@driftengine/core 4.1.1 → 4.1.3

package/CHANGELOG.json

@@ -1,4 +1,36 @@
 [
+  {
+    "version": "4.1.3",
+    "date": "2026-09-20",
+    "entries": [
+      {
+        "kind": "fixed",
+        "short": "An imported model draws as it did before 4.0.0. Decoding images with straight alpha let the bytes under a transparent texel reach the frame, and on an opaque draw nothing discards them.",
+        "text": "**Reported as a car whose interior, grille, mirrors and lamps came through as hard black and white shards, where the published build of the same game was correct.** 4.0.0 changed how a `.drft` decodes its images, from premultiplied to straight alpha.\n\n**The argument for straight alpha was measured and is still true.** `createImageBitmap` premultiplies unless told not to, the upload into a straight-alpha texture divides back out, and on a PNG holding every colour at every alpha, 98,463 of 196,608 channel values came back changed. None did with `premultiplyAlpha: none`. Every cutout and emblem was losing the colour its author padded past its edge.\n\n**What it did not measure is content.** An imported material routinely carries arbitrary bytes under its fully transparent texels, and premultiplying is what kept them out of the frame. Straight alpha let them through, and an opaque draw discards nothing, so the shader takes the colour whatever the alpha beside it says.\n\n**Isolated in the showroom on held frames**, which is the part worth keeping. A model with 41 images drew clean and two with 64 and 65 drew shards, on both backends, with the old container and the new alike, fully streamed. The count only decides how likely a model is to carry a masked texture at all. Restoring the one option drew the car correctly.\n\nSo the faithful choice per texel was the wrong choice per model. `colorSpaceConversion` is unchanged and stays off."
+      },
+      {
+        "kind": "fixed",
+        "short": "A tested material stating a zero alpha reference takes the shader default rather than discarding nothing. A grille's holes and a seat's stitching were coming through filled in.",
+        "text": "**`ksAlphaRef` of zero means the shader's own threshold, not discard nothing.** The `.kn5` reader read it literally, and the first car to set the flag set it on eleven materials with a reference of zero on every one: `int_net`, `int_stitching`, `grille_a`, `hood_labels`. A threshold of zero discards nothing, so a grille's holes and a seat's stitching were drawn solid.\n\nA material that says it is alpha tested has already said something is meant to go, so a reference of zero cannot be read literally without contradicting the flag beside it. Half, because that is the convention those shaders were authored against, and because these masks are two valued.\n\nThe comment this replaces said the path was carried on the format's word rather than on evidence. This is the evidence arriving."
+      },
+      {
+        "kind": "fixed",
+        "short": "A device that refuses the transparent pipeline now really does lose only the glass. The guard added in 4.1.2 warned correctly and did not prevent a single one of the errors it was written for.",
+        "text": "**4.1.2 had this the wrong way round, and the reporter proved it on the next run.** That version built the pipeline, bound a group against its layout, encoded the pass, and disowned the handle when the error scope came back. A scope comes back on a microtask, after all three. The log carried the new warning and then every error it was meant to prevent: `GetBindGroupLayout` on an invalid pipeline, a bind group against an invalid layout, a `SetPipeline` with it, and a refused submit.\n\n**Nothing touches the handle until the device has answered now.** The bindings are held as a closure rather than built, and run once, either where the verdict has already landed or when it does. What that costs is no transparency for the frames before the answer, which nobody sees.\n\n**A device offering no error scopes is taken at its word**, because refusing transparency forever on hardware that never said no would be the worse failure of the two."
