Render Editor limits, errors and cleanup

Native Light format and bounds

The current native envelope is barocss-render-editor-native-scene, wire version 2, profile canonical-native-lights, with a directional or point lights.profile. RenderNativeLightDocument and the generic parse/prepare/serialize/request/session APIs remain unsuffixed. This is separate from the historical Source1 and mixed-depth limits below.

• Select one to four original native Surface bodies through explicit qualified bindings, with at least one visible Surface. Keep complete CAD source, source options, original document/asset revisions, material source and supplied overrides. Material targets must match current qualified body pins; repeated geometry IDs are not interchangeable.
• File/draft text is limited to 2097152 UTF-8 bytes and UTF-16 code units. Input traversal is bounded to 65536 values, depth 24, 32 fields per record and generally 64 array elements; selected bodies, visible bodies, poses, materials and lights have their narrower four-entry limits. History allows at most 64 entries and 16 MiB of canonical serialized text.
• Body translation XYZ is finite in −10000..10000 mm; scale XYZ is finite in 0.001..100. Rotation is a raw XYZW unit quaternion: each component in −1..1 and length within 1e-9 of 1. Position/scale fields preserve it; the explicit degree-delta controls below stage an intentional rotation. Empty poses mean identity intent; otherwise every selected body must occur exactly once, including hidden bodies.
• mmToSceneUnit is 0.000001..1, with the explicit part-xyz-matches-rhyup basis. Camera eye/target and point-light positions are already scene coordinates; do not apply the mm conversion to them again.
• Camera eye/target components are finite within ±1000 scene units, separated by at least 0.0001. Up has finite dimensionless components and length at least 0.000001; its authored magnitude is retained. Up and viewing direction must not be singular. Vertical FOV is 10..100 degrees; clipping requires 0.0001 ≤ near < far ≤ 10000 scene units. Actual Float32 conditioning checks can refuse otherwise bounded values.
• Directional catalogs contain zero to four lights, each with a nonzero raw XYZ vector and components within ±1000. Point catalogs contain zero to four lights, position components within ±1000000 scene units and range 0.001..1000000 scene units. Ambient, each linear RGB component and intensity are 0..1. Disabled entries count toward the limit and still require valid fields. Point attenuation is the GPU's artistic finite-range law, not a photometric calibration claim.

Bounds are admission requirements, not permission to clamp or normalize. Original up/quaternion/vector components, signed zero and omitted material overrides survive accepted authorship and the signed codec. Actual native/material/TEN and posed GPU admission remain authoritative after schema validation. Plain own enumerable data is required; unknown fields, foreign prototypes, accessors, symbols, sparse arrays, nonfinite numbers, unsupported profiles and mismatched owner/revision bindings refuse.

Workspace focus and transaction limits

• Inspector focus is presentation state, not a new selection identity, document format or partial transaction. Body/light targets and every corrective field retain their existing authority. Focus controls refuse during pending work, navigation, Help, file/material reads, dialogs and recovery; changing a target never silently resolves hidden drafts.
• The fixed footer uses the existing whole-scene Apply/Discard handlers. Invalid hidden fields remain reachable and refuse Apply; accepted-only Save, one acknowledged history step and unavailable-presentation recovery retain their existing limits. Scene titles retain the provider's raw admitted text and bounds: non-whitespace, at most 128 Unicode code points, 256 UTF-16 code units and 512 UTF-8 bytes.
• Canvas sizing preserves the element's 8:5 backing aspect while fitting both frame axes, so the intended pick rectangle is the displayed image rectangle. Source-linked sizing and controlled center-pick checks do not establish rendered CSS, ordinary pointer behavior or GPU pixels. Physical narrow/short viewport picking, fixed-footer visibility and keyboard reachability still need actual-device verification; see the adopted styles and focused flow.

Selected Body task limits

• Body tasks change presentation context only. Selection identity, raw corrective fields, mounted Canvas/controller and whole-scene Apply/history retain their existing authority. Selection changes reset the task to overview, and focus leaves a field that becomes hidden. Pending work, navigation, Help, dialogs, reads and recovery retain the existing synchronous fences.
• Correction routes do not classify every provider error or bypass validation. Choose the affected body and existing Move/Scale/Material inputs; unrelated hidden drafts still participate in Apply. Back is neither Discard nor an undo operation.
• The adopted focused flow passed eight scenarios/four controlled Viewer attempts/zero files/one lifetime per light kind. The historical workspace-focus fixture was adapted for task visibility but was not rerun in this slice. Physical keyboard/focus, short-viewport layout, pointer picking and GPU acceptance require separate actual-device evidence.

