Vulkan: remove dead USE_UPLOAD_QUEUE; simplify reversed-depth branches

[cursor]

Flags / compile toggles removed

1. USE_UPLOAD_QUEUE (implicit dead feature)

   • Why safe: The macro was never defined by CMake or any header in-tree. The #ifdef blocks could only ever compile the #else path. The #ifdef branch also referenced symbols (vk.image_uploaded, vk.rendering_finished, vk.cmd->rendering_finished2, vk.staging_command_buffer) that do not exist on Vk_Instance / vk_tess_t, so enabling the macro would not have been a viable configuration.

2. Non-reversed branches behind USE_REVERSED_DEPTH

   • Why safe: USE_REVERSED_DEPTH is unconditionally #defined in src/renderers/vulkan/vk.h for the Vulkan renderer. The removed #else paths were never selected in any supported build. USE_REVERSED_DEPTH remains defined for GLSL (compile_shaders.sh still passes -DUSE_REVERSED_DEPTH for the listed shaders).

Behavioral parity

• Active path preserved: Queue submit/wait/present remains the single-semaphore path that was always compiled before. Reversed-depth math, clears, depth compares, polygon offset, SSAO push constant, and flare ortho Z range match the previous #ifdef USE_REVERSED_DEPTH / #ifndef USE_REVERSED_DEPTH branches that were actually in use.
• Build: ./scripts/compile_engine.sh vulkan (Release) succeeded.
• Tests: ctest in build-vk-Release — all 19 tests passed (smoke, renderer regression, unit tests).

Notes

• OpenGL renderer (src/renderers/opengl/tr_main.c) is unchanged; Vulkan-only tr_main.c edits are under #ifdef USE_VULKAN as before.

  

[cursor]

Security review completed for PR #148.

Outcome: no high-confidence medium, high, or critical vulnerabilities found in the added or modified code. The diff removes dead Vulkan upload-queue compile branches and non-reversed-depth code paths; I did not find a new attacker-controlled path to injection, auth/permission bypass, secret exposure, traversal/SSRF/XSS, unsafe deserialization, or supply-chain risk.

Prior automation threads: none found to revalidate.

  

_{Sent by Cursor Automation: Find vulnerabilities}