Advance M8-M11 parity workflows

2026-08-17 04:37:07 -04:00
parent 7c16b279ae
commit 0fe8d2bb56
324 changed files with 31920 additions and 863 deletions
--- a/docs/status/M10-01.md
+++ b/docs/status/M10-01.md
@@ -0,0 +1,51 @@
+# M10-01 Status
+
+status: done
+task: 从 Blender Main 读取 Geometry Nodes 图拓扑、socket 默认值、link 和稳定 node ID
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The WebEngine authoritative Main reader publishes a bounded `GeometryNodeGraphIR`
+snapshot for every `GeometryNodeTree`. It preserves unsupported nodes as metadata,
+uses Blender node identifiers and socket identifiers rather than display names, and
+does not evaluate Geometry Nodes. The existing `web/protocol/schema-version` remains
+`1`: `geometryNodeGraphs` is an additive optional SceneIR field and no existing field
+meaning or persisted storage schema changed.
+
+## Evidence
+
+- Fixture: `tests/files/web/modifier_geometry_nodes_scene.blend`.
+- Fixture SHA-256: `f3820511f791769837d75be092934130c397cf46ee0acf79db28efca9a7948c9`.
+- Desktop reference: `tests/golden/W-075/modifier_geometry_nodes_scene.json`.
+- Desktop reference SHA-256: `93c21e5158daefce10f2d4df674e636bf3f6ed3dd43e1576c45a02a8592f5886`.
+- Golden manifest: `tests/golden/M10-01/geometry-node-main-reader.json`.
+- Protocol/unit check: `node --test web/tests/unit/geometry-nodes.test.mjs` (3/3).
+- Native/WASM reader check: `node tools/web/check-geometry-node-main-reader.mjs`;
+  3 graphs, 10 nodes, 7 links, 9 defaults, stable IDs, graph hashes, desktop
+  comparison, save/reopen and unsupported Simulation-node preservation all passed.
+- Chromium Worker check: `WEB_TEST_PORT=5440 npm --prefix web run test:geometry-node-main-reader`
+  (unit 3/3, reader 1/1, Chromium 1/1).
+- `source tools/web/emscripten-env.sh && cmake --build build_web_blender6 --target web_engine -- -j8`:
+  passed (`ninja: no work to do`).
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`,
+  `npm --prefix web run build`, and `git diff --check`: passed.
+
+## Contract
+
+- Per-graph budgets are fixed at 4,096 graphs, 4,096 nodes, 16,384 links,
+  65,536 node sockets, and 4,096 interface sockets.
+- Graphs, nodes, links, and socket arrays are deterministically ordered before the
+  graph SHA-256 is emitted.
+- Socket data types and finite defaults are read from Blender's native `bNodeSocket`
+  storage; ID-valued defaults are serialized as stable typed IDs.
+- `__extend__` sockets are omitted because they are UI extension sockets, not graph
+  data. Missing/duplicate identifiers, invalid links, and budget overflow fail closed.
+- Unsupported node types remain in the graph and are available to the later M10-02
+  allowlist gate; this task does not claim Geometry Nodes evaluation.
+
+## Rollback
+
+Remove the M10-01 reader, protocol field, golden, unit/E2E checks, package script and
+this status file together. Existing SceneIR consumers continue to accept snapshots
+without the optional `geometryNodeGraphs` field.
--- a/docs/status/M10-02.md
+++ b/docs/status/M10-02.md
@@ -0,0 +1,56 @@
+# M10-02 Status
+
+status: done
+task: Geometry Nodes allowlist 与未支持节点无损阻断
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+`GEOMETRY_NODE_ALLOWLIST_SCHEMA` and `GEOMETRY_NODE_ALLOWLIST` freeze the only node
+types that may proceed past the Geometry Nodes protocol gate. The gate validates the
+complete graph before any Main writer call. A node outside the list returns
+`GN_NODE_UNSUPPORTED`; a structurally valid allowlisted graph still returns
+`CAPABILITY_MISSING` from the production Worker until its evaluator and desktop/WASM
+golden are completed by M10-03. Neither failure mutates Main or replaces the graph
+read by M10-01.
+
+## Allowlist
+
+Schema 1 contains 16 node types: Group Input/Output, Transform Geometry, Set
+Position, Join/Separate Geometry, Realize Instances, Store Named Attribute, integer/
+vector input, Value, Compare, Math, and Object/Collection/Image Info. External resource
+nodes remain subject to stable-ID, missing-resource, linked-resource and owner-cycle
+checks.
+
+## Evidence
+
+- Golden: `tests/golden/M10-02/geometry-node-allowlist.json`.
+- Fixture: `tests/files/web/modifier_geometry_nodes_scene.blend`, SHA-256
+  `f3820511f791769837d75be092934130c397cf46ee0acf79db28efca9a7948c9`.
+- `WEB_TEST_PORT=5441 npm --prefix web run test:geometry-node-allowlist`: unit 4/4
+  and Chromium 1/1 passed.
+- The real Main graph `WebGeometryNodesSimulation` preserved
+  `GeometryNodeSimulationInput` and `GeometryNodeSimulationOutput`; an attempted
+  graph transaction returned `GN_NODE_UNSUPPORTED` and retained the graph JSON,
+  graph SHA-256 and Main revision.
+- The allowlisted `WebGeometryNodes` graph returned `CAPABILITY_MISSING` while the
+  evaluator is still closed; it also retained graph identity and Main revision.
+- M10-01 regression: `WEB_TEST_PORT=5442 npm --prefix web run
+  test:geometry-node-main-reader` passed (unit 4/4, reader 1/1, Chromium 1/1).
+- Full unit suite: 131/131 passed.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`,
+  `npm --prefix web run build` (73 modules), and `git diff --check`: passed.
+
+## Implementation Hashes
+
+- Protocol: `23c2289ec2acbdce0beba47c0b6539bc3f14f5a71ce29927df86cf6c705d6ec3`.
+- Unit: `e60933ed0f946bdaa96f5322ba8d80b26c8425c623dd6e87da33016a1592c299`.
+- Chromium: `ff2c838b5c16d86eff13699586a0cd1121ee1a86d5ea52d7b89c01d35632bb77`.
+- Golden: `471fec9c5382ab7522b6c18ab580a6926eaa59eb5a8b72d23968670b9b9ab37a`.
+- Production Worker: `4a65547e6b1fea16a120b4e72eb37d4d9f7c7ced4342f535796535262ff65fcc`.
+
+## Rollback
+
+Remove the exported allowlist schema/list, M10-02 unit/E2E assertions, golden,
+package script and this status file together. The older private allowlist behavior is
+otherwise unchanged; no persisted schema migration is required.
--- a/docs/status/M10-03.md
+++ b/docs/status/M10-03.md
@@ -0,0 +1,73 @@
+# M10-03 Status
+
+status: done
+task: Geometry Nodes allowlist 逐节点 Blender 5.2 desktop/WASM golden
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The headless Web modifier evaluates the saved Blender Main graph only through the
+16-node schema-1 allowlist. Eleven minimal Blender 5.2 fixtures make every allowlisted
+node affect a measured output. The same fixture is evaluated by the full-Main WASM in
+Node and by the production Chromium Worker before and after save/reopen.
+
+This is a bounded constant-scalar, topology, attribute, and same-file resource closure.
+It does not claim arbitrary Blender field/domain conversion, complete lazy-function
+semantics, Geometry Nodes graph writing, linked resources, or Simulation Zones.
+
+## Coverage
+
+- Graph boundary: Group Input and Group Output.
+- Geometry: Transform, Set Position, Join/Separate Geometry, Realize Instances, and
+  Store Named Attribute with a constant Float point-domain value.
+- Scalar/vector: Integer, Vector, Value, Compare, and Math nodes on the bounded
+  operations accepted by the native evaluator.
+- Same-file resources: Object Info, Collection Info with separate children, and Image
+  Info dimensions. Missing, recursive, linked, or otherwise unverified resources stay
+  behind the M10-02 resource gate.
+
+## Evidence
+
+- Fixture: `tests/files/web/geometry_node_allowlist_evaluator.blend`.
+- Golden: `tests/golden/M10-03/geometry-node-evaluator.json`.
+- Desktop generator: `tools/web/generate-geometry-node-evaluator-golden.py`; Blender
+  5.2.0 LTS emitted 11 cases, and a clean temporary regeneration matched every semantic
+  golden field after excluding output-path-dependent fixture path/hash fields.
+- Node full-Main WASM: `node tools/web/check-geometry-node-evaluator-golden.mjs`;
+  16 nodes, 11 cases, maximum position error 0, RMS position error 0, and attributes
+  passed.
+- Chromium: `WEB_TEST_PORT=5443 npm --prefix web run
+  test:geometry-node-evaluator-golden`; unit 4/4, Node golden 1/1, and Worker
+  open/evaluate/save/reopen 1/1 passed.
+- Tolerances: maximum position `1e-5`, RMS position `1e-6`, Float point attribute
+  `1e-6`, and bounds `1e-5`.
+- M10-01 regression on port 5444 and M10-02 regression on port 5445 passed.
+- Full unit suite 131/131, typecheck, lint, production build (73 modules), local
+  dependency checks, and `git diff --check` passed.
+
+## Implementation Hashes
+
+- Native evaluator: `b896c5c52a611e7a309f80ca4bf8323ccded458584f65ab8f6841df24d70cc42`.
+- Desktop generator: `f42ba309e4935a4534eabcb8ab1978abc08d863e2d18d80a70607f31dd3a3066`.
+- WASM checker: `76a02d4aae70a597f0c26c12de3104d56e3f1cc9fded1d4824a05d7ddc59c1b5`.
+- Fixture: `0cb3e33df570b436e32d783eef0a6c2daad04ca5bb4ccb4f0286b3d723ff7978`.
+- Golden: `363ae47cfb50b8c95d0a55116e8663e41d27c7aa332cffe9b702bbe9b8cbfe1c`.
+- Chromium spec: `83b1c96518eb64bef2c8830c778a84eb13d8da0ea62c2488471ed5fefea975c8`.
+- Full-Main WASM: `432c5c9efb03b23a506c1b8f57f0d06ee683274bbdfe415f894f0d3c29db0b77`.
+
+## Contract
+
+- Evaluation is demand-driven from the active Group Output and is capped at 4,096
+  node-output evaluations. Unsupported nodes, sockets, operations, cycles, or resource
+  states return `GEOMETRY_NODES_EVALUATOR_UNSUPPORTED` without claiming evaluation.
+- The evaluator uses Blender `GeometrySet`, geometry join/realize/transform helpers,
+  evaluated dependency graph resources, and Blender mesh attributes. Three.js does not
+  execute or approximate Geometry Nodes semantics.
+- The fixture and golden inventory must cover every schema-1 allowlist entry before the
+  check starts; missing coverage fails before numeric comparison.
+
+## Rollback
+
+Remove the bounded evaluator expansion, M10-03 generator/fixture/golden/checker,
+Chromium spec, package script, and this status file together. Revert the M10 count to
+2/15 and restore the previous Transform/Set Position-only modifier evaluator.
--- a/docs/status/M10-04.md
+++ b/docs/status/M10-04.md
@@ -0,0 +1,75 @@
+# M10-04 Status
+
+status: done
+task: Geometry Nodes field/domain materialization budgets
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+Field materialization schema 1 binds every request to a graph ID/hash, Main revision,
+source and target domain, data type, transport, and an exact seven-domain cardinality
+snapshot. The parser derives element, scalar, and byte counts rather than accepting
+caller-provided counts. JSON never carries field values in this contract; the current
+native Depsgraph path only publishes a small verified point-Float payload.
+
+This task establishes budgets and transport boundaries. It does not claim actual
+evaluation for arbitrary POINT/EDGE/FACE/CORNER/CURVE/INSTANCE/LAYER conversions,
+complete Blender lazy-function semantics, graph writing, or Simulation Zones.
+
+## Budgets
+
+- Domain maxima: POINT 1,000,000; EDGE/FACE 2,000,000 each; CORNER 4,000,000;
+  CURVE/INSTANCE 100,000 each; LAYER 4,096.
+- Batch maxima: 64 fields, 32 real domain conversions, 4,000,000 target elements,
+  and 64 MiB of materialized data.
+- Per-field JSON maximum: 65,536 scalar values. Larger fields must stay binary or
+  return `GN_FIELD_JSON_BUDGET_EXCEEDED`.
+- Supported bounded layouts are Boolean, Int, Float, Vector, and Color. Element,
+  component, and byte multiplication is checked before a receipt is returned.
+
+## Native Contract
+
+The full-Main Depsgraph reports exact POINT/EDGE/FACE/CORNER cardinality from the
+evaluated Blender Mesh and zeroes the non-Mesh domains for the current fixture. The
+observable `m10_value` point-Float attribute carries schema version, element/scalar
+counts, materialized byte length, and transport. The TypeScript parser cross-checks
+the receipt against mesh vertex count, domain cardinality, the Float32 byte layout,
+and the actual attribute payload. Unknown receipt fields and hidden JSON arrays are
+rejected.
+
+## Evidence
+
+- `WEB_TEST_PORT=5448 npm --prefix web run test:geometry-node-field-budget`:
+  unit 6/6 and real Chromium Worker 1/1 passed.
+- The real `M10GN_StoreAttribute` evaluated mesh reported cardinality
+  POINT/EDGE/FACE/CORNER `8/12/6/24`, schema 1, eight Float scalars, 32 bytes, and
+  eight values equal to `0.375`.
+- Chromium negative checks rejected POINT cardinality drift, byte-length drift, and
+  a hidden `values` array in the receipt.
+- M10-01/02/03 regressions passed on ports 5449/5450/5451. M10-03 still covers all
+  16 allowlisted nodes across 11 desktop/full-Main WASM/Chromium cases with zero
+  maximum and RMS position error.
+- Full unit suite 133/133, typecheck, lint, production build (73 modules), local
+  dependency checks, `git diff --check`, and the three-fixture 100-iteration
+  Depsgraph regression passed.
+
+The first Chromium rerun on port 5447 was not accepted as evidence: the negative
+check used a browser-relative dynamic import that resolved to a nonexistent
+`/protocol/depsgraph.ts`. The check was moved to Playwright's Node-side static import,
+then the complete task command was rerun on port 5448.
+
+## Implementation Hashes
+
+- Geometry Nodes protocol: `8d04291c29e9ce30e3f2f6d4141bc4101d49529bf7f7edf109d67d059efa58b1`.
+- Depsgraph protocol: `df7e0e29422f5b605f20fd5ab939d170d35048020968d2f6aea86603d0633cd6`.
+- Native Depsgraph: `5bcc17416fd4d45985bc1529288127b9eeed4a30b47836e687dc5321182c0b11`.
+- Unit test: `1aa4df021731d7ba4c4191d56f88c663b223443f78c9fdc1b88c2a43423239c7`.
+- Chromium spec: `95d8380d6a17a5b85df695a3cb850dffa8705f574ae0b9c97422bb802899eb8e`.
+- Full-Main WASM: `1bb4a947da4332471f3d7bab8f3f628c83d1703244093a554a188668ddafafd7`.
+
+## Rollback
+
+Remove the field materialization schema/parser, native Depsgraph cardinality and
+receipt fields, M10-04 unit/Chromium checks, package script, and this status file
+together. Revert the M10 count to 3/15; do not leave the native attribute JSON path
+without its receipt and cardinality validation.
--- a/docs/status/M10-05.md
+++ b/docs/status/M10-05.md
@@ -0,0 +1,68 @@
+# M10-05 Status
+
+status: done
+task: Simulation cache graph/source/revision identity binding
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+Simulation cache manifest schema 2 binds every cache to the Geometry Nodes graph ID/hash,
+the committed source `.blend` hash and revision, input hash, Blender 5.2 build, and the
+declared frame range. A deterministic `revisionHash` is calculated from those fields and
+the storage key is `sim2-` plus the complete 64-character digest. The payload hash and
+per-frame hashes remain separate integrity checks.
+
+This task closes identity and stale-source safety. It does not implement Simulation Zone
+evaluation, browser bake, cancel, LRU, corruption quarantine, or playback capability.
+
+## Protocol
+
+- Schema 1 manifests and undeclared manifest/frame fields are rejected.
+- `sourceRevision` is a bounded committed revision; frame values are bounded to +/-1,000,000.
+- `revisionHash` uses a JSON-array canonical encoding with an explicit v2 domain marker,
+  avoiding ambiguous delimiter collisions.
+- Graph/source/input/revision/frame-range drift returns
+  `SIMULATION_CACHE_REVISION_MISMATCH`; payload or source bytes still use their dedicated
+  hash mismatch codes.
+
+## Storage Contract
+
+`putSimulationCache`, full read, frame read, and list run through the per-project transaction
+lock. Put checks revision and source hash before hashing/storing the payload. Full/frame reads
+re-verify the manifest identity and current project; listing validates all manifests and filters
+valid but stale revisions out of the current project view. Old rows are not silently reused.
+
+## Evidence
+
+- `WEB_TEST_PORT=5455 npm --prefix web run test:simulation-cache-identity`: unit 3/3 and
+  Chromium 1/1 passed. Revision 7 cache recovered after Worker restart; after save to revision
+  8, the old key was rejected and omitted from the list, while a new key was accepted.
+- Negative checks covered forged graph hash, forged source hash, stale read/put, changed input,
+  changed source revision, changed frame range, legacy schema, undeclared fields, and frame
+  payload drift.
+- `WEB_TEST_PORT=5456 npm --prefix web run test:simulation-cache`: identity and existing
+  Worker-restart smoke 2/2 passed.
+- `WEB_TEST_PORT=5457 npm --prefix web run test:simulation-cache-performance`: 600/600 frames,
+  OPFS backend, playback completed, 600 published frames, 0 pending requests after terminate,
+  5,072 ms total, below the 30,000 ms gate.
+- Full unit suite 136/136; typecheck, lint, production build (73 modules), local dependency
+  check, and `git diff --check` passed. The first full static pass had one unused import lint
+  failure after the read-path refactor; removing it and rerunning produced the results above.
+
+## Implementation Hashes
+
+- Simulation protocol: `974b006f1ad4cd1d3d294122fc777c89c3a7da04fdaa7aebedea12b545bc65e5`.
+- Storage Worker: `a7b31eeb601e9e71c74eaceda95704f1d120653e9ade6bfbee6d262a42edaa74`.
+- Unit test: `591582a4ce77b699a4462e30d587eb89034f29ec0a22a94c81f8ab7306f2524f`.
+- Identity Chromium spec: `2446060a9c3955ef466adb479966bf424fd9e9c351b65cd8525e90a1a1032e4d`.
+- Existing smoke: `0c8c001290c8c6b3482eeebc105b2f217c55b2eded0c62b4fee4595ec277a11d`.
+- Performance spec: `f6c465b7afa012030dd8516d676e2663f4dd8298aa156defb905b3fa0229a84b`.
+- Package: `f9e28fb23af28720f56f97b249cb636599ebd92955ab2ff6d234b821e6d5ea44`.
+- Error registry: `4c6045b1cab8348f0acf180a1e618a0d691ddc5092822ca288f974904e5e13a5`.
+
+## Rollback
+
+Remove schema 2 identity fields and hash helper, restore the prefix-truncated key, revert
+Storage Worker project-lock checks and stale filtering, remove the identity unit/E2E/package
+entries and this status file, then restore the M10 count to 4/15. Do not retain schema 2
+manifests with schema 1 readers.
--- a/docs/status/M10-06.md
+++ b/docs/status/M10-06.md
@@ -0,0 +1,84 @@
+# M10-06 Status
+
+status: done
+task: Simulation cache cancellation, playback gate, LRU, restart and corruption isolation
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+Simulation cache playback is now a lifecycle-gated operation. A cache may be read by
+frame only after the current Storage Worker has completed a full manifest, payload and
+per-frame hash verification. This closes cache lifecycle safety; it does not implement
+Simulation Zone evaluation, browser bake generation, or GN modifier seek semantics.
+
+## Protocol and Client
+
+- `SIMULATION_CACHE_NOT_READY`, `SIMULATION_CACHE_CANCELLED` and
+  `SIMULATION_CACHE_BUDGET_EXCEEDED` are stable error codes.
+- `verifySimulationCacheCancellable` checks cancellation between total and per-frame
+  SHA-256 work. `StorageClient` accepts `AbortSignal`, removes an aborted request from
+  `pending`, and sends a `cancelRequest` to the Worker so late responses cannot publish.
+- `planSimulationCacheLRU` sorts removable entries by `lastAccessAt`, `createdAt`, and
+  `cacheKey`; active playback keys are protected. If protected entries alone exceed the
+  requested budget, the result reports `budgetSatisfied: false` instead of evicting them.
+
+## Storage Contract
+
+- IndexedDB schema 7 adds `simulation_quarantine`; the M10-06 Chromium test creates a
+  temporary schema 6 database and verifies the real v6 to v7 migration and store.
+- `prepareSimulationCachePlayback` performs full verification in the current Worker and
+  activates the key. `readSimulationCacheFrame` rejects unprepared keys, while `release`
+  removes readiness and LRU protection. A successful full read also establishes verified
+  readiness for compatibility with existing callers.
+- `pruneSimulationCaches` removes deterministic LRU manifests and deletes their
+  unreferenced simulation assets. Active playback is automatically protected.
+- Invalid manifests and missing, truncated, or hash-mismatched payloads are moved from
+  `simulation_manifest` to `simulation_quarantine`. Quarantine preserves the bad row for
+  diagnostics while valid cache listing and playback continue.
+
+## Evidence
+
+- `WEB_TEST_PORT=5464 npm --prefix web run test:simulation-cache-lifecycle`: unit 5/5 and
+  real Chromium 1/1. It covers v6 to v7 migration, post-restart `NOT_READY`, full
+  verification, StorageClient cancellation, BrowserTransform playback cancellation with
+  zero published frames and zero pending requests, active-cache LRU protection, release,
+  cancelled write cleanup, OPFS byte tamper, and quarantine listing.
+- `WEB_TEST_PORT=5460 npm --prefix web run test:simulation-cache-identity`: unit 5/5 and
+  Chromium 1/1. Existing graph/source/revision stale filtering remains green.
+- `WEB_TEST_PORT=5461 npm --prefix web run test:simulation-cache`: identity and existing
+  Worker-restart smoke 2/2.
+- `WEB_TEST_PORT=5462 npm --prefix web run test:simulation-cache-performance`: 600/600
+  frames, OPFS backend, 6,639 ms total, 0 pending requests after terminate, and restart
+  recovery passed the 30,000 ms gate.
+- Targeted schema/snapshot smoke 2/2 and recent-project recovery 4/4 passed after the
+  schema version update. Full unit suite passed 138/138; typecheck, lint, production
+  build (73 modules), local-dependency check, and `git diff --check` passed.
+
+The first lifecycle run was not accepted as evidence because the test helper returned the
+numeric legacy `DOMException.code` value `20` instead of the `AbortError` name. The helper
+was corrected and the complete command was rerun on port 5459, then rerun again on port
+5464 after adding playback cancellation and migration assertions.
+
+## Implementation Hashes
+
