feat: cool ambient in wreck interiors, plus the #124 optics guard

[N1k4G]

Closes #124 — both the wreck half of the art direction and the reference frames and thresholds the issue asked be done last.

1. The wreck reads cool now (src/renderer.js)

The cave was fixed in #135. This is the same fix applied to the wreck's equivalent surface, which turned out to be somewhere else entirely.

scene	luma	chroma
wreck-engine-room	58.3 → 58.5	14.8 → 21.5 (+45%)
wreck-cargo-hold	64.4 → 64.7	19.4 → 27.9 (+44%)
wreck-crew-deck	66.2 → 66.5	22.8 → 31.8 (+39%)
wreck-vehicle-deck	61.4 → 62.0	26.6 → 35.4 (+33%)
cave (all three)	unchanged	unchanged
wreck-exterior-bow, reef-open-water	noise	noise

Mean luminance moves by at most 0.6 — deliberately. #124 asked that this not be a brightening exercise, and a torch-lit overhead should still read as dark. npm run pixi:visual-check reports 0% changed pixels, so the change is confined to the legacy client.

Where the wreck's gloom actually was. #124's last comment predicted the lever would be localised detail on the interior panels, the "tint the steel" family having already been ruled out. Both readings assumed the steel was what the measurements were seeing. It was not.

drawWreckHullSkin ends with a radial gradient documented as feathering the rim of the torch's near-field circle. A radial gradient holds its last stop past its outer radius, and this one fills the whole hull silhouette — so past ~53 px from the diver it paints rgba(28,33,38) at alpha 0.9 over essentially the entire interior frame. Chroma 10, near-opaque, everywhere. That is the wreck's exact analogue of the cave gloom overlay, and drawSiltAndTorch returning early for wrecks is why #135 could not reach it. Recoloured to a cool blue-teal at matched luminance (31.2 vs 32.3).

Two leads closed with evidence rather than left open, both recorded at the call site next to the earlier steel-tint finding:

• Localised surface detail — built, measured, reverted. A per-plate pass of rust blooms, flakes and seam tears scaled by the [Grafik][Material] Surface Accumulation: Sediment, Bewuchs und Rost reagieren auf Flächenausrichtung und Zone #56 accumulation moved frame chroma by under 0.5 with every alpha at 1.0, and moved a box around the torch-lit area by 34.8 → 34.7, 30.2 → 29.7, 26.0 → 26.5. Noise, in both directions. The gloom is why: a tenth of any backdrop detail survives it, and inside the bubble the structures cover the backdrop anyway.
• Per-zone atmosphere tints — works on the metric (engine room reaches 34.4), not taken. It pushed the interior toward generic blue water rather than flooded steel, and those values are deliberately authored character.

2. Reference frames and thresholds (scripts/interior-optics-check.mjs)

npm run interior:check     verify — CI-gated in pr.yml and deploy.yml
npm run interior:update    re-record the reference FRAMES, deliberately

Nine scenes — four wreck interiors, three cave interiors, two open-water controls — each with a band on per-pixel chroma and one on mean luminance.

Thresholds are code; frames are data. --update re-records the PNGs and never touches a threshold. That split is the point of #124's sequencing warning: thresholds derived from what is currently on screen describe the current state, so recording them while that state is the shortfall locks the shortfall in.

Floors sit midway between each scene's measured flat and fixed states — most headroom either side that still catches the regression:

scene	flat → fixed	floor	catches by	headroom
wreck-vehicle-deck	26.4 → 35.5	31.0	+4.6	−4.5
wreck-crew-deck	22.5 → 31.7	27.0	+4.5	−4.7
wreck-cargo-hold	19.1 → 27.9	23.5	+4.4	−4.4
wreck-engine-room	15.0 → 22.5	18.5	+3.5	−4.0
cave-upper-tunnel	9.8 → 17.5	13.5	+3.7	−4.0
cave-restriction	12.0 → 19.2	15.5	+3.5	−3.7
cave-cathedral	16.7 → 23.6	20.0	+3.3	−3.6

Both columns were measured by this script, by reverting the two gloom colours and re-running it — every floor is calibrated against a real state of this codebase, not an estimate.

Verified three ways: clean passes all nine; reverting #136 fails exactly the four wreck interiors; reverting #135 fails exactly the three cave ones. The controls hold in both cases.

