@woosh/meep-engine 3.60.4 → 3.60.5

package/src/shade/renderer/geometry/virtual/runtime/REVIEW_LEDGER.md

@@ -1,308 +0,0 @@
-# Virtual Geometry runtime — review ledger
-
-An adversarial review of `runtime/` on 2026-09-11, immediately after it was written. Twelve
-reviewers over disjoint dimensions, every non-nit finding attacked by three verifiers (refute /
-reproduce / scope) and kept only if two failed to refute it, then a completeness critic and a second
-pass on the gaps it named. 251 agents, 61 survivors, ~35 distinct after the critic's dedup.
-
-**Worked to closure on 2026-09-12, and the closure re-checked the same day.** Every C and M row
-below is closed or reclassified against the commit that closed it. Twenty-one reintroductions of
-those defects are now caught by the spec their row cites, run mechanically, one at a time: ten were
-when the campaign ended, and the other eleven are the re-review's work. See
-[Re-review 2026-09-12](#re-review-2026-09-12) for what the first pass claimed that was not true —
-including one defect that was still live — and for the two things it could not prove below the
-headless drive, which are written down there rather than counted as closed. The status column is
-the record; the prose under each section is what it cost to get there.
-
-| | |
-|---|---|
-| `90b0b4b46` | fixed-stride page slots, and a tier that answers its own activation question |
-| `7d993a083` | the collect pass gets an oracle, and four defects with it |
-| `51b9d9cdc` | the feedback loop gets a spec, and stops being three kinds of wrong |
-| `6fa44985f` | the prose catches up with the code |
-| `61cee96b6` | the singular-instance guard was a test of the wrong number, and only worked axis-aligned |
-| `88f92a07c` | eight closures that no spec could have noticed being undone, and three that were wrong |
-
-**What the campaign changed about the shape of the thing**, rather than about a line of it:
-
-1. **The VRAM tier answers its own residency questions.** Selectability, the bytes an eviction
-   refunds, and eviction's child rule were each taken from the *RAM* tier, and each is a different
-   answer over a different set. C1 is the one that broke the guarantee the whole design is arranged
-   around, and the fix is not a patch to the publisher — it is the group row carrying its parent
-   count so the rule can be evaluated where the residency it is about lives.
-2. **Fixed-stride page slots**, which DESIGN §6 asked for and FORMAT §11.14 finally permitted. Four
-   defects stopped existing, the page table stopped being a binding, and the traversal came down
-   from nine storage buffers to eight against the engine's floor of ten.
-3. **A readback is about a frame that has gone.** The layout it is decoded with and the identity of
-   every page row it names belong to that frame; both are snapshotted when the reading is scheduled.
-4. **The proof tiers are not interchangeable.** Nothing below the headless drive exercises the
-   engine-integration path, and 18,569 green specs did not notice the playground failing to boot.
-   The drive is a required check, and it reproduces the README's numbers on a real adapter after
-   every change here.
-
----
-
-## Critical
-
-| id | defect | status |
-|---|---|---|
-| C1 | **Selectability was a RAM-tier answer; the cut descends the VRAM tier.** `#refresh_selectable` published `reader.is_selectable(page, group)` — true when the ancestor cone is in *RAM* — into the flag `vg_group_selectable` reads, while descent is gated on `vg_lookup`, which is *VRAM* and a strict subset. So a group could be flagged selectable while a page holding one of its parents had no row, and that parent's own ancestor clamped and drew a coarse stand-in over the same surface. Reachable three ways on the normal path: a refused install, the feedback loop's per-frame promotion budget, and evicting a parent page while its child is not yet resident. Reproduced against the real kernels: 18 drawn ancestor/descendant pairs. | **closed** `90b0b4b46` — the group row carries `group_parent_count`, and `VGeoRuntimeTables.refresh_selectable` computes the rule over this tier's arena and lookup with no reader involved. The agreement spec gained a `vram_withheld` set and a fixpoint oracle over an arbitrary residency set; it was red on the old code |
-| C2 | **`MESHLET_BASE` was cached across a meshlet-pool compaction.** A page row stores `batch.metadata.offset`; `GPUMeshletManager.compact()` relocates allocations and fires `record.changed`. The pool subscribed to nothing, so after a compaction every VG page row pointed at another page's clusters — silently, and undetectably from inside the runtime, because every index involved is still in range. | **closed** `90b0b4b46` — the pool subscribes per batch and republishes the slot's `MESHLET_BASE`. **Not a defect of the arena's allocator**, as the note below claimed: it is the *meshlet* pool's compaction, and fixed slots do nothing about it |
