Assets tab: browse, preview and place the whole shipped catalog

[mefisme]

What this changes

Adds the Assets tab — a browser over DOOM's entire shipped asset catalog, with real previews and
one-click placement — plus the engine-call fixes found while building it.

This is a large PR for one feature area. It is 29 commits and the history is meant to be read: each
commit is one decision with its evidence in the message, and several of them record a wrong turn and
the measurement that corrected it. If you review by commit rather than by squashed diff, the
reasoning is there.

Everything is enumerated live from the game's own containers at startup. No pre-extraction step, no
bundled asset list, no DOOM bytes in the repo.

---

The asset browser

The catalog. Every category is read out of snap_gameresources.index at load. Only snap-box
assets are listed, with sounds as the deliberate, tested exception: SnapMap never mounts the
campaign's gameresources.resources, so a campaign-only model resolves in the editor as a black cube.
Sounds are exempt because a sound decl is a thin wrapper and the audio lives in Wwise banks loaded
independently of the .resources boxes — they have a side door, materials and models do not.

Categories: Materials, Images, Models, Modules, Brush models, Clip models, Sounds, Lights, FX,
Particles, Decal atlases, Entity defs, Editor defs, Perks, SWF / Flash, plus a user-owned Pinned
shortlist.

Material previews are real pixels. A material's pages are located in the shipped megatexture set
and decoded with DOOM's own page decoder, called in-process. That decoder is a pure function — no
renderer, no GPU, no virtual-texture state, no map residency — which is the property that makes
whole-catalog browsing possible at all: a preview does not require the loaded map to have the
material on screen. Materials with no atlas rect (roughly half the catalog) fall back to reading the
image out of the .index/.resources containers and decoding BC1/BC3/BC7 directly.

This replaced an earlier render-capture route that only ever produced static noise. The transport
that survived it is route-independent, so the producer could be swapped without touching the
frontend.

Sound previews audition through the editor's own preview path with working play/stop, rather than
the testSound console command — which throws its emitter handle away, so it can neither be stopped
nor prevented from stacking a new voice on every click. The preview session is scoped to window
focus: background audio is only wanted while DOOM lacks focus, so blurring the Snapmap+ window ends
the session and hands the editor its audio back.

Apply to selection patches the selected entity's decl and commits immediately — one entity at a
time, since it edits the decl the editor has open. New entity authors a one-entity prefab and
stages it through the engine's own paste path, so it arrives held and ready to place.

Each carrier is gated to the classes that own the field it writes, in one function:

Asset	Writes	Allowed on
Material (name or Virtual Mapping)	customMaterial / virtualmapping	render-capable classes — blocking volumes, triggers, props, movers, idAI2*, cap entities, dynamic SnapMap entities
Model · Brush model · Module · Clip model	renderModelInfo.model (+ clipModelName)	the same set plus interactables, minus three whose model is the mechanic
Sound	sound	speakers
Light material	lightMaterial	lights
Particle	particleSystem	emitters
FX	fxDecl	FX entities
anything	—	never the player start, a variable, or a SnapMap action

Two notes on how those lists were arrived at, since both look wrong at first glance. FX appears to
need a denylist: 371 shipped defs across 39 classes carry an fxDecl. None are placeable in SnapMap
— the set a mapper can select is the editor's own fx/ category, which resolves to three runtime
classes, 45 of its 49 entries being idVolume_ToggleableDamageOverTime. And the gate keys on
class, never on palette-placeability: idSnapMapParticleEmitter has no placeable palette entry,
yet this tool creates one by overriding the classname on snapmaps/unknown, so gating on
placeability would have refused the emitter it just made.

Materials and models share one list on purpose — anything that can wear a model can wear a surface.

