@woosh/meep-engine 3.23.0 → 3.25.0

package/src/shade/renderer/geometry/virtual/runtime/REVIEW_LEDGER.md

@@ -0,0 +1,241 @@
+# Virtual Geometry runtime — review ledger
+
+An adversarial review of `runtime/` on 2026-09-11, immediately after it was written. Twelve
+reviewers over disjoint dimensions, every non-nit finding attacked by three verifiers (refute /
+reproduce / scope) and kept only if two failed to refute it, then a completeness critic and a second
+pass on the gaps it named. 251 agents, 61 survivors, ~35 distinct after the critic's dedup.
+
+**Worked to closure on 2026-09-12, and the closure re-checked the same day.** Every C and M row
+below is closed or reclassified against the commit that closed it. Twenty-one reintroductions of
+those defects are now caught by the spec their row cites, run mechanically, one at a time: ten were
+when the campaign ended, and the other eleven are the re-review's work. See
+[Re-review 2026-09-12](#re-review-2026-09-12) for what the first pass claimed that was not true —
+including one defect that was still live — and for the two things it could not prove below the
+headless drive, which are written down there rather than counted as closed. The status column is
+the record; the prose under each section is what it cost to get there.
+
+| | |
+|---|---|
+| `90b0b4b46` | fixed-stride page slots, and a tier that answers its own activation question |
+| `7d993a083` | the collect pass gets an oracle, and four defects with it |
+| `51b9d9cdc` | the feedback loop gets a spec, and stops being three kinds of wrong |
+| `6fa44985f` | the prose catches up with the code |
+| `61cee96b6` | the singular-instance guard was a test of the wrong number, and only worked axis-aligned |
+| `88f92a07c` | eight closures that no spec could have noticed being undone, and three that were wrong |
+
+**What the campaign changed about the shape of the thing**, rather than about a line of it:
+
+1. **The VRAM tier answers its own residency questions.** Selectability, the bytes an eviction
+   refunds, and eviction's child rule were each taken from the *RAM* tier, and each is a different
+   answer over a different set. C1 is the one that broke the guarantee the whole design is arranged
+   around, and the fix is not a patch to the publisher — it is the group row carrying its parent
+   count so the rule can be evaluated where the residency it is about lives.
+2. **Fixed-stride page slots**, which DESIGN §6 asked for and FORMAT §11.14 finally permitted. Four
+   defects stopped existing, the page table stopped being a binding, and the traversal came down
+   from nine storage buffers to eight against the engine's floor of ten.
+3. **A readback is about a frame that has gone.** The layout it is decoded with and the identity of
+   every page row it names belong to that frame; both are snapshotted when the reading is scheduled.
+4. **The proof tiers are not interchangeable.** Nothing below the headless drive exercises the
+   engine-integration path, and 18,569 green specs did not notice the playground failing to boot.
+   The drive is a required check, and it reproduces the README's numbers on a real adapter after
+   every change here.