-| C3 | **`#ensure_arena` tested total capacity, not free space**, so a full-but-large arena never grew and `install` then threw and was refused forever. The second clause grew on *byte* pressure, which arena pressure does not follow. And `arena_word_ceiling` defaulted to 1<<26 words = 256 MiB against a 128 MiB default binding limit, so the last doubling threw in `#create`. | **gone** `90b0b4b46` — there is no arena growth. The arena is `page_capacity` slots from the first frame to the last, and the binding limit is checked once at construction |
-| C4 | **`resident_bytes` drifted upward permanently.** `evict()` subtracted `page?.decoded_size ?? 0`, re-derived from the RAM reader; if the RAM tier had dropped that page the subtraction was zero, and the VRAM budget then refused every install forever. | **closed** `90b0b4b46` — the slot header carries `DECODED_SIZE`, so the tier that charged the budget refunds the number it charged |
-| C5 | **The feedback readback was parsed with the wrong frame's layout.** `#apply` re-read `runtime.feedback_layout`, but `begin_frame` recomputes it every frame from `page_row_capacity` and `lookup_word_count`, both of which move as pages install. A readback landing a frame or two later decoded with bases that had shifted — wants and touches read out of the stamp region. | **closed** `51b9d9cdc` — the layout is closed over in `read()`, and `VGeoFeedbackLoop.spec.js` grows the tier underneath an outstanding reading |
-| C6 | **Two `.vgeo` assets collapsed onto one geometry record.** `VirtualGeometry` inherited `MeshletGeometry`'s `hash()`/`equals()`, which are `this.meshlets.hash()` over an **empty** `MeshletBatch`. `GPUGeometryManager.add` keys `#records_by_content` by content, so the second VG asset registered became another name for the first's record and drew the first's cut. | **closed** `51b9d9cdc` — identity is the container. `VirtualGeometry.spec.js` holds two assets to two rows, and two handles on one reader to one |
-| C7 | **The seed kernel trusted `ROOT_PAGE_ROW`, guarded only by a stripped assert.** `register()` used `assert.notEqual(page_row, -1)`, and this engine strips `assert.*` in the shipped build, so a failed root install left `VGEO_PAGE_ROW_NONE` in the geometry row; the seed kernel read it as a u32 index and the multiply wrapped into a live stat word. | **closed** `90b0b4b46`, the kernel half tested `88f92a07c` — `register` throws and rolls the geometry back, and the kernel checks the sentinel in one compare that no build strips. The compare itself had no test: the agreement spec now runs the seed pass alone against a record carrying the sentinel, and asserts nothing is enqueued, nothing is claimed and not one word of the frame's counters moves |
-
-## Major — correctness
-
-| id | defect | status |
-|---|---|---|
-| M1 | **Plane 4 was the far plane, not the near one.** The collect pass extracted `row_w + row_z`; the engine's own `construct_frustum_planes` uses `w − z` for near under reverse-Z, and `w + z` is the degenerate row an infinite projection makes useless. | **closed** `7d993a083` — a sign, and a test that holds all five planes against `Camera.construct_frustum_planes` on the same matrix rather than re-deriving them |
-| M2 | **Frustum culling is on by default and was tested by nothing.** `cull_enabled = true`; the agreement spec ran only with it off. M1 shipped precisely because the default path had no oracle. | **closed** `7d993a083` — it cannot be compared to the CPU cut, because a culled node leaves a real hole, so it is held to §4.4's claim instead: culling removes only clusters whose own sphere is outside the frustum, and never one inside it |
-| M3 | **A singular instance transform produced a NaN eye**, and NaN makes every comparison in `vg_project` and the frustum test fail *open* — one zero-scaled instance drew its whole resident set. | **closed** `61cee96b6`. `7d993a083` tested the smallest singular value, which is a degeneracy test in exact arithmetic and not in f32 — it closed the axis-aligned flatten the spec used and left the rotated one open, NaN eye and all, for thirty-six of forty. The test is the **determinant** now, which is the number `mat4_inverse` divides by and is exactly zero at every rotation |
-| M4 | **The scale correction was not conservative under shear.** `max/min` of the column lengths is not the singular-value ratio; under shear it under-refines, which three comments and two docs called conservative. | **closed** `7d993a083` — `chunk_mat3_singular_values`, closed form, and **exactly 1** for a uniform scale, which a conservative bound would not have been |
