@woosh/meep-engine 2.168.0 → 2.169.0

package/src/REVIEW_2026_08_06/adv-gfx.md

@@ -0,0 +1,480 @@
+# Adversarial verification — gfx-texture / engine-ecs / gfx-gi / engine-asset / gfx-render / geom-3d
+
+Method: every CRITICAL re-checked, plus every MAJOR whose claim was "never works" / "always throws" /
+"is never called" / "is always wrong". Where the module runs in node, findings were reproduced by
+executing throwaway jest specs (`H:/git/moh` + `jest.conf.json`); those specs have been deleted.
+GPU/shader claims were checked against the installed `H:/git/moh/node_modules/three` (r136) sources,
+not from memory.
+
+Pre-confirmed by the lead reviewer and NOT re-checked: `GFXR-11`, `GEOM3-1`, `ASSET-4`.
+
+---
+
+## gfx-texture
+
+### GFXT-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `sampler2d_paint.js:68` reads `Math.round(x + sourceY)`. Executed: 4x1 RGBA source with
+  red = 10/20/30/40 per column, `sampler2d_paint(dst, src, /*sourceX*/2, /*sourceY*/0, 0,0, 1,1)`
+  wrote `[10,0,0,255]` — column 0, not column 2.
+
+### GFXT-2
+- **Verdict**: CONFIRMED
+- **Evidence**: `Sampler2D.js` defines `read(x,y,result)` at :499 and `write(x,y,texel)` at :518; there is no
+  `set` member (`grep '\bset\b'` yields only `result.set(x,y)` and `newData.set(...)` call sites).
+  Executed: `typeof Sampler2D.uint8(4,8,8).set === 'undefined'`, and `bitSet2Sampler2D` throws.
+
+### GFXT-3
+- **Verdict**: CONFIRMED
+- **Evidence**: forward/backward passes read `const v = getD(x,y)` once and compare all four candidates
+  against that stale value. Executed on a 4x3 source with a single differing pixel at (1,0):
+  cell (3,1) came out `2` where the correct chamfer value is `1.414` (the `v0 = 0 + d2` write is
+  overwritten by the later `v1 = 1 + d1` and `v3 = 1 + d1` writes). Cell (0,2) came out `2.414`
+  where the correct value is `1.414`.
+
+### GFXT-4
+- **Verdict**: CONFIRMED
+- **Evidence**: `sampler2d_ensure_uint8_RGBA` returns `input` unchanged for itemSize 4 + Uint8Array
+  (`:10-15`), and `data_texture_to_sampler`'s dimension check compares against `_width/_height`
+  that default to the image's own dimensions. Executed with a 2x2 RGBA8 `DataTexture`:
+  before `[1,1,1,255, 2,2,2,255, 3,3,3,255, 4,4,4,255]`, after `convertTexture2Sampler2D(tex)` the
+  **texture's own** `image.data` was `[3,3,3,255, 4,4,4,255, 1,1,1,255, 2,2,2,255]` — rows swapped in place.
+
+### GFXT-23
+- **Verdict**: CONFIRMED
+- **Evidence**: `TextureAtlas.js:362` is literally `patch.clearFlag(AtlasPatchFlag.Packed | AtlasPatchFlag.Packed)`.
+  `AtlasPatchFlag` has `Packed: 1, Painted: 2, Attached: 4` — distinct values, so `Painted` survives.
+  `paint()` (`:497`) only repaints on `!Painted || last_painted_version !== sampler.version`; `pack()`
+  (`:470-477`) re-places and calls `updatePositionFromPacking` without erasing or marking for repaint.
+  The `remove()` path two blocks above clears `Attached | Packed | Painted` correctly, confirming the typo.
+
+### GFXT-24
+- **Verdict**: CONFIRMED
+- **Evidence**: `AtlasLookupTexture.js:58` gates only on `image.height < expected_row_count`. Executed with
+  10 patches: after `update()` the texture image was still `width 1, height 1, data.length 4`. Writes for
+  patches 1..9 land at indices 4..39 on a 4-element `Uint16Array` and are silently dropped.
