Mock game: render every backend UNCAPPED + assert a healthy present rate

The mock backends presented with vsync ("a game-like cadence") -- wrong for a
perf/stress fixture: it does trivial work on an RTX 4090, so it must run as fast
as it can. Vsync capped them to tens of fps (dx9 30, dx10 23, dx11 63, dx12 126),
which hid both capture-induced slowdowns and the hook-removal race. Uncapped now:

  dx9/dx10 INTERVAL_IMMEDIATE / Present(0,0) (BLT), dx11/dx12 ALLOW_TEARING +
  Present(0, ALLOW_TEARING) (flip), gl wglSwapIntervalEXT(0), vk IMMEDIATE/MAILBOX.

Measured no-hook: dx9 ~21000, dx10 ~2800, dx11 ~17000, dx12 ~12000, gl ~26000, vk
~24000 fps.

mock_game_test now adds a present-rate floor per backend (>= 300/s while
capturing): with the hook live every backend stays in the hundreds-thousands
(vk 13500, dx11 9000+, gl 1800, dx9/10 ~1000-1600, dx12 2500). This is the
dimension the frame-advance checks missed -- the Vulkan 144->3 FPS stall still
advanced frames -- so it catches a present-thread stall OR an accidental vsync.

The faster storm exposed the hook-removal UAF fixed in the previous commit.
README roadmap + lessons-learned updated (incl. correcting the old "reset makes
in-flight trampoline calls safe" claim). Full suite 21/21.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -108,18 +108,6 @@ default** and covers anything the hooked path doesn't.
 
 ## Roadmap
 
-### Current tasks
-
-- **DX12 capture is measurably slower than the other backends — find out why and improve it.** The
-  present-thread overhead guard shows DX12 ~0.34 ms vs DX11 ~0.05 ms / OpenGL ~0.09 ms (the D3D11On12
-  bridge). Investigate and reduce it.
-- **The mock game must implement and test *every* rendering backend.** Today `coop_mock_game` only
-  drives D3D11/D3D12, so the Vulkan/OpenGL/D3D9 capture paths have no game-driven coverage (which is
-  why the Vulkan present-thread stall slipped through). Add Vulkan, OpenGL, and D3D9 renderers to the
-  mock game and exercise each through the capture + perf tests, so it serves as a real-world test.
-
-### Done
-
 The near-term tracked tasks are complete: injection hardening (the cross-backend safe-unhook drain),
 two-path audio-format correlation (rate + channels/bit-depth recovery), mouse + keyboard forwarding
 for DirectInput and Raw Input games, real-game Vulkan validation (`coop_vk_validate` against Sphere
@@ -132,9 +120,16 @@ directory and `vk_hook` intercepts present/swapchain resolved via `vkGetInstance
 `vkGetDeviceProcAddr`). Both Vulkan paths are verified on the real game. The capture also **preserves
 the game's sync mode** — it passes the swapchain's present mode through untouched and no longer
 throttles the mirror (vsync paces it): Sphere Spectacle requests `FIFO` and holds a steady 144 Hz
-with the layer attached. See **Lessons learned** and
-the test suite for each. Open directions: per-game profiles, multi-guest virtual-pad mapping, and
-continuous raw-mouse *movement* forwarding (the MKB event stream is position-based today).
+with the layer attached. The **mock game now drives every backend uncapped** (DX9/10/11/12 + OpenGL +
+Vulkan, thousands of fps — the slow vsync'd cadence was masking bugs), `mock_game_test` asserts each
+keeps a healthy present rate while capturing, and that faster stress **exposed and fixed a
+hook-removal use-after-free** (the inline-hook removal now disables → drains → destroys, and the
+shared drain settles before concluding, so a backend presenting at thousands/s survives the
+hook/unhook storm). DX12's higher capture cost was traced to the inherent D3D11On12 bridge (not
+`CreateWrappedResource`) and documented; a native-D3D12 copy path is the remaining (deferred)
+improvement. See **Lessons learned** and the test suite for each. Open directions: per-game profiles,
+multi-guest virtual-pad mapping, continuous raw-mouse *movement* forwarding (the MKB event stream is
+position-based today), and the native-D3D12 capture path.
 
 ## Building
 
@@ -675,15 +670,23 @@ Non-obvious things that cost time and constrain the design:
   mid-flight on the game's render thread → use-after-free → the game crashed (Brotato, on its
   OpenGL path; reproduced across every backend by the `mock_game_test` storm). The generalised fix
   (`hook/src/hook_guard.hpp`, `DetourGate`): every detour wraps its body in an RAII active-count
-  `Guard`; `remove_*` (1) restores the hook so **no new detour can start** — reset the inline hook
-  (SafetyHook's mutex-guarded call wrappers make any in-flight trampoline call safe), or, for the
-  focus WNDPROC subclass, restore the window proc — then (2) `drain()`s the active count to zero,
-  and only **then** (3) frees the shared state. **Vulkan is the exception**: the game caches our
-  `hk_vkQueuePresentKHR` pointer at resolution time and keeps calling it even after the GPA hook is
-  reset, so a reset can't stop new detours — instead removal closes an atomic **capture gate**
-  first (the detour then passes straight through to the real present without touching the read-back
-  state), drains, and only then frees. The drain is bounded (~400 ms) so a wedged game thread can't
-  hang the worker; detours are micro- to milliseconds, so it returns almost immediately.
+  `Guard`; `remove_*` (1) **disables** the hook so **no new detour can start** — for a SafetyHook
+  inline hook that's `disable()` (restore the original bytes under thread suspension) **not** `= {}`,
+  because destroying frees the trampoline immediately and an in-flight detour about to call it
+  (`.stdcall()`) then uses freed memory; or, for the focus WNDPROC subclass, restore the window proc
+  — then (2) `drain()`s the active count to zero, and only **then** (3) destroys the hook (frees the
+  trampoline) and frees the shared state. Two subtleties the *uncapped* mock storm (thousands of
+  presents/s) exposed that the old vsync'd one (tens/s) masked: **(a)** the original code did `= {}`
+  before draining → trampoline UAF (now disable → drain → destroy, keeping the trampoline alive
+  across the drain); **(b)** `drain()` returned the instant the count read zero, but a thread can be
+  *inside* the detour yet not have reached its `Guard` constructor (the few-instruction prologue is
+  unguarded), so it `Sleep(1)`s **before** each zero-check to let such a thread register. **Vulkan is
+  the exception**: the game caches our `hk_vkQueuePresentKHR` pointer at resolution time and keeps
+  calling it even after the GPA hook is reset, so a reset can't stop new detours — instead removal
+  closes an atomic **capture gate** first (the detour then passes straight through to the real present
+  without touching the read-back state), drains, and only then frees. The drain is bounded (~400 ms)
+  so a wedged game thread can't hang the worker; detours are micro- to milliseconds, so it returns
+  almost immediately.
 - **Capturing at `Present` decouples the mirror from DWM composition.** The hook copies
   the backbuffer inside the game's `Present`, which the game issues at its true render
   rate regardless of how DWM composites that *window*. So an unfocused game window can