# Render studio UI implementation batch - 2026-10-22

Owner-directed continuation of #1/#2 and draft PR #7 from `ecffc20fd9bc08d250c7a1822f819f06b9103990`. No upstream refresh, source-model mutation or release. Repository text is English; localization retains its own language. The owner requested coordinated implementation before expensive compilation.

## Acceptance target for this batch

Deliver the native Render workspace's end-to-end user interface for the capabilities actually implemented: model/library navigation, context-owned resource browser and inspector, scene composition, appearances, lighting, environments, camera, output, preflight, progress/cancellation and exact completed-result export. Use the existing shell, tokens, shared controls and single RENDER ribbon tab. Keep all authored catalogs inspectable, with executable projections, unbound concepts and blocked advanced capabilities identified separately.

1. Replace the long undifferentiated inspector with local Scene, Appearance, Lighting, Environment, Camera, Output and Diagnostics sections. Keep an explicit All controls view for dense expert inspection and existing interaction regressions. Never add a global expertise or render-mode system.
2. Extend the existing Browser card with a local Model/Library selector, preserving both shell layouts, selection and model visibility. Preserve per-category query/page/selection; provide bounded favorites/recent collections, availability filters and source/omission details. Original source-map previews must be labelled as source maps, not measured or path-traced material thumbnails.
3. Add reviewed native studio compositions through shared read-only resolve / atomic apply commands. Their identities are separate from unbound SCENE-* specifications. Explicit lighting/stage replacement, revision checks and conservative product clearance are mandatory. Preserve camera, appearances, engineering assignments and geometry.
4. Make fixed-sample PNG projections of compatible quality specifications explicitly opt-in. Do not turn adaptive stopping, independent transmission-depth limits, raw buffers or EXR into implemented promises. Applying a sampling budget must preserve lighting, optical bindings and camera.
5. Complete accessible numeric camera, environment, stage and output controls; pin Check/Render/Cancel/Export outside scrolling bodies. Check and Start must use the same request. Retain completed images and exact export identities across later edits and failures.
6. Add bounded shot duplication/rename/removal through the engine, with conflict rejection and one undo. Switching away from a dirty draft requires Save/Discard/Keep editing; library inspection never commits a preset.
7. Consolidate type/lint checks, focused engine/UI tests and one native application build after the coordinated changes. Inspect actual application screenshots in both themes and both layouts with a small public-safe fixture. Do not claim interaction or visual acceptance from source-only checks.

## Explicit boundaries

This UI batch does not claim adaptive sampling, a new transmission estimator, EXR/linear masters, unrestricted nested media, volumes, displacement, spectral transport, dynamics, a render queue or completed whole-project CI. Missing capabilities remain visible and cannot emit unsupported parameters. The reviewed 4K SELENE export and its renderer/model hashes remain unchanged. No new icon artwork, external assets or dependencies are required.

## Execution ledger

Initial state: clean local/remote integration branch; published physical resources at `32eda023`, SELENE master at `cf8e6510`. Local `plan/` files are absent, so committed issue objectives, UX.md, UI_INTEGRATION.md and the actual source define this batch. Implementation and validation results are recorded below as they happen; this initial plan is not completion evidence.


## Grouped source checkpoint

The coordinated source batch now contains the contextual inspector and existing Browser-card integration; bounded category navigation/favorites/recent inspection; original source-map previews; complete native composition resolve/apply; saved-shot lifecycle/dirty-draft consent; exact opaque appearance editing; CPU point/spot/rectangular lights; GPU sky/lighting/camera/output controls; explicit fixed-sample quality projections; and captured preflight/job diagnostics. The source catalog lookup still verifies 216 original assets without changing source bytes or readiness flags. New English/Spanish UI text uses the existing English fallback for other locales rather than unreviewed translations.

Focused regression sources cover seven inspector journeys, five engine contract groups and two browser-state groups; existing dense-control interactions explicitly select the public All controls page. No GPU/application binary has been linked for this batch yet. Initial grouped type/lint checks identified a JSON macro-expression syntax issue, the existing f32 sky contract and two strict lint findings; all are corrected in source without suppressing diagnostics. Native execution and visual acceptance remain pending.


## First consolidated execution and grouped corrections

On `cca1175f`, strict whole-workspace/all-target Clippy passed. One grouped engine/UI test-artifact build completed, then the engine render suite ran 66 tests (64 passed, 2 failed) and the UI suite ran 67 (65 passed, 2 failed). All seven new contextual-inspector journeys and both new library-state tests passed, including native scene application through real UI controls and fixed job actions across both themes/layouts.

The failures identified one stale physical-reference fixture (SURF-013 gained references in the published 59-profile package), one incorrect test expectation for animation-only Q-009, and two legacy UI assumptions after moving the camera into its context page. The source now tests a genuinely unbound MAT-009 without manufacturing missing properties, refuses Q-008/Q-009 as animated profiles, restores camera actions to All controls, and exercises the new visible Camera navigation in the existing save/restore test. No renderer boundary or numerical assertion is weakened.