+
+### GFXT-25
+- **Verdict**: CONFIRMED
+- **Evidence**: `WebGLTextureAtlas.add()` (`:93-108`) only accumulates `__total_area`; it never writes
+  `patch.packing` or `patch.size`. `AtlasPatch` defaults are `position = Vector2(0,0)`, `size = Vector2(0,0)`,
+  `packing = new AABB2()` (zero extent). `layout()` (`:110-147`) packs those zero-area boxes and never calls
+  `updatePositionFromPacking`, so `patch.position` stays `(0,0)` and `build()` copies every source to the
+  origin. `power = Math.ceil(Math.log2(this.__total_area))` treats an area as a side length (`:112`).
+  `build()` also indexes `this.__sources[i]` while `add()` stores at `this.__sources[id]`.
+
+### GFXT-32
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MAJOR
+- **Evidence**: `BILLBOARD_PARTICLE_SPECIFICATION.js:23` really does register `color` with `itemSize: 1`
+  while `ParticleBillboardMaterial.js:123` declares `attribute vec4 color;`. Both consequences follow.
+- **Reason** (downgrade, ground 5 — blast radius): the *shader* is the production shader
+  (`ShaderManager.buildMaterial:253`), but the production **pool** is built from
+  `PARTICULAR_PARTICLE_SPECIFICATION` (itemSize 4, correct). The only consumer of the broken spec in the
+  whole tree is `renderers/billboard/prototypeBillboardRenderer.js`, which is out of review scope by the
+  repo's own `prototype*.js` convention. No shipping render path is affected; this is a broken
+  public-surface export, not a live rendering defect.
+
+### GFXT-40
+- **Verdict**: CONFIRMED
+- **Evidence**: `computeMeshSurfaceArea.js:40` is `const y2 = points[c3 + 2];`. Executed with the triangle
+  `A=(0,0,0) B=(1,0,0) C=(0,1,0)` (true area 0.5) — the function returned `0`.
+
+### GFXT-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `sampler2d_combine.js:52` — the input1 read loop is `for (j = 0; j < itemSize0; j++)`
+  while indexing `data1[j + i * itemSize1]`. `itemSize1` is computed at :34 and never used for reads.
+
+### GFXT-6
+- **Verdict**: CONFIRMED
+- **Evidence**: `sampler2d_compute_texel_value_conversion_scale_to_uint8.js:44` is
+  `max = max2(min, sampler2d_channel_compute_max(sampler, i).value)` — `min`, not `max`.
+
+### GFXT-7
+- **Verdict**: CONFIRMED
+- **Evidence**: producer returns `offset = min` (`:51`); consumer `sampler2d_to_html_canvas.js:61,81`
+  computes `(source_value + offset) * scale`. Executed on `Float32` `[10,11,12,13]`: producer returned
+  `{scale: 85, offset: 10}` → texel 0 maps to `(10+10)*85 = 1700`, saturating to 255 (correct: 0).
+  `sampler2d_to_data_url.js:16-18` composes exactly these two.
+
+### GFXT-10
+- **Verdict**: CONFIRMED
+- **Evidence**: `Sampler2DSerializationAdapter.js:26` is `if (value.data instanceof Uint8Array)`, else
+  `throw new TypeError('Unsupported data type')`. `Uint8ClampedArray` is not an `instanceof Uint8Array`
+  (separate constructor, both descend from `%TypedArray%`). `deserialize` always allocates `Uint8Array`,
+  so a clamped sampler cannot round-trip.
+
+### GFXT-17
+- **Verdict**: CONFIRMED
+- **Evidence**: executed `cubic2(0, 0, 1) === 24` (must be 1) and `cubic2(1.5, 0, 1) === 1059`
+  (must be -0.125); `cubic2.support === undefined`, so
+  `sampler2d_scale_down_generic(..., cubic2)` computes `ceil(ratio * undefined / 2) = NaN`.