+      }
+    ]
+  },
+  {
+    "version": "4.1.2",
+    "date": "2026-09-20",
+    "entries": [
+      {
+        "kind": "fixed",
+        "short": "A device that refuses the transparent pipeline loses the glass, not the frame. It was taking the whole command buffer with it, so a phone drew nothing where it could have drawn everything else.",
+        "text": "**Reported from a Galaxy S23 Ultra, on the published site.** `CreateGraphicsPipelines failed with VK_ERROR_UNKNOWN` for `gpu-driven blend`, and then four more errors that were all the same one: an invalid pipeline makes an invalid bind group, which makes an invalid encoder, which makes an invalid command buffer. **The city drew nothing, on a device that could have drawn all of it but the glass.**\n\n**`createRenderPipeline` does not throw where a driver refuses it.** It hands back an *invalid* handle and reports asynchronously, so there is nothing to catch at the call and the code after it carried on: a bind group built from the invalid layout, a pass set to the invalid pipeline, a submit of the invalid buffer. Two `as GPURenderPipeline` casts are where that assumption lived.\n\n**So the pipeline is built inside error scopes and disowned where one comes back.** Both scopes, validation and internal, because a shader a driver cannot compile is reported as one on some backends and the other elsewhere, and this is exactly the case where guessing costs the whole frame. The transparent pass then skips itself and everything opaque still draws. The warning is said once, in the words the device used.\n\n**The check that went with it had to be rewritten before it meant anything.** The first version asserted that no transparent draw was encoded, and it could not have failed: the fixture carries nothing transparent, so that draw is absent either way and it passed over an unfixed pass. What is observable is the warning and the frame, so that is what it asserts, and perturbing the disown turns it red.\n\n**What is not fixed is why that driver refuses the pipeline.** Its targets are `rgba16float` and `r8unorm` under `layout: auto`, and diagnosing `VK_ERROR_UNKNOWN` needs the part that produces it. This is the containment: a refusal costs what it is about."
+      }
+    ]
+  },
   {
     "version": "4.1.1",
     "date": "2026-09-20",

package/dist/render/backend/webgpu/gpuDrivenPass.d.ts

@@ -456,6 +456,22 @@ export declare class GpuDrivenPass implements PassDefinition {
     private oitAccumView;
     private oitRevealView;
     private blendPipeline;
+    /**
+     * Whether the device has actually accepted the blend pipeline.
+     *
+     * **False until it says so, and 4.1.2 had this the wrong way round.** That version built the
+     * pipeline, bound a group against its layout, encoded the pass, and disowned the handle when the
+     * error scope came back — but a scope comes back on a microtask, after all three. The reporter's
+     * next run carried the new warning *and* every error it was meant to prevent: `GetBindGroupLayout`
+     * on an invalid pipeline, a bind group against an invalid layout, a `SetPipeline` with it, and a
+     * refused submit.
+     *
+     * Nothing touches the handle until this is true. The cost is no transparency for the frames
+     * before the device answers, which nobody sees; the alternative is a frame that draws nothing.
+     */
+    private blendUsable;
+    /** Builds the transparent raster's bindings, held until there is a pipeline worth binding to. */
+    private makeBlendGroup;
     private blendResolvePipeline;
     private blendLodGroup;
     private blendCompactGroup;
@@ -613,6 +629,18 @@ export declare class GpuDrivenPass implements PassDefinition {
      * origin so nothing ever said so. `StreamingScene` computes them when a mesh is placed.
      */
     private buildBuffers;
+    /**
+     * Close the two scopes the blend pipeline was built in, and disown it where the device refused.
+     *
+     * **Asynchronous because a pipeline failure is.** Nothing can be known at the call that creates
+     * it, so the first frames draw no transparency and then either it arrives or it never does. That
+     * is the honest order: a pane missing for two frames is invisible, and a frame missing entirely
+     * is what this exists to prevent.
+     *
+     * The warning is once, in the words the device used, because the whole difficulty of the report
+     * this came from was five errors that were all the same one.
+     */
+    private watchBlendPipeline;
     private buildPipelines;
     /**
      * The groups that name `history` and `drawn`, rebuilt when the two swap.

package/dist/render/backend/webgpu/gpuDrivenPass.js

@@ -431,6 +431,22 @@ export class GpuDrivenPass {
     oitAccumView = null;
     oitRevealView = null;
     blendPipeline = null;
+    /**
+     * Whether the device has actually accepted the blend pipeline.
