@forgeax/engine-render 0.1.27 → 0.1.29

package/README.md

@@ -33,7 +33,7 @@ GPU, Browser, and Dawn evidence that cannot execute is `not-run` or
 `unavailable`, never a verified structural substitute.
 
 The public frame vocabulary is intentionally small. `Camera` is the authoring
-owner for tone, antialiasing, bloom, and `historyVersion`; `Atmosphere` and
+owner for tone, exposure, color grading, antialiasing, bloom, and `historyVersion`; `Atmosphere` and
 `Fog` are independent ECS components. The renderer extracts these facts into
 an immutable `FramePlan`, records one frame, and returns a `FrameReceipt`.
 `FrameReceipt` is the only successful synchronous proof that the host submit
@@ -47,8 +47,10 @@ An AI consumer can start with the public sequence `state -> inspect -> recover
 `alive` admits a frame; `device-lost` permits one explicit recovery flight;
 `recovering` shares that flight; `faulted` requires a new Renderer; and
 `disposed` is terminal. `inspect()` is detached POD evidence for the current
-state and recovery attempt. After `recover()` succeeds, submit the unchanged
+state, recovery attempt, and named output contract. After `recover()` succeeds, submit the current
 draw input and use the new `FrameReceipt` as the proof for that generation.
+Recovery prepares the last successfully submitted workset; the next draw still
+consumes current World edits and admits new resources through normal residency.
 
 `inspect().recovery` is always present. Its `phase` is `null` outside an active
 attempt and otherwise follows `quiesce`, `acquire-adapter`, `acquire-device`,
@@ -194,6 +196,28 @@ environment owners or multiple fog owners return structured errors with a
 code-specific `detail`; they do not create a second registry or silently pick
 the first entity. Frame facts contain IDs, revisions, and POD values only, not
 textures, buffers, devices, or other live GPU objects.
+
+The Standard graph renders an Atmosphere source as a 128-by-128, six-face
+`rgba16float` sky cube and a background pass before scene geometry. The selected
+DirectionalLight supplies the sun direction, color, and illuminance; the sun
+angle is in radians, and zero radius disables the visible disc. Geometry covers
+the background through ordinary scene rendering, including transparent blending.
+The cube excludes the disc. Weak ambient lighting remains the explicit `Skylight`
+input; selecting an Atmosphere does not silently add a second ambient light.
+
+The cube has 786,432 texture payload bytes plus 280 bytes of graph-owned
+parameter and vertex payload, before backend allocation alignment. Its six faces update together when the selected environment
+signature changes, and become current only after successful frame submission.
+An unchanged source runs only the background pass. Resize, topology replacement,
+and recovery use normal graph retirement and reconstruction. GPU pass observations
+name `atmosphere-prepare`, `atmosphere-cube-0` through `atmosphere-cube-5`, and
+`atmosphere-background`; unavailable timestamps remain explicitly unavailable.
+The source lifecycle inspection and graph resource accounting describe different
+owners: a source revision is not a claim that its GPU cube was submitted.
+
+The reusable [Wave 1 recipe](../../scripts/dev-verify/wave1-rendering/README.md)
+shows the public scene inputs and associated acceptance gates.
+
 ## GPU pass timing: opt in, draw, observe, branch on status
 
 GPU pass timing is disabled by default. Opt in once on `createRenderer`, keep the
@@ -291,6 +315,18 @@ over-budget requests. A World with no `PointLightShadow` remains `inactive`;
 there is no pseudo-disabled shadow mode. Directional CSM remains a separate
 shadow owner; PointLightShadow is not a second directional-light path.
 
+The cube atlas uses negated world axes: cube lookup is `lightPos - worldPos`,
+and each face camera looks opposite its cube axis with the corresponding face-up
+vector. This matches WebGPU framebuffer V without reflecting clip-space Y or
+changing authored front-face/culling state. Raster matrices and sampling must
+change together; a standalone Z flip is not a valid conversion.
+
+Camera-culled scene meshes remain shadow candidates when their bounds intersect
+an admitted light frustum. Their projected dispatch contains only `ShadowCaster`,
+never Forward/Deferred work. Persistent composition uses the merged light frame,
+including lights from another World. `frustumStats.culled` continues to count
+camera rejection even when the retained object casts a shadow.
+
 ## Render happy path
 
 `RenderScene -> Standard Pipeline -> DeviceScope -> FrameReceipt` is the only frame
@@ -319,20 +355,50 @@ and keeps shadow, PBR, IBL, SSAO, bloom, tone, antialiasing, sky, material, VFX,
 ownership inside the same graph and submit boundary. CPU and WebGL2 remain capability lanes for the
 Cluster membership producer or for mesh/instance storage fallback; they do not reintroduce a
 PointLight/SpotLight buffer or a fixed four-light ABI.
-## SSR M0 admission: inspect owners, then decide
+## SSR admission and bounded inspection
+
+Coverage counters are `null` until GPU measurements are supplied; missing
+measurements must not be interpreted as zero hits. The hello-ssr Browser smoke
+captures a v7 RHI tape, reads trace/temporal/compose outputs at their producing
+work indices, and requires positive confidence plus a measurable composition
+delta. It also verifies that the composed resource reaches a later draw and
+retains its pixels through that draw. Ordinary `hello-ssr` startup enables SSR.
+
+The Standard G-buffer stores the visible material's response once:
+
+| Target | RGB | Alpha |
+|:--|:--|:--|
+| Normal/roughness | Encoded world normal | Roughness |
+| Albedo/metallic | Linear albedo | Metallic |
+| Specular response/AO | Unit-radiance specular BRDF response, including occlusion | AO |
+
+Forward lighting still owns direct light and emissive contributions. SSR uses
+one fullscreen additive draw, not a geometry redraw: its RGB delta is
+`confidence * (filteredRadiance * specularResponse - fallback)`. This prevents
+equal-depth overlapping geometry from subtracting the fallback more than once.
+Resolved radiance has a confidence-weighted mip chain; composition samples
+`roughness² * (mipCount - 1)` with trilinear reconstruction. Receiver admission
+uses the current lighting coverage, compatible half-resolution normals, and
+the shared View's enable/roughness cutoff. It does not clip the rough lobe to
+the central mirror ray's hit confidence. Material roughness changes the
+reflection's filter footprint, not just its opacity; confidence remains bounded
+by the current receiver's roughness fade. Coarse mips are spatial approximations,
+not separate roughness-dependent ray traces.
 
 > [!IMPORTANT]
 > SSR M0 is a consumer-only admission boundary. It reads detached producer,
-> r32float format, and temporal receipts with one four-field integration
-> identity. Any missing, stale, structural-only, or mismatched receipt stays
-> `fallback-only` and emits zero SSR work; this section does not describe SSR
-> capture, ray tracing, Hi-Z, temporal resolve, composition, or history.
+> r32float format, and optional prior temporal receipts with one four-field
+> integration identity. Missing required, stale, structural-only, or mismatched receipts stay
+> `fallback-only` and emits zero SSR work. An admitted Standard frame then
+> projects the renderer-owned M1 spatial chain and M2 history through
+> `renderer.inspect().ssr`; paired Browser/Dawn pixel evidence is still the
+> gate for calling the result SSR v1.