Body duplicate and remove limits

• Duplicate/Remove reuse the actual Native derivations and reconstruct every qualified target. A copy has new body/asset/embedded material IDs, with only its new asset/material revisions reset by that authority. The native document revision advances once; the owned whole-scene acceptance advances scene/light revisions and history once. Original source, raw pose/quaternion/signed zero, omitted poses/uniforms, other materials, light catalog and authored camera retain their values.
• Current limits remain four source assets, four selected/visible/material Surfaces and 16 native bodies, plus existing file/source/revision bounds. Hidden, unbound, unknown or stale selections refuse. Remove preserves at least one editable material-bound visible Surface; shared assets survive while any native body references them. This adds neither a visibility toggle nor a native geometry editor.
• The app preflights the complete reservation union at 2048 IDs before draft or Viewer mutation. All three generated IDs are reserved together only after acknowledgement. Undo/Redo, removal, Discard and accepted-scene remount retain reservations; successful Open or explicit New workspace resets them. Exhaustion requires a new workspace or reopening a saved scene, not silent ID reuse.
• Dirty/corrective fields, Help, choosers, navigation, pending work and unavailable lifetimes block commands. Ready failure cleanup requires the same command ticket, session, accepted document and exact introduced draft text, with no pending operation. It may advance the internal draft version but makes no extra Viewer request or accepted/history/saved change. Unsafe cleanup keeps the original error and recovery diagnostic; Apply, competing edits/files and navigation remain fenced until explicit recovery. Accepted-only Save remains available. Remount resets history and does not certify pixel rollback; stale completions cannot publish selection or reservations into another lifetime.

The finite software flow covers both light kinds with 32 direct helper cases, 12 replacement attempts and four Save/Open transports per kind, including refusal, remount and stale completion. These are actual authority/React/session checks with controlled Viewer and file transport, not physical GPU, chooser, persistence or gizmo acceptance.

Original Surface file addition limits

• Add Surface reuses the original CAD source inspector, Native Surface-add derivation and complete Light scene qualification. It requires one currently selected visible, unambiguous, fully qualified material-bound Surface in a clean ready scene. Curve-only files, unknown Surface IDs, malformed/unsafe source and existing scene/display capacity or revision limits refuse; inspection is not display admission.
• The existing source limit is 65536 UTF-8 bytes and 65536 UTF-16 code units. Reported file.size is checked before reading; actual buffer.byteLength is checked independently before fatal UTF-8 decoding. The real source/compiler guards run afterward. Extensions are hints only. No unit conversion rewrites source: XYZ is native mm, using the existing scene scale, with an identity pose at the source origin and the provider's omitted-pose representation retained when applicable.
• The selected accepted embedded material is supplied explicitly. The command creates independent body/source-asset/material identities and preserves other bindings even when material IDs repeat. Complete source, including unselected objects, is retained. Existing provider capacities and the full 2048-ID reservation union are checked before draft or Viewer work. All three generated IDs and the new selected row are published only after acknowledgement. Undo/removal/remount retain reservations; successful Open/New resets them.
• One Add acknowledgement owns one outer scene/history step and the provider's native revision increment. A ready refusal clears only the exact command-owned temporary draft and retains the inspected candidate; it never accepts a partial source or material. Candidate retry rebases only after owned cleanup with unchanged accepted identity, selected binding, selection epoch and corrective form. Unavailable cleanup requires explicit body-command recovery, without a pixel rollback claim.
• The dialog owns its captured session/lifetime and fences competing authoring, selection, files and navigation. Closing invalidates pending reads, while failed or canceled reads retain the prior candidate when still open. Submitted Add disables Cancel, Escape and outside-close synchronously; disposal still invalidates its continuation. No late read or acknowledgement can update another lifetime, and waiting for a promise is not an abort guarantee.

The bounded actual-provider/React/session flow uses controlled Viewers and file transport. Physical chooser, disk persistence, GPU pixels and integrated device recovery remain separate. The scoped software evidence does not add physical acceptance for #1573. This Manual documents the local app entry point and does not deploy the editor itself.