+     *
+     * **False until it says so, and 4.1.2 had this the wrong way round.** That version built the
+     * pipeline, bound a group against its layout, encoded the pass, and disowned the handle when the
+     * error scope came back — but a scope comes back on a microtask, after all three. The reporter's
+     * next run carried the new warning *and* every error it was meant to prevent: `GetBindGroupLayout`
+     * on an invalid pipeline, a bind group against an invalid layout, a `SetPipeline` with it, and a
+     * refused submit.
+     *
+     * Nothing touches the handle until this is true. The cost is no transparency for the frames
+     * before the device answers, which nobody sees; the alternative is a frame that draws nothing.
+     */
+    blendUsable = false;
+    /** Builds the transparent raster's bindings, held until there is a pipeline worth binding to. */
+    makeBlendGroup = null;
     blendResolvePipeline = null;
     blendLodGroup = null;
     blendCompactGroup = null;
@@ -941,6 +957,49 @@ export class GpuDrivenPass {
         this.zeroHistory = this.empty(device, 'history zero', count * 4);
         this.historySink = this.empty(device, 'history sink', count * 4);
     }
+    /**
+     * Close the two scopes the blend pipeline was built in, and disown it where the device refused.
+     *
+     * **Asynchronous because a pipeline failure is.** Nothing can be known at the call that creates
+     * it, so the first frames draw no transparency and then either it arrives or it never does. That
+     * is the honest order: a pane missing for two frames is invisible, and a frame missing entirely
+     * is what this exists to prevent.
+     *
+     * The warning is once, in the words the device used, because the whole difficulty of the report
+     * this came from was five errors that were all the same one.
+     */
+    watchBlendPipeline(device) {
+        /*
+         * **A device with no error scopes is taken at its word.** Nothing can be asked of it, and
+         * refusing transparency forever on a device that never said no would be a worse failure than
+         * the one this guards: a frame that quietly loses its glass on hardware that could draw it.
+         */
+        if (typeof device.popErrorScope !== 'function') {
+            this.blendUsable = true;
+            if (this.makeBlendGroup !== null)
+                this.blendRasterGroup = this.makeBlendGroup();
+            return;
+        }
+        let outstanding = 2;
+        const settle = (error, scope) => {
+            outstanding -= 1;
+            if (error !== null && this.blendPipeline !== null) {
+                this.blendPipeline = null;
+                this.blendRasterGroup = null;
+                this.makeBlendGroup = null;
+                console.warn(`[driftengine] this device refused the gpu-driven blend pipeline (${scope}), so the ` +
+                    `transparent pass is off and everything opaque still draws: ${error.message}`);
+            }
+            /* Usable only once both scopes have come back clean, and only then is anything bound. */
+            if (outstanding > 0 || this.blendPipeline === null)
+                return;
+            this.blendUsable = true;
+            if (this.makeBlendGroup !== null)
+                this.blendRasterGroup = this.makeBlendGroup();
+        };
+        void device.popErrorScope().then((error) => settle(error, 'internal'));
+        void device.popErrorScope().then((error) => settle(error, 'validation'));
+    }
     buildPipelines(device, format, samples) {
         const compute = (label, code) => device.createComputePipeline({
             label: `gpu-driven ${label}`,
@@ -1045,6 +1104,26 @@ export class GpuDrivenPass {
          * hide. The opaque raster culls back faces, where a closed hull's far side is a wasted draw.
          */
         const blend = device.createShaderModule({ label: 'blend raster', code: BLEND_RASTER_WGSL });
+        /*
+         * **Built inside error scopes, because a driver that refuses this must not take the frame.**
+         *
+         * Reported from a Galaxy S23 Ultra: `CreateGraphicsPipelines failed with VK_ERROR_UNKNOWN`
+         * for this pipeline, and then four more errors that were all the same one. `createRenderPipeline`
+         * does not throw where a driver refuses — it hands back an *invalid* pipeline and reports
+         * asynchronously — so the code that followed built a bind group from its layout, set it on a
+         * pass, and submitted a command buffer, each of which is invalid because the one before it was.
