fix(video): isolate optional Program publication (#804)

docs/BACKLOG.md

@@ -59,6 +59,12 @@ plan remains the qualification reference for #517, with installed rollback and
 failed evidence preserved. The October 4 owner focus below supersedes its code-work
 priority while the remaining acceptance stays open.
 
+Owner approved prioritizing [#804](https://github.com/iamfatness/CoreVideoPro/issues/804)
+on October 7 ahead of the remaining #802 admission/health work: isolate optional
+shell/multiview export API stalls from scheduled Program publication. PR #808 stays
+draft, with its failed exact-head cadence evidence retained, until this repair is
+qualified. Installed validation may resume now that the owner reports the app closed.
+
 | Order | Lane | Issue | Remaining work |
 |---|---|---|---|
 | Incident | A | [#790](https://github.com/iamfatness/CoreVideoPro/issues/790) | Owner priority October 5: fix confirmed screen-share teardown callback reentrancy that crashed the SDK helper during the live meeting test. Add deterministic lifecycle regressions, verify helper-loss reporting, ship a corrective beta and repeat live acceptance. Preempts the normal queue until the crash repair ships. |
@@ -99,7 +105,7 @@ These can preempt Next on a show night. They do not jump the ranked Now item unt
 |---|---|
 | [#798](https://github.com/iamfatness/CoreVideoPro/issues/798) | Hosted fake-core initial zoom-snapshot request timed out before polling assertions in #792 CI. Exact PR full suite and targeted hosted rerun passed; failed job retained. Attribution unknown, distinct from #754; needs owner rank. |
 | [#802](https://github.com/iamfatness/CoreVideoPro/issues/802) | Approved #517 CPU fallback boundary after merged #797/#801. Merged #805 fixes GPU/CPU format coexistence. PR #806 adds optional SHM BGRA uploads on the preparation owner; Zoom/I420 preparation, lifecycle and delivery qualification remain. Preserve source playout/guest trim, CPU/ISO and identity. No independent rank change. |
-| [#804](https://github.com/iamfatness/CoreVideoPro/issues/804) | #517 measured follow-on: GPU-ready Program packets expired during scheduled shell/multiview export calls (16.6–19.4 ms); retained losses fail release qualification. Trace/preparation/publication repair needs owner priority relative to approved #802. |
+| [#804](https://github.com/iamfatness/CoreVideoPro/issues/804) | #517 measured follow-on: GPU-ready Program packets expired during scheduled shell/multiview export calls (16.6–19.4 ms); retained losses fail release qualification. Owner promoted October 7 ahead of remaining #802: isolate optional publication from native delivery with bounded independent GPU read leases; preserve failed evidence and repeat exact-head qualification. |
 | [#807](https://github.com/iamfatness/CoreVideoPro/issues/807) | macOS Metal full native CI suite segfaulted on #806 after focused checks passed. Attribution unconfirmed; retain the failed trial, identify the test/stack and verify exact-head CI. Unranked; does not replace approved #802 work. |
 | [#782](https://github.com/iamfatness/CoreVideoPro/issues/782) | Windows supervisor disposal queried an already-disposed Process in the crash lock-order CI test. Captured stack and run; attribution and focused fix need owner rank. |
 | [#784](https://github.com/iamfatness/CoreVideoPro/issues/784) | Screen/window capture flashes after asynchronous WGC lifecycle change: the shell rejects connecting and auto-retries, repeatedly restarting sessions. Fixed in merged #785 and beta `beta-2026-10-04-92e6b1e`: accepted pending requests are preserved and repeated connect is idempotent. Owner visual check was positive; installed capture alongside streaming acceptance remains. |

docs/reference/render-delivery-spec.md

@@ -240,3 +240,49 @@ Build one candidate with commit, flags, adapter/driver, source formats, receiver
 - [Existing export isolation](https://github.com/iamfatness/CoreVideoPro/blob/75c3838/native/src/modules/D3DDecoupledExport.h)
 - [Shedding policy](https://github.com/iamfatness/CoreVideoPro/blob/75c3838/native/src/core/MonitorShedPolicy.h#L98)
 - [Existing render-budget issue and earlier measurements](https://github.com/iamfatness/CoreVideoPro/issues/517)
+
+## Windows buffered optional publication ownership (#804)
+
+The native delivery packet and optional shell/multiview snapshots have distinct
+publication boundaries. Preparation holds input key 1, converts the exact image
+to owned NV12 when requested, and copies it into a per-slot immutable BGRA
+snapshot. It releases the input to key 0 and verifies the preparation GPU event
+before marking the slot Ready. Scheduled delivery makes no D3D calls; it advances
+the native sequence/PTS and queues the NV12 packet. Its sharedTexture is empty.
+
+Shell and multiview each own a separate device/context, completion query and
+stable keyed output texture. Each accepts at most one source read lease, including
+running work; an occupied or failed branch refuses subsequent offers instead of
+queuing them. A free branch cannot be held behind the other reader. The original
+slot pool remains depth + 3 (five slots for the two-frame setting); slots with
+outstanding readers cannot return to the producer. The additional immutable BGRA
+snapshot costs width * height * 4 bytes per slot, approximately 39.6 MiB at 1080p
+with two-frame buffering, excluding existing input/output/readback allocations.
+There is no per-frame texture creation or growing handle cache.
+
+Each export worker verifies its actual GPU copy event before dropping its source
+lease. Metadata retains that same frame number, delivery sequence, generation
+and render-plan evidence, and advances before key 1 exposes the completed copy.
+latestDeliveredProgramFrame peeks the completed shell snapshot; the multiview PGM
+cell separately peeks the completed multiview snapshot. Native output consumers
+continue using takeDeliveredProgramFrame. A delayed optional snapshot must not
+advance native delivery counters or claim display presentation. Existing stable
+handle/key consumer semantics are preserved; physical receiver/display frame
+identity still needs the parent qualification evidence.
+
+Busy output ownership preserves the previous published snapshot. A GPU-query
+error/timeout or uncertain exception disables that branch and quarantines its
+source slot rather than permitting a future frame to overwrite an unfinished
+read. A two-second query limit bounds polling; a driver API that never returns
+can still prevent joining its worker during teardown. Device recreation and
+that driver-hang shutdown case remain separate lifecycle qualification limits.
+
+The bounded asynchronous [program-buffer-export] trace reports branch, frame,
+generation, completed/refused/busy/unconsumed counts and maximum worker API wall
+time at most once per second per active branch. Its GPU read completion flag is
+not display presentation proof. Refusals also contribute to the existing
+aggregate displayBusy diagnostic. Native deadline misses/underruns remain
+independent; optional refusal never becomes a successful native frame claim.
+The fault test holds either branch for roughly one second while native NV12
+continues at 60 Hz, reads the other branch's actual GPU pixels and then checks
+that the delayed image still contains its original tagged pixels.