+
+---
+
+## Critical
+
+| id | defect | status |
+|---|---|---|
+| C1 | **Selectability was a RAM-tier answer; the cut descends the VRAM tier.** `#refresh_selectable` published `reader.is_selectable(page, group)` — true when the ancestor cone is in *RAM* — into the flag `vg_group_selectable` reads, while descent is gated on `vg_lookup`, which is *VRAM* and a strict subset. So a group could be flagged selectable while a page holding one of its parents had no row, and that parent's own ancestor clamped and drew a coarse stand-in over the same surface. Reachable three ways on the normal path: a refused install, the feedback loop's per-frame promotion budget, and evicting a parent page while its child is not yet resident. Reproduced against the real kernels: 18 drawn ancestor/descendant pairs. | **closed** `90b0b4b46` — the group row carries `group_parent_count`, and `VGeoRuntimeTables.refresh_selectable` computes the rule over this tier's arena and lookup with no reader involved. The agreement spec gained a `vram_withheld` set and a fixpoint oracle over an arbitrary residency set; it was red on the old code |
+| C2 | **`MESHLET_BASE` was cached across a meshlet-pool compaction.** A page row stores `batch.metadata.offset`; `GPUMeshletManager.compact()` relocates allocations and fires `record.changed`. The pool subscribed to nothing, so after a compaction every VG page row pointed at another page's clusters — silently, and undetectably from inside the runtime, because every index involved is still in range. | **closed** `90b0b4b46` — the pool subscribes per batch and republishes the slot's `MESHLET_BASE`. **Not a defect of the arena's allocator**, as the note below claimed: it is the *meshlet* pool's compaction, and fixed slots do nothing about it |
+| C3 | **`#ensure_arena` tested total capacity, not free space**, so a full-but-large arena never grew and `install` then threw and was refused forever. The second clause grew on *byte* pressure, which arena pressure does not follow. And `arena_word_ceiling` defaulted to 1<<26 words = 256 MiB against a 128 MiB default binding limit, so the last doubling threw in `#create`. | **gone** `90b0b4b46` — there is no arena growth. The arena is `page_capacity` slots from the first frame to the last, and the binding limit is checked once at construction |
+| C4 | **`resident_bytes` drifted upward permanently.** `evict()` subtracted `page?.decoded_size ?? 0`, re-derived from the RAM reader; if the RAM tier had dropped that page the subtraction was zero, and the VRAM budget then refused every install forever. | **closed** `90b0b4b46` — the slot header carries `DECODED_SIZE`, so the tier that charged the budget refunds the number it charged |
+| C5 | **The feedback readback was parsed with the wrong frame's layout.** `#apply` re-read `runtime.feedback_layout`, but `begin_frame` recomputes it every frame from `page_row_capacity` and `lookup_word_count`, both of which move as pages install. A readback landing a frame or two later decoded with bases that had shifted — wants and touches read out of the stamp region. | **closed** `51b9d9cdc` — the layout is closed over in `read()`, and `VGeoFeedbackLoop.spec.js` grows the tier underneath an outstanding reading |
+| C6 | **Two `.vgeo` assets collapsed onto one geometry record.** `VirtualGeometry` inherited `MeshletGeometry`'s `hash()`/`equals()`, which are `this.meshlets.hash()` over an **empty** `MeshletBatch`. `GPUGeometryManager.add` keys `#records_by_content` by content, so the second VG asset registered became another name for the first's record and drew the first's cut. | **closed** `51b9d9cdc` — identity is the container. `VirtualGeometry.spec.js` holds two assets to two rows, and two handles on one reader to one |
+| C7 | **The seed kernel trusted `ROOT_PAGE_ROW`, guarded only by a stripped assert.** `register()` used `assert.notEqual(page_row, -1)`, and this engine strips `assert.*` in the shipped build, so a failed root install left `VGEO_PAGE_ROW_NONE` in the geometry row; the seed kernel read it as a u32 index and the multiply wrapped into a live stat word. | **closed** `90b0b4b46`, the kernel half tested `88f92a07c` — `register` throws and rolls the geometry back, and the kernel checks the sentinel in one compare that no build strips. The compare itself had no test: the agreement spec now runs the seed pass alone against a record carrying the sentinel, and asserts nothing is enqueued, nothing is claimed and not one word of the frame's counters moves |
+