+         * The city drew **nothing**, on a device that could have drawn all of it but the glass.
+         *
+         * So the handle is disowned where the device refused it and the transparent pass skips itself.
+         * Both scopes, because a shader a driver cannot compile is reported as internal on some
+         * backends and as validation on others, and this is exactly the case where guessing which
+         * costs the whole frame.
+         */
+        /* Only where the device offers them: see `watchBlendPipeline` for the case where it does not. */
+        if (typeof device.pushErrorScope === 'function') {
+            device.pushErrorScope('validation');
+            device.pushErrorScope('internal');
+        }
         this.blendPipeline = device.createRenderPipeline({
             label: 'gpu-driven blend',
             layout: 'auto',
@@ -1077,6 +1156,7 @@ export class GpuDrivenPass {
                 depthCompare: DEPTH_COMPARE,
             },
         });
+        this.watchBlendPipeline(device);
         /*
          * **Premultiplied over, where `renderer.ts`'s composite is a lerp**, and `blendRaster.wgsl.ts`
          * carries why: this pipeline's colour target has a coverage mask in its alpha, which the blit
@@ -1585,7 +1665,12 @@ export class GpuDrivenPass {
             ],
         });
         /* Everything the transparent raster reads: the same scene, the same frame, its own list. */
-        this.blendRasterGroup = device.createBindGroup({
+        /*
+         * Held rather than built, because whether the pipeline is usable is not known yet: the error
+         * scopes settle on a microtask and this runs synchronously. `watchBlendPipeline` runs it once
+         * the device has answered, and never if the answer was no.
+         */
+        this.makeBlendGroup = () => device.createBindGroup({
             layout: this.blendPipeline.getBindGroupLayout(0),
             entries: [
                 { binding: 0, resource: { buffer: this.viewProjBuffer } },
@@ -1601,7 +1686,10 @@ export class GpuDrivenPass {
                     binding: 9,
                     resource: this.environmentView ?? this.emptyEnvironmentView,
                 },
-                { binding: 10, resource: this.environmentSampler ?? this.emptySampler },
+                {
+                    binding: 10,
+                    resource: this.environmentSampler ?? this.emptySampler,
+                },
                 { binding: 11, resource: this.latentsView },
                 { binding: 12, resource: this.latentClamp },
                 { binding: 13, resource: this.latentRepeat },
@@ -1609,6 +1697,13 @@ export class GpuDrivenPass {
                 { binding: 15, resource: { buffer: this.decodeWeights } },
             ],
         });
+        /*
+         * And build it now where the device has already answered, which is the ordinary case: the
+         * verdict lands before this runs on a device with no error scopes, and after it on one that
+         * has them. Whichever order, exactly one of the two places builds the group.
+         */
+        if (this.blendUsable)
+            this.blendRasterGroup = this.makeBlendGroup();
         this.blendResolveGroup = device.createBindGroup({
             layout: this.blendResolvePipeline.getBindGroupLayout(0),
             entries: [
@@ -2028,6 +2123,13 @@ export class GpuDrivenPass {
                 return;
             }
             case 'blendDraw': {
+                /*
+                 * **Skipped where the device refused the pipeline, rather than drawn with an invalid one.**
+                 * Everything opaque has already been drawn by the time this runs, so what is lost is the
+                 * glass and not the city. See `watchBlendPipeline`.
