@forgeax/engine-render 0.1.23 → 0.1.25

package/src/render-system.ts

@@ -16,13 +16,22 @@
 // .invert` (charter proposition 5: no math reinvention; render-system.test.ts
 // asserts `/@forgeax\/engine-math/` shows up in render-system.ts source).
 
-import { numMipLevels, resolveAssetHandle } from '@forgeax/engine-assets-runtime';
+import {
+  type MipmapEncoderWork,
+  numMipLevels,
+  resolveAssetHandle,
+} from '@forgeax/engine-assets-runtime';
 import type { World } from '@forgeax/engine-ecs';
 import type { RenderReadLease } from '@forgeax/engine-ecs/projection';
-import { mat4 } from '@forgeax/engine-math';
 import type { RecorderSession } from '@forgeax/engine-profiler';
 import type { CompiledRenderGraphInfo } from '@forgeax/engine-render-graph';
-import type { BindGroupEntry, BindGroupLayout, Buffer, RenderPipeline } from '@forgeax/engine-rhi';
+import type {
+  BindGroupEntry,
+  BindGroupLayout,
+  Buffer,
+  RenderPipeline,
+  RhiDevice,
+} from '@forgeax/engine-rhi';
 import { err, ok, type Result, RhiError } from '@forgeax/engine-rhi';
 import {
   derive,
@@ -30,7 +39,6 @@ import {
   type Handle,
   type MaterialAsset,
   type MaterialTextureValue,
-  type MeshAsset,
   type RenderPipelineAsset,
   RenderQueue,
   type SamplerAsset,
@@ -43,14 +51,16 @@ import {
   projectDirectionalShadowInspectionSource,
 } from './assembly/directional-shadow-inspection';
 import { createClusterBinScratch } from './cluster-binner';
+import type { DeviceScope, LifecycleResourceSpec } from './device/device-scope';
+import type { EnvironmentGeneration } from './environment/generation';
 import { EnvironmentLifecycle } from './environment/lifecycle';
 import {
   type ObservationUnavailableError,
-  PointsLinesMaterialUnsupportedError,
   type RenderError,
   TransmissionCapabilityMissingError,
 } from './errors/render';
 import {
+  type RenderFeatureHost,
   type RenderFeaturePreparedGraphicsResolverInput,
   runRenderFeatureFrame,
   settlePreparedGraphicsCompletion,
@@ -84,20 +94,14 @@ import type {
   TemporalTargetInspection,
   TransmissionInspection,
 } from './inspection-types';
-import { admitPointsLines } from './points-lines/admission';
-import { PointsLinesExpansionCache } from './points-lines/expansion-cache';
-import {
-  inspectPointsLines,
-  type PointsLinesInspection,
-  type PointsLinesSourceError,
-} from './points-lines/inspection';
-import {
-  createPointsLinesLanePreparationAdapter,
-  type PointsLinesLanePreparationAdapter,
-} from './points-lines/prepare';
-import { createPointsLinesLaneAdapter, type PointsLinesBackend } from './points-lines/record';
+import { buildOcclusionProxyVertices } from './occlusion-proxy';
 import type { PointsLinesRetainedSnapshot } from './points-lines/snapshot';
-import type { PointsLinesRecordOwner, PointsLinesRecordSubmission } from './record/render-context';
+import { StandardPointsLinesOwner } from './points-lines/standard-owner';
+import {
+  createRenderSystemRecovery,
+  materialSamplerHandles,
+  materialTextureHandles,
+} from './recovery/render-system-candidate';
 import { ReflectionProbeRecordOwner } from './reflection/record-owner';
 import {
   OcclusionRenderRuntime,
@@ -108,18 +112,19 @@ import { inspectVolumetricFog } from './volume/inspection';
 
 export type { RenderSceneInspection } from './inspection-types';
 
-import { deriveVertexLayoutProjection } from '@forgeax/engine-geometry';
 import { createCubeCaptureScheduler } from './capture/scheduler';
+import type { GpuResidencyCache } from './device/gpu-residency';
 import type { EnvironmentInspection } from './environment/inspection';
-import {
-  GPU_BUFFER_USAGE_COPY_DST,
-  GPU_BUFFER_USAGE_INDEX,
-  GPU_BUFFER_USAGE_UNIFORM,
-  GPU_BUFFER_USAGE_VERTEX,
-} from './gpu-usage';
+import { GPU_BUFFER_USAGE_COPY_DST, GPU_BUFFER_USAGE_UNIFORM } from './gpu-usage';
 import { resetHdrpBuffers } from './hdrp-buffers';
 import { assembleMaterialWithSkylightEntries } from './ibl/skylight-bind-group';
-import { disposeInstanceBuffers, disposeTransientInstanceBuffers } from './instance-buffer-cache';
+import {
+  disposeInstanceBufferChunks,
+  disposeInstanceBuffers,
+  disposeTransientInstanceBuffers,
+} from './instance-buffer-cache';
+import type { InstanceCollectionInspection } from './instances';
+import { InstanceProjectionStore } from './instances';
 import {
   type MeshMaterialBindingObservation,
   type MeshMaterialBindingPreparationFailure,
@@ -158,9 +163,9 @@ import type {
   GpuPassTimingSession,
 } from './record/gpu-pass-timing/session';
 import type { GpuTimingCapture } from './record/gpu-timing';
-import { computeProjectionMatrix, computeViewMatrix } from './record/helpers';
 import { applyParamSnapshotToUbo, residentTextureView } from './record/main-pass-material';
-import type { RenderSystemInternals } from './record/render-context';
+import type { RecoveryPipelineReadiness } from './record/recovery-pipeline';
+import type { PipelineState, RenderSystemInternals } from './record/render-context';
 import type { CubeCaptureGraphState } from './record/typed-frame-graph';
 import {
   type RenderFeatureGraphCandidate,
@@ -183,7 +188,11 @@ import type {
   RenderableSnapshot,
 } from './render-system-extract';
 import { extractFrames } from './render-system-extract';
-import { PersistentRenderScene } from './scene/render-scene';
+import {
+  type PersistentGpuDrivenCandidate,
+  type PersistentRenderCandidateRequest,
+  PersistentRenderScene,
+} from './scene/render-scene';
 import { inspectLodOcclusion } from './scene/visibility/inspection';
 import { resolveSsaoParameters } from './ssao-config';
 import { projectSsrDependencies, resolveSsrAdmissionGeneration } from './ssr/admission';
@@ -210,6 +219,34 @@ import {
   inspectTransmissionFromAdmission,
 } from './transmission/inspection';
 
+function canonicalizeWorldComposition(
+  worlds: readonly World[],
+  owners: Pick<DrawOwnerOptions, 'cameraOwner' | 'resourceOwner'>,
+  leases: readonly RenderReadLease[] | undefined,
+): {
+  readonly worlds: readonly World[];
+  readonly owners: Pick<DrawOwnerOptions, 'cameraOwner' | 'resourceOwner'>;
+  readonly leases: readonly RenderReadLease[] | undefined;
+} {
+  const order = worlds
+    .map((world, index) => ({ world, index }))
+    .sort((left, right) => left.world.identity.localeCompare(right.world.identity));
+  const indexByOriginal = new Map(order.map((entry, index) => [entry.index, index]));
+  return {
+    worlds: Object.freeze(order.map((entry) => entry.world)),
+    owners: {
+      cameraOwner: indexByOriginal.get(owners.cameraOwner) ?? owners.cameraOwner,
+      resourceOwner: indexByOriginal.get(owners.resourceOwner) ?? owners.resourceOwner,
+    },
+    leases:
+      leases === undefined
+        ? undefined
+        : Object.freeze(
+            order.map((entry) => leases[entry.index]).filter((lease) => lease !== undefined),
+          ),
+  };
+}
+
 interface LodInspectionQuerySummary {
   readonly used: number;
   readonly capacity: number;
@@ -361,6 +398,128 @@ export {
   selectSwapChainFormat,
 } from './record/render-context';
 