+## Major — correctness
+
+| id | defect | status |
+|---|---|---|
+| M1 | **Plane 4 was the far plane, not the near one.** The collect pass extracted `row_w + row_z`; the engine's own `construct_frustum_planes` uses `w − z` for near under reverse-Z, and `w + z` is the degenerate row an infinite projection makes useless. | **closed** `7d993a083` — a sign, and a test that holds all five planes against `Camera.construct_frustum_planes` on the same matrix rather than re-deriving them |
+| M2 | **Frustum culling is on by default and was tested by nothing.** `cull_enabled = true`; the agreement spec ran only with it off. M1 shipped precisely because the default path had no oracle. | **closed** `7d993a083` — it cannot be compared to the CPU cut, because a culled node leaves a real hole, so it is held to §4.4's claim instead: culling removes only clusters whose own sphere is outside the frustum, and never one inside it |
+| M3 | **A singular instance transform produced a NaN eye**, and NaN makes every comparison in `vg_project` and the frustum test fail *open* — one zero-scaled instance drew its whole resident set. | **closed** `61cee96b6`. `7d993a083` tested the smallest singular value, which is a degeneracy test in exact arithmetic and not in f32 — it closed the axis-aligned flatten the spec used and left the rotated one open, NaN eye and all, for thirty-six of forty. The test is the **determinant** now, which is the number `mat4_inverse` divides by and is exactly zero at every rotation |
+| M4 | **The scale correction was not conservative under shear.** `max/min` of the column lengths is not the singular-value ratio; under shear it under-refines, which three comments and two docs called conservative. | **closed** `7d993a083` — `chunk_mat3_singular_values`, closed form, and **exactly 1** for a uniform scale, which a conservative bound would not have been |
+| M5 | **The instance slot was an unbounded `atomicAdd` with no capacity check anywhere.** Every other append in the cut is bounded; this one was missed. | **closed** `7d993a083` — bounded and counted. As the seam is wired it cannot fire, and that is recorded where the check is: the invariant is a call away and the buffer is made here |
+| M6 | **`meshlet_capacity` was a frame-scoped constant (1<<20) unrelated to the collection the cut writes into** — the engine's default is 2e5, so `vg_draw` bounds-checked against five times the buffer it was writing into. | **closed** `7d993a083`, the seam half tested `88f92a07c` — both capacities are declared by the expansion site that was handed the collections, and a frame with several sites takes the minimum. The campaign tested the runtime's minimum and not the declaration, so deleting the call from the seam left the suite green |
+| M7 | **A broken `child_ref` resolved to page index 0** in `vgeo_runtime_write_page_block` and the cluster was silently dropped, where the CPU reference draws it as a leaf and counts it. Page 0 is the root, which is pinned and therefore always resident. | **closed** `90b0b4b46` — it becomes a leaf and is counted, as `vgeo_select_cut` does with the same input |
+| M8 | **Queue overflow and `max_iterations` exhaustion were silent** — the one degradation the design admits costs holes rather than coarseness, and the counters RUNTIME_PLAN promises for it did not exist. | **closed** `51b9d9cdc` for the kernel, `88f92a07c` for the seam — `QUEUE_REMAINING` and `WAVEFRONTS`, the first left behind by one extra prepare pass the seam records after the wavefront loop. That pass was bound to `queue_a`, which holds the produced work only when the iteration count is even; at an odd `max_iterations` it reported the count of work already done and zeroed the count of what was left. The loop carries the roles rather than the buffers now. Measured on a device: fourteen wavefronts at τ = 0.5, nothing outstanding at any threshold |
+| M9 | **`evictable()`'s child rule disabled itself when the RAM page was gone**, orphaning VRAM-resident children under an evicted parent. | **closed** `90b0b4b46` — the rule reads this tier's own arena, so a page whose RAM copy has gone still knows its VRAM children |
+| M10 | **A recycled page row was resolved with no identity check.** Feedback is at least a frame behind; a row freed and re-used between the cut and the readback makes a want whose page index and byte range come from different pages, and a touch that reroutes both tiers' LRU to the wrong page. | **closed** `51b9d9cdc` — `VGeoRuntimeTables.generation_of(row)`, snapshotted when the reading is scheduled and compared when it lands. CPU-side, which is where it belongs: nothing on the device needs it |