 
 ```mermaid
 flowchart LR
   P["producer detached receipt"] --> A["admitSsrM0"]
   F["format stage receipt"] --> A
-  T["temporal submit receipt"] --> A
+  T["optional prior temporal receipt"] -.-> A
   A -->|"all identity and verdict checks pass"| E["admitted: parent M1 may unlock"]
   A -->|"missing, stale, unavailable, or mismatched"| B["fallback-only: zero work"]
 ```
@@ -355,16 +421,64 @@ if (admission.status === 'fallback-only') {
 }
 ```
 
+After the ordinary frame, read the detached spatial projection without opening
+the graph or a GPU handle:
+
+```ts
+const spatial = renderer.inspect().ssr;
+switch (spatial.status) {
+  case 'not-requested':
+  case 'requested':
+  case 'fallback-only':
+    // Base probe / Skylight / neutral reflection remains visible.
+    break;
+  case 'structural-only':
+    // The graph is admitted, but this run has no executable shader carrier.
+    break;
+  case 'admitted':
+    // Inspect history, passRoster, fallbackSource, and coverage before evidence.
+    break;
+}
+```
+
+| `renderer.inspect().ssr.status` | Meaning | SSR work |
+|:--|:--|:--|
+| `not-requested` | Active camera has no `ScreenSpaceReflection` | Exact zero |
+| `requested` | Authoring is present; M0/spatial facts are not yet complete | Exact zero |
+| `fallback-only` | A closed config, lane, input, capability, or owner receipt failed | Exact zero |
+| `structural-only` | Spatial admission and graph topology exist, but no executable shader source is bound | Topology only |
+| `admitted` | Standard spatial path and shader manifest are bound | Inspect `history`, `passRoster`, `fallbackSource`, and coverage |
+
+`history.state`, `history.bytes`, `history.resetCount`, `passRoster`, and
+`fallbackSource` are bounded POD facts. They are evidence about the current
+owner state, not an acceptance claim: M1/M2 remain an implementation checkpoint
+until the paired Browser/Dawn 300-frame carrier, readback, falsifiers, and
+performance gates are present.
+
+SSR temporal feedback and presentation use distinct coordinates without another
+allocation. The persistent color/depth and normal/confidence slots use fixed,
+unjittered half-resolution centers (`2*p + 0.5` in full-resolution pixels).
+Current trace samples are reconstructed onto that grid once; history reprojection
+uses unjittered motion and validates depth/normal before interpolation. The
+separate resolved output stays on the current jittered raster grid for composition
+and reflection mip generation. Never feed that presentation reconstruction back
+into history: repeated jitter filtering loses reflected texture contrast.
+
 Use `inspect -> owner recovery -> matching submit -> reinspect` as the complete
 AI route. No returned field is a device, graph node, texture, buffer, encoder,
 or other live handle. A stable generation keeps `resetCount`, `rebuildCount`,
 and additional format probe work at zero; a changed generation must be
 reinspected before admission can be considered again.
 
-`inspect()` is a synchronous snapshot. The first snapshot after binding may show
-an absent format or temporal receipt while the owner probe and first submit are
-still in flight; it is not a `pending` verdict. Run the ordinary owner frame,
-await `FrameReceipt.completed`, then inspect again before routing recovery.
+`inspect()` is a synchronous snapshot. Explicit `RendererOptions.ssrIdentity`
+opts into one real format probe during initialization of each device generation;
+initialization and recovery await it before the first synchronous draw. A renderer
+without that option does not probe. Camera demand still controls all per-frame
+SSR attachments, passes, history and uploads. An unavailable format stays
+fallback-only; an absent previous temporal receipt does not block fresh spatial
+SSR. Current-frame motion/coverage comes from the Standard graph. History is
+read only after its normal successful-submit validation, never fabricated to
+admit the first frame.
 
 There are two action projections. `admission.failure.detail.action` is the coarse
 M0 gate instruction (`retry` for demand/readiness and `rebuild` for a missing or
@@ -377,8 +491,8 @@ API; use the existing owner operation shown here, then submit and inspect again:
 | `reflectionFallbackInspection.recoveryAction = use-LKG` | Keep the compatible probe row and draw the next frame | Read the committed row and matching temporal receipt |
 | `reflectionFallbackInspection.recoveryAction = use-Skylight` / `use-neutral` | Change the World-owned probe/`Skylight` source, then draw | Confirm selected source and committed generation |
 | `reflectionFallbackInspection.recoveryAction = recapture` / `rebuild` / `retry` | Draw again so the producer/RHI owner retries pending work | Await completion and inspect the owner receipt/failure |
-| `admission.failure.detail.action = retry` / `rebuild` | Retry the consumer frame, or rebuild the named owner receipt | Reinspect admission and all three receipt generations |
-| device-loss recovery | `await renderer.recover()` before the next draw | Confirm the replacement `deviceGeneration`, then re-probe |
+| `admission.failure.detail.action = retry` / `rebuild` | Retry the consumer frame, or rebuild the named owner receipt | Reinspect required receipts and any supplied temporal receipt |
+| device-loss recovery | `await renderer.recover()` before the next draw | Confirm the replacement `deviceGeneration` and its completed format probe |
 
 SSR never invokes these operations or mutates producer/device state; this table
 maps the typed action to the existing public World and Renderer seams.
@@ -410,18 +524,56 @@ The exact public names and stable consumer IDs are machine-readable in
 
 Progressive disclosure is intentional: read Camera configuration first, then
 the graph facts, backend facts, and finally the stable observation identity.
-The JSON-safe `RenderInspection` projection names the output contract directly:
+The JSON-safe `RenderInspection` projection keeps renderer lifecycle facts and
+the output contract in separate named subtrees. Read `renderer.inspect().output`
+for output facts; do not infer output state from renderer-level fields:
 
 | Field | Meaning | Owner |
 |:--|:--|:--|
-| `outputTransform` | `forgeax::standard::output-transform` | Standard post chain |
-| `displayEncoded` | final output is display encoded | Output Transform |
-| `intermediateFormat` | linear intermediate format (`rgba16float`) | Standard target owner |
-| `surfaceStorage` / `surfaceDisplay` | raw storage and display surface formats | surface adapter |
-| `endpoint` | `surface.storage.raw` | backend adapter |
-| `capability` / `error` | structured availability and recovery facts | RHI/render surface |
+| `output.outputTransform` | `forgeax::standard::output-transform` | Standard post chain |
+| `output.displayEncoded` | final output is display encoded | Output Transform |
+| `output.intermediateFormat` | linear intermediate format (`rgba16float`) | Standard target owner |
+| `output.surfaceStorage` / `output.surfaceDisplay` | raw storage and display surface formats | surface adapter |
+| `output.endpoint` | `surface.storage.raw` | backend adapter |
+| `output.capability` / `output.error` | structured availability and recovery facts | RHI/render surface |
 | `observation.observationId` / `frameId` | stable correlation refs | renderer observation owner |
 
+### Auto exposure and 3D LUT authoring
+
+Exposure is a Camera-owned closed union. Manual exposure is a positive
+multiplier; auto exposure carries a fallback, EV compensation, bounded EV
+range, and non-negative adaptation rates. The renderer owns the GPU receipt,
+but the author owns the Camera input:
+
+```ts
+world.set(camera, Camera, {
+  exposure: { kind: 'auto', fallback: 1, compensationEv: 0,
+    rangeEv: [-4, 4], rates: [2, 1] },
+}).unwrap();
+
+const output = renderer.inspect().output;
+if (output.autoExposure?.receipt.committed !== true) {
+  throw new Error(output.error?.hint ?? 'auto exposure is not committed');
+}
+```
+
+Color grading uses the ordinary shared `TextureAsset` route. Import/cook the
+3D LUT through Pack/Catalog, load the shared handle by its GUID/source key, and
+bind it to the Camera; there is no second LUT registry or URL-derived identity:
+
+```ts
+world.set(camera, Camera, {
+  colorLut: world.allocSharedRef('TextureAsset', lutHandle),
+  colorLutStrength: 0.75,
+}).unwrap();
+const lut = renderer.inspect().output.standardLut;
+// Match lut.sourceKey and lut.receipt.frameId to the submitted FrameReceipt.