+export type RendererProducerRootKind =
+  | 'backend-surface'
+  | 'shader-material-pipeline'
+  | 'mesh-texture-sampler'
+  | 'render-scene'
+  | 'gpu-driven'
+  | 'feature'
+  | 'external-source'
+  | 'render-graph'
+  | 'target-history'
+  | 'observation-lease';
+
+export interface RendererProducerRoot {
+  readonly kind: RendererProducerRootKind;
+  readonly owner: string;
+  readonly candidateScope: 'device-scope';
+  readonly visibility: 'visible-workset' | 'non-visible-lazy';
+  readonly disabledWork: 'zero' | 'lazy';
+}
+
+/** Device-bound post-process resources prepared off to the side of the active renderer. */
+export interface RecoveryPostProcessResources {
+  readonly device: RhiDevice;
+  readonly paramsBuffers: Map<string, Buffer>;
+}
+
+const PRODUCER_ROOT_MATRIX: readonly RendererProducerRoot[] = Object.freeze([
+  {
+    kind: 'backend-surface',
+    owner: 'backend-surface-owner',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'shader-material-pipeline',
+    owner: 'shader-material-pipeline-owner',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'mesh-texture-sampler',
+    owner: 'gpu-residency',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'lazy',
+  },
+  {
+    kind: 'render-scene',
+    owner: 'persistent-render-scene',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'gpu-driven',
+    owner: 'gpu-driven-production',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'feature',
+    owner: 'render-feature-host',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'lazy',
+  },
+  {
+    kind: 'external-source',
+    owner: 'external-source-owner',
+    candidateScope: 'device-scope',
+    visibility: 'non-visible-lazy',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'render-graph',
+    owner: 'typed-frame-graph',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'target-history',
+    owner: 'temporal-target-owner',
+    candidateScope: 'device-scope',
+    visibility: 'visible-workset',
+    disabledWork: 'zero',
+  },
+  {
+    kind: 'observation-lease',
+    owner: 'render-observation-owner',
+    candidateScope: 'device-scope',
+    visibility: 'non-visible-lazy',
+    disabledWork: 'zero',
+  },
+]);
+
+export function createRendererProducerRootMatrix(): readonly RendererProducerRoot[] {
+  return PRODUCER_ROOT_MATRIX;
+}
+
+/**
+ * Production-owned recovery facts. These values are projections of the live
+ * RenderSystem owners; they are not a test ledger or a second graph model.
+ */
+export interface RecoveryProductionEvidence {
+  readonly producerRoots: readonly RendererProducerRoot[];
+  readonly graph: {
+    readonly ready: boolean;
+    readonly generation: number;
+    readonly passCount: number;
+    readonly resourceCount: number;
+  };
+  readonly residency: { readonly meshResidencyEpoch: number };
+  readonly submissions: {
+    readonly count: number;
+    readonly lastGeneration: number | undefined;
+  };
+}
+
 /**
  * Unified transparent-queue sub-sort covering all four
  * {@link TransparentSortConfig} modes. Reorders the
@@ -508,6 +667,19 @@ export interface RenderSystem {
     renderReadLeases?: readonly RenderReadLease[],
     timingCapture?: GpuTimingCapture,
   ): boolean;
+  /** Prepare a detached graph candidate without entering the frame record path. */
+  prepareRecoveryGraphCandidate(
+    runtime: RecoveryGraphCandidateRuntime,
+  ): Promise<RecoveryGraphCandidatePreparation>;
+  /** Finish and submit detached candidate setup, never a frame receipt. */
+  submitCandidateSetup(
+    candidate: RecoveryGraphCandidate,
+    isValid: () => boolean,
+  ): Result<RecoveryGraphSetupSubmission, RhiError>;
+  /** Publish a detached graph candidate at the generation publication boundary. */
+  publishRecoveryGraphCandidate(candidate: RecoveryGraphCandidate): void;
+  /** Discard a detached graph candidate that did not reach publication. */
+  discardRecoveryGraphCandidate(candidate: RecoveryGraphCandidate): void;
   /** Release renderer-owned persistent state for one detached World. */
   detachScene(world: World): void;
   /** Release the profiler catalog contribution owned by this RenderSystem. */
@@ -524,6 +696,8 @@ export interface RenderSystem {
   readonly pipelineDispatchCounts: {
     readonly unlit: number;
   };
+  /** Detached residency and upload facts for explicit instance collections. */
+  readonly instanceCollectionsInspection: readonly InstanceCollectionInspection[];
   /**
    * feat-20260528-frustum-culling M5 / w14: per-frame frustum-culling counters.
    * Updated by `draw([world], { cameraOwner: 0, resourceOwner: 0 })` on every call from the Extract stage.
@@ -560,6 +734,8 @@ export interface RenderSystem {
   readonly pointsLinesSnapshots: readonly PointsLinesRetainedSnapshot[];
   /** Current mesh-slot provenance and active diagnostics from the last frame. */
   readonly meshMaterialBindings: readonly MeshMaterialBindingObservation[];
+  /** Final-submit IBL binding-chain receipt for the last diagnostic frame. */
+  readonly iblBinding: import('./mesh-material-bindings').IblBindingInspection | undefined;
   /**
    * feat-20260531-bloom-first-declarative-render-graph-pass M4 fix-up w19:
    * per-frame render-graph pass names in declaration order. Empty array
@@ -573,6 +749,8 @@ export interface RenderSystem {
   readonly lastSuccessfulCameraAntialias: CameraSnapshot['antialias'] | undefined;
   /** Detached compiled-graph facts used by the renderer inspection owner. */
   readonly perFrameGraphInfo: CompiledRenderGraphInfo | undefined;
+  /** Production-owner recovery facts used by Renderer.inspect(). */
+  readonly recoveryEvidence: RecoveryProductionEvidence;
   /**
    * feat-20260531-per-frame-bind-group-cache M1 / w4: per-frame
    * createBindGroup counter. Reset to 0 on every `draw([world], { cameraOwner: 0, resourceOwner: 0 })` entry,
@@ -600,6 +778,8 @@ export interface RenderSystem {
   configureStandard(config: RenderPipelineAsset['config']): void;
   /** Register one engine-owned post-process shader used by the Standard lane. */
   registerBuiltinPostProcess(id: string, entry: PostProcessShaderEntry): () => void;
+  /** Resolve one active built-in post-process declaration for a detached candidate. */
+  readonly lookupPostProcess: (id: string) => PostProcessShaderEntry | undefined;
   /**
    * feat-20260612-rhi-destroy-renderer-dispose-gpu-lifecycle / M5 / w21:
    * release the per-RenderSystem frame-state GPU bookkeeping during
@@ -623,9 +803,19 @@ export interface RenderSystem {
    *      handles and are rebuilt after the replacement device is live.
    * Idempotent and graph-optional (no-op when nothing has compiled yet).
    */
-  resetForRecover(): void;
+  resetForRecover(retiringPipelineState?: PipelineState, replacementDevice?: RhiDevice): void;
+  /** Build post-process parameter buffers without mutating the active bundle. */
+  prepareRecoveryPostProcessResources(
+    device: RhiDevice,
+  ): Result<RecoveryPostProcessResources, RhiError>;
+  /** Publish a previously prepared post-process bundle at the recovery boundary. */
+  publishRecoveryPostProcessResources(candidate: RecoveryPostProcessResources): void;
+  /** Release a candidate bundle that was never published. */
+  discardRecoveryPostProcessResources(candidate: RecoveryPostProcessResources): void;
   /** Recreate post-process GPU parameter resources after a device rebuild. */
   restorePostProcessResources(): void;
+  /** Build candidate roots from explicit candidate-owned device state. */
+  prepareRecoveryRoots(runtime: RecoveryRootRuntime): RecoveryRootBundle;
 }
 
 function isStructuredRendererError(error: unknown): error is RhiError | RenderError {
@@ -681,11 +871,12 @@ function makePreparedPipelinePendingError(): RhiError {
   });
 }
 
-type PointsLinesGpuResources = {
-  readonly vertexBuffer: Buffer;
-  readonly indexBuffer: Buffer;
-};
-type PointsLinesPreparationAdapter = PointsLinesLanePreparationAdapter<PointsLinesGpuResources>;
+/** The single Points/Lines owner’s staged device-generation handoff. */
+export interface RecoveryPointsLinesCandidate {
+  createRecoveryRoot(scope: DeviceScope): LifecycleResourceSpec<unknown>;
+  publish(): void;
+  release(): void;
+}
 
 function preparationFailureFrom(error: unknown): MeshMaterialBindingPreparationFailure | undefined {
   if (typeof error !== 'object' || error === null) return undefined;
@@ -714,30 +905,56 @@ function preparationFailureFrom(error: unknown): MeshMaterialBindingPreparationF
   };
 }
 
-function materialTextureHandles(
-  material: MaterialSnapshot,
-): readonly Handle<'TextureAsset', 'shared'>[] {
-  const handles = new Map<number, Handle<'TextureAsset', 'shared'>>();
-  const add = (handle: Handle<'TextureAsset', 'shared'> | undefined): void => {
-    if (handle !== undefined) handles.set(Number(handle), handle);
-  };
-  for (const handle of material.textureHandles?.values() ?? []) add(handle);
-  add(material.baseColorTexture);
-  add(material.metallicRoughnessTexture);
-  add(material.normalTexture);
-  add(material.emissiveTexture);
-  add(material.occlusionTexture);
-  return [...handles.values()];
+/** Candidate-only device/runtime inputs used by the recovery prepare seam. */
+export interface RecoveryGraphCandidateRuntime {
+  readonly internals: RenderSystemInternals;
+  readonly pipelineState: PipelineState;
 }
 
-function materialSamplerHandles(
-  material: MaterialSnapshot,
-): readonly Handle<'SamplerAsset', 'shared'>[] {
-  const handles = new Map<number, Handle<'SamplerAsset', 'shared'>>();
-  for (const handle of material.samplerHandles?.values() ?? []) {
-    handles.set(Number(handle), handle);
-  }
-  return [...handles.values()];
+/** Detached graph state prepared on a replacement device, before publication. */
+export interface RecoveryGraphCandidate {
+  readonly frameState: RenderFrameState;
+  readonly setupWorks: readonly MipmapEncoderWork[];
+  readonly device: RhiDevice;
+  readonly generation: number;
+  readonly gpuDrivenProduction?: GpuDrivenProduction;
+  readonly gpuDrivenScene?: PersistentGpuDrivenCandidate;
+  /** Staged CPU-expanded Points/Lines buffers owned by the same RenderSystem. */
+  readonly pointsLines?: RecoveryPointsLinesCandidate;
+  readonly featureHost?: RenderFeatureHost;
+  readonly featureGpuWork?: RenderFeatureGpuWorkOwner;
+  readonly featureGraphCandidate?: RenderFeatureGraphCandidate;
+  readonly postProcessPipelines?: ReadonlyMap<string, RenderPipeline>;
+  readonly recoveryReadiness: RecoveryPipelineReadiness;
+  /** Release all candidate roots before publication; safe to call repeatedly. */
+  readonly release: () => void;
+  /** Transfer candidate-root ownership to the published RenderSystem. */
+  readonly markPublished: () => void;
+}
+
+/** Candidate setup completion; completion is bounded by the recovery owner. */
+export interface RecoveryGraphSetupSubmission {
+  readonly completion?: PromiseLike<unknown>;
+}
+
+export type RecoveryGraphCandidatePreparation =
+  | { readonly kind: 'no-seed' }
+  | { readonly kind: 'ready'; readonly candidate: RecoveryGraphCandidate }
+  | { readonly kind: 'failed'; readonly reason: string; readonly cause?: unknown };
+
+/** Explicit candidate-owned inputs for lifecycle-root preparation. */
+export interface RecoveryRootRuntime {
+  readonly scope: DeviceScope;
+  readonly device: RhiDevice;
+  readonly gpuStore: GpuResidencyCache;
+  readonly graphCandidate?: RecoveryGraphCandidate | undefined;
+}
+
+/** Candidate roots plus the one synchronous owner switch at publication. */
+export interface RecoveryRootBundle {
+  readonly roots: readonly LifecycleResourceSpec<unknown>[];
+  publish(): void;
+  discard(): void;
 }
 