+| M11 | **`install_wants` was fire-and-forget** — no `AbortSignal`, no limit, no cross-frame dedup, and an empty catch. The shared `ConcurrencyGate` accumulated stale closures and the RAM budget was charged once per frame per still-wanted page. | **closed** `51b9d9cdc` and `88f92a07c`. Four parts, one of which had a test: the dedup. Of the other three, two were also wrong. The limit was documented "across every reader" and applied per reader, so a frame seeing eight assets issued eight times it — one budget now, ranked across readers because a want's priority is pixels of error and comparable across assets. The failure report sat on a `.catch` and a failed fetch never arrives as one: `VGeoResidencyManager` catches it per page, because the cut stands without any page — so it reads the reader's quarantine now. The signal was right and unexercised; `destroy()` is the verb, and see U1 for who calls it |
+| M12 | **Nothing advanced the RAM tier's clock outside the playground.** `VGeoResidencyManager.advance_frame()` had exactly one non-spec caller, so in any real host the protect window never moved and `evict_to_budget` was a permanent no-op. The RAM tier was unbounded. | **closed** `51b9d9cdc` — `VGeoFeedbackLoop.read` winds it, before its own early returns: a frame whose feedback is skipped is still a frame |
+| M13 | **Every shadow-map face ran a full cut at the main camera's projection scale.** `GPUSceneShadowmapContext` calls `graph_rasterize_scene_fast_raw`, which carries the seam; the shadow graph is a different `FrameGraph`, so `runtime.feedback` is a cross-graph handle there. | **closed** `7d993a083`, tested `88f92a07c` — the runtime records the graph its frame was opened on and the seam skips any other. The campaign's test compared `runtime.frame_graph` to a graph, which is the getter and not the check; `graph_vgeo_expand.spec.js` calls the seam on a second graph and holds it to recording no passes at all |
+| M14 | **Alpha-tested and transparent VG instances are silently invisible**, and DESIGN §9 — cited in the code as the authority for it — did not say so. | **closed** `51b9d9cdc`, tested `88f92a07c` — §9 says it now, and `GPUSceneRows.attach_mesh` says it out loud when such a mesh is attached. Held to the console the way `cloth_collision.spec.js` and `cloth_rig.spec.js` hold theirs: a real `.vgeo` container, a blended material, and the warning read where it is written. The path itself stays out of scope: the bucket path is handed a scene and a camera resource, not a view context |
+| M15 | **No unregister or teardown anywhere.** Geometry rows, lookup allocations, pinned root pages, meshlet batches and all four GPU buffers leaked; `#geometry_allocations` was written and never read. | **closed** `90b0b4b46` — `GPUVirtualGeometryPool.unregister` gives back pages, batches, the lookup block and the row, and `destroy` runs it for every registered container. Geometry rows are recycled too |
+| M16 | **Arena growth mutated the shadow before the buffer existed** — `grow_arena` then `#create`, so a create that exceeded the binding limit left shadow and device permanently desynchronized. | **gone** `90b0b4b46` — with C3 |
+| M17 | **A full page-row table never triggered eviction** — `#make_room` looped on bytes only, so row exhaustion was a permanent cliff independent of the budget. | **closed** `90b0b4b46` — slots and rows are the same thing now, and `#make_room` evicts on whichever budget is short |
+| M18 | **Defaults were far short of the design's scale.** `claim_word_capacity` (1<<14 words) covered ~0.5 M (instance, page) pairs — 512 instances of a 1,024-slot tier — against the design's thousands of instances × thousands of pages. | **closed for the claim, reclassified for the queue** `51b9d9cdc`, tested `88f92a07c`. `claim_word_capacity` is derived from the pool's own capacity and a stated `visible_instance_hint`, so it follows the tier it indexes into. `queue_capacity` is left where it is and the reason is written down: the worst case is unbounded, a queue is two buffers of `capacity × 16` bytes per expansion site, and running out is no longer silent — `QUEUE_REMAINING` is non-zero exactly when it costs a hole |
+
+## Major — the proof was weaker than it looked
+
+The agreement spec is the campaign's central claim. It is a real test and it did constrain the
+kernel, but it proved less than RUNTIME_PLAN §7 said.
