#517 Isolate render work and trace camera delivery failures

[iamfatness]

Related to #517. Monitor source exports and WGC CPU conversion occupied the production path during the October 3 show. This draft separates optional work and adds identity-based camera diagnosis. Default rollout flags remain off; the full specification and installed acceptance are still open.

COREVIDEO_ISOLATE_MONITORS=1 moves Preview, multiview and requested source exports to a bounded worker on a separate same-adapter device. Metadata follows the exported image; the Program tile uses the buffered Program export. Monitor capture copies have independent three-image leases and a 256 MiB ingress cap, while source ingress has a separate 512 MiB cap.

COREVIDEO_GPU_CAPTURE=1 publishes completed WGC GPU images through prepared consumer views. ISO readback uses private images, a separate D3D device/context and an ordered, bounded conversion branch. CPU arrivals retain their original pixels, frame IDs, epochs and capture times; they are drained independently rather than relabelled with newer production frames. CPU device creation and session start/stop/join run off production commands. Pool preparation runs on its own worker; cancellation cannot publish an old session into a reconnect. All preparation, capacity and conversion refusals are counted. ISO admission is extracted into a focused type, reducing MediaCore rather than adding another ingest path.

Camera diagnostics correlate buffered Program identity with publication and reader emission through a separate versioned sidecar, preserving the pixel ABI. An OS Media Foundation receiver decodes actual NV12 identities and rejects loss, repetition, reordering, tears, wrong rates and partial captures. Retry remains experimental and off in the shipping DLL. Separate isolated QA targets deliberately exercise publication contention.

Validation

• Release core/tests build passes at the current implementation checkpoint.
• Independent D3D device tests: blocked CPU conversion preserved 29 independently decoded production GPU images; blocked CPU pool preparation preserved 12. Delayed CPU pixels retained their original identity, epoch and time. Four CPU-branch tests pass, including memory admission and resize retirement.
• Real WGC at 2560x1440: zero compositor CPU uploads, separate CPU arrivals, 20 new production GPU frames while all three monitor images were retained, followed by ISO demand and three asynchronous reconnects with fresh GPU/CPU epochs. Repeated final trials pass. This is short correctness evidence, not a continuous 60 fps qualification.
• Lifecycle tests deliberately block creation/retirement, verify responsive polling and commands, reject stale starts and bound requested sources. Three pass. ISO regression filter: 70 pass; shell capture lifecycle: 6; capture worker: 2; source demand: 1; script suite: 161.
• Controlled Windows camera experiment: the repeated retry-off control failed with 30 repeats, 34 missing identities, 2389 slate/invalid markers and a 601.076 ms arrival gap. Retry-on passed two measured minutes of 3601 identities each without errors; maximum intervals were 18.306/20.588 ms. The second process recorded 5461 exercised recoveries across smoke/warmup/measurement. Both healthy-source on runs and the repeated off control had zero publisher deadline overruns. A 20 ms over-budget negative control correctly failed.

Failed trials are retained. The newly added WGC OS-frame retention fence initially caused repeated retirement refusals when ended after the earlier production GPU wait. Moving it into the source-copy submission batch resolved that regression and repeated real-capture trials pass. This does not establish the original show's sole root cause. A cold reconnect smoke recorded one 8.474 ms render with 7.986 ms in the source texture stage; sustained latency and resource destruction remain unqualified.

The last previously qualified #517 CI checkpoint passed 17 checks. Current stacked heads have no checks because workflows filter PRs to main; do not treat local tests as complete CI. Installation dependency #781 is separately reviewed in draft #783, which has its own green checks. This PR is based on that branch so installer changes remain in their own review.

The obsolete development camera registration remains removed. Installed HKLM/HKCU registration points to the current beta. Tests use isolated SHM or native capture; production preferences and the production mapping are preserved. No public release was created. Raw successful/failed evidence and exact binary hashes are retained locally under preserved-local-evidence/camera-publication-qa and preserved-local-evidence/iso-cpu-isolation-517.

Acceptance still open

Production/monitor resource preparation and destruction, full visibility demand, prepared CPU fallback uploads, complete monitor-memory accounting, ISO arm/readiness behavior, color/device-loss/window-resize qualification, bounded fixed-event tracing and native/C#/Swift deliveryEvidence remain open. So do camera phase/lifecycle/independent-receiver qualification, installer lifecycle gates, matched latency/audio, the controlled 30-minute soak, installed 90-minute workload and lower-tier hardware evidence.

Follow docs/reference/render-delivery-spec.md and the owner-approved docs/reference/render-delivery-completion-plan.md. Keep #517 open, this PR draft and rollout flags off until the required evidence and operator release acceptance are complete.