subagent transcript

I've verified all the load-bearing claims. Let me confirm my findings. The evidence checks out: 1. **Line 179** reads `F.arrays.vertex._count ? F.arrays.vertex._count-1 : count-1` — confirmed. 2. **`_count` is never assigned anywhere.** `grep -n "_count"` returns only line 179 (the read). The vertex spec object is defined at line 65 as `{on,size,type,stride,ptr,vbo}` and populated in `ffPointer` (lines 351-357), which sets only `size,type,stride,ptr,glbuf`. No `_count` property is ever written, so the ternary always evaluates the falsy branch and falls back to `count-1`. 3. **The under-sizing path is real.** When `isElements && vertClient && elemBuf` (indices in a bound ELEMENT_ARRAY_BUFFER, vertices in client memory), `F._maxIndex = count-1`, so `maxV = count` (line 149) and the scratch `Float32Array` is `count*sz` (line 150). For indexed draws, `count` is the number of *indices*, not vertices; the true maximum vertex index can exceed `count-1` (e.g., 3 indices {5,100,200}). The gather then produces only `count` vertices, and `drawElements` at line 193 reads the VBO-resident indices which reference beyond the gathered range → garbage/NaN or missing geometry. 4. The developer explicitly acknowledged this as an assumption in the comment at lines 177-178. Minor imprecision in the write-up: the gather loop itself stays within its own `maxV` bound; the corruption actually happens at the subsequent `drawElements` reading past the under-sized gathered VBO. Net effect is the same (corrupt/missing geometry), so this doesn't change the verdict. Severity: low is appropriate — the triggering combination (VBO indices + client vertices) is a niche mix, and in the common indexed case (vertices reused, indices > vertex count) `count-1` happens to over-size safely. It's a genuine latent bug but rarely hit.