+```
+
+`output.autoExposure`, `output.standardLut`, and `output.error` are detached
+facts. A fallback or last-known-good row is a recovery observation, not proof
+that a physical Browser/Dawn workload or timing gate completed.
+
 `renderer.inspect()` and `renderer.observe()` never carry ROI pixels, scanlines,
 brightness or level metrics. The hello-fxaa `hello-fxaa/dark-gradient/v1`
 fixture report owns those fields and records the fixed camera, low-light scene,
@@ -508,6 +660,83 @@ gate exercises the browser delivery path. Runtime inspection uses the public
 belongs in `packages/render/bench` and its dev-verify producer. Render does
 not expose a timing controller or a second membership-specific API.
 
+## TAA accumulation and private stability
+
+TAA reconstructs unjittered current color, validates reprojected depth, and
+accumulates HDR using luminance-preserving compressed-domain weights. History
+depth validation recognizes mixed current-depth coverage, following Three's
+TRAA edge exception: background/geometry and depth-discontinuous 3x3 edges
+may retain clipped history instead of alternating between accumulated and
+raw current color. Uniform-depth disocclusion, absent current geometry,
+out-of-bounds reprojection, invalid global history, motion and reactivity
+retain their rejection or weighting behavior. The GPU coverage regression
+executes the complete resolve, including the non-edge negative cases.
+History clipping uses YCoCg bounds. After eight accepted stationary frames, its bounds
+cover the texels supporting the reconstructed neighborhood; motion, rejection,
+or reactivity resets that private age. The history still updates every frame:
+this is not a frozen screenshot or an appearance acceptance claim.
+
+The private age continues to 128 accepted stationary frames without another
+surface. History weight stays at 0.95 through frame 64, then smoothly rises to
+0.99 by frame 128 to reduce residual phase response. The eight-frame clipping
+footprint remains unchanged. Clipping relaxation runs earlier, from accepted
+frame 8 through frame 64, while the 0.95 history weight still permits responsive
+accumulation. Releasing it only after increasing history weight preserves a
+biased clipped mean and causes prolonged static drift. Once settled, a single phase's unsupported
+color does not erase accumulated subpixel coverage: clipping resumes only
+after eight consecutive unsupported samples in the same signed dominant RGB
+direction. Finding support or reversing direction breaks that streak.
+Persistent unmarked color changes therefore restore color clipping within one
+complete jitter cycle. This color correction preserves the accepted stationary
+age and its reconstruction footprint; it must not collapse the next frame's
+neighborhood from 5x5 to 3x3. Motion,
+reactivity or rejection immediately reset
+the age and restore fast recovery; this delay is necessary because zero
+velocity alone does not establish settled radiance.
+
+An optional secondary-source reactivity texture joins the scene reactive lane
+before history weighting and stability counting. Standard forwards SSR's
+existing hit-source mask through a typed sampled read; TAA takes a conservative
+7x7 maximum at that texture's resolution. This covers the measured vacated
+reflection edge missed by the former radius-one footprint; it is a bounded
+dilation, not an arbitrary-speed reflected-motion guarantee. Reflected source motion can therefore
+reset a stationary receiver without changing the receiver's velocity or depth.
+The disabled path binds existing temporal data but does not sample it as a mask;
+no extra texture or pass is allocated. The 658-frame Browser and Dawn feedback
+variant checks secondary-motion reset and recovery; Dawn additionally verifies
+a failing control that ignores the mask. Each cyclic input step checks the
+Karis recurrence from the actual stored history against its adjacent FP16
+values; an independent infinite-precision tail detects accumulated bias.
+The premature high-weight counterexample must also fail. This does not establish visual
+convergence or ghost-free SSR.
+
+Color writeback stochastically selects adjacent representable FP16 values before
+attachment conversion. This prevents consistently downward conversion from
+accumulating a dark history bias without widening the history textures. Its
+deterministic pixel/frame hash shares one RGB threshold, leaves alpha and
+temporal metadata unchanged, and does not freeze the jitter sequence. Browser
+and Dawn run the same 528-frame raster-feedback regression against an analytic
+compressed-HDR recurrence; this precision gate is not visual acceptance.
+
+| Ping-pong history | Format | Consumer |
+|:--|:--|:--|
+| Color | `rgba16float` | TAA and downstream HDR processing |
+| Motion, depth, reactivity | `rgba16float` | Unchanged `temporal-v1` metadata, including Motion Blur |
+| Stationary age and settled clipping streak | `r8unorm` | TAA only; never stored in the reactive lane |
+
+The private byte uses codes 0–128 for stationary age and 129–170 for one
+through seven unsupported samples in six signed RGB directions. The eighth
+matching sample restores clipping and resets age. This is one encoded state,
+not an additional attachment or a change to downstream temporal metadata.
+Browser and Dawn raster-feedback tests cover phase-local coverage, unmarked
+color steps, and a falsifier that permanently disables clipping.
+
+These six surfaces share the existing successful-submit, abort, replacement,
+and retirement lifecycle. Texture accounting is 34 bytes per output pixel;
+`inspect().temporal.resources` includes active, candidate, and retiring states.
+Fullscreen pipeline targets come from the declared attachment format list,
+not from inspecting shader source text for a particular output structure.
+
 ## Motion Blur temporal consumer
 
 The Standard camera may carry the presence-enabled `MotionBlur` component. Its
@@ -664,69 +893,135 @@ infer state from URLs, or repair a producer failure. Aggregate counts are
 derived from the observations, so an AI can inspect first, repair or recook the
 producer, and retry without guessing at hidden renderer state.
 
-### Large Instances ownership
+### Renderer-owned Instances and CPU bounds
 
-> [!IMPORTANT]
-> World owns `Instances.transforms`. Create, replace and read instance matrices
-> through ECS without constructing a Renderer. A scene remains usable by another
-> Renderer after the first is disposed; glTF SceneAssets retain their matrices.
+`Instances` is a lightweight ECS association containing only a
+renderer-owned `collectionId`. Create and mutate the canonical packed matrices
+through the same `renderer.instances` owner; it validates mat4 stride, keeps
+revision/capacity/dirty ranges, and returns detached inspection snapshots.
+
+```ts
+function identityMatrices(count: number): Float32Array {
+  const matrices = new Float32Array(count * 16);
+  for (let index = 0; index < count; index += 1) {
+    const offset = index * 16;
+    // Column-major identity, with a deterministic layout so the instances are visible.
+    matrices[offset] = 1;
+    matrices[offset + 5] = 1;
+    matrices[offset + 10] = 1;
+    matrices[offset + 15] = 1;
+    matrices[offset + 12] = (index % 100) * 2;
+    matrices[offset + 14] = Math.floor(index / 100) * 2;
+  }
+  return matrices;
+}
+
+const collection = renderer.instances.create({
+  transforms: identityMatrices(instanceCount),
+}).unwrap();
+world.spawn(
+  { component: MeshFilter, data: { assetHandle: cube } },
+  { component: MeshRenderer, data: {} },
+  { component: Instances, data: { collectionId: collection.collectionId } },
+);
+
+const patch = identityMatrices(1);
+patch[12] = 4;
+renderer.instances.update(collection.collectionId, {
+  start: 0,
+  transforms: patch,
+});
+
+// Replacement keeps the logical identity and publishes a new revision.
