[Fix] (DirectGLES, DirectVulkan, MG_State): close stale-cache, A-B-A and state-leak holes across the memo layers

Audit of every memoization implementation; sixteen verified defects fixed:

DirectGLES backend:
- Broadcast draw-buffer memo: cleared at MakeCurrent/DestroyEGLContext like its
  sibling shadows; its identity+version key is only monotonic within one GLContext,
  so a library teardown + re-init could false-hit on a recycled FBO address.
- Backend texture id re-mint (RecreateBackendTexture) now bumps an attachment
  generation that the SyncCurrentFBO gate and every FBO twin compare, so driver
  FBOs re-attach instead of keeping the deleted texture name; the attachment walk
  re-enters until the generation is quiescent (a walk itself can re-mint).
- Buffer id re-mint (persistent-map adoption, immutable-store retire) now bumps a
  generation the VAO twin sync compares, forcing a full re-emit of the baked
  glVertexAttribPointer / element-array bindings that frontend versions cannot see.
- VAO element-array sync memo: bound-object identity joins the wrapping Uint16
  slot version (same pairing the ResolvedDrawBuffers IBO memo already uses).

DirectVulkan backend:
- EBO slice memo gains the mapped-buffer guard its vertex-binding sibling has: a
  shadow-backed persistent map mutates with no epoch bump, so a hit must decline.
- VkClearManager::MergeClearPayload keeps colorEncoding/colorInt/colorUint with
  the color, so deferred glClearBufferiv/uiv no longer degrade to all-zero float.
- GetOrCreateComputePipeline no longer memoizes a failed creation (same contract
  as PipelineFactory): a transient driver failure was permanently disabling every
  dispatch of that program.
- Explicit-LOD-0 verdict memo keys on the sampling-resolution generation; sampler
  filter/aniso/LOD setters bump only that counter, so the old key served a stale
  verdict (wrong SPIR-V variant) after glTexParameter/glSamplerParameter changes.
- SetupDraw fast path declines instead of re-arming on a moved sampling-resolution
  generation (the snapshot bakes the LOD verdict into its pipeline), and
  recomputes the XfbCapture bit so the first draw after glBeginTransformFeedback
  cannot bind the undecorated variant and silently capture nothing.
- VertexInputStateFactory eviction epoch is drawn from a process-wide source: VAO
  state-pointer memos outlive the factory across renderer recreation, and a fresh
  factory restarting at epoch 1 would dereference a dead factory's entry.
- Cached render passes re-read the live renderbuffer clear payload at begin (the
  clear VALUE is not in the pass hash; the entry's inline snapshot replayed the
  creation-time color and dropped the newly queued one).
- FramebufferObject gains a never-reused lifetime id, keyed into the render-pass
  fast-path memo and the SetupDraw snapshot beside the raw pointer + Uint16
  version pair, which address reuse plus fresh version counts could equal.
- SyncTextureResource's preserved-content image goes through the deferred-release
  ring on both failure paths instead of a synchronous destructor under the GPU.

MG_State frontend:
- Layer-1 compile memo is env-disciplined like layers 2/3: a node computed against
  a dead CompileEnv (e.g. pre-capability fallback limits) no longer answers
  glCompileShader forever once the environment's content changes.
- Pipeline composite cache rebuilds from each stage program's last-link shader
  snapshot (new LinkedShaderRef list + pinned link inputs) instead of the live
  attach list and current compile nodes: post-link glAttachShader/glCompileShader
  must not leak into the composite while the (lifetimeId, linkVersion) signature
  still hits - GL's "as last linked" rule.