+- Simulation protocol: `3025db84bd4e0151b8894a457c51da630d628afb1760e2f0caeec003f0efce3f`.
+- Storage protocol: `2711dbab0c52a566679b83d5e4d793ec0ffd3f991e744dce765b6bdc54d25c13`.
+- Error registry: `7ebff554dd6346b539215a6545c67806bca2ead33953700b79c0910fd0cfb408`.
+- Storage Worker: `e31d7dcf93c5dcefb7e6c4cfd7874c748f972849ee7d93adb6294f82aafcf236`.
+- Storage client: `aaa3a03e3b91452e90a661566407c261c7a16b1671ed55ec948de7626d49bfa4`.
+- Storage migration: `8de1fcbbda9d7a4e7496995306c4e9fc83224211a516cf7241496b6a145953b5`.
+- OPFS helper: `2e8ef9d72194bf803a7e823fb2b7de30b9f10ae6dd4b031b81b97ff82eee9cc6`.
+- Unit test: `4ece0f5051667b04fab78c81a847def7a0c77d9267bd9e4fa2bbe4b9308125bf`.
+- Lifecycle Chromium spec: `861d370f72896987cef65d2e4d78ab3edcc1d4828d4a0fa0b5301b72a4a2932a`.
+- Identity regression: `aa305871e8651018342b123112beab10a43dab3313e2c9765e450dc91c08b6e1`.
+- Performance regression: `d7083c24789fc5877a7841bf611aee0ff471cc191621de1b30720d637635b44c`.
+- Smoke/recovery version updates: `2d15e5bf54a1dcdec1686ee937a510a7521ad44b152c895289a152ea711fadf4` /
+  `a4d6279f05b6215f2e34cd5f1d76ebb6d5ed2cc765859c2ae0af975623f93b2c`.
+- Package: `fe90c0bd741a7840f6184726737a1a93c606841b8408dd7fd6dec823a8352cf6`.
+
+## Rollback
+
+Remove the schema 7 migration and `simulation_quarantine` store, restore frame reads to
+the schema 6 identity-only contract, remove cancellation/LRU/playback commands and the
+M10-06 tests/status entry, then restore the M10 count to 5/15. Do not retain schema 7
+databases with a schema 6 reader.
--- a/docs/status/M10-07.md
+++ b/docs/status/M10-07.md
@@ -0,0 +1,59 @@
+# M10-07 Status
+
+status: done
+task: Bounded WebGL2/Three physical compiler for the declared Shader node subset
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The browser material path now compiles only the declared RGB, Value, Math,
+Image Texture, Normal Map, Principled, and Material Output closure. The compiler
+produces a schema-versioned `WEBGL2_THREE_PHYSICAL` report before a Shader Main
+transaction is sent to Blender. Unknown nodes, cycles, duplicate inputs, missing
+or blocked images, oversized graphs, and invalid constants fail closed without
+mutating the source graph.
+
+This task does not claim arbitrary Shader Node support, WebGPU compilation,
+complete color management/sampler parity, compile-key invalidation, or pipeline
+rollback; those remain later M10 tasks.
+
+## Protocol and Runtime
+
+- `web/protocol/shader-compiler.ts` defines the M10-07 allowlist, fixed node/link/
+  depth/texture/identifier budgets, deterministic graph fingerprint fallback,
+  scalar Math evaluation, and bounded `ShaderCompileReport`.
+- The Engine Worker compiles `setShaderGraph` before the native Main transaction,
+  rejects a blocked report, and returns the report with the committed delta.
+- Main-thread and Offscreen viewport material creation share `createPBRMaterial`;
+  compiled constants and declared base-color/normal texture bindings are stored in
+  material `userData` for the texture adapter.
+
+## Evidence
+
+- `WEB_TEST_PORT=5521 npm --prefix web run test:shader-compile`: unit 5/5 and
+  Chromium 3/3 passed. The suite covers the real Main graph transaction, Math
+  result and topological order, Image/Normal bindings through the shared viewport
+  path, missing resources, cycles, duplicate inputs, oversized graphs, forged
+  fingerprints, and source graph immutability on blocked input.
+- `tests/golden/M10-07/shader-compile.json` fixes the fixture digest, backend,
+  allowlist, six Math operations, and compiler budgets.
+- The first attempt on the default port was rejected before browser startup because
+  an existing process owned `127.0.0.1:5173`; it is not counted as a feature failure.
+
+## Implementation Hashes
+
+- Compiler: `50b29c99d73c886a41bb8e10ccd2309068a1c09b23196655659b2f530d31f856`.
+- Engine Worker: `376efe09de20150fc32803745da7e7e55bb41d178302e45b1fd90a2fe7778b2e`.
+- PBR adapter: `f9c2e5ede635d11673f971c985288821af24ed81ecaadc95efefd958637672fd`.
+- Texture adapter: `d5e379e25e0ab8294523690c4d4c79203b6f1610b4d6a608b33a7118f51efa57`.
+- Unit test: `1e5d44b4f73f4ee4e4c9329f73628980df9337632dc48a3d50689f051a89b6e7`.
+- Chromium spec: `c59b9f349bd6ce329ffc89f64eba3fec3e1e02a528978bdc1c3793d921faabc3`.
+- Golden: `6bb8c07f014a0f2c1fd0e9ec16b08b99a524d8d3161bc556767acaf510c6c961`.
+- Package: `ea0fef34497d51448d5478f4a761bef3c4ca816c408fd8a0807eaa0b093d0df8`.
+
+## Rollback
+
+Remove the compiler, Worker gate, shared material/texture adapter integration,
+M10-07 tests, golden and this status file together. Restore the M10 count to
+6/15 and leave Shader Main's existing capability gate and writeback contract in
+place; do not retain a compiler report that is not enforced before Main mutation.
--- a/docs/status/M10-08.md
+++ b/docs/status/M10-08.md
@@ -0,0 +1,59 @@
+# M10-08 Status
+
+status: done
+task: Shader compile key binding for graph, textures, color space and backend
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+Every bounded Shader compile report now carries a deterministic 64-character
+`compileKey`. The key is SHA-256 over the task-local report schema, graph hash,
+renderer backend, and sorted texture identities: image ID, usage, asset ID,
+asset SHA-256, and resolved SRGB/LINEAR/NON_COLOR color space.
+
+Texture identities are optional for legacy SceneIR rows; missing metadata is
+represented explicitly as `null`, while usage-based color-space defaults remain
+deterministic. An unknown renderer backend or malformed texture digest blocks
+compilation. The global `web/protocol/schema-version` remains 1 because this is
+an additive field in the task-local Shader report, whose schema is still 1.
+
+## Runtime
+
+- `ImageIR.colorSpace` is optional and validated; render asset requests use it
+  when present and otherwise retain the existing usage-derived color space.
+- The Engine Worker passes snapshot image asset/hash/color-space identity into the
+  compiler. The PBR adapter accepts the same context for main-thread and Offscreen
+  material creation.
+
+## Evidence
+
+- `WEB_TEST_PORT=5523 npm --prefix web run test:shader-compile-key`: unit 7/7 and
+  Chromium 1/1 passed. The browser test proves key changes for texture SHA-256 and
+  color-space changes through the application PBR entry point.
+- `WEB_TEST_PORT=5524 npm --prefix web run test:shader-compile`: M10-07 regression
+  unit 7/7 and Chromium 3/3 passed.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`,
+  `npm --prefix web run build`, `npm --prefix web run test:status-consistency`,
+  and `git diff --check` passed.
+
+The first browser attempt on port 5522 used a repository-root dynamic import that
+Vite does not expose and was rejected before exercising the compiler. The test was
+moved through the application PBR entry point and rerun in full on port 5523.
+
+## Implementation Hashes
+
+- Compiler: `acd5f8deb2912f6823533df12baba8049c5e64d440c17a6dc3f90741f71774b2`.
+- SceneIR: `a65ef3b4be5303b1b86b3ee6829c795870dcc2490ba58d3a66b8bed8172d6442`.
+- Render assets: `840c09a6c2ec56cc75a9ca72bcbdde6957612a7c61b19ab83be47c571eca8b67`.
+- Engine Worker: `668728f7e5b6edf9e1cee3e6152238d16ac19f43f030e94e77bfe24e7ff50489`.
+- PBR adapter: `8a9cb52c8e7b1481096017cc659d93541c21724c1203d22755e37e1e3c365250`.
+- Unit test: `9ae9bb4c778d9e31a607d0c7d678ecf3448ed4e5b57c88ab4ba767a2f0850cc7`.
+- Chromium spec: `a09ebfa451e76c33f421bc8402fac4c77faedee88020431a505602f317b4eb65`.
+- Golden: `187666d9dfb9d9cdd5bd6195cc2f7ee57bb78fa0d05d6020762c06a4ab015984`.
+
+## Rollback
+
+Remove `compileKey`, texture identity context, ImageIR color-space metadata,
+M10-08 tests/golden and the Worker/adapter wiring together. Restore the M10
+count to 7/15 and retain graphHash-only reports with the original usage-derived
+render asset color-space behavior.
--- a/docs/status/M10-09.md
+++ b/docs/status/M10-09.md
@@ -0,0 +1,40 @@
+# M10-09 Status
+
+status: done
+task: Preserve the previous usable material pipeline on compile failure
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+`PBRMaterialPipeline` makes material replacement transactional. A successfully
+compiled candidate becomes current only after compilation; the previous material
+is disposed exactly once after replacement. A blocked candidate is disposed and
+the current material remains usable, with the failed report stored as
+`shaderCompileFailure` for diagnostics. This does not claim arbitrary Shader Node
+support or a WebGPU pipeline.
+
+The Engine Worker independently rejects blocked `setShaderGraph` requests before
+the Blender Main transaction, so a failed graph cannot publish a new SceneIR
+snapshot in addition to the viewport-side rollback.
+
+## Evidence
+
+- `WEB_TEST_PORT=5525 npm --prefix web run test:shader-pipeline`: Chromium 1/1.
+  The test confirms the failed candidate reports `SHADER_NODE_UNSUPPORTED`, keeps
+  object identity and the previous compiled report, and that a later successful
+  compile replaces the material.
+- `npm --prefix web run typecheck` and `npm --prefix web run lint` passed after the
+  pipeline helper was added.
+- `tests/golden/M10-09/shader-pipeline.json` fixes the rollback invariants.
+
+## Implementation Hashes
+
+- PBR adapter: `8a9cb52c8e7b1481096017cc659d93541c21724c1203d22755e37e1e3c365250`.
+- Chromium spec: `e6771f672e885250db199cbf97a0a3866084ab9bb3f2ad25d17f5c53edaa99af`.
+- Golden: `5dbb916e512935a76dacde37242b123707897f54ab10d7b99e246f57afbc94ac`.
+
+## Rollback
+
+Remove `PBRMaterialPipeline`, its Chromium test/golden and this status file. Keep
+the M10-08 compile key and Engine Worker pre-transaction gate, and restore the M10
+count to 8/15.
--- a/docs/status/M10-10.md
+++ b/docs/status/M10-10.md
@@ -0,0 +1,39 @@
+# M10-10 Status
+
+status: done
+task: Stable capability block for unsupported Shader nodes
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The Shader capability query now accepts arbitrary node type strings and returns a
+stable `PBR-012/ARBITRARY_SHADER` block for every type outside the declared bounded
+compiler set. Unsupported node names are de-duplicated and sorted, so the same
+graph receives the same error regardless of input order. The block uses
+`SHADER_NODE_UNSUPPORTED`, remains recoverable, and does not silently report READY.
+
+The existing ShaderGraph validator and Engine Worker gate continue to preserve the
+source graph and reject blocked `setShaderGraph` commands before any Main mutation.
+This task does not expand the compiler allowlist.
+
+## Evidence
+
+- `WEB_TEST_PORT=5526 npm --prefix web run test:shader-capability`: Chromium 1/1.
+  `VORONOI` and `CUSTOM_OSL` both return the expected stable block; reversed input
+  order produces the identical task/capability/status/code/message result.
+- `npm --prefix web run typecheck` and `npm --prefix web run lint` passed.
+- `tests/golden/M10-10/shader-capability-block.json` fixes the status, error code,
+  recoverability and graph-preservation policy.
+
+## Implementation Hashes
+
+- Render capability gate: `322929e9c7b627a9e79b8a6f11d5e9b0c7c05a5754f82d41c45c1134bbaaf385`.
+- Chromium spec: `6337801f10b9115ba7b53a43152ae69a324b5baa61c8e455cc61505437228cbf`.
+- Golden: `b7182bb57e10d0b302b4c7dc9bc43160721a2c9414b056c86173c3b5c2501739`.
+- Package: `d6d4dcaf4f5c852f884ba2064da96a8c30519c661bf4a16c59e115742aa37e8a`.
+
+## Rollback
+
+Restore the enum-only `ARBITRARY_SHADER` request, remove deterministic sorting,
+the M10-10 Chromium test/golden and this status file, and restore the M10 count to
+9/15. Keep the existing M10-07 compiler fail-closed behavior.
--- a/docs/status/M10-11.md
+++ b/docs/status/M10-11.md
@@ -0,0 +1,44 @@
+# M10-11 Status
+
+status: done
+task: NLA track/strip/action/time mapping read-only exact evaluation
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+A Blender 5.2 desktop-authored fixture contains one object, one NLA Track and two
+Action Clip strips. The first maps Action frames 1..11 to scene frames 20..40 with
+scale 2. The second maps the same Action range to frames 45..65 with reverse playback
+and repeat 2. Both use `NOTHING` extrapolation so samples outside their ranges expose
+boundary behavior rather than hold behavior.
+
+The Main reader must preserve Track, Strip, Action and time-mapping fields. Blender's
+native Depsgraph evaluates 12 boundary/interior/cycle frames; Node WASM and the
+production Chromium Worker compare every world matrix with the desktop golden. The
+test asserts that evaluation does not change NLA or Action JSON. It does not call
+`setNLAStack` and does not claim the M10-12 operator transaction.
+
+## Evidence
+
+- Fixture: `tests/files/web/nla_time_mapping_scene.blend`, SHA-256
+  `b32f783debe213a1345ec4528e5ed27f0f4de00d7896b626df39756289119855`.
+- Golden: `tests/golden/M10-11/nla-evaluation.json`; Blender 5.2.0 LTS, 1 Track,
+  2 Clip strips and 12 frames.
+- `WEB_TEST_PORT=5527 npm --prefix web run test:nla-evaluation-golden`: Node/WASM
+  checker and Chromium 1/1 passed; maximum matrix error 0 and read-only identity passed.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and
+  `npm --prefix web run check:local-deps`: passed.
+
+## Implementation Hashes
+
+- Fixture generator: `a941ecb850ddd165ede117f6411615c6daed4d6bdaffaeac8228a308b7fbe745`.
+- Golden generator: `941a63cc9edbaa0d8dd25025872e3fc44bf64df54d5a9232ad4128e6ac0cd5c5`.
+- Node/WASM checker: `2ce9db0fcbceaf30e398e8feb5c002a60395ac34e61382d9414e980e51e6fdd5`.
+- Golden: `2d148ac0cbc2ac9281d430da20dba8373ad1bb0de6ec5fa578adf36296455fbe`.
+- Chromium spec: `c12f105d206a03dae5b73b076cc3b0a758d597cea7532b6720f4653568df0245`.
+
+## Rollback
+
+Remove the fixture/golden generators, fixture, M10-11 golden/checker/Chromium spec,
+package command and this status file together. Restore the M10 count to 10/15. Keep
+the existing N-014 bounded Main writer and reverse/repeat regression unchanged.
--- a/docs/status/M10-12.md
+++ b/docs/status/M10-12.md
@@ -0,0 +1,45 @@
+# M10-12 Status
+
+status: done
+task: One NLA edit operator with Main transaction, undo/redo and save/reopen
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The bounded `moveNLAStrip` command moves one existing Action Clip while preserving
+its duration and time mapping. It requires the current `baseRevision`; stale commands
+return `REVISION_CONFLICT` before Main mutation. The Worker derives a candidate stack
+through the pure protocol helper, validates Action/path/range/overlap gates, and commits
+it through one authoritative Main `setNLAStack` transaction. The native history entry
+therefore covers the exact pre-edit `.blend` bytes.
+
+This task intentionally opens only the move operator. Create/remove/resize/active,
+multi-track blending, Transition/Meta/Sound, NLA UI and export remain blocked or planned.
+
+## Evidence
+
+- Pure contract: `web/protocol/nla.ts` and `web/tests/unit/nla.test.mjs`, 2/2 tests.
+  The source stack is not mutated; overlap, unknown identity and frame budget errors
+  are deterministic.
+- `WEB_TEST_PORT=5528 npm --prefix web run test:nla-operator`: unit 2/2 and Chromium
+  1/1 passed. The browser path proves stale revision rejection, Main move 20..40 ->
+  5..25, monotonic revision/delta, undo to 20..40, redo to 5..25, save/reopen at
+  5..25, and native frame-10 evaluation at X=2.5.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and `git diff --check`:
+  passed.
+
+## Rollback
+
+Remove `moveNLAStrip` from `web/protocol/nla.ts` and `web/protocol/web-engine.ts`,
+remove the Worker conversion, unit/E2E tests and package command, and delete this
+status file. Restore the M10 count to 11/15. Keep M10-11 read-only evaluation and
+the pre-existing whole-stack `setNLAStack` authoring path.
+
+## Implementation Hashes
+
+- `web/protocol/nla.ts`: `03d5abce5cb2f0a3a38e42eedbced7f4de6e2052d18e53a3dcde3b3ca1e6020d`
+- `web/protocol/web-engine.ts`: `48f2290ead27aeda1f17b279f01ae278776b50b4cb4de065d94b0e1d44717dbb`
+- `web/app/src/workers/web-engine.worker.ts`: `4ccad87c1619db8e39d2855ebca9918883484ce3e5dfc8a325ccee9a8220397c`
+- `web/tests/unit/nla.test.mjs`: `d8bac2dd3e4ec1a1342de7c7401a51beb9879ea5ba2b34df7d615ae0449081a7`
+- `web/tests/e2e/nla-operator.spec.ts`: `1658d52eb0b8cf329f73be552e9b2649ed6dc96b21edb48ade9dd4a725a37ae0`
+- `web/package.json`: `e9d5c6e4f7132921faac8ecbee40215098497fe374d56309f2c76fab152c33d6`
--- a/docs/status/M10-13.md
+++ b/docs/status/M10-13.md
@@ -0,0 +1,48 @@
+# M10-13 Status
+
+status: done
+task: Probe local Physics solvers per family and keep unsupported families bake-only
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The Physics protocol now probes all seven declared families independently. A local
+solver becomes `READY` only after its runtime export exists, initialization succeeds,
+its thread requirement is met and its required memory fits the active WASM limit.
+Missing exports, initialization errors, insufficient threads or memory, and malformed
+probe results remain `BLOCKED` and route to `DESKTOP_SERVER_BAKE`.
+
+The production inventory has no installed solver runtime adapter, so Rigid Body,
+Soft Body, Cloth, Fluid, Dynamic Paint, Particle and Hair all remain bake-only.
+The synthetic positive probe verifies the gate and does not declare an actual solver.
+Desktop family decoding, cache playback, browser bake and server job submission remain
+blocked for later tasks.
+
+## Evidence
+
+- `node --test web/tests/unit/physics-solver-probe.test.mjs`: 3/3. It covers the
+  default seven-family fallback, family isolation across all four gates, and invalid
+  environment/result fail-closed behavior.
+- `WEB_TEST_PORT=5530 npm --prefix web run test:physics-solver-probe`: unit 3/3 and
+  Chromium Worker 1/1. The browser result matches the M10-13 golden and keeps every
+  failed family on `DESKTOP_SERVER_BAKE`.
+- `WEB_TEST_PORT=5531 npm --prefix web run test:e2e -- --grep "N-018 physics"` and
+  `npm --prefix web run test:physics-main-reader`: passed without changing existing
+  metadata/cache gates or claiming a solver.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, production build
+  (74 modules), and `git diff --check`: passed.
+
+## Implementation Hashes
+
+- `web/protocol/physics-simulation.ts`: `adc57a12c7f57c6b1d5f99590d3c36cefa83636aca86c780c2520f3f41148981`
+- `web/tests/unit/physics-solver-probe.test.mjs`: `e499d55770d2024c75803ce1acc1c234814c027279f2b40f42195fd480977653`
+- `web/app/src/workers/physics-solver-probe-test.worker.ts`: `fbad383de186a659440da42dcad988310ca2e483db27e30d74342c8f57a0f49a`
+- `web/tests/e2e/physics-solver-probe.spec.ts`: `1419b98d68da9b0ab0bf41b37843442741593655e2693159d84e069f1dec3f09`
+- `tests/golden/M10-13/physics-solver-probe.json`: `bcc8f9094e2b0d8f41ef01fda0daa2a29693d188e602447d6d06358aaa751df4`
+- `web/package.json`: `875162709315e2a8116c5d28023576a4b95fb076b79453de8b21acdbff2df9dc`
+
+## Rollback
+
+Remove the solver probe types/functions, unit/Worker/E2E/golden/package command and
+this status file, then restore the M10 count to 12/15. Keep the existing N-018
+metadata, Main reader, Simulation cache and BTF1 playback primitive unchanged.
--- a/docs/status/M10-14.md
+++ b/docs/status/M10-14.md
@@ -0,0 +1,47 @@
+# M10-14 Status
+
+status: done
+task: Validate source hash, frame range, byte budget and version for every Physics cache family
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+Every Physics family cache now uses cache schema 1 and binds its family, desktop or
+server bake origin, Blender 5.2 version, source blend/settings/input/cache SHA-256,
+frame range, total byte length and per-frame byte offset/length/SHA-256. `COMPLETE`
+caches require every frame; `PARTIAL` caches may omit frames but remain strictly
+ordered and byte-contiguous. Per-frame and total cache budgets match the existing
+bounded Simulation cache policy.
+
+`verifyPhysicsCachePayload` hashes the actual current blend, full cache payload and
+every frame before consumption. Family/source/version/range/budget drift fails closed.
+This task validates cache identity and bytes; it does not implement a Blender family
+decoder or change the existing cache playback capability block.
+
+## Evidence
+
+- `node --test web/tests/unit/physics-cache-family.test.mjs`: 3/3. All seven families
+  and both desktop/server sources pass; source/payload drift and family/schema/version/
+  range/budget/undeclared-field failures return stable codes.
+- `WEB_TEST_PORT=5533 npm --prefix web run test:physics-cache-family`: unit 3/3 and
+  Chromium Worker 1/1, matching the M10-14 golden.
+- M10-13 probe Chromium 1/1, Physics Main reader, M10-05 Simulation cache identity
+  unit 5/5 + Chromium 1/1, typecheck, lint, production build (74 modules), and
+  `git diff --check`: passed.
+
+## Implementation Hashes
+
+- `web/protocol/error.ts`: `6972a144bdc61c2a4270c88df2d86c75640bb5f24b5ac3b7f9a02d69d3c500fd`
+- `web/protocol/physics-simulation.ts`: `b02b820503d79cd26b0323a4d2033e79d0eeb3032befd26fafe5eab55634584c`
+- `web/app/src/workers/physics-simulation-test.worker.ts`: `453c6e9e683b9da0ef7ce4bd0e4e430b97102d80ddb9b14cc9d075319b37d818`
+- `web/tests/unit/physics-cache-family.test.mjs`: `e1c6f07ec58ce4c4c987bd8a36f270497ae3a0f521d6ed27d7f199debeeaccb2`
+- `web/app/src/workers/physics-cache-family-test.worker.ts`: `8af676506cc0ff1501816431d92d82ca15316b40095d617ecb664b9608e209e0`
+- `web/tests/e2e/physics-cache-family.spec.ts`: `6a2788587f6692bf5bf19d76400810fa277a6985d1a6ecc1b8d1adb85c609249`