+                 */
+                if (!this.blendUsable || this.blendPipeline === null || this.blendRasterGroup === null)
+                    return;
                 const pass = encoder.beginRenderPass({
                     label: 'gpu-driven blend draw',
                     colorAttachments: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@driftengine/core",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "description": "DriftEngine reusable browser 3D runtime",
   "license": "Apache-2.0",
   "type": "module",
@@ -29,8 +29,8 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@driftengine/drft": "4.1.1",
-    "@driftengine/physics": "4.1.1",
+    "@driftengine/drft": "4.1.3",
+    "@driftengine/physics": "4.1.3",
     "gl-matrix": "^3.4.3"
   },
   "author": "Drift Technologies",
@@ -63,8 +63,8 @@
     "prepack": "node ../../scripts/build.mjs @driftengine/core"
   },
   "devDependencies": {
-    "@driftengine/nav": "4.1.1",
-    "@driftengine/network": "4.1.1",
-    "@driftengine/texture": "4.1.1"
+    "@driftengine/nav": "4.1.3",
+    "@driftengine/network": "4.1.3",
+    "@driftengine/texture": "4.1.3"
   }
 }

package/src/render/backend/webgpu/gpuDrivenPass.ts

@@ -723,6 +723,22 @@ export class GpuDrivenPass implements PassDefinition {
   private oitAccumView: GPUTextureView | null = null;
   private oitRevealView: GPUTextureView | null = null;
   private blendPipeline: GPURenderPipeline | null = null;
+  /**
+   * Whether the device has actually accepted the blend pipeline.
+   *
+   * **False until it says so, and 4.1.2 had this the wrong way round.** That version built the
+   * pipeline, bound a group against its layout, encoded the pass, and disowned the handle when the
+   * error scope came back — but a scope comes back on a microtask, after all three. The reporter's
+   * next run carried the new warning *and* every error it was meant to prevent: `GetBindGroupLayout`
+   * on an invalid pipeline, a bind group against an invalid layout, a `SetPipeline` with it, and a
+   * refused submit.
+   *
+   * Nothing touches the handle until this is true. The cost is no transparency for the frames
+   * before the device answers, which nobody sees; the alternative is a frame that draws nothing.
+   */
+  private blendUsable = false;
+  /** Builds the transparent raster's bindings, held until there is a pipeline worth binding to. */
+  private makeBlendGroup: (() => GPUBindGroup) | null = null;
   private blendResolvePipeline: GPURenderPipeline | null = null;
   private blendLodGroup: GPUBindGroup | null = null;
   private blendCompactGroup: GPUBindGroup | null = null;
@@ -1299,6 +1315,50 @@ export class GpuDrivenPass implements PassDefinition {
     this.historySink = this.empty(device, 'history sink', count * 4);
   }
 
+  /**
+   * Close the two scopes the blend pipeline was built in, and disown it where the device refused.
+   *
+   * **Asynchronous because a pipeline failure is.** Nothing can be known at the call that creates
+   * it, so the first frames draw no transparency and then either it arrives or it never does. That
+   * is the honest order: a pane missing for two frames is invisible, and a frame missing entirely
+   * is what this exists to prevent.
+   *
+   * The warning is once, in the words the device used, because the whole difficulty of the report
+   * this came from was five errors that were all the same one.
+   */
+  private watchBlendPipeline(device: GPUDevice): void {
+    /*
+     * **A device with no error scopes is taken at its word.** Nothing can be asked of it, and
+     * refusing transparency forever on a device that never said no would be a worse failure than
+     * the one this guards: a frame that quietly loses its glass on hardware that could draw it.
+     */
+    if (typeof device.popErrorScope !== 'function') {
+      this.blendUsable = true;
+      if (this.makeBlendGroup !== null) this.blendRasterGroup = this.makeBlendGroup();
+      return;
+    }
+
+    let outstanding = 2;
+    const settle = (error: GPUError | null, scope: string): void => {
+      outstanding -= 1;
+      if (error !== null && this.blendPipeline !== null) {
+        this.blendPipeline = null;
+        this.blendRasterGroup = null;
+        this.makeBlendGroup = null;
+        console.warn(
+          `[driftengine] this device refused the gpu-driven blend pipeline (${scope}), so the ` +
+            `transparent pass is off and everything opaque still draws: ${error.message}`,
+        );
+      }
+      /* Usable only once both scopes have come back clean, and only then is anything bound. */
+      if (outstanding > 0 || this.blendPipeline === null) return;
+      this.blendUsable = true;
+      if (this.makeBlendGroup !== null) this.blendRasterGroup = this.makeBlendGroup();
+    };
+    void device.popErrorScope().then((error) => settle(error, 'internal'));
+    void device.popErrorScope().then((error) => settle(error, 'validation'));
+  }
+
   private buildPipelines(device: GPUDevice, format: GPUTextureFormat, samples: number): void {
     const compute = (label: string, code: string): GPUComputePipeline =>
       device.createComputePipeline({
@@ -1409,6 +1469,26 @@ export class GpuDrivenPass implements PassDefinition {
      * hide. The opaque raster culls back faces, where a closed hull's far side is a wasted draw.