MobileGL/MG_State/GLState/Core.cpp

@@ -646,9 +646,17 @@ namespace MobileGL::MG_State {
             for (SizeT stage = 0; stage < ProgramPipelineObject::kGraphicsStageCount; ++stage) {
                 const auto& stageProgram = pipeline->GetStageProgram(static_cast<ShaderStage>(stage));
                 if (!stageProgram) continue;
-                for (const auto& shader : stageProgram->GetAttachedShaders()) {
-                    if (!shader || static_cast<SizeT>(shader->GetShaderStage()) != stage) continue;
-                    composite->AttachShader(shader);
+                // The stage program contributes the shaders its LAST LINK consumed, never
+                // its live attach list: per GL 4.6 7.3/7.4 a pipeline stage executes the
+                // stage program as last linked - glAttachShader and glCompileShader take
+                // effect only at the program's next link - and neither of those moves the
+                // link version this cache keys on, so reading live state here would let a
+                // post-link attach or recompile leak into the composite while the signature
+                // still hits. The pinned (source, node) makes the composite's Link()
+                // consume the very inputs that link consumed.
+                for (const auto& ref : stageProgram->GetLinkedShaderSnapshot()) {
+                    if (!ref.shader || static_cast<SizeT>(ref.shader->GetShaderStage()) != stage) continue;
+                    composite->AttachShaderWithPinnedLinkInput(ref);
                     anyStage = true;
                 }
             }

MobileGL/MG_State/GLState/FramebufferState/FramebufferObject.cpp

@@ -9,7 +9,18 @@
 #include "FramebufferObject.h"
 #include "MG_Util/Types.h"
 
+#include <atomic>
+
 namespace MobileGL::MG_State::GLState {
+    // Starts at 1 so a zero-initialized memo slot can never carry a live object's id.
+    // Atomic for the same reason as the VAO counter: it costs nothing, and a duplicate
+    // id would resurrect exactly the ABA this id exists to kill.
+    static std::atomic<Uint64> s_nextFramebufferLifetimeId{1};
+
+    Uint64 FramebufferObject::AllocateLifetimeId() {
+        return s_nextFramebufferLifetimeId.fetch_add(1, std::memory_order_relaxed);
+    }
+
     // FramebufferAttachmentObject
     FramebufferAttachmentObject::FramebufferAttachmentObject(
         const SharedPtr<MG_State::GLState::ITextureObject>& texture, TextureUploadTarget textureUploadTarget, Int level,

MobileGL/MG_State/GLState/FramebufferState/FramebufferObject.h

@@ -148,13 +148,25 @@ namespace MobileGL {
 
             Uint16 GetObjectVersion() const { return m_objectVersion; }
 
+            // Globally-unique, never-reused id for THIS object's lifetime - the same
+            // contract as VertexArrayObject::GetLifetimeId(), and needed for the same
+            // reason: neither the GL name nor the heap address can tell a
+            // deleted-and-recreated framebuffer from the original, and m_objectVersion
+            // starts at 0 for every new object, so a backend memo keyed on
+            // (pointer, version) alone would silently inherit the dead object's entry
+            // (see VkRenderPassManager's per-draw fast-path memo).
+            Uint64 GetLifetimeId() const { return m_lifetimeId; }
+
             Uint GetExternalIndex() const;
             Bool IsDefaultFramebuffer() const { return m_externalIndex == 0; }
 
         private:
+            static Uint64 AllocateLifetimeId();
+
             void BumpAttachmentVersion(FramebufferAttachmentType type);
 
             const Uint m_externalIndex = 0;
+            const Uint64 m_lifetimeId = AllocateLifetimeId();
             FramebufferAttachmentObjectArray m_attachmentObjects;
             FramebufferAttachmentVersionArray m_attachmentVersions;
 

MobileGL/MG_State/GLState/ProgramState/ProgramObject.cpp

@@ -393,6 +393,14 @@ namespace MobileGL::MG_State::GLState {
         return true;
     }
 
