@woosh/meep-engine 3.33.0 → 3.35.0

package/src/shade/renderer/geometry/virtual/runtime/GPUVirtualGeometryRuntime.js

@@ -1,13 +1,23 @@
 import { assert } from "../../../../../core/assert.js";
 import { BufferResourceDescriptor } from "../../../../device/graph/BufferResourceDescriptor.js";
-import { noop } from "../../../../../core/function/noop.js";
 import { vgeo_cut_feedback_layout } from "./cut/vgeo_cut_feedback_layout.js";
 
 /**
  * @typedef {import("./GPUVirtualGeometryPool.js").GPUVirtualGeometryPool} GPUVirtualGeometryPool
+ * @typedef {import("./VGeoViewCut.js").VGeoViewCut} VGeoViewCut
  * @typedef {import("../../../../../engine/graphics/render/frame_graph/FrameGraph.js").FrameGraph} FrameGraph
  */
 
+/**
+ * The most views one frame's feedback is laid out for. A view past it shares the last slot, which
+ * merges its counters and its want slice with that view's and loses nothing else; the bound exists
+ * so that a frame drawing many point lights for the first time — first draws bypass the shadow
+ * budget — cannot grow the buffer without limit.
+ *
+ * @type {number}
+ */
+const SLOT_CEILING = 64;
+
 /**
  * What one frame of virtual geometry needs that is not a page: the threshold, the feedback buffer
  * every view writes into, and the parameters every pass reads.
@@ -18,9 +28,16 @@ import { vgeo_cut_feedback_layout } from "./cut/vgeo_cut_feedback_layout.js";
  * virtual geometry is view-dependent by construction — but everything here is shared between them,
  * which is exactly what §4 means by "the setup is shared rather than the result".
  *
- * **The feedback buffer is per frame and not per invocation**, and that is what dedups a touch
- * across the buckets and passes a frame is split into. Each expansion site gets its own claim
- * bitmask (different instance sets) and writes into this one buffer.
+ * **A frame spans every graph of a render.** The renderer opens it before the shadow maps are drawn
+ * and closes it after the main view's graph is recorded, and each shadow map records into a
+ * `FrameGraph` of its own (SHADOW_PLAN_2026_09_28 §2.1). So the feedback buffer is not a transient of
+ * any one graph: it is a buffer this runtime owns, **imported** into each graph that cuts, and the
+ * first graph of a frame to import it clears it. Graphs are encoded in the order they are recorded
+ * into one encoder, which is the only ordering the frame needs between them.
+ *
+ * **Every view that cuts takes a slot** (§2.4): its own counters, its own want slice and its own
+ * stamp tag, so one view's list running out cannot silence another's, and a reading can say which
+ * view needed more wavefronts. The view the frame is opened for is slot 0.
  *
  * @author Alex Goldring
  * @copyright Company Named Limited (c) 2026
@@ -31,14 +48,11 @@ export class GPUVirtualGeometryRuntime {
      */
     #pool;
 
-
-
     /**
      * @type {number}
      */
     #want_capacity;
 
-
     /**
      * @type {number}
      */
@@ -59,11 +73,6 @@ export class GPUVirtualGeometryRuntime {
      */
     #iteration_ceiling;
 
-    /**
-     * @type {number}
-     */
-    #iteration_escalations = 0;
-
     /**
      * @type {number}
      */
@@ -71,6 +80,7 @@ export class GPUVirtualGeometryRuntime {
 
     /**
      * Pixels of permitted error — the single quality/perf lever, and a runtime dial by design §4.
+     * A view cuts at this times its own {@link VGeoViewCut#tau_scale}.
      * @type {number}
      */
     tau = 1;
@@ -81,10 +91,15 @@ export class GPUVirtualGeometryRuntime {
     cull_enabled = true;
 
     /**
-     * This frame's feedback resource, or -1 outside a frame.
-     * @type {number}
+     * @type {boolean}
      */
-    #feedback = -1;
+    #frame_open = false;
+
+    /**
+     * The feedback buffer, persistent and re-made only when a frame's layout outgrows it.
+     * @type {GPUBuffer|null}
+     */
+    #feedback_buffer = null;
 
