sec-surface phantoms: #48 wrap lit idx-254 art in live armor colors; fix + palette-aware glass token

Playtester report: (1) the CONTROL MODE stack showed boxes around the inactive
MID/ADV entries, (2) a phantom block between the HEADING dial and the ARMOR
rosette.  Root-caused [T1] by a 4-agent investigation + art decode:

  The #48 translation-table cycle-fill (6bb03ae, 2026-07-25) mapped
  out-of-range art indices in-plane as (index mod 2^bits) -- so art index 254
  landed on plane slot 62 = the LIVE colorMapperMultiArmor right-armor damage
  slot.  And idx-254 art EXISTS: every SMODE.PCC frame fills the INACTIVE
  mode-box interiors with 254, and BTSEC1.PCX carries a stray 52x13 idx-254
  bar at port (199-250,101-113) between the heading dial and the rosette (a
  scratch duplicate of the rosette quadrant bars).  Both lit up in the current
  right-armor color (adpal ramp green/orange/red) on EVERY render path.  On
  the shipped machine those regions rendered BLACK (the garbage entry's low
  plane bits were 0), which is why the 2026-07-19 smode audit -- run before
  the cycle-fill landed -- verified CORRECT.

FIX 1 (BuildSecondaryTranslation): map [2^bits..255] to translationTable[0]
  (plane BACKGROUND) -- the authentic on-screen result, same no-leak
  guarantee.  Verified on both paths: MID/ADV back to authored borders+text
  (idx 5/9), no interior fills; the phantom bar gone; BAS badge and the live
  armor rosette (in-range slots 60-63) untouched.

FIX 2 (glass dirty-skip palette blindness, latent in c9e25e5): the
  ColorMapper family animates by CLUT writes with zero pixel churn, which the
  pixel-checksum token cannot see -- the glass radar held stale armor tints
  between pixel repaints.  New SVGA16::paletteGeneration, bumped by the
  palette writers (BuildSecondaryColor only on a REAL entry change -- the
  adpal/adpal2 flash alternates every Execute writing identical RGB at zero
  damage, so the skip survives; full rebuilds bump unconditionally), folded
  into GlassWindowToken for palette-expanding windows.

KB: gauges-hud #48 REFINED addendum; glass-cockpit repaint-pump section
  (records f3d27f5 + c9e25e5 + this); GAUGE_COMPOSITE row 33 corrected
  (ControlsMapper/ControlMode, not DisplayMode) + re-verification note.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

context/gauges-hud.md

@@ -783,6 +783,22 @@ pattern across entries [2^bits..255] (high-index art degrades to its
 index-mod-2^bits colour IN-PLANE, can never leak).  The 1995 binary ships the
 SAME 64-entry fill and relied on 6-bit art discipline -- garbage is not a
 preservable behaviour, so the cycle-fill is a guarded PORT deviation.
+
+**REFINED 2026-08-10 [T1] -- the cycle-fill itself made phantoms.** The
+in-plane wrap mapped art index 254 onto plane slot 62 = the LIVE
+`colorMapperMultiArmor` right-armor damage slot, and idx-254 art EXISTS:
+every SMODE.PCC frame fills the INACTIVE control-mode box interiors with 254
+(active border/text idx 9 yellow, inactive borders idx 5 orange-red), and
+BTSEC1.PCX carries a stray 52x13 idx-254 bar at port (199-250, 101-113) --
+between the heading dial and the armor rosette, geometrically a scratch
+duplicate of the rosette quadrant bars.  Both lit up in the current
+right-armor colour (adpal ramp green/orange/red) on EVERY render path --
+playtester-reported as "red boxes around MID/ADV" + "a block between Armor
+and Heading".  On the shipped machine those regions rendered BLACK (the
+garbage entry's low plane bits were 0 -> in-plane index 0), so the fill now
+maps [2^bits..255] to `translationTable[0]` (plane BACKGROUND) -- authentic
+on-screen result, same no-leak guarantee.  NB the 2026-07-19 audit verified
+smode BEFORE the 07-25 cycle-fill landed, which is why the row said CORRECT.
 Post-fix: **0 leaks over 60s** on the same probe; sim3 3-pod regression clean.
 **The tripwires are DEFAULT-ON in every build** (BT_PLANE_AUDIT=0 opts out): the
 plane-leak trap, plus an out-of-bounds draw-start trap in `buildDestPointer`

context/glass-cockpit.md

@@ -203,6 +203,31 @@ appears in the cfg like any panel and honours `,noframe`. Verified: a drag wrote
 at 321,222. NB the plasma window blits directly every frame (`GetDC`+`StretchDIBits`), so unlike
 the panels it has no `WM_TIMER` focus-throttle to worry about.
 