+    bool ProgramObject::AttachShaderWithPinnedLinkInput(const LinkedShaderRef& ref) {
+        if (!AttachShader(ref.shader)) {
+            return false;
+        }
+        m_pinnedLinkInputs[ref.shader.get()] = ref;
+        return true;
+    }
+
     SizeT ProgramObject::DetachShader(const SharedPtr<ShaderObject>& shader) {
         MGLOG_D("DetachShader called for shader %p from ProgramObject %u", shader.get(), m_externalIndex);
         if (!ShaderIsAttached(shader)) {
@@ -475,6 +483,8 @@ namespace MobileGL::MG_State::GLState {
             AddDefaultFragmentShaderIfMissing();
         }
         if (m_shaders.empty()) {
+            // This IS the last link now, and it consumed nothing.
+            m_linkedShaderSnapshot.clear();
             m_artifacts.infoLog = "No shader objects are attached to program.";
             MGLOG_E("ProgramObject %u: Link failed - no shader objects attached.", m_externalIndex);
             return;
@@ -505,8 +515,19 @@ namespace MobileGL::MG_State::GLState {
         Vector<SharedPtr<ShaderCompileTask>> deps;
         deps.reserve(m_shaders.size());
         task->in.shaders.reserve(m_shaders.size());
+        m_linkedShaderSnapshot.clear();
+        m_linkedShaderSnapshot.reserve(m_shaders.size());
         for (const auto& shader : m_shaders) {
-            const SharedPtr<ShaderCompileTask>& node = shader->CompiledNodeForLink();
+            // A pipeline composite pins the (source, node) each stage program's LAST link
+            // consumed (AttachShaderWithPinnedLinkInput); an ordinary program takes the
+            // shader's current ones. Without the pin a post-link recompile would leak a
+            // shader the stage program never linked into the composite.
+            SharedPtr<const String> sourcePtr = shader->GetShaderSourcePtr();
+            SharedPtr<ShaderCompileTask> node = shader->CompiledNodeForLink();
+            if (const auto pinned = m_pinnedLinkInputs.find(shader.get()); pinned != m_pinnedLinkInputs.end()) {
+                sourcePtr = pinned->second.source;
+                node = pinned->second.node;
+            }
             if (node) {
                 // This link is now an observer of that node's result, and the ShaderObject is
                 // no longer the only route to it: without the marker, the ordinary
@@ -515,7 +536,10 @@ namespace MobileGL::MG_State::GLState {
                 node->MarkLinkReferenced();
                 if (!node->IsTerminal()) deps.push_back(node);
             }
-            task->in.shaders.push_back({shader->GetShaderStage(), shader->GetShaderSourcePtr(), node});
+            task->in.shaders.push_back({shader->GetShaderStage(), sourcePtr, node});
+            // What "as last linked" will mean for this program from now on - the pipeline
+            // composite cache rebuilds from exactly this set (GetProgramForDraw).
+            m_linkedShaderSnapshot.push_back({shader, sourcePtr, node});
         }
 
         // Phase B of the same link: SPIR-V generation, spirv-opt and the global-UBO routing

MobileGL/MG_State/GLState/ProgramState/ProgramObject.h

@@ -60,6 +60,26 @@ namespace MobileGL::MG_State::GLState {
 
         Vector<SharedPtr<ShaderObject>>& GetAttachedShaders();
         const Vector<SharedPtr<ShaderObject>>& GetAttachedShaders() const;
+
+        // One shader exactly as this program's last Link() consumed it: the object, the
+        // source snapshot, and the compile node taken at that link's enqueue. GL 4.6 7.3/7.4
+        // makes this triple - not the live attach list, not the shader's current compile -
+        // what a program pipeline stage executes ("as last linked"): glAttachShader and
+        // glCompileShader take effect only at the program's next link, yet neither moves
+        // m_linkVersion, so anything keyed on the link generation must consume this
+        // snapshot rather than re-read the live state.
+        struct LinkedShaderRef {
+            SharedPtr<ShaderObject> shader;
+            SharedPtr<const String> source;
+            SharedPtr<ShaderCompileTask> node;
+        };
+        // The last link's full input set; empty when this program has never linked (or its
+        // last link had no shaders attached). GL-thread-owned, rebuilt in Link()'s prologue.
+        const Vector<LinkedShaderRef>& GetLinkedShaderSnapshot() const { return m_linkedShaderSnapshot; }
+        // Pipeline-composite attach: AttachShader plus a pin that makes THIS program's
+        // Link() consume ref's (source, node) instead of the shader's current ones, so a
+        // post-link recompile of the stage program's shader cannot leak into the composite.
+        bool AttachShaderWithPinnedLinkInput(const LinkedShaderRef& ref);
         const String& GetInfoLog() const { return Artifacts().infoLog; }
         // glCreateShaderProgramv folds the shader's compile log into the program's log, which
         // is the only place a caller can read it from once the shader name is gone.
@@ -1223,6 +1243,13 @@ namespace MobileGL::MG_State::GLState {
         // glGetAttachedShaders / GL_ATTACHED_SHADERS / the orphan-shader sweep need no join.
         Vector<SharedPtr<ShaderObject>> m_shaders;
         Vector<SharedPtr<ShaderObject>> m_detachedShaders; // Store detached shaders and remove on next link
+        // See GetLinkedShaderSnapshot. Holding the SharedPtrs here is deliberate: the
+        // "as last linked" set must survive detach-and-delete of its shaders (the
+        // glCreateShaderProgramv shape) until the next link replaces it.
+        Vector<LinkedShaderRef> m_linkedShaderSnapshot;
+        // See AttachShaderWithPinnedLinkInput. Populated only on pipeline composites,
+        // which never detach, so entries need no removal path. GL-thread-owned.
+        UnorderedMap<const ShaderObject*, LinkedShaderRef> m_pinnedLinkInputs;
 
