three.js r186 (0.186.0) is vendored as one IIFE (vendor/three-r186.js) with two addons; React Three Fiber is not used (the manifest gives most of the editability without migrating the stack).
Each object runs in <iframe sandbox="allow-scripts"> without allow-same-origin, with a CSP that forbids any network access. Finding: an opaque-origin frame cannot load ES module scripts from the LMS server without CORS headers, which LMSs do not send; the build therefore compiles each object (authored as an ES module, import * as THREE from 'three') into a classic script.
Time, randomness and frames come from the host (host.onFrame, host.random, host.now), so tests replay objects frame by frame and snapshots are stable in headless Chrome (SwiftShader).
Gates 2–6 are automated (elabora object test); gates 7–8 stay human and are listed in the proof dossier.