     /**
      * @type {ReturnType<vgeo_cut_feedback_layout>|undefined}
@@ -92,10 +107,43 @@ export class GPUVirtualGeometryRuntime {
     #layout;
 
     /**
-     * @type {FrameGraph|undefined}
+     * The current version of the feedback buffer in each graph that has imported it this frame.
+     * @type {Map<FrameGraph, number>}
+     */
+    #imports = new Map();
+
+    /**
+     * Whether a graph of this frame has already recorded the clear.
+     * @type {boolean}
+     */
+    #cleared = false;
+
+    /**
+     * This frame's slot for each view that has cut in it.
+     * @type {Map<VGeoViewCut, number>}
+     */
+    #slot_of = new Map();
+
+    /**
+     * This frame's views, by slot; a slot shared past the layout holds more than one.
+     * @type {VGeoViewCut[][]}
      */
-    #graph;
+    #slots = [];
 
+    /**
+     * The most slots any frame has asked for, which is what the next frame is laid out for — and
+     * never fewer than two, so that a view past the layout always has a slot to share that is not
+     * the frame's own view's. Sharing slot 0 merged a cascade's counters into the main view's reading
+     * and escalated the main view's wavefront bound on the cascade's remainder.
+     * @type {number}
+     */
+    #slot_high_water = 2;
+
+    /**
+     * The view the last frame was opened for.
+     * @type {VGeoViewCut|undefined}
+     */
+    #frame_view;
 
     /**
      * @type {number}
@@ -117,7 +165,7 @@ export class GPUVirtualGeometryRuntime {
      *     overriding the derivation below
      * @param {number} [options.queue_capacity] traversal items one wavefront may hold
      * @param {number} [options.max_iterations] wavefronts before the descent is abandoned, to start
-     *     with; the runtime raises it from what the cut reports
+     *     with; each view raises its own from what its cut reports
      * @param {number} [options.max_iteration_ceiling] as far as that raising may go
      * @param {number} [options.descent_steps] steps of the descent one traversal dispatch runs
      *     before handing back what it still holds; see the traversal kernel for why it cannot
@@ -153,10 +201,10 @@ export class GPUVirtualGeometryRuntime {
                      */
                     queue_capacity = 1 << 16,
                     /*
-                     Where the wavefront bound *starts*. It is raised by the runtime itself when a
-                     reading says the descent could not finish — see {@link note_incomplete_descent}
-                     — so this is the cost a scene pays until it has been told otherwise rather than
-                     a limit anyone has to get right in advance.
+                     Where every view's wavefront bound *starts*. Each view raises its own when a
+                     reading says its descent could not finish — see
+                     `VGeoViewCut.note_incomplete_descent` — so this is the cost a view pays until it
+                     has been told otherwise rather than a limit anyone has to get right in advance.
 
                      Eight is what almost every cut needs: one container at a modest viewport drains
                      in six. A converted scene at 3441×1440 does not, and nothing on the host can
@@ -199,8 +247,6 @@ export class GPUVirtualGeometryRuntime {
         this.#max_iterations = max_iterations;
         this.#iteration_ceiling = Math.max(max_iterations, max_iteration_ceiling);
         this.#descent_steps = descent_steps;
-
-
     }
 
     /**
@@ -234,11 +280,8 @@ export class GPUVirtualGeometryRuntime {
     }
 
     /**
-     * Wavefronts the descent may run, as the runtime currently understands this scene.
-     *
-     * A **high-water mark**, not a setting: it starts where the host put it and is raised by
-     * {@link note_incomplete_descent} from what the cut reports. `graph_vgeo_expand_instances_to_meshlets`
-     * reads it while it is recording passes, so a rise lands on the next frame.
+     * Wavefronts a view's descent starts with — each view raises its own from what its cut reports
+     * (`VGeoViewCut.note_incomplete_descent`), and cuts at the larger of the two.
      *
      * @returns {number}
      */
@@ -247,64 +290,14 @@ export class GPUVirtualGeometryRuntime {
     }
 