+## Glass-panel repaint pump — perf + dirty-skip (2026-08-09/10) [T2 measured]
+
+The exploded per-display windows are pure CPU/GDI (`ExpandPlaneToBGRA` +
+`StretchDIBits`), repainted synchronously on the MAIN render thread by
+`BTGlassPanels_Tick` (~16 Hz). Three layered changes (branch `glass-panel-perf`)
+after a playtester reported ~20 fps in panels mode vs ~130 fps in the surround:
+
+1. **HALFTONE → COLORONCOLOR** (`f3d27f5`): the `HALFTONE` stretch (GDI's
+   per-output-pixel resample) × 7 windows per pump was the primary sink; nearest
+   is crisper for the low-res MFD pixels anyway. `BT_GLASS_SMOOTH=1` restores.
+2. **Per-window dirty-skip** (`c9e25e5`): each window carries a change token =
+   FNV over `SVGA16::PlaneChecksum(mask)` (the shared pixelBuffer masked to every
+   port that can feed the window) + each button's RENDERED lamp brightness +
+   held/latch. The pump re-blits only windows whose token moved: ~31 pumps/2s →
+   4-15 window repaints vs 217-224 always-on. `BT_GLASS_DIRTY=1` logs the tally.
+3. **Palette generation in the token** (2026-08-10): the ColorMapper family
+   (armor rosette tints, adpal/adpal2 damage flash) animates by CLUT writes with
+   ZERO pixel churn — invisible to a pixel checksum. `SVGA16::paletteGeneration`
+   is bumped by the palette writers (`BuildSecondaryColor` only on a REAL entry
+   change, since the flash alternates palettes every Execute writing identical
+   RGB at zero damage; full rebuilds unconditionally) and folded into the token
+   for palette-expanding windows (`monoTint < 0`, or all under `BT_GLASS_MFD_PAL`).
+   Without it the glass radar held stale armor tints between pixel repaints while
+   the D3D surround (which re-expands every frame) tracked live.
+
 **Turning it OFF: `L4PLASMA=NONE` (also `OFF`/`0`, 2026-08-06) [T2].** `L4GREND` creates a
 marquee whenever `L4PLASMA` is set at all (`SCREEN` → the desktop window, anything else → a real
 `PlasmaDisplay` on that serial port), and the GLASS profile force-defaults it to `SCREEN` — so on

docs/GAUGE_COMPOSITE.md

@@ -696,7 +696,7 @@ reconfigure/externalConfigure); parse-skip list EMPTY ([gskip]=0), all 50 attr b
 | 30 | sec: schematic CRITICAL view (cmCrit) | subsystem simulationState/damage | LIVE this audit: N-cycle shows the full subsystem list (GEN A-D, LOOP 1-6, HUD, SENSORS, GYRO, TORSO, weapons) | T2 | CORRECT |
 | 31 | sec: schematic HEAT view (cmHeat) | subsystem currentTemperature tint | #6 pixel-verified; re-cycled this audit (mask 0x450421→0x490421→0x510421) | T2 | CORRECT |
 | 32 | sec: view cycling (N / pod 0x15) | CycleDisplayMode → vtbl+0x4C @4d1ae4 | #6 resolution re-verified live ([mode] display notify 0/1/2) | T2 | CORRECT |
-| 33 | sec: CONTROL MODE lamp (BAS/MID/ADV) | ControlsMapper/DisplayMode oneOfSeveralPixInt | attr wave incr.5; M-cycle verified #6 | T2 | CORRECT |
+| 33 | sec: CONTROL MODE lamp (BAS/MID/ADV) | ControlsMapper/**ControlMode** oneOfSeveralPixInt (row previously mislabeled DisplayMode — that is the sibling sdspmod) | attr wave incr.5; M-cycle verified #6. **2026-08-10:** this row's verification PREDATED the 07-25 #48 cycle-fill, which then lit the inactive box interiors (art idx 254 → live armor slot 62) — playtester-reported, re-fixed by mapping out-of-range indices to plane background (see context/gauges-hud.md §#48 REFINED); both render paths re-verified against the reference | T2 | CORRECT |
 | 34 | sec: duck / searchlight button lamps | duckState (ctor-zeroed only) / Searchlight LightOn | duckState writer missing (P3 leftover) | T3 | DEFERRED-FEED (duck); CORRECT (light attr published) |
 | 35 | sec: messageBoard ticker | StatusMessagePool (NULL stub) + kill ticker strip 0 | 7fc4acb; kill ticker live 2026-07-12, other strips unsurveyed | T2/T3 | DEFERRED-FEED (partial) |
 | 36 | MFD preset paging (J/K/L, pod RIO banks) | SetPresetMode table @0051dbf0 (little-endian re-decode) | #9; re-verified live this audit: cycles visit EXACTLY the populated set (MFD1: 1,2,4; MFD2: 1-4; MFD3: 1,2) | T2 | CORRECT |

