JointHost leaves the public index, Retry-After is capped, and the witness-materials proof passes

[pasquelin]

Why

Split from #457: three small public-surface and loader items gathered there on 2026-09-25/26.

To do

• JointHost leaves the public index (moved from Merges of 24 Sept. agree: WebGPU blend parity, WebGL2 refuses a surface per object #558).
• Retry-After is capped: a documented, tested constant, so a load without an abort signal never waits as long as a server asks (from Every engine fetch goes through the one HTTP loader: retry, abort and named errors #765).
• witness-materials passes: the test:gpu proof no longer fails with "Scene nodes belong to different roots" (from the measurer, 2026-09-25).

Code context

The public index and its API inventory, cluster/pages.ts checked (#765), the witness-materials proof.

Proof

The API inventory without JointHost; a test of a capped Retry-After; witness-materials green in the measurer's test:gpu.

Links

Split from #457.

[pasquelin]

taken by lead sdk

Design note (lead sdk). (1) JointHost leaves the public index and the facade (the inventory regenerated, the reference and translations follow); its internal users import it from its module. (2) checked waits min(Retry-After, RETRY_AFTER_CAP_MS): one named, documented constant beside retriable in cluster/pages.ts (a bound of seconds a streamed page can afford, stated in docs/SDK.md with the retry policy), tested under mock timers with a server asking an hour. (3) witness-materials: the cause read in #683 (the page imports graph.fixture.ts from source while the engine comes from /dist/, so two scene states meet at scene/core/node.ts:177) confirmed or corrected by reading, and fixed where it lives: the proof builds its graph with the engine it draws with, one module instance, no second scene state; a fast test pins that the proof's page imports no engine source beside /dist/. Budget: none. Paths: the loader (all backends), the witness proof (WebGL2 witness). Proof scenes: the witness-materials browser proof (the measurer, on the branch: 🟠 with a browser proof) and the loader tests.

[pasquelin]

Merged #802: Retry-After capped at 10 s (RETRY_AFTER_CAP_MS, justified by the two-attempt model loads; the streamer never waits it); proof pages run one engine, their sources mapped onto dist through the import map by one shared emittedOf rule, a stale dist refused; JointHost pinned out of the index. To measure: witness-materials in test:gpu.