Accepted original source export limits

• Export accepted CAD source requires a current visible, unambiguous, qualified material-bound original Surface. The selected body identifies its whole asset; repeated geometry IDs do not select another asset and shared ownership does not block this read-only operation.
• The download preserves exact accepted source text as UTF-8, including other objects and accepted point edits. Native document admission rejects malformed source and unpaired surrogates; an additional encoding roundtrip refuses replacement. No geometry serialization, axis conversion, scene transform, newline or BOM insertion is performed. Accepted text is not a claim of byte identity to an imported file before decoding.
• Export does not consume drafts, mark the scene saved, alter revisions/history or request a Viewer replacement. Current selection epoch, accepted identity, lifetime and pending/dialog/chooser/navigation fences reject stale operations. Anchors and object URLs are cleaned even if the download request throws.
• Focused actual-provider/React checks cover whole-asset reimport and accepted-only bytes through a controlled download transport. They do not establish physical chooser/disk persistence or GPU acceptance.

Original Surface control-point limits

• Edit control point requires a clean ready scene and one visible, unambiguous, qualified material-bound Surface. U/V are original row/column indices. XYZ is bounded to ±1000000 source mm, weight to 0.000001..1000000, and corrective fields to 256 characters. Existing source, rational geometry, posed display and revision admission remains authoritative; values are never silently clamped.
• Any other native body referencing the same asset blocks editing, including hidden/unselected siblings. Duplicate body creates a new independently owned asset when capacity allows; a full scene can refuse duplication. Point editing itself creates no IDs, changes no pose/material contents/light values and preserves source comments, unrelated scalar spans and geometry.
• The provider owns the native and edited-asset revision increments and refreshed target bindings; one acknowledged command owns one outer scene/history step. Exact serialized no-ops retain source, revisions, raw signs and fields without presentation. Corrective edits lock point switching until Reset fields or a successful command.
• The captured coefficient/selection/lifetime ticket and existing exact command-draft cleanup own ready-refusal retry and loss recovery. Submitted Apply point synchronously disables all close routes; unmount invalidates its continuation. A stale completion cannot update a replacement lifetime. No rollback of physical pixels is promised.

Both light kinds passed focused actual-provider/React/session checks with 12 edit-helper calls plus one real duplicate, six Viewer attempts, two Save/Open transports and three lifetimes per kind. These controlled checks do not establish physical GPU, file persistence or gizmo acceptance.

Body transform reset limits

• Stage reset transform replaces only the selected body's position/rotation/scale fields. It can correct that body's invalid numeric text without parsing or consuming unrelated drafts. Those other drafts still participate in the eventual whole-scene Apply and can refuse it.
• The target is source-origin [0,0,0] mm, XYZW [0,0,0,1] and scale [1,1,1]. Existing document and posed-display admission must accept the generated selected pose before fields change. Source geometry, materials, lights, visibility and local view are retained; there is no automatic framing.
• Signed-zero-aware exact numerical identity returns the same form, preserving lexical values such as 1.0 and omitted poses. A genuine explicit reset may replace -0 with +0 or a negative-identity quaternion with the stated target. It never normalizes an imported quaternion implicitly.
• Current qualified selection, selection epoch, lifetime, pending operation, dialog, chooser and navigation fences apply. Staging adds no revision/history or Viewer request; ordinary Apply owns the acknowledged whole-scene change. Both-kind focused controlled checks establish software behavior, not physical GPU or file acceptance.

Body rotation controls

• Rotate by accepts finite decimal degrees in −360..360. It turns about the selected body origin without translating or scaling it. With XYZW axis delta δ = [axis × sin(d × π / 360), cos(d × π / 360)], local is q × δ and world is δ × q, using Hamilton multiplication in the existing right-handed basis.
• Imported q, the generated delta and the composed result are not normalized, sign-snapped or converted through Euler angles. Existing document and posed Viewer/GPU CPU admission refuses unsafe components, norm or coordinates before staging. A nonzero angle whose half-angle underflows to zero also refuses; previous draft and corrective strings remain available.
• Exactly ±0 and ±360 return the identical form and retain raw signs, signed zero and empty identity poses. Other angles are not wrapped or clamped. Several intentional rotations can produce a different raw quaternion despite an equivalent orientation; whole-scene signed serialization, not approximate orientation, owns Apply no-ops. A genuine change expands omitted poses to the existing complete selected-body contract.
• Commands use the current selected-body draft and captured selection/lifetime fences. Position/scale strings, other bodies and unrelated scene data are retained. Command preferences are local UI state; only staged quaternion data enters whole-scene Apply/history and accepted-only Save. The collapsed advanced quaternion display is read-only. Controlled React/provider/session checks are not physical GPU, native-file or #1573 gizmo acceptance.

