TURN RECORD: THE EXPORT HANDLER SIMPLY PROPAGATES THE RENDER DRIVER'S CODE.
(Undecoded code at 0x630BC..0x630E7 was the missing link; now read.)

  0x630B6  CALLA 0x07F63B00      ; free the export context
  0x630BC  A5 = *A13(0x120)      ; <-- the RENDER DRIVER's return value
  0x630C0  JREQ 0x630E8          ; zero -> SUB A8,A8 -> return 0 (success)
  0x630C2  ... error report ...
  0x630E2  A8 = *A13(0x120)
  0x630E6  JR 0x630EA            ; return the render driver's code unchanged

So everything the export handler does -- lookup, three range checks, extent
computation, drawable init, context allocation, finalize -- either succeeds or is
not reached, and the value the client sees is precisely what 0x1B152 returned.

Combined with previous turns:
  0x1B852 AFTER_FINALIZE a8 = 0        (finalizer succeeds)
  0x39F5E BadValue site NOT firing     (rp byte 4 already 1)
  err2 therefore comes from elsewhere inside 0x1B152 after 0x1B852.

CLIENT-SIDE STATE (unchanged, reproducible):
  CreatePhoto(w6=1) -> SetTransport(mode=3, component_organization=1) -> PutTile
     element+0x28 buffer = 0xFF (white) / 0x00 (black)
     QueryResource: comp_COUNT=1, 64x64, constrained
  Export(minor 21):
     src_base (rp+0x610) = 008FD510 / 00915FD0   (non-zero)
     returns err2; window unchanged; white vs black captures differ only by the
     Terminal Manager's own figures and the cursor (AE 1186-2950)

STATUS.  NO client-chosen XIE image.  xshow (core X) remains the only viewer that
has displayed an image.

REMAINING SCOPE: strictly inside one function (0x1B152, ~0x500 bytes) after
0x1B852, on a code path that has a valid source, a successful finalize, and still
produces 2.