Function decodeSceneDocument

Parses and validates JSON text as a §79 scene document, treating the text as untrusted (§96).

§96 requires that "scene deserializers shall treat external content as untrusted", with input-size limits among its named requirements. This is that enforcement point for the §79 format, and it is the only one on this path: the text length is checked before JSON.parse runs, and the nesting depth before validateSceneDocument — whose validateNode recurses once per children generation — ever sees the value. A caller that parses the text itself and hands the result to validateSceneDocument has opted out of both, deliberately; that entry point stays unguarded because by then the value is already a live object the caller built or vouched for.

Both bounds default to finite, generous values (DEFAULT_MAXIMUM_TEXT_LENGTH, DEFAULT_MAXIMUM_DEPTH), so a document this engine has ever written decodes exactly as it did before the guard existed. Raising one is an explicit, per-call decision.