Body material uniform limits

• Body material edits only scalar uniforms declared by an existing visible body's qualified embedded material. Names, ranges and defaults come from the actual shader compiler/provider; they are not a universal 0..1 range. Hidden/missing/unqualified bindings and materials with no scalar declarations are noneditable. Uniform editing creates no binding or ID and preserves shader source; explicit portable-material transfer is described below.
• Each full body binding owns its embedded material independently. Repeated material documentId values do not link bodies or authorize changing another binding. Unrelated materials and original source/TEN/pose/camera/light data stay intact.
• Enabled overrides require complete finite decimals within their declared ranges. Empty, incomplete, nonfinite or out-of-range active input refuses the whole transaction without accepting partial edits. Cleared overrides omit their property and use the declared default; their retained corrective text is not authored input. Explicit defaults differ from omission, and signed zero differs from positive zero. Equivalent numeric formatting with unchanged presence is a no-op when the complete scene is otherwise unchanged.
• Existing material-session preparation owns dirty comparison and the single next embedded revision. Changed material revision 2147483647 refuses before presentation; unchanged bindings retain their revision. Temporary material sessions are disposed without a separate history commit or presentation. Material/body/camera/light changes use the same pending-operation fences, one scene Apply/history transaction and accepted-only Save described below.

See the body-bound uniform guide and the unchanged Surface B downloads. These controls do not establish physical GPU/file/device acceptance or resolve #1573.

Portable material transfer limits

• Import targets one existing visible, unambiguous, fully qualified embedded binding. It copies only shader source and supplied uniforms through the actual portable codec/assignment/material-session authority; it does not import the portable identity/title/revision, create a shared asset or fan out repeated material IDs. Other bindings and complete scene/native/TEN/pose/light/authored-camera/local-view authority remain intact.
• Existing material limits apply: file size is at most 262144 UTF-8 bytes, source at most 65536, and at most 16 supplied uniforms. The host checks both reported size and actual buffer bytes, then fatal UTF-8 and the strict codec/compiler/provider. Unknown fields, malformed source, undeclared/out-of-range uniforms and invalid qualifications refuse atomically. No partial source/uniform fields are published.
• Import requires a clean whole-scene form/session, ready idle presentation and no Help, chooser or navigation operation. It captures the exact snapshot/form, full binding, selection epoch and owning lifetime before the chooser, then checks them again after reading. Selection away/back, changed form/history/workspace, disposal, loss or stale completion cannot retarget the import. Cancellation/empty selection is a no-op, and the input is cleared for same-file reselection. Submitted reads are awaited rather than falsely described as cancelled; only the owning operation releases busy state.
• Staging alone leaves accepted revision/history/saved state unchanged. Real material or scene changes at revision 2147483647 refuse before staging or Viewer work; an exact no-op needs no next revision. Existing signed-value material preparation owns a changed embedded revision once, and the eventual whole-scene Apply owns the single presentation/history transaction. Temporary material sessions are disposed on every path, including exceptions.
• Export reads only the selected accepted embedded material, even if private fields are dirty. It uses the signed portable serializer and safe existing ID filename, never calls the scene's saved acknowledgement, and always removes its owned link/revokes its URL. Download transport is not proof of disk persistence. Hidden, unbound, unqualified and busy targets remain unavailable.

See the material Import/Export steps and existing material authority. Controlled files and Viewers establish software retention and lifecycle behavior only; #1577's physical file/pixel gate and #1573's physical gizmo gate remain open.

Body material copy limits

• Stage material copy reads the accepted source from another visible, unambiguous, fully qualified body binding. It uses the same actual assignment/material-session authority as portable import, retaining the destination identity/title/target and unrelated scene data. Repeated material or geometry IDs do not create a shared material.
• Shader text and supplied overrides retain omission versus explicit defaults and signed zero. Exact equal content returns the unchanged form with no Viewer/history request. Changed material or scene revisions at 2147483647 refuse before staging; successful ordinary Apply advances each changed material and the scene once.
• The whole-scene form/session must be clean and ready. Captured accepted-scene, source/destination binding, selection epoch and lifetime identities fence stale actions; selection away/back invalidates the choice. Pending operations, dialogs, file choosers, navigation and unavailable presentation block the command. A refused Apply retains staged corrective data under the existing transaction contract.
• Both-kind focused provider/React checks cover ten helper cases, four Viewer attempts, no file transport and one lifetime per kind. Ordinary browser selection, visible material changes and physical GPU behavior require separate Execute Tester evidence; directional observations do not establish point-light pixels.