+
+### GFXT-26
+- **Verdict**: CONFIRMED
+- **Evidence**: `AtlasLookupTexture.js:27-32` sets `format = RGBAIntegerFormat` (→ GL `RGBA_INTEGER`),
+  `type = UnsignedShortType`, `internalFormat = 'RGB16UI'`. three r136 `WebGLTextures` resolves a string
+  `internalFormat` straight to `_gl[name]`, so the upload is
+  `texImage2D(…, RGB16UI, …, RGBA_INTEGER, UNSIGNED_SHORT, data)`. GLES 3.0 table 3.2 pairs `RGB16UI`
+  only with `RGB_INTEGER`; the combination is `INVALID_OPERATION`. (Not executed — no GL context.)
+
+### GFXT-30
+- **Verdict**: CONFIRMED
+- **Evidence**: read `sampler2d_copy_with_margins.js`. `sItemSize` is bound at :29 and used only for
+  `_itemSize` and `sRowSize`; every source column offset is `… * dItemSize`
+  (`sOffset = sourceY * sRowSize + sourceX * dItemSize` at :45, `sOffset = sA + (x + sourceX) * dItemSize`
+  at :66, and the same shape at the other cited lines). `_itemSize = Math.min(dItemSize, sItemSize)`
+  proves differing channel counts are an intended input.
+
+### GFXT-33
+- **Verdict**: CONFIRMED
+- **Evidence**: `ParticularEngine.js:155-167` — `const step = steps[type]` is one shared object per
+  `SimulationStepType`, and `step.layer_parameters[j] = stepDefinition.parameters` overwrites on a second
+  definition of the same type for the same layer `j`. The execution loop at :171+ walks `steps` by index
+  (enum order), not authored order.
+
+### GFXT-34
+- **Verdict**: CONFIRMED
+- **Evidence**: `core/math/lookup/ParameterLookupTable.js:110` — `Math.log2(itemCount)` used as a bit width;
+  `log2(256) === 8 <= 8` selects the 1-byte class and `writeUint8(256)` wraps to 0, while 768+256 floats are
+  still written. The `@deprecated` tag does **not** rescue it: `ParameterLookupTableSerializationAdapter.js:17,26`
+  is the live adapter and calls `toBinaryBuffer`/`fromBinaryBuffer` directly.
+
+### GFXT-35
+- **Verdict**: CONFIRMED
+- **Evidence**: `addValue` (`:303-340`) ends at the `Array.prototype.splice.apply(this.data, …)` with no
+  `computeStatistics()`; `write()` (`:298`) calls it.
+
+### GFXT-36
+- **Verdict**: CONFIRMED
+- **Evidence**: `distrubuteParticlesOnMesh.js:157-159` — `const r0 = random(); const r1 = random() * (1 - r0);`
+  under a comment citing the triangle-point-picking reference (which describes the reflect method).
+  Joint density ∝ 1/(1−r0), not uniform.
+
+### GFXT-37
+- **Verdict**: CONFIRMED
+- **Evidence**: `ParticleVolume.js:353-359` — the `attribute_object === undefined` branch contains only the
+  `console.warn`; execution falls through to `attribute_object.fromJSON(attribute_json)`.
+
+### GFXT-41
+- **Verdict**: CONFIRMED
+- **Evidence**: `bvh32_geometry_raycast.js:124` sets `hit_found = true;` immediately after
+  `if (!triangle_hit_found) continue;`, i.e. before the `if (distance_sqr < best_distance_sqr)` block that
+  is the only writer of `result`.
+
+### GFXT-42
+- **Verdict**: CONFIRMED
+- **Evidence**: executed — `decode_attribute_value(255, BinaryDataType.Uint8, true)`,
+  `(127, Int8, true)` and `(32767, Int16, true)` all throw; the `Uint16` control returns ~1.0.
+
+### GFXT-43
+- **Verdict**: CONFIRMED
+- **Evidence**: `computeSkinnedMeshVertices.js:24-26` reads `attributes.position.array` /
+  `skinIndex.array` / `skinWeight.array` raw and hands them to `mesh_apply_skeletal_vertex_skinning`,
+  which indexes at a hard-coded stride of 3 (`index*3`) and 4 (`index*bones_per_vertex + i`) with no
+  offset/stride/normalized handling. In three r136 `InterleavedBufferAttribute.array` is a getter for
+  `this.data.array` (the whole interleaved buffer).