      */
     const blend = device.createShaderModule({ label: 'blend raster', code: BLEND_RASTER_WGSL });
+    /*
+     * **Built inside error scopes, because a driver that refuses this must not take the frame.**
+     *
+     * Reported from a Galaxy S23 Ultra: `CreateGraphicsPipelines failed with VK_ERROR_UNKNOWN`
+     * for this pipeline, and then four more errors that were all the same one. `createRenderPipeline`
+     * does not throw where a driver refuses — it hands back an *invalid* pipeline and reports
+     * asynchronously — so the code that followed built a bind group from its layout, set it on a
+     * pass, and submitted a command buffer, each of which is invalid because the one before it was.
+     * The city drew **nothing**, on a device that could have drawn all of it but the glass.
+     *
+     * So the handle is disowned where the device refused it and the transparent pass skips itself.
+     * Both scopes, because a shader a driver cannot compile is reported as internal on some
+     * backends and as validation on others, and this is exactly the case where guessing which
+     * costs the whole frame.
+     */
+    /* Only where the device offers them: see `watchBlendPipeline` for the case where it does not. */
+    if (typeof device.pushErrorScope === 'function') {
+      device.pushErrorScope('validation');
+      device.pushErrorScope('internal');
+    }
     this.blendPipeline = device.createRenderPipeline({
       label: 'gpu-driven blend',
       layout: 'auto',
@@ -1441,6 +1521,7 @@ export class GpuDrivenPass implements PassDefinition {
         depthCompare: DEPTH_COMPARE,
       },
     });
+    this.watchBlendPipeline(device);
 
     /*
      * **Premultiplied over, where `renderer.ts`'s composite is a lerp**, and `blendRaster.wgsl.ts`
@@ -2015,30 +2096,46 @@ export class GpuDrivenPass implements PassDefinition {
     });
 
     /* Everything the transparent raster reads: the same scene, the same frame, its own list. */
-    this.blendRasterGroup = device.createBindGroup({
-      layout: (this.blendPipeline as GPURenderPipeline).getBindGroupLayout(0),
-      entries: [
-        { binding: 0, resource: { buffer: this.viewProjBuffer as GPUBuffer } },
-        { binding: 1, resource: { buffer: this.blendList as GPUBuffer } },
-        { binding: 2, resource: { buffer: this.clusterMeta as GPUBuffer } },
-        { binding: 3, resource: { buffer: this.indices as GPUBuffer } },
-        { binding: 4, resource: { buffer: this.vertices as GPUBuffer } },
-        { binding: 5, resource: { buffer: this.transformBuffer as GPUBuffer } },
-        { binding: 6, resource: { buffer: this.materialOf as GPUBuffer } },
-        { binding: 7, resource: { buffer: this.materialTable as GPUBuffer } },
-        { binding: 8, resource: { buffer: this.frameBuffer as GPUBuffer } },
-        {
-          binding: 9,
-          resource: this.environmentView ?? (this.emptyEnvironmentView as GPUTextureView),
-        },
-        { binding: 10, resource: this.environmentSampler ?? (this.emptySampler as GPUSampler) },
-        { binding: 11, resource: this.latentsView as GPUTextureView },
-        { binding: 12, resource: this.latentClamp as GPUSampler },
-        { binding: 13, resource: this.latentRepeat as GPUSampler },
-        { binding: 14, resource: { buffer: this.decodeNodes as GPUBuffer } },
-        { binding: 15, resource: { buffer: this.decodeWeights as GPUBuffer } },
-      ],
-    });
+    /*
+     * Held rather than built, because whether the pipeline is usable is not known yet: the error
+     * scopes settle on a microtask and this runs synchronously. `watchBlendPipeline` runs it once
+     * the device has answered, and never if the answer was no.