Grouped refinements also retain readable names in bounded favorites/recent collections, separate collection search from per-category queries, expose native GPU preparation/refusal in context, and expand the existing Browser when explicitly opening a category. A fail-closed `SOLIDCRAFT_SETTINGS_DIR` desktop profile override permits actual hardware GUI review without adopting or modifying personal settings; normal startup remains unchanged. The post-correction execution and native visual review are still pending.


## Nathan shared-kit integration and native review findings

The owner's explicit request is to reuse Nathan's existing components, not introduce a competing Render design system. The implemented foundation is Nathan-Dane's merged #3627 stack (`8e77d9fd`): token-owned shell/cards, form rows, segmented controls, shared menu/search rows, confirmation dialogs, multi-tone SVGs and light/dark roles. Current upstream #4533/#3822/#4608 were inspected for scope, but are not silently merged into the frozen personal branch. The open corner-radius work is not treated as released behavior.

A fresh native hardware application at `3e3ef3d4` compiled and was launched under an isolated settings profile. Five actual application captures exercised light/dark and docked/floating Render pages with a public-safe three-body command-created fixture. Review identified clipped scope notices and inefficient stacked output fields. The grouped refinement reuses the kit's wrapping Note/Error text and aligned numeric rows, and the existing two-line MenuItem search rows for visible resource identity/availability. Favorites/recent inspection retain the source availability state rather than turning specifications into executable resources. Physical-reference navigation now follows the same bounded category history.

Editor-only output aspect lock uses a fixed rational anchor, checked integer arithmetic and atomic refusal when a coupled axis exceeds the selected method's hard bound. Explicit presets, orientation swaps and loaded shot dimensions reanchor the ratio; no mode, sample budget, light, camera or saved document changes merely by enabling the lock. The temporary-map adapter now forwards the reviewed physical scale and mapping plane, matching the persistent-map path instead of silently falling back to XY/unit scale.

Seven additional regression groups cover rational rounding/refusal, explicit reanchoring, actual lock/orientation controls, readable notes, bounded availability history, physical-reference navigation and exact temporary map projection/optical exclusivity. These are source checkpoints until grouped native tests and final GUI inspection complete. No adaptive estimator, EXR exporter, source-map BRDF thumbnail or full-project CI success is implied.


## Full-master acceptance repair batch

The existing contextual UI at `592e0ddd` had already passed grouped engine/UI/shared-kit and WASM checks. Its actual protected-profile Windows review exposed two additional acceptance blockers: the live product preview rejected the unchanged full SELENE scene at the old 128 MiB expanded-vertex cap, and a normal requested application shutdown overflowed the main-thread stack. The retained crash event is `EXCEPTION_STACK_OVERFLOW`; matching native symbol inspection locates the fault in geometry destruction. Those observations are not counted as a successful whole-master UI review.

This owner-directed continuation preserves Nathan-Dane/Nateaux's shared `ui_kit` panel/card/form/menu/icon/token resources. It does not import another upstream UI snapshot, invent new icon art or change transport sampling. The Environment page now uses the existing `environment_map` master. The eight contextual pages and established native resource/shot workflows remain the interface authority.

The coordinated repair implements an exact expanded-vertex admission plan, one fallible reservation per output buffer, a native 64-bit 512 MiB vertex-payload ceiling (128 MiB on restricted targets), and the existing actual-device upload chunking. Captured source triangles, appearances and visibility are not simplified. Rejected captures are cached until their identity changes or the user explicitly retries; the shared kit supplies a wrapped, theme-owned failure card readable even over an opposite-color scene background. Diagnostics reports vertex payload separately from total device/process memory.

Naming origins retain older model states, whose bodies retain older origins; default recursive Arc destruction is not bounded by the naming-computation depth limit. The document-layer repair iteratively releases uniquely owned naming ancestors and placed-copy chains while preserving shared snapshots. It does not change kernel geometry or naming semantics. Regression sources include 20,000-level small-stack ancestry/copy destruction, concurrent final owners, exact preview accounting, original source identity, hostile counts and repeated-refusal behavior.

Whole-workspace/all-target Clippy with `-D warnings` passes for the grouped source. Native unit execution, fresh-application full-master preview and normal shutdown acceptance are pending at this recovery checkpoint. The source is saved as WIP rather than claiming full CI or final native acceptance.


## Follow-on acceptance closure

The full-master application check is now completed on the exact `f8e0b07b` code checkpoint: the rebuilt native app displays the unchanged full visible SELENE in light/docked and dark/floating layouts and exits normally with code 0, without process termination or preference changes. The full document suite completed 301 passes / 0 failures / 1 explicit ignore. Exact binary/source hashes and the separate new finishing/background/linear-output work are recorded in [FINISHING-BATCH-2026-10-22.md](FINISHING-BATCH-2026-10-22.md). This closes the earlier unresolved preview/shutdown item; it does not make the subsequent new features accepted before their own execution gates.