+
+| id | defect | status |
+|---|---|---|
+| P1 | Every assertion was conditioned on **VRAM set == RAM set** — `residency_to_tables` mirrored the reader exactly — which is the one state the pool does not maintain, and is why C1 was invisible to it. | **closed** `90b0b4b46` — `vram_withheld`, a fixpoint oracle over an arbitrary residency set, and a direct antichain assertion that needs no oracle at all: no drawn cluster is a descendant of another |
+| P2 | `shader_vgeo_cut_collect`, the **only producer of the instance record**, was compile-only. The spec fabricated the record it would have written, so M1, M3, M4 and M5 were all outside its reach. | **closed** `7d993a083` — it runs under the emulator against a scene database built through `SceneManager`, and the cut selected from its own record is held to `vgeo_select_cut` |
+| P3 | Every test registered **exactly one** VG geometry, so `lookup_base` was always 0 and every use of it a verified no-op. | **closed** `7d993a083` — two containers in one tier, each held to its own oracle |
+| P4 | The device-facing half — `VGeoFeedbackLoop`, `GPUVirtualGeometryRuntime`, the seam — **had no spec at all**. | **closed** `51b9d9cdc` for the first two, `88f92a07c` for the third — `VGeoFeedbackLoop.spec.js` is a real frame graph, a readback that lands, and a feedback image written the way the kernel writes it. Its three seam tests read the runtime's getters and never called the seam, so P4 was closed with a third of it still untested; `graph_vgeo_expand.spec.js` records the seam and asserts what came out |
+| P5 | Every overflow and degradation branch was **provably dead** in the suite, so §4.5's "degrades in one direction" was untested. | **closed** `7d993a083` — draw records, the wavefront queue and the want list are each driven to their bound, and each shown to lose work rather than invent it or write past the end |
+| P6 | The blocked-group search's guard rejected nothing, so **which case it exercised was chosen by the kernel under test**. | **closed** `7d993a083` — a candidate has to be a page the traversal still enters *and still draws from another group of*, which is the mixed page the own-group term exists for. A page with one drawn group can never be one |
+| P7 | RUNTIME_PLAN §7's step-4 row claimed the seam was proved by "4,667 engine specs green" — those specs exercise **no line** of the seam. | **closed** `6fa44985f`, and again `88f92a07c` — the row says so, and names the tier that does exercise it. A row of a proof table has to name a test that would go red |
+
+## Major — claims in prose the code did not honour
+
+All eight corrected in `6fa44985f`, except where a commit is named.
+
+- **D1** §4.7/§4.5 named queue-exhaustion counters that did not exist — they exist (`51b9d9cdc`), and
+  §4.5 now says which reading means a hole.
+- **D2** §6 described the agreement fixture as the very fixture that cannot exercise its headline
+  case. It is built at 64 KB, and §6 records the measurement: at 8 KB this torus puts one group in
+  every page, so no page is ever mixed and the own-group term is unreachable.
+- **D3** "all four expansion sites" — three did. §5 says three, names the fourth, and points at
+  DESIGN §9 for why it is not four.
+- **D4** §4.5 claimed FORMAT §10's in-flight pin was closed; nothing pins anything and §10 still
+  marks it open. Both documents now say the same thing: the cut names the source page, which is what
+  §10 was blocked on, and the pin itself is not implemented.
+- **D5** §4.9's binding list named `stamps`, which is a *region of* `feedback` rather than a buffer,
+  and omitted `vg_lookup`, which the descent is gated on. Corrected, and
+  `vgeo_cut_shaders.compile.spec.js` asserts the exact count of every kernel so the list cannot
+  drift again.