+     */
+    this.makeBlendGroup = (): GPUBindGroup =>
+      device.createBindGroup({
+        layout: (this.blendPipeline as GPURenderPipeline).getBindGroupLayout(0),
+        entries: [
+          { binding: 0, resource: { buffer: this.viewProjBuffer as GPUBuffer } },
+          { binding: 1, resource: { buffer: this.blendList as GPUBuffer } },
+          { binding: 2, resource: { buffer: this.clusterMeta as GPUBuffer } },
+          { binding: 3, resource: { buffer: this.indices as GPUBuffer } },
+          { binding: 4, resource: { buffer: this.vertices as GPUBuffer } },
+          { binding: 5, resource: { buffer: this.transformBuffer as GPUBuffer } },
+          { binding: 6, resource: { buffer: this.materialOf as GPUBuffer } },
+          { binding: 7, resource: { buffer: this.materialTable as GPUBuffer } },
+          { binding: 8, resource: { buffer: this.frameBuffer as GPUBuffer } },
+          {
+            binding: 9,
+            resource: this.environmentView ?? (this.emptyEnvironmentView as GPUTextureView),
+          },
+          {
+            binding: 10,
+            resource: this.environmentSampler ?? (this.emptySampler as GPUSampler),
+          },
+          { binding: 11, resource: this.latentsView as GPUTextureView },
+          { binding: 12, resource: this.latentClamp as GPUSampler },
+          { binding: 13, resource: this.latentRepeat as GPUSampler },
+          { binding: 14, resource: { buffer: this.decodeNodes as GPUBuffer } },
+          { binding: 15, resource: { buffer: this.decodeWeights as GPUBuffer } },
+        ],
+      });
+
+    /*
+     * And build it now where the device has already answered, which is the ordinary case: the
+     * verdict lands before this runs on a device with no error scopes, and after it on one that
+     * has them. Whichever order, exactly one of the two places builds the group.
+     */
+    if (this.blendUsable) this.blendRasterGroup = this.makeBlendGroup();
     this.blendResolveGroup = device.createBindGroup({
       layout: (this.blendResolvePipeline as GPURenderPipeline).getBindGroupLayout(0),
       entries: [
@@ -2519,6 +2616,13 @@ export class GpuDrivenPass implements PassDefinition {
         return;
       }
       case 'blendDraw': {
+        /*
+         * **Skipped where the device refused the pipeline, rather than drawn with an invalid one.**
+         * Everything opaque has already been drawn by the time this runs, so what is lost is the
+         * glass and not the city. See `watchBlendPipeline`.
+         */
+        if (!this.blendUsable || this.blendPipeline === null || this.blendRasterGroup === null)
+          return;
         const pass = encoder.beginRenderPass({
           label: 'gpu-driven blend draw',
           colorAttachments: [
@@ -2546,8 +2650,8 @@ export class GpuDrivenPass implements PassDefinition {
           },
           timestampWrites: this.writesFor('blendDraw'),
         });
-        pass.setPipeline(this.blendPipeline as GPURenderPipeline);
-        pass.setBindGroup(0, this.blendRasterGroup as GPUBindGroup);
+        pass.setPipeline(this.blendPipeline);
+        pass.setBindGroup(0, this.blendRasterGroup);
         pass.setViewport(0, 0, this.width, this.height, 0, 1);
         pass.drawIndirect(this.blendArgs as GPUBuffer, 0);
         pass.end();