Native Light transaction and cleanup limits

A workspace's backend kind is fixed for its lifetime. Mixed lighting and cross-kind Open/Apply refuse. Supported legacy directional V1 can be parsed and migrated; Native V0 requires the app's explicit legacy import into a directional workspace. Switching kinds starts a new lifetime; remount reconstructs accepted data and resets history.

Accepted documents and candidates are immutable. Await commitPrepared; concurrent mutations, stale versions and foreign/forged/reused candidates refuse. Invalid or refused drafts retain corrective text and accepted authoring/history. The workbench's signed whole-document no-op comparison avoids a presentation/revision/history change; the bare session does not automatically suppress a prepared Apply. Save uses accepted authorship, excludes raw field strings and acknowledges only the exact issued save payload after persistence.

Native Light errors use RenderEditorError codes including DOCUMENT_INPUT, DOCUMENT_VERSION, DOCUMENT_BYTES, SOURCE_REFUSED, STALE_CANDIDATE, PRESENTATION_REFUSED, HISTORY_LIMIT and DISPOSED, with reached provider causes retained. Correct data and reprepare after an ordinary refusal. An indeterminate acknowledgement or lost/unavailable presentation requires explicit disposal/remount. Retained CPU authorship is not retained pixels. The host must fence file reads and asynchronous actions, dispose its owned session, and clean up startup that completes after closure.

Local viewport navigation limits

The Light workbench navigation controls use the same strict camera bounds and raw-value admission above. The existing session's navigateViewportCamera and resetViewportCamera require a current expected version and an awaited result. Local view changes advance session/Viewer generations only: accepted authorship, raw drafts, document/catalog revisions, Save identity and history stay unchanged. Exact signed-value camera no-ops make no Viewer request. The camera is not added to the saved document unless the clean-only Set scene camera action accepts it through one whole-scene Apply.

Frame selected/all use qualified original CAD control-hull bounds for visible material-bound Surfaces, preserving complete body/document/asset/model/geometry identity even when geometry IDs repeat. The current admitted quaternion, positive nonuniform scale, translation and explicit mm conversion transform all eight corners per included body. Framing retains viewing orientation, raw Up and FOV, then chooses a centered local camera and clipping planes with a 1.2 visual margin. Every corner must pass the actual prepared projection and near/far checks; nonfinite, degenerate, out-of-limit, missing, hidden, unbound or ambiguous targets refuse without clamping. This conservative visual fit is not a tight Surface bound, centroid or pixel-containment certificate, and does not import Source1's separate radial travel rule.

Framing reads accepted geometry without consuming corrective fields, revisions, history or Save identity. Its repeat cache requires the exact acknowledged document/camera identities, body scope and CSS/backing dimensions; any changed key requalifies instead of using approximate camera equality. Active drag/queued/pending operations, file chooser, Help and unavailable state fence Frame commands. A Canvas backing size that differs from the acknowledged Viewer size refuses before cache reuse or presentation. Existing local-view retention/reset and explicit clean-only Set scene camera behavior still apply; no new shortcut, picking or gizmo behavior is implied.

There is at most one in-flight workbench presentation and one latest desired target, accumulated from new inputs rather than the stale acknowledged camera. Drag/queued/pending input fences author/file actions. Cancellation, blur/capture loss and changed CSS rectangles discard queued motion, not an already submitted or acknowledged update. Scene camera is a separate acknowledged reset. Ordinary Apply/Undo/Redo retain an active local override; successful Open/new lifetime resets it, while refused Open retains it.

Recoverable refusal retains the last acknowledged camera and accepted/raw state. Unexpected rejection or malformed/inconsistent acknowledgement is indeterminate and requires explicit disposal/remount. ACK followed by device loss still records acknowledged metadata with unavailable live status; it does not promise a visible frame. Disposal/replaced-workspace fences prevent late completion from reviving the old lifetime. Original validation failures and backend causes remain observable.

Directional and point Viewer replacement currently rebuilds complete candidates/resources. Coalescing bounds concurrent work; it is not a camera-only GPU fast path, measured performance result, smoothness or 60 fps guarantee. The bounded software checks use actual input/math/codec/session behavior with controlled Viewer, DOM geometry, pointer capture and RAF boundaries. Physical browser/GPU/device behavior remains unverified by those checks.

