WebGPURenderer.replaceModel(artifact) installs one complete glb-static.1 model beside the existing primitive presentation scene. replaceModel(null) clears it. The Engine Observatory now renders the checked-in lantern-plinth GLB artifact through this path. The authored-model integration adds replaceCatalog for ECS-driven world placements and static collision.
#Validation and preparation
packages/assets/runtime.ts copies the JSON before yielding and independently checks the artifact profile, geometry/material/node budgets, triangle indices, normalized normals, finite coordinates, hierarchy, composed transforms, reflected orientation, bounds, collision metadata, census and SHA-256. Rehashing invalid metadata does not bypass these checks. The digest is an integrity check, not proof of a trusted publisher or source-file correspondence. The JSON envelope is bounded by the shared 16 MiB checkpoint limit; names are limited to 256 characters, source labels to 4,096, positions to +/-10,000 and world bounds to +/-1,000,000.
packages/render/model.ts prepares packed position/normal/UV float32 vertices and uint32 triangle indices. Repeated node instances reuse a mesh variant. Reflected nodes use reflected local X positions/normals, reversed triangle winding and a corresponding positive instance matrix. This preserves world positions and inverse-transpose lighting while retaining back-face culling. The existing presentation conditioning limits apply to the resulting matrices; a compiler artifact outside those renderer limits is rejected before GPU allocation.
Opaque base color, metallic, roughness, RGB emission and double-sided flags reach the owned shaders. Back-face normals flip for double-sided surfaces. The instance ABI is now 112 bytes, including an emission vec4; shader profile forward-shaders.2 compiles five pipelines together: single/double-sided scene and shadow variants plus postprocessing. Vertex UVs remain available for later texture support. Textures and masks were outside this original path; the subsequent extensions below add them. Alpha blending, skeletons, animation and material extensions remain open.
#Replacement and ownership
A replacement owns its input at admission and allows one native operation at a time, with a 20-second deadline. Candidate vertex/index buffers are tracked immediately, uploaded inside short validation/out-of-memory scopes, and published only after every scope settles and the previous frame retires. Both scopes are popped synchronously before awaiting, so unrelated rendering errors retain their normal failure path. Partial allocation or validation failure destroys the candidate and keeps the accepted model. Late results after cancellation, timeout or renderer disposal are fenced and destroyed. An uncancellable native operation retains the slot until it settles.
Accepted plus candidate geometry has a 32 MiB logical GPU-buffer ceiling. Each unique oriented mesh owns two buffers. Imported objects, primitive objects and the 25 parts per traveler share the existing 4,096-instance limit. Reservations are checked against the current scene before upload and again before publication; later baselines/deltas cannot bypass them. Camera and shadow culling use transformed mesh-local bounds, including off-center geometry and affine shear. Clearing/replacing a model retires its old buffers; renderer disposal and device loss release all model ownership. Counts describe engine-owned resources, not physical VRAM or driver caches.
#Verification and remaining integration
Headless tests cover independently rehashed invalid artifacts, owned immutable input, mirrored world positions/winding, shared geometry, material values, an independent corner-based visibility oracle, presentation reservations, partial allocation, asynchronous scope rejection and cleanup. The worker GPU probe verifies actual visible geometry; mirror removal, emission and back-face pixel controls, including exact lighting equivalence to the corresponding front face; four repeated replacements; three exact culling/reference image pairs; rejection preserving exact pixels; clear/restore; explicit device destruction and reinstallation of the retained CPU artifact on a new device. The compiled model has three drawable instances and 24 scene triangles, using three oriented meshes, six buffers and 2,592 geometry bytes. Its stage remains a procedural primitive.
The standalone model probe retains and reinstalls the artifact explicitly. The subsequent authored-model integration connects world references, static collision and catalog installation to player graphics creation/recovery, with independent imported-catalog GPU evidence. Default Darkwind still uses primitive content. Live asset activation remains open. The synthetic back-face control and rehashed diagnostic variants are test inputs, not published compiler outputs. Software-WebGPU evidence does not establish physical-device frame budgets. No full engine milestone is closed by this increment.
#Material image integration
Material textures extend this path with sRGB/linear sampled images, explicit glTF samplers, bounded image ownership and textured single/double-sided pipelines. The earlier geometry-only acceptance above remains a historical record.
Surface materials and the Hearth study add tangent-space normals, ambient occlusion, separate tangent/uniform buffers, a nine-pipeline bundle, and an authored furnished scene. The earlier two-buffer-per-mesh geometry census applies only to the original untextured fixture.
Cutout materials add alpha rejection to color, depth and directional/point shadow passes, expand the atomic bundle to thirteen pipelines, and add an original ivy planter to the furnished study. Physics collision remains independent of pixel alpha.
Skeletal deformation adds format-4 palette presentation, shared skinned geometry with independent poses, current-pose visibility bounds and a seventeen-pipeline shader bundle. Both color and shadow passes deform vertices. Authored model placements retain rest palettes across checkpoints; animated actors are not yet integrated.