         // Link INPUTS (all "take effect at the next link" per GL): glBindAttribLocation,
         // glBindFragDataLocation(Indexed), glTransformFeedbackVaryings, and the draw-buffer

MobileGL/MG_State/GLState/ProgramState/ShaderObject.cpp

@@ -140,6 +140,13 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void ShaderObject::Compile() {
+        // The compile-environment snapshot is taken HERE, on the GL thread, and handed to
+        // the job. Everything the pipeline needs to know about the device comes through it,
+        // never through pActiveBackendObject - that is what makes the body movable.
+        // Hoisted above the memo check because the memo must be env-disciplined too (below).
+        const SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env =
+            MG_Util::ShaderTranspiler::GetCurrentCompileEnv();
+
         // P0b layer 1, as a tri-state: the memo is "the node in m_compiled was built from
         // the string m_source still points at". SetShaderSource only swaps that pointer when
         // the text actually differs, so this is a pointer compare, and it covers Pending as
@@ -152,7 +159,18 @@ namespace MobileGL::MG_State::GLState {
         // ClaimParsedShader's on-demand re-parse needs - a real recompile would have handed
         // the next link a fresh parse, the no-op hands it a fresh re-parse of the identical
         // source instead. Same result, one parse either way.
-        if (HasMemoizedCompile()) return;
+        //
+        // The environment joins the check (ShaderSourceKey.h's memo-hazard rule: a memo
+        // must never be handed back under an environment other than the one it was
+        // computed against). Layers 2 and 3 key on the fingerprint, but this memo sits
+        // ABOVE both, so without this compare a node computed against a dead environment
+        // - e.g. a compute shader rejected against the pre-capability fallback limits -
+        // would keep answering forever while a fresh object with byte-identical source
+        // compiles fine. The fingerprint is a content hash, so a republish of identical
+        // capabilities still hits.
+        if (HasMemoizedCompile() && m_compiled->env != nullptr && m_compiled->env->fingerprint == env->fingerprint) {
+            return;
+        }
 
         // Two reasons to stay on this thread, one rule. Without the async flag the whole
         // path must be byte-identical to the synchronous implementation, and a cache-less
@@ -168,12 +186,6 @@ namespace MobileGL::MG_State::GLState {
         // glMaxShaderCompilerThreadsKHR(0) and a flag-off build both bypass sharing exactly
         // as they bypass the pool, and their behaviour stays byte-identical to pre-stage-6.
         const Bool runOnPool = m_preprocessCache && MG_Util::Async::AsyncShaderCompileActive();
-
-        // The compile-environment snapshot is taken HERE, on the GL thread, and handed to
-        // the job. Everything the pipeline needs to know about the device comes through it,
-        // never through pActiveBackendObject - that is what makes the body movable.
-        const SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env =
-            MG_Util::ShaderTranspiler::GetCurrentCompileEnv();
         const Uint64 sourceHash = ShaderPreprocessCache::HashSource(*m_source);
 
         // ---- P1 stage 6: adopt an equivalent compile instead of enqueueing a duplicate ----