+renderer.instances.replace(collection.collectionId, identityMatrices(instanceCount + 1));
+const current = renderer.instances.inspect(collection.collectionId).unwrap();
+const detached = renderer.instances.snapshot(collection.collectionId).unwrap();
+renderer.instances.release(collection.collectionId);
+```
 
-| Data | Owner |
+The lifecycle is deliberately one owner: `create` allocates canonical CPU
+storage, `replace` publishes a complete new revision (and grows capacity when
+needed), `update` validates a bounded matrix interval and records its dirty
+range, `inspect` returns identity/count/capacity/revision, `snapshot` returns a
+detached matrix copy plus dirty ranges for extraction, and `release` makes the
+collection id terminal. A caller never provides a GPU buffer or maintains
+backend-specific chunks. `detached.transforms` is an observation, not mutable
+renderer state.
+
+Render snapshots one collection per frame and derives CPU union bounds from the
+mesh AABB, entity world matrix, and detached matrices. Direct, GPU-driven, and
+backend fallback lanes consume that same projection; internal GPU chunks never
+become ECS or game-side state. Missing, malformed, or empty collections fail
+closed or remain a conservative no-cull result without manufacturing an
+identity instance. The initial payload must contain valid matrices: an
+all-zero mat4 has a zero homogeneous `w` and can produce a blank frame. Do not
+add matrix bytes, bounds, or chunk fields to the public `Instances` component or
+duplicate this renderer fact in Pack/asset state.
+
+#### Instance inspection and recovery
+
+`renderer.inspect().instanceCollections` is detached, bounded evidence for
+every live collection. Each row contains:
+
+| Field | Meaning |
 |:--|:--|
-| Instance matrices and entity lifecycle | World component storage |
-| Detached instance snapshot and content revision | Per-renderer projection |
-| GPU allocation, binding-sized chunks and uploaded revision | Existing renderer device generation |
-
-Small managed arrays keep the existing BufferPool size classes. Arrays larger
-than the largest pooled class use dedicated allocations and are released instead
-of retained in a large free bucket. The same authoring path supports 1,500,
-10,000 and 20,000 instances without application chunking.
-
-Each renderer compares complete extracted matrices against its own prior
-projection. Identical input retains the projection revision; a changed input
-publishes a complete new snapshot. Upload completion belongs to each GPU
-resident, not to a shared authoring dirty-range or a snapshot read. Stable
-residents skip upload; changed or new residents upload the complete applicable
-binding chunk. A renderer that skips frames still receives every latest value.
-
-`renderer.inspect().instanceCollections` reports derived projection identity,
-count, revision and upload/residency facts. These IDs never appear in components
-or SceneAssets and cannot be used to author a scene. Residency here describes
-the direct/chunked instance buffers; GPU-driven primary rendering is reported
-by `inspect().renderScene` and does not retain those unused buffers.
-
-Device loss uses the existing `renderer.recover()` candidate-generation protocol.
-The World stays authoritative; candidate preparation initializes replacement
-instance buffers from the complete snapshot before publication. Main and shadow
-passes share these residents, so the first recovered frame performs no cold
-instance upload for the prepared visible workset. Instances
-introduce no additional recovery API or lifecycle.
-
-Shader preparation, layouts and uploads all consume `RhiDevice.caps.storageBuffer`.
-Material boot variants include only axes declared by the material manifest.
-The Dawn gate restricts the advertised capability on a real WebGPU device and
-verifies uniform bindings below and above 128 instances with material pixels,
-GPU validation and stable-upload receipts.
-
-Population checks use the same World component route:
+| `collectionId`, `count`, `capacity`, `revision` | Logical identity and canonical authoring revision. |
+| `residentGeneration`, `lane` | Device generation and the selected `direct-storage`, `chunked-storage`, `direct-uniform`, `chunked-uniform`, `unresident`, or `unavailable` lane. |
+| `dirtyRanges`, `uploadRanges` | Canonical pending edits and the ranges uploaded by the current resident. |
+| `uploadedBytes`, `requestedBytes`, `supportedBytes` | Measured upload and admission byte facts; unsupported limits remain explicit. |
+| `backend`, `owner` | Backend identity and the fixed owner `renderer.instances`. |
+| `error` | A structured record-stage failure with `code`, `expected`, `hint`, and typed `detail` facts. |
+
+Authoring failures use the same closed `InstanceCollectionError` contract.
+For example, an invalid stride is rejected before publication and carries
+typed facts instead of requiring message parsing:
+
+```ts
+const result = renderer.instances.create({ transforms: new Float32Array(17) });
+if (!result.ok) {
+  const { code, expected, hint, detail, facts } = result.error;
+  // facts expose requestedBytes, supportedBytes, backend, owner, cause, and
+  // recovery; detail retains operation metadata. Repair the payload and retry.
+  void code;
+  void expected;
+  void hint;
+  void detail;
+  void facts;
+}
+```
+
+After a `device-lost` transition, call `await renderer.recover()` and retry the
+same draw request. The renderer drops generation-owned residents, keeps the
+canonical collection, and uploads every matrix into the new resident before
+recording; it does not reuse an old partial dirty range for uninitialized GPU
+memory. If inspection reports `unavailable`, follow its `error.detail.recovery`
+and repair the named capability/producer before retrying.
+
+The large-instance smoke exercises the real Dawn path for all admitted sizes:
 
 ```bash
-pnpm exec vitest run --config vitest.browser.config.ts --project=browser apps/parity/instancing-static/src/__tests__/instances.browser.test.ts
-INSTANCE_COUNT=20000 SMOKE_MIN_FRAMES=600 SMOKE_DURATION_MS=0 pnpm --filter @forgeax/parity-instancing-static smoke
+for count in 1500 10000 20000; do
+  INSTANCE_COUNT=$count SMOKE_MIN_FRAMES=600 SMOKE_DURATION_MS=0 \
+    pnpm --filter @forgeax/parity-instancing-static smoke
+done
 ```
 
-### Instances CPU bounds contract
+Each run must retain one logical collection, submit real work, upload on its
+first resident frame, and report zero transform-upload bytes on unchanged
+frames. Browser WebGPU acceptance additionally uses the browser/dev-server
+transport through the same production fixture and parameterizes the same three
+populations:
+
+```bash
+pnpm exec vitest run --config vitest.browser.config.ts --project=browser \
+  apps/parity/instancing-static/src/__tests__/instances.browser.test.ts
+```
 
-`Instances` remains author data containing only packed local transforms. The
-renderer derives a CPU union bound from each mesh AABB, entity world matrix,
-and every instance matrix. The union cache is scoped by World/entity and
-invalidated by mesh, entity-transform, instance-array, slot removal, and
-generation changes. Missing, malformed, or empty instance data is a
-conservative no-cull result; it never creates a synthetic identity instance.
-The GPU path keeps the mesh-local AABB and performs per-instance visibility,
-while the CPU path uses the derived union only to avoid dropping an entity
-whose origin is outside the view. Do not add `bounds` to the public
-`Instances` component or duplicate this renderer fact in Pack/asset state.
+The Browser test submits 600 frames for each population, asserts a real
+`webgpu` backend, captures the first and stable `instanceCollections` upload
+witnesses, reads the presented canvas through the browser compositor, and
+requires visible spread at three or more grid samples with zero renderer/RHI
+error events. Dawn structural evidence alone is not a browser validation.
