthetic.ProjectionMode != 1)
+            throw new InvalidOperationException("Camera JSON parser failed to preserve explicit synthetic-camera provenance.");
+        string unmarkedSynthetic = synthetic.Replace("\"synthetic_camera\":true", "\"synthetic_camera\":false");
+        rejected = false;
+        try { ParseSelectedCameraJson(unmarkedSynthetic, "bad.json"); }
+        catch (InvalidDataException) { rejected = true; }
+        if (!rejected) throw new InvalidOperationException("Camera JSON parser accepted an unmarked synthetic camera plan.");
         string zeroMatrix = valid.Replace("1065353216,0,0,1065353216,0,1065353216,0,1073741824,0,0,1065353216,1077936128,0,0,0,1065353216",
             "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0");
-        bool rejected = false;
+        rejected = false;
         try { ParseSelectedCameraJson(zeroMatrix, "bad.json"); }
         catch (InvalidDataException) { rejected = true; }
         if (!rejected) throw new InvalidOperationException("Camera JSON parser accepted a singular all-zero matrix.");
@@ -1664,15 +2093,20 @@ internal static partial class NativeFrameCapture
 
         uint vtable = ReadU32(process, camera.Camera);
         uint selectorField = ReadU32(process, unchecked(camera.Camera + 0x10));
+        uint parent = ReadCameraParent(process, camera.Camera);
         uint expectedVtable = unchecked(terrainBase + ExternalCameraVtableRva);
         byte[] current = new byte[64];
-        if (vtable != expectedVtable || selectorField != 0xFFFFFFFF
-            || !ReadExact(process, unchecked(camera.Camera + 0x20), current))
+        byte[] effectiveWorldCurrent = new byte[64];
+        if (vtable != expectedVtable || selectorField != 0xFFFFFFFF || parent != camera.Parent
+            || !ReadExact(process, unchecked(camera.Camera + 0x20), current)
+            || !ReadExact(process, unchecked(camera.Camera + 0x60), effectiveWorldCurrent))
         {
             camera.CurrentAtProjectionVerified = false;
-            camera.Failure = "camera pointer, vtable, selector, or matrix changed before projection";
+            camera.EffectiveWorldAtProjectionVerified = false;
+            camera.Failure = "camera pointer, parent, vtable, selector, local matrix, or world matrix changed before projection";
             Log("CAMERA_MATRIX_AT_PROJECTION_REJECTED generation=" + generation
                 + " vtable=0x" + vtable.ToString("X8") + " selector=0x" + selectorField.ToString("X8")
+                + " parent=0x" + parent.ToString("X8") + " expectedParent=0x" + camera.Parent.ToString("X8")
                 + " expectedVtable=0x" + expectedVtable.ToString("X8"));
             return false;
         }
@@ -1687,22 +2121,54 @@ internal static partial class NativeFrameCapture
         if (!finite)
         {
             camera.CurrentAtProjectionVerified = false;
+            camera.EffectiveWorldAtProjectionVerified = false;
             camera.Failure = "camera matrix contains a non-finite value at projection boundary";
             Log("CAMERA_MATRIX_AT_PROJECTION_REJECTED generation=" + generation + " nonFinite=true");
             return false;
         }
 
+        uint[] effectiveWorldWords = MatrixWords(effectiveWorldCurrent);
+        bool effectiveWorldFinite = true;
+        for (int i = 0; i < effectiveWorldWords.Length; i++)
+            if (!IsFinite(BitConverter.ToSingle(effectiveWorldCurrent, i * 4)))
+                effectiveWorldFinite = false;
+        string worldFailure = null;
+        bool effectiveWorldRigid = effectiveWorldFinite
+            && IsOrthonormalAffineCamera(effectiveWorldCurrent, out worldFailure);
+        if (!effectiveWorldFinite) worldFailure = "effective-world matrix contains a nonfinite value";
+        if (!effectiveWorldRigid)
+        {
+            camera.CurrentAtProjectionVerified = false;
+            camera.EffectiveWorldAtProjectionVerified = false;