+- `tests/golden/M10-14/physics-cache-family.json`: `b220d1fd73f307213078ce3cbd6212544f97ade84a45d54847f107cef69d302d`
+- `web/package.json`: `9baeb319d8c740f67f3e7615942c78f920e7a56b0d654a5a8f47d68de7243eb4`
+
+## Rollback
+
+Restore the former Physics cache binding, remove the two new cache hash error codes,
+unit/Worker/E2E/golden/package command and this status file, then restore M10 to
+13/15. Keep M10-13 solver probing and the existing GN Simulation cache schema 2.
--- a/docs/status/M10-15.md
+++ b/docs/status/M10-15.md
@@ -0,0 +1,51 @@
+# M10-15 Status
+
+status: done
+task: Browser performance, OOM-prevention and malicious-input gates for GN, Shader, NLA and Simulation
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+GN, Shader, NLA and Simulation now run in four isolated Chromium Worker sessions.
+Each session executes a representative bounded workload, rejects an over-budget input
+before evaluator/payload allocation, rejects a domain-specific malicious graph or
+manifest, and then proves that a small valid input still succeeds in the same Worker.
+
+NLA gains explicit track/strip/string budgets and exact declared-field checks.
+Simulation cache total/frame/range overages now return the dedicated
+`SIMULATION_CACHE_BUDGET_EXCEEDED` code. This is a deterministic OOM-prevention gate;
+it does not claim that arbitrary browser heap exhaustion is recoverable inside a
+domain evaluator.
+
+## Evidence
+
+- `WEB_TEST_PORT=5536 npm --prefix web run test:m10-domain-gates`: Node 23/23 and
+  Chromium 1/1. Measured Worker times were GN 54 ms (10 x 512 nodes), Shader 17 ms
+  (100 compiles), NLA 62 ms (20 x 256 strips), and Simulation 2 ms (64 frame hashes),
+  all below their 5/5/5/10 second gates.
+- Stable OOM/malicious codes: GN `GN_GRAPH_BUDGET_EXCEEDED`/
+  `GN_DEPENDENCY_CYCLE`; Shader `SHADER_NODE_UNSUPPORTED`/`SHADER_GRAPH_CYCLE`;
+  NLA `NLA_BUDGET_EXCEEDED`/`NLA_INVALID_STACK`; Simulation
+  `SIMULATION_CACHE_BUDGET_EXCEEDED`/`SIMULATION_CACHE_INVALID`.
+- Existing GN field budget (unit 6/6 + Chromium 1/1), Shader compiler (7/7 + 3/3),
+  NLA operator (4/4 + 1/1), and Simulation lifecycle (6/6 + 1/1) all passed.
+- Typecheck, lint, production build (74 modules), status consistency and
+  `git diff --check`: passed.
+
+## Implementation Hashes
+
+- `web/protocol/error.ts`: `88119782307cb9a61e131f2d5e2e25127256c1e68a333fc7fc3206158b8a1019`
+- `web/protocol/nla.ts`: `96ae7cf9ca3fadbaf98ca15a38937329f203b0bc4a9c39ef685987e7f55353dd`
+- `web/protocol/simulation-cache.ts`: `a1302e42129420a96416e363cbc857d082d4646655685520c9e81f877ce3d9b8`
+- `web/tests/unit/nla.test.mjs`: `e11aa1f395970613cee5d37a9eb21c3fac3422f0080c75c78eb8777effb77adc`
+- `web/tests/unit/simulation-cache.test.mjs`: `2be82cdda991b47fbf8955cfbf2f92cb1fdc7b7c0debb0c8102d4f35e8fce8e3`
+- `web/app/src/workers/m10-domain-gate-test.worker.ts`: `bc508e1c81ca6efefd67b5c572f93c27dd71bd602319ae887c50e27f8a309a31`
+- `web/tests/e2e/m10-domain-browser-gates.spec.ts`: `2973a596df8613a9cfdb0bd4d300d95b71a8e818e615278a39fb777db6c5cf03`
+- `tests/golden/M10-15/domain-browser-gates.json`: `580051434ec6673251bac755cc189939de1f887aad088497e16a7657f3a83963`
+- `web/package.json`: `092931cebf9cb14814951703af26e2d0e4c5e0295c1ba4cb748bfe4ee49448c2`
+
+## Rollback
+
+Remove the NLA stack budgets/exact-field checks, restore the former Simulation cache
+budget error mapping, remove the domain Worker/E2E/golden/package command and this
+status file, then restore M10 to 14/15. Keep all M10-01 through M10-14 behavior.
--- a/docs/status/M11-01.md
+++ b/docs/status/M11-01.md
@@ -0,0 +1,42 @@
+# M11-01 Status
+
+status: done
+task: Camera, Light, World and Scene color-management field parity table
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+`tests/golden/M11-01/lighting-field-parity.json` is the machine-readable field table
+for all CameraIR, LightIR and WorldIR leaves plus Scene render engine and color
+management. Each field independently records reader, writer, main viewport and
+Offscreen viewport status as VERIFIED, PARTIAL, METADATA_ONLY, BLOCKED or
+NOT_APPLICABLE, with an aggregate parity status.
+
+The table contains 60 fields: 24 COMPLETE, 17 PARTIAL and 19 BLOCKED. It explicitly
+keeps true Orthographic/Panoramic/Custom projection, camera DOF rendering, light
+radius/area spread/sun angle, World environment rotation and visual Mist, display/
+view/look/gamma/white-balance rendering and Scene writer behavior outside COMPLETE.
+
+## Evidence
+
+- `npm --prefix web run test:lighting-field-parity`: AST table checker and the real
+  Main lighting roundtrip passed. The checker proves exact type coverage, unique fields,
+  valid states, existing evidence paths and required blocked claims.
+- The Main roundtrip covers Camera/DOF, Light exposure/temperature/shadow, World/Mist,
+  validation rejection, undo/redo, save/reopen and the white-balance integrity gate.
+- `WEB_TEST_PORT=5541 npm --prefix web run test:e2e -- --grep "N-019"`: Chromium 2/2,
+  covering Scene-over-World exposure, shadow metadata and renderer-bound World/Scene
+  delta preservation.
+- Typecheck, lint, production build (74 modules), status consistency and
+  `git diff --check`: passed.
+
+## Implementation Hashes
+
+- Parity table: `b7fee80b4f2469cf119902c939f9091e640a6f0e1307e97ba29f0afa8942c4ed`
+- AST checker: `cf910a087f9af72e0782d62e67341f90fd4af1c6c8eddf54169ee6275e24bd9c`
+- Package: `cd7174b04b19e61a280e03e6c61e2ffd20fd507c0716c820b8faa31ea2438ebf`
+
+## Rollback
+
+Remove the M11-01 table/checker/package command and this status file, restore M11 to
+0/14, and keep the existing N-019 reader/writer/viewport implementation unchanged.
--- a/docs/status/M11-02.md
+++ b/docs/status/M11-02.md
@@ -0,0 +1,48 @@
+# M11-02 Status
+
+status: done
+task: Supported Camera, Light and World fields through Main, history, persistence and viewport mapping
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+The bounded `setCameraProperties`, `setLightProperties` and `setWorldProperties`
+commands now have one task-level acceptance path through Blender Main, monotonically
+revisioned undo/redo, in-memory `.blend` save, a fresh Worker reopen and the shared
+main-thread/Offscreen PBR mapping functions.
+
+The golden covers Camera lens, both sensor dimensions and fit modes, shift, clip,
+ortho scale and DOF fields; Light color, energy/exposure, temperature, shadow, spot
+and area fields; and World color/exposure/Mist fields. Viewport assertions cover both
+horizontal and vertical sensor fit, clip and film offset, temperature-adjusted linear
+RGB, intensity, shadow, spot angle/blend, area dimensions and World background color.
+Fields kept PARTIAL or BLOCKED by M11-01 remain outside visual parity claims.
+
+## Evidence
+
+- `WEB_TEST_PORT=5545 npm --prefix web run test:lighting-field-roundtrip`: native
+  Main roundtrip passed and Chromium 1/1 passed.
+- Camera, Light and World edits each advanced revision; task-level Chromium coverage
+  undid and redid every domain, saved, opened the bytes in a fresh Worker and compared
+  the reopened values with float32-aware `1e-5` tolerance.
+- The native rejection path kept an invalid `near >= far` edit out of Main. Existing
+  white-balance integrity protection remained blocked after Blender serialization
+  rather than publishing invalid Scene color-management values.
+- `npm --prefix web test`: 156/156 passed. Typecheck, lint, production build
+  (74 modules) and `git diff --check` passed.
+
+## Implementation Hashes
+
+- Golden: `ac6d84c0099b12cf6c96df2dbbb4281e3308c36f0bda49c92d7548e58ccc286e`
+- Chromium spec: `9f75c7b88c70ab42c6c418b0056dcffcab3b8851003258891902db9615fcfe67`
+- Native roundtrip checker: `023e3e43bc37fb38c3063d33c20e59043308013874fce20bc3a49d508b850e6c`
+- Web command protocol: `48f2290ead27aeda1f17b279f01ae278776b50b4cb4de065d94b0e1d44717dbb`
+- Blender Main writer: `510b4017c540fc4d1ac135c1ce7251cc5d7143f31d8604e1d545de36716da9a2`
+- Shared PBR adapter: `78352e46c62d0c8d9bf25408ea1d725a843a42068ea3eb304bb3d78f8d612e0b`
+- Package: `8074d80265a1378fb3f284206c343ff1e388a5ea43e57946a1d4092076d72ea8`
+
+## Rollback
+
+Remove the M11-02 golden/spec/package command and this status file, restore M11 to
+1/14, and keep the underlying N-019 bounded writers and viewport mappings at their
+previous independently tested status.
--- a/docs/status/M11-03.md
+++ b/docs/status/M11-03.md
@@ -0,0 +1,55 @@
+# M11-03 Status
+
+status: done
+task: Explicit Three WebGL2 and WebGPU light, shadow-map and texture budgets
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+Schema 1 `PBRRenderBudget` freezes separate `THREE_WEBGL2` and `THREE_WEBGPU`
+product ceilings. WebGL2 reserves two built-in lights and one built-in shadow map
+inside totals of 16 lights and four 1024-square shadow maps. The WebGPU contract uses
+64 lights and eight 2048-square maps. Runtime device limits may only lower these
+ceilings.
+
+The shared planner deterministically retains light nodes in SceneIR order, retains a
+bounded shadow-capable prefix and reports every dropped identity with stable
+`GPU_LIGHT_BUDGET_EXCEEDED`/`GPU_SHADOW_BUDGET_EXCEEDED` issues. Main-thread and
+Offscreen production viewports publish the same report on the canvas.
+
+Texture planning covers asset count, maximum dimension, aggregate compressed payload
+and decoded RGBA GPU bytes before hash/decode/allocation. An over-budget batch leaves
+the previous texture set alive. This task defines the WebGPU budget contract but does
+not claim that the still-unbundled Three WebGPU renderer is available.
+
+## Evidence
+
+- `WEB_TEST_PORT=5548 npm --prefix web run test:render-resource-budget`: unit 3/3 and
+  Chromium 3/3. Both production viewports requested 20 lights, rendered 14, dropped
+  six, rendered three of 14 requested scene shadow maps and blocked 11; with reserved
+  resources, the main Three scene contained exactly 16 lights and four shadow maps.
+- A 257-asset batch was rejected before decode in both viewports. A separate browser
+  case first decoded a valid PNG, rejected a 257-asset follow-up (258 including the
+  retained asset), and proved the original texture object/hash remained installed.
+- M11-02 field roundtrip remained 1/1. Real 4K (64 MiB decoded) and 8K (256 MiB
+  decoded) texture performance cases passed; packed raster main/Offscreen passed 2/2.
+- Full unit was 159/159. Typecheck, lint, production build (75 modules), local runtime
+  dependency checks and `git diff --check` passed.
+
+## Implementation Hashes
+
+- Budget protocol: `d7784690358e38b71c6ad3ccc5baf82869d897714d5257f219bbd00dc7e7b0f7`
+- PBR adapter: `934874434afa6778eaf783c78650ad221a428352741f3ff7173cb3c17a0c3c14`
+- Texture store: `0f18f3bcf04c5c99175d4cac8bbf1bc028fc54d635701fb6a92791e06c335fb6`
+- Main viewport: `dcb502ca892fd5431cbf1a13823aec5d83a2aa0a1b40487cb66fa630c6e461b3`
+- Offscreen Worker: `c95bce10f0bd73591f002c21415bfbc6f709ecbe61e97a3b5b05bcec2b0e0bef`
+- Unit: `4bde90788bbf9a94317d83bd398acd321bbcf4e53e26bf40165a889bacff03a2`
+- Chromium spec: `90834dfff09e61a2d32732d3a8f0db4b9c71414ac4991412d93d322119ef2de7`
+- Golden: `c312bf5ed8415ad51e5cccb3a2653f65cd9fee46488be2f860e6a5a8d5a7901d`
+- Package: `c718983c3f3a552f4c68d9390376777e45a3f23e6999afd5cb4ddc786a12a278`
+
+## Rollback
+
+Remove the render-budget protocol, planner integration, canvas reports, unit/E2E/
+golden/package command and this status file; restore the former fixed 1024 shadow
+configuration and per-asset-only texture checks, then restore M11 to 2/14.
--- a/docs/status/M11-04.md
+++ b/docs/status/M11-04.md
@@ -0,0 +1,56 @@
+# M11-04 Status
+
+status: done
+task: Explainable image-error metrics between the Web realtime viewport and a Blender 5.2 reference
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 `RenderImageComparisonIR` compares equal-size display-referred `SRGB8`/
+`STRAIGHT` RGBA frames. The report records mean absolute error, root mean squared
+error, P95 channel error, maximum channel error, bad-pixel ratio, reference-background
+foreground intersection-over-union and alpha coverage delta. Each release check keeps
+its measured value, threshold, direction and pass state; a mismatch returns the stable
+`RENDER_REFERENCE_MISMATCH` code. Dimensions, byte lengths, threshold ranges and a
+4,194,304-pixel bound are validated before comparison.
+
+The reference is generated by Blender 5.2 Eevee from
+`tests/files/web/m11_render_reference.blend` with a fixed camera, black rough material,
+World color, one-sample TAA and zero dither. The source fixture, generator and PNG are
+SHA-256 bound in `tests/golden/M11-04/manifest.json`. Re-render verification compares
+decoded Blender pixels exactly because PNG container bytes may differ while pixels do
+not.
+
+## Evidence
+
+- `WEB_TEST_PORT=5552 npm --prefix web run test:render-reference`: unit 3/3,
+  Blender reference re-render verification passed, Chromium 3/3. Main-thread and
+  Offscreen reports were identical: MAE `2.0433349609375`, RMS `5.448994264342599`,
+  P95 `4`, maximum channel error `110`, bad-pixel ratio `0.0047760009765625`,
+  foreground IoU `0.9853400565736072`, alpha coverage delta `0`.
+- Thresholds are MAE `4`, RMS `12`, P95 `12`, bad-pixel ratio `0.02`, foreground
+  IoU `0.97` and alpha coverage delta `0`. A non-empty red block with the wrong
+  composition is rejected as `RENDER_REFERENCE_MISMATCH`.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, production build
+  (75 modules), `npm --prefix web run test:status-consistency` and `git diff --check`
+  passed.
+
+## Implementation Hashes
+
+- `web/protocol/render-image-comparison.ts`: `4345cc0d02b4482201de34292cbf5198009bf615e69c80cc00bc3e76116efec2`
+- `web/app/src/three-adapter/render-image-comparison.ts`: `ad97fd594d0d964e05d4da2bffc84a64ef737fef700045c252b5222250f1ffc7`
+- `web/protocol/error.ts`: `e8ea483466b16debaf803ff1640ade07a858a802781e3040d3547028ecb5d19f`
+- `tools/web/generate-m11-render-reference.py`: `118c98c77d98922e72660898bfb65842e11743fc77f4124c9f5088a76cb6a94a`
+- `tools/web/check-render-reference.mjs`: `ead3500f054e98c2db4cd6596c983586a622e929bc8a587e9fbd38d94a7df7d1`
+- `web/tests/unit/render-image-comparison.test.mjs`: `f9800745760b85700e80abc5e389f44d7f7ea3b9e41e1002f4e5449bcb620f67`
+- `web/tests/e2e/render-reference.spec.ts`: `349c7da0dfd60baec80139cced52079312bd5e892a42f000ba0b4f55c6a4a61d`
+- `tests/files/web/m11_render_reference.blend`: `d2bea55fe4de0b00e73a9241b4d1b0c802c2eb0e6159c0cd48e007b97b9d3963`
+- `tests/golden/M11-04/blender-eevee-reference.png`: `f5c22636a232bcbb0ed0f772418cb12fced18ff72f4999804197e42caa61480a`
+- `tests/golden/M11-04/manifest.json`: `e9551f86f0b9704d7be35c03f07321bec5d2481ffee4208ae766156d9c9a0135`
+- `web/package.json`: `38ba6a722a2e0bc2c91d6edbd2b7df5e3609342e3b7ef2ec9646b9c6ce0d25a6`
+
+## Rollback
+
+Remove the M11-04 protocol, reference fixture/golden, generator/checker, unit/E2E
+specs and package command; restore M11 to 3/14 and remove the bounded reference slice
+from N-019. Keep M11-01 through M11-03 resource and lighting behavior unchanged.
--- a/docs/status/M11-05.md
+++ b/docs/status/M11-05.md
@@ -0,0 +1,47 @@
+# M11-05 Status
+
+status: done
+task: Server-only routing for Cycles, complex Eevee and hardware render backends
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 `RenderRoutingRequestIR` separates execution target from endpoint
+availability. Only bounded Eevee on WebGL2, or WebGPU after both browser and bundled
+renderer capability checks, may return `WEB_LOCAL_BOUNDED/READY`. Cycles, complex
+Eevee, Workbench final rendering and CUDA/OptiX/HIP/Metal/oneAPI requests always
+target `SERVER_JOB`; the default unconfigured endpoint returns
+`SERVER_JOB_UNAVAILABLE` without a local approximation. Unknown, syntactically valid
+SceneIR engine identities fail closed as `PLATFORM_CAPABILITY_UNAVAILABLE`.
+
+Setting `serverRenderAvailable:true` can make a server route `READY`, but only proves
+the routing decision. It does not submit a job or claim the source/build/settings/
+output hash contract reserved for M11-06.
+
+## Evidence
+
+- `WEB_TEST_PORT=5556 npm --prefix web run test:render-routing`: unit 3/3 and
+  Chromium 1/1. The browser reads `BLENDER_EEVEE` from the real M11 reference `.blend`
+  through the production WebEngine Worker before checking the local/server matrix.
+- Cycles, complex Eevee and OptiX all remained `SERVER_JOB/BLOCKED` with
+  `SERVER_JOB_UNAVAILABLE` under the production default. A synthetic configured
+  server context returned `SERVER_JOB/READY`, never a Web target.
+- Unbundled WebGPU remained `WEB_LOCAL_BOUNDED/BLOCKED` with
+  `WEBGPU_RENDERER_UNAVAILABLE`; an unknown engine remained server-targeted and
+  blocked with `PLATFORM_CAPABILITY_UNAVAILABLE`.
+- Typecheck, lint, production build (75 modules) and `git diff --check` passed.
+
+## Implementation Hashes
+
+- `web/protocol/render-routing.ts`: `2d41d48609635c810572aaae95979df2fe9e49bbd130c60d70f64042c5d0f097`
+- `web/app/src/three-adapter/render-routing.ts`: `f360c05fa62aa830a486c5be4747488fcbb5ba9b68d82b4f7187e1267da46fa6`
+- `web/tests/unit/render-routing.test.mjs`: `4ac2e7a6c2265f948d971f72effb4ff9ad1c51839ab6c06d496fc2b0768c4fa8`
+- `web/tests/e2e/render-routing.spec.ts`: `e5572d9ad9426f1dcc1856fe426261910093fa2f5460117e4ffdcfc7b23b10a1`
+- `tests/golden/M11-05/render-routing.json`: `53c5d3a2e51f251d14953594567081597be4250be5b1236832370e74805bd35d`
+- `web/package.json`: `716a5331990618892bca97f48c7eef589a5af6c5131b8cf3ae52a1b9d923644c`
+
+## Rollback
+
+Remove the M11-05 routing protocol/wrapper, unit/E2E/golden/package command, restore
+M11 to 4/14 and remove the N-019 server-routing completed slice. Keep M11-04 realtime
+reference metrics and all earlier lighting/resource behavior unchanged.
--- a/docs/status/M11-06.md
+++ b/docs/status/M11-06.md
@@ -0,0 +1,48 @@
+# M11-06 Status
+
+status: done
+task: server render job provenance binding
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+`web/protocol/server-render-job.ts` defines schema 1 for a server render request and
+result. A request is accepted only when the uploaded `.blend` bytes match its declared
+source SHA-256 and byte length, the Blender build is a declared 5.2 build with a
+content hash, and canonical bounded render settings match `settingsSha256`. The
+request itself is bound by `requestSha256`.
+
+A successful result carries the same source/revision/build/settings identity and adds
+output MIME, byte length, and output SHA-256, plus `resultSha256`. Consumers recalculate
+the output hash before accepting pixels. The contract does not claim a remote queue,
+progress, cancellation, denoise, or Freestyle implementation; those remain later
+M11 tasks.
+
+## Evidence
+
+- `npm --prefix web run test:server-render-job`: unit 3/3 and a real loopback server
+  check passed.
+- The check used Blender 5.2.0 headless to open
+  `tests/files/web/m11_render_reference.blend` and render a PNG from the submitted
+  source bytes. It verified source/build/settings/output hashes and rejected source,
+  build, settings, and output tampering.
+- Result: `server-render-job-ok blender=5.2.0 source=d2bea55fe4de0b00e73a9241b4d1b0c802c2eb0e6159c0cd48e007b97b9d3963 settings=97bb832618bd27e8763722afa0d250ef74383fb355f0ff38763930f57ba1590b output=564b95cd501da2636085aeada88814c4a3b7af7b1f0188543a1863fe34dd091e bytes=3915 source-hash=1 build-hash=1 settings-hash=1 output-hash=1 tamper=4`.
+- Full regression passed: typecheck, lint, Node `168/168`, status consistency
+  (`12` parity blocked, `0` release blocked), release evidence (`17` records,
+  `0` missing), production build (`75` modules), and `git diff --check`.
+
+## Implementation Hashes
+
+- `web/protocol/server-render-job.ts`: `e2b5b95032b0dbcb346aa35d1a10a3b55d6c006603f16b9e72c3de45763906c5`
+- `web/protocol/error.ts`: `747ea52fd96b3ec7ede9ce72c15f56fdc454836ba5bf924cc60198096d4986de`
+- `web/tests/unit/server-render-job.test.mjs`: `c84f86365006360f146601839d7e1394f3f7bc7fa71dcbf62d8d4e4321cdd16d`
+- `tools/web/check-server-render-job.mjs`: `6dd49fbd1be202a88fa714b2fb81305018da6df5f9d73c95e048e3697742764e`
+- `tools/web/render-server-job.py`: `48950b0884a52a40ae234f8bbe590a0cb89e58c4d2a2de40ea638f491d111aff`
+- `tests/golden/M11-06/server-render-job.json`: `36f083f8da7585f850e748e6ac78fc57cd6e8d59bce03d77eee3acd2fa042ae7`
+- `web/package.json`: `628191a76c7614393a74969bd000faa8a6302d887265d13a1ad49dcfc401c2fc`
+
+## Rollback
+
+Remove the server-render-job protocol, error codes, unit/check commands, and this status
+record; restore M11 to 5/14 and remove the M11-06 completed slice. Keep M11-05 routing,
+M11-04 reference metrics, and all earlier lighting/resource behavior unchanged.
--- a/docs/status/M11-07.md
+++ b/docs/status/M11-07.md
@@ -0,0 +1,36 @@
+# M11-07 Status
+
+status: done
+task: compositor allowlist CPU/WebGPU node goldens
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+The schema 1 WebGPU compositor allowlist contains only `CONSTANT_COLOR`, `EXPOSURE`,
+`INVERT`, and `COMPOSITE`. A Blender 5.2 fixture supplies an independent constant,
+exposure, invert, and integrated-chain scene through the production Main/WASM reader.
+The production CPU executor and a real Chromium WebGPU compute pipeline must produce
+identical `LINEAR_SRGB` Float32 RGBA bytes for every case.
+
+Resource inputs, branching graphs, Viewer, Transform, Alpha Over, Blur, Mix, and
+undeclared Blender nodes remain outside the allowlist and fail before shader