     /**
-     * Times the bound has been raised. Zero for the whole life of almost every scene; a small
-     * number, once, for one that needed more than it was given.
+     * As far as a view's wavefront bound may be raised.
      *
      * @returns {number}
      */
-    get iteration_escalations() {
-        return this.#iteration_escalations;
-    }
-
-    /**
-     * @returns {number}
-     */
     get iteration_ceiling() {
         return this.#iteration_ceiling;
     }
 
-    /**
-     * A reading saying the descent stopped with work still queued — raise the bound and keep it
-     * raised.
-     *
-     * **This is the only place the engine can learn it.** How many wavefronts a cut needs is a
-     * function of the frontier's *breadth*, which is a function of the scene, the viewpoint and the
-     * render target together; the kernel cannot know it before it runs and the host cannot know it
-     * at all. So the bound is guessed low, and the one reading that says the guess was wrong —
-     * `VGEO_CUT_STAT.QUEUE_REMAINING`, non-zero exactly when items were abandoned — pays for
-     * correcting it. It is the same shape as the rasterizer's meshlet counts, which cannot be known
-     * before the expansion runs either and are grown from what the frame reported.
-     *
-     * **Doubling, because the reading does not say how much more was needed.** A remainder is a
-     * count of *items*, and what they cost in wavefronts depends on how they spill; there is no
-     * ratio to convert one into the other. So it goes up by a factor until it drains, which is at
-     * most three steps from 8 to the ceiling.
-     *
-     * **Never lowered.** A frame that drained is evidence about that frame, not that the scene got
-     * smaller — and a bound that fell back would re-learn the same lesson every time the camera
-     * turned away and back, at a hole a time. An unused wavefront is an empty indirect dispatch,
-     * which is the cheap side of that trade.
-     *
-     * What it costs when it is wrong is bounded by the readback: the cut is capped at two readings
-     * in flight and skips frames when saturated, so the scene draws with a hole for the few frames
-     * between the first truncated descent and the reading that reports it — and then never again.
-     *
-     * @param {number} remaining items the descent still held when it was abandoned
-     * @returns {boolean} whether the bound moved
-     */
-    note_incomplete_descent(remaining) {
-        assert.isNonNegativeInteger(remaining, 'remaining');
-
-        if (remaining === 0 || this.#max_iterations >= this.#iteration_ceiling) {
-            return false;
-        }
-
-        this.#max_iterations = Math.min(this.#max_iterations * 2, this.#iteration_ceiling);
-        this.#iteration_escalations++;
-
-        return true;
-    }
-
     /**
      * Steps of the descent one traversal dispatch runs.
      *
@@ -317,7 +310,7 @@ export class GPUVirtualGeometryRuntime {
     /**
      * Settable, like tau, and for the same reason: it is a quality-of-schedule dial whose right
      * value is a property of the asset's depth and the scene's breadth together rather than of the
-     * engine. `begin_frame` re-writes the params every frame, so a change lands on the next one.
+     * engine. Every view writes its params at record time, so a change lands on the next frame.
      *
      * @param {number} value
      */
@@ -329,32 +322,31 @@ export class GPUVirtualGeometryRuntime {
     }
 
     /**
-     * This frame's feedback resource. Every expansion site writes into it and one readback reads it.
-     * @returns {number}
+     * Whether a frame is open — whether a rasterization path recording now may cut.
+     *
+     * @returns {boolean}
      */
-    get feedback() {
-        return this.#feedback;
+    get frame_open() {
+        return this.#frame_open;
     }
 