-| M5 | **The instance slot was an unbounded `atomicAdd` with no capacity check anywhere.** Every other append in the cut is bounded; this one was missed. | **closed** `7d993a083` — bounded and counted. As the seam is wired it cannot fire, and that is recorded where the check is: the invariant is a call away and the buffer is made here |
-| M6 | **`meshlet_capacity` was a frame-scoped constant (1<<20) unrelated to the collection the cut writes into** — the engine's default is 2e5, so `vg_draw` bounds-checked against five times the buffer it was writing into. | **closed** `7d993a083`, the seam half tested `88f92a07c` — both capacities are declared by the expansion site that was handed the collections, and a frame with several sites takes the minimum. The campaign tested the runtime's minimum and not the declaration, so deleting the call from the seam left the suite green |
-| M7 | **A broken `child_ref` resolved to page index 0** in `vgeo_runtime_write_page_block` and the cluster was silently dropped, where the CPU reference draws it as a leaf and counts it. Page 0 is the root, which is pinned and therefore always resident. | **closed** `90b0b4b46` — it becomes a leaf and is counted, as `vgeo_select_cut` does with the same input |
-| M8 | **Queue overflow and `max_iterations` exhaustion were silent** — the one degradation the design admits costs holes rather than coarseness, and the counters RUNTIME_PLAN promises for it did not exist. | **closed** `51b9d9cdc` for the kernel, `88f92a07c` for the seam — `QUEUE_REMAINING` and `WAVEFRONTS`, the first left behind by one extra prepare pass the seam records after the wavefront loop. That pass was bound to `queue_a`, which holds the produced work only when the iteration count is even; at an odd `max_iterations` it reported the count of work already done and zeroed the count of what was left. The loop carries the roles rather than the buffers now. Measured on a device: fourteen wavefronts at τ = 0.5, nothing outstanding at any threshold |
-| M9 | **`evictable()`'s child rule disabled itself when the RAM page was gone**, orphaning VRAM-resident children under an evicted parent. | **closed** `90b0b4b46` — the rule reads this tier's own arena, so a page whose RAM copy has gone still knows its VRAM children |
-| M10 | **A recycled page row was resolved with no identity check.** Feedback is at least a frame behind; a row freed and re-used between the cut and the readback makes a want whose page index and byte range come from different pages, and a touch that reroutes both tiers' LRU to the wrong page. | **closed** `51b9d9cdc` — `VGeoRuntimeTables.generation_of(row)`, snapshotted when the reading is scheduled and compared when it lands. CPU-side, which is where it belongs: nothing on the device needs it |
-| M11 | **`install_wants` was fire-and-forget** — no `AbortSignal`, no limit, no cross-frame dedup, and an empty catch. The shared `ConcurrencyGate` accumulated stale closures and the RAM budget was charged once per frame per still-wanted page. | **closed** `51b9d9cdc` and `88f92a07c`. Four parts, one of which had a test: the dedup. Of the other three, two were also wrong. The limit was documented "across every reader" and applied per reader, so a frame seeing eight assets issued eight times it — one budget now, ranked across readers because a want's priority is pixels of error and comparable across assets. The failure report sat on a `.catch` and a failed fetch never arrives as one: `VGeoResidencyManager` catches it per page, because the cut stands without any page — so it reads the reader's quarantine now. The signal was right and unexercised; `destroy()` is the verb, and see U1 for who calls it |
-| M12 | **Nothing advanced the RAM tier's clock outside the playground.** `VGeoResidencyManager.advance_frame()` had exactly one non-spec caller, so in any real host the protect window never moved and `evict_to_budget` was a permanent no-op. The RAM tier was unbounded. | **closed** `51b9d9cdc` — `VGeoFeedbackLoop.read` winds it, before its own early returns: a frame whose feedback is skipped is still a frame |
-| M13 | **Every shadow-map face ran a full cut at the main camera's projection scale.** `GPUSceneShadowmapContext` calls `graph_rasterize_scene_fast_raw`, which carries the seam; the shadow graph is a different `FrameGraph`, so `runtime.feedback` is a cross-graph handle there. | **closed** `7d993a083`, tested `88f92a07c` — the runtime records the graph its frame was opened on and the seam skips any other. The campaign's test compared `runtime.frame_graph` to a graph, which is the getter and not the check; `graph_vgeo_expand.spec.js` calls the seam on a second graph and holds it to recording no passes at all |