+compilation. This task does not claim the M11-08 graph-preservation pipeline, HDR/color
+management parity, a production compositor scheduler, or server compositor execution.
+
+## Evidence
+
+- `WEB_TEST_PORT=5562 npm --prefix web run test:compositor-node-golden`: Node 3/3,
+  Blender 5.2 Main/WASM fixture check, and Chromium WebGPU 1/1 passed.
+- The four CPU and WebGPU Float32 SHA-256 values match the committed golden exactly;
+  maximum absolute error is `0`.
+- The first run without an isolated port passed Node/native checks but did not start
+  Chromium because port 5173 was already occupied. It was not counted as evidence;
+  the complete command was rerun on port 5562.
+- Full regression passed: typecheck, lint, Node 171/171, production build, status
+  consistency, release evidence validation, and `git diff --check`.
+
+## Rollback
+
+Remove the WebGPU compositor plan/executor, M11-07 fixture/goldens/tests, and this
+status record; restore M11 to 6/14 and remove the N-020 WebGPU golden completed slice.
+Keep the existing bounded CPU compositor and Main graph reader unchanged.
--- a/docs/status/M11-08.md
+++ b/docs/status/M11-08.md
@@ -0,0 +1,37 @@
+# M11-08 Status
+
+status: done
+task: preserve unsupported compositor graphs and block execution
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+The CPU compositor and cached execution entry points now preflight the complete parsed
+graph before evaluation or cache lookup. Any `UNSUPPORTED` node blocks with
+`COMPOSITOR_NODE_UNSUPPORTED`, including a disconnected node that does not contribute
+to the Composite output. Unsupported Blender type names are sorted and deduplicated so
+the failure is deterministic.
+
+The gate is pure: it does not remove nodes, rewrite links, advance Main revision, run a
+cancellation callback, allocate an output, or accept a previously cached result. The
+existing Blender 5.2 fixture preserves its Glare node name, `UNSUPPORTED` IR type, and
+`CompositorNodeGlare` source type before and after the failed attempt.
+
+## Evidence
+
+- `WEB_TEST_PORT=5565 npm --prefix web run test:compositor-unsupported-gate`: unit 2/2,
+  native Main reader, and Chromium 1/1 passed.
+- `WEB_TEST_PORT=5566 npm --prefix web run test:e2e -- --grep "N-020"`: 2/2 passed;
+  the supported synthetic CPU graph still executes, while the real graph containing a
+  disconnected Glare node now fails closed.
+- The first new unit run was 172/173 because an async rejection used `assert.throws`.
+  It was corrected to `await assert.rejects`; no implementation failure was counted as
+  evidence. The complete Node suite then passed 173/173.
+- Full regression passed: typecheck, lint, production build, status consistency,
+  release evidence validation, and `git diff --check`.
+
+## Rollback
+
+Remove the complete-graph preflight from CPU/cached execution and the M11-08 tests and
+golden, restore the old N-020 smoke expectation, restore M11 to 7/14, and remove the
+N-020 completed slice. Keep M11-07 CPU/WebGPU goldens unchanged.
--- a/docs/status/M11-09.md
+++ b/docs/status/M11-09.md
@@ -0,0 +1,43 @@
+# M11-09 Status
+
+status: done
+task: runtime codec probes for IMAGE, SOUND, and MOVIE strips
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 codec probe requests and receipts bind the Sequencer strip family, canonical
+MIME type, source byte length, and source SHA-256. File names and source paths are not
+accepted by the probe contract, so extensions cannot grant capability. A READY receipt
+must also use the family-specific backend and carry validated decoded dimensions or
+audio frame metadata.
+
+The production browser probe hashes the supplied bytes and performs a real decode:
+`createImageBitmap` for IMAGE, a fixed 48 kHz `OfflineAudioContext` for SOUND, and a
+muted `HTMLMediaElement` load/seek/canvas readback for MOVIE. The committed movie is a
+deterministic 16x16, two-frame H.264 MP4 generated locally by FFmpeg. This task does not
+claim frame-accurate WebCodecs seeking, waveform/proxy generation, A/V synchronization,
+arbitrary codec support, or final encoding.
+
+## Evidence
+
+- `WEB_TEST_PORT=5570 npm --prefix web run test:sequencer-codec-probe`: unit 3/3 and
+  Chromium 1/1 passed. PNG, WAV, and H.264 MP4 returned READY with their expected
+  runtime backend and decoded metadata.
+- Deliberately wrong file extensions had no effect. Corrupt bytes, source identity
+  drift, PNG bytes declared as MOVIE, a forged backend, and a forged receipt all stayed
+  BLOCKED with `SEQUENCER_CODEC_UNSUPPORTED` at the gate.
+- The first Chromium attempt failed before business execution because `/protocol` is
+  not exposed by Vite; the test now imports the existing app adapter. The second decoded
+  all media but exposed device-rate Web Audio resampling; the production probe now uses
+  a fixed 48 kHz OfflineAudioContext. The complete command was then rerun successfully.
+- Sequencer Main reader, N-021 browser regression, and the one-million-frame long media
+  performance/restart test passed. Full regression passed: typecheck, lint, Node suite,
+  production build, status consistency, release evidence validation, and
+  `git diff --check`.
+
+## Rollback
+
+Remove the codec probe protocol/runtime/tests/movie fixture, restore the MIME-set gate,
+restore M11 to 8/14, and remove the new N-021 completed slice. Keep the V1 long-media
+IMAGE/SOUND index/cache behavior and all M11-08 compositor behavior unchanged.
--- a/docs/status/M11-10.md
+++ b/docs/status/M11-10.md
@@ -0,0 +1,57 @@
+# M11-10 Status
+
+status: done
+task: bind long-media proxy/cache entries to source hash and runtime decode capability
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 proxy-cache manifests bind the complete movie source identity, the source-bound
+M11-09 READY decode receipt, an explicit SRGB8/STRAIGHT RGBA8 profile, and the source
+frame into one deterministic SHA-256 cache identity. The proxy payload has an independent
+byte length and SHA-256. Source drift, decode-capability drift, identity tampering, and
+payload tampering therefore fail with separate stable codes.
+
+The production browser adapter verifies the movie bytes before decode, captures only the
+initial decoded HTMLMedia frame, and stores verified copies in a 64 MiB-bounded LRU. The
+Chromium gate persists the RGBA8 payload and its manifest through the content-addressed
+Storage Worker path, creates a new Storage Worker, and verifies the reopened bytes against
+the current runtime receipt. This task does not claim frame-accurate proxy generation,
+seek/scrub publication, waveform generation, A/V synchronization, or final encoding.
+
+## Evidence
+
+- `WEB_TEST_PORT=5573 npm --prefix web run test:sequencer-media-cache`: unit 3/3 and
+  Chromium 1/1 passed. The real 16x16 H.264 fixture produced one 8x8/256-byte RGBA8
+  proxy; its cache identity is
+  `68a3af14865841e81f69bd75f2605461de4819fe025d158ac3723fa0cdf31525`.
+- A one-frame cache budget admitted frame 0, returned a copied hit, then evicted it when
+  frame 1 was inserted. `clear()` released exactly 256 bytes and left zero entries.
+- Source hash drift, READY receipt metadata drift, payload mutation, and bad source bytes
+  returned `SEQUENCER_CACHE_SOURCE_MISMATCH`,
+  `SEQUENCER_CACHE_CAPABILITY_MISMATCH`, or `SEQUENCER_CACHE_HASH_MISMATCH` as
+  appropriate. Blocked receipts, undeclared profile fields, oversized RGBA8 profiles, and
+  upscaled profiles were rejected before cache insertion.
+- The first unit run was 2/3 because the test incorrectly treated exactly 64 MiB as over
+  budget; the corrected 64 MiB plus one-row case passed. The first Chromium run completed
+  all business operations but sampled `statsBeforeClear` after `clear()`; the sampling
+  order was fixed and the full command rerun on ports 5572 and 5573.
+- Regression passed: M11-09 unit 3/3 plus Chromium 1/1, one-million-frame long-media 1/1,
+  Sequencer Main reader, full Node 179/179, typecheck, lint, and production build (75
+  modules).
+
+## Artifact Hashes
+
+- protocol: `1dd5ee8cade2642723bac6f0c8e34d09cf178d000beba6eb63626284ee35fd5e`
+- browser adapter: `57070b1a42129afdfb8121ec11a48b0792b3de9d84f7e8a78017c7d6e12343aa`
+- app protocol exports: `8ca82257c758580f5fe91a3a5cd21f8ae9e9ce10f9fa71fcd7cf1f30e0b6367b`
+- unit: `f4cc1171dd6875bf079e242beed846409a1d1f53b9497882aa475bd2773b43c7`
+- Chromium spec: `6d9d26e3639a74b173f77ec5d67e53e5ec42b88dd6e34bda54c8168b8251423e`
+- golden: `39a71f8d97f0045da6ec913b6a0231ac3363f67a420eea5ab3fabaa8f1d47c33`
+- package: `2c7fb9f8657155088e4a080443b8a0ba9c13aae9f46f1807ff3b8820640c44c4`
+
+## Rollback
+
+Remove the proxy-cache protocol/runtime/tests/golden and package command, restore M11 to
+9/14, and remove the new N-021 completed slice. Keep M11-09 runtime codec probes and the
+V1 long-media index/cache evidence unchanged.
--- a/docs/status/M11-11.md
+++ b/docs/status/M11-11.md
@@ -0,0 +1,52 @@
+# M11-11 Status
+
+status: done
+task: revision-gate late seek, scrub, and decode results before publication
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 uses one request identity for SEEK, SCRUB, and DECODE. Every request binds a
+timeline ID, timeline revision, monotonically increasing request revision, operation,
+and frame. A completed result must echo that identity and add a bounded source frame and
+payload SHA-256. Publication is allowed only when both the timeline revision and latest
+request revision still match the controller state.
+
+The production controller advances one shared request revision across all three operation
+types. Replacing a timeline invalidates every pending request before a new request begins,
+and same-timeline revisions must advance monotonically. The publish callback is invoked
+only after the pure gate returns PUBLISH, so stale results cannot update the visible frame
+or write a decoded payload into cache. This task does not claim frame-accurate WebCodecs
+seeking or the M11-14 cancellation/restart resource lifecycle.
+
+## Evidence
+
+- `WEB_TEST_PORT=5576 npm --prefix web run test:sequencer-media-revision`: unit 4/4
+  and Chromium 1/1 passed on the first complete run.
+- Chromium scheduled SEEK revision 1 behind SCRUB revision 2. SCRUB published first and
+  the late SEEK returned `STALE/REVISION_CONFLICT`. A real H.264 runtime decode started at
+  timeline revision 7, completed after replacement with revision 8, and was rejected
+  before publish/cache. The revision-8 DECODE published; a forged result identity stayed
+  stale.
+- The machine sequence is frozen in
+  `tests/golden/M11-11/sequencer-media-revision.json`: only `SCRUB@2` and `DECODE@5`
+  publish, and only `DECODE@5` reaches the cache-write callback.
+- Regression passed: M11-10 unit 3/3 plus Chromium 1/1, M11-09 unit 3/3 plus Chromium
+  1/1, one-million-frame long-media 1/1, full Node 183/183, typecheck, lint, and production
+  build (75 modules).
+
+## Artifact Hashes
+
+- protocol: `326f1525f50af3b2c4132ff58508ed6174ba3aa4a5075b2a6660e549c280826a`
+- production controller: `29a44404bb28e46d67439eec0622a69ce4cd7264ce45da77a3f320c8687b7006`
+- app protocol exports: `be2eca8482a60e437878b99f69d3178f47fee61618886d141760320e3a3ed1e1`
+- unit: `2099f738120897dfbb8662741831774b5f9150d51924dfa7832907177de5e7`
+- Chromium spec: `e47f105360ce0e2d4d561d3cf790ceec9f41dd6bac7361965914ada307db843c`
+- golden: `672b4fde6e27f8b15cd51d839cacb5efb128c0d0f4c7f6aa4e184c713f9b45e5`
+- package: `5d17b17d67ee587191552c3dfe226cd8f2e5a872791224d8e6c22aafa1177ebe`
+
+## Rollback
+
+Remove the media revision protocol/controller/tests/golden and package command, restore
+M11 to 10/14, and remove the N-021 revision-gate slice. Keep M11-09 runtime probes,
+M11-10 proxy-cache identity, and the V1 long-media generation behavior unchanged.
--- a/docs/status/M11-12.md
+++ b/docs/status/M11-12.md
@@ -0,0 +1,58 @@
+# M11-12 Status
+
+status: done
+task: keep final video encoding on an explicit server-export capability route
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 final-export requests bind the Main timeline ID/revision, source `.blend`
+SHA-256, bounded frame range and rational frame rate, output dimensions, and one declared
+container/video/audio codec combination. The canonical encoding settings and the complete
+source identity receive separate SHA-256 hashes, so source revision drift and settings
+drift produce different request identities.
+
+The only route is `SERVER_EXPORT`. A missing endpoint fails closed with
+`SEQUENCER_EXPORT_SERVER_UNAVAILABLE`; a configured endpoint returns
+`SERVER_EXPORT_REQUIRED`, not local success. Browser `VideoEncoder` availability is
+recorded for diagnostics only and cannot change the route or the invariant
+`localEncoding=BLOCKED`. This task does not claim a server encoder implementation,
+upload/progress/cancellation, audio mixing, or encoded-output verification.
+
+## Evidence
+
+- `WEB_TEST_PORT=5579 npm --prefix web run test:sequencer-final-export`: unit 4/4 and
+  Chromium 1/1 passed on the first complete run.
+- Chromium opened the real Blender 5.2 `sequencer_scene.blend` through WebEngine Main and
+  bound timeline `sequencer:scene:SequencerScene`, revision 1, frames 1..250, 24000/1001
+  FPS, and source SHA-256
+  `5f5212487bb6b5df62b5ca915c75133f1ca45678614712ea4c7d902d823cd90c`.
+- The fixed settings hash is
+  `01e39d1fdd88c75aecad7bc48a2b756bbcd645929963528b42ceb180b51e5566`;
+  the source/timeline/settings request hash is
+  `20d3a9e333804e014a993a9892a557842293fc44902229dd6eb65661f0691cfc`.
+- No-server, server-without-encoder, server-with-injected-encoder, and actual Chromium
+  runtime cases all retained the server route and blocked local encoding. Undeclared
+  fields, invalid codec combinations, over-budget ranges, and environment drift returned
+  `SEQUENCER_EXPORT_REQUEST_INVALID`.
+- Regression passed: M11-09 unit 3/3 plus Chromium 1/1, M11-10 unit 3/3 plus Chromium
+  1/1, M11-11 unit 4/4 plus Chromium 1/1, one-million-frame long-media 1/1, Sequencer Main
+  reader, full Node 187/187, typecheck, lint, and production build (75 modules).
+
+## Artifact Hashes
+
+- protocol: `559516163ce9a9c60917033455c71a1ae6be2f34666371f12723a056ddfdb3dd`
+- browser adapter: `f9f193eb71afa48a23b4eb618cd98b5c0064c59943b3652fb6a601b545ac175c`
+- app protocol exports: `d30783528fabaaefe8835998e11d75da357d265ee06db67713e57e4b85b58d7d`
+- error contract: `747894b216db59c753b24ce85eb946925e64340f63684311e5d9628c9a6a9c8e`
+- unit: `6f5030852e89160fd898b2aff4dc9911963342bd6c2301a2c0e8a3d518ddbcbd`
+- Chromium spec: `d8cba79c9a330c1e5c777c8f0ed08362b29f50702c31d8229fd65f4304bce363`
+- golden: `c0061f82ef156e53ad4dfc6aedf7c6a8f53e616d8d9fa1435fd9491ba3d07e01`
+- package: `83ee5bfa50a0e5b742048d4563ae815171232a121cf3df4a1e813f21313a6509`
+
+## Rollback
+
+Remove the final-export protocol/browser adapter/tests/golden and package command, remove
+the two export error codes and SequencerTimeline exports, restore M11 to 11/14, and remove
+the N-021 final-export completed slice. Keep M11-09/10/11 decode, proxy, and revision
+gates and the existing `sequencerRuntimeCapabilities().localEncoding=BLOCKED` contract.
--- a/docs/status/M11-13.md
+++ b/docs/status/M11-13.md
@@ -0,0 +1,58 @@
+# M11-13 Status
+
+status: done
+task: verify AudioContext suspend, resume, missing-device, and mute recovery
+updated: 2026-08-17 America/New_York
+
+## Scope
+
+Schema 1 audio-session reports separate context state
+(`UNAVAILABLE/SUSPENDED/RUNNING/CLOSED`) from output state
+(`BLOCKED/SILENT/ENABLED`). Every initialize, resume, suspend, mute, device-recovery, and
+close operation advances a monotonic revision. Reports bind the mute flag, effective gain,
+and a stable issue code, and reject contradictory states such as enabled output from a
+suspended or muted context.
+
+The production `SequencerAudioSession` owns one `AudioContext` and master `GainNode`.
+Mute schedules gain zero; unmute restores the configured nominal gain. Suspend and resume
+must reach the corresponding real context state before output can be enabled. Missing API,
+constructor failure, and resume/suspend failure remain silent with structured errors.
+Closing first zeros and disconnects the gain node, closes the context, drops all references,
+and reports `CLOSED/SILENT`. This task does not claim waveform generation, A/V sync,
+multi-strip mixing, output-device selection, or encoded audio export.
+
+## Evidence
+
+- `WEB_TEST_PORT=5586 npm --prefix web run test:sequencer-audio-recovery`: unit 3/3 and
+  Chromium 1/1 passed on the first complete run.
+- The Chromium case creates a real `AudioContext` inside a trusted click handler, then
+  verifies suspend, mute, resume-while-muted, unmute, second suspend/resume, and close.
+  Muted output remains `RUNNING/SILENT` at gain 0; unmute restores
+  `RUNNING/ENABLED` at gain 0.75; close reports `CLOSED/SILENT` at gain 0.
+- A scope without `AudioContext` returns
+  `UNAVAILABLE/BLOCKED/SEQUENCER_AUDIO_DEVICE_UNAVAILABLE`. The deterministic unit path
+  then makes a constructor available and verifies `recoverDevice()` plus resume. Constructor
+  and resume failures stay silent; malformed state reports return
+  `SEQUENCER_AUDIO_CONTEXT_INVALID`.
+- Regression passed: M11-09 unit 3/3 plus Chromium 1/1, M11-10 unit 3/3 plus Chromium
+  1/1, M11-11 unit 4/4 plus Chromium 1/1, M11-12 unit 4/4 plus Chromium 1/1,
+  one-million-frame long-media 1/1, Sequencer Main reader, full Node 190/190, typecheck,
+  lint, and production build (75 modules).
+
+## Artifact Hashes
+
+- protocol: `0b1b75c7630b599723914bbced9ee0a107bd8c0ac4382ced1f1c5114dac8fd01`
+- production controller: `c09914d2581ee454e042ed6a9ef5b8c0f6f7b0688eadb1deff45163263742109`
+- app protocol exports: `e630f647ddd3680a04e07ce7388cf03f54268d4e2d839aa5991cb9ceb6a53bda`
+- error contract: `6589f712058a39a2177cb174cc355c01777a549d254c4b9eac2301a344c619f2`
+- unit: `1a888d1b19a3d12091e6edd05287a5bcc19912415cf7f2ed73a028d12846a298`
+- Chromium spec: `1b94ea07ab5fafb0b06fbd73742c77d6b69d745a546fc60def85857844afc719`
+- golden: `584aea46687fd5cec8d89e8fac51314acc9a8d05af2a8d762e8d6a74483e0940`
+- package: `8d87390f9b1b7382bf9c0ba189f7a9d95daa3ee15d1d422a8d856fa4eb6d3cca`
+
+## Rollback
+
+Remove the audio-session protocol/controller/tests/golden and package command, remove the
+four audio error codes and SequencerTimeline exports, restore M11 to 12/14, and remove the
+N-021 audio-recovery completed slice. Keep M11-09 offline audio decoding and M11-12 final
+export routing unchanged.
--- a/docs/status/M9-14.md
+++ b/docs/status/M9-14.md
@@ -0,0 +1,57 @@
+# M9-14 Status
+
+status: done
+task: Curve、Grease Pencil、Paint 三编辑域故障恢复闭环
+updated: 2026-08-16 America/New_York
+
+## Scope
+
+`web/protocol/editing-domain-recovery.ts` freezes one schema-v1 evidence shape for
+the three domains. Each report must prove Main identity, Worker generation, OOM
+fault mapping/cleanup, WebGL2 resource release/reinitialization, and a visible
+small-scene recovery. Save/reopen may reset the logical Main revision; the
+content identity SHA-256 remains the authoritative recovery check.
+
+## Evidence
+
+- Curve fixture: `tests/files/web/nonmesh_scene.blend`, SHA-256
+  `ae8ef85d606aa120ce6b7611fc03407fd80bb60311e94a6ef73f6384d0b6c8b4`.
+- Grease Pencil fixture: `tests/files/web/modifier_grease_pencil_scene.blend`, SHA-256
+  `3a8525077807f9178dac3a5ba84b524e5f8e80874b15c54e2a6658ecb80315a3`.
+- Paint fixture: `tests/files/web/attribute_scene.blend`, SHA-256
+  `12fa75bb79f8c38e660d3d2a8fc9cc16dd3df4fc9208b0e2ad94fb1f8aa68f71`.
+- `WEB_TEST_PORT=5435 npm --prefix web run test:editing-domain-recovery`: unit 3/3 and
+  Chromium 1/1. All three reports returned `RECOVERED` for Worker restart, OOM,
+  GPU release and small-scene stages.
+- Full unit suite: 127/127 tests passed.
+- `npm --prefix web run typecheck`: passed.
+- `npm --prefix web run lint`: passed.
+- `npm --prefix web run build`: passed, Vite production bundle transformed 73 modules.
+- `git diff --check`: passed.
+
+## Implementation hashes
+
+- Protocol: `42ab53dde3161ec31ca7de420046a2c06f58408b3ac4919c9904e02d875af258`.
+- Browser runner: `2bb9805795fc2104e5443207a08951ac7684e67913064d6795c9d165b0c54c7e`.
+- Unit test: `ca565149e7769b40f59e865e42d2dfb0f4ecb2a4655371004678c14536ec9ef6`.
+- Chromium test: `7ab3421d1b44eb78d13525f67a26f1f6ed20816ae9b43c010c9ed3ebdf32c09a`.
+- Golden manifest: `f548052f39f6259f30b0569528160512aad955e61e8e8559e0d553c30d5619f9`.
+
+## Recovery boundaries
+
+- Worker restart uses a fresh `WebEngineClient`/Worker and reopens the saved bytes;
+  stable domain identity is required, while revision reset on a newly serialized
+  `.blend` is accepted and recorded.
+- OOM uses the token-isolated `GPU_GEOMETRY_UPLOAD` fault point. A tracked texture
+  lease is released before close; the matching error is
+  `GPU_GEOMETRY_BUDGET_EXCEEDED`, with zero live temporary resources.
+- GPU release disposes geometry, material and renderer once, then creates a fresh
+  WebGL2 renderer and requires non-zero pixels for the same domain probe.
+- Small-scene recovery requires the reopened data IDs, identity hash, object count
+  and visible pixels to match the committed baseline.
+
+## Rollback
+
+Remove the M9-14 protocol/runner/tests/golden and package script together. Existing
+Curve, Grease Pencil and Paint writers remain unchanged; no persisted schema or
+release metadata migration is required.
--- a/docs/status/N-012.md
+++ b/docs/status/N-012.md
@@ -7,14 +7,46 @@