Two contaminants the crop had to be moved off. #124 flagged that its baseline crop still caught fixed chrome. Tightening it turned up two, both found by measurement rather than by eye:

• The toasts are on the canvas, not the DOM, at y 0.18/0.30/0.36 — amber text, the highest-chroma pixels in frame, the hint line refilling from a queue on a timer. Worth 0.6–0.9 chroma and 6 SD. Now suppressed at source and asserted silent. Clearing them in one evaluate and measuring in the next left room for a frame that re-armed one, so settle/silence/read are a single evaluation.
• The dive computer looks like DOM and is not — canvas, x ≥ 880. A window running to 0.80 had its corner inside, worth 1.79% of measured pixels. The window is 0.48 wide instead.

Rather than trust a crop that looked right once, assertNoChrome proves it every run: two scenes sharing no scenery cannot legitimately agree pixel for pixel, so anything byte-identical across both is chrome. Measures 0.03% against a 0.5% budget. That is what stops the crop rotting next time the HUD moves — #125 alone reflowed the result screens.

Moving the window below the toasts instead was tried and rejected: it slides off the interior onto the seabed, taking the engine room's contrast from SD 17.1 to 7.9.

Frames are review artefacts, not a pixel diff. #133 established Playwright frames are deterministic per platform but not across them, and there is no linux set here. They are cut from the same canvas pixels the statistics read, so picture and numbers cannot disagree, and sized to the sample window.

Cross-platform drift: measured, not assumed

This started as a stated unknown — thresholds derived on win32, CI on linux, no linux node here to check. CI answered it, on the corrected harness:

scene	win32 / linux		scene	win32 / linux
wreck-vehicle-deck	35.5 / 35.5		cave-upper-tunnel	17.5 / 17.5
wreck-crew-deck	31.7 / 31.7		cave-restriction	19.2 / 19.2
wreck-cargo-hold	27.9 / 27.9		cave-cathedral	23.6 / 23.6
wreck-engine-room	22.5 / 22.5		wreck-exterior-bow	116.2 / 116.1
			reef-open-water	53.9 / 53.9

Every interior agrees exactly and the controls to within 0.1 — on renderers whose individual pixels differ by a max channel delta of 230 across 10.6% of them (#133). Aggregating over ~63k samples averages the rasteriser differences away completely, which is the assumption this guard is built on.

An earlier run measured up to 0.5 drift on interiors and 1.2 on a control. That turned out not to be the platforms: it was the harness letting the diver drift slightly between pinning position and reading pixels, and re-pinning every frame — done for the overhead-assertion fix, not for this — removed it. Worth knowing, because it inverts the natural assumption: when these numbers move, suspect the harness before the environment.

So the headroom is not reserved for an environment gap at all. It is slack for art changes that are meant to happen, which means a band that starts failing is overwhelmingly likely to be a real change.

Review round 2 (932910a)

Three findings, all valid; the first had made an assertion worthless.

The overhead assertion was self-fulfilling. The harness set inOverhead = true for interior scenes and then asserted it was true — reading back its own input. The failure that mattered was the quiet one: if geometry moves, or a hard-coded sample position leaves the room it is named after, forcing the flag keeps the guard green while measuring a view no player could reach. Now the position is re-pinned each frame and the game's own updateOverheadState() derives inOverhead = overheadAt(diverX, depth) as it does in play; the assertion checks both the geometry predicate and the settled flag, for interiors and controls — asserting wreck-exterior-bow is not in an overhead is a real check that control never had. Only the two animation ramps stay pinned, and they settle to whatever the simulation believes: easing state, not world state.

Verified all nine positions are genuinely correct against the current geometry, and that the assertion can now fail in both directions — moving wreck-engine-room outside the hull, and mislabelling reef-open-water as an interior, each abort with the real geometry and rested position.

Update mode could destroy the references it exists to protect. The chrome probe can only run after two scenes, but update wrote each PNG as it went — so a HUD change could overwrite all nine references with contaminated captures and only then fail the probe. Captures are now buffered; nothing reaches disk until the window is validated. Verified by widening CROP back over the dive computer: aborts at 1.81%, every reference byte-identical afterwards.

Update mode ignored luma breaches. It promised to flag frames outside "the thresholds" but checked chroma only, so a reference could be recorded at any brightness in silence. It now calls breachesFor — one definition of acceptable for both paths — and summarises how many frames were recorded out of band. Verified by tightening a luma band alone.

Thresholds re-derived. Removing the forced state shifted some absolutes (most under 0.1; engine room 1.4, exterior bow 3.1), so flat and fixed were re-measured on the corrected harness and two floors recentred on their new midpoints. Noise unchanged at under 0.1 over three runs. Both regressions still isolate correctly; frames re-recorded.

Verification

npm run lint, typecheck, sites:check, test:unit (133), test:parity (28), test:e2e (36), pixi:visual-check, interior:check (9 + chrome probe) — all pass.

🤖 Generated with Claude Code