+
+### GFXT-44
+- **Verdict**: CONFIRMED
+- **Evidence**: `computeGeometryBoundingSphereMiniball.js:10` is
+  `const vertexData = geometry.attributes.position.array;` fed straight into
+  `computeBoundingSphereFromVertexData`; no deinterleave, no denormalize, no use of `attribute.count`.
+
+### GFXT-45
+- **Verdict**: CONFIRMED
+- **Evidence**: `geometry_compute_vertex_normals_indexed.js:28-37` accumulates the output of
+  `geometry_construct_triangle_normal`, which is a thin wrapper delegating straight to
+  `tri3_compute_normal` — whose `(0,1,0)` degenerate sentinel is already confirmed (GEOM3-1). The
+  accumulation is a full-magnitude unit vector, so a collapsed triangle contributes a fabricated +Y.
+
+### GFXT-46
+- **Verdict**: CONFIRMED
+- **Corrected severity**: (unchanged, MAJOR) — confidence upgraded from "Likely" to Confirmed
+- **Evidence**: `mesh_apply_skeletal_vertex_skinning` applies `bindMatrix`, then the world bone matrices
+  (`bone.matrixWorld · boneInverse`, built in `computeSkinnedMeshVertices:39`), then `bindMatrixInverse` —
+  exactly three's `skinning_vertex` chunk, i.e. mesh-local `transformed`. `meshFromSkinnedMesh.js:25-36`
+  then copies `position/rotation/scale` onto the new `Mesh` **and** bakes `inverse(matrixWorld)` into the
+  positions, so the source transform is applied once forward and once inverted.
+
+---
+
+## engine-ecs
+
+### ECS-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `Entity.js:508-525` sets `EntityFlags.Built` and binds the reference but registers no
+  `EventType.EntityRemoved` listener, unlike `build()` at :487-489. Reproduced verbatim: id 0 removed,
+  `createEntity()` recycled id 0, `e.isBuilt === true`, `e.add(new B())` wrote B onto the recycled entity,
+  and `e.destroy()` destroyed it (`entityExists(0) === false`).
+
+### ECS-14
+- **Verdict**: CONFIRMED
+- **Evidence**: `TerrainTileManager.js:462,471` — the point is packed `Float32Array.of(x, 0, y)` (top-down Y
+  at index 2) and then passed as `this.getRawTileByPosition(v3[0], v3[1])`. With an identity transform
+  `v3[1]` is the literal `0`, so `getRawTileByPosition` computes `tileY = floor(0 / tileSize.y) = 0` for
+  every input. `getRawTileByPosition` also divides by `tileSize` (grid units) without dividing out
+  `this.scale`, as claimed.
+
+### ECS-40
+- **Verdict**: CONFIRMED
+- **Evidence**: `LineSetDescription.js:56` reads `const sets = this.sets;` inside the loop over the popped
+  `set`. Reproduced with `R{lines:[l-root], sets:[C]}`, `C{lines:[l-child]}` behind a write-count guard:
+  output was `l-root, l-child, l-child, l-child, …` until the 500-element guard tripped.
+
+### ECS-9
+- **Verdict**: CONFIRMED
+- **Evidence**: `FogOfWarSystem.js:162-215` registers three anonymous `function (renderer, camera, scene)`
+  closures on `graphics.on.preRender` / `.buffersRendered` / `.postRender`; `shutdown` (`:217-219`) is a
+  one-liner that only removes `this.compositLayer`. No reference to the closures is retained anywhere.
+
+### ECS-15
+- **Verdict**: CONFIRMED
+- **Evidence**: `TerrainSystem.js:265-290` — `let tile_count = 0;` is passed as the `result_offset` on every
+  frustum iteration and never advanced, while `found_tiles += bvh_query_user_data_intersects_frustum(...)`
+  accumulates; the consumer loop runs `for (i = 0; i < found_tiles; i++)`.
+
+### ECS-16
+- **Verdict**: CONFIRMED
+- **Evidence**: `TerrainOverlay.js:321` passes `this` (the `TerrainOverlay`) as the destination sampler.