+- **D6** `grow_arena`'s comment described a 9/8 margin the code never applied to a request — gone
+  with `grow_arena` (`90b0b4b46`).
+- **D7** VGEO_FORMAT said the reader decodes neither the node table nor the metric. It decodes both;
+  the node table has a consumer and the metric does not, for the reason §4.8 gives.
+- **D8** the reader's documented per-page RAM overhead, and §2's own measurement gate, which was
+  never discharged. Measured and tabled in §2: **six per cent of the decoded bytes**, flat across
+  page size, 0.2–33.9 KB per page at 544 KB pages. The audit's "6.4–11.9 KB" is the mean of that
+  distribution and not its range.
+
+## What the review itself got wrong
+
+Recorded because the next reviewer will otherwise repeat it.
+
+- **The range was wrong, and more wrong than it looked.** Reviewers were given
+  `git diff master..HEAD` — a two-dot, tip-to-tip diff — while master had moved past the merge base
+  (`f07c9f741`). Master's own work was reported as this branch's regressions, including an apparent
+  version downgrade and two "re-introduced" dangling doc links. By the next day master was
+  **thirty-six** commits ahead, not the three the review counted, and had deleted the scene graph.
+  Use `master...HEAD` or `$(git merge-base master HEAD)..HEAD`, and take the count at the moment you
+  read it — in this repo it is stale within the day.
+- **Nobody was pointed at the integration target.** Master's newest commit added a per-row generation
+  token for exactly the recycled-row identity hazard M10 describes. A reviewer looking at what this
+  branch must merge into would have found the shape of the fix already written.
+- **Twelve dimensions, all spatial.** They partition the code by subsystem and by one-shot
+  correctness. None asked what happens on the hundredth frame or under a moving camera — the regime
+  a streaming LOD runtime exists for. The second pass caught some of it; it should have been in the
+  first.
+- **Two verifier failures.** A refutation of M12 contradicted a one-line grep, and the shadow-path
+  defect (M13) was refuted twice and confirmed once as minor. Three verdicts on one fact means none
+  of them is a verdict. M13 was re-checked on 2026-09-12 and stood.
+- **Nobody asked what the change did not use.** Twelve reviewers audited the code that exists; none
+  asked which engine primitive it re-implemented. A "what should this have reused" lens belongs in
+  the next sweep — and see the two notes below for how that lens went wrong when it was finally
+  applied.
+- **The C2/C3/M16/M17 grouping was half right.** "They are what the arena's `OffsetAllocator` costs"
+  is true of C3, M16 and M17 and false of C2, which is `GPUMeshletManager.compact()` relocating a
+  batch and has nothing to do with the VG arena. Converting to slots closed three of the four and
+  left C2 exactly where it was; it took a subscription to the meshlet pool's own `changed` signal.
+- **The `GPUDatabase` note's binding claim was wrong, and the conclusion was right for another
+  reason.** "A database binds as one `array<u32>`, so `vg_pages` + `vg_geometries` collapse to one"
+  — but `vg_geometries` is bound by the *collect* pass and `vg_pages` by the *traversal*, which are
+  different shaders with different budgets, so collapsing them buys the traversal nothing. What
+  actually bought the binding was folding the page header into its own arena slot, which is a
+  consequence of the fixed-stride conversion rather than of adopting a table.
+
+  `GPUTypedTable` was **not** adopted for the page or geometry rows, and the rest of the case for it
+  does not survive the conversion either. Its partial-write path stages into an upload buffer and
+  scatters with a compute pass, where a slot install is one contiguous `writeBuffer` of one range;
+  its paged growth is the growth DESIGN §6 asks this tier not to have; and `track_generations()` is
+  ten lines when the table is one array you own. What the note was right about is that the
+  generation token was the answer to M10, and that nobody had looked.