Canvas body selection limits

The Canvas selection workflow queries the currently acknowledged scene through the owned Viewer. Public pickViewportBody(xPixel, yPixel, expectedVersion) requires integer top-left backing coordinates, current version, ready status and matching actual/acknowledged backing dimensions. The app maps an in-bounds point from its axis-aligned CSS rectangle with floor((client - origin) * backing / CSS-size); outside, nonfinite or invalid dimensions refuse rather than clamp. This is not the historical Native continuous-CSS triangle picker or Source1 selection API.

A result must match the complete current original document/revision/body/asset/revision/model/geometry/frame binding and display reference, and identify exactly one visible material-bound Surface. Hidden, unbound, malformed, foreign or stale identities refuse. Repeated geometry IDs alone cannot identify a body. The read holds the session operation lock but leaves the exact accepted snapshot, corrective draft, authored revision/history, valid Save payloads and local camera unchanged. It does not call Viewer selection/highlight or request a scene replacement.

The host captures session/lifetime/generation and CSS/backing geometry, then rechecks completion before changing its Inspector row. A miss keeps that row. Active-drag capture loss and explicit cancellation invalidate input; ordinary capture release after pointerup does not invalidate the admitted click. A cancelled in-flight query remains busy until actual completion. Disposal, replacement, loss, changed dimensions or generation cannot update a newer workspace. Controlled identity responses and DOM events verify these software boundaries; they do not establish physical identity-buffer pixels, pointer behavior, device recovery or fixes for #1573/#1332.

Evidence boundary

The complete scene downloads and shared host expose original authoring data and a bounded source-consumer workflow. Controlled Viewer acknowledgements can verify software transactions; they do not establish actual WebGPU availability, rendered pixels, picking, physical file dialogs/persistence or integrated device recovery. No Native Light screenshot or physical rendering result is asserted here.

The numeric body fields and local camera controls do not establish a fix for the physical arrow-control report #1573, which remains open and unresolved. Arbitrary mixed/spot lighting, visibility controls and native geometry editing are outside this workbench.

Source format

Version0 gpu-scene uses file limit 262144 UTF-8 bytes, source limit 65536 bytes, at most 32 history entries and 4 MiB of history text. Exact own enumerable fields are required. Unknown versions/fields, accessors, malformed source/camera and forged/stale/reused candidates refuse. Original source is preserved, not normalized into a new schema.

Supported Source1 objects include Sphere, Box, Cylinder, Capsule, Rounded Box and Torus under actual GPU compiler admission. This does not imply universal affine scaling, mesh editing, canvas picking or transform gizmos.

Mixed format

Version1 mixed-depth admits exactly one Sphere and one selected native Surface under profile sdf-sphere-native-surface-v0. Each original source is at most 65536 UTF-8 bytes/code units; file is at most 524288 bytes. Sample axes are 2–17, with at most 289 vertices/512 triangles. Camera-inside/clip/travel/Float32 guards still apply. Asset revision is a declared association, not a historical content certificate.

Surface display XYZ is in scene units, finite within ±1000 in the supported field profile. Original CAD coefficients/weights/knots stay native. U/V has no length unit. The existing focused mixed host declares a 1000 × 760 CSS-pixel minimum workspace; that is not mobile/device certification.

Stable error families

Source RenderEditorError.code: DOCUMENT_INPUT, DOCUMENT_VERSION, DOCUMENT_BYTES, SOURCE_REFUSED, STALE_CANDIDATE, PRESENTATION_REFUSED, HISTORY_LIMIT, DISPOSED.

Mixed RenderMixedDocumentError.code: INPUT, VERSION, BYTES, SOURCE, QUALIFICATION, NATIVE, GPU, with reached provider cause. Correct invalid drafts/source/ref/profile before full Apply. Retain authoring/history on failure. Recover explicitly when presentation is unavailable; a restored frame and a retained CPU snapshot are different facts.

Raw incomplete hidden object/Surface input blocks full Apply and file/camera Use. Do not bypass those guards with a metadata-only or camera-only commit. Unmount/dispose releases owned resources; the host owns file reads/downloads, cancellation, routes and session closure.

No general native geometry editor, arbitrary mixed shapes/materials, picking, unrestricted asset scene, Physics coupling, full IME/mobile/recovery certification or publication is established here.

packages/barocss-render-editor/package.json (Manifest and version; local source) · packages/barocss-render-editor/README.md (Package task notes; local source)