+  `TerrainOverlay` has no `width`/`height` fields (pixel data lives on `this.sampler`), so
+  `sampler2d_paint`'s `_w = Math.min(width, source.width - 0, undefined - dx)` and `_h` are both `NaN`
+  and both loops (`for (y = _y0; y < _h; …)`) execute zero iterations. Silent no-op, `needsUpdate` still set.
+
+### ECS-21
+- **Verdict**: CONFIRMED-BUT-DOWNGRADED
+- **Corrected severity**: MINOR
+- **Evidence**: `HeightSampler2NormalSamplerSoft.js:54-56` writes `_x = dX / magnitude`, `_y = dY / magnitude`
+  with no negation. For `h(x,y) = x` this yields `(+0.998, 0, +0.0624)` where the geometric surface normal
+  is `(-0.998, 0, +0.0624)`.
+- **Reason** (ground 5): the maths is as described, but this is a `convertHeightMap2NormalMap` **texture**
+  producer with no in-repo consumer, and the sign of both tangent axes in a height→normal bake is a
+  well-known convention split (OpenGL vs DirectX green, and u/v handedness). Calling it "MAJOR / always
+  wrong" over-states it; the same file's `z = 0.5 / magnitude` "strength" choice is equally
+  convention-driven. Real, worth fixing, but not a MAJOR correctness defect on any live path.
+
+### ECS-26
+- **Verdict**: CONFIRMED
+- **Evidence**: `AnimationOptimizer.js:111-112` assigns `this.times` / `this.values` on the optimizer.
+  Executed on a `VectorKeyframeTrack` with 5 keys (3 redundant): after `optimize(clip)` the track still had
+  `times.length === 5` (`[0,1,2,3,4]`) while `optimizer.times` held the compacted `[0,1,3,4]`.
+
+### ECS-28
+- **Verdict**: CONFIRMED
+- **Evidence**: `DynamicRuleDescription.js:55` is `return this.id.equals(other.id);` and `id` is a primitive
+  string field. Executed: `a.equals(b)` throws `TypeError: this.id.equals is not a function`.
+
+### ECS-31
+- **Verdict**: CONFIRMED
+- **Evidence**: `PointFitnessGaussianBlur.from` (`:38-53`) consumes `quality` only to compute
+  `samples_x/y/z`; there is no `r.quality = …` and no `quality` class field.
+  `serializeToJSON_PointFitnessFunction.js:61` writes `quality: value.quality` (→ `undefined`, dropped by
+  `JSON.stringify`), and `deserializeFromJSON_PointFitnessFunction.js:45,51` destructures it with no
+  default and forwards it, so `from()`'s own `quality = 5` applies.
+
+### ECS-36
+- **Verdict**: CONFIRMED
+- **Evidence**: `BinaryObjectSerializationAdapter2.js:416` calls
+  `this.#schema_table.getRecord(schema_address)`. `getRecord(schema)` (`:124-125`) reads `#schema_map`,
+  populated by `#schema_map.set(record.schema, record)` (`:148`) — keyed by the schema **object**. The
+  address-keyed map is `#address_map`, reachable only through `getSchemaAt(address)` (`:115-116`).
+  A numeric address can never be a key of `#schema_map`, so `record` is `undefined` and `record.typeName`
+  at :419 throws. The `HEADER_TAG_REF_SCHEMA` branch has no other exit.
+
+### ECS-37
+- **Verdict**: CONFIRMED
+- **Evidence**: `BinaryBufferSerializer.js:26-34` — `if (smComponentIndex === -1) { return false; }` sits
+  *above* the `componentInstance[COMPONENT_SERIALIZATION_TRANSIENT_FIELD] === true` check.
+
+### ECS-38
+- **Verdict**: CONFIRMED
+- **Evidence**: `BinaryObjectSerializationAdapter.js:59-61` uses a plain `Klass.typeName` static lookup,
+  which walks the prototype chain. The v2 writer (`BinaryObjectSerializer.js:270`) explicitly guards this
+  with `Object.prototype.hasOwnProperty.call(ctor, "typeName")`, so the divergence is real.