 本轮已交付版本化 `GeometryNodeGraphIR`、node/socket/link/domain 校验、支持节点白名单、
 循环依赖和自递归 group 检测。Object/Collection/Image Info 资源现在按 SceneIR stable ID、
-资源类型、owner cycle 和 linked/missing/corrupt 沙箱校验。合法图仍只通过协议门，native
-lazy-function evaluator 未启用时返回 `CAPABILITY_MISSING`。
+资源类型、owner cycle 和 linked/missing/corrupt 沙箱校验。保存于 Blender Main 的 allowlist
+图已启用有界 native evaluator；任意图写回仍返回 `CAPABILITY_MISSING`。

-`SimulationCacheManifestIR` 已绑定 graph/source blend/input hash、Blender 5.2、完整帧范围、
-连续 byte range、总 payload 和逐帧 SHA-256。StorageWorker schema 6 使用 OPFS 内容寻址资产
-和 `simulation_manifest` 索引，写入前核对当前 committed blend，Worker 重启后重新逐帧验证；
-缺失、版本不符和损坏均结构化阻断。
+M10-01 已把真实 Blender Main 图拓扑、socket 默认值、link 和稳定 node/socket ID 发布到
+SceneIR；M10-02 将 16 项 allowlist 固定为 schema 1。M10-03 用 11 个 Blender 5.2 desktop
+fixture 覆盖全部 16 项节点，并在 Node full-Main WASM 与 Chromium Worker 打开、求值、保存、
+重开路径逐项比较 topology、position、bounds 和 point float attribute。当前误差为 0，门限为
+position max `1e-5`/RMS `1e-6`、attribute `1e-6`、bounds `1e-5`。真实 Simulation Zone 节点
+仍返回 `GN_NODE_UNSUPPORTED` 并保留原图、graph hash 和 Main revision。

-仍未声明：浏览器生成 bake、WASM Simulation Zone 求值、cache frame seek 接入 GN modifier、
-任意 lazy-function/field/instance graph。验收：`npm --prefix web run test:simulation-cache`、
-`npm --prefix web run test:capability-gates`。
+M10-04 已冻结 field materialization schema 1：POINT/EDGE/FACE/CORNER/CURVE/INSTANCE/LAYER
+分别具有元素上限，单批最多 64 fields、32 次 domain conversion、4,000,000 个目标元素和
+64 MiB；单 field 超过 65,536 scalar 时禁止 JSON transport。Depsgraph 的真实 point Float
+attribute 回执携带 schema、domain cardinality、元素/scalar/byte 数并与 payload 交叉校验；
+基数漂移、字节漂移、隐藏 JSON 数组和未知 domain 均 fail-closed。
+
+M10-05 将 `SimulationCacheManifestIR` 升为 schema 2，加入 committed `sourceRevision` 和可由
+graph ID/hash、source blend hash、source revision、input hash、Blender 版本及 frame range
+复算的完整 `revisionHash`。cache key 不再截取 hash 前缀，而是 `sim2-` 加完整 revision hash；
+Storage Worker 的 put/read/frame/list 均在 project lock 内核对当前 committed revision/hash，旧
+revision 只保留在存储中、不进入当前列表且显式读取返回 `SIMULATION_CACHE_REVISION_MISMATCH`。
+manifest/frame 未声明字段、legacy schema、graph/source/input/range 漂移均 fail-closed。
+
+`SimulationCacheManifestIR` 已绑定 graph/source blend/input/revision hash、Blender 5.2、完整帧范围、
+连续 byte range、总 payload 和逐帧 SHA-256。StorageWorker schema 7 使用 OPFS 内容寻址资产、
+`simulation_manifest` 索引和 `simulation_quarantine` 隔离 store，写入前核对当前 committed blend。
+每个 Worker 生命周期必须先完整复验 cache 才允许逐帧播放；播放/写入支持 AbortSignal，取消不发布
+manifest；LRU 按 `lastAccessAt/createdAt/cacheKey` 确定性淘汰并保护 active playback；Worker 重启
+重新验证，manifest 或 payload 损坏会从可播放索引移入 quarantine，列表仍返回其他有效 cache。
+
+M10-15 为 GN 和 Simulation 分别增加隔离 Chromium Worker 门：GN 以 10 次 512-node
+parse/validate、超 node budget 和 dependency cycle 覆盖性能/OOM-prevention/恶意输入；Simulation
+以 64 帧逐帧 hash、16 GiB+1 manifest 和未声明字段覆盖同三类门。两域均在失败后由同 Worker
+完成小输入恢复。
+
+仍未声明：任意 field/domain 实际求值、完整 lazy-function runtime、图写回、浏览器生成 bake、
+WASM Simulation Zone 求值、cache frame seek 接入 GN modifier 和任意实例图。验收：
+`npm --prefix web run test:geometry-node-evaluator-golden`、
+`npm --prefix web run test:geometry-node-field-budget`、`npm --prefix web run
+test:simulation-cache-identity`、`npm --prefix web run test:simulation-cache`、
+`npm --prefix web run test:simulation-cache-performance`、`npm --prefix web run
+test:simulation-cache-lifecycle`、`npm --prefix web run test:capability-gates`、
+`npm --prefix web run test:m10-domain-gates`。
--- a/docs/status/N-013.md
+++ b/docs/status/N-013.md
@@ -1,6 +1,6 @@
 # N-013 Shader Node 图

-状态：`in_progress（七节点 Main + 常量 PBR 映射子集）`
+状态：`in_progress（七节点 Main + 有界 WebGL2 compiler 子集）`

 详细分解、ShaderIR、typed socket 校验、Main 写回、Web 编译、GLB 映射和验收命令见
 [`docs/UNDECLARED_CAPABILITIES_EXECUTION_PLAN.md`](../UNDECLARED_CAPABILITIES_EXECUTION_PLAN.md)。
@@ -16,6 +16,19 @@ operation 保存重开；其他运算继续结构化阻断。RGB/Value 到 Princ
 Roughness、Metallic 的有限常量链接现可确定性映射为 glTF PBR factor；缺值、越界、
 重复输入和未知链接继续返回 `SHADER_GRAPH_UNMAPPABLE`。Mix、Mapping、Texture
 Coordinate、Bump 及任意节点仍返回 `SHADER_NODE_UNSUPPORTED`。node properties 仅开放
-Math operation；受限 Web 编译、完整色彩管理、完整 GLB 图映射和桌面渲染 golden 仍为 planned。
-验收：`npm --prefix web run test:authoring-roundtrip`、`npm --prefix web run test:capability-gates`
+Math operation。M10-07 新增 schema 1 有界 compiler：只把 RGB/Value 常量、六项 Math、Image
+Texture、Normal Map、Principled 和 Output 编译为 `WEBGL2_THREE_PHYSICAL` report；Native reader
+发布 graph SHA-256，Worker 在 Main transaction 前编译并失败关闭，主线程和 Offscreen 复用同一
+`createPBRMaterial` 入口。M10-08 为 report 增加 graph/texture/color-space/backend 绑定的
+`compileKey`，M10-09 由 `PBRMaterialPipeline` 保留上一份可用材质并记录失败报告。节点/链接/
+深度/纹理/标识预算固定；M10-10 将任意未知节点名称归一化排序后返回稳定
+`PBR-012/ARBITRARY_SHADER` capability block，未知节点不被删除或静默降级。
+
+M10-15 在独立 Chromium Worker 中连续完成 100 次有界 compile、129-node 超预算阻断、恶意
+cycle 阻断和同会话小图恢复；performance/OOM-prevention/malicious-input 三门均使用现有 compiler，
+不以 mock 成功替代材质编译。
+
+完整色彩管理、sampler/alpha/tangent、WebGPU、完整 GLB 图映射和桌面渲染 golden 仍为 planned。验收：
+`npm --prefix web run test:shader-compile`、`npm --prefix web run test:authoring-roundtrip`、
+`npm --prefix web run test:capability-gates`、`npm --prefix web run test:m10-domain-gates`
 以及 Shader GLB mapping E2E。
--- a/docs/status/N-014.md
+++ b/docs/status/N-014.md
@@ -13,8 +13,21 @@ Blender `NLASTRIP_FLAG_REVERSE`，reader 可恢复该标志；反向正例得到
 `[0.555556, 1.111111, 1.666667]`。
 同一正例已扩为 `repeat=2`，frame 5 与第二周期 frame 14 的 native Depsgraph 矩阵一致。

