# D6. Free objects: vanilla three.js r186, vendored, sandboxed, deterministic

- three.js r186 (0.186.0) is vendored as one IIFE (`vendor/three-r186.js`) with two addons; React Three Fiber is not used (the manifest gives most of the editability without migrating the stack).
- Each object runs in `<iframe sandbox="allow-scripts">` without `allow-same-origin`, with a CSP that forbids any network access. **Finding:** an opaque-origin frame cannot load ES module scripts from the LMS server without CORS headers, which LMSs do not send; the build therefore compiles each object (authored as an ES module, `import * as THREE from 'three'`) into a classic script.
- Time, randomness and frames come from the host (`host.onFrame`, `host.random`, `host.now`), so tests replay objects frame by frame and snapshots are stable in headless Chrome (SwiftShader).
- Gates 2–6 are automated (`elabora object test`); gates 7–8 stay human and are listed in the proof dossier.