+
+### ECS-41
+- **Verdict**: CONFIRMED
+- **Evidence**: `GUIElementSystem.js:248` subscribes with a fresh object-literal context
+  (`{el, system, entity}`); `:261` calls `component.visible.onChanged.remove(handleComponentVisibilityChange)`
+  with no second argument. `Signal.remove(h, thisArg)` (`core/events/signal/Signal.js:194-220`) matches on
+  `n.handle === h && n.context === thisArg`, so `undefined !== {…}` never matches and it returns `false`.
+
+### ECS-43
+- **Verdict**: CONFIRMED
+- **Evidence**: executed. `toJSON()` emitted
+  `{"worldOffset":…,"transformWorldOffset":true,"transformPerspectiveRotation":true}` from a component with
+  `flags === 3`; `fromJSON` on a fresh component produced `flags === 1` and
+  `getFlag(PerspectiveRotation) === false`.
+
+---
+
+## gfx-gi
+
+### GFXG-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `node_modules/three/src/renderers/shaders/ShaderChunk/worldpos_vertex.glsl.js` (r136) wraps
+  the entire declaration in `#if defined( USE_ENVMAP ) || defined( DISTANCE ) || defined ( USE_SHADOWMAP ) || defined ( USE_TRANSMISSION )`.
+  `sh3/gi/material/space_fragment/build_vertex_shader.js:16-24` unconditionally injects
+  `vWorldPosition = worldPosition.xyz;` after `#include <fog_vertex>` (which follows `worldpos_vertex` in
+  three's vertex shaders), with no matching `#if` and no local fallback. The newer LPG builder computes
+  the world position locally, as the report says.
+
+### GFXG-2
+- **Verdict**: CONFIRMED
+- **Evidence**: `prepare_bake_material.js` supplies 1x1 fallbacks for diffuse/roughness/metalness/occlusion/
+  emissive (`:57-75`) but `texture_normal` (`:25`, `:33`) is left `null` and assigned straight to
+  `target_uniforms.tNormal.value` at :100 — the `if (t === null) return;` in the anisotropy loop at :86
+  exists precisely because it can be null. `BakeShaderStandard.js:124` then does
+  `texture_supersample_4(tNormal, …).rgb * 2.0 - 1.0`; three r136 binds `emptyTexture` for a null
+  `sampler2D` uniform, which samples black → `(-1,-1,-1)`.
+
+### GFXG-3
+- **Verdict**: REFUTED
+- **Reason** (grounds 1 + 2): the finding's premise — "ShaderMaterial's `fog` defaults to `true` and
+  `SplatMaterial` does not turn it off" — is factually wrong for the pinned three.
+  `node_modules/three/src/materials/ShaderMaterial.js:41` is `this.fog = false; // set to use scene fog`
+  (it overrides `Material.js:20`'s `true`). `SplatMaterial.js:103-120` constructs the terrain
+  `ShaderMaterial` without a `fog` parameter and never assigns `sm.fog`; a repo-wide grep for
+  `.fog = true` / `fog: true` finds only the two impostor shaders. `WebGLProgram.js:442` emits
+  `#define USE_FOG` only when `parameters.useFog` (= `material.fog`) is true, so the `#ifdef USE_FOG`
+  block containing `fogDepth` (`TerrainShader.js:359-366`) is unreachable dead code. The stale symbol
+  should still be renamed, but the claimed failure — terrain failing to compile the moment `scene.fog`
+  is set — cannot occur. At most MINOR (latent).
+
+### GFXG-4
+- **Verdict**: REFUTED
+- **Reason** (ground 1): `computeMaterialEquality` does not stop at the generic flags. After the flag
+  block it dispatches on material type — `isMeshStandardMaterial` / `isMeshDepthMaterial` /
+  `isMeshMatcapMaterial` — and the final `else` is `//TODO implement other material types; return false;`.
+  A `ShaderMaterial` matches none of the three, so the function returns **false** for every pair of
+  distinct shader materials. Executed: two `ShaderMaterial`s with different sources/defines/uniforms →
+  `computeMaterialEquality === false`; two *byte-identical* `ShaderMaterial`s → also `false` (their
+  hashes do collide at `157685845`, but `HashMap` resolves by equality, so a bucket collision only costs a
+  comparison). `MaterialManager.obtain()` therefore cannot hand caller B caller A's material. No
+  in-repo material sets `isMeshStandardMaterial` on a shader material (only
+  `WebGLCubeProbeRenderer.js:78` reads the flag). The "both trails render smoke.png" scenario does not happen.
