Producer snapshot ownership above the accepted render repair

Only this additive Patch Pipeline folder is authored. Two final host C++ units
are copied outside the checkout: presentation_identity.cpp and events.cpp.
The shared mailbox implementation is linked once by the game executable.
Submodules, RecompiledFuncs and RecompiledPatches remain read-only. No guest
function, save, allocator, launcher design, online protocol or peer ID changes.

The existing gfxtask_run_xbus entry callback receives the completed display-list
range before osSendMesg can enqueue it for the game scheduler. External-work
suppression remains before capture; Accurate presentation also receives the
snapshot. The scheduler transfers the memory lease when its RSP task starts.
The current private decode arena and all render guards remain unchanged.

Keys include the RAM owner, physical root and native command count, matched in
FIFO order. A consumed image cannot be reused. Address or size mismatches,
invalid captures and pending-set overflow disable early matching until session
reset, preserving the existing submission-copy fallback. Never search a later
slot by a recycled root or let a mismatch realign an ambiguous queue. Suppressed
graphics submissions retire any corresponding producer image. Reset discards
pending images without invalidating active worker leases. A session era also
rejects a capture that was copying when reset occurred. Pending metadata is
bounded to four images, and completed storage uses the existing four-slot pool.

The steady-state protected path still performs one 8 MiB submission copy and
the retained private decode copy. Copy timing moves to the producer. At most
four early pending 8 MiB images can be retained; live graphics-worker images
remain governed by the existing task lifecycle. No extra per-frame RAM dump,
full-memory comparison, synchronous GPU wait or change to SP/DP acknowledgements
is introduced. Logs announce activation and record bounded session counters.

The new synthetic fixture reproduces a late snapshot seeing reused invalid
indices, then verifies earlier capture preserves the original data. It tests
FIFO roots, invalid ranges, suppression-style retirement, fallback, overflow,
session reset and 8,000 concurrent transfers. Retained render/residency,
allocator, owned-entry and online fixtures remain required. Audit checks both
actual ROM-revision producer callbacks and both final host compiler bindings,
plus the full previous source chain. Packages use the accepted runtime-only
allowlist with archive read-back and static ELF dependency inspection.

The latest log narrows the fault to submitted data or its interpretation; it
does not identify the exact asset writer/free operation. Closing this verified
unprotected queue interval is a targeted prevention measure, not a claim that
the logged task has been reproduced in real gameplay. Manual acceptance still
requires zero malformed-task/allocator/HUD failures through repeated matching
track/menu tests, followed by online and spectator sessions.