     /**
-     * Hand back the version of the feedback resource that an expansion left behind.
-     *
-     * A frame is cut once per bucket per HZB pass per view, and every one of those writes into the
-     * *same* feedback buffer — which is exactly what dedups a touch across them. But a FrameGraph
-     * resource is versioned: the handle `begin_frame` created is version 0, and a second expansion
-     * that wrote version 0 again after the first had produced version 65 would be reading stale
-     * contents while claiming not to. The graph says so, loudly, and it is right to.
+     * The view the last frame was opened for, which is slot 0 of that frame's feedback.
      *
-     * So the runtime carries the *current* version and each expansion publishes what it produced.
-     * The readback then reads the last one, which is the only version that has seen every view.
-     *
-     * @param {number} handle
-     * @returns {void}
+     * @returns {VGeoViewCut|undefined}
      */
-    publish_feedback(handle) {
-        assert.isNonNegativeInteger(handle, 'handle');
+    get frame_view() {
+        return this.#frame_view;
+    }
 
-        this.#feedback = handle;
+    /**
+     * The feedback buffer every view of a frame writes into, or null before the first frame and
+     * after {@link destroy}.
+     *
+     * @returns {GPUBuffer|null}
+     */
+    get feedback_buffer() {
+        return this.#feedback_buffer;
     }
 
     /**
@@ -365,12 +357,12 @@ export class GPUVirtualGeometryRuntime {
     }
 
     /**
-     * Open a frame: publish the page tables, size the feedback buffer against what is resident, and
-     * write the parameters every pass of every view will read.
+     * Open a frame: publish the page tables, lay the feedback buffer out for the views the frame is
+     * expected to have, and take slot 0 for the view it is rendered for.
      *
-     * The sizing happens here rather than at construction because one of its terms moves with
-     * residency — one touch bit per page-table row — and a frame is the coarsest granularity at
-     * which it holds still.
+     * The sizing happens here rather than at construction because two of its terms move — one
+     * touch bit per page-table row follows residency, and the slot count follows the most views any
+     * frame has cut in — and a frame is the coarsest granularity at which they hold still.
      *
      * **The pool's frame advances here, before the flush**, and not at `end_frame`. The frame
      * number is what stamps a page row's `visible_from` — the frame whose flush publishes the
@@ -379,34 +371,43 @@ export class GPUVirtualGeometryRuntime {
      * frame's reading, exactly (RUNTIME_PLAN_2026_09_14 §2.4). It is also the clock both tiers'
      * protect windows read, and it moves whether or not a readback is scheduled this frame.
      *
-     * **A frame has no projection.** It used to take one, and wrote it into a params buffer
-     * every view then shared — so a shadow cascade cut against whichever view opened the
-     * frame. `projection_k` is a property of a render target and a camera, which is to say of
-     * a view, and it lives on {@link VGeoViewCut} with the rest of what a view owns alone.
+     * **A frame has no projection and no graph.** Each view writes its own projection
+     * ({@link VGeoViewCut}), and each graph that cuts imports the feedback buffer itself
+     * ({@link feedback_in}).
+     *
+     * Opening a frame that is already open starts it again: a render that threw before closing its
+     * frame leaves nothing behind that the next one can be confused by.
      *
      * @param {Object} options
-     * @param {FrameGraph} options.graph
-     * @returns {number} the feedback resource
+     * @param {VGeoViewCut} options.view the view the frame is rendered for
+     * @returns {void}
      */
-    begin_frame({ graph }) {
-        assert.defined(graph, 'graph');
+    begin_frame({ view }) {
+        assert.defined(view, 'view');
 
         this.#pool.advance_frame();
         this.#pool.flush();
 
+        const slot_count = Math.min(this.#slot_high_water, SLOT_CEILING);
+
         this.#layout = vgeo_cut_feedback_layout({
             page_row_capacity: this.#pool.page_row_capacity,
             want_capacity: this.#want_capacity,
+            slot_count,
         });
 
-        const spawn = graph.add('vgeo/frame', {}, noop);
+        this.#ensure_feedback_buffer(this.#layout.word_count * 4);
 
-        this.#feedback = spawn.create('vgeo feedback', BufferResourceDescriptor.empty(
-            this.#layout.word_count * 4,
-            GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_SRC
-        ));
+        this.#imports.clear();
+        this.#cleared = false;
 