+M10-11 另以桌面 Blender 5.2 生成只读 fixture：同一 Track 包含 scale=2 的正向 Clip 和
+reverse + repeat=2 的 Clip。桌面、Node WASM 与生产 Chromium Worker 在 12 个边界/周期帧上
+逐矩阵比较，最大误差为 0；每帧求值前后的 Track/Strip/Action JSON 完全一致。本切片不调用
+`setNLAStack`，不提前关闭细粒度 operator 工作。
+
 当前只支持单对象 Action Clip、正 scale、Replace/Add/Multiply/Combine 和有限外插。
-Transition/Meta/Sound、Animated Time、Drivers、细粒度拖动/resize 命令、NLA UI、
+M10-12 仅新增 `moveNLAStrip`，以 revision gate 和单次 Main transaction 保留时长移动现有 Clip，
+并已通过 undo/redo 与保存重开。Transition/Meta/Sound、Animated Time、Drivers、其余
+create/remove/resize/active 命令、NLA UI、
 骨骼/约束混合矩阵及 GLB 展开仍为 planned/结构化阻断。

-验收：`npm --prefix web run test:authoring-roundtrip`、`npm --prefix web run test:capability-gates`。
+M10-15 冻结 4,096 tracks、每 track 16,384 strips、总 65,536 strips 及 ID/name/reason 字节预算，
+拒绝未声明字段。隔离 Chromium Worker 对 20 次 256-strip stack、超 track budget、恶意字段和
+同会话小 stack 恢复分别建立 performance/OOM-prevention/malicious-input 门。
+
+验收：`npm --prefix web run test:nla-evaluation-golden`、`npm --prefix web run test:nla-operator`、
+`npm --prefix web run test:authoring-roundtrip`、
+`npm --prefix web run test:capability-gates`、`npm --prefix web run test:m10-domain-gates`。
--- a/docs/status/N-015.md
+++ b/docs/status/N-015.md
@@ -1,9 +1,9 @@
 # N-015 非 Mesh 几何数据块

-状态：`BLOCKED / in_progress`（VDB core 已覆盖 server、OPFS、Float32 WebGPU、显式 GPU 分页、
-有限 grid 材质与 Main 属性重开；自动 demand paging 缺页重绘、联合重开和发布 golden 仍阻断）
+状态：`BLOCKED / in_progress`（M8 自动 demand paging、联合重开、64 MiB sparse 门和三轴 density
+golden 已完成；深度合成、完整 Volume 材质/GLB/USD 与 512 MiB/1 GiB 联合故障矩阵仍阻断）

-更新时间：2026-08-14
+更新时间：2026-08-16

 ## 当前声明

@@ -14,9 +14,10 @@ topology editor。
 Volume 采用“桌面/服务端 OpenVDB 转 NanoVDB，浏览器分块读取并以 WebGPU 渲染”的固定架构。
 浏览器不直接解码 OpenVDB；当前已完成真实资源 catalog、独立 OpenVDB 13 -> NanoVDB 32 desktop
 converter、受控 server job、转换/清单/分块协议、OPFS 绑定/重开、Float32 CPU/WGSL 树遍历、
-有界体积积分、主线程/Offscreen 生产视口、显式 hash 校验 GPU 分页/LRU、有限 grid 材质和
-Volume Main 属性保存重开。自动缺页重绘、联合重开和发布 golden 尚未完成，因此 N-015 整体保持
-`BLOCKED`。
+有界体积积分、主线程/Offscreen 生产视口、显式 hash 校验 GPU 分页/LRU、有限 grid 材质、
+Volume Main/asset binding 联合重开、自动缺页重绘、64 MiB sparse 门和 OpenVDB/WebGPU 三轴
+density golden。深度合成、完整 Volume 材质/GLB/USD 与更大真实 bundle 联合故障矩阵尚未完成，
+因此 N-015 整体保持 `BLOCKED`。

 | 数据族 | Reader | Web 预览 | 当前门 |
 | --- | --- | --- | --- |
@@ -26,7 +27,7 @@ Volume Main 属性保存重开。自动缺页重绘、联合重开和发布 gold
 | Metaball | 元素类型、位置、半径、尺度 | bounded sphere proxy；depsgraph implicit mesh | `READY` |
 | PointCloud | position/radius/POINT 属性 | WNM 分块 Points | `READY`（空数据为 `summary-only`） |
 | Curves/Hair | position/radius/curve/POINT 属性 | WNM 分块 Points/curve line | `READY`（缺数据阻断） |
-| Volume | path/grid metadata + VDB/NanoVDB 转换契约 | WebGPU 可渲染真实 density/color/temperature/emission；双生产视口已接入 | `BLOCKED`（自动缺页/联合恢复/golden） |
+| Volume | path/grid metadata + VDB/NanoVDB 转换契约 | WebGPU 可渲染真实 density/color/temperature/emission；自动分页、联合重开与三轴 density golden 已接入 | `BLOCKED`（深度合成/完整材质与 IO/更大联合故障矩阵） |

 ## 已实现任务

@@ -104,6 +105,16 @@ Volume Main 属性保存重开。自动缺页重绘、联合重开和发布 gold
 20. GPU grid 支持初始空驻留、经 manifest chunk hash 校验的显式单页加载、页表间接寻址、确定性
    LRU 替换和设备重建后按需页重放；多材质 grid 按同一 manifest `maxResidentBytes` 分配页槽，
    Chromium 以 GPU 数据读取验证被触碰页保留、旧页淘汰和恢复后内容一致。
+21. GPU feedback buffer、revision gate、manifest range/hash page request、同页请求合并、frame pin
+    LRU、渐进重绘预算、网络精确 offset 续传、Worker restart 和 device-loss 可见页回放已形成自动
+    demand paging 最小闭环；hash 失败、stale feedback、取消和 OOM 均不污染 resident/page table。
+22. 64 MiB sparse HTTP bundle 以 4 MiB page 实际 range 读取，首 page、总耗时、峰值工作集和取消
+    延迟均有 Chromium 证据；取消后 coordinator/consumer 归零，未将逻辑 64 MiB fixture 写入仓库。
+23. 同一保存 hash 下，Volume Main 属性、OPFS project revision、NanoVDB binding 和 bundle/grid bytes
+    在 Worker 清空后联合重开；主线程和 Offscreen 两个生产视口都从恢复 asset 输出非空像素。
+24. OpenVDB 13 native `density` reader 按 `volume-wgsl-v1` 有界积分生成 X/Y/Z 三轴 64x64 RGBA8
+    desktop/Chromium 发布 golden；主线程与 Offscreen WebGPU 对 49,152 bytes 的最大通道误差、MAE、RMS 和 alpha 覆盖
+    差均为 0。门限仍固定为 2/0.1/0.5/0.002，漂移返回 `NANOVDB_GOLDEN_MISMATCH`。

 ## 后续分解

@@ -117,9 +128,9 @@ Volume Main 属性保存重开。自动缺页重绘、联合重开和发布 gold
   raycast、多 handle preview、handle-local gizmo 与单次 Main 写回已完成。
 4. N-015-D2：evaluated preview 与源控制笼分层显示、WebGPU 等价。
 5. N-015-B3/D2/E1（Volume）：真实资源、desktop/server converter、可续传 HTTP range、OPFS、
-   有界网络/Worker/quota/tamper/device-loss 故障门、Float32 WGSL core、有限 grid 材质、显式 GPU
-   分页/LRU、resident/page-table OOM 恢复和 Main Volume 属性重开已完成；继续执行自动缺页重绘、联合恢复、GLB/USD loss、大 bundle 和
-   desktop/Chromium golden，未完成项保持阻断。
+   有界网络/Worker/quota/tamper/device-loss 故障门、Float32 WGSL core、自动 GPU paging/LRU、
+   resident/page-table OOM、Main/binding/双视口联合重开、64 MiB sparse 和三轴 density golden 已完成；
+   继续执行场景深度合成、完整 Principled Volume/GLB/USD loss 与 512 MiB/1 GiB 联合故障矩阵。
 6. N-015-E2：100k/1M WASM/GPU 内存、Worker restart 和 Chromium OPFS quota；Chromium
   64 KiB 真实 quota、失败后旧 revision 保持、Worker restart 恢复已通过。后续浏览器验收
   仅以 Chromium 为基线，不配置 Firefox/WebKit。
@@ -131,7 +142,8 @@ Volume Main 属性保存重开。自动缺页重绘、联合重开和发布 gold
 - Metaball sphere proxy 不得用于导出或保存为求值曲面。
 - Volume/VDB 不得生成占位几何；协议 fixture 不得作为真实 decoder/renderer 证据。
 - 浏览器构建不得通过开启 `WITH_OPENVDB` 绕过 desktop/server 转换边界。
- 自动缺页重绘、联合恢复、完整故障门和发布 golden 未齐前，VDB 与 N-015 保持 `BLOCKED`。
+- 场景深度合成、完整 Volume 材质/IO 和更大真实 bundle 联合故障矩阵未齐前，VDB 与 N-015 保持
+  `BLOCKED`；M8 完成不能自动把 N-015 全域标为 `COMPLETE`。
 - Metaball sphere proxy 不得进入 GLB；GLB 只能消费 depsgraph evaluated mesh。
 - 任意新增 Main authoring 命令在 save/reopen 与 undo/redo 完成前不得开放 UI。

@@ -161,6 +173,10 @@ npm --prefix web run test:vdb-opfs
 npm --prefix web run test:vdb-webgpu
 npm --prefix web run test:vdb-viewport
 npm --prefix web run test:vdb-faults
+npm --prefix web run test:nanovdb-sparse-performance
+npm --prefix web run test:nanovdb-volume-roundtrip
+npm --prefix web run test:nanovdb-render-golden
+node tools/vdb/generate-volume-golden.mjs --check
 WEB_TEST_PORT=5349 npm --prefix web run test:e2e -- -g "real OPFS quota|reports quota exhaustion"
 WEB_TEST_PORT=5201 npm --prefix web run test:e2e -- -g "N-015|non-mesh"
 ```
--- a/docs/status/N-016.md
+++ b/docs/status/N-016.md
@@ -1,7 +1,8 @@
 # N-016 Grease Pencil

-状态：`BLOCKED`（协议、有限 reader/Main transaction、当前帧及相邻帧 onion preview 已落地；
-完整 2D canvas/Dope 编辑、modifier 语义和桌面 golden 仍阻断）
+状态：`BLOCKED`（协议、有限 reader/Main transaction、当前帧及相邻帧 onion preview、
+current-drawing marquee 和有限 2D point canvas 已落地；完整 2D stroke/segment/Dope 编辑、
+modifier 语义和桌面 golden 仍阻断）

 ## 已验证切片

@@ -22,8 +23,8 @@
   drawing，渲染真实 3D stroke/闭环；Chromium 主线程与 OffscreenCanvas 均通过非空像素门。
 6. N-016-D（editor 部分）：editor context schema 绑定 data/layer/frame、onion 开关、stroke/
   point selection 和 revision，拒绝 stale/重复/超 1M selection；Properties 面板已连接真实 Main
-   layer create/remove、当前 frame insert/remove 和整帧 clear transaction。完整 2D stroke/point
-   画布选择和 dope sheet integration 仍阻断。
+   layer create/remove、当前 frame insert/remove 和整帧 clear transaction。完整 2D stroke/segment、
+   lasso 和 dope sheet integration 仍阻断。
 7. N-016-D（点编辑部分）：Properties 面板可在当前 layer/frame 选择实际 stroke/point，执行
   有界 X 轴平移；协议先校验 point identity、revision、有限坐标和 1M 点预算，再保留 radius、
   opacity、vertex color、cyclic、material index 并合并为一个 `setGreasePencilStrokes` Main
@@ -40,11 +41,29 @@
 11. N-016-D（重启部分）：真实 Grease Pencil fixture 经首个 WebEngine Worker 点编辑和 `.blend`
    保存后，终止 Worker 并由全新 Worker 重开；data/layer/drawing identity、位置、radius、opacity
    均重新解析验证。
+12. N-016-D（M9-06 marquee）：Main reader 为 drawing、stroke 和 point 发布稳定 ID，并发布 Blender
+    active layer；旧文件未记录 active layer 时只读快照确定性选择首个实际 layer，不修改 Main。
+    纯 marquee 合同绑定 Main revision、当前 data/layer/frame/drawing、归一化矩形和 1M candidate
+    预算，跨 drawing、重复/伪造 ID、stale revision 和超预算均稳定失败关闭。生产 UI 只在活动、
+    可见且未锁定 drawing 开放框选，主线程与 OffscreenCanvas 共用同一合同；真实 `.blend` 均选中
+    4 个稳定 point ID 和 1 个 stroke ID，选择不递增 Main revision。
+13. N-016-D（M9-07 shared selection）：纯 `grease-pencil-selection` schema 将当前 drawing、稳定
+    point ID、来源和独立 selection revision 绑定为唯一状态；2D point canvas、主线程 3D viewport
+    和 OffscreenCanvas Worker 的 point/marquee 事件都携带 base selection revision，迟到结果返回
+    `REVISION_CONFLICT`，不修改 Main。真实 fixture 从 2D 选择 1 点后由 3D 框选 4 点，revision
+    `0 -> 1 -> 2`，两条生产后端回执与画布高亮一致，Main revision 保持不变。
+14. N-016-D（M9-08 layer/frame reorder）：纯 `grease-pencil-reorder` schema 将 layer 方向移动和
+    drawing frame 移动绑定到稳定 data/layer/drawing ID 与 Main base revision；stale revision、
+    边界 no-op、伪造 drawing、已占用 target frame 和正负 1,000,000 之外帧号均在 Main 前失败关闭。
+    生产 Properties UI 的 layer 上下移动与 frame target 移动各只提交一次 Main transaction；真实
+    fixture 经 undo/redo、OPFS save、close/recover 后保持 Blender 5.2 desktop golden 的 layer 顺序、
+    frame 12 和原 drawing identity。完整 group hierarchy、frame duplicate 与 Dope Sheet 拖拽仍阻断。

 ## 仍然阻断

 - N-016-C：material datablock 事务、onion fade/range 完整语义和完整 Grease Pencil modifier reader。
- N-016-D：完整 2D canvas/marquee 和完整 timeline/dope 编辑；3D current-frame 点 raycast、
+- N-016-D：完整 2D canvas 的 stroke/segment 选择、套索和完整 timeline/dope 编辑仍阻断；有限
+  2D point canvas 与 3D 共享 selection revision、3D current-drawing point marquee、点 raycast、
  多点高亮、连续 preview、单次 gizmo commit、有界 drawing frame 导航和 worker restart 已完成。
 - N-016-E：desktop drawing hash、Chromium 像素 golden、GLB/USD loss report 和 OPFS。

@@ -54,6 +73,9 @@
 npm --prefix web run typecheck
 npm --prefix web run lint
 npm --prefix web run test:grease-pencil
+WEB_TEST_PORT=5404 npm --prefix web run test:grease-pencil-marquee
+WEB_TEST_PORT=5411 npm --prefix web run test:grease-pencil-selection
+WEB_TEST_PORT=5416 npm --prefix web run test:grease-pencil-reorder
 WEB_TEST_PORT=5205 npm --prefix web run test:grease-pencil-editor
 WEB_TEST_PORT=5202 npm --prefix web run test:e2e -- --grep "N-016 Grease Pencil"
 ```
--- a/docs/status/N-017.md
+++ b/docs/status/N-017.md
@@ -1,7 +1,9 @@
 # N-017 Paint 与权重

-状态：`BLOCKED`（stroke/patch schema、真实 Three raycast 命中、选择/遮罩门和 Main 顶点色/权重
-transaction 已落地；PBVH brush、texture paint 和 GPU/image 生命周期未实现）
+状态：`BLOCKED`（stroke/patch schema、真实 Three raycast 命中、GPU depth 可见性、选择/遮罩门、
+单 undo 分块 pointer session、Main 顶点色/权重、浏览器 packed/UDIM 原子资产绑定和
+PBVH WASM 入口显式能力门已落地；
+PBVH brush、Blender Main image tile 写回、完整色彩转换和 GPU/image 生命周期仍未实现）

 ## 已验证切片

@@ -12,9 +14,11 @@ transaction 已落地；PBVH brush、texture paint 和 GPU/image 生命周期未
   tile 256 MiB；非法 barycentric、pressure、color、weight 和非有限数会结构化拒绝。
 4. N-017-B（部分）：`setVertexColors` 在单用户 Mesh 上创建/转换 `POINT` 或 `CORNER`
   `FLOAT_COLOR` 属性，并更新 active color；`setVertexWeights` 在真实 Object/Mesh 上创建顶点组、
-   写入/移除 `MDeformWeight`，支持逐顶点 normalize。
-5. 顶点色和权重都已通过 Main undo/redo 与 `.blend` save/reopen；`mirror:true` 在没有已验证
-   对称拓扑映射时返回 `CAPABILITY_MISSING`，不会伪造镜像结果。
+   写入/移除 `MDeformWeight`，支持逐顶点 normalize、最多 32 个 influence 的 limit，以及
+   基于局部坐标 reciprocal map 的 mirror。
+5. 顶点色和权重都已通过 Main undo/redo 与 `.blend` save/reopen；镜像在没有已验证对称映射时
+   返回 `CAPABILITY_MISSING`，不会伪造结果。limit/normalize/mirror 的组合已与 Blender 5.2
+   desktop golden 逐顶点比较。
 6. `paintHitFromIntersection` 消费真实 Three `Raycaster` intersection，按 indexed/non-indexed
   triangle 解析顶点，输出对象/data stable ID、source face、局部 barycentric、世界法线、
   插值 UV 与 pressure；测试使用真实 BufferGeometry 射线，不注入伪命中。
@@ -24,7 +28,7 @@ transaction 已落地；PBVH brush、texture paint 和 GPU/image 生命周期未
 8. N-017-A/C（协议边界）：有界 CPU brush 对候选顶点执行 smoothstep falloff、遮挡标记过滤和
   front-face 法线门；它不宣称 PBVH 加速或桌面 brush 等价。`UdimTilePatchIR` 约束 1001-1999
   tile、RGBA8、色彩空间、尺寸/256 MiB 预算、revision、base/result SHA-256，并在内存中验证
-   原子 range patch；尚未绑定 Blender packed image/UDIM Main 写回与保存。
+   原子 range patch。
 9. N-017-A（空间查询部分）：uniform-grid spatial index 在 1M vertex/1M cell 预算内按 brush AABB
   粗筛候选，再执行球半径、front-face、falloff 精筛；depth-gated 查询必须显式提供已验证可见
   vertex ID 集合，缺失或重复会拒绝。该结构减少全量扫描，但不是 Blender PBVH。
@@ -34,14 +38,35 @@ transaction 已落地；PBVH brush、texture paint 和 GPU/image 生命周期未
 11. Properties paint 面板可对当前真实 VERT selection 执行 selection-masked `Blend Color` 和
    `Blend Weight`，每次仅提交一个 Main transaction。Blender 5.2 reader 从 Mesh
    `vertex_group_names` 恢复顶点组摘要及 skin weight 名称；新增组经 undo/redo、保存重开后保持。
+12. M9-09：主线程和 Offscreen Worker 使用同一 WebGL2 RGBA depth pass/readback，
+    以 Main revision 和稳定顶点索引返回真实可见集；遮挡 fixture 的两后端结果一致。
+13. M9-10：WebEngine Worker 可序列化接收有界 color/weight chunks，一次 pointer
+    session 仅在 commit 时对 Main 发一个合并命令；真实 Main 历史只产生一个 undo step。
+14. M9-11：Storage Worker 将 packed/UDIM PNG 解码为 RGBA8，复验 dirty range 的
+    base/result pixel hash，新 PNG 经 OPFS content-addressed 临时写、回读验证后，
+    才以 IndexedDB 单事务切换 tile binding。中途故障保持旧 binding/旧资产可读，
+   packed 与 UDIM 均已通过 Worker restart 回读。
+15. M9-12：`WeightPaintOptionsIR` 固定 normalize、limit、mirror axis/tolerance 和 1M
+   patch budget；Worker 拒绝重复/越界/非法组合，native 在 Main 内先写入 patch，再做
+   mirror、limit、normalize。镜像 map 使用 mesh 局部坐标，要求每个顶点都有 reciprocal
+   counterpart，且大于 100k 顶点时结构化预算阻断。`rigged_shape_scene.blend` 的四步
+   golden（initial/normalize/limit-normalize/mirror）与 WASM snapshot、save/reopen 逐项一致。
+16. M9-13：按 Blender 5.2 `DNA_brush_enums.h` 冻结 32 个 Sculpt、4 个 Vertex Color、
+    4 个 Weight 和 6 个 Texture 活跃 brush。生产 WebEngine Worker 探测
+    `_web_engine_apply_pbvh_stroke`；当前 stable/single/pthread 均无该 WASM 入口，因此 46 项
+    全部返回 `N-017/BLOCKED/PAINT_PBVH_UNAVAILABLE`。即使未来出现入口，session context 和
+    逐 brush desktop/WASM golden 未就绪时仍分别失败关闭；查询不会修改 Main revision、handle
+    或 WASM allocated bytes，畸形字段返回完整标准 `ErrorReport`。