 /**
@@ -856,267 +1073,6 @@ function observeMaterialResidency(
   };
 }
 
-/**
- * The Standard renderer's single Points/Lines prepare owner.
- *
- * The retained snapshot is the identity boundary; this owner only resolves
- * the source assets, runs admission, and publishes the existing preparation
- * and record contracts to the main geometry loop. The expansion cache is
- * shared across lanes and this owner keeps the one prepared vertex/index
- * resource pair for each retained identity.
- */
-class StandardPointsLinesOwner implements PointsLinesRecordOwner {
-  private readonly cache = new PointsLinesExpansionCache();
-  private readonly preparations = new Map<string, PointsLinesPreparationAdapter>();
-  private readonly active = new Map<string, PointsLinesInspection>();
-  private readonly layoutProjection = deriveVertexLayoutProjection({
-    position: new Float32Array(0),
-    normal: new Float32Array(0),
-    uv: new Float32Array(0),
-    tangent: new Float32Array(0),
-  });
-
-  constructor(private readonly internals: RenderSystemInternals) {}
-
-  beginFrame(): void {
-    this.active.clear();
-  }
-
-  prepare(
-    entry: import('./record/frame-snapshot').ValidatedRenderable,
-    clustered: boolean,
-  ): PointsLinesRecordSubmission | undefined {
-    const snapshot = entry.source.pointsLines;
-    if (snapshot === undefined || snapshot.component === undefined || entry.world === undefined) {
-      return undefined;
-    }
-    const key = `${snapshot.worldId}:${snapshot.entityKey}`;
-    const topology = snapshot.component === 'Points' ? 'point-list' : 'line-list';
-    const backend = this.backend();
-    const lane = backend === 'wgpu-webgl2' ? 'cpu-webgl2' : clustered ? 'clustered' : 'direct';
-    const meshResult = resolveAssetHandle<MeshAsset>(
-      entry.world,
-      toShared<'MeshAsset'>(entry.source.assetHandle),
-    );
-    const materialResult = resolveAssetHandle<MaterialAsset>(
-      entry.world,
-      toShared<'MaterialAsset'>(snapshot.materialHandle),
-    );
-    if (!meshResult.ok || !materialResult.ok) {
-      this.publishRefusal(
-        snapshot,
-        new PointsLinesMaterialUnsupportedError({
-          entity: snapshot.entityKey,
-          material: 'unresolved',
-          pass: 'forward',
-          module: 'asset-resolution',
-          reason: 'source MeshAsset or MaterialAsset could not be resolved',
-        }),
-      );
-      return undefined;
-    }
-    const admission = admitPointsLines({
-      entity: snapshot.entityKey,
-      mesh: meshResult.value,
-      material: materialResult.value,
-      ...(snapshot.style?.kind === 'points'
-        ? {
-            points: {
-              sizePx: snapshot.style.sizePx,
-              shape: snapshot.style.shape === 'circle' ? 1 : 0,
-            },
-          }
-        : { lines: { widthPx: snapshot.style?.widthPx ?? 1 } }),
-    });
-    if (!admission.ok) {
-      this.publishRefusal(snapshot, admission.error);
-      return undefined;
-    }
-    const geometryKey = this.cache.getOrCreate(snapshot, meshResult.value).key;
-    const prepKey = `${geometryKey}:${lane}:${backend}`;
-    let preparation = this.preparations.get(prepKey);
-    if (preparation === undefined) {
-      preparation = createPointsLinesLanePreparationAdapter(lane, backend, {
-        cache: this.cache,
-        adapter: {
-          create: (geometry) => {
-            const vertex = this.internals.device.createBuffer({
-              label: `points-lines-vertices:${geometryKey}`,
-              size: Math.max(4, geometry.vertices.byteLength),
-              usage: GPU_BUFFER_USAGE_VERTEX | GPU_BUFFER_USAGE_COPY_DST,
-              mappedAtCreation: false,
-            });
-            if (!vertex.ok) return err(vertex.error);
-            const index = this.internals.device.createBuffer({
-              label: `points-lines-indices:${geometryKey}`,
-              size: Math.max(4, geometry.indices.byteLength),
-              usage: GPU_BUFFER_USAGE_INDEX | GPU_BUFFER_USAGE_COPY_DST,
-              mappedAtCreation: false,
-            });
-            if (!index.ok) {
-              this.internals.device.destroyBuffer(vertex.value);
-              return err(index.error);
-            }
-            return ok({ vertexBuffer: vertex.value, indexBuffer: index.value });
-          },
-          upload: (resource, geometry) => {
-            if (geometry.vertices.byteLength > 0) {
-              const vertexWrite = this.internals.device.queue.writeBuffer(
-                resource.vertexBuffer,
-                0,
-                geometry.vertices,
-              );
-              if (!vertexWrite.ok) return err(vertexWrite.error);
-            }
-            if (geometry.indices.byteLength > 0) {
-              const indexWrite = this.internals.device.queue.writeBuffer(
-                resource.indexBuffer,
-                0,
-                geometry.indices,
-              );
-              if (!indexWrite.ok) return err(indexWrite.error);
-            }
-            return ok(geometry.derivedBytes);
-          },
-          validate: (_resource, geometry) =>
-            geometry.expandedVertexCount > 0 && geometry.expandedIndexCount > 0
-              ? ok(undefined)
-              : err(new Error('Points/Lines expansion contains no drawable triangles')),
-          destroy: (resource) => {
-            this.internals.device.destroyBuffer(resource.vertexBuffer);
-            this.internals.device.destroyBuffer(resource.indexBuffer);
-          },
-        },
-      });
-      this.preparations.set(prepKey, preparation);
-    }
-    const prepared = preparation.prepare(snapshot, meshResult.value);
-    if (!prepared.ok) {
-      const lkg = preparation.lastKnownGood();
-      if (lkg !== undefined) {
-        const lkgPlan = createPointsLinesLaneAdapter(lane, backend).createRecordPlan(
-          lkg.snapshot,
-          lkg.geometry,
-        );
-        const state = preparation.inspect();
-        this.active.set(
-          key,
-          inspectPointsLines({
-            snapshot,
-            topology,
-            lane,
-            pointCount: lkg.geometry.pointCount,
-            segmentCount: lkg.geometry.segmentCount,
-            sourceBytes: lkg.geometry.sourceBytes,
-            derivedBytes: lkg.geometry.derivedBytes,
-            cache: { hit: true, rebuilds: state.rebuilds, evictions: 0 },
-            drawCount: lkgPlan.drawCount,
-            uploadBytes: 0,
-            lastKnownGood: true,
-            refusal: {
-              code: prepared.error.code,
-              expected: prepared.error.expected,
-              hint: prepared.error.hint,
-              detail: prepared.error.detail,
-              generation: prepared.error.detail.generation,
-              lastKnownGood: true,
-            },
-          }),
-        );
-        return {
-          plan: lkgPlan,
-          vertexBuffer: lkg.resource.vertexBuffer,
-          indexBuffer: lkg.resource.indexBuffer,
-          layoutProjection: this.layoutProjection,
-        };
-      }
-      this.publishRefusal(snapshot, prepared.error);
-      return undefined;
-    }
-    const plan = createPointsLinesLaneAdapter(lane, backend).createRecordPlan(
-      snapshot,
-      prepared.value.geometry,
-    );
-    const state = preparation.inspect();
-    this.active.set(
-      key,
-      inspectPointsLines({
-        snapshot,
-        topology,
-        lane,
-        pointCount: prepared.value.geometry.pointCount,
-        segmentCount: prepared.value.geometry.segmentCount,
-        sourceBytes: prepared.value.geometry.sourceBytes,
-        derivedBytes: prepared.value.geometry.derivedBytes,
-        cache: {
-          hit: prepared.value.uploadedBytes === 0,
-          rebuilds: state.rebuilds,
-          evictions: 0,
-        },
-        drawCount: plan.drawCount,
-        uploadBytes: prepared.value.uploadedBytes,
-        lastKnownGood: prepared.value.lastKnownGood,
-      }),
-    );
-    return {
-      plan,
-      vertexBuffer: prepared.value.resource.vertexBuffer,
-      indexBuffer: prepared.value.resource.indexBuffer,
-      layoutProjection: this.layoutProjection,
-    };
-  }
-
-  resetForDeviceLoss(): void {
-    for (const preparation of this.preparations.values()) preparation.resetForDeviceLoss();
-    this.active.clear();
-  }
-
-  inspections(): readonly PointsLinesInspection[] {
-    return [...this.active.values()];
-  }
-
-  private backend(): PointsLinesBackend {
-    switch (this.internals.device.caps.backendKind) {
-      case 'wgpu-webgl2':
-        return 'wgpu-webgl2';
-      case 'null':
-        return 'null';
-      default:
-        return 'webgpu';
-    }
-  }
-
-  private publishRefusal(
-    snapshot: PointsLinesRetainedSnapshot,
-    error: PointsLinesSourceError,
-  ): void {
-    this.active.set(
-      `${snapshot.worldId}:${snapshot.entityKey}`,
-      inspectPointsLines({
-        snapshot,
-        topology: snapshot.component === 'Points' ? 'point-list' : 'line-list',
-        lane: 'refused',
-        pointCount: 0,
-        segmentCount: 0,
-        sourceBytes: 0,
-        derivedBytes: 0,
-        cache: { hit: false, rebuilds: 0, evictions: 0 },
-        drawCount: 0,
-        uploadBytes: 0,
-        lastKnownGood: false,
-        refusal: {
-          code: error.code,
-          expected: error.expected,
-          hint: error.hint,
-          detail: error.detail,
-          generation: snapshot.meshGeneration,
-          lastKnownGood: false,
-        },
-      }),
-    );
-  }
-}
-
 export function createRenderSystem(internals: RenderSystemInternals): RenderSystem {
   const phaseCatalogRegistration = internals.profiler?.registerPhaseCatalog(
     'render',
@@ -1127,6 +1083,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
   let preparedWorlds: readonly World[] = [];
   let latestCamera: CameraSnapshot | undefined;
   const pointsLinesOwner = new StandardPointsLinesOwner(internals);
+  const instanceCollections = new InstanceProjectionStore();
   const reflectionProbeOwner = new ReflectionProbeRecordOwner(internals);
   let ssrFormatReceipt: import('@forgeax/engine-rhi').RhiTextureFormatCapabilityReceipt | undefined;
   let ssrFormatProbeGeneration = -1;
@@ -1168,8 +1125,10 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     onSharedRefMutation: (worldId, handle) => {
       internals.gpuStore.invalidateMesh(handle, preparedWorlds[worldId] ?? worldId);
     },
+    instanceCollections,
+    getSkinPaletteAllocator: () => internals.getPipelineState()?.skinPaletteAllocator ?? null,
   });
-  const environmentLifecycle = new EnvironmentLifecycle(internals.deviceScope);
+  let environmentLifecycle = new EnvironmentLifecycle(internals.deviceScope);
   const transmissionAdmission = new TransmissionCandidateAdmission();
   let lastTransmissionInspection: TransmissionInspection | undefined;
   let lastTransmissionKey = '';
@@ -1294,8 +1253,13 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         });
     lastTransmissionKey = key;
   };
+  // GPU-driven production uses the validated adapter for normal frames. The
+  // assembly-supplied closure resolves its device-bound adapter at call time,
+  // so recovery candidate preparation still follows candidateShaderState
+  // rather than retaining a lost-generation module.
   const gpuDrivenShaderFactory =
     internals.shaderModuleFactory ??
+    internals.immediateShaderModuleFactory ??
     ({
       createShaderModule: () =>
         err(
@@ -1306,7 +1270,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           }),
         ),
     } satisfies import('./pipeline-builder').PipelineBuilderShaderModuleFactory);
-  let gpuDrivenProduction = new GpuDrivenProduction(internals.device, gpuDrivenShaderFactory);
+  let gpuDrivenProduction = GpuDrivenProduction.forDevice(internals.device, gpuDrivenShaderFactory);
   let occlusionRuntime: OcclusionRenderRuntime | undefined = new OcclusionRenderRuntime(
     internals.device,
     persistentRenderScene.visibilityFacetStore(),
@@ -1324,34 +1288,36 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     }
     return occlusionRuntime;
   };
-  const featureGpuWork: RenderFeatureGpuWorkOwner = createRenderFeatureGpuWorkOwner({
-    getDevice: () => internals.device,
-    getShaderModuleFactory: () =>
-      internals.shaderModuleFactory ??
-      ({
-        createShaderModule: () =>
-          err(
-            new RhiError({
-              code: 'rhi-not-available',
-              expected: 'the renderer backend exposes shader module creation',
-              hint: 'construct the renderer through the backend pack before activating GPU features',
-            }),
-          ),
-      } satisfies import('./pipeline-builder').PipelineBuilderShaderModuleFactory),
-    getImmediateShaderModuleFactory: () =>
-      internals.immediateShaderModuleFactory ??
-      internals.shaderModuleFactory ??
-      ({
-        createShaderModule: () =>
-          err(
-            new RhiError({
-              code: 'rhi-not-available',
-              expected: 'the renderer backend exposes shader module creation',
-              hint: 'construct the renderer through the backend pack before activating GPU features',
-            }),
-          ),
-      } satisfies import('./pipeline-builder').PipelineBuilderShaderModuleFactory),
-  });
+  const createFeatureGpuWorkOwner = (runtime: RenderSystemInternals): RenderFeatureGpuWorkOwner =>
+    createRenderFeatureGpuWorkOwner({
+      getDevice: () => runtime.device,
+      getShaderModuleFactory: () =>
+        runtime.shaderModuleFactory ??
+        ({
+          createShaderModule: () =>
+            err(
+              new RhiError({
+                code: 'rhi-not-available',
+                expected: 'the renderer backend exposes shader module creation',
+                hint: 'construct the renderer through the backend pack before activating GPU features',
+              }),
+            ),
+        } satisfies import('./pipeline-builder').PipelineBuilderShaderModuleFactory),
+      getImmediateShaderModuleFactory: () =>
+        runtime.immediateShaderModuleFactory ??
+        runtime.shaderModuleFactory ??
+        ({
+          createShaderModule: () =>
+            err(
+              new RhiError({
+                code: 'rhi-not-available',