+
+### GFXG-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `sh3/shader/visualize.frag.js:19,21,25,27` use `result -=` for coefficients 1, 3, 5 and 7.
+  `node_modules/three/src/renderers/shaders/ShaderChunk/lights_pars_begin.glsl.js:18-27` is all-`+=`, and
+  `core/geom/3d/sphere/harmonics/sh3_basis_at.js:29-37` — the projection basis every bake uses — is
+  all-positive. The visualiser is the only evaluator with the opposite convention.
+
+### GFXG-6
+- **Verdict**: CONFIRMED
+- **Evidence**: `ImpostorShaderLitV0.js:225` and `VoxelImpostorShaderLitV0.js:97` declare
+  `vec4 worldPosition = …` inline; neither file contains the string `#include <worldpos_vertex>`.
+  Both set `lights: true` (`:747` / `:227`), so `isLitMaterial` selects them and
+  `render/forward_plus/plugin/MaterialTransformer.js:68` runs `fp_build_vertex_shader`, whose sole
+  vertex injection is `insert_after(a, '#include <worldpos_vertex>', …)`.
+  `core/primitives/strings/insert_after.js:9-13` `console.warn`s and returns the source unchanged when the
+  term is absent, while the preamble still declares `varying vec3 v_world_position;` — so the varying is
+  declared and never written.
+
+### GFXG-8
+- **Verdict**: CONFIRMED
+- **Evidence**: `DenoiseShader.js` — the fragment reads `float bSigma = sigmas.y;` and uses it in
+  `normpdf3(rgba.rgb - pixel.rgb, bSigma)`, but the JS initialiser is
+  `sigmas: { type: "v2", value: new Vector2(sigma, sigma) }`. `filterSmoothness` reaches only `bZnorm`,
+  which multiplies `factor` uniformly and therefore cancels in `accumulatedColor / accumulatedFactor`.
+
+### GFXG-7 / GFXG-9
+- **Verdict**: CONFIRMED (spot-checked, both are single-line reads)
+- **Evidence**: `BakeShaderStandard.js:38` is `vec3 T = normalize(vec3(modelViewMatrix * tangent) );`
+  with `tangent` a `vec4` and `defaultAttributeValues.tangent = [1,0,0,1]` at :192-194 — the translation
+  column is folded in. `:95` is `vec4 col;` with no initialiser, followed by four `col += texture(...)`.
+
+---
+
+## engine-asset
+
+### ASSET-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `PNGReader.js:497` allocates `new Uint8Array(width * bytes_per_pixel)` while `:523` uses
+  `line_offset = (y % 2) * passLineBytes`, and pass 7 has `pass_width === width` so
+  `passLineBytes === width * bytes_per_pixel` — the entire buffer. Reproduced by calling
+  `interlaceAdam7` directly on a hand-built 2x4 8-bit grayscale Adam7 stream for pixels
+  `[10,11, 20,21, 30,31, 40,41]`: the function returned `[10,11, 20,21, 30,31, 0,0]` — the last row lost.
+
+### ASSET-2
+- **Verdict**: CONFIRMED
+- **Evidence**: `ArrayBufferLoader.js:45-61` — `reader.read().then(({done, value}) => {…})` has no second
+  argument and no `.catch`. On a body-stream error the wrapper `ReadableStream` controller is never
+  `close()`d or `error()`d, so the `new Response(stream)` at :77 never completes and
+  `await response.arrayBuffer()` at :154 never settles; `load()` neither calls `success`/`failure` nor
+  rejects, and the read rejection surfaces as an unhandled rejection. The stream prototype also defines
+  no `cancel`.
+
+### ASSET-7
+- **Verdict**: CONFIRMED
+- **Evidence**: `PNG.js:216-221` — `a = this.transparency_lookup[pixels[i]]` with no bounds test.
+  Executed on a colour-type-3 PNG with a 3-entry palette and a 2-entry `tRNS`, pixel index 2:
+  `getPixel` returned `[200, 100, 50, undefined]`. Into a `Uint8Array` destination (the
+  `getRGBA8Array_generic` path) `undefined` stores as 0 → fully transparent, where the spec requires 255.