-| M14 | **Alpha-tested and transparent VG instances are silently invisible**, and DESIGN §9 — cited in the code as the authority for it — did not say so. | **closed** `51b9d9cdc`, tested `88f92a07c` — §9 says it now, and `GPUSceneRows.attach_mesh` says it out loud when such a mesh is attached. Held to the console the way `cloth_collision.spec.js` and `cloth_rig.spec.js` hold theirs: a real `.vgeo` container, a blended material, and the warning read where it is written. The path itself stays out of scope: the bucket path is handed a scene and a camera resource, not a view context |
-| M15 | **No unregister or teardown anywhere.** Geometry rows, lookup allocations, pinned root pages, meshlet batches and all four GPU buffers leaked; `#geometry_allocations` was written and never read. | **closed** `90b0b4b46` — `GPUVirtualGeometryPool.unregister` gives back pages, batches, the lookup block and the row, and `destroy` runs it for every registered container. Geometry rows are recycled too |
-| M16 | **Arena growth mutated the shadow before the buffer existed** — `grow_arena` then `#create`, so a create that exceeded the binding limit left shadow and device permanently desynchronized. | **gone** `90b0b4b46` — with C3 |
-| M17 | **A full page-row table never triggered eviction** — `#make_room` looped on bytes only, so row exhaustion was a permanent cliff independent of the budget. | **closed** `90b0b4b46` — slots and rows are the same thing now, and `#make_room` evicts on whichever budget is short |
-| M18 | **Defaults were far short of the design's scale.** `claim_word_capacity` (1<<14 words) covered ~0.5 M (instance, page) pairs — 512 instances of a 1,024-slot tier — against the design's thousands of instances × thousands of pages. | **closed for the claim, reclassified for the queue** `51b9d9cdc`, tested `88f92a07c`. `claim_word_capacity` is derived from the pool's own capacity and a stated `visible_instance_hint`, so it follows the tier it indexes into. `queue_capacity` is left where it is and the reason is written down: the worst case is unbounded, a queue is two buffers of `capacity × 16` bytes per expansion site, and running out is no longer silent — `QUEUE_REMAINING` is non-zero exactly when it costs a hole |
-
-## Major — the proof was weaker than it looked
-
-The agreement spec is the campaign's central claim. It is a real test and it did constrain the
-kernel, but it proved less than RUNTIME_PLAN §7 said.
-
-| id | defect | status |
-|---|---|---|
-| P1 | Every assertion was conditioned on **VRAM set == RAM set** — `residency_to_tables` mirrored the reader exactly — which is the one state the pool does not maintain, and is why C1 was invisible to it. | **closed** `90b0b4b46` — `vram_withheld`, a fixpoint oracle over an arbitrary residency set, and a direct antichain assertion that needs no oracle at all: no drawn cluster is a descendant of another |
-| P2 | `shader_vgeo_cut_collect`, the **only producer of the instance record**, was compile-only. The spec fabricated the record it would have written, so M1, M3, M4 and M5 were all outside its reach. | **closed** `7d993a083` — it runs under the emulator against a scene database built through `SceneManager`, and the cut selected from its own record is held to `vgeo_select_cut` |
-| P3 | Every test registered **exactly one** VG geometry, so `lookup_base` was always 0 and every use of it a verified no-op. | **closed** `7d993a083` — two containers in one tier, each held to its own oracle |
-| P4 | The device-facing half — `VGeoFeedbackLoop`, `GPUVirtualGeometryRuntime`, the seam — **had no spec at all**. | **closed** `51b9d9cdc` for the first two, `88f92a07c` for the third — `VGeoFeedbackLoop.spec.js` is a real frame graph, a readback that lands, and a feedback image written the way the kernel writes it. Its three seam tests read the runtime's getters and never called the seam, so P4 was closed with a third of it still untested; `graph_vgeo_expand.spec.js` records the seam and asserts what came out |
-| P5 | Every overflow and degradation branch was **provably dead** in the suite, so §4.5's "degrades in one direction" was untested. | **closed** `7d993a083` — draw records, the wavefront queue and the want list are each driven to their bound, and each shown to lose work rather than invent it or write past the end |
-| P6 | The blocked-group search's guard rejected nothing, so **which case it exercised was chosen by the kernel under test**. | **closed** `7d993a083` — a candidate has to be a page the traversal still enters *and still draws from another group of*, which is the mixed page the own-group term exists for. A page with one drawn group can never be one |
-| P7 | RUNTIME_PLAN §7's step-4 row claimed the seam was proved by "4,667 engine specs green" — those specs exercise **no line** of the seam. | **closed** `6fa44985f`, and again `88f92a07c` — the row says so, and names the tier that does exercise it. A row of a proof table has to name a test that would go red |
-
-## Major — claims in prose the code did not honour
-
-All eight corrected in `6fa44985f`, except where a commit is named.