-        this.#graph = graph;
+        this.#slot_of.clear();
+        this.#slots = [];
+
+        this.#frame_view = view;
+        this.#frame_open = true;
+
+        this.slot_of(view);
 
         /*
          Nothing until an expansion site says what it was handed. Zero is the safe start: a kernel
@@ -415,8 +416,150 @@ export class GPUVirtualGeometryRuntime {
          */
         this.#instance_capacity = 0;
         this.#meshlet_capacity = 0;
+    }
+
+    /**
+     * @param {number} bytes
+     */
+    #ensure_feedback_buffer(bytes) {
+        const existing = this.#feedback_buffer;
+
+        if (existing !== null && existing.size >= bytes) {
+            return;
+        }
+
+        existing?.destroy();
+
+        // to the next power of two, so a tier filling a page row at a time re-makes it rarely
+        const size = Math.max(256, 2 ** Math.ceil(Math.log2(bytes)));
+
+        this.#feedback_buffer = this.#pool.device.createBuffer({
+            label: 'vgeo feedback',
+            size,
+            usage: GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_SRC | GPUBufferUsage.COPY_DST,
+        });
+    }
+
+    /**
+     * This frame's slot for a view, taking the next one the first time the view cuts in the frame.
+     *
+     * A view past the slots the frame was laid out for shares the last one — never slot 0, which is
+     * the frame's own view's — and the next frame is laid out with room for it. A shared slot's
+     * counters are the sum of its views', so its reading lands on each of them but escalates none
+     * (see `VGeoFeedbackLoop`).
+     *
+     * @param {VGeoViewCut} view
+     * @returns {number}
+     */
+    slot_of(view) {
+        assert.equal(this.#frame_open, true, 'a slot is a slot of an open frame');
+
+        const known = this.#slot_of.get(view);
+
+        if (known !== undefined) {
+            return known;
+        }
+
+        const requested = this.#slot_of.size;
+
+        this.#slot_high_water = Math.max(this.#slot_high_water, requested + 1);
+
+        const slot = Math.min(requested, this.#layout.slot_count - 1);
+
+        this.#slot_of.set(view, slot);
+
+        if (this.#slots[slot] === undefined) {
+            this.#slots[slot] = [];
+        }
+
+        this.#slots[slot].push(view);
+
+        return slot;
+    }
+
+    /**
+     * The tag a slot's view writes into the want stamps, unique to that view in this frame and never
+     * zero — see `VGEO_CUT_PARAMS_STRUCT.frame_tag`.
+     *
+     * @param {number} slot
+     * @returns {number}
+     */
+    frame_tag_of(slot) {
+        return ((this.#pool.frame * SLOT_CEILING + slot + 1) >>> 0) || 1;
+    }
+
+    /**
+     * This frame's views, by slot — what a reading of this frame's feedback is about. A copy, since
+     * the reading lands frames later and the table is rebuilt every frame.
+     *
+     * @returns {VGeoViewCut[][]}
+     */
+    frame_slots() {
+        return this.#slots.map(views => views.slice());
+    }
+
+    /**
+     * The feedback buffer as a resource of `graph`, at the version that graph last wrote.
+     *
+     * The first call for a graph imports the buffer into it; if no graph of this frame has yet, it
+     * also records the clear — the counters and the touch bits, which is everything a kernel adds
+     * to — so the first graph encoded is the one that clears, before anything of this frame writes.
+     *
+     * @param {FrameGraph} graph
+     * @returns {number} resource handle
+     */
+    feedback_in(graph) {
+        assert.equal(this.#frame_open, true, 'the feedback buffer is a buffer of an open frame');
+
+        const known = this.#imports.get(graph);
+
+        if (known !== undefined) {
+            return known;
+        }
+
+        const buffer = this.#feedback_buffer;
+
+        let handle = graph.import_resource(
+            'vgeo feedback', BufferResourceDescriptor.fromBuffer(buffer), buffer
+        );
+
+        if (!this.#cleared) {
+            const bytes = this.#layout.clear_word_count * 4;
+
+            const data = {};
+
+            const pass = graph.add('vgeo/frame clear', data, (data, resources, context) => {
+                context.encoder.clearBuffer(resources.get(data.feedback), 0, bytes);
+            });
+
+            handle = data.feedback = pass.write(handle);
+
+            this.#cleared = true;
+        }
 
