v1.4: audit unframed C_livery transforms before silent misrender

[Datamining00]

Diagnostic hardening derivative of v1.4-bare-parent-transform-fix.

Why

The rendering defect is a parser/grammar problem, not corrupt source artwork: FH6 C_livery can contain valid transform records that the pinned decoder may fail to frame. When that happens, transform bytes are walked as ordinary bytes and the resulting group can be placed at the wrong location while still producing the expected layer count.

The targeted bare-parent fix corrects the proven bare parent -> extended child transform -> group variant, but a one-off visual patch is not sufficient for arbitrary future liveries.

What the first real audit showed

The first audit JSON reported 984 raw candidates. That number is not 984 parser bugs. Audit v1 scanned every byte offset, so valid float/color bytes inside already-decoded records could look like transforms. It also failed to populate decoded_section_ranges because FH6 Assistant stores section provenance as source_section, not section.

The useful evidence is the repeated high-confidence extended-child pattern. In the supplied Right section the raw stream contains, among others:

• parent at 0x41DDC / decimal 269788: (-360.5, -31.0, 0.9000001, 3.5) followed by marker 0002000100000003;
• parent at 0x42660 / decimal 271968: (-373.5, 4.0, 1.0, 0.0) followed by the same marker and child transform (-0.0033054, -1.81714, 1.1799998, 3.6).

These are the same grammar family rather than car-specific coordinates. The existing group trace also shows the child group beginning at 272009 as a root-level markerless group in the pre-recovery tree, which is exactly the kind of relationship the bare-parent grammar is intended to preserve.

Structural Audit v2

Audit v2 no longer scans arbitrary raw offsets at runtime. It instruments the actual patched decoder walk and only inspects positions that every observed parser pass still consumes one byte at a time. A position that any parser pass recognizes as a multi-byte record is excluded from the unresolved set.

This means:

• bytes inside valid shapes/groups are no longer reported merely because they resemble floats;
• normal already-recognized group transforms are excluded;
• transforms recovered by the bare-parent fix are excluded;
• only structurally plausible transforms that the current decoder still silently walks byte-by-byte remain as warnings;
• section provenance now uses source_section with section fallback;
• the audit remains non-invasive and never changes tree ownership, transforms, masks, z-order, or rendering.

No car ID, section name, phrase, creator, source offset, or livery-specific coordinate is hard-coded into the parser rule.

Validation

• Windows CI: success.
• Full regression suite: 175 tests, OK.
• PyInstaller one-file build: success.
• EXE SHA-256: a67c164b9abd03e35562475506025f487c25d9c692a04a474ebc02c045fefb0b.
• Artifact ZIP SHA-256: 5aacc6bd0d6f244bd9738fc308d2e1fa6fa980e2ac171ab97779e864b489ff9d.

This PR remains draft until the same real livery is run once with Audit v2. The resulting candidate count is the actionable measure of parser grammar still missing after the current recovery patches.