 
 ## Points and Lines authoring (M1)
 
@@ -959,18 +1254,32 @@ state published by `World.update()`.
 
 ## Persistent render scene
 
-The ordinary single-World path bootstraps one renderer-owned CPU projection,
-then drains the World's bounded change journal. A no-change frame reuses the
-last visible snapshot without traversing renderable archetypes; transform
-changes update only their stable projection slots. Unrelated gameplay
-component writes do not invalidate render state.
+Every attached World composition bootstraps one renderer-owned CPU projection,
+then consumes each World's component and shared-reference change versions. One identity-based update
+publication merges content, root transforms, and instance changes, including
+when all occur in the same frame. Its GPU projection compares affected matrix
+and metadata rows before uploading them. An unchanged frame retains its existing
+snapshot; unrelated gameplay component writes do not invalidate render state.
+There is no exclusive transform/instance scene admission followed by a separate
+rebuild implementation. Missing producer evidence causes conservative source
+extraction into the same retained projection. World reordering and catalog
+reconciliation preserve surviving slots and their submitted temporal history.
 
 Mutable shared payloads use the same explicit-dirty rule: mutate the resolved
 payload, then call `world.sharedRefs.markChanged(handle)`. The renderer compares
-one monotonic shared-ref epoch on the no-change path, drains the bounded exact
-mutation journal when it advances, and refreshes only projection slots indexed
-by the changed material handle. Journal overflow and topology-changing material
-edits remain explicit full-reconcile reasons rather than silent partial state.
+one monotonic shared-ref epoch on the no-change path, reads changed handles
+when it advances, and refreshes the projection slots indexed by changed
+material or mesh handles. Missing source evidence requests conservative
+source reconciliation. Camera, light, and environment facts refresh independently
+of geometry publication; their edits do not discard retained geometry.
+
+Instance collection revisions refresh only their consumers. Visibility and
+parent changes refresh the affected subtree, and joint changes refresh the
+retained skin consumers. Shadow pass facts belong to each retained renderable;
+frame ownership is derived before camera culling so offscreen casters remain
+available. CPU visibility, occlusion, and LOD consume this same projection on
+every frame, including frames submitted through GPU-driven raster. No scene
+classification enables a second extraction or visibility implementation.
 
 When `RhiCaps.storageBuffer` is available, the same projection owns persistent
 Primitive, Instance, Transform, DrawTemplate, and Material GPU tables. The
@@ -998,11 +1307,128 @@ reason. The nested `gpu` status is one of `inactive`, `unsupported`, `resident`,
 `rebuild-pending`, or `error`; resident state additionally reports capacity,
 upload ranges and bytes, grows, clears, rebuilds, and no-change frames. The
 `gpuDriven` inspection reports whether stable frames materialized or validated
-GPU-owned rows and whether candidate or batch topology bytes were uploaded.
+GPU-owned rows and whether candidate or batch topology bytes were uploaded. Its
+lifetime `residencyValidationScans` and `residencyValidationCacheHits` counters
+make the CPU residency boundary auditable: an unchanged persistent frame should
+reuse the producer rows, while mesh, device, pipeline, or catalog generations
+force a new validation.
 GPU and renderer contract errors arrive through the single `renderer.subscribe`
 event stream (`event.kind === 'error'`); the renderer does not expose a second
 error listener registry.
 
+## GPU-driven PBR / shadow / skin navigation
+
+The shortest public declaration uses the same `Materials.standard` producer as
+the runtime and imported-skin carriers. `alphaCutoff` is the Alpha Mask
+contract; `castShadow` publishes the matching ShadowCaster pass.
+
+```ts
+import { Materials } from '@forgeax/engine/render';
+
+const material = Materials.standard({
+  baseColor: [1, 1, 1, 1],
+  alphaCutoff: 0.5,
+  castShadow: true,
+});
+const materialHandle = world.allocSharedRef('MaterialAsset', material);
+void materialHandle;
+```
+
+| Candidate | Main GPU lane | Shadow GPU lane | Closed result |
+|:--|:--:|:--:|:--|
+| Standard opaque or Alpha Mask, finite resources | supported | supported | `gpu` |
+| Standard skin with producer-authored finite animated bounds | supported | supported | `gpu` |
+| Skin bounds missing or non-finite | refused | refused | `cpu-deformation` |
+| Capable resource/pipeline not ready | refused | refused | `blocked` (`resource-not-ready`) |
+| Blend, transmission, morph, custom, or unsupported topology | refused | refused | `cpu-semantic` |
+| Clustered local lights or enabled SSAO, including zero local lights | refused | refused | `cpu-semantic` (`unsupported`) |
+
+The current scene-index shader does not consume the unified Cluster surface
+bindings. Admission checks active surface requirements each frame; disabling
+SSAO restores GPU eligibility when no other unsupported input remains. The
+existing complete CPU submission path still renders on the selected GPU.
+
+### Static TextureAsset admission
+
+Static PBR and Alpha Mask resources are admitted only from registered shared
+`TextureAsset` and `SamplerAsset` payloads. The resource-class identity is the
+sorted handle-pair projection used by the prepared material; it is not an
+array-position guess. Dynamic `RenderTargetTextureSource` and video sources
+remain their own CPU semantic boundary and are never coerced into a static
+GPU texture candidate.
+
+The focused topology fixture allocates and resolves real static shared refs for
+resource classes `1`, `16`, and `256`, then builds `100,000` candidates for each
+class. It is structural admission evidence, not a physical-GPU benchmark:
+
+```sh
+FORGEAX_SKIP_HARNESS_SYNC=1 pnpm exec vitest run --project=@forgeax/engine-render \
+  packages/render/src/__tests__/gpu-driven-batch-topology-pbr.unit.test.ts \
+  --no-file-parallelism --reporter=dot
+```
+
+### Point and Spot shadow authoring → view inspection
+
+`PointLight` and `SpotLight` shadow views are public light facts, not a hidden
+GPU slot API. A Spot author declares a companion `Transform`, outgoing
+`direction`, cone angles in degrees, and the embedded shadow policy:
+
+```ts
+import { SpotLight } from '@forgeax/engine-render';
+import { Transform } from '@forgeax/engine-scene';
+
+world.spawn(
+  { component: Transform, data: { pos: [0, 5, 0] } },
+  {
+    component: SpotLight,
+    data: {
+      direction: [0, -1, 0],
+      range: 20,
+      innerConeDeg: 15,
+      outerConeDeg: 35,
+      castShadow: true,
+      mapSize: 1024,
+      pcfKernelSize: 3,
+    },
+  },
+);
+```
+
+| Author fact | Contract |
+|:--|:--|
+| `direction` / `Transform` | Outgoing direction plus the light position; both are required for a useful view |
+| `range` | Meters; default `10` |
+| `innerConeDeg` / `outerConeDeg` | Degrees; `0 ≤ inner < outer ≤ 90`, defaults `0` / `45` |
+| `castShadow` | Defaults `true`; set `false` for the explicit no-shadow case |
+| `mapSize`, `pcfKernelSize` | Shadow map resolution and odd PCF width; defaults `2048` / `3` |
+| `cookie` / `projector` | Optional GUID-backed static texture facts; dynamic target/video sources stay outside GPU admission |
+
+After a successful `draw`, inspect the same renderer projection:
+
+```ts
+const channels = renderer.inspect().renderScene.gpuDriven.channels;
+const spotViews = channels.filter((channel) => channel.viewPass === 'spot-shadow');
+const pointFaces = channels.filter((channel) => channel.viewPass === 'point-shadow');
+void spotViews; // lane, reason, drawCount, and viewIndex are bounded facts.