-
-- **D1** §4.7/§4.5 named queue-exhaustion counters that did not exist — they exist (`51b9d9cdc`), and
-  §4.5 now says which reading means a hole.
-- **D2** §6 described the agreement fixture as the very fixture that cannot exercise its headline
-  case. It is built at 64 KB, and §6 records the measurement: at 8 KB this torus puts one group in
-  every page, so no page is ever mixed and the own-group term is unreachable.
-- **D3** "all four expansion sites" — three did. §5 says three, names the fourth, and points at
-  DESIGN §9 for why it is not four.
-- **D4** §4.5 claimed FORMAT §10's in-flight pin was closed; nothing pins anything and §10 still
-  marks it open. Both documents now say the same thing: the cut names the source page, which is what
-  §10 was blocked on, and the pin itself is not implemented.
-- **D5** §4.9's binding list named `stamps`, which is a *region of* `feedback` rather than a buffer,
-  and omitted `vg_lookup`, which the descent is gated on. Corrected, and
-  `vgeo_cut_shaders.compile.spec.js` asserts the exact count of every kernel so the list cannot
-  drift again.
-- **D6** `grow_arena`'s comment described a 9/8 margin the code never applied to a request — gone
-  with `grow_arena` (`90b0b4b46`).
-- **D7** VGEO_FORMAT said the reader decodes neither the node table nor the metric. It decodes both;
-  the node table has a consumer and the metric does not, for the reason §4.8 gives.
-- **D8** the reader's documented per-page RAM overhead, and §2's own measurement gate, which was
-  never discharged. Measured and tabled in §2: **six per cent of the decoded bytes**, flat across
-  page size, 0.2–33.9 KB per page at 544 KB pages. The audit's "6.4–11.9 KB" is the mean of that
-  distribution and not its range.
-
-## What the review itself got wrong
-
-Recorded because the next reviewer will otherwise repeat it.
-
-- **The range was wrong, and more wrong than it looked.** Reviewers were given
-  `git diff master..HEAD` — a two-dot, tip-to-tip diff — while master had moved past the merge base
-  (`f07c9f741`). Master's own work was reported as this branch's regressions, including an apparent
-  version downgrade and two "re-introduced" dangling doc links. By the next day master was
-  **thirty-six** commits ahead, not the three the review counted, and had deleted the scene graph.
-  Use `master...HEAD` or `$(git merge-base master HEAD)..HEAD`, and take the count at the moment you
-  read it — in this repo it is stale within the day.
-- **Nobody was pointed at the integration target.** Master's newest commit added a per-row generation
-  token for exactly the recycled-row identity hazard M10 describes. A reviewer looking at what this
-  branch must merge into would have found the shape of the fix already written.
-- **Twelve dimensions, all spatial.** They partition the code by subsystem and by one-shot
-  correctness. None asked what happens on the hundredth frame or under a moving camera — the regime
-  a streaming LOD runtime exists for. The second pass caught some of it; it should have been in the
-  first.
-- **Two verifier failures.** A refutation of M12 contradicted a one-line grep, and the shadow-path
-  defect (M13) was refuted twice and confirmed once as minor. Three verdicts on one fact means none
-  of them is a verdict. M13 was re-checked on 2026-09-12 and stood.
-- **Nobody asked what the change did not use.** Twelve reviewers audited the code that exists; none
-  asked which engine primitive it re-implemented. A "what should this have reused" lens belongs in
-  the next sweep — and see the two notes below for how that lens went wrong when it was finally
-  applied.
-- **The C2/C3/M16/M17 grouping was half right.** "They are what the arena's `OffsetAllocator` costs"
-  is true of C3, M16 and M17 and false of C2, which is `GPUMeshletManager.compact()` relocating a
-  batch and has nothing to do with the VG arena. Converting to slots closed three of the four and
-  left C2 exactly where it was; it took a subscription to the meshlet pool's own `changed` signal.