+  `getUint8Data_case3` (`:369-377`) implements the bounded rule correctly, confirming intent.
+
+---
+
+## gfx-render
+
+### GFXR-1
+- **Verdict**: CONFIRMED
+- **Evidence**: `Camera.js:279` is `const near = scratch_frustum.planes[0];` with
+  `const scratch_frustum = new Frustum()` (`:303`, `Frustum` imported from `'three'` at :1), filled through
+  `frustum_from_camera` → `result.setFromProjectionMatrix(...)`. three r136
+  `Frustum.js:54-59` orders the planes right / left / bottom / top / far / near, so index 0 is the RIGHT
+  plane and near is index 5. `pp/PerfectPanner.js:9-10` states the correct indices.
+
+### GFXR-5
+- **Verdict**: CONFIRMED
+- **Evidence**: `loadCubeTexture.js:27` calls `ImageUtils.loadTextureCube(urls)`.
+  `node_modules/three/src/extras/ImageUtils.js` (r136) declares exactly one member,
+  `static getDataURL(image)`. The call throws `TypeError` for any input.
+
+### GFXR-13
+- **Verdict**: CONFIRMED
+- **Evidence**: `BoneMapping.js:13-15` `byDistance` returns `b.distance - a.distance` (descending) and
+  `:61` consumes with `matches.pop()` — the tail, i.e. the smallest distance.
+  `core/primitives/strings/string_compute_similarity.js` is `string_jaro_winkler` with the JSDoc
+  "Higher value means string are more similar", so the least-similar pair is committed first and its
+  bone/name slots are then evicted for every remaining candidate.
+
+### GFXR-14
+- **Verdict**: CONFIRMED
+- **Evidence**: `SGMeshAnimationControllerSystem.js:159-167` — `const entity = this.#queue.pop();` inside a
+  fixed `for (let i = 0; i < 1000; i++)`; `#enqueue` (`:90-92`) is `this.#queue.push(entity);`.
+  `#process` re-enqueues synchronously before its first `await` when `mesh.node === null` (`:65-68`),
+  so the same entity is popped and pushed back to the same end 1000 times per tick.
+
+### GFXR-15
+- **Verdict**: CONFIRMED
+- **Evidence**: `QueryShader.js:108` reads
+  `float n2 = textureLod(utDepth, vec2(n_max.y, n_min.y), float(mip_to_use)).x;` — `n_max.y` in the x slot,
+  while the three sibling taps are `n_min.xy`, `vec2(n_min.x, n_max.y)` and `n_max.xy`.
+
+### GFXR-22
+- **Verdict**: CONFIRMED
+- **Evidence**: `LightSerializationAdapter.js` — `value.distance.toBinaryBuffer(buffer)` and its read
+  counterpart both sit inside `if (value.type.getValue() === LightType.SPOT)`. `maxShadowDistance` does not
+  appear in the file at all.
+
+### GFXR-25
+- **Verdict**: CONFIRMED
+- **Evidence**: `fp_build_vertex_lighting_shared.js:26` is `insert_after(result, 'void main() {', accumulation_pars)`
+  and `accumulation_pars` (`:9-13`) opens with
+  `vec3 fp_normalized_screen_position = ((gl_Position.xyz / gl_Position.w)+vec3(1.0))*0.5;` — read at the
+  top of `main`, before `#include <project_vertex>` assigns `gl_Position`. Reached whenever
+  `shader.defines.LIGHTING_VERTEX_ONLY === true` (`plugin/MaterialTransformer.js:63-64`).
+
+### GFXR-27
+- **Verdict**: CONFIRMED
+- **Evidence**: `LightManager.js:771-796` — the visibility dispatch is
+  `if (light.isDecal === true) {…} else if (light.isPointLight === true) {…}` with no trailing branch and
+  no diagnostic. A `forward_plus/model/SpotLight` accepted by `addLight` is never binned.
+
+---
+
+## Not re-checked (pre-confirmed by the lead)
+
+`GFXR-11`, `GEOM3-1`, `ASSET-4`.