+
+---
+
+## Re-review 2026-09-12
+
+The campaign above closed every C and M row and claimed each one had been "red first against a
+reintroduction of exactly its own defect". That claim was checked the way it is written: reintroduce
+one defect, run the spec the row cites, restore, next. Twenty-one reintroductions, one at a time,
+scripted rather than done by hand so that the filter is proved to select real tests on the clean
+tree before the edit is applied — a name filter that matches nothing fails the run for the wrong
+reason and reads exactly like a catch.
+
+**Ten went red. Eleven did not**, and one of the eleven was not a testing gap at all: it was the
+defect, still there, closed against the one case that could not see it.
+
+| # | what the first pass got wrong | closed by | proved by |
+|---|---|---|---|
+| 1 | **M3 was closed for an axis-aligned zero scale only, and the defect was live.** `!(σ_min > 0)` is a degeneracy test in exact arithmetic. In f32 it holds only on the closed form's diagonal branch, which is the branch `placed([0, 0, 0], [1, 0, 1])` takes. Rotate the flatten and the trigonometric branch computes σ_min as a difference of nearly equal numbers, with an absolute error of about `sqrt(eps_f32)·σ_max ≈ 3.4e-4` — an f32 model of the chunk over four thousand rotated flattens puts the worst σ_min/σ_max at 3.7e-4, which is why a relative threshold cannot be set safely (see below). Of forty rotated zero-scale instances under the emulator, **thirty-six were not dropped**, every one with a NaN eye, the largest projection scale reaching the traversal at **6.2e10** against an intended 540. | `61cee96b6` | agreement spec (emulator) |
+| 2 | **The seam had no spec.** P4 was closed against `VGeoFeedbackLoop.spec.js`, whose three seam tests read `runtime.frame_graph`, `runtime.meshlet_capacity` and `runtime.instance_capacity` and never call `graph_vgeo_expand_if_enabled`. Deleting the graph check (M13) or the `declare_collections` call (M6) left the whole suite green. | `88f92a07c` | `graph_vgeo_expand.spec.js` (software device) |
+| 3 | **M8's seam half was a live bug, found by writing that spec.** The extra prepare pass exists for one number and the seam bound it to `queue_a`, which holds the produced work only when the iteration count is even. At an odd `max_iterations` it reported the count of work already done and zeroed the count of what was left — `QUEUE_REMAINING`, the one reading that means a hole. | `88f92a07c` | `graph_vgeo_expand.spec.js`, both parities |
+| 4 | **C7's kernel compare had no test.** The host half was covered; deleting the sentinel compare from the seed kernel left the suite green. | `88f92a07c` | agreement spec (emulator) |
+| 5 | **M11 had one test for four parts, and two of the other three were also wrong.** The frame limit is documented "across every reader" and was applied per reader. The failure report sat on a `.catch`, and a failed fetch never arrives as a rejection — `VGeoResidencyManager` catches it per page, because the cut stands without any one page — so the sentence the fix claimed ("a reader that has quarantined everything asked of it is a fact somebody has to be able to see") was still false. The `AbortSignal` was correct and unexercised. | `88f92a07c` | `VGeoFeedbackLoop.spec.js` |
+| 6 | **M18 had no test.** Putting `1 << 14` back left the suite green. | `88f92a07c` | `VGeoFeedbackLoop.spec.js` |
+| 7 | **M14 had no test.** Replacing the warning's condition with `false` left all 163 scene specs green. | `88f92a07c` | `GPUSceneRows.spec.js`, reading the console the way the cloth specs read theirs |
+| 8 | **The commit table cited a hash that is not in the history.** `c5fc435f0` is a dangling pre-amend of `6fa44985f` — same parent, three lines of this file apart, no branch containing it. It would have resolved on this machine and nowhere else. | this commit | `git branch --contains` |
+| 9 | **RUNTIME_PLAN §6 tier 3 still listed "the arena's growth"** among what the software device exercises. There has been no arena growth since `90b0b4b46` (C3). | this commit | reading it |
+
+And one thing the first pass fixed too weakly. P7 replaced "4,667 engine specs green" with the
+headless drive, which is closer and still not a test that goes red on one line: the drive is a
+whole-system check on one adapter that cannot be run per commit, and finding 3 above is exactly a
+seam defect its six numbers do not move — `max_iterations` defaults to 64, which is even.