-- **The `GPUDatabase` note's binding claim was wrong, and the conclusion was right for another
-  reason.** "A database binds as one `array<u32>`, so `vg_pages` + `vg_geometries` collapse to one"
-  — but `vg_geometries` is bound by the *collect* pass and `vg_pages` by the *traversal*, which are
-  different shaders with different budgets, so collapsing them buys the traversal nothing. What
-  actually bought the binding was folding the page header into its own arena slot, which is a
-  consequence of the fixed-stride conversion rather than of adopting a table.
-
-  `GPUTypedTable` was **not** adopted for the page or geometry rows, and the rest of the case for it
-  does not survive the conversion either. Its partial-write path stages into an upload buffer and
-  scatters with a compute pass, where a slot install is one contiguous `writeBuffer` of one range;
-  its paged growth is the growth DESIGN §6 asks this tier not to have; and `track_generations()` is
-  ten lines when the table is one array you own. What the note was right about is that the
-  generation token was the answer to M10, and that nobody had looked.
-
----
-
-## Re-review 2026-09-12
-
-The campaign above closed every C and M row and claimed each one had been "red first against a
-reintroduction of exactly its own defect". That claim was checked the way it is written: reintroduce
-one defect, run the spec the row cites, restore, next. Twenty-one reintroductions, one at a time,
-scripted rather than done by hand so that the filter is proved to select real tests on the clean
-tree before the edit is applied — a name filter that matches nothing fails the run for the wrong
-reason and reads exactly like a catch.
-
-**Ten went red. Eleven did not**, and one of the eleven was not a testing gap at all: it was the
-defect, still there, closed against the one case that could not see it.
-
-| # | what the first pass got wrong | closed by | proved by |
-|---|---|---|---|
-| 1 | **M3 was closed for an axis-aligned zero scale only, and the defect was live.** `!(σ_min > 0)` is a degeneracy test in exact arithmetic. In f32 it holds only on the closed form's diagonal branch, which is the branch `placed([0, 0, 0], [1, 0, 1])` takes. Rotate the flatten and the trigonometric branch computes σ_min as a difference of nearly equal numbers, with an absolute error of about `sqrt(eps_f32)·σ_max ≈ 3.4e-4` — an f32 model of the chunk over four thousand rotated flattens puts the worst σ_min/σ_max at 3.7e-4, which is why a relative threshold cannot be set safely (see below). Of forty rotated zero-scale instances under the emulator, **thirty-six were not dropped**, every one with a NaN eye, the largest projection scale reaching the traversal at **6.2e10** against an intended 540. | `61cee96b6` | agreement spec (emulator) |
-| 2 | **The seam had no spec.** P4 was closed against `VGeoFeedbackLoop.spec.js`, whose three seam tests read `runtime.frame_graph`, `runtime.meshlet_capacity` and `runtime.instance_capacity` and never call `graph_vgeo_expand_if_enabled`. Deleting the graph check (M13) or the `declare_collections` call (M6) left the whole suite green. | `88f92a07c` | `graph_vgeo_expand.spec.js` (software device) |
-| 3 | **M8's seam half was a live bug, found by writing that spec.** The extra prepare pass exists for one number and the seam bound it to `queue_a`, which holds the produced work only when the iteration count is even. At an odd `max_iterations` it reported the count of work already done and zeroed the count of what was left — `QUEUE_REMAINING`, the one reading that means a hole. | `88f92a07c` | `graph_vgeo_expand.spec.js`, both parities |
-| 4 | **C7's kernel compare had no test.** The host half was covered; deleting the sentinel compare from the seed kernel left the suite green. | `88f92a07c` | agreement spec (emulator) |
-| 5 | **M11 had one test for four parts, and two of the other three were also wrong.** The frame limit is documented "across every reader" and was applied per reader. The failure report sat on a `.catch`, and a failed fetch never arrives as a rejection — `VGeoResidencyManager` catches it per page, because the cut stands without any one page — so the sentence the fix claimed ("a reader that has quarantined everything asked of it is a fact somebody has to be able to see") was still false. The `AbortSignal` was correct and unexercised. | `88f92a07c` | `VGeoFeedbackLoop.spec.js` |
-| 6 | **M18 had no test.** Putting `1 << 14` back left the suite green. | `88f92a07c` | `VGeoFeedbackLoop.spec.js` |
-| 7 | **M14 had no test.** Replacing the warning's condition with `false` left all 163 scene specs green. | `88f92a07c` | `GPUSceneRows.spec.js`, reading the console the way the cloth specs read theirs |
-| 8 | **The commit table cited a hash that is not in the history.** `c5fc435f0` is a dangling pre-amend of `6fa44985f` — same parent, three lines of this file apart, no branch containing it. It would have resolved on this machine and nowhere else. | this commit | `git branch --contains` |
-| 9 | **RUNTIME_PLAN §6 tier 3 still listed "the arena's growth"** among what the software device exercises. There has been no arena growth since `90b0b4b46` (C3). | this commit | reading it |
-
-And one thing the first pass fixed too weakly. P7 replaced "4,667 engine specs green" with the
-headless drive, which is closer and still not a test that goes red on one line: the drive is a
-whole-system check on one adapter that cannot be run per commit, and finding 3 above is exactly a
-seam defect its six numbers do not move — `max_iterations` defaults to 64, which is even.