+void pointFaces; // point views additionally expose the cube `face`.
+```
+
+The per-view cache is keyed by light identity and view parameters. A cache hit
+does not dispatch or record a duplicate shadow view. The inspection labels and
+identity helpers are anchored in
+[`spot-light.ts`](src/components/spot-light.ts),
+[`shadow-views.ts`](src/gpu-driven/shadow-views.ts), and
+[`frame.ts`](src/record/frame.ts); repair the producer named by a structured
+`failure.detail` before retrying the unchanged frame.
+
+For offline recovery, read `renderer.inspect().renderScene.gpuDriven.channels`.
+A blocked channel carries one bounded `failure` projection with the same
+closed `code`, `detail.owner`, `detail.reason`, and `detail.recovery` that the
+renderer error stream emits. Repair that owner, recook or republish its
+producer artifact, and retry the identical frame; `hint` is explanatory text,
+not a value to parse. A blocked capable candidate is not permission to issue a
+duplicate CPU draw.
+
 ## GPU-driven view kernel
 
 `BatchTopology` groups eligible rigid draw items by immutable geometry,
@@ -1012,41 +1438,53 @@ non-indexed five-word indirect command. A per-view typed graph records
 `reset -> frustum/compact -> finalize` over persistent candidate and batch
 buffers. The compute path validates generation and active flags, composes the
 primitive world transform with each ordinary instance-local transform, writes a
-compact `(instanceIndex, materialIndex)` stream, sets explicit overflow flags,
-and emits indirect arguments with `firstInstance = 0`.
-
-The Standard frame activates the production raster lane when compute, storage
-buffers, and indirect drawing are available. The current lane accepts opaque,
-rigid default-unlit triangle-list passes with batch-stable render state,
-ordinary instances, indexed or non-indexed geometry, multiple submeshes and
-material slots, and the canonical `12F` vertex layout. It also accepts persistent rigid multi-World
-composition. Candidates come from the complete persistent projection rather
-than the CPU-visible snapshot. The same typed graph imports the scene and mesh
-buffers, runs the three compute passes, and consumes generated arguments with
-`drawIndexedIndirect` or `drawIndirect`. Entities accepted by that lane are not
-also validated, uploaded, or recorded by the CPU forward loop on a stable
-frame.
-
-clustered, PBR and custom shader variants, texture/sampler/video resource bindings,
-transparent meshes, skinning, morphing, non-canonical layouts, and shadow views
-keep explicit CPU or specialized lanes. WebGL2 selects capability fallback from
-the same persistent projection; it does not emulate compute. Visibility and
-hierarchy changes, non-rigid multi-World composition, and some prepared-resource
-changes still require bounded reconcile work. The implemented lane proves a
-zero-upload stable data path and broad rigid geometry coverage, but hardware
-100k timing, schema-derived material variants, stable world identities, and
-GPU-driven shadows remain required before declaring P3 complete.
-
-The bounded inspection reports topology revision, candidates, batches, visible
-capacity, buffer capacities, update count, upload bytes, rebuild count, and CPU
-fallback rows. RhiNull verifies graph dependency order and stable-frame zero
-work; Dawn and Chromium verification consume indexed, non-indexed,
-multi-submesh, and instanced arguments, read persistent scene tables in the
-vertex path, and compare the resulting pixel. The renderer-level RhiNull
-integration also proves that the built-in Standard graph contains the compute chain
-before `main`, including rigid multi-World composition, without GPU plus CPU
-duplicate draws. The renderer retains one graph, one compile owner, one
-encoder, and one submit route.
+compact `(meshProjectionRow, materialOrPaletteRow)` stream, sets explicit
+overflow flags, and emits indirect arguments with `firstInstance = 0`. The low
+bit of the candidate admission word controls submission; its upper bits carry
+the batch-local projected mesh row. Rigid rows address the generated material
+table, while skin rows address the persistent palette through
+`Instance.customDataStart`.
+
+The Standard frame activates the production raster lane only when compute,
+storage buffers, indirect drawing, and producer-owned Standard PBR artifacts
+are all ready. It covers opaque and Alpha Mask rigid/skin candidates whose
+geometry, resource class, reflection, palette address, and (for skin) finite
+producer-authored bounds satisfy the prepared contract. Main and directional,
+spot, or point shadow views consume the same scene and topology, but keep
+view-local visibility and projection bindings. Ownership is per draw item and
+view pass, so one draw can be GPU-owned in the main/shadow channels while an
+unrelated semantic pass remains CPU-owned.
+
+Transparent/blend, transmission, morph, custom or unsupported prepared
+variants, and skin without a producer-authored conservative bound stay on an
+explicit CPU semantic or CPU deformation lane. WebGL2 selects capability
+fallback from the same persistent projection; it does not emulate compute.
+Missing capable-path artifacts and failed resource publication are structured
+errors that block graph promotion rather than silently drawing the same item a
+second time through CPU semantics.
+
+> [!WARNING]
+> A GPU selector overflow is fail-closed: `finalize` emits zero indirect
+> instances for the affected batch and inspection reports `overflow=true`.
+> The last-known-good resource generation remains authoritative until the
+> producer can rebuild with sufficient capacity. Missing skin bounds are also
+> intentionally conservative: they remain CPU deformation work; bind-pose
+> bounds are never invented as animation bounds.
+
+The bounded `gpuDriven.channels` inspection reports the selected lane and
+closed reason for each view pass. Blocked promotion additionally exposes the
+producer-owned `failure` (`code`, `expected`, `hint`, and typed `detail`) so an
+AI caller can branch on owner/recovery without decoding an error string. The
+same `GpuDrivenPreparationError` is delivered through the renderer error
+stream. The inspection also reports topology revision, candidates,
+batches, visible capacity, buffer capacities, update count, upload bytes,
+rebuild count, overflow, retry count, and last-known-good generation. RhiNull
+verifies graph dependency order and stable-frame zero work; local Dawn verifies
+the command, binding, palette, shadow-view, and readback contracts. The
+renderer-level integration also proves that the built-in Standard graph
+contains the compute chain before `main`, with no GPU plus CPU duplicate draws.
+The renderer retains one graph, one compile owner, one encoder, and one submit
+route.
 
 > [!NOTE]
 > Non-rigid multi-World composition, skinned lanes, visibility/hierarchy
@@ -1056,6 +1494,28 @@ encoder, and one submit route.
 > semantics; later coverage can make those changes entity-local without adding
 > another scene authority.
 
+### Offline inspect → repair owner → retry
+
+Use the detached channel to identify the next owner without opening a browser
+or reading live GPU objects:
+
+```mermaid
+flowchart LR
+  A["inspect gpuDriven.channels"] --> B{"lane / reason"}
+  B -->|"gpu / none"| C["record the same graph"]
+  B -->|"blocked / resource-not-ready"| D["repair failure.detail.owner"]
+  D --> E["recook or publish the receipt"]
+  E --> F["retry the identical frame request"]
+```
+
+The three public navigation entries are [`shader`](../shader/README.md#gpu-driven-pbr--shadow--skin-navigation),
+[`runtime`](../runtime/README.md#gpu-driven-pbr--shadow--skin-navigation), and
+this render owner. The two executable carriers are
+[`hello-skin`](../../apps/hello/skin/README.md#gpu-driven-skin-carrier) and
+[`hello-fbx-skin`](../../apps/hello/fbx-skin/README.md#gpu-driven-fbx-carrier).