+                expected: 'the renderer backend exposes shader module creation',
+                hint: 'construct the renderer through the backend pack before activating GPU features',
+              }),
+            ),
+        } satisfies import('./pipeline-builder').PipelineBuilderShaderModuleFactory),
+    });
+  let featureGpuWork = createFeatureGpuWorkOwner(internals);
   const disposeFeatureGpuWork = (): void => {
     const disposed = featureGpuWork.dispose();
     if (!disposed.ok) internals.errorRegistry.fire(disposed.error);
@@ -1411,6 +1377,8 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     currentDirectionalShadowView: null,
     currentSpotShadowView: null,
     instanceBuffers: new Map(),
+    instanceResidency: new Map(),
+    instanceBufferChunks: new Map(),
     probeBlendBuffers: new Map(),
     probeBlendRecordBufferCapacity: 0,
     morphBuffers: new Map(),
@@ -1493,6 +1461,8 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     spotShadowSnapshots: [],
   };
   let directFrameId = 0;
+  let submittedFrameCount = 0;
+  let lastSubmittedGeneration: number | undefined;
   let lastDirectionalShadowLights: ExtractedLights | undefined;
   let lastDirectionalShadowCandidate: 'accepted' | 'failed' = 'failed';
   let lastDirectionalShadowError: DirectionalShadowInspectionSource['error'];
@@ -1551,7 +1521,8 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
   // D-3 / D-8: per-shader params UBO resource table (id -> GPU Buffer).
   // Eager-created at register time when entry.params is present (byteSize >= 16,
   // defaultValue.length === byteSize); reused frame-to-frame via queue.writeBuffer.
-  const postProcessParamsBuffers = new Map<string, Buffer>();
+  let postProcessParamsBuffers = new Map<string, Buffer>();
+  let postProcessParamsDevice = internals.device;
   const builtinPostProcessEntries = new Map<string, PostProcessShaderEntry>();
   let activeFeaturePostProcessEntries: ReadonlyMap<string, PostProcessShaderEntry> = new Map();
   const lookupPostProcess = (id: string): PostProcessShaderEntry | undefined =>
@@ -1567,6 +1538,76 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
   // per-frame snapshot + bind it at group(1) binding(2).
   const getPostProcessParamsBuffer = (id: string): Buffer | undefined =>
     postProcessParamsBuffers.get(id);
+  const postProcessDeclarations = (): readonly (readonly [string, PostProcessShaderEntry])[] => [
+    ...builtinPostProcessEntries.entries(),
+    ...activeFeaturePostProcessEntries.entries(),
+  ];
+  const disposePostProcessResources = (resources: RecoveryPostProcessResources): void => {
+    for (const buffer of resources.paramsBuffers.values()) {
+      const destroyed = resources.device.destroyBuffer(buffer);
+      if (!destroyed.ok) internals.errorRegistry.fire(destroyed.error);
+    }
+  };
+  const prepareRecoveryPostProcessResources = (
+    device: RhiDevice,
+  ): Result<RecoveryPostProcessResources, RhiError> => {
+    const paramsBuffers = new Map<string, Buffer>();
+    try {
+      for (const [id, entry] of postProcessDeclarations()) {
+        if (id === 'forgeax.taa-resolve') continue;
+        let buffer: Buffer | undefined;
+        if (entry.params !== undefined) {
+          const created = device.createBuffer({
+            label: `post-process-params-${id}`,
+            size: entry.params.byteSize,
+            usage: GPU_BUFFER_USAGE_UNIFORM | GPU_BUFFER_USAGE_COPY_DST,
+            mappedAtCreation: false,
+          });
+          if (!created.ok) throw created.error;
+          buffer = created.value;
+          paramsBuffers.set(id, buffer);
+          const written = device.queue.writeBuffer(buffer, 0, entry.params.defaultValue);
+          if (!written.ok) throw written.error;
+        } else if (entryHasDepthRead(entry)) {
+          const created = device.createBuffer({
+            label: `post-process-params-${id}`,
+            size: DEPTH_MIN_PARAMS_BYTE_SIZE,
+            usage: GPU_BUFFER_USAGE_UNIFORM | GPU_BUFFER_USAGE_COPY_DST,
+            mappedAtCreation: false,
+          });
+          if (!created.ok) throw created.error;
+          buffer = created.value;
+        }
+        if (buffer !== undefined) paramsBuffers.set(id, buffer);
+      }
+    } catch (cause) {
+      disposePostProcessResources({ device, paramsBuffers });
+      if (cause instanceof RhiError) return err(cause);
+      return err(
+        new RhiError({
+          code: 'webgpu-runtime-error',
+          expected: 'post-process recovery resources are created on the candidate device',
+          hint: cause instanceof Error ? cause.message : String(cause),
+        }),
+      );
+    }
+    return ok({ device, paramsBuffers });
+  };
+  const publishRecoveryPostProcessResources = (candidate: RecoveryPostProcessResources): void => {
+    if (candidate.paramsBuffers === postProcessParamsBuffers) return;
+    const previous = { device: postProcessParamsDevice, paramsBuffers: postProcessParamsBuffers };
+    postProcessParamsDevice = candidate.device;
+    postProcessParamsBuffers = candidate.paramsBuffers;
+    disposePostProcessResources(previous);
+  };
+  const discardRecoveryPostProcessResources = (candidate: RecoveryPostProcessResources): void => {
+    if (candidate.paramsBuffers === postProcessParamsBuffers) {
+      postProcessParamsBuffers = new Map();
+      disposePostProcessResources(candidate);
+      return;
+    }
+    disposePostProcessResources(candidate);
+  };
   interface PostProcessParamsCandidate {
     readonly buffers: ReadonlyMap<string, Buffer>;
     readonly created: readonly Buffer[];
@@ -1666,6 +1707,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     const key = `${id}|${colorFormat}|${signature}`;
     const cached = postProcessPipelineCache.get(key);
     if (cached !== undefined) return cached;
+    internals.recoveryColdWorkGuard?.notePipelineColdWork();
     const factory = internals.buildPostProcessPipeline;
     if (factory === undefined) return null;
     const built = factory(
@@ -1842,44 +1884,60 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     createBindGroup: 0,
     keys: [],
   };
-  const preparedPipelineIds = new WeakMap<object, string>();
-  const preparedMaterialPipelineShaders = new WeakMap<object, string>();
-  const preparedGroup0Pipelines = new WeakSet<object>();
-  const preparedViewOnlyPipelines = new WeakSet<object>();
-  const preparedRenderMaterialPipelines = new WeakSet<object>();
-  const preparedAssetHandles = new WeakMap<World, Map<string, number>>();
+  type PreparedResolverCaches = {
+    readonly preparedPipelineIds: WeakMap<object, string>;
+    readonly preparedMaterialPipelineShaders: WeakMap<object, string>;
+    readonly preparedGroup0Pipelines: WeakSet<object>;
+    readonly preparedViewOnlyPipelines: WeakSet<object>;
+    readonly preparedRenderMaterialPipelines: WeakSet<object>;
+    readonly preparedAssetHandles: WeakMap<World, Map<string, number>>;
+  };
+  const createPreparedResolverCaches = (): PreparedResolverCaches => ({
+    preparedPipelineIds: new WeakMap(),
+    preparedMaterialPipelineShaders: new WeakMap(),
+    preparedGroup0Pipelines: new WeakSet(),
+    preparedViewOnlyPipelines: new WeakSet(),
+    preparedRenderMaterialPipelines: new WeakSet(),
+    preparedAssetHandles: new WeakMap(),
+  });
+  const activePreparedResolverCaches = createPreparedResolverCaches();
   const preparedHandle = <Brand extends string>(
+    runtime: RenderSystemInternals,
+    caches: PreparedResolverCaches,
     world: World,
     guid: string,
     brand: Brand,
   ): Handle<Brand, 'shared'> | undefined => {
-    let handles = preparedAssetHandles.get(world);
+    let handles = caches.preparedAssetHandles.get(world);
     if (handles === undefined) {
       handles = new Map();
-      preparedAssetHandles.set(world, handles);
+      caches.preparedAssetHandles.set(world, handles);
     }
     const key = `${brand}:${guid.toLowerCase()}`;
     const cached = handles.get(key);
     if (cached !== undefined) return cached as Handle<Brand, 'shared'>;
-    const asset = internals.assets.lookup(guid);
+    const asset = runtime.assets.lookup(guid);
     if (asset === undefined) return undefined;
     const handle = world.allocSharedRef(brand, asset);
     handles.set(key, handle as number);
     return handle;
   };
   const preparedMaterialBindings = (
+    runtime: RenderSystemInternals,
+    caches: PreparedResolverCaches,
+    worlds: readonly World[],
     materialShaderId: string,
     worldIndex: number,
     materialGuid: string,
     layout: BindGroupLayout,
   ) => {
-    const world = preparedWorlds[worldIndex];
-    const material = internals.assets.lookup(materialGuid) as MaterialAsset | undefined;
-    const pipelineState = internals.getPipelineState();
+    const world = worlds[worldIndex];
+    const material = runtime.assets.lookup(materialGuid) as MaterialAsset | undefined;
+    const pipelineState = runtime.getPipelineState();
     if (world === undefined || material?.kind !== 'material' || pipelineState === null) {
       return err(new Error('prepared material asset is unavailable'));
     }
-    const schema = internals.getParamSchema?.(materialShaderId) ?? [];
+    const schema = runtime.getParamSchema?.(materialShaderId) ?? [];
     const values = material.values ?? {};
     const derived = derive(schema);
     const fields = [...derived.textureFieldNames];
@@ -1892,7 +1950,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         schema,
         values as Readonly<Record<string, number | readonly number[]>>,
       );
-      const created = internals.device.createBuffer({
+      const created = runtime.device.createBuffer({
         label: `prepared-material:${materialGuid}`,
         size: payload.byteLength,
         usage: GPU_BUFFER_USAGE_UNIFORM | GPU_BUFFER_USAGE_COPY_DST,
@@ -1900,9 +1958,9 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       if (!created.ok) return created;
       buffer = created.value;
       payloadByteLength = payload.byteLength;
-      const written = internals.device.queue.writeBuffer(buffer, 0, payload);
+      const written = runtime.device.queue.writeBuffer(buffer, 0, payload);
       if (!written.ok) {
-        internals.device.destroyBuffer(buffer);
+        runtime.device.destroyBuffer(buffer);
         return written;
       }
     }
@@ -1919,20 +1977,32 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           : undefined;
       let sampler = pipelineState.defaultSampler;
       if (textureValue?.sampler !== undefined) {
-        const handle = preparedHandle(world, String(textureValue.sampler), 'SamplerAsset');
+        const handle = preparedHandle(
+          runtime,
+          caches,
+          world,
+          String(textureValue.sampler),
+          'SamplerAsset',
+        );
         if (handle !== undefined) {
           const asset = resolveAssetHandle<SamplerAsset>(world, handle);
           if (asset.ok) {
-            const resident = internals.gpuStore.ensureSamplerResident(handle, asset.value, world);
+            const resident = runtime.gpuStore.ensureSamplerResident(handle, asset.value, world);
             if (resident.ok) sampler = resident.value;
           }
         }
       }
       let view = pipelineState.defaultWhiteTextureView;
       if (textureValue !== undefined) {
-        const handle = preparedHandle(world, String(textureValue.texture), 'TextureAsset');
+        const handle = preparedHandle(
+          runtime,
+          caches,
+          world,
+          String(textureValue.texture),
+          'TextureAsset',
+        );
         if (handle !== undefined) {
-          view = residentTextureView(world, internals.gpuStore, internals, handle) ?? view;
+          view = residentTextureView(world, runtime.gpuStore, runtime, handle) ?? view;
         }
       }
       textureResources.push({ sampler, view });
@@ -1968,12 +2038,12 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         textureIndex += 1;
         continue;
       }
-      if (buffer !== undefined) internals.device.destroyBuffer(buffer);
+      if (buffer !== undefined) runtime.device.destroyBuffer(buffer);
       return err(new Error('prepared material schema contains unsupported binding kinds'));
     }
     const fallback = pipelineState.skylightFallback;
     if (fallback === null) {
-      if (buffer !== undefined) internals.device.destroyBuffer(buffer);
+      if (buffer !== undefined) runtime.device.destroyBuffer(buffer);
       return err(new Error('prepared material skylight fallback is unavailable'));
     }
     const completeEntries = assembleMaterialWithSkylightEntries(entries, {
@@ -1985,207 +2055,268 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       brdfLutSampler: fallback.sampler,
       intensityBuffer: fallback.intensityBuffer,
     });
-    const group = internals.device.createBindGroup({ layout, entries: completeEntries });
+    const group = runtime.device.createBindGroup({ layout, entries: completeEntries });
     if (!group.ok) {
-      if (buffer !== undefined) internals.device.destroyBuffer(buffer);
+      if (buffer !== undefined) runtime.device.destroyBuffer(buffer);
       return group;
     }
     if (buffer === undefined) return group;
     return ok({
       handle: group.value,
       dynamicOffsets: [0, 0],
-      release: () => internals.device.destroyBuffer(buffer),
+      release: () => runtime.device.destroyBuffer(buffer),
     });
   };
   const lastFrustumStats: { culled: number; total: number } = { culled: 0, total: 0 };
   const lastVisibilityStats: { explicitlyHidden: number } = { explicitlyHidden: 0 };
   let lastMeshMaterialBindings: readonly MeshMaterialBindingObservation[] = [];
   let lastMeshMaterialBindingFrame: ExtractedFrame | undefined;
-  const preparedResolverFactory = (
-    input: RenderFeaturePreparedGraphicsResolverInput,
-  ): PreparedGraphicsResolver => {
-    return createPreparedGraphicsResolver({
-      device: internals.device,
-      featureIdentity: input.featureIdentity,
-      generation: input.generation,
-      capabilityAvailable: true,
-      featureOrder: input.order,
-      lookup: input.lookup,
-      resolveGpuBuffer: (reference) =>
-        featureGpuWork.resolveBuffer(input.featureIdentity, reference),
-      resolvePipeline: (descriptor) => {