-RUNTIME_PLAN §7's step-4 row names `graph_vgeo_expand.spec.js` now, and the drive stays what it is.
-
-**The drive was re-run after both commits** — the collect kernel's guard is a shader change and the
-seam's queue bookkeeping is a seam change — on the nvidia/lovelace adapter, and every row of
-`playground/vgeo_runtime/README.md`'s τ table is identical: 50/31/18/17/9/8 clusters drawn over
-9/8/6/6/5/5 pages, nothing clamped, 14/14/11/11/8/8 wavefronts, nothing left queued. Residency
-settles at 9 of 13 pages and 230 KB. `determinant()` therefore compiles and runs under Dawn as well
-as under the emulator, which is the only tier that can say so.
-
-### Not closed, recorded
-
-Two things this pass could not prove below the drive, written down rather than counted as closed.
-
-- **U1 — `VGeoFeedbackLoop` has no engine-side owner, so its teardown has nowhere to be wired.**
-  `abort()` had no caller anywhere in the tree, and the reason turns out not to be an oversight in
-  a teardown path: nothing in the engine constructs a feedback loop at all.
-  `GPUSceneContext.enable_virtual_geometry` hands back a runtime and a pool, and the host is
-  expected to build the loop over them — so the whole population of hosts is
-  `playground/vgeo_runtime/`, which now calls `destroy()` on `pagehide`. The spec proves the signal
-  reaches the residency manager and that a page arriving after an abort installs nothing. It cannot
-  prove that a host tears the loop down, because there is one host and it is a demo. This is M12's
-  shape exactly, and it stays open until an engine-side owner exists.
-
-  **Closed, in two halves (2026-09-28).** *Ownership*, `28035083b`: the scene context constructs the
-  loop and the renderer opens and closes each VG frame (SHADOW_PLAN_2026_09_28 §2.1). *Teardown*,
-  `7a9e14fea`: `GPUSceneContext.destroy()` releases everything `enable_virtual_geometry` built, in
-  dependency order — the loop and the residency, the fetcher and its workers (the context made it,
-  so the residency never released it), then the runtime's feedback buffer (through the runtime's
-  new `destroy()`) and the pool — idempotently, and as a no-op when VG was never enabled. The
-  scene's own TLAS, volumetrics, volumetric light map and probe-volume mesh BVH were not released
-  either way, which was not VG's and predated it; `fab3fd38e` (2026-09-29) releases them, and
-  `3685e5bec` stops the scene's teardown giving its rows back one at a time. The hosts' `pagehide`
-  stops the frame loop and destroys the renderer and then its device, and nothing VG-specific
-  (`87add5e70`, `f9107e835`).
-
-  What it took besides, each red first:
-  - `c3fe2bf3f`: a fetch still queued in the residency's gate started after its container was
-    unregistered, and behind a destroyed fetcher it spawned the worker pool again.
-  - An adversarial review of the above found four more. `e82476c26`: a reading in flight at
-    teardown landed on destroyed views and an emptied residency, or was logged as a failed readback;
-    a destroyed loop now drops it. `1beafcb9e`: a throw partway through `enable_virtual_geometry`
-    left a runtime with no loop, and `destroy()` then threw before the rest of the scene; the four
-    are installed together now. `3d241c331`: a destroyed fetcher's next `fetch()` spawned the pool
-    again; it refuses now. `f9107e835`: the hosts released neither the loop nor the device.
-
-  Tested by `scene/GPUSceneContext.destroy.spec.js` (buffers on the software device, aborted reads,
-  terminated workers, a failed enable, a second destroy) and the residency, loop and fetcher specs'
-  own tests. Each teardown call removed in turn turns a spec red except the scene's call to the
-  loop's `destroy()`: the scene spec schedules no reading, and the loop's spec is what holds that
-  method. Tier 4: `vgeo_runtime` under headless Chrome, 126 frames and 7 worker fetches in, a
-  `pagehide` left no VG, no feedback buffer, no resident page, nothing in flight and a frame counter
-  that stopped.