+RUNTIME_PLAN §7's step-4 row names `graph_vgeo_expand.spec.js` now, and the drive stays what it is.
+
+**The drive was re-run after both commits** — the collect kernel's guard is a shader change and the
+seam's queue bookkeeping is a seam change — on the nvidia/lovelace adapter, and every row of
+`playground/vgeo_runtime/README.md`'s τ table is identical: 50/31/18/17/9/8 clusters drawn over
+9/8/6/6/5/5 pages, nothing clamped, 14/14/11/11/8/8 wavefronts, nothing left queued. Residency
+settles at 9 of 13 pages and 230 KB. `determinant()` therefore compiles and runs under Dawn as well
+as under the emulator, which is the only tier that can say so.
+
+### Not closed, recorded
+
+Two things this pass could not prove below the drive, written down rather than counted as closed.
+
+- **U1 — `VGeoFeedbackLoop` has no engine-side owner, so its teardown has nowhere to be wired.**
+  `abort()` had no caller anywhere in the tree, and the reason turns out not to be an oversight in
+  a teardown path: nothing in the engine constructs a feedback loop at all.
+  `GPUSceneContext.enable_virtual_geometry` hands back a runtime and a pool, and the host is
+  expected to build the loop over them — so the whole population of hosts is
+  `playground/vgeo_runtime/`, which now calls `destroy()` on `pagehide`. The spec proves the signal
+  reaches the residency manager and that a page arriving after an abort installs nothing. It cannot
+  prove that a host tears the loop down, because there is one host and it is a demo. This is M12's
+  shape exactly, and it stays open until an engine-side owner exists.
+- **U2 — nothing below the drive executes a cut through the seam.** The software device runs copies
+  and not shaders, so `graph_vgeo_expand.spec.js` proves what the seam *records* — the passes, the
+  resource behind each handle, the version chain, the capacities that reach the runtime — and
+  nothing about what a pass callback binds when it runs. Renaming a binding, or swapping two buffers
+  of the same type inside one `bindings` object, would pass every spec in this tree and fail only at
+  tier 4. That is the same gap P4 was about, one level in, and the drive is the only thing that
+  covers it.
+
+### What this pass got wrong, or nearly did
+
+- **A reintroduction script has to prove the clean run first.** The first version applied the edit,
+  ran the spec, and called a non-zero exit RED. A mistyped `-t` filter matches no tests, exits
+  non-zero, and reads as a catch — which would have certified rows that no test touches, which is
+  the exact failure being investigated. Every row now runs clean-then-dirty and reports the clean
+  pass count beside the verdict.
+- **The obvious fix for M3 was the wrong one.** A relative threshold — drop when
+  `σ_min / σ_max < eps` — is what the arithmetic seems to ask for, and it cannot be set safely: the
+  noise reaches 3.7e-4 of σ_max in a four-thousand-sample f32 model and a legitimately flat instance
+  (a plate a thousand times wider than it is thick) sits at 1e-3, so any threshold with real
+  headroom over the noise also drops real geometry. The determinant has no such tension, because it is not an estimate of anything — it is the number the
+  inverse divides by, and it is exactly zero for a flattened instance at every rotation.
+- **`max_wants_per_frame` was the second option in this tree documented as a global budget and
+  implemented as a per-reader one.** `VGeoResidencyManager`'s own doc records the first being
+  measured at 48 concurrent range requests against a cap of six, and that is why its gate is shared.
+  Worth a grep the next time a limit is added: the reader-shaped one is the easy one to write.