+            camera.Failure = "effective-world matrix failed validation at projection: " + worldFailure;
+            Log("CAMERA_WORLD_MATRIX_AT_PROJECTION_REJECTED generation=" + generation + " reason=" + worldFailure);
+            return false;
+        }
+
         bool changed = !ByteArraysEqual(camera.EntryMatrixBytes, current);
+        bool effectiveWorldChanged = !ByteArraysEqual(camera.EntryEffectiveWorldMatrixBytes, effectiveWorldCurrent);
         camera.Vtable = vtable;
         camera.SelectorField = selectorField;
+        camera.Parent = parent;
+        camera.Parented = parent != 0;
         camera.Words = words;
+        camera.EffectiveWorldWords = effectiveWorldWords;
         camera.ProjectionMatrixBytes = (byte[])current.Clone();
+        camera.ProjectionEffectiveWorldMatrixBytes = (byte[])effectiveWorldCurrent.Clone();
         camera.MatrixFinite = true;
+        camera.EffectiveWorldMatrixFinite = true;
         camera.CurrentAtProjectionVerified = true;
+        camera.EffectiveWorldAtProjectionVerified = true;
         camera.WordsChangedAtProjection = changed;
+        camera.EffectiveWorldChangedAtProjection = effectiveWorldChanged;
         camera.ProjectionMatrixSha256 = HashBytes(current);
+        camera.ProjectionEffectiveWorldMatrixSha256 = HashBytes(effectiveWorldCurrent);
         Log("CAMERA_MATRIX_AT_PROJECTION generation=" + generation + " verified=true changedSinceEntry=" + changed
             + " entrySha256=" + camera.EntryMatrixSha256 + " projectionSha256=" + camera.ProjectionMatrixSha256);
+        Log("CAMERA_WORLD_MATRIX_AT_PROJECTION generation=" + generation + " verified=true"
+            + " parent=0x" + parent.ToString("X8") + " changedSinceEntry=" + effectiveWorldChanged
+            + " entrySha256=" + camera.EntryEffectiveWorldMatrixSha256
+            + " projectionSha256=" + camera.ProjectionEffectiveWorldMatrixSha256);
         return true;
     }
 
@@ -1725,7 +2191,20 @@ internal static partial class NativeFrameCapture
             throw new InvalidOperationException("DDLOCK flag self-check failed.");
         RemoteCode acquire = BuildReadbackStub(0x10000000, 0x20000000, false);
         RemoteCode cleanup = BuildReadbackStub(0x10000000, 0, true);
-        RemoteCode cameraSetter = BuildCameraSetterStub(0x30000000, 0x40000000);
+        RemoteCode surfaceProbe = BuildSurfaceProbeStub(0x18000000, 0x28000000);
+        RemoteCode cameraSetterApply = BuildCameraSetterStub(0x30000000, 0x40000000, 2);
+        RemoteCode cameraSetterRestore = BuildCameraSetterStub(0x31000000, 0x40000000, 1);
+        int[] cameraApplyCalls = cameraSetterApply.CallInstructionOffsets;
+        int[] cameraRestoreCalls = cameraSetterRestore.CallInstructionOffsets;
+        int effectiveWorldGetterCall = cameraApplyCalls != null && cameraApplyCalls.Length > 1
+            ? cameraApplyCalls[1] : -1;
+        bool effectiveWorldGetterArgumentsMatch = effectiveWorldGetterCall >= 8
+            && cameraSetterApply.Bytes[effectiveWorldGetterCall - 1] == 0x56
+            && cameraSetterApply.Bytes[effectiveWorldGetterCall - 2] == 2
+            && cameraSetterApply.Bytes[effectiveWorldGetterCall - 3] == 0x6A
+            && cameraSetterApply.Bytes[effectiveWorldGetterCall - 8] == 0x68
+            && BitConverter.ToUInt32(cameraSetterApply.Bytes, effectiveWorldGetterCall - 7)
+                == 0x30000000 + RemoteDataOffset + CameraSetterWorldMatrixPointerOffset;
         string[] d3d7DeviceVtable = new string[] {
             "QueryInterface", "AddRef", "Release", "GetCaps", "EnumTextureFormats", "BeginScene", "EndScene",
             "GetDirect3D", "SetRenderTarget", "GetRenderTarget", "Clear", "SetTransform", "GetTransform",
@@ -1759,11 +2238,28 @@ internal static partial class NativeFrameCapture
             || Marshal.OffsetOf(typeof(X86ContextLayout), "Esp").ToInt32() != ContextEspOffset