-        const postProcessEntry =
-          input.fullscreenEffects.get(descriptor.shader) ??
-          builtinPostProcessEntries.get(descriptor.shader);
-        if (postProcessEntry !== undefined) {
-          const fullscreen = buildFullscreenPostProcessPass(
-            { device: internals.device, errorRegistry: internals.errorRegistry },
-            postProcessEntry,
-          );
-          if (fullscreen === null) return err(new Error('prepared post-process layout failed'));
-          const pipeline = internals.getPostProcessPipeline?.(
+  const createPreparedResolverFactory =
+    (
+      runtime: RenderSystemInternals,
+      gpuWork: RenderFeatureGpuWorkOwner,
+      worlds: readonly World[],
+      caches: PreparedResolverCaches,
+    ) =>
+    (input: RenderFeaturePreparedGraphicsResolverInput): PreparedGraphicsResolver => {
+      const {
+        preparedPipelineIds,
+        preparedMaterialPipelineShaders,
+        preparedGroup0Pipelines,
+        preparedViewOnlyPipelines,
+        preparedRenderMaterialPipelines,
+      } = caches;
+      return createPreparedGraphicsResolver({
+        device: runtime.device,
+        featureIdentity: input.featureIdentity,
+        generation: input.generation,
+        capabilityAvailable: true,
+        featureOrder: input.order,
+        lookup: input.lookup,
+        resolveGpuBuffer: (reference) => gpuWork.resolveBuffer(input.featureIdentity, reference),
+        resolvePipeline: (descriptor) => {
+          const postProcessEntry =
+            input.fullscreenEffects.get(descriptor.shader) ??
+            builtinPostProcessEntries.get(descriptor.shader);
+          if (postProcessEntry !== undefined) {
+            const fullscreen = buildFullscreenPostProcessPass(
+              { device: runtime.device, errorRegistry: runtime.errorRegistry },
+              postProcessEntry,
+            );
+            if (fullscreen === null) return err(new Error('prepared post-process layout failed'));
+            const pipeline = runtime.getPostProcessPipeline?.(
+              descriptor.shader,
+              fullscreen.bindGroupLayout,
+              descriptor.colorFormats[0] as GPUTextureFormat,
+              postProcessEntry,
+            );
+            if (pipeline !== null && pipeline !== undefined) {
+              preparedPipelineIds.set(pipeline as object, descriptor.shader);
+              if (runtime.getMaterialShaderBindingContract?.(descriptor.shader) === 'group-0') {
+                preparedGroup0Pipelines.add(pipeline as object);
+              }
+            }
+            return pipeline === null || pipeline === undefined
+              ? err(makePreparedPipelinePendingError())
+              : ok(pipeline);
+          }
+          const preparedPipeline = runtime.getMaterialShaderPipeline?.(
             descriptor.shader,
-            fullscreen.bindGroupLayout,
+            descriptor.colorFormats[0] === 'rgba16float',
+            descriptor.renderState,
+            descriptor.topology,
+            descriptor.indexFormat,
+            undefined,
+            'forward',
+            undefined,
+            descriptor.sampleCount ?? 1,
+            // Prepared graphics own their declared attachment format. Passing
+            // it through keeps the PSO compatible with feature-target views
+            // (the ordinary material path intentionally defaults to the
+            // swap-chain view format).
             descriptor.colorFormats[0] as GPUTextureFormat,
-            postProcessEntry,
+            undefined,
+            descriptor.depthFormat === undefined
+              ? null
+              : (descriptor.depthFormat as GPUTextureFormat),
+            descriptor.vertexLayout,
+            undefined,
+            input.shaderModuleMode,
           );
-          if (pipeline !== null && pipeline !== undefined) {
-            preparedPipelineIds.set(pipeline as object, descriptor.shader);
-            if (internals.getMaterialShaderBindingContract?.(descriptor.shader) === 'group-0') {
+          // A requested material shader is an exact pipeline contract. During
+          // async shader warmup, substituting the generic unlit pipeline can
+          // mismatch vertex layouts and HDR attachment formats, turning a
+          // retryable next-frame prepare into an invalid GPU command buffer.
+          const pipeline = preparedPipeline ?? null;
+          if (pipeline !== null) {
+            preparedMaterialPipelineShaders.set(pipeline as object, descriptor.shader);
+            const bindingContract = runtime.getMaterialShaderBindingContract?.(descriptor.shader);
+            if (bindingContract === 'group-0') {
               preparedGroup0Pipelines.add(pipeline as object);
+            } else if (bindingContract === 'view-only') {
+              preparedViewOnlyPipelines.add(pipeline as object);
+            } else {
+              preparedRenderMaterialPipelines.add(pipeline as object);
             }
           }
-          return pipeline === null || pipeline === undefined
-            ? err(makePreparedPipelinePendingError())
-            : ok(pipeline);
-        }
-        const preparedPipeline = internals.getMaterialShaderPipeline?.(
-          descriptor.shader,
-          descriptor.colorFormats[0] === 'rgba16float',
-          descriptor.renderState,
-          descriptor.topology,
-          descriptor.indexFormat,
-          undefined,
-          'forward',
-          undefined,
-          descriptor.sampleCount ?? 1,
-          // Prepared graphics own their declared attachment format. Passing
-          // it through keeps the PSO compatible with feature-target views
-          // (the ordinary material path intentionally defaults to the
-          // swap-chain view format).
-          descriptor.colorFormats[0] as GPUTextureFormat,
-          undefined,
-          descriptor.depthFormat === undefined
-            ? null
-            : (descriptor.depthFormat as GPUTextureFormat),
-          descriptor.vertexLayout,
-          undefined,
-          input.shaderModuleMode,
-        );
-        // A requested material shader is an exact pipeline contract. During
-        // async shader warmup, substituting the generic unlit pipeline can
-        // mismatch vertex layouts and HDR attachment formats, turning a
-        // retryable next-frame prepare into an invalid GPU command buffer.
-        const pipeline = preparedPipeline ?? null;
-        if (pipeline !== null) {
-          preparedMaterialPipelineShaders.set(pipeline as object, descriptor.shader);
-          const bindingContract = internals.getMaterialShaderBindingContract?.(descriptor.shader);
-          if (bindingContract === 'group-0') {
-            preparedGroup0Pipelines.add(pipeline as object);
-          } else if (bindingContract === 'view-only') {
-            preparedViewOnlyPipelines.add(pipeline as object);
-          } else {
-            preparedRenderMaterialPipelines.add(pipeline as object);
+          return pipeline === null ? err(makePreparedPipelinePendingError()) : ok(pipeline);
+        },
+        resolveBindings: (descriptor, pipeline) => {
+          const materialShaderId = preparedMaterialPipelineShaders.get(pipeline as object);
+          const bindingContract =
+            materialShaderId === undefined
+              ? undefined
+              : runtime.getMaterialShaderBindingContract?.(materialShaderId);
+          if (bindingContract === 'group-0-resource') {
+            return descriptor.values.sceneDepth === undefined
+              ? err(new Error('prepared group-0 resource pipeline requires a scene target'))
+              : ok(undefined);
           }
-        }
-        return pipeline === null ? err(makePreparedPipelinePendingError()) : ok(pipeline);
-      },
-      resolveBindings: (descriptor, pipeline) => {
-        const materialShaderId = preparedMaterialPipelineShaders.get(pipeline as object);
-        const bindingContract =
-          materialShaderId === undefined
-            ? undefined
-            : internals.getMaterialShaderBindingContract?.(materialShaderId);
-        if (bindingContract === 'group-0-resource') {
-          return descriptor.values.sceneDepth === undefined
-            ? err(new Error('prepared group-0 resource pipeline requires a scene target'))
-            : ok(undefined);
-        }
-        if (bindingContract === 'view-and-scene-depth') {
-          return ok(undefined);
-        }
-        if (preparedGroup0Pipelines.has(pipeline as object)) {
+          if (bindingContract === 'view-and-scene-depth') {
+            return ok(undefined);
+          }
+          if (preparedGroup0Pipelines.has(pipeline as object)) {
+            const layout =
+              (materialShaderId === undefined
+                ? undefined
+                : runtime.getMaterialBindGroupLayout?.(materialShaderId)) ??
+              (
+                pipeline as RenderPipeline & {
+                  getBindGroupLayout?: (index: number) => BindGroupLayout;
+                }
+              ).getBindGroupLayout?.(0);
+            return layout === undefined
+              ? err(new Error('prepared group-0 pipeline bind group layout is unavailable'))
+              : runtime.device.createBindGroup({ layout, entries: [] });
+          }
+          if (
+            preparedViewOnlyPipelines.has(pipeline as object) ||
+            (preparedRenderMaterialPipelines.has(pipeline as object) &&
+              descriptor.values.group === 0) ||
+            pipeline === runtime.getPipelineState()?.unlitPipeline
+          ) {
+            return ok(undefined);
+          }
+          const group = descriptor.values.group;
           const layout =
-            (materialShaderId === undefined
-              ? undefined
-              : internals.getMaterialBindGroupLayout?.(materialShaderId)) ??
+            (materialShaderId !== undefined
+              ? (runtime.getMaterialBindGroupLayout?.(materialShaderId) ??
+                (group === 0 ? runtime.getPipelineState()?.materialBindGroupLayout : undefined))
+              : undefined) ??
             (
               pipeline as RenderPipeline & {
                 getBindGroupLayout?: (index: number) => BindGroupLayout;
               }
-            ).getBindGroupLayout?.(0);
-          return layout === undefined
-            ? err(new Error('prepared group-0 pipeline bind group layout is unavailable'))
-            : internals.device.createBindGroup({ layout, entries: [] });
-        }
-        if (
-          preparedViewOnlyPipelines.has(pipeline as object) ||
-          (preparedRenderMaterialPipelines.has(pipeline as object) &&
-            descriptor.values.group === 0) ||
-          pipeline === internals.getPipelineState()?.unlitPipeline
-        ) {
-          return ok(undefined);
-        }
-        const group = descriptor.values.group;
-        const layout =
-          (materialShaderId !== undefined
-            ? (internals.getMaterialBindGroupLayout?.(materialShaderId) ??
-              (group === 0 ? internals.getPipelineState()?.materialBindGroupLayout : undefined))
-            : undefined) ??
-          (
-            pipeline as RenderPipeline & {
-              getBindGroupLayout?: (index: number) => BindGroupLayout;
-            }
-          ).getBindGroupLayout?.(group === 1 ? 1 : 0);
-        const material = descriptor.values.material;
-        if (
-          group === 1 &&
-          layout !== undefined &&
-          materialShaderId !== undefined &&
-          typeof material === 'object' &&
-          material !== null &&
-          'world' in material &&
-          'guid' in material &&
-          typeof material.world === 'number' &&
-          typeof material.guid === 'string'
-        ) {
-          return preparedMaterialBindings(materialShaderId, material.world, material.guid, layout);
-        }
-        return layout === undefined
-          ? err(new Error('prepared pipeline bind group layout is unavailable'))
-          : internals.device.createBindGroup({
+            ).getBindGroupLayout?.(group === 1 ? 1 : 0);
+          const material = descriptor.values.material;
+          if (
+            group === 1 &&
+            layout !== undefined &&
+            materialShaderId !== undefined &&
+            typeof material === 'object' &&
+            material !== null &&
+            'world' in material &&
+            'guid' in material &&
+            typeof material.world === 'number' &&
+            typeof material.guid === 'string'
+          ) {
+            return preparedMaterialBindings(
+              runtime,
+              caches,
+              worlds,
+              materialShaderId,
+              material.world,
+              material.guid,
               layout,
-              entries:
-                group === 1 && preparedPipelineIds.has(pipeline as object)
-                  ? [
-                      {
-                        binding: 0,
-                        resource: {
-                          kind: 'textureView',
-                          value: internals.getPipelineState()?.fallbackTextureView as never,
+            );
+          }
+          return layout === undefined
+            ? err(new Error('prepared pipeline bind group layout is unavailable'))
+            : runtime.device.createBindGroup({
+                layout,
+                entries:
+                  group === 1 && preparedPipelineIds.has(pipeline as object)
+                    ? [
+                        {
+                          binding: 0,
+                          resource: {
+                            kind: 'textureView',
+                            value: runtime.getPipelineState()?.fallbackTextureView as never,
+                          },
                         },
-                      },
-                      {
-                        binding: 1,
-                        resource: {
-                          kind: 'sampler',
-                          value: internals.getPipelineState()?.defaultSampler as never,
+                        {
+                          binding: 1,
+                          resource: {
+                            kind: 'sampler',
+                            value: runtime.getPipelineState()?.defaultSampler as never,
+                          },
