[yujiaxu-ops]

The kernel follows indices it reads from buffers and checks none of them, so until now the loop guard was the only thing between bad data and a dispatch that never ends. I checked what the references do: pbrt-v4, Embree, Cycles, three-mesh-bvh, Falcor, the DXR and Vulkan specs, wgpu/naga/Tint. They all do three things:

• hold the invariants in the builders (children after the parent, a depth cap tied to the traversal stack, forced or median leaves);
• clean input where it enters (Embree and Cycles drop non-finite primitives, DXR makes them inactive);
• keep structural checks to debug builds and tests.

None of them checks a tree before every upload, and none caps a traversal's iterations: the 2^64 loop bound that naga and Tint insert does not stop a hang, and clamping a bad child index can close a cycle. This PR does the same three things here.

What changes

Builders

• bvh.rs: no tree is deeper than the kernel's 48-entry stack. Where the levels left could not finish the split SAH wants, the builder splits at the median instead.
• Items whose box is not finite go in no leaf. They sit after every leaf's range and keep their index.
• check_tree (moved here from units.rs) runs on every tree in tests and debug builds.
• A build reports its depth (bvh_depth in the load timings). Today's scenes: Bistro 18, Kabukichō 26, the district 33. No current tree changes.
• ltree.rs: LightTree::check runs after every build, growth and refit in tests and debug builds. It checks that children come after their parent, that leaves stay inside the entries, and that each entry's code leads to its own leaf. Note that the light tree's walks end whatever the data, because their loops are bounded by the encoding. The risk the check covers is out-of-range reads.

Where data enters

• World::set_geometry refuses positions that are not finite.
• A volume's majorant must be a finite number > 0, in Rust and in packages/scene. Infinity used to pass both checks, and delta tracking then never stepped: the walk through the volume never ended.
• A world matrix that is not finite places its object at a point, the same convention scene::instance_world already uses for hidden instances. Transforms are still kept as set.
• scene::blas_tri makes the hardware acceleration structures' vertices finite. DXR and Vulkan leave a non-finite vertex as undefined behaviour and define a degenerate triangle as never hit, so a triangle with a non-finite vertex becomes three vertices at the origin and keeps its index.

Tests and docs

• Garbage-input tests for the BVH builder and the light tree: NaN, infinite and near-limit values, a thousand copies of one triangle, a needle, garbage in the slot for emitters added in place.
• A depth-cap test: boxes spaced in powers of two make SAH deep; the capped tree stays within the cap and is unchanged where it fits.
• Tests for the input checks, in Rust and TS.
• docs/RUNTIME.md has a new section, "What the kernel trusts", with a table of every structure the kernel walks and what holds it. There is also a ROADMAP record.

Checks

• cargo test --release with the loop guard (GPU tests included): 138 passed.

• render-identity against main, 190 outputs each, guarded runs first:

  run	byte-identical	within run-to-run spread	changed
  native + guard	175	15	0
  merged + guard	171	19	0
  software traversal (THREERT_HWRT=0) + guard	171	19	0
  native, no guard	172	18	0

• tools/web-hello.ts in Chrome: pass.

• Load time: the district's tree builds in 333 ms against main's 321 ms, one load each. An earlier load of the same build took 338 ms, so the difference is within run-to-run variation.

• No shader changed.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes core BVH construction and scene-prep invariants that can affect traversal correctness and performance, though shaders are unchanged and identity checks report no output drift.

Overview
Shifts responsibility for safe GPU traversal from the browser loop guard alone to data the kernel consumes: BVH/light-tree builders enforce walk-ending structure, and inputs are sanitized where they enter the pipeline.

BVH (bvh.rs) trees are capped to the kernel’s 48-entry stack, SAH splits fall back to median splits when depth would exceed the cap, triangles/boxes with non-finite bounds are excluded from leaves (kept in order after leaf ranges), check_tree lives in bvh.rs and runs in tests/debug builds, and builds report bvh_depth in load timings.

Light tree (ltree.rs) adds LightTree::check (topology, leaf ranges, path codes) after build/growth/refit in tests/debug.

Input gates: finite geometry positions (World::set_geometry), finite volume majorant > 0 (Rust + VolumeMesh in TS), non-finite world matrices collapse to a point (like hidden instances), and scene::blas_tri replaces non-finite BLAS vertices with origin degenerates for hardware RT upload paths.

Adds garbage-input / depth-cap tests and documents the contract in docs/RUNTIME.md (“What the kernel trusts”) and docs/ROADMAP.md.

^{Reviewed by Cursor Bugbot for commit b0672ee. Bugbot is set up for automated code reviews on this repo. Configure here.}