Things the catalog turned out to be, that we assumed wrong first

• A module places as one entity that is both visible and solid, by writing both halves — baked
  geometry to renderModelInfo.model, its paired collision to clipModelInfo.clipModelName. The two
  live at unrelated paths and pair 232-for-232 by a total path rule; the browser derives the
  collision name. The inherited CLIPMODEL_AUTO is left alone — naming a clip model overrides the
  automatic derivation on its own.
• Materials are addressable two independent ways and neither set contains the other. Listing only
  material decls hid thousands of .vmtr atlas rows that are paintable via Virtual Mapping but
  have no decl authored. The list is now the union, and SH_ASSET_VTONLY lets the UI gate the Custom
  Material carrier honestly instead of guessing.
• Sounds are two sources too. A sound decl and a Wwise event are different sets; a decl-only
  list was missing ~2,600 names including the generic SnapMap VO. Union, deduplicated
  case-insensitively — the manifest spells events Play_Vo_... and decls are lowercase.
• Breakable props were filed under a decl type we never read. A breakable decl describes how
  something shatters and names a model; those 108 models are indexed as discreteAnimation, not
  model, and are invisible to a model-only catalog. They are in the snap box, so they load.
• Lights are not an asset class. The asset is the light material — the projection a light shines
  through, written as lightMaterial. Point vs spot is which entity carries it, so it is the Create-as
  choice. The list is material decls under lights/ and lights_blended/; the underscore makes
  the second a sibling rather than a subfolder, and matching only the first silently dropped every
  flare.
• The game index is a record-per-blob table, not a catalog of distinct assets. The same decl can
  be baked into .resources more than once at different offsets, and the index lists each copy —
  decalatlas had 1,673 records for 1,024 distinct names. That is why decals appeared twice, and why
  clicking one row selected both (the UI keys off the name). Now collapsed.

Smaller browser behavior worth knowing

• Sounds are filed by soundbank, not by name: their own names carry no structure, so the tree was
  one root folder of ~8,000 rows. 24 sensibly-sized banks; an event listed in several is filed under
  one home so nothing appears twice; search cuts across banks rather than within the open one.
• Pinned is a cross-type shortlist in its own pinned.json, deliberately not in config.json —
  the settings file is all-or-nothing on a parse error, and a malformed pin list has no business
  resetting somebody's theme. The host moves the bytes and parses none of them.
• Cross Platform Textures filter: the 224 megatexture rects hand-tested to render identically on
  PC, Xbox and PlayStation, with a ramp-tiling picker and a bloom-mask control scoped to Virtual
  Mapping only (confirmed in-editor that only the triplanar ambientprogram reads them).
• "No ramp" removes the ramp rather than declining to write one — on an entity that already had a
  ramp1 the option previously did nothing, which is exactly the entity someone picks it for.
• No Refresh control: the catalog is indexed once per process from files that cannot change while
  the game runs, so it re-fetched identical bytes and could not recover a failed index either.

---

Bugs fixed

• The Ctrl latch in the SWF text editor. After one Ctrl+C or Ctrl+V, every subsequent bare c or
  v typed into any editor text field copied or pasted — typing "variable" pasted the clipboard once
  per v. Owner-reported, confirmed fixed live. The flag was set on Ctrl key-down and cleared on
  key-up, and modifier key-ups are not reliably delivered to a focused SWF script object. It had been
  justified as tracking Ctrl "exactly the way the stock handler tracks Shift" — but the stock handler
  reads Shift only while processing the keystroke it was handed, so a release it never sees costs
  nothing. Ours was consulted on later keystrokes. The mechanism was copied without its lifetime
  assumption.
• A sound preview could take the whole sound engine down. Owner-reported: an access violation then
  a freeze. DOOM's StartSound_wwise publishes a new emitter into the sound world's live list before
  initialising it, and idSoundWorld::Update walks that list on an audio worker thread — dereferencing
  the pointer that is still null inside the window. Calling from a non-main thread widened a race the
  engine gets away with internally; every audition now runs on the main thread.
• Duplicate rows across the catalog (decal atlases, images) — see the record-per-blob finding above.
• Duplicate sound rows, twice over: 449 path-form decls are wrappers around an event already
  listed, and the first fix caught only the ones whose twin was a bare event, missing the 129 whose
  twin was another flat decl.
• Materials that existed but could not be found — the decl-only catalog, above.
• Arrow-key paging only moved a highlight in the asset list; seeing what a row was needed a
  follow-up Enter. File rows now auto-select (debounced, so holding the key previews only where you
  stop); folder rows still need Enter, since opening one replaces the whole list.
• The built-in Unknown tile's property sheet gained clipModelInfo.size and
  renderModelInfo.color, so a user overriding unknown.decl has more than displayName and
  spawnOrientation to work with.
• The last hardcoded engine RVAs are gone, replaced by signature resolution, and a [64] in the
  test arrays that hid a truncated signature DB was fixed — it had bitten once before.

