[MG_Impl, MG_IntegrationTest, ci] (P7): the read-side control counts to two, one per perturbation block

- the server reads GetPixelStoreParameters twice inside the ReadPixels window - PipeApplier::read_pixels saves the application's pack through the accessor before it installs the neutral one, and the backend's ReadPixels reads the field after - and both reads sit inside ServerReadsInsideTheNeutralPackWindow; the hook's first perturbation is what turns the saved-pack read red (past the first compare the application's pack differs from the neutral oracle on its own), and only the perturbation re-applied after the window's overwrite can turn the post-install read red, because there the stored value is the neutral pack
- so a control that accepted ONE `where=read` line was satisfied by either block alone and falsified neither: the second block, which protects the lane's post-install backend reads, had no falsifier
- CorruptedFieldIsReportedOnTheServerRead now counts the `where=read` reports for the field in the server half since its mark and requires at least two; the CI read-side step does the same with grep -c; both block comments in the hook say which read each turns red
- measured on the host: both entries green, server half DirectGLES 3 / DirectVulkan 2; removing only the second block rebuilds green and turns both entries red with exactly one report per server half (1 / 1, ctest rc 8); the file was restored byte-identical and rebuilt

.github/workflows/test.yml

@@ -1094,6 +1094,14 @@ jobs:
       # private log carries the report. This step re-reads those logs from outside, so the claim
       # does not rest only on the assertion that produced them.
       #
+      # AND IT COUNTS, NEEDING TWO (V1 fix round 2). The server reads the pack field twice inside
+      # the ReadPixels window - PipeApplier::read_pixels saves the application's pack before it
+      # installs the neutral one, the backend's ReadPixels reads it after - and the hook perturbs
+      # its oracle once per read, because the ID-49 overwrite inside the window wipes the first
+      # perturbation before the second read's compare. A step satisfied by ONE line was satisfied
+      # by either perturbation alone and falsified neither; two is one per read, each falsified on
+      # its own. Measured at landing: 3 (DirectGLES) / 2 (DirectVulkan).
+      #
       # THE GREEN HALF is the lane run above: the same hook, the same window, with no corruption
       # armed, across 1070 entries at zero divergences.
       - name: Negative control A (split, read side) - the server's own read must report it
@@ -1110,12 +1118,14 @@ jobs:
           ctest --output-on-failure -L '^integration-verify-split$' -R "${FILTER}" --no-tests=error
           for backend in DirectGLES DirectVulkan; do
             log="MobileGL/MG_IntegrationTest/pipe-verify-split-read-corrupt-${backend}.server.log"
-            if ! grep -q 'Fatal{PipeVerifyDiffer, "GetPixelStoreParameters@ReadPixels".*where=read}' "${log}"; then
-              echo "::error::${log} carries no compare-at-read report for the corrupted pack field: the hook is not comparing on the server's apply thread, or the ID-49 neutral-pack window swallowed the perturbation"
+            reads=$(grep -c 'Fatal{PipeVerifyDiffer, "GetPixelStoreParameters@ReadPixels".*where=read}' "${log}" 2>/dev/null || true)
+            reads=${reads:-0}
+            if [ "${reads}" -lt 2 ]; then
+              echo "::error::${log} carries ${reads} compare-at-read report(s) for the corrupted pack field, fewer than the two reads the server makes inside the ReadPixels window (the applier's saved-pack read and the backend's post-install read): the hook is not comparing on the server's apply thread, or one of its two perturbations no longer reaches its read because the ID-49 neutral-pack overwrite swallowed it"
               exit 1
             fi
           done
-          echo "both backends reported GetPixelStoreParameters@ReadPixels where=read in the SERVER half, as they must"
+          echo "both backends reported GetPixelStoreParameters@ReadPixels where=read at least twice in the SERVER half, as they must"
 
       # NEGATIVE CONTROL B ON THE SPLIT ARM, WITH THE SPLIT ARM'S PAIR. The monolith pair
       # (GenerateMipmap:GetActiveTextureUnit) is inert here - the split backend's generate_mipmap