+Their Dawn smoke commands remain independent evidence; RhiNull proves graph
+ownership and deterministic lane facts only.
+
 Features are supplied through the construction options (`features: [...]`) and
 enter the same host-owned extract → plan → graph projection path. The public
 `Renderer` intentionally has no install/uninstall methods: optional capability
@@ -1163,6 +1623,34 @@ targets, and draw/dispatch commands. Graph buffer and texture access is derived
 from those roles; producers never author a second `reads`/`writes` ledger and
 never receive an encoder or submit authority.
 
+Prepared material-input layouts accept `particleInputLanes` from 1 through 4
+(omission selects the canonical one-lane layout). The count is valid only for a
+material-input vertex layout. Render derives its instance stride and attributes
+from the base layout and uses the same complete multi-stream descriptor in the
+PipelineSpec cache identity. Invalid counts fail during resource preparation.
+
+A prepared pipeline with empty `colorFormats` uses the depth-only route and
+preserves its declared `depthFormat`, depth state and complete vertex streams.
+A vertex-only shader needs no fragment entry. For a vertex-index-generated draw,
+declare `vertexLayout: 'none'` on the draw and supply the prepared empty group
+when the shader has no resources. This is depth-target rendering, not automatic
+registration as a Standard light-view shadow caster.
+
+For light-view participation, declare a `shadow-caster` plan pass with the same
+draw vocabulary and a depth32float, zero-color graphics program. Standard owns
+the light-view binding, atlas, viewport and pass replication; the feature owns
+only geometry and instance inputs. It reuses the normal prepared draw encoder
+and the same graph buffer imports. Active GPU casters disable static directional
+atlas reuse because ECS mesh epochs do not describe GPU buffer contents.
+
+The graph projects a feature's leading compute prefix before shadow views until
+the first scene-target dependency or ordinary raster. Remaining work stays at
+the normal scene contribution boundary. A caster whose projection is late reads
+the prior submitted instance data (initially empty); it must not be described as
+current-frame simulation. Owner-local pipeline implementations use
+`contributeShadowFeatures` with `addTypedShadowPasses`; graph construction and
+these helpers are not added to the public Render root.
+
 ### Five render terms
 
 | Term | Meaning | Owner |
@@ -1355,6 +1843,236 @@ sibling-loop report or an authored manifest. Read identity, generation, evidence
 level, and closed failure fields before following the named owner recovery action.
 Submit the same consumer request and reinspect after recovery. The route returns
 detached facts only: no live GPU handle, second owner, or second ledger is exposed.
-Missing or mismatched receipts remain
-`fallback-only` with zero SSR work; SSR v1, Hi-Z, ray marching, temporal resolve,
-compose, and history are out of scope.
+Missing or mismatched receipts remain `fallback-only` with zero SSR work. The
+current renderer may expose admitted structural Hi-Z, trace, temporal, compose,
+and history facts, but no single backend snapshot or non-black canvas is an SSR
+v1 acceptance result; use paired Browser/Dawn readback and the closed-loop gates
+before promoting that status.
+
+The canonical paired carrier is `apps/hello/ssr`. It runs the same fixture at
+`http://127.0.0.1:4173/?forgeax-evidence=ssr` and
+`dawn://hello/ssr?forgeax-evidence=ssr`, records 300-frame identity-bound
+readbacks, and keeps visual rows in the form `observed` / `verdict` /
+`confidence`. Its performance lane derives the 1920x1080 descriptor and checks
+it against `estimateSsrSpatialMemory`; timestamp or paired-lane absence remains
+blocked.
+
+## Standard dynamic MeshAsset candidates
+
+The Renderer owns one bounded candidate lifecycle for geometry produced by an
+external consumer. The payload is the existing `MeshAsset` contract, not a
+voxel-specific asset kind. The consumer remains the World shared-reference
+owner and publishes `MeshFilter` / `MeshRenderer` through the ordinary ECS
+write barrier; the Renderer owns GPU residency, device generation, frame
+receipt, and delayed retirement.
+
+```ts
+import type { MeshAsset } from '@forgeax/engine-types';
+import { FixedTime, type World } from '@forgeax/engine-ecs';
+import { Transform } from '@forgeax/engine-scene';
+import { MeshFilter, MeshRenderer } from '@forgeax/engine-render';
+import type { FrameCamera, FrameEnvironment, Renderer } from '@forgeax/engine-render';
+
+declare const renderer: Renderer;
+declare const world: World;
+declare const mesh: MeshAsset;
+declare const camera: FrameCamera;
+declare const environment: FrameEnvironment;
+
+// Attach first: the Renderer owns the lease/generation boundary, while the
+// World remains the MeshAsset handle and ECS scene owner.
+const attached = renderer.attach(world);
+if (!attached.ok) throw attached.error;
+const meshHandle = world.allocSharedRef('MeshAsset', mesh);
+const entity = world
+  .spawn(
+    { component: Transform, data: {} },
+    { component: MeshFilter, data: { assetHandle: meshHandle } },
+    { component: MeshRenderer, data: { materials: [] } },
+  )
+  .unwrap();
+const fixedStep = world.getResource(FixedTime).tick;
+const prepared = renderer.prepareDynamicGeometry({
+  world,
+  entity,
+  mesh,
+  meshHandle,
+  // Must match a live material handle/source slot; this mesh uses its default.
+  materialIdentity: 'default',
+  revision: 4,
+  topologyRevision: 2,
+  // For paired physics use the admission example below, not this draw-only path.
+});
+if (!prepared.ok) {
+  // Branch on prepared.error.code; the previous visible mesh is retained.
+} else {
+  // ECS FixedTime is the ordering proof for this render-only revision.
+  const accepted = renderer.acceptDynamicGeometry(prepared.value, {
+    world,
+    fixedStep,
+  });
+  if (accepted.ok) {
+    const frame = renderer.draw({
+      leases: [attached.value],
+      camera,
+      environment,
+      fixedStep,
+    });
+    if (frame.ok) {
+      const geometryReceipt = renderer.dynamicGeometryReceipt(accepted.value);
+      // geometryReceipt.frame.frameId === frame.value.frameId for this
+      // generation; geometryReceipt.frame.completed fences GPU retirement.
+      void geometryReceipt;
+    }
+  }
+}
+```
+
+The entity must already carry `Transform`, a live `MeshFilter`, and a
+`MeshRenderer` when the candidate is prepared and accepted; these are the same
+ECS prerequisites used by the render extraction query. Preparation records the
+old `MeshFilter.assetHandle` and stages the new standard handle without changing
+the visible ECS binding. Acceptance is the one ECS write-barrier that swaps in
+the candidate. If acceptance or GPU preparation fails, the old binding remains;
+cancelling an accepted candidate swaps that old handle back, and refuses to
+overwrite a newer external binding. The Renderer host reads
+`World.FixedTime.tick` itself; a caller-supplied `{ world, fixedStep }` object
+cannot bind an unrelated World or step. Preparation may precede acceptance by
+multiple fixed steps; acceptance records the actual current tick. If
+`physicsEntity` is supplied, acceptance requires that entity's active paired
+`PhysicsWorld` admission to match the revision and current step. An already
+published physics result is deliberately insufficient: it cannot roll back if
+geometry now fails. A
+candidate that is not present in the ECS render snapshot at the successful draw
+is left accepted without a receipt; the receipt is issued only after the
+submitted record stage consumed the live binding.