             || ContextAllX86 != 0x0001003F || acquire.Bytes.Length == 0 || cleanup.Bytes.Length == 0
             || acquire.MaxCallStackBytes != RemoteStubMaxCallStackBytes || cleanup.MaxCallStackBytes != 12
-            || cameraSetter.Bytes.Length == 0 || cameraSetter.MaxCallStackBytes != 16
-            || cameraSetter.CallInstructionOffsets == null || cameraSetter.CallInstructionOffsets.Length != 1
-            || DecodeIndirectCallDisplacement(cameraSetter.Bytes, cameraSetter.CallInstructionOffsets[0])
+            || cameraSetterApply.Bytes.Length == 0 || cameraSetterApply.MaxCallStackBytes != 16
+            || cameraSetterApply.Bytes[12] != 0x6A || cameraSetterApply.Bytes[13] != 2
+            || cameraSetterRestore.Bytes[12] != 0x6A || cameraSetterRestore.Bytes[13] != 1
+            || CameraSetterMode(CameraSetterPhase.Apply) != 2 || CameraSetterMode(CameraSetterPhase.Restore) != 1
+            || cameraApplyCalls == null || cameraApplyCalls.Length != 2
+            || cameraRestoreCalls == null || cameraRestoreCalls.Length != 1
+            || DecodeIndirectCallDisplacement(cameraSetterApply.Bytes, cameraApplyCalls[0])
+                != CameraTransformSetterSlotOffset
+            || DecodeIndirectCallDisplacement(cameraSetterApply.Bytes, effectiveWorldGetterCall)
+                != CameraTransformGetterSlotOffset
+            || DecodeIndirectCallDisplacement(cameraSetterRestore.Bytes, cameraRestoreCalls[0])
                 != CameraTransformSetterSlotOffset
-            || cameraSetter.TrapAddress != 0x30000000 + cameraSetter.Bytes.Length - 1
+            || !effectiveWorldGetterArgumentsMatch
+            || cameraSetterApply.TrapAddress - cameraSetterApply.Base != (uint)(effectiveWorldGetterCall + 3)
+            || cameraSetterApply.TrapAddress != 0x30000000 + cameraSetterApply.Bytes.Length - 1
+            || surfaceProbe.Bytes.Length == 0 || surfaceProbe.MaxCallStackBytes != 12
+            || surfaceProbe.CallInstructionOffsets == null || surfaceProbe.CallInstructionOffsets.Length != 2
+            || DecodeIndirectCallDisplacement(surfaceProbe.Bytes, surfaceProbe.CallInstructionOffsets[0])
+                != D3dDeviceGetRenderTargetOffset
+            || DecodeIndirectCallDisplacement(surfaceProbe.Bytes, surfaceProbe.CallInstructionOffsets[1])
+                != DdSurfaceReleaseOffset
+            || surfaceProbe.TrapAddress != 0x18000000 + surfaceProbe.Bytes.Length - 1
             || VtableOffset(d3d7DeviceVtable, "GetRenderTarget") != D3dDeviceGetRenderTargetOffset
             || VtableOffset(surface7Vtable, "Lock") != DdSurfaceLockOffset
             || VtableOffset(surface7Vtable, "SetOverlayPosition") != 0x78
@@ -1824,8 +2320,9 @@ internal static partial class NativeFrameCapture
             Rows = new byte[] { 1, 2, 3, 4, 5, 6 }, RgbMasksVerified = true
         }), 4, 5, 6, 255, 1, 2, 3, 255);
         Console.WriteLine("self-check: D3D7 GetRenderTarget and Surface7 Lock/Unlock/Release SDK vtable ordinals OK");
+        Console.WriteLine("self-check: boundary surface probe calls GetRenderTarget/Release only; no Lock; 12-byte max stack OK");
         Console.WriteLine("self-check: caller stack footprint (24/12 bytes), original ESP, committed writable range and guard rejection OK");
-        Console.WriteLine("self-check: selected-camera setter stub uses verified interface slot +0x1C and 16-byte maximum caller stack OK");
+        Console.WriteLine("self-check: selected-camera mode-2 setter refreshes selector-2 world cache before trap; local restore uses verified setter slot +0x1C; 16-byte maximum caller stack OK");
         Console.WriteLine("self-check: 24-byte present call arguments compare unchanged and detect a changed byte");
         Console.WriteLine("self-check: return context logging verifies remote EIP/ESP before restoring the original present call");
         Console.WriteLine("self-check: viewport bounds fit the captured pixel surface OK");