-- **U2 — nothing below the drive executes a cut through the seam.** The software device runs copies
-  and not shaders, so `graph_vgeo_expand.spec.js` proves what the seam *records* — the passes, the
-  resource behind each handle, the version chain, the capacities that reach the runtime — and
-  nothing about what a pass callback binds when it runs. Renaming a binding, or swapping two buffers
-  of the same type inside one `bindings` object, would pass every spec in this tree and fail only at
-  tier 4. That is the same gap P4 was about, one level in, and the drive is the only thing that
-  covers it.
-
-### What this pass got wrong, or nearly did
-
-- **A reintroduction script has to prove the clean run first.** The first version applied the edit,
-  ran the spec, and called a non-zero exit RED. A mistyped `-t` filter matches no tests, exits
-  non-zero, and reads as a catch — which would have certified rows that no test touches, which is
-  the exact failure being investigated. Every row now runs clean-then-dirty and reports the clean
-  pass count beside the verdict.
-- **The obvious fix for M3 was the wrong one.** A relative threshold — drop when
-  `σ_min / σ_max < eps` — is what the arithmetic seems to ask for, and it cannot be set safely: the
-  noise reaches 3.7e-4 of σ_max in a four-thousand-sample f32 model and a legitimately flat instance
-  (a plate a thousand times wider than it is thick) sits at 1e-3, so any threshold with real
-  headroom over the noise also drops real geometry. The determinant has no such tension, because it is not an estimate of anything — it is the number the
-  inverse divides by, and it is exactly zero for a flattened instance at every rotation.
-- **`max_wants_per_frame` was the second option in this tree documented as a global budget and
-  implemented as a per-reader one.** `VGeoResidencyManager`'s own doc records the first being
-  measured at 48 concurrent range requests against a cap of six, and that is why its gate is shared.
-  Worth a grep the next time a limit is added: the reader-shaped one is the easy one to write.
-
-## 2026-09-14 — the remainder counter never worked
-
-`QUEUE_REMAINING` read zero at every iteration budget, including the ones where the descent drew
-nothing at all. M8 added the counter and a spec for it, and both were right about a frame with one
-cut in it; the engine has never recorded a frame with one cut in it.
-
-Measured on `zorah-2026-13-09/bdf6f9615ae672d54bfb70cde904f5c2.vgeo` (28M faces, 17,172 pages)
-through the playground on a 4090, sweeping `max_iterations` at tau = 1:
-
-| `max_iterations` | pages | drawn | remaining, before | after |
-| --- | --- | --- | --- | --- |
-| 40 | 1593 | 10177 | 0 | 0 |
-| 39 | 1593 | 10177 | 0 | 0 |
-| 38 | 1593 | 10170 | 0 | 7 |
-| 32 | 1315 | 2115 | 0 | 4556 |
-| 20 | 25 | 0 | 0 | 75 |
-
-Two causes, and they cancelled into a plausible number:
-
-- **The prepare pass wrote it, and the prepare pass runs between wavefronts.** What it could report
-  is the frontier of an iteration, not a remainder, and the next iteration overwrote it. Only a pass
-  after the last wavefront is looking at the right thing.
-- **It was a plain store, and a frame has more than one cut.** The two-way HZB filter gives every
-  view two expansion sites and a scene routinely has all of its virtual geometry in one of them, so
-  the *empty* bucket ran last and stored its own zero over the other's truncation. Every other stat
-  in `VGEO_CUT_STAT` is an add across the frame's cuts; this one was not.
-
-`shader_vgeo_cut_queue_remainder` is the tail now — three bindings, one workgroup, an `atomicAdd` —
-and the prepare pass no longer binds the feedback buffer at all. The spec that missed it ran one
-cut against one feedback buffer, which is the only arrangement in which a last-writer-wins race has
-no second writer; the new one runs a truncated cut and an empty cut against the buffer
-`begin_frame` would have given them both.
-
-**What this unblocks.** `max_iterations` defaults to 64 and the descent on this asset converges at
-39, so 89 of the 128 traverse dispatches a frame records are empty — and until now nothing could
-say whether a smaller budget was safe. It can now: 39 is exact and 40 is free.