The WebGPU renderer accepts a complete trusted scene/post WGSL pair through replaceShaders. Shadow, scene and post pipelines compile together against fixed layouts. Only a fully successful latest revision replaces the active bundle; rendering continues with the previous bundle during compilation and after rejection. Initial compilation must succeed before renderer creation succeeds.
#Admission and ownership
packages/render/shader-updates.ts owns frozen source pairs, exact uint64 revision strings, one native compilation and one latest pending request. Combined UTF-8 source size is limited to 256 KiB per request. Malformed admission does not supersede valid work. Diagnostics retain at most 32 messages of 1,024 characters each. State exports expose revisions, content identity, bounded diagnostics and retained source bytes, without source text.
New intent supersedes older tickets. A superseded or timed-out native build retains its slot until every native operation settles. Its result cannot publish. Pending intent has a deadline from admission, including its wait behind native work. The default deadline is 15 seconds. Disposal resolves unfinished tickets, clears accepted references and fences late completion. WebGPU offers no cancellation for native pipeline compilation; a hung compiler therefore prevents new native builds on this controller, while the existing renderer can keep its valid pipelines.
#GPU validation and activation
packages/render-webgpu/pipelines.ts collects compilation diagnostics for both modules, then awaits all five asynchronous pipeline creations (single/double-sided scene and shadow variants plus post). Even if one fails, all must settle before the compile slot is released. Module creation uses a validation error scope that is popped synchronously before awaiting; unrelated frame errors remain on the renderer's normal failure path. Async pipeline failures reject their promises rather than dispatching GPU errors (GPUWeb API contract).
Explicit layouts enforce the 448-byte global uniform, 112-byte minimum instance storage, shadow depth/comparison bindings, and HDR texture/filtering sampler. Compatible post pipelines share a fixed bind-group layout. Invalid bindings, oversized uniforms, missing entry points and syntax errors cannot partially replace a bundle. The SHA-256 identity includes the forward-shaders.2 profile, output format and both sources. Publication replaces one bundle reference between synchronous frame encodes; existing GPU submissions retain their encoded pipelines.
The player exposes the active revision in F2 and shader state in playtest exports. The Engine Observatory runs actual worker-GPU replacement checks. This is an engine API, not an author-facing shader editor.
#Verification and limits
Headless tests cover ownership, bounds, supersession, failed builds, deadline fencing, disposal, synchronous error scopes, complete native settlement and content identity. The real GPU probe changes both scene and post shading, preserves the prior frame during compilation, rejects five malformed/incompatible candidates with identical retained pixels, alternates four valid replacements, and restores the original pixel image after supersession. Existing graph targets, six buffers and three textures remain unchanged.
This path accepts trusted engine WGSL only. A shader author must preserve the vertex/instance ABI, uniform meanings and conservative geometry bounds used by culling. Layout validation cannot prove semantic compatibility or prevent expensive shader execution. This is not an untrusted shader sandbox, material graph, live authored-world activation or automatic device recovery. Resource counts do not measure driver pipeline caches or physical VRAM, and software-WebGPU verification does not establish physical-device performance. No full roadmap milestone is closed by this increment.