Commit is a departure
Committing a command buffer schedules work; it does not mean the GPU has consumed your uniforms or finished writing an output. Keep the slot’s CPU-writable ranges unchanged until the corresponding work completes. Metal’s normal retained-resource command-buffer behavior can keep referenced resource objects alive, but that is not permission to overwrite their contents or reset an application allocator. Your application still owns the access schedule.
Use addCompletedHandler to observe completion without blocking every frame. Register the handler before committing. The callback should inspect status/errors and publish a small completion record to a synchronized queue or safe shared state. Do not assume it runs on your UI thread, and do not mutate Cocoa views from it. The main/render thread can consume the record and return the slot to the available pool.
Begin with a bounded number of submissions. If all slots are busy, apply backpressure. This keeps latency and memory growth understandable. A completion record should identify the slot and generation or submission token so the receiver can reject stale notifications rather than treating an index as timeless permission.
