D3D12Renderer m_composeTargets: show-thread emplace_back/resize races editor readers

[duremovich]

From the 2026-07-03 comprehensive review.

The show thread grows/mutates m_composeTargets at runtime while the editor thread indexes it — no lock, no reserve. Show-thread writes: createComposeTarget does emplace_back (D3D12Renderer.cpp:3525 — realloc moves every element); resizeComposeTarget recreates sub-resources + rewrites srvHandles (:3646+). Reached from CompositorSystem::update (show thread) whenever a screen is added or a layer gains its first effect mid-show. Editor-thread reads: getComposeTargetTextureID (:3790), isComposeTargetReady (:3836), getComposeTargetStableSrvSlot (:3807) from StageWindow.cpp:149-155 and ProjectorCalibrationWindow.cpp:440,680.

Triple-buffering (ADR-0014 §2) guards RT contents, not vector structure. The comment at D3D12Renderer.hpp:718-719 ("targets only added at startup before the show thread runs") is false.

Failure: add a screen / toggle a first effect during a live show with Stage or Calibration window open → torn D3D12_GPU_DESCRIPTOR_HANDLE → ImGui binds a garbage descriptor → GPU page fault / DXGI_ERROR_DEVICE_REMOVED.

Fix: reserve(MAX_COMPOSE_TARGETS) at init + atomic ready gate; the resize resource-swap path additionally needs a mutex or generation gate (reserve alone kills the realloc UAF but not the resize race).

[duremovich]

Fixed in 2dfde7c (core fix) + e5567b7 (review fixes).

Fix shape as endorsed, plus one addition the analysis surfaced: an editor ImGui command list can hold a compose-target SRV handle for up to a frame between record and ExecuteCommandLists — invisible to waitForGpu — so the resize path needed more than a CPU-side gate.

• reserve(MAX_COMPOSE_TARGETS) at initialize: emplace_back never reallocates.
• m_composeTargetCount published (release) only after full init; editor accessors bound-check it, never size().
• EditorReadGate + EditorFrameTracker (include/entity/render/EditorReadGate.hpp, unit-tested): per-target seq_cst generation gate keyed to editor-frame begin/submit counters. resizeComposeTarget closes the gate, defers until every editor frame begun before the close has submitted, drains the GPU, swaps, reopens. CompositorSystem retries every tick; output renders at old dims during a deferral; editor stalls never block the show thread.
• Liveness backstop (from the review pass): endShowFrame reopens any gate not re-asserted by a resize call that tick, so an abandoned deferral (dims revert, screen deleted, invalid snapshot dims) can never strand the editor preview blank.

Stale header comment ("targets only added at startup") fixed; ADR-0014 amended (third entry). Both Tracy legs build + pass ctest; failures were #69-class WARP under-load flakes, all pass in isolation.

Follow-up found by the review: video-texture slot frees have the identical hazard class (beginShowFrame's deferred drain vs unsubmitted editor cmdlists holding the slot's SRV handle) — separate issue to come.