                         },
-                      },
-                      ...(internals.getPostProcessParamsBuffer?.(
-                        preparedPipelineIds.get(pipeline as object) ?? '',
-                      ) === undefined
-                        ? []
-                        : [
-                            {
-                              binding: 2,
-                              resource: {
-                                kind: 'buffer' as const,
-                                value: {
-                                  buffer: internals.getPostProcessParamsBuffer?.(
-                                    preparedPipelineIds.get(pipeline as object) ?? '',
-                                  ) as never,
+                        ...(runtime.getPostProcessParamsBuffer?.(
+                          preparedPipelineIds.get(pipeline as object) ?? '',
+                        ) === undefined
+                          ? []
+                          : [
+                              {
+                                binding: 2,
+                                resource: {
+                                  kind: 'buffer' as const,
+                                  value: {
+                                    buffer: runtime.getPostProcessParamsBuffer?.(
+                                      preparedPipelineIds.get(pipeline as object) ?? '',
+                                    ) as never,
+                                  },
                                 },
                               },
-                            },
-                          ]),
-                    ]
-                  : [],
-            });
-      },
-    });
-  };
+                            ]),
+                      ]
+                    : [],
+              });
+        },
+      });
+    };
+  const preparedResolverFactory = (
+    input: RenderFeaturePreparedGraphicsResolverInput,
+  ): PreparedGraphicsResolver =>
+    createPreparedResolverFactory(
+      internals,
+      featureGpuWork,
+      preparedWorlds,
+      activePreparedResolverCaches,
+    )(input);
+  const recoveryOwner = createRenderSystemRecovery({
+    frameState,
+    internals,
+    getEnvironmentLifecycle: () => environmentLifecycle,
+    getGpuDrivenProduction: () => gpuDrivenProduction,
+    setGpuDrivenProduction: (production) => {
+      gpuDrivenProduction = production;
+    },
+    disposeFeatureGpuWork,
+    setFeatureGpuWork: (owner) => {
+      featureGpuWork = owner;
+    },
+    getActiveFeaturePostProcessEntries: () => activeFeaturePostProcessEntries,
+    setActiveFeaturePostProcessEntries: (entries) => {
+      activeFeaturePostProcessEntries = entries;
+    },
+    postProcessPipelineCache,
+    clearPostProcessPipelineCache,
+    clearPostProcessPipelineEntry,
+    invalidatePostProcessModule,
+    persistentRenderScene,
+    gpuDrivenShaderFactory,
+    createFeatureGpuWorkOwner,
+    pointsLinesOwner,
+    createPreparedResolverFactory,
+    createPreparedResolverCaches,
+  });
   return {
+    get instanceCollectionsInspection(): readonly InstanceCollectionInspection[] {
+      return instanceCollections._inspections(
+        frameState.instanceResidency,
+        frameState.frameNumber - 1,
+      );
+    },
     releaseProfilerCatalog(): void {
       releaseProfilerCatalog?.();
       releaseProfilerCatalog = undefined;
@@ -2387,7 +2518,10 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       renderReadLeases?: readonly RenderReadLease[],
       timingCapture?: GpuTimingCapture,
     ): boolean {
-      preparedWorlds = worlds;
+      const composition = canonicalizeWorldComposition(worlds, opts, renderReadLeases);
+      const compositionWorlds = composition.worlds;
+      const compositionLeases = composition.leases;
+      preparedWorlds = compositionWorlds;
       const profileSession = internals.profiler?.activeSession();
       let ownsProfileFrame = false;
       let submitted = false;
@@ -2403,7 +2537,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         // cameraOwner drives the surfaced cameras + frustum
         // cull; resourceOwner drives skylight/skybox/postProcess + per-world
         // record config.
-        const { cameraOwner, resourceOwner } = opts;
+        const { cameraOwner, resourceOwner } = composition.owners;
         // Keep the compiled graph as last-known-good until the candidate topology
         // compiles. The failed candidate frame does not execute it; successful
         // replacement retires it atomically in ensureCompiledFrameGraph.
@@ -2438,28 +2572,33 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         // the dedicated resourceOwner index. The variable is named
         // `resourceWorld` so the record-stage reads are self-describing (they
         // are resource-owner reads, not camera reads).
-        const resourceWorld = worlds[resourceOwner] as World;
+        const resourceWorld = compositionWorlds[resourceOwner] as World;
         const frame = runProfiledRenderPhase(profileSession, 'extract', () => {
           return persistentRenderScene.extractComposition(
-            worlds,
+            compositionWorlds,
             { cameraOwner, resourceOwner },
             internals.assets.catalogEpoch,
-            (renderables) =>
+            (request: PersistentRenderCandidateRequest) =>
               extractFrames(
-                worlds,
+                compositionWorlds,
                 { cameraOwner, resourceOwner },
                 internals.assets,
                 internals.getPipelineState(),
                 persistentRenderScene.materialSnapshotCacheStore(),
                 {
                   cull: 'none',
-                  renderables,
+                  renderables: request === 'none' ? 'none' : 'full',
+                  ...(request === 'none' || request === 'full'
+                    ? {}
+                    : { renderableEntitiesByWorld: request.entitiesByWorld }),
+                  retainHidden: true,
+                  instanceCollections,
                   ...(internals.getMaterialShaderArtifact === undefined
                     ? {}
                     : { getMaterialShaderArtifact: internals.getMaterialShaderArtifact }),
                 },
               ),
-            renderReadLeases,
+            compositionLeases,
           );
         });
         const {
@@ -2491,16 +2630,16 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           skylight,
         );
         latestCamera = cameras[0];
-        persistentRenderScene.updateVisibilityFacet(worlds, latestCamera, renderables);
+        persistentRenderScene.updateVisibilityFacet(compositionWorlds, latestCamera, renderables);
         let occlusionProjection:
           | import('./scene/visibility/occlusion-runtime').OcclusionFrameProjection
           | undefined;
         let occlusionFallback: LodOcclusionInspection['fallback'] = { active: false };
-        const worldKeys = persistentRenderScene.visibilityWorldKeysFor(worlds);
+        const worldKeys = persistentRenderScene.visibilityWorldKeysFor(compositionWorlds);
         const slotByEntity = persistentRenderScene.compositionSlotByStableEntity();
         if (latestCamera !== undefined) {
           const camera = latestCamera;
-          const cameraWorld = worlds[camera.worldId ?? cameraOwner];
+          const cameraWorld = compositionWorlds[camera.worldId ?? cameraOwner];
           const view = viewKey({
             attachmentId: cameraWorld?.identity ?? 'missing-camera-world',
             cameraEntity: camera.entityKey ?? 0,
@@ -2514,7 +2653,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
             cachedCandidates.cameraWorldIdentity === (cameraWorld?.identity ?? '')
               ? cachedCandidates.candidates
               : renderables.flatMap((renderable) => {
-                  const world = worlds[renderable.worldId];
+                  const world = compositionWorlds[renderable.worldId];
                   const aabb = renderable.localAabb;
                   // Occlusion is a LOD transport concern. A plain mesh has no
                   // lower-detail range to select, so keep it on the ordinary CPU
@@ -2599,7 +2738,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           latestCamera !== undefined &&
           ensureOcclusionRuntime().prepareUnavailable
         ) {
-          const cameraWorld = worlds[latestCamera.worldId ?? cameraOwner];
+          const cameraWorld = compositionWorlds[latestCamera.worldId ?? cameraOwner];
           if (cameraWorld !== undefined) {
             const fallbackView = viewKey({
               attachmentId: cameraWorld.identity,
@@ -2609,7 +2748,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
             });
             for (const renderable of renderables) {
               if ((renderable.lods?.length ?? 0) === 0) continue;
-              const world = worlds[renderable.worldId];
+              const world = compositionWorlds[renderable.worldId];
               if (world === undefined) continue;
               const slot = slotByEntity.get(
                 worldEntityKey(
@@ -2632,7 +2771,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           }
         }
         const visibilityProjection = persistentRenderScene.projectVisibility(
-          worlds,
+          compositionWorlds,
           latestCamera,
           renderables,
           dispatch,
@@ -2678,7 +2817,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           const inspectionQuery = ensureOcclusionRuntime().inspect();
           const inspectionBudget = persistentRenderScene.visibilityBudgetValue();
           const inspectionWorlds = createLodWorldInspections(
-            worlds,
+            compositionWorlds,
             renderables,
             submissionRenderables,
             inspectionCamera,
@@ -2697,8 +2836,8 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
               : { active: false },
           );
           const attachmentByWorldKey = new Map<number, string>();
-          for (let worldId = 0; worldId < worlds.length; worldId += 1) {
-            const world = worlds[worldId];
+          for (let worldId = 0; worldId < compositionWorlds.length; worldId += 1) {
+            const world = compositionWorlds[worldId];
             if (world === undefined) continue;
             const worldKey = worldKeys[worldId] ?? worldId;
             if (attachmentByWorldKey.has(worldKey)) {
@@ -2717,7 +2856,8 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
               sourceKey: `render-frame:${frameState.frameNumber}`,
             },
             view: {
-              attachmentId: worlds[inspectionCamera.worldId ?? cameraOwner]?.identity ?? 'none',
+              attachmentId:
+                compositionWorlds[inspectionCamera.worldId ?? cameraOwner]?.identity ?? 'none',
               cameraEntity: inspectionCamera.entityKey ?? 0,
               viewRole: 'main',
               viewGeneration: inspectionCamera.historyVersion ?? 0,
@@ -2859,7 +2999,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         const preparedResourceBatches = runProfiledRenderPhase(profileSession, 'features', () => {
           if (internals.featureHost === undefined) return [];
           const featureFrame = runRenderFeatureFrame(internals.featureHost, {
-            worlds,
+            worlds: compositionWorlds,
             owner: resourceOwner,
             frameNumber: frameState.frameNumber,
             visibilitySnapshots: frame.featureVisibilitySnapshots,
@@ -3021,7 +3161,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
             skybox,
             skyboxCount,
             postProcessParams,
-            worlds,
+            compositionWorlds,
             recordProfilePhase,
             {
               owner: gpuDrivenProduction,
@@ -3034,7 +3174,7 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
               telemetryCandidateCount: lodCandidateCountForFrame,
               ...(occlusionProjection === undefined ? {} : { occlusion: occlusionProjection }),
             },
-            renderReadLeases,
+            compositionLeases,
             featureGraphCandidate,
             pointsLinesOwner,
             {
@@ -3051,6 +3191,14 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
             timingCapture,
           ),
         );
+        if (submitted) {
+          try {
+            internals.recoveryColdWorkGuard?.finish();
+          } catch (cause) {
+            submitted = false;
+            throw cause;
+          }
+        }
         if (submitted && lastLodOcclusionInspection !== undefined) {
           const query = ensureOcclusionRuntime().inspect();
           lastLodOcclusionInspection = {
@@ -3090,6 +3238,16 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
           };
         }
         if (submitted) {
+          recoveryOwner.setLastSuccessfulFrameSeed({
+            frame,
+            worlds: compositionWorlds,
+            cameraOwner: composition.owners.cameraOwner,
+            resourceOwner: composition.owners.resourceOwner,
+            width: Math.max(1, internals.canvas.width),
+            height: Math.max(1, internals.canvas.height),
+          });
+          submittedFrameCount += 1;
+          lastSubmittedGeneration = internals.deviceScope?.generation;
           if (occlusionProjection === undefined) {
             runProfiledRenderPhase(profileSession, 'record/occlusion-global-advance', () =>
               ensureOcclusionRuntime().advanceSuccessfulSubmit(frameState.frameNumber),
@@ -3226,6 +3384,9 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     get meshMaterialBindings(): readonly MeshMaterialBindingObservation[] {
       return lastMeshMaterialBindings;
     },
+    get iblBinding(): import('./mesh-material-bindings').IblBindingInspection | undefined {
+      return frameState.iblBindingInspection;
+    },
     get perFramePassNames(): readonly string[] {
       return frameState.compiledFrameGraph?.inspect().passes.map((pass) => pass.name) ?? [];
     },
@@ -3235,6 +3396,25 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
     get perFrameGraphInfo(): CompiledRenderGraphInfo | undefined {
       return frameState.compiledFrameGraph?.inspect();
     },
+    get recoveryEvidence(): RecoveryProductionEvidence {