-        return this.#feedback;
+        this.#imports.set(graph, handle);
+
+        return handle;
+    }
+
+    /**
+     * Hand back the version of the feedback resource a graph's expansion left behind.
+     *
+     * A FrameGraph resource is versioned: the handle an import produced is its first version, and a
+     * second expansion that wrote that version again after the first had produced a later one would
+     * be reading stale contents while claiming not to. The graph says so, loudly, and it is right to.
+     * So the runtime carries each graph's current version and each expansion publishes what it
+     * produced; the readback then reads the last one.
+     *
+     * @param {FrameGraph} graph
+     * @param {number} handle
+     * @returns {void}
+     */
+    publish_feedback(graph, handle) {
+        assert.isNonNegativeInteger(handle, 'handle');
+        assert.equal(this.#imports.has(graph), true, 'the graph never imported the feedback buffer');
+
+        this.#imports.set(graph, handle);
     }
 
     /**
@@ -427,10 +570,9 @@ export class GPUVirtualGeometryRuntime {
      * defaulted to 1 << 20 against a meshlet collection whose engine default is 2e5, so `vg_draw`
      * bounds-checked against a number five times the buffer it was writing into (REVIEW_LEDGER M6).
      *
-     * One params buffer serves the whole frame, so a frame with sites of different sizes takes the
-     * **minimum** — conservative, and the direction every other bound in the cut fails in. Written
-     * at record time, like everything else here, so the last value published before submit is what
-     * every pass of the frame executes against.
+     * A frame with sites of different sizes takes the **minimum** — conservative, and the direction
+     * every other bound in the cut fails in. Each view writes its params at record time from what
+     * has been declared so far, which is never more than its own site was handed.
      *
      * @param {Object} options
      * @param {number} options.instance_capacity records the VG instance buffer holds
@@ -465,29 +607,29 @@ export class GPUVirtualGeometryRuntime {
     }
 
     /**
-     * The graph this frame was opened on.
-     *
-     * A cut writes into the feedback resource `begin_frame` created, and a resource handle belongs
-     * to one graph — so a rasterization path running on a *different* graph inside the same frame
-     * (a shadow view builds its own) would be naming a resource that graph has never heard of. The
-     * seam checks this and skips, which is also design §9's position: one cut per view, and shadow
-     * cuts are out of scope for v1.
+     * Close a frame. Nothing may cut until the next opens; reading it is {@link VGeoFeedbackLoop}'s,
+     * which schedules the readback while the last graph is still being recorded.
      *
-     * @returns {FrameGraph|undefined}
+     * @returns {void}
      */
-    get frame_graph() {
-        return this.#graph;
+    end_frame() {
+        this.#frame_open = false;
+        this.#imports.clear();
     }
 
-
     /**
-     * Close a frame. The feedback resource stops being valid; reading it is
-     * {@link VGeoFeedbackLoop}'s, which schedules the readback while the graph is still being built.
+     * Release the feedback buffer, which is the one device resource this makes, and close whatever
+     * frame is open so that nothing cuts into the buffer afterwards.
+     *
+     * The pool is not this runtime's to release: it was handed one, and whoever made it tears it
+     * down — after this, since a frame of this runtime writes into the pool's tables.
      *
      * @returns {void}
      */
-    end_frame() {
-        this.#feedback = -1;
-        this.#graph = undefined;
+    destroy() {
+        this.end_frame();
+
+        this.#feedback_buffer?.destroy();
+        this.#feedback_buffer = null;
     }
 }