engine/MUNGA_L4/L4GLASSWIN.cpp

@@ -1832,7 +1832,19 @@ static unsigned long
 			if (svga == NULL) svga = static_cast<SVGA16*>(p->graphicsDisplay);
 		}
 		if (svga != NULL && combined != 0)
+		{
 			token ^= svga->PlaneChecksum(combined);
+			// PALETTE-ANIMATED content (2026-08-10): a palette-expanding window
+			// (the radar; MFDs under BT_GLASS_MFD_PAL) changes colour with ZERO
+			// pixel writes -- the ColorMapper family (armor rosette tints, the
+			// adpal/adpal2 damage flash) writes CLUT entries.  Fold the palette
+			// write generation in so those changes repaint; mono-tint windows
+			// don't read the palette and keep their pixel-only token.
+			static int sPalTok = -1;
+			if (sPalTok < 0) sPalTok = getenv("BT_GLASS_MFD_PAL") ? 1 : 0;
+			if (w->monoTint < 0 || sPalTok)
+				token = (token ^ svga->PaletteGeneration()) * 16777619UL;
+		}
 	}
 
 	// Lamps: each button's RENDERED brightness + held/latched, so a flash toggle or a

engine/MUNGA_L4/L4VB16.cpp

@@ -5445,6 +5445,7 @@ SVGA16::SVGA16(
    BuildWindows(init_width,init_height,windowed, secondaryIndex, aux1Index, aux2Index);
 	for (int _i = 0; _i < 10; _i++)	// DEV-COMPOSITE: lazily created on first surface draw
 		mDevSurfaceTex[_i] = NULL;
+	paletteGeneration = 0;			// GLASS dirty-skip palette tracking
 //STUBBED: VIDEO RB 1/15/07
 #	if defined(DEBUG)
 		Tell("SVGA16::SVGA16()\n");
@@ -7190,6 +7191,7 @@ void
 
 	svga_palette->paletteData.Valid = True;
 	svga_palette->modified = True;
+	((SVGA16 *) graphicsDisplay)->paletteGeneration++;	// glass dirty-skip (full rebuild)
 
 	Check_Fpu();
 }
@@ -7234,6 +7236,13 @@ void
 	SVGA16Palette
 		*svga_palette(&((SVGA16 *) graphicsDisplay)->palette[paletteID]);
 
+	// GLASS dirty-skip: track whether this write CHANGES anything -- the
+	// ColorMapper family calls this every Execute (the adpal/adpal2 flash
+	// alternates palettes even at zero damage, usually writing identical RGB),
+	// so bump the generation only on a real change or every glass window that
+	// palette-expands would repaint every pump for nothing.
+	int palette_changed = 0;
+
 	//-------------------------------------------
 	// If any of the ...TransparentZero modes are used,
 	// leave color zero undefined for this bit group by
@@ -7275,21 +7284,31 @@ void
 					{
 					case RedChannel:
 					case RedChannelTransparentZero:
+						if (destination_triplet->Red != source_triplet->Red)
+							palette_changed = 1;
 						destination_triplet->Red = source_triplet->Red;
 						break;
 
 					case GreenChannel:
 					case GreenChannelTransparentZero:
+						if (destination_triplet->Green != source_triplet->Green)
+							palette_changed = 1;
 						destination_triplet->Green = source_triplet->Green;
 						break;
 
 					case BlueChannel:
 					case BlueChannelTransparentZero:
+						if (destination_triplet->Blue != source_triplet->Blue)
+							palette_changed = 1;
 						destination_triplet->Blue = source_triplet->Blue;
 						break;
 
 					case AllChannels:
 					case AllChannelsTransparentZero:
+						if (destination_triplet->Red   != source_triplet->Red
+						 || destination_triplet->Green != source_triplet->Green
+						 || destination_triplet->Blue  != source_triplet->Blue)
+							palette_changed = 1;
 						*destination_triplet = *source_triplet;
 						break;
 					}
@@ -7310,6 +7329,8 @@ void
 
 	svga_palette->paletteData.Valid = True;
 	svga_palette->modified = True;
+	if (palette_changed)
+		((SVGA16 *) graphicsDisplay)->paletteGeneration++;	// glass dirty-skip
 