+      const graph = frameState.compiledFrameGraph?.inspect();
+      return Object.freeze({
+        producerRoots: createRendererProducerRootMatrix(),
+        graph: Object.freeze({
+          ready: graph !== undefined,
+          generation: frameState.graphGeneration,
+          passCount: graph?.passes.length ?? 0,
+          resourceCount: graph?.resources.length ?? 0,
+        }),
+        residency: Object.freeze({
+          meshResidencyEpoch: internals.gpuStore.meshResidencyEpoch,
+        }),
+        submissions: Object.freeze({
+          count: submittedFrameCount,
+          lastGeneration: lastSubmittedGeneration,
+        }),
+      });
+    },
     get volumetricFog(): import('./volume/inspection').VolumetricFogInspection {
       return frameState.volumetricFogInspection;
     },
@@ -3330,6 +3510,11 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         throw cause;
       }
     },
+    lookupPostProcess,
+    prepareRecoveryGraphCandidate: recoveryOwner.prepareRecoveryGraphCandidate,
+    submitCandidateSetup: recoveryOwner.submitCandidateSetup,
+    publishRecoveryGraphCandidate: recoveryOwner.publishRecoveryGraphCandidate,
+    discardRecoveryGraphCandidate: recoveryOwner.discardRecoveryGraphCandidate,
     disposeFrameState(): void {
       (internals as TimingSessionHost).gpuPassTimingSession?.dispose();
       (internals as TimingSessionHost).gpuPassTimingSession = undefined;
@@ -3337,7 +3522,9 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       (internals as TimingSessionHost).gpuPassTimingSubmittedWork = undefined;
       (internals as TimingSessionHost).gpuPassTimingFrameIdentity = undefined;
       (internals as TimingSessionHost).gpuPassTimingBeginReason = undefined;
+      pointsLinesOwner.dispose();
       persistentRenderScene.dispose();
+      instanceCollections.dispose();
       gpuDrivenProduction.dispose();
       occlusionRuntime?.dispose();
       disposeFeatureGpuWork();
@@ -3407,6 +3594,10 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       // so destroy failures fire structured errors (unified per-frame +
       // dispose error strategy).
       disposeInstanceBuffers(frameState.instanceBuffers, internals.errorRegistry);
+      frameState.instanceResidency?.clear();
+      if (frameState.instanceBufferChunks !== undefined) {
+        disposeInstanceBufferChunks(frameState.instanceBufferChunks, internals.errorRegistry);
+      }
       disposeTransientInstanceBuffers(frameState.transientInstanceBuffers, internals.errorRegistry);
       if (frameState.probeBlendRecordBuffer !== undefined) {
         if (!frameState.probeBlendRecordBuffer.isDestroyed) {
@@ -3436,7 +3627,14 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
         frameState.pointShadowAtlas = null;
       }
     },
-    resetForRecover(): void {
+    resetForRecover(retiringPipelineState?: PipelineState, replacementDevice?: RhiDevice): void {
+      frameState.lastSuccessfulTemporalView = undefined;
+      frameState.successfulTemporalFrameIndex = 0;
+      frameState.pendingTemporalCommit = { kind: 'none' };
+      // The active expansion buffers belong to the lost generation. Abandon
+      // their handles without invoking destroy on a device that can no longer
+      // service cleanup; the staged candidate owns the replacement buffers.
+      pointsLinesOwner.abandonForDeviceLoss();
       ssrFormatReceipt = undefined;
       ssrFormatProbeGeneration = -1;
       ssrFormatProbe = undefined;
@@ -3457,18 +3655,28 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       updateTransmissionInspection(lastTransmissionAntialias, false);
       persistentRenderScene.resetGpuForRecover();
       gpuDrivenProduction.dispose();
-      gpuDrivenProduction = new GpuDrivenProduction(internals.device, gpuDrivenShaderFactory);
+      // The active renderer still points at the lost device until the caller
+      // completes the synchronous publication boundary. Bind the replacement
+      // explicitly so the first published draw never routes through an owner
+      // recreated against the old physical device.
+      gpuDrivenProduction = GpuDrivenProduction.forDevice(
+        replacementDevice ?? internals.device,
+        gpuDrivenShaderFactory,
+      );
       occlusionRuntime?.dispose();
       // The replacement device is installed by the host after this hook. Do
       // not recreate device-bound query resources against the lost device;
       // the first post-recovery frame lazily binds the current device.
       occlusionRuntime = undefined;
       disposeFeatureGpuWork();
+      featureGpuWork = createFeatureGpuWorkOwner(internals);
       reflectionProbeOwner.dispose();
       // A recovered device cannot retain handles from the lost device. The
       // Bloom owner abandons candidates and retires every committed generation
       // before the new PipelineState is rebuilt.
-      internals.getPipelineState()?.perPassResources.drainBloomResources?.();
+      (
+        retiringPipelineState ?? internals.getPipelineState()
+      )?.perPassResources.drainBloomResources?.();
       // feat-20260622-s5 M3 / B-2 / w18: recover() rebuild drops device-bound
       // state minted by the lost device. The active graph and per-entity caches
       // must be discarded, not merely marked for destruction: their opaque
@@ -3531,6 +3739,8 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       }
       frameState.retiredCompiledFrameGraphs.clear();
       frameState.instanceBuffers.clear();
+      frameState.instanceBufferChunks?.clear();
+      frameState.instanceResidency?.clear();
       delete frameState.probeBlendRecordBuffer;
       frameState.probeBlendRecordBufferCapacity = 0;
       frameState.probeBlendBuffers.clear();
@@ -3554,113 +3764,147 @@ export function createRenderSystem(internals: RenderSystemInternals): RenderSyst
       // the lost device, so recovery must invalidate this cache alongside the
       // feature-host declarations and UBOs below.
       postProcessPipelineCache.clear();
-      // Logical declarations stay live in the feature host while a replacement
-      // device is being requested.
-      postProcessParamsBuffers.clear();
+      // Logical declarations and the active params bundle stay live until the
+      // candidate post-process bundle crosses the publication boundary.
       resetRenderFeatureGraphState(internals);
     },
+    prepareRecoveryPostProcessResources(device: RhiDevice) {
+      return prepareRecoveryPostProcessResources(device);
+    },
+    publishRecoveryPostProcessResources(candidate: RecoveryPostProcessResources): void {
+      publishRecoveryPostProcessResources(candidate);
+    },
+    discardRecoveryPostProcessResources(candidate: RecoveryPostProcessResources): void {
+      discardRecoveryPostProcessResources(candidate);
+    },
     restorePostProcessResources(): void {
-      const declarations = [
-        ...builtinPostProcessEntries.entries(),
-        ...activeFeaturePostProcessEntries.entries(),
-      ];
-      for (const [id, entry] of declarations) {
-        if (id === 'forgeax.taa-resolve') continue;
-        let buffer: Buffer | undefined;
-        if (entry.params !== undefined) {
-          const created = internals.device.createBuffer({
-            label: `post-process-params-${id}`,
-            size: entry.params.byteSize,
-            usage: GPU_BUFFER_USAGE_UNIFORM | GPU_BUFFER_USAGE_COPY_DST,
-            mappedAtCreation: false,
-          });
-          if (!created.ok) throw created.error;
-          buffer = created.value;
-          const written = internals.device.queue.writeBuffer(buffer, 0, entry.params.defaultValue);
-          if (!written.ok) {
-            internals.device.destroyBuffer(buffer);
-            throw written.error;
-          }
-        } else if (entryHasDepthRead(entry)) {
-          const created = internals.device.createBuffer({
-            label: `post-process-params-${id}`,
-            size: DEPTH_MIN_PARAMS_BYTE_SIZE,
-            usage: GPU_BUFFER_USAGE_UNIFORM | GPU_BUFFER_USAGE_COPY_DST,
-            mappedAtCreation: false,
+      const prepared = prepareRecoveryPostProcessResources(internals.device);
+      if (!prepared.ok) throw prepared.error;
+      publishRecoveryPostProcessResources(prepared.value);
+    },
+    prepareRecoveryRoots(runtime: RecoveryRootRuntime): RecoveryRootBundle {
+      // Snapshot only CPU projections/declarations here. The root create
+      // callbacks below must never close over a mutable active owner while
+      // LifecycleTransaction is awaiting candidate construction.
+      const candidateEnvironmentLifecycle = environmentLifecycle.createRecoveryCandidate(
+        runtime.scope,
+      );
+      const roots: LifecycleResourceSpec<unknown>[] = [];
+      let candidateEnvironmentGeneration: EnvironmentGeneration | undefined;
+      let environmentRootCleaned = false;
+      let published = false;
+      if (candidateEnvironmentLifecycle.hasRecoveryFrame()) {
+        const environmentRoot = candidateEnvironmentLifecycle.createRecoveryRoot(runtime.scope);
+        roots.push({
+          ...environmentRoot,
+          create: async () => {
+            const generation = (await environmentRoot.create()) as EnvironmentGeneration;
+            candidateEnvironmentGeneration = generation;
+            return generation;
+          },
+          cleanup: (value) => {
+            if (environmentRootCleaned) return;
+            environmentRootCleaned = true;
+            if (candidateEnvironmentGeneration === value) {
+              candidateEnvironmentGeneration = undefined;
+            }
+            if (published) {
+              candidateEnvironmentLifecycle.retirePublishedGeneration(
+                value as EnvironmentGeneration,
+              );
+            } else {
+              environmentRoot.cleanup(value);
+            }
+          },
+        });
+      }
+      const graphCandidate = runtime.graphCandidate;
+      if (graphCandidate !== undefined) {
+        const releaseGraphCandidate = (): void => graphCandidate.release();
+        const compiledGraph = graphCandidate.frameState.compiledFrameGraph;
+        if (compiledGraph !== null) {
+          roots.push({
+            kind: 'pipeline',
+            create: () => {
+              if (!runtime.scope.isAlive()) {
+                throw new Error('Recovery graph candidate scope is not active.');
+              }
+              if (graphCandidate.frameState.compiledFrameGraph !== compiledGraph) {
+                throw new Error('Recovery graph candidate was changed before aggregate assembly.');
+              }
+              return compiledGraph;
+            },
+            // All graph/feature/GPU-driven candidate resources share one
+            // owner. The root is a real release seam, not a marker; the
+            // candidate latch makes every root cleanup call harmless after
+            // the first one.
+            cleanup: releaseGraphCandidate,
           });
-          if (!created.ok) throw created.error;
-          buffer = created.value;
         }
-        if (buffer !== undefined && lookupPostProcess(id) === entry) {
-          postProcessParamsBuffers.set(id, buffer);
-        } else if (buffer !== undefined) {
-          internals.device.destroyBuffer(buffer);
+        if (graphCandidate.featureHost !== undefined) {
+          const featureRoot = graphCandidate.featureHost.createRecoveryRoot(runtime.scope);
+          roots.push({ ...featureRoot, cleanup: releaseGraphCandidate });
+        }
+        if (graphCandidate.featureGpuWork !== undefined) {
+          const featureWorkRoot = graphCandidate.featureGpuWork.createRecoveryRoot(runtime.scope);
+          roots.push({ ...featureWorkRoot, cleanup: releaseGraphCandidate });
+        }
+        if (graphCandidate.gpuDrivenProduction !== undefined) {
+          const productionRoot = graphCandidate.gpuDrivenProduction.createRecoveryRoot(
+            runtime.scope,
+          );
+          roots.push({ ...productionRoot, cleanup: releaseGraphCandidate });
+        }
+        if (graphCandidate.gpuDrivenScene?.state !== undefined) {
+          const sceneRoot = graphCandidate.gpuDrivenScene.createRecoveryRoot(runtime.scope);
+          roots.push({ ...sceneRoot, cleanup: releaseGraphCandidate });
+        }
+        if (graphCandidate.pointsLines !== undefined) {
+          const pointsLinesRoot = graphCandidate.pointsLines.createRecoveryRoot(runtime.scope);
+          roots.push({ ...pointsLinesRoot, cleanup: releaseGraphCandidate });
+        }
+        if (runtime.gpuStore.recoveryResourceCount() > 0) {
+          const gpuStoreRoot = runtime.gpuStore.createRecoveryRoot(runtime.scope);
+          roots.push({ ...gpuStoreRoot, cleanup: releaseGraphCandidate });
         }
       }
+      let discarded = false;
+      return {
+        roots: Object.freeze(roots),
+        publish: () => {
+          if (published || discarded) return;
+          if (
+            candidateEnvironmentGeneration !== undefined &&
+            !candidateEnvironmentGeneration.retired
+          ) {
+            environmentLifecycle.retireActiveForReplacement();
+            candidateEnvironmentLifecycle.publish(candidateEnvironmentGeneration);
+          }
+          published = true;
+          environmentLifecycle = candidateEnvironmentLifecycle;
+          Object.assign(frameState, { environmentLifecycle });
+        },
+        discard: () => {
+          if (published || discarded) return;
+          discarded = true;
+          if (candidateEnvironmentGeneration !== undefined) {
+            candidateEnvironmentLifecycle.discard(candidateEnvironmentGeneration);
+            candidateEnvironmentGeneration = undefined;
+          }
+          candidateEnvironmentLifecycle.discardRecoveryCandidates();
+          // The transaction can fail before it reaches any graph root (for
+          // example while the environment root is created). Keep the graph,
+          // feature, GPU-driven, and residency resources on the same real
+          // candidate owner in that case; later scope/factory cleanup is a
+          // harmless repeat through the candidate latch.
+          graphCandidate?.release();
+          runtime.scope.abandon();
+        },
+      };
     },
   };
 }
 