 ## 仍然阻断

- N-017-A：真实 PBVH、由 viewport 深度缓冲生成可见 vertex 集合，以及 brush falloff 桌面
-  golden；基础 Mesh/UV hit、uniform-grid 候选查询和可见性硬门已完成。
- N-017-B：limit/clean、已验证拓扑映射上的 mirror、桌面 brush/falloff 对照。
- N-017-C：Blender packed/UDIM tile Main transaction、dirty tile、色彩转换和原子保存；当前
-  只有内容哈希绑定的浏览器内存 patch 边界。
+- N-017-A：真实 PBVH 与 brush falloff 桌面 golden；基础 Mesh/UV hit、uniform-grid 候选
+  查询、可见性硬门和双后端 GPU depth 可见集已完成。当前不存在 PBVH WASM writer，完整
+  brush inventory 由 `PAINT_PBVH_UNAVAILABLE` 明确阻断，不会把 bounded helper 当作成功。
+- N-017-B：clean/高级 Blender weight-paint operator、真实 PBVH brush/falloff 与更大拓扑的
+  桌面对照；当前 bounded limit/normalize/verified mirror 已完成。
+- N-017-C：Blender packed/UDIM tile Main transaction、完整色彩转换和 `.blend` 内 image
+  tile 保存仍阻断；浏览器 dirty tile 的 OPFS 原子 asset/binding 边界已完成。
 - N-017-D/E：armature golden、seam bleed、face mask、GPU dispose、quota、坏图和桌面 UI 对照；
  vertex selection 与数值 mask 门已完成，不等同于完整 Paint 面/纹理遮罩系统。

@@ -50,7 +75,9 @@ transaction 已落地；PBVH brush、texture paint 和 GPU/image 生命周期未
 ```bash
 WEB_TEST_PORT=5203 npm --prefix web run test:e2e -- --grep "N-017 paint"
 npm --prefix web run test:paint-roundtrip
+WEB_TEST_PORT=5422 npm --prefix web run test:texture-paint-asset
+WEB_TEST_PORT=5427 npm --prefix web run test:paint-pbvh-capability
 ```

-`test:paint-roundtrip` 覆盖 CORNER color、vertex group patch、normalize、mirror 错误门、
-undo/redo 与 save/reopen。
+`test:paint-roundtrip` 覆盖 CORNER color、vertex group patch、normalize、limit、verified
+mirror、undo/redo 与 save/reopen；`test:weight-paint-golden` 对比 Blender 5.2 desktop golden。
--- a/docs/status/N-018.md
+++ b/docs/status/N-018.md
@@ -1,7 +1,7 @@
 # N-018 Physics 与 Simulation

-状态：`BLOCKED`（family capability、settings/dependency/cache manifest、错误帧门及浏览器自有
-BTF1 播放会话已落地；desktop bake playback、WASM solver 和 bake job 未实现）
+状态：`BLOCKED`（family capability、settings/dependency/cache manifest、错误帧门、浏览器自有
+BTF1 播放会话及逐 family solver probe 已落地；desktop bake playback、WASM solver 和 bake job 未实现）

 ## 已验证切片

@@ -34,13 +34,19 @@ BTF1 播放会话已落地；desktop bake playback、WASM solver 和 bake job
 10. N-018-C（持久缓存集成）：两帧真实 BTF1 经过 content-addressed Simulation cache 写入，终止
    Storage Worker 后由新 Worker 精确 range 读取第二帧并应用到 SceneIR；帧 hash、magic、offset
    和最终 object translation 均验证。
+11. N-018-D（M10-13 probe 门）：七个 family 分别检查 runtime export、初始化、线程和内存；只有
+    四门全过才允许 `LOCAL_SOLVER`。当前生产 inventory 没有 solver adapter，全部明确路由到
+    `DESKTOP_SERVER_BAKE`。合成正例只验证门逻辑，不声明真实 WASM solver 或 cache decoder。
+12. N-018-C/D（M10-14 cache 门）：七类 desktop/server bake cache 均绑定 cache schema、family、
+    Blender 5.2、source/settings/input/cache hash、frame range、总/逐帧 byte range/hash；消费前对
+    实际 source、payload 和逐帧 bytes 复算 SHA-256。decoder/playback capability 仍不开放。

 ## 仍然阻断

 - N-018-A/B：从真实 Main 提取完整 family settings、collection/effector/collision 依赖。
 - N-018-C：desktop bake payload 的逐 family decoder、正式 viewport UI 播放控制和 100 帧
  golden；浏览器自有 transform frame decoder/SceneIR 播放会话已完成但不替代 Blender bake。
- N-018-D：逐 family WASM solver 初始化、线程、内存和确定性验证。
+- N-018-D：逐 family 真实 WASM solver adapter、初始化实现和确定性 golden；探测/路由门已完成。
 - N-018-E：bake start/cancel/commit、服务端 job、故障恢复、进度与 UI。

 ## 验收
@@ -49,8 +55,10 @@ BTF1 播放会话已落地；desktop bake playback、WASM solver 和 bake job
 WEB_TEST_PORT=5204 npm --prefix web run test:e2e -- --grep "N-018 physics"
 npm --prefix web run test:simulation-cache
 npm --prefix web run test:physics-main-reader
+npm --prefix web run test:physics-solver-probe
+npm --prefix web run test:physics-cache-family
 ```

 本轮在 Chromium 隔离端口复验 content-addressed cache 的 Worker restart、目标帧 range read、
-帧 SHA-256、BTF1 seek/play/cancel 和迟到结果抑制通过；没有 desktop bake family decoder 或
-solver，因此 desktop playback/solver/bake 状态不变，继续为 `BLOCKED`。
+帧 SHA-256、BTF1 seek/play/cancel、迟到结果抑制和逐 family solver probe 通过；没有 desktop
+bake family decoder 或真实 solver，因此 desktop playback/solver/bake 状态不变，继续为 `BLOCKED`。
--- a/docs/status/N-019.md
+++ b/docs/status/N-019.md
@@ -1,7 +1,8 @@
 # N-019 灯光与渲染

-状态：`BLOCKED`（Camera/Light/World/Scene metadata、Camera/Light/World 有界 Main 写回与
-Three exposure/shadow 映射已落地；Scene 颜色管理 writer 和渲染等价未实现）
+状态：`BLOCKED`（Camera/Light/World/Scene metadata、Camera/Light/World 有界 Main 写回、
+Three exposure/shadow 映射和一条有界 Blender reference 图像指标闭环已落地；Scene 颜色管理
+writer、全域渲染等价和高级后端仍未实现）

 ## 已验证切片

@@ -24,6 +25,30 @@ Three exposure/shadow 映射已落地；Scene 颜色管理 writer 和渲染等
 7. N-019-B（色温部分）：`useTemperature:true` 时，共享 PBR 适配器把 800–20000 K 的有界
   黑体近似归一到 6500 K 中性白并转换为线性 RGB，再乘入 Light color；关闭色温时原始颜色
   保持不变。主线程与 Offscreen Worker 共用该实现，数值门和原生 temperature 保存重开通过。
+8. M11-01 字段表：CameraIR、LightIR、WorldIR 及 Scene render/color-management 共 60 个叶字段
+   已逐项标注 reader/writer/main viewport/Offscreen viewport 状态；AST checker 保证零漏项、零重复。
+   当前 24 COMPLETE、17 PARTIAL、19 BLOCKED，未把 metadata-only 或近似映射提升为视觉 parity。
+9. M11-02 字段闭环：支持的 Camera/Light/World writer 已在同一 Chromium 任务中完成 Main edit、
+   revision 单调的 undo/redo、保存、全新 Worker 重开和共享 PBR 映射；水平/垂直 sensor fit、
+   temperature linear RGB、shadow、spot/area 参数及 World 背景均有字段级断言。
+10. M11-03 资源预算：主线程与 Offscreen 共用 schema 1 light/shadow/texture planner；WebGL2
+    总预算为 16 lights、4 x 1024 shadow maps（均包含内置保留槽），纹理同时限制数量、单边、
+    aggregate payload 与 decoded RGBA bytes。WebGPU 只冻结 64/8 x 2048 及 device-limit 下调合同，
+    未把未安装的 WebGPU renderer 标为可用。
+11. M11-04 有界实时 reference：Blender 5.2 Eevee 256×256 fixture 绑定 source/generator/image
+    SHA-256；SRGB8/STRAIGHT RGBA 比较输出 MAE、RMS、P95 channel、坏像素比例、前景 IoU 和
+    alpha 覆盖率。主线程与 Offscreen 生产 viewport 均为同一报告（MAE 2.0433、RMS 5.4490、
+    P95 4、坏像素 0.004776、IoU 0.98534）；非空但错误构图负例稳定返回
+    `RENDER_REFERENCE_MISMATCH`。
+12. M11-05 最终渲染路由：schema 1 只让 bounded Eevee 的 WebGL2（以及 capability 全通过的
+    WebGPU）进入 `WEB_LOCAL_BOUNDED`；Cycles、complex Eevee、Workbench 与 CUDA/OptiX/HIP/
+    Metal/oneAPI 固定为 `SERVER_JOB`。默认 endpoint 未配置时返回 `SERVER_JOB_UNAVAILABLE`，
+    未知 SceneIR render engine 返回 `PLATFORM_CAPABILITY_UNAVAILABLE`，均不产生本地等价成功。
+13. M11-06 server render job：schema 1 请求绑定 source `.blend` SHA-256/byte length/revision、
+    Blender 5.2 build SHA-256、规范化 render settings SHA-256 和 request SHA-256；成功结果
+    绑定同一 provenance 并公开 output MIME/byte length/output SHA-256/result SHA-256。真实
+    loopback server 由 Blender 5.2 headless 打开 fixture 并输出 PNG；source、settings、build
+    和 output 篡改均在提交或消费前结构化拒绝。

 ## 仍然阻断

@@ -31,8 +56,11 @@ Three exposure/shadow 映射已落地；Scene 颜色管理 writer 和渲染等
  Blender/RNA 颜色管理 API 后才能开放。Camera writer 已完成。
 - N-019-B/C：AgX/Standard/Raw 的视觉等价、Area spread、Mist、DOF、
  transparent sorting、probe 和高级 shadow 参数。
- N-019-D：Cycles/Freestyle/denoise 服务端 job 协议与结果 hash。
- N-019-E：desktop/Chromium 像素 golden、设备丢失和 1M triangles。
+- N-019-D：M11-05 已冻结 Cycles/复杂 Eevee/硬件后端的 server-only 路由；M11-06 已完成
+  有界 server-style submit 和 source/settings/build/output hash provenance；真实远程队列、
+  进度、取消、Freestyle 和 denoise job 仍未完成。
+- N-019-E：完整 desktop/Chromium 像素 parity、设备丢失和 1M triangles；M11-04 仅关闭固定
+  fixture 的有界 reference 指标门，不代表全场景或全色彩管理等价。
 - N-019-B/C/E（Volume）：Float32 NanoVDB WGSL 树遍历、有界积分、有限
  temperature/color/emission grid 语义和显式 GPU resident LRU 已有真实 Chromium 数值/图像专项门；
  自动缺页重绘、生产视口深度合成和 desktop/Chromium 三视角 golden 仍阻断，不能据此声明发布级体渲染。
@@ -41,5 +69,11 @@ Three exposure/shadow 映射已落地；Scene 颜色管理 writer 和渲染等

