[Docs] (Pipe): record why the forwarders carry no poison check, the InHook re-entry guard, and the Index slot no FillPoints.def row can fill

- The seven F-class forwarders are the declared exception to D4's "every accessor body": a forward is a live call, not a stored value, and InvalidateCompileEnv is reached from backend initialisation before any verb has filled, where a check would be Fatal{...@<none>} on every start. Their sticky stamp is consulted by no accessor; the tests pin it through MGPipeInputFieldIsFresh directly. Written down so P2's tracker does not "fix" the missing check.
- MGPipeVerifyReadHook: InHook is what keeps a GetProgramForDraw-triggered backend re-entry from recursing into a second hook, and the whole-field re-read is a per-read cost to keep in mind when reading the verify lane's wall time.
- GetBufferBindingSlot(Index) is polymorphic on GLContext (the bound VAO's element-buffer slot) and null in the block by design: a push Fatal there is not a missing row. No backend reads it today.

MobileGL/MG_Backend/MGPipe/PipeInputs.h

@@ -560,6 +560,12 @@ namespace MobileGL::MG_Pipe {
         // i.e. it is a lookup or a reverse-channel write, not a state read; there is no value
         // the filler could copy and no verb whose fill could make it stale. Phase C replaces
         // them with handle tables and callbacks.
+        // They carry no MGP_INPUT_CHECK / MGP_INPUT_VERIFY_READ (the declared exception to
+        // P1 brief D4's "every accessor body"): a forward is a live call, not a stored value,
+        // and InvalidateCompileEnv is reached from backend initialisation before any verb has
+        // filled, where a check would be Fatal{...@<none>} on every start. Their sticky stamp
+        // is therefore consulted by no accessor; the tests pin it through
+        // MGPipeInputFieldIsFresh directly.
         SizeT GetBufferBindingPointCount(BufferTarget target) const;
         const SharedPtr<ProgramObject>& GetProgramObject(Uint index);
         const SharedPtr<ITextureObject>& GetTextureObject(Uint index);

MobileGL/MG_Impl/Pipe/PipeFill.cpp

@@ -61,8 +61,11 @@ namespace MobileGL::MG_Pipe {
                 dst.m_boundVertexArray = ctx.GetBoundVertexArray();
                 break;
             case F::GetBufferBindingSlot:
-                // Every global target has a slot; the others (Index) stay null and a read
-                // of one is the poison Fatal in the accessor.
+                // Every global target has a slot; Index stays null - GLContext resolves it
+                // through the bound VAO's element-buffer slot (Core.cpp), a derivation no
+                // FillPoints.def row can copy - and a read of it is the poison Fatal in the
+                // accessor. No backend reads it today (every slot read is DrawIndirect,
+                // DispatchIndirect, Parameter or PixelPack).
                 for (const auto target : GlobalBufferTargets) {
                     dst.m_bufferBindingSlot[static_cast<SizeT>(target)] = &ctx.GetBufferBindingSlot(target);
                 }
@@ -440,7 +443,14 @@ namespace MobileGL::MG_Pipe {
         if (ctx == nullptr) return;
         // The whole field is re-read and compared - a superset of "the same indices", so a
         // divergence in an index the backend did not ask for is still a divergence between
-        // the boundary value and the live value. The indices only decorate the report.
+        // the boundary value and the live value. The indices only decorate the report. The
+        // cost is per backend read (GetRenderStateParameters re-copies and compares the whole
+        // struct; GetProgramForDraw re-joins the pending link), inside the verify budget and
+        // to be kept in mind when reading the verify lane's wall time.
+        // InHook: the re-read calls the same GLContext accessor the filler calls, and
+        // GetProgramForDraw's join can re-enter a backend and with it another gPipeInputs
+        // accessor; that inner read is a plain load rather than a second hook, so the hook
+        // never recurses (and never reports the inner read against a half-copied scratch).
         g_verify.InHook = true;
         MGPipeFillAccess::CopyField(g_readScratch, *ctx, field);
         const Bool equal = MGPipeInputsFieldEqual(field, self, g_readScratch);