-function buildOcclusionProxyVertices(
-  aabb: ArrayLike<number>,
-  world: ArrayLike<number>,
-  camera: import('./render-contract').CameraSnapshot,
-): Float32Array {
-  const view = computeViewMatrix(camera);
-  const projection = computeProjectionMatrix(camera);
-  const viewProjection = mat4.create();
-  mat4.multiply(viewProjection, projection, view);
-  const corners = [
-    [aabb[0] ?? 0, aabb[1] ?? 0, aabb[2] ?? 0],
-    [aabb[3] ?? 0, aabb[1] ?? 0, aabb[2] ?? 0],
-    [aabb[3] ?? 0, aabb[4] ?? 0, aabb[2] ?? 0],
-    [aabb[0] ?? 0, aabb[4] ?? 0, aabb[2] ?? 0],
-    [aabb[0] ?? 0, aabb[1] ?? 0, aabb[5] ?? 0],
-    [aabb[3] ?? 0, aabb[1] ?? 0, aabb[5] ?? 0],
-    [aabb[3] ?? 0, aabb[4] ?? 0, aabb[5] ?? 0],
-    [aabb[0] ?? 0, aabb[4] ?? 0, aabb[5] ?? 0],
-  ];
-  const triangles = [
-    0, 1, 2, 0, 2, 3, 4, 6, 5, 4, 7, 6, 0, 4, 5, 0, 5, 1, 3, 2, 6, 3, 6, 7, 0, 3, 7, 0, 7, 4, 1, 5,
-    6, 1, 6, 2,
-  ];
-  const output = new Float32Array(triangles.length * 4);
-  for (let index = 0; index < triangles.length; index += 1) {
-    const corner = corners[triangles[index] ?? 0] ?? [0, 0, 0];
-    const cx = corner[0] ?? 0;
-    const cy = corner[1] ?? 0;
-    const cz = corner[2] ?? 0;
-    const x = (world[0] ?? 0) * cx + (world[4] ?? 0) * cy + (world[8] ?? 0) * cz + (world[12] ?? 0);
-    const y = (world[1] ?? 0) * cx + (world[5] ?? 0) * cy + (world[9] ?? 0) * cz + (world[13] ?? 0);
-    const z =
-      (world[2] ?? 0) * cx + (world[6] ?? 0) * cy + (world[10] ?? 0) * cz + (world[14] ?? 0);
-    const w =
-      (world[3] ?? 0) * cx + (world[7] ?? 0) * cy + (world[11] ?? 0) * cz + (world[15] ?? 1);
-    const base = index * 4;
-    output[base] =
-      (viewProjection[0] ?? 0) * x +
-      (viewProjection[4] ?? 0) * y +
-      (viewProjection[8] ?? 0) * z +
-      (viewProjection[12] ?? 0) * w;
-    output[base + 1] =
-      (viewProjection[1] ?? 0) * x +
-      (viewProjection[5] ?? 0) * y +
-      (viewProjection[9] ?? 0) * z +
-      (viewProjection[13] ?? 0) * w;
-    output[base + 2] =
-      (viewProjection[2] ?? 0) * x +
-      (viewProjection[6] ?? 0) * y +
-      (viewProjection[10] ?? 0) * z +
-      (viewProjection[14] ?? 0) * w;
-    output[base + 3] =
-      (viewProjection[3] ?? 0) * x +
-      (viewProjection[7] ?? 0) * y +
-      (viewProjection[11] ?? 0) * z +
-      (viewProjection[15] ?? 0) * w;
-  }
-  return output;
-}
-
 /** Resolve the build identity used by every inspection submit. */
 export function resolveInspectionBuild(internals: Pick<RenderSystemInternals, 'build'>): string {
   return internals.build ?? 'render-system';