1 files changed, 104 insertions, 0 deletions

diff --git a/src/ISURFACE_STATUS.md b/src/ISURFACE_STATUS.md
new file mode 100644
index 0000000..32a27bb
--- /dev/null
+++ b/src/ISURFACE_STATUS.md
@@ -0,0 +1,104 @@
+# HL2hake ISurface Drawing — Status Report
+
+## Date: 2026-09-12 (final round)
+
+## Result: WORKING
+
+Overlay drawing works in-game and in menus. Draw path: `PaintTraverseEx`
+hook (slot 114) on the copied ISurface vtable, wrapping our draws in
+`PushMakeCurrent(panel, false)` / `PopMakeCurrent(panel)` around ISurface
+slots 6/10/12/17/18/20/22/66/67.
+
+## Confirmed ISurface VTable Slots (disassembly-verified, binary=SDK header+4)
+
+| Slot | Function                                  | Evidence |
+|------|-------------------------------------------|----------|
+| 6    | `GetEmbeddedPanel()`                      | returns VPANEL used with PushMakeCurrent |
+| 8    | `PushMakeCurrent(VPANEL, bool)`           | verified via disassembly |
+| 9    | `PopMakeCurrent(VPANEL)`                  | verified via disassembly |
+| 10   | `DrawSetColor(int r,g,b,a)`               | stores RGBA at `this+0x24..0x27` |
+| 12   | `DrawFilledRect(int x0,y0,x1,y1)`         | verified via disassembly |
+| 17   | `DrawSetTextFont(HFont)`                  | stores HFont at `this+0x290` |
+| 18   | `DrawSetTextColor(int r,g,b,a)`           | stores RGBA at `this+0x28..0x2b` |
+| 20   | `DrawSetTextPos(int x,y)`                 | stores at `this+0x2c/0x30` |
+| 22   | `DrawPrintText(wchar_t*, int, drawType)`  | reads font `0x290`, pos `0x2c/0x30` |
+| 66   | `CreateFont()`                            | SDK header 62; empirical (379) |
+| 67   | `AddGlyphSetToFont(font,name,tall,weight,blur,scanlines,flags,rangeMin,rangeMax)` | SDK header 62+4; disassembly (slot 67 = 0x6a300, passes 9 args to FontManager) |
+| 87   | `SolveTraverse`                           | InternalSchemeSettingsTraverse profiling strings @ 0x73240 |
+| 88   | `PaintTraverse(VPANEL)`                   | tail-calls `ipanel->vt+0x1c8(panel,false)` @ 0x697e0 |
+| 114  | `PaintTraverseEx(VPANEL, bool paintPopups)` | IsVisible check `ipanel+0x40`, popup array `this+0x250/0x25c`, "Too many popups!" assert @ 0x6dd46 |
+
+Slot mapping rule: **binary slot = SDK-header slot + 4** (confirmed via
+CreateFont 62→66 and PaintTraverseEx 110→114). Vtable has 179 entries;
+slots 122–148 = second base class `IMatSystemSurface`
+(AttachToWindow=122 … DrawSetTextureRGBAEx2=148).
+
+## Draw-Path Decision
+
+- **Primary: PaintTraverseEx (slot 114)** — fires every frame for the root panel.
+- **Fallback kept: DrawPrintText (slot 22)** — fires only when the game draws
+  text (menus); also used as in-draw call site for the game's own text.
+- `g_in_draw` (hl2h.cpp) prevents recursion; both hooks call `outer_draw()`
+  (menu.cpp) guarded by it.
+
+## Fonts (the long fight)
+
+Font alignment problem: `Tahoma` placeholder fontconfig-substituted to
+Noto Sans → per-glyph baseline jumps (fallback-substitution glyph metrics).
+Fixes tried in order: Tahoma → DejaVu Sans (+ANTIALIAS 0x10) → no AA →
+**winner: "Liberation Sans" 16px, weight 400, flags 0x400 (FONTFLAG_CUSTOM), glyph range pinned 0x20–0xFF**.
+`FONTFLAG_CUSTOM` disables the Asian fallback-compat glyph path; pinned
+range forces one font pass → uniform metrics, no jumping letters.
+
+fc-match findings (system fontconfig):
+- `Tahoma` → NotoSans-Regular.ttf (substituted — unusable)
+- `DejaVu Sans` → native, but jumping letters persisted
+- `Verdana` → Noto Sans (substituted)
+- `Liberation Sans` → LiberationSans-Regular.ttf (real, installed) ✓
+
+## Surface Internals Observed
+
+- Paint-stack count: `this+0x270` (nonzero while painting)
+- Stack array: `this+0x264`, 0x1c-byte entries
+- Popup array: `this+0x250/0x25c`
+- Current font: `this+0x290`; text pos: `this+0x2c/0x30`
+
+## Menu
+
+- Tree: HL2hake → Climb/Bunnyhop/ABH, children indented (`g_depth[]`, +12px/level).
+- Right-aligned state at x=200: `[on]`/`[off]` for Active rows,
+  `[keyname]` for Bind rows, `[press key]` while binding.
+- Feature gating: `feature_active(int)` (menu.cpp) — active AND
+  (bind==0 or key held). Called from `do_move` (hl2h.cpp) to gate
+  climb (middle-mouse) and bhop (jump) branches.
+- Config: INI at `~/.hl2hake.ini` (climb/bhop/abh active+bind).
+
+## Build / Run
+
+- `./build.sh`: g++ `-m32 -O2 -fPIC -shared`, links 5 TUs, `-ldl`,
+  `-Wall -Wextra -Werror` (all warnings fatal).
+- `./play.sh -windowed +map d1_trainstation_01` (Steam runtime wrapper,
+  `LD_PRELOAD=libhl2hake.so`).
+- Logs: `/tmp/hl2hake.log` (logf), `/tmp/hl2run.log` (stderr).
+- Probe logging (`hook fired:`, `probe:`) removed 2026-09-12.
+- `HL2H_DRAW_TEST=1` env: draws red rect + "HL2H DRAW TEST" without
+  opening the menu.
+
+## Lessons
+
+1. **Never pipe-mask build failures**: `./build.sh | tail` hides g++ rc.
+   Use `./build.sh > /tmp/build.log 2>&1; echo rc=$?`. This masked a
+   dropped `static bool g_in_draw` declaration for a whole session.
+2. PIC base recovery in vguimatsurface.so: string refs are
+   `lea -disp(%reg)` after `call thunk; add $const,%reg`; base 0x271000
+   for slot-87/114 region.
+3. Check binary freshness: `strings libhl2hake.so | grep -c <newstr>`
+   — mtime can lie (build silently failed).
+
+## File Locations
+
+- Project: `/home/salmon/Documents/rust/hl2h/`
+- Hook + feature logic: `src/hl2h.cpp`
+- Menu + drawing + config + input: `src/menu.cpp`
+- Shared API: `src/hl2h.h`
+- SDK headers: `source-sdk-2013/src/public/vgui/`