Batch 2: retain hot-path benchmark evidence

[imakris]

Scope

Implements Batch 2 Checkpoint 2.1 on top of #17:

• native, backend-agnostic QRhi evidence: reject Null, record the actual API/device, and do not impose Vulkan/OpenGL/D3D/Metal product gates
• exact clean build/runtime source, dependency, executable, Qt, machine, OS/CPU, renderer settings, invocation identity, and hosted capacity
• separate cold, warmup, measured-frame, submission, GPU-finish, planning, allocation, snapshot, producer, and memory observations
• exact producer pause/rebase boundary so warm-up schedule debt cannot enter measured live throughput
• append-only smoke/calibration attempts with terminal phase validation and artifact hashes, including source/preflight/bootstrap/backend-allocation failure
• fixed six-scenario protocol: 24 warm-up + 84 measured executions, plus a separate current-environment probe
• exact-zero validation across every retained value, automatic numeric-margin proposal, and separate owner approval bound to its SHA-256
• mandatory evidence on all four platforms; FreeBSD packages in the isolated guest, copies evidence/status back, uploads, then propagates failure

Exact candidate at 6e815dd

• clean initialized Release build: green
• CTest: 29/29 green
• Python helper tests: 40/40 green, including bootstrap-failure, renderer-provenance, capacity-retention, fallback-format, fixed-render-protocol, and allocator telemetry cases
• native D3D11 pixel/counter smoke: green; source/dependency identities clean and equal; context sample count 1 and measured render sample count 4
• retained local diagnostic: DIAGNOSTIC_PASS, clean source 6e815ddb1fa97e0c53a524c19f6e0ab28b454382, nonzero checksum, 863,348 nonuniform pixels
• canonical Varinomics style pipeline: green with the same two pre-existing ternary warnings
• actionlint 1.7.12: green
• plan branch is a real ancestor of this branch

Exact-head hosted validation is green in Linux 29115256431, FreeBSD 29115256325, macOS 29115256361, and Windows 29115256444: all eight jobs passed. All four retained text-enabled bundles independently recompute every declared hash, match candidate tree c188d1ef, retain clean equal source/build/runtime identity, and finish DIAGNOSTIC_PASS with native non-Null rendering, nonuniform pixels, nonzero checksums, and complete phase traces. All three xhigh reviewers returned VERDICT: GREEN on this exact candidate.

Retained remediation history

• Round 4 at 86ad4c0: 5/8 green; Linux text-ON llvmpipe OOM and FreeBSD NFS ownership failure; all three xhigh reviewers RED.
• f07549b: FreeBSD rsync/copyback text-OFF passed and Linux softpipe removed the OOM, but softpipe 3.3 could not consume baked GLSL 410; the strict pixel oracle correctly rejected a clear-only frame.
• c5d6265: retained Qt-native selection; added compatible GLSL 330 + 410 artifacts and Core 3.3/single-sample only for the offscreen context. The measured target remains 4x and the pixel oracle remains strict.
• 273e90e: calibration schema v3 explicitly names Core 3.3/1x context and 4x measured rendering, and rejects mismatched raw artifacts.
• Linux runs 29111220046, 29111320276, 29111950491, 29112893934, and 29114371994 are green with strict nonuniform-frame evidence. FreeBSD run 29111220086 proves that guest cannot create a softpipe drisw screen.
• a83316e left FreeBSD driver selection native/default and disabled rendering workers, but run 29111950433 retained std::bad_alloc at backend creation. 836b178 raised only guest capacity to 10 GiB, retained capacity/limits, and localized the repeated failure in run 29112893803 to Qt's convenience fallback-surface helper.
• 989f5af supplies the documented caller-owned QOffscreenSurface directly with the same 3.3/Core/1x request, avoiding only Qt's preliminary temporary context. Requested/resolved formats are retained and enforced; QRhi still creates the real native context and must render a nonuniform 4x frame.
• Exact FreeBSD artifact 29114372558 then localized the remaining failure to this executable's global aligned-new adapter: align_val_t{4} was passed directly to FreeBSD posix_memalign, which requires at least pointer-size alignment and returned EINVAL, falsely surfaced as bad_alloc. 6e815dd normalizes only the effective platform alignment to at least sizeof(void*), retains requested/effective telemetry, and adds a direct regression.

The superseded 84-run artifacts are not accepted. Fresh 108-execution calibration follows green CI and unanimous iterative review. Its proposal must be inspected and approved by exact SHA-256 before checkpoint PASS can exist.

Three xhigh reviewers iterate until all three return green. Fable is not invoked or awaited per the owner's quota instruction. D4 remains open and is not claimed by this checkpoint.