 	Check_Fpu();
 }
@@ -7413,6 +7434,7 @@ void
 
 	svga_palette->paletteData.Valid = True;
 	svga_palette->modified = True;
+	((SVGA16 *) graphicsDisplay)->paletteGeneration++;	// glass dirty-skip (full rebuild)
 
 #	if defined(TESTPALETTE)
 		std::cout << "L4GraphicsPort::BuildAuxiliaryPalette for port " <<
@@ -7523,6 +7545,7 @@ void
 
 	svga_palette->paletteData.Valid = True;
 	svga_palette->modified = True;
+	((SVGA16 *) graphicsDisplay)->paletteGeneration++;	// glass dirty-skip (full rebuild)
 
 	Check_Fpu();
 }
@@ -7557,17 +7580,28 @@ void
 	// LEFT AS HEAP GARBAGE and any pixmap pixel >= that count wrote the
 	// garbage's high bits into other displays' planes (the #48 stray
 	// blocks; convicted live by BT_PLANE_AUDIT -- the 480x640 radar
-	// background carries index 217).  Cycle the in-plane pattern across
-	// the remainder: high-index art degrades to its (index mod 2^bits)
-	// colour IN-PLANE, and can never leak.  (The 1995 binary shipped the
-	// same 64-entry fill and relied on art discipline; garbage is not a
-	// preservable behaviour, so this is a guarded PORT deviation.)
+	// background carries index 217).  Map the remainder to the plane
+	// BACKGROUND (translationTable[0]): high-index art renders as the
+	// port's background colour in-plane, and can never leak.
+	//
+	// REFINED 2026-08-10 (the sec-surface phantoms): the first #48 fill
+	// cycled the remainder IN-PLANE (index mod 2^bits), which mapped art
+	// index 254 onto plane slot 62 -- a LIVE colorMapperMultiArmor damage
+	// slot.  SMODE.PCC's inactive control-mode box interiors and a stray
+	// 52x13 idx-254 bar baked into BTSEC1.PCX (between the heading dial
+	// and the armor rosette) lit up in the current right-armor damage
+	// colour on every render path.  On the shipped machine those regions
+	// rendered BLACK (the heap garbage's low plane bits were 0 ->
+	// in-plane index 0), so background IS the authentic on-screen result.
+	// (The 1995 binary shipped the same 64-entry fill and relied on art
+	// discipline; garbage is not a preservable behaviour, so this stays a
+	// guarded PORT deviation.)
 	{
 		int filled = 1;
 		for (int b = bitMask & 0xFF; b != 0; b &= (b - 1))
 			filled <<= 1;
 		for (int i = filled; i < 256; ++i)
-			translationTable[i] = translationTable[i & (filled - 1)];
+			translationTable[i] = translationTable[0];
 	}
 	Check_Fpu();
 }

engine/MUNGA_L4/L4VB16.h

@@ -382,6 +382,15 @@ protected:
 	SVGA16Palette
 		palette[PaletteCount];
 
+	// GLASS dirty-skip (2026-08-10): bumped by the palette writers
+	// (L4GraphicsPort::BuildSecondaryColor on a REAL entry change; the full
+	// palette rebuilds unconditionally) so the glass repaint token can see
+	// palette-only animation -- the ColorMapper family (armor rosette tints,
+	// damage flash) changes COLORS with zero pixel writes, which the pixel
+	// checksum alone can never catch.
+	unsigned long
+		paletteGeneration;
+
 private:
 	int NUMGAUGEWINDOWS;
    HWND *gaugeWindows;
@@ -425,6 +434,11 @@ public:
 	// glass repaint pump re-blit ONLY the windows whose plane actually changed
 	// (idle MFDs / static panels skip; the sweeping radar keeps updating).
 	unsigned long PlaneChecksum(int mask) const;
+
+	// GLASS dirty-skip: the palette write generation (see paletteGeneration).
+	// Folded into the repaint token of palette-expanding windows so ColorMapper
+	// palette animation (armor tints / damage flash) repaints without pixel churn.
+	unsigned long PaletteGeneration() const { return paletteGeneration; }
 };
 
 //########################################################################