+
+### Paired physics admission
+
+Prepare both domain candidates invisibly, with matching revision and the geometry
+candidate's `physicsEntity` naming the physical parent. Queue the physical candidate
+with one synchronous geometry commit. The existing Physics fixed-step owner runs it
+after native staging and before step/writeback/publication; no second clock or queue
+is created. A refused geometry commit restores the old native state. Physics queries,
+mutations and Renderer draw are refused during this borrowed admission interval.
+
+```ts
+import { err, ok } from '@forgeax/engine-types';
+import { FixedTime } from '@forgeax/engine-ecs';
+
+physics.admitDerivedShapeCandidate(physicsCandidate, () => {
+  const admitted = renderer.acceptDynamicGeometry(geometryCandidate, {
+    world,
+    fixedStep: world.getResource(FixedTime).tick,
+  });
+  if (!admitted.ok) return err(admitted.error);
+  acceptedGeometry = admitted.value;
+  return ok(undefined);
+}).unwrap();
+// Normal World FixedUpdate performs admission, physics step and writeback.
+// After World.update succeeds, inspect Physics publication/failure and draw.
+```
+
+The commit must return immediately after its complete binding change, without
+additional fallible work. On physical preparation/native failure it is not called;
+cancel the still-prepared geometry using its normal owner. On a refused commit,
+inspect `getDerivedFailure` and cancel that prepared geometry. Success publication
+remains after physics writeback and the real Renderer submission, not callback return.
+
+`meshHandle` is mandatory on the public Renderer path. The pure
+`createDynamicGeometryLifecycle` helper may omit it for CPU-only validation, in
+which case `gpuReady` is false and no Renderer receipt can be produced. The
+attached Renderer uses the existing `GpuResidencyCache.ensureResident` path
+before acceptance; its failure is `dynamic-geometry-gpu-failed`, while a
+missing handle is the distinct `dynamic-geometry-gpu-not-ready` error. The
+handle is never minted by the Renderer and no RHI buffer or queue escapes the
+host. A supplied `materialIdentity` must match a live MeshRenderer slot or the
+MeshAsset material-slot source key; otherwise the host returns structured
+`dynamic-geometry-invalid`. The normal draw path consumes the accepted standard
+handle from `MeshFilter`, so main, depth, shadow, and motion/history share one
+committed geometry identity. The lifecycle also bounds aggregate typed-geometry
+bytes (`inspect().meshBytes` / `maxMeshBytes`) in addition to candidate count.
+
+```mermaid
+stateDiagram-v2
+  [*] --> prepared: prepare
+  prepared --> accepted: accept
+  prepared --> cancelled: cancel / generation loss
+  accepted --> published: successful draw FrameReceipt
+  published --> retired: receipt-safe retirement
+  accepted --> cancelled: detach / World teardown
+```
+
+`DynamicGeometryCandidate` is a short-lived credential bound to the attached
+World object, live ECS entity, lifecycle owner identity, candidate revision,
+copied MeshAsset, material identity, and active device generation. A Renderer
+acceptance records the attached World's `FixedTime` ordering and performs the
+binding swap; a candidate with `physicsEntity` also records that entity's
+PhysicsWorld admission step. A frame publishes only candidates for the
+drawn lease Worlds whose candidate step is no newer than the actual World
+`FixedTime.tick`, and whose PhysicsWorld publication has the exact candidate
+revision. The optional frame `fixedStep` is checked against that World tick; it
+is an assertion, not a second clock. Thus a multi-fixed-step host frame can
+issue one receipt for the latest submitted frame without dropping an accepted
+candidate, while a successful draw for another World cannot publish an
+arbitrary credential. The public attached-Renderer receipt carries
+`recordStageConsumed: true` and the embedded `frame.completed` fence, making it
+a real record/submit proof, not a non-empty handle or counter. The detached
+`createDynamicGeometryLifecycle` helper may intentionally publish a CPU-only
+receipt with `recordStageConsumed: false`; that helper is not a Renderer draw
+path and must not be used as GPU evidence.
+
+`dynamicGeometryReceipt(candidate)` is present only after the accepted candidate
+is published by a successful `FrameReceipt`; it carries the same `frameId`,
+`deviceGeneration`, preparation fixed step, and actual publication fixed step.
+A topology revision invalidates lower-revision prepared/accepted candidates for the same entity and
+marks older published history invalid, but retains each published receipt's
+completion fence; an already-published credential remains until an explicit
+retire can release its GPU owner after that fence resolves. Each later
+record-stage consumption emits a refreshed receipt and adds its
+`FrameReceipt.frame.completed` fence, so retirement waits for every observed
+in-flight frame (resolved or rejected), not only the latest receipt. The
+attached host revalidates the live `(World, entity, MeshFilter)` binding for
+each candidate, so a topology change on entity B does not suppress a real
+record-stage use of still-live entity A; only the candidate/entity whose
+binding changed is refused.
+The shared `GpuResidencyCache` owns allocation leases and submission fences.
+A lease captures the concrete GPU allocation, not a reusable World handle slot;
+cancelling B cannot invalidate a resource still used by A. Every submitted
+frame conservatively fences all resident meshes, including ordinary, shadow-only
+and cached GPU-driven uses, independently of publication or history validity.
+In-place mesh invalidation immediately allows a new upload while old submitted
+buffers retire behind their own completion. An accepted topology change resets
+the existing temporal history owner before the next draw. The candidate's World
+reference is also retained through completion so its handle slot cannot be reused.
+The detached inspection reports both history invalidation and concrete
+candidate invalidation. Stale revisions, cross-World/lifecycle candidates, old
+generations, invalid GPU readiness, invalid ordering, duplicate acceptance,
+unknown retirement, and bounded in-flight count/byte overflow are structured
+`DynamicGeometryError` results. Cancelling or invalidating work leaves the last
+published candidate untouched, cleans candidate-only residency when no other
+ECS entity or candidate shares the handle, and never releases a caller-owned
+shared reference. Call `retireDynamicGeometry` only after the receipt-bound
+consumer no longer needs the old geometry, then release the World shared
+reference through its normal owner. Retirement is a logical state transition
+first: the attached host keeps the candidate count and typed mesh bytes in the
+bounded budget until all receipt fences resolve and the candidate's shared GPU
+lease is released. If the candidate is still the live `MeshFilter`, retirement
+returns `dynamic-geometry-invalid` without deleting its receipt or GPU owner;
+swap the binding through ECS first so the completion fence can safely retire it.
+The pure lifecycle exposes `finalizeRetirement` for its owner to release that
+deferred count/byte reservation after cleanup.
+
+This seam intentionally does not add a second asset registry, Pack kind,
+RenderFeature, worker, or frame clock. Asset ownership is SSOT: the producer
+owns sourceKey/GUID and Cooked Pack payloads, Catalog is only the projection,
+the runtime `AssetRegistry` resolves GUIDs, and the World owns the shared
+`MeshAsset` handle. `world.allocSharedRef` is the only handle creation in this
+example; Renderer never registers or mints an asset. Provider/Catalog/GUID cold
+loading therefore continues through the existing route; a producer that needs
+a custom voxel artifact owns that schema and loader outside the Engine, while
+its projected standard mesh enters this candidate path.
+
+### Targeted spatial inspection
+
+`renderer.bounds(world, entity)` returns a detached world-space AABB from the last extracted composition, including the existing instance-bound projection. It returns `undefined` for an absent World/entity or unknown/invalid producer bounds. This is renderer geometry evidence, not collision geometry or a synchronous update of authored World changes. A subsequent draw refreshes the projection; callers must not substitute an origin for an unavailable mesh bound. The query reuses culling ownership and retains no additional bounds cache.