---

Docs

Updated per docs/contributing.md section 9, each doc getting the layer it already covers:

Doc	What was added
capabilities.md	the category inventory, previews, apply rules, soundbank filing, Pinned, pinned.json
webview-ui.md	dated changelog entries for the frontend work
backend-changes.md	the record collapse, the main-thread audition, the Ctrl latch
architecture.md	the extension-slot range, and the two-file split of persistent state
rawmap-shadow-gate.md	new — the save-shadow/load-swap coupling, recorded as an open decision (issue #63)

---

Testing

• build.ps1 → package.ps1 → deployed into a real DOOM install and exercised in the SnapMap editor.
• Native suite: 15/15.
• Installer suite: gofmt clean, go vet clean, go test — the install round-trip tests refuse to
  run while DOOM is open (the installer's own guard); they pass with the game closed.
• Live in-game: material and sound previews across categories, Apply and New entity for models,
  modules, sounds, FX, particles and lights, prefab place, and the breakable models specifically
  (they render rather than showing the campaign-box black cube).

Known limitations

• Perks and SWFs are reference-only. A perk is granted by an idTarget_Command entity and a
  .swf belongs to an entity that owns a screen; neither structure is worked out yet, so both are
  names to copy and wire by hand. They are listed under Reference rather than Placeable on purpose —
  a category under Placeable whose Apply does nothing reads as a broken tool.

• The per-carrier allowlists are built from the classes we have seen own each field in a shipped def,
  not derived exhaustively from the class universe. A legitimate target nobody has encountered is
  refused rather than permitted — the safe direction to be wrong in, but it does mean a refusal here
  reads as not known to work, not proven not to work.

• An unexplained off-by-one in the sound catalog: 8,028 rows file against 7,649 distinct events
  with 378 unbanked, leaving one more banked row than there are events. Sound names are unique in both
  boxes, so the obvious explanation is ruled out. One row in 8,028, no known consequence; recorded in
  backend-changes.md rather than left out.

• The point and spot light inspectors ship different valid-material whitelists (21 shared, one
  unique each). We do not enforce either — the list is the broader known-good set.

---

Checklist

• Clean-room: this is my own reverse-engineering / implementation -- no decompiled or copyrighted DOOM or
  original-SnapHak content is pasted into the repo.
• No binaries added (.dll / .exe / .obj / .pdb / .zip ...) -- the source is the only deliverable.
• Source stays pure ASCII (.c / .h / .cpp / .ps1).
• Built + tested locally: build.ps1 -> package.ps1 -> deployed into a real DOOM install, and I ran the Go
  (gofmt / go vet / go test) and C (tests\run-tests.ps1) suites, and confirmed it works in DOOM.
• Docs updated in this PR for any behavior change (see docs/contributing.md section 9).

Notes on the boxes, so a reviewer does not have to take them on trust:

• No binaries — verified by filtering the full diff against upstream/main for binary extensions; none.
• Pure ASCII — three files this branch adds carried a UTF-8 section sign in a comment and were fixed in
  6f40391. apply_engine.c keeps six that predate this branch; changing them is not this PR's business.
• Deployment — the overlay was dropped into the DOOM root by hand rather than through
  snapmap-plus.exe install --local dist, which contributing.md section 6 allows (dist/ mirrors the overlay
  tree). Both DLLs were hash-verified against dist/ after every copy.
• The DOOM-image signature tests (sig_test / hooktol_test) were run for the signature work earlier in this
  branch, which is the change that required them.