 ```bash
 npm --prefix web run test:lighting-roundtrip
+npm --prefix web run test:lighting-field-parity
+WEB_TEST_PORT=5545 npm --prefix web run test:lighting-field-roundtrip
+WEB_TEST_PORT=5548 npm --prefix web run test:render-resource-budget
+WEB_TEST_PORT=5552 npm --prefix web run test:render-reference
+WEB_TEST_PORT=5556 npm --prefix web run test:render-routing
+WEB_TEST_PORT=5560 npm --prefix web run test:server-render-job
 WEB_TEST_PORT=5319 npm --prefix web run test:e2e -- --grep "N-019 Scene exposure"
 ```
--- a/docs/status/N-020.md
+++ b/docs/status/N-020.md
@@ -1,7 +1,7 @@
 # N-020 Compositor

-状态：`BLOCKED`（GraphIR、有界 CPU executor 与真实 Main graph 结构 reader 已落地；完整节点
-参数映射、WebGPU、HDR golden 和服务端执行未实现）
+状态：`BLOCKED`（GraphIR、有界 CPU executor、真实 Main graph reader、四节点 WebGPU golden
+与 Unsupported 全图执行门已落地；完整节点参数映射、通用 WebGPU、HDR golden 和服务端执行未实现）

 ## 已验证切片

@@ -27,14 +27,23 @@
   Output 的动态 `Socket_0` 规范化为 GraphIR `Image`。桌面生成 fixture 经 WASM/Worker 后直接由
   CPU executor 求值 Constant→Exposure→Invert→Composite，RGBA 结果通过；未连接的 Glare 仍保留
   Unsupported 并使完整图 capability gate 保持阻断。
+8. N-020-B/E（M11-07 有界 WebGPU golden）：显式 allowlist 只包含 Constant Color、Exposure、
+   Invert、Composite。Blender 5.2 生成的四场景 fixture 经真实 WASM Main reader 后，生产 CPU
+   executor 与 Chromium WebGPU compute 对 2×2 `LINEAR_SRGB` Float32 RGBA 输出逐字节 SHA-256
+   相同；CPU-only、资源输入、未声明节点、断链和错误 socket 在 shader 编译前结构化阻断。
+9. N-020-D（M11-08 全图执行门）：CPU 与 frame-cache 入口在求值、取消回调和 cache hit 前扫描
+   完整 graph；即使 Unsupported 节点未连接到 Composite，也返回
+   `COMPOSITOR_NODE_UNSUPPORTED`。真实 Blender 5.2 Main fixture 的 Glare node name/type/
+   `blenderType`、graph JSON 与 revision 在失败前后完全不变；预置 cache 不能绕过该门。

 ## 仍然阻断

 - N-020-A：Main graph 写回，以及 Transform、非默认 Invert、Alpha Over、Blur、Mix、Image/Render
  Layer 的逐节点参数与 resource/pass reader；基础真实图结构、常量色、Exposure、默认 Invert、
  Viewer/Composite 已完成。
- N-020-B/C：WebGPU executor、tile scheduler、OPFS 持久 frame cache、增量 invalidation 和 GPU
-  dispose；CPU 周期取消和内容寻址内存 LRU 已完成。
+- N-020-B/C：M11-07 只实现四节点、无资源、单输入链的有界 WebGPU compute；通用 WebGPU
+  executor、tile scheduler、OPFS 持久 frame cache、增量 invalidation 和生产 GPU 调度仍阻断；
+  CPU 周期取消和内容寻址内存 LRU 已完成。
 - N-020-D：服务端 Blender job、source hash 和结果提交。
 - N-020-E：desktop HDR/alpha/color-space golden、OOM/fault/device-loss。

@@ -43,4 +52,6 @@
 ```bash
 WEB_TEST_PORT=5320 npm --prefix web run test:e2e -- --grep "N-020 CPU compositor"
 npm --prefix web run test:compositor-main-reader
+WEB_TEST_PORT=5562 npm --prefix web run test:compositor-node-golden
+WEB_TEST_PORT=5565 npm --prefix web run test:compositor-unsupported-gate
 ```
--- a/docs/status/N-021.md
+++ b/docs/status/N-021.md
@@ -1,7 +1,9 @@
 # N-021 Sequencer 与音频

-状态：`BLOCKED`（strip schema、真实 Main reader、确定性时间编辑、长媒体有界索引/seek/cache
-和 codec 能力门已落地；Main 写回、完整媒体解码/渲染、音频波形和服务端编码仍未实现）
+状态：`BLOCKED`（strip schema、真实 Main reader、确定性时间编辑、长媒体有界索引/seek/cache、
+三类实际 runtime codec probe、source/decode-bound 首帧 proxy cache、三类迟到结果 revision
+gate、最终编码 server-export 路由和实时 AudioContext 恢复门已落地；Main 写回、完整媒体
+解码/渲染、音频波形、A/V sync、实际混音和真正服务端编码 job 仍未实现）

 ## 已验证切片

@@ -14,8 +16,8 @@
   映射，避免左右片段复用越界源帧。
 4. N-021-B/C（部分）：`resolveSequencerFrame` 在切分边界解析当前顶层 strip、source frame
   与依赖；META 覆盖的子 strip 和 inactive dependency 不会泄漏到渲染帧。
-5. N-021-C/D（门）：运行时只报告 WebCodecs/HTMLMedia 需要精确 probe；codec 必须
-   出现在已验证 MIME 集合中才可放行，本地编码固定为 `BLOCKED`。
+5. N-021-C/D（门）：运行时 inventory 只报告 WebCodecs/HTMLMedia 需要精确 probe；旧的
+   MIME 集合不能作为 READY receipt，本地编码固定为 `BLOCKED`。
 6. N-021-A（部分）：Blender 5.2 `Scene.ed/Editing.seqbase` 读取 Scene、Movie、Image、Sound、
   Meta 和协议支持的 Effect；显示范围由持久 `start/startofs/endofs/len` 计算，保留 channel、
   mute/lock、相对媒体路径、24/1.001 FPS 和 effect input stable ID。绝对路径、未知类型、
@@ -32,16 +34,45 @@
    仍 resident；timeline/current frame/asset hashes 作为内容寻址 session manifest 写入 OPFS，终止
    StorageWorker 与 media Worker 后在 frame 765432 恢复。session SHA-256 固定为
    `d2e7e3c5ed9ae4fda6fe358cebb474f5774f1d2037dff3df9b6dfde9e0bebd2d`。
-11. 上述门只放行 fixture 的 IMAGE/SOUND 原始本地资源读取，不声称 WebCodecs MOVIE decode、
-    waveform/proxy 生成或最终编码完成；`video/mp4` 和 local encoding 仍结构化阻断。
+11. 上述 V1 长媒体门只放行 fixture 的 IMAGE/SOUND 原始本地资源读取，不声称 WebCodecs MOVIE
+    seek、waveform/proxy 生成或最终编码完成；local encoding 仍结构化阻断。
+12. M11-09 runtime codec probe：schema 1 request/result 绑定 IMAGE/SOUND/MOVIE family、规范 MIME、
+    byte length 和 source SHA-256，且不接收 source path/扩展名字段。Chromium 用 ImageBitmap
+    解码 8×8 PNG，用固定 48 kHz OfflineAudioContext 解码 1 秒 WAV，用 HTMLMedia 加载、seek
+    并绘制 16×16 两帧 H.264 MP4；三类均 READY。错误扩展名不影响结果，损坏 bytes、hash
+    drift、MIME/family 和 backend 伪造均返回 `SEQUENCER_CODEC_UNSUPPORTED`。
+13. M11-10 proxy cache：schema 1 identity 绑定 MOVIE source family/MIME/bytes/SHA-256、当前
+    READY HTMLMedia receipt、SRGB8/STRAIGHT RGBA8 profile 和 source frame；payload 再独立绑定
+    byte length/SHA-256。Chromium 从真实 H.264 初始 decoded frame 生成 8x8/256-byte proxy，
+    一帧预算 LRU 发生确定性淘汰，content-addressed payload/manifest 经新 Storage Worker 重开
+    后复验。source、decode receipt、identity 或 payload 漂移均在消费前稳定阻断。
+14. M11-11 media revision gate：SEEK/SCRUB/DECODE 使用同一 schema 1 request，绑定 timeline
+    ID/revision、单调 request revision、operation 和 frame；completed result 必须逐字段回显并绑定
+    source frame/payload hash。Chromium 中旧 SEEK 晚于新 SCRUB 返回、真实 H.264 DECODE 跨
+    timeline replacement 返回及伪造 result 全部在 publish/cache callback 前成为
+    `STALE/REVISION_CONFLICT`；只有当前 SCRUB 与当前 DECODE 发布。
+15. M11-12 final export route：schema 1 将真实 Main timeline ID/revision、source `.blend`
+    SHA-256、帧范围/帧率、分辨率和 container/video/audio codec 绑定到 settings/request SHA-256。
+    无 endpoint 时返回 `SERVER_EXPORT/BLOCKED/SEQUENCER_EXPORT_SERVER_UNAVAILABLE`；有 endpoint
+    时只返回 `SERVER_EXPORT_REQUIRED`。Chromium 中注入和实际探测到的 `VideoEncoder` 都不能
+    把 `localEncoding` 从 `BLOCKED` 提升为本地完成。
+16. M11-13 audio session recovery：schema 1 分开报告
+    `UNAVAILABLE/SUSPENDED/RUNNING/CLOSED` context 与 `BLOCKED/SILENT/ENABLED` output，
+    revision 随 initialize/mute/resume/suspend/close 单调推进。Chromium 在真实用户手势内创建
+    `AudioContext`，通过 suspend、mute、muted resume、unmute、二次 suspend/resume 和 close；
+    mute 将 gain 归零，unmute 恢复 0.75，close 再归零并断开节点。API/构造器缺失与 resume
+    failure 分别稳定返回 `SEQUENCER_AUDIO_DEVICE_UNAVAILABLE` 和
+    `SEQUENCER_AUDIO_RESUME_FAILED`，不会误报输出启用。

 ## 仍然阻断

 - N-021-A/B：Main strip 写回、非 CROSS transition/modifier 完整参数、undo/redo 和 save/reopen；
  基础真实 reader 与 CROSS/GAMMA_CROSS 帧描述已完成。
- N-021-C：WebCodecs 精确 seek/decode、音频 waveform、proxy 生成、A/V sync、丢帧和
-  损坏媒体处理。
- N-021-D：浏览器不支持的 codec、混音与最终编码的服务端 Blender job。
+- N-021-C：M11-09/10/11/13 完成三类短 fixture 的初始实际解码门、MOVIE 初始帧 RGBA8 proxy
+  cache identity、迟到结果 publish/cache gate 和实时 AudioContext 生命周期；WebCodecs 帧精确
+  seek/decode、多帧 proxy、音频 waveform、A/V sync、实际混音、丢帧和长媒体损坏恢复仍阻断。
+- N-021-D：M11-12 已冻结最终编码的 server-export 路由与请求 identity；真正服务端 Blender
+  encode job、进度/取消、混音和输出结果校验仍阻断。
 - N-021-E：V1 有界 Chromium/OPFS 长媒体门已完成；完整桌面/Chromium 解码/渲染 golden 仍阻断。

 ## 验收
@@ -50,4 +81,9 @@
 WEB_TEST_PORT=5321 npm --prefix web run test:e2e -- --grep "N-021 sequencer"
 npm --prefix web run test:sequencer-main-reader
 npm --prefix web run test:long-media-performance
+WEB_TEST_PORT=5570 npm --prefix web run test:sequencer-codec-probe
+WEB_TEST_PORT=5573 npm --prefix web run test:sequencer-media-cache
+WEB_TEST_PORT=5576 npm --prefix web run test:sequencer-media-revision
+WEB_TEST_PORT=5579 npm --prefix web run test:sequencer-final-export
+WEB_TEST_PORT=5586 npm --prefix web run test:sequencer-audio-recovery
 ```
--- a/docs/status/parity-ledger.json
+++ b/docs/status/parity-ledger.json
@@ -1,6 +1,6 @@
 {
  "schemaVersion": 2,
-  "updatedAt": "2026-08-14",
+  "updatedAt": "2026-08-17",
  "source": "docs/BLENDER_5_2_WEB_FEATURE_PARITY.md",
  "parityStatusEnum": ["COMPLETE", "BLOCKED"],
  "releaseClassEnum": ["LOCAL_EXACT", "LOCAL_BOUNDED", "SERVER", "EXCLUDED"],
@@ -13,10 +13,10 @@
      "releaseClass": "LOCAL_BOUNDED",
      "releaseStatus": "READY",
      "v1RequiredSlices": ["C3-roundtrip", "D2-nanovdb-bounded-webgpu-integration", "E2-vdb-network-worker-quota-tamper-rollback-faults"],
-      "v1ExcludedSlices": ["C2-new-external-font-import", "D2-nanovdb-production-viewport-automatic-page-fault-depth-composition", "C3-volume-combined-asset-viewport-reopen", "E1-volume-glb-usd-loss-desktop-chromium-golden", "E2-vdb-large-stream-device-loss-oom"],
+      "v1ExcludedSlices": ["C2-new-external-font-import", "D2-nanovdb-production-viewport-automatic-page-fault-depth-composition", "E1-volume-glb-usd-loss-desktop-chromium-golden"],
      "roadmapStatus": "in_progress",
-      "completedSlices": ["A1", "A2-malformed-binary-partial", "A2-integer-overflow-fixtures", "A2-multichunk-attribute-completeness", "B2", "B3-metadata", "B3-vdb-conversion-request-boundary", "B3-nanovdb-manifest-range-hash-protocol", "B3-nanovdb-serial-range-streamer", "B3-vdb-stage-capability-gates", "B3-vdb-real-resource-license-hash-catalog", "B3-desktop-openvdb13-nanovdb32-converter", "B3-native-conversion-determinism-malformed-input", "B3-vdb-server-job-isolation-cancel-timeout", "B3-vdb-desktop-server-hash-equality", "B3-nanovdb-http-retry-if-range-body-resume", "C1-topology-partial", "C1-handle-points-partial", "C1-handle-preview-raycast-partial", "C1-handle-identity-gizmo-main-roundtrip", "C1-multi-handle-selection-highlight-bounded-commit", "C1-gizmo-revision-delta-transaction-boundary", "C1-continuous-handle-gizmo-preview-single-commit", "C1-handle-local-origin-orientation-gizmo", "C1-rename-partial", "C1-create-delete-poly-partial", "C1-poly-bezier-nurbs-1d-conversion", "C1-multispline-create-delete-bulk-handle-cyclic-transaction", "C1-surface-2d-topology-transaction", "C2-font-geometry-partial", "C2-font-layout-partial", "C2-font-character-style-textbox-roundtrip", "C2-existing-packed-vfont-style-links", "C2-builtin-font-evaluation-exact", "C3-roundtrip", "C3-volume-main-properties-save-reopen", "C3-nanovdb-opfs-binding-worker-reopen", "D1-raycast-partial", "D1-offscreen-vert-edge-partial", "D1-selection-history-partial", "D1-cross-object-history-range-patch", "D1-handle-identity-axis-gizmo", "D2-partial", "D2-nanovdb-float32-cpu-wgsl-sampling", "D2-nanovdb-bounded-webgpu-integration", "D2-webgpu-device-loss-session-recovery", "D2-nanovdb-grid-material-mapping", "D2-nanovdb-explicit-resident-page-lru-recovery", "E1-partial", "E1-desktop-geometry-golden", "E1-true-2d-surface-desktop-golden", "E1-glb-evaluated-nonmesh-roundtrip-partial", "E1-glb-curve-line-surface-mesh-evaluated", "E1-usda-four-object-desktop-roundtrip", "E1-pointcloud-curves-hair-glb-usd-loss-fixture", "E2-1M-chromium", "E2-chromium-worker-recovery", "E2-opfs-quota-chromium", "E2-vdb-network-worker-quota-tamper-rollback-faults"],
-      "blockedSlices": ["C2-new-external-font-import", "D2-nanovdb-production-viewport-automatic-page-fault-depth-composition", "C3-volume-combined-asset-viewport-reopen", "E1-volume-glb-usd-loss-desktop-chromium-golden", "E2-vdb-large-stream-device-loss-oom"],
+      "completedSlices": ["A1", "A2-malformed-binary-partial", "A2-integer-overflow-fixtures", "A2-multichunk-attribute-completeness", "B2", "B3-metadata", "B3-vdb-conversion-request-boundary", "B3-nanovdb-manifest-range-hash-protocol", "B3-nanovdb-serial-range-streamer", "B3-vdb-stage-capability-gates", "B3-vdb-real-resource-license-hash-catalog", "B3-desktop-openvdb13-nanovdb32-converter", "B3-native-conversion-determinism-malformed-input", "B3-vdb-server-job-isolation-cancel-timeout", "B3-vdb-desktop-server-hash-equality", "B3-nanovdb-http-retry-if-range-body-resume", "C1-topology-partial", "C1-handle-points-partial", "C1-handle-preview-raycast-partial", "C1-handle-identity-gizmo-main-roundtrip", "C1-multi-handle-selection-highlight-bounded-commit", "C1-gizmo-revision-delta-transaction-boundary", "C1-continuous-handle-gizmo-preview-single-commit", "C1-handle-local-origin-orientation-gizmo", "C1-rename-partial", "C1-create-delete-poly-partial", "C1-poly-bezier-nurbs-1d-conversion", "C1-multispline-create-delete-bulk-handle-cyclic-transaction", "C1-surface-2d-topology-transaction", "C2-font-geometry-partial", "C2-font-layout-partial", "C2-font-character-style-textbox-roundtrip", "C2-existing-packed-vfont-style-links", "C2-builtin-font-evaluation-exact", "C3-roundtrip", "C3-volume-main-properties-save-reopen", "C3-nanovdb-opfs-binding-worker-reopen", "C3-volume-combined-asset-viewport-reopen", "D1-raycast-partial", "D1-offscreen-vert-edge-partial", "D1-selection-history-partial", "D1-cross-object-history-range-patch", "D1-handle-identity-axis-gizmo", "D2-partial", "D2-nanovdb-float32-cpu-wgsl-sampling", "D2-nanovdb-bounded-webgpu-integration", "D2-webgpu-device-loss-session-recovery", "D2-nanovdb-grid-material-mapping", "D2-nanovdb-explicit-resident-page-lru-recovery", "D2-nanovdb-production-viewport-automatic-page-fault", "E1-partial", "E1-desktop-geometry-golden", "E1-true-2d-surface-desktop-golden", "E1-glb-evaluated-nonmesh-roundtrip-partial", "E1-glb-curve-line-surface-mesh-evaluated", "E1-usda-four-object-desktop-roundtrip", "E1-pointcloud-curves-hair-glb-usd-loss-fixture", "E1-volume-desktop-main-offscreen-pixel-golden", "E2-1M-chromium", "E2-chromium-worker-recovery", "E2-opfs-quota-chromium", "E2-vdb-network-worker-quota-tamper-rollback-faults", "E2-vdb-large-stream-device-loss-oom"],
+      "blockedSlices": ["C2-new-external-font-import", "D2-nanovdb-production-viewport-automatic-page-fault-depth-composition", "E1-volume-glb-usd-loss-desktop-chromium-golden"],
      "excludedSlices": [],
      "acceptance": ["web:test:nonmesh-roundtrip", "web:test:nonmesh-desktop-golden", "web:test:nonmesh-glb-blender-roundtrip", "web:test:nonmesh-usd-serialization", "web:test:nonmesh-usd-blender-roundtrip", "web:test:nonmesh-binary", "web:test:selection-history", "web:test:nonmesh-interaction", "web:test:vdb", "web:test:vdb-availability", "web:test:vdb-native", "web:test:vdb-server", "web:test:vdb-opfs", "web:test:vdb-webgpu", "web:test:vdb-viewport", "web:test:vdb-faults", "web:e2e:N-015|non-mesh", "web:e2e:real OPFS quota"],
      "dependencies": []
@@ -72,7 +72,7 @@
      "v1RequiredSlices": ["B-world-scene-render-delta-roundtrip", "B-C-nanovdb-float32-wgsl-bounded-ray-integration"],
      "v1ExcludedSlices": ["A", "B", "C", "D", "E", "B-C-nanovdb-production-viewport-paging-advanced-material", "E-volume-desktop-chromium-pixel-golden"],
      "roadmapStatus": "planned",
-      "completedSlices": ["A-camera-light-world-scene-reader-partial", "A-main-camera-dof-properties-partial", "A-main-light-world-properties-partial", "A-white-balance-integrity-gate", "B-three-exposure-shadow-mapping-partial", "B-bounded-kelvin-linear-light-color", "B-world-scene-render-delta-roundtrip", "B-volume-material-manifest-boundary", "B-C-nanovdb-float32-wgsl-bounded-ray-integration"],
+      "completedSlices": ["A-camera-light-world-scene-reader-partial", "A-main-camera-dof-properties-partial", "A-main-light-world-properties-partial", "A-white-balance-integrity-gate", "B-three-exposure-shadow-mapping-partial", "B-bounded-kelvin-linear-light-color", "B-world-scene-render-delta-roundtrip", "B-volume-material-manifest-boundary", "B-C-nanovdb-float32-wgsl-bounded-ray-integration", "D-final-render-server-routing-fail-closed", "D-server-render-source-build-settings-output-hash-binding", "E-bounded-realtime-blender-reference-image-metrics"],
      "blockedSlices": ["A", "B", "C", "D", "E", "B-C-nanovdb-production-viewport-paging-advanced-material", "E-volume-desktop-chromium-pixel-golden"],
      "acceptance": ["web:test:lighting-roundtrip", "web:e2e:N-019 Scene exposure"],
      "dependencies": ["N-018"]
@@ -86,7 +86,7 @@
      "v1RequiredSlices": ["B-real-main-exposure-invert-cpu-chain", "D-unsupported-node-preservation-gate"],
      "v1ExcludedSlices": ["A", "B", "C", "D", "E"],
      "roadmapStatus": "planned",
-      "completedSlices": ["A-graph-resource-cycle-schema", "A-main-graph-structure-reader-partial", "A-main-exposure-default-invert-parameter-reader", "B-bounded-cpu-executor-partial", "B-real-main-exposure-invert-cpu-chain", "C-image-operation-budget-cancel-partial", "C-content-addressed-frame-lru-cache", "D-unsupported-node-preservation-gate"],
+      "completedSlices": ["A-graph-resource-cycle-schema", "A-main-graph-structure-reader-partial", "A-main-exposure-default-invert-parameter-reader", "B-bounded-cpu-executor-partial", "B-real-main-exposure-invert-cpu-chain", "B-webgpu-constant-exposure-invert-golden-partial", "B-D-unsupported-full-graph-execution-block", "C-image-operation-budget-cancel-partial", "C-content-addressed-frame-lru-cache", "D-unsupported-node-preservation-gate"],
      "blockedSlices": ["A", "B", "C", "D", "E"],
      "acceptance": ["web:test:compositor-main-reader", "web:e2e:N-020 CPU compositor"],
      "dependencies": ["N-019"]
@@ -100,7 +100,7 @@
      "v1RequiredSlices": ["B-real-main-cross-still-frame-resolution", "C-runtime-codec-probe-gate"],
      "v1ExcludedSlices": ["A", "B", "C", "D", "E"],
      "roadmapStatus": "planned",
-      "completedSlices": ["A-strip-resource-schema", "A-main-strip-timeline-reader-partial", "B-deterministic-move-trim-split-partial", "B-source-frame-seek", "B-active-frame-dependency-resolution", "B-cross-transition-progress-input-resolution", "B-real-main-cross-still-frame-resolution", "C-runtime-codec-probe-gate"],
+      "completedSlices": ["A-strip-resource-schema", "A-main-strip-timeline-reader-partial", "B-deterministic-move-trim-split-partial", "B-source-frame-seek", "B-active-frame-dependency-resolution", "B-cross-transition-progress-input-resolution", "B-real-main-cross-still-frame-resolution", "C-runtime-codec-probe-gate", "C-runtime-image-sound-movie-byte-decode-probe", "C-source-decode-bound-movie-proxy-cache", "C-seek-scrub-decode-revision-gate", "C-audio-context-suspend-device-mute-recovery", "D-final-export-server-routing-fail-closed"],
      "blockedSlices": ["A", "B", "C", "D", "E"],
      "acceptance": ["web:test:sequencer-main-reader", "web:e2e:N-021 sequencer"],
      "dependencies": ["N-020"]
--- a/docs/status/release-evidence.json
+++ b/docs/status/release-evidence.json
@@ -1,8 +1,8 @@
 {
  "schemaVersion": 4,
  "source": "docs/status/parity-ledger.json",
-  "sourceSha256": "1e16518a25c6b6bed4ab7f605ea1ad5babe529f2842c858b20ae6daae30bd478",
-  "generatedAt": "2026-08-15T05:37:25.215Z",
+  "sourceSha256": "0a9b4c1026c42b5f77869f222b1531601ed229184a1d1737e74047c7b3406730",
+  "generatedAt": "2026-08-17T08:22:00.415Z",
  "families": [
    {
      "id": "N-015",
@@ -18,9 +18,7 @@
      "v1ExcludedSlices": [
        "C2-new-external-font-import",
        "D2-nanovdb-production-viewport-automatic-page-fault-depth-composition",
-        "C3-volume-combined-asset-viewport-reopen",
-        "E1-volume-glb-usd-loss-desktop-chromium-golden",
-        "E2-vdb-large-stream-device-loss-oom"
+        "E1-volume-glb-usd-loss-desktop-chromium-golden"
      ],
      "roadmapStatus": "in_progress",
      "completedSlices": [
@@ -61,6 +59,7 @@
        "C3-roundtrip",
        "C3-volume-main-properties-save-reopen",
        "C3-nanovdb-opfs-binding-worker-reopen",
+        "C3-volume-combined-asset-viewport-reopen",
        "D1-raycast-partial",
        "D1-offscreen-vert-edge-partial",
        "D1-selection-history-partial",
@@ -72,6 +71,7 @@
        "D2-webgpu-device-loss-session-recovery",
        "D2-nanovdb-grid-material-mapping",
        "D2-nanovdb-explicit-resident-page-lru-recovery",
+        "D2-nanovdb-production-viewport-automatic-page-fault",
        "E1-partial",
        "E1-desktop-geometry-golden",
        "E1-true-2d-surface-desktop-golden",
@@ -79,17 +79,17 @@
        "E1-glb-curve-line-surface-mesh-evaluated",
        "E1-usda-four-object-desktop-roundtrip",
        "E1-pointcloud-curves-hair-glb-usd-loss-fixture",
+        "E1-volume-desktop-main-offscreen-pixel-golden",
        "E2-1M-chromium",
        "E2-chromium-worker-recovery",
        "E2-opfs-quota-chromium",
-        "E2-vdb-network-worker-quota-tamper-rollback-faults"
+        "E2-vdb-network-worker-quota-tamper-rollback-faults",
+        "E2-vdb-large-stream-device-loss-oom"
      ],
      "blockedSlices": [
        "C2-new-external-font-import",
        "D2-nanovdb-production-viewport-automatic-page-fault-depth-composition",
-        "C3-volume-combined-asset-viewport-reopen",
-        "E1-volume-glb-usd-loss-desktop-chromium-golden",
-        "E2-vdb-large-stream-device-loss-oom"
+        "E1-volume-glb-usd-loss-desktop-chromium-golden"
      ],
      "excludedSlices": [],
      "acceptance": [
@@ -274,7 +274,10 @@
        "B-bounded-kelvin-linear-light-color",
        "B-world-scene-render-delta-roundtrip",
        "B-volume-material-manifest-boundary",
-        "B-C-nanovdb-float32-wgsl-bounded-ray-integration"
+        "B-C-nanovdb-float32-wgsl-bounded-ray-integration",
+        "D-final-render-server-routing-fail-closed",
+        "D-server-render-source-build-settings-output-hash-binding",
+        "E-bounded-realtime-blender-reference-image-metrics"
      ],
      "blockedSlices": [
        "A",
@@ -317,6 +320,8 @@
        "A-main-exposure-default-invert-parameter-reader",
        "B-bounded-cpu-executor-partial",
        "B-real-main-exposure-invert-cpu-chain",
+        "B-webgpu-constant-exposure-invert-golden-partial",
+        "B-D-unsupported-full-graph-execution-block",
        "C-image-operation-budget-cancel-partial",
        "C-content-addressed-frame-lru-cache",
        "D-unsupported-node-preservation-gate"
@@ -362,7 +367,12 @@
        "B-active-frame-dependency-resolution",
        "B-cross-transition-progress-input-resolution",
        "B-real-main-cross-still-frame-resolution",
-        "C-runtime-codec-probe-gate"
+        "C-runtime-codec-probe-gate",
+        "C-runtime-image-sound-movie-byte-decode-probe",
+        "C-source-decode-bound-movie-proxy-cache",
+        "C-seek-scrub-decode-revision-gate",
+        "C-audio-context-suspend-device-mute-recovery",
+        "D-final-export-server-routing-fail-closed"
      ],
      "blockedSlices": [
        "A",