package/src/shade/renderer/geometry/virtual/runtime/REVIEW_LEDGER.md

@@ -214,6 +214,36 @@ Two things this pass could not prove below the drive, written down rather than c
   reaches the residency manager and that a page arriving after an abort installs nothing. It cannot
   prove that a host tears the loop down, because there is one host and it is a demo. This is M12's
   shape exactly, and it stays open until an engine-side owner exists.
+
+  **Closed, in two halves (2026-09-28).** *Ownership*, `28035083b`: the scene context constructs the
+  loop and the renderer opens and closes each VG frame (SHADOW_PLAN_2026_09_28 §2.1). *Teardown*,
+  `7a9e14fea`: `GPUSceneContext.destroy()` releases everything `enable_virtual_geometry` built, in
+  dependency order — the loop and the residency, the fetcher and its workers (the context made it,
+  so the residency never released it), then the runtime's feedback buffer (through the runtime's
+  new `destroy()`) and the pool — idempotently, and as a no-op when VG was never enabled. The
+  scene's own TLAS, volumetrics, volumetric light map and probe-volume mesh BVH were not released
+  either way, which was not VG's and predated it; `fab3fd38e` (2026-09-29) releases them, and
+  `3685e5bec` stops the scene's teardown giving its rows back one at a time. The hosts' `pagehide`
+  stops the frame loop and destroys the renderer and then its device, and nothing VG-specific
+  (`87add5e70`, `f9107e835`).
+
+  What it took besides, each red first:
+  - `c3fe2bf3f`: a fetch still queued in the residency's gate started after its container was
+    unregistered, and behind a destroyed fetcher it spawned the worker pool again.
+  - An adversarial review of the above found four more. `e82476c26`: a reading in flight at
+    teardown landed on destroyed views and an emptied residency, or was logged as a failed readback;
+    a destroyed loop now drops it. `1beafcb9e`: a throw partway through `enable_virtual_geometry`
+    left a runtime with no loop, and `destroy()` then threw before the rest of the scene; the four
+    are installed together now. `3d241c331`: a destroyed fetcher's next `fetch()` spawned the pool
+    again; it refuses now. `f9107e835`: the hosts released neither the loop nor the device.
+
+  Tested by `scene/GPUSceneContext.destroy.spec.js` (buffers on the software device, aborted reads,
+  terminated workers, a failed enable, a second destroy) and the residency, loop and fetcher specs'
+  own tests. Each teardown call removed in turn turns a spec red except the scene's call to the
+  loop's `destroy()`: the scene spec schedules no reading, and the loop's spec is what holds that
+  method. Tier 4: `vgeo_runtime` under headless Chrome, 126 frames and 7 worker fetches in, a
+  `pagehide` left no VG, no feedback buffer, no resident page, nothing in flight and a frame counter
+  that stopped.
 - **U2 — nothing below the drive executes a cut through the seam.** The software device runs copies
   and not shaders, so `graph_vgeo_expand.spec.js` proves what the seam *records* — the passes, the
   resource behind each handle, the version chain, the capacities that reach the runtime — and

package/src/shade/renderer/geometry/virtual/runtime/RUNTIME_PLAN_2026_09_14.md

@@ -258,7 +258,10 @@ reader keeps decode, its page map, and quarantine.
 `GPUSceneContext.enable_virtual_geometry` constructs the pool, the runtime, **and the residency and
 the feedback loop** *(rev 2)*, from an options object with a `residency` key rather than one
 spread; the playground stops building any of them and wires only the two frame extensions. That
-closes REVIEW_LEDGER U1: an engine host gets the loop by enabling virtual geometry.
+closes REVIEW_LEDGER U1: an engine host gets the loop by enabling virtual geometry. *(2026-09-28:
+construction only — hosts still drove the frame and tore the loop down by hand. The engine drives
+it since SHADOW_PLAN_2026_09_28 §2.1, `28035083b`, and releases it since `7a9e14fea`; REVIEW_LEDGER
+U1 records both.)*
 
 ### 4.1 State