[scripts, MG_Pipe, MG_Backend, MG_Test] (P7): the census docstring's triage follows what the same wave retired, and the comments stop joining the @P7 census

Two corrections to the two commits before this one. The widening's docstring was written against the 83 sites it found, and the commit that routed five of them through Session::Fail did not revisit the prose. It now describes the 79-site floor the baseline actually records, says which five went and where, and states that the enforceable artefact is the baseline's per-file map rather than the counts in the prose - so a reader who finds the two disagreeing knows which one to believe. The three buckets are restated too: `(ii)` is no longer "owned by a Ph / P7 row", because with the Magma wire arms routed what is left there is the peer-reachable deaths in the applier and the two backends, which is exactly the set ID-P7-1 scopes to Ph's fuzz arm 2 AFTER P7. And the routing commit's own comments spelled the at-sign refusal marker while explaining what routes through them, which put SEVEN comment lines into the retirement census: `grep @P7` went from 15 sites in 4 files to 22 in 6, and that grep is how wave 2 will measure which refusals it has retired. The prose says the word instead, and the count is 15/4 again.
2026-11-07 01:53:24 +09:00 · 2026-09-22 14:01:06 -04:00
parent a5dcbb444f
commit 484a56a5ae
5 changed files with 38 additions and 26 deletions
@@ -68,7 +68,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
    }

    // P7 wave 0, the descriptor half of WireFramebuffer.inc's MagmaWireFatal - same message,
-    // same seam, same reason. Four of the fifteen `@P7` refusals die here.
+    // same seam, same reason. Four of the fifteen P7-marked refusals die here.
    [[noreturn]] static void WireDescriptorFatal(const char* detail) {
        MG_Pipe::MGPipeSessionFail(MG_Pipe::MGPipeFatalFamily::UnmigratedVerb,
                                   "MGPipe: Fatal{UnmigratedVerb, \"Magma:%s\"}", detail);
@@ -2,7 +2,7 @@
 // belong to the applier; no frontend object, lifetime-id lookup or allocator is used.
 #if MOBILEGL_BUILD_DISAGGREGATED
    // P7 wave 0. THE MESSAGE IS UNCHANGED; where it goes is not. This funnel is how eleven of
-    // the fifteen `@P7` refusals die (the other four are WireDescriptorFatal's), and until now
+    // the fifteen P7-marked refusals die (the other four are WireDescriptorFatal's), and until now
    // every one of them raised its own abort: no SessionFault frame for the peer, no
    // SessionFaultCount() for exit gate S8, and nothing tying the hand-typed word to
    // FatalFamilies.def. MGPipeSessionFail hands the line to the hook MG_Remote installs at
@@ -6,13 +6,13 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // End of Source File Header

-// P7 wave 0 (plan section 1.3 row `@P7`, item (0); Ph slice (2)). HOW A BACKEND DEATH REACHES
+// P7 wave 0 (plan section 1.3's P7-marked refusal row, item (0); Ph slice (2)). HOW A BACKEND DEATH REACHES
 // Session::Fail WITHOUT THE BACKEND KNOWING MG_Remote EXISTS.
 //
 // The three Magma wire funnels - MagmaWireFatal (Renderer/WireFramebuffer.inc),
 // WireDescriptorFatal (Renderer/UniformManager.cpp) and WireBufferLegacyFatal
 // (Renderer/WireDraw.inc) - each logged their line and raised their OWN std::abort(). Fifteen
-// `@P7` refusals and two more sites die through them, and every one of those deaths:
+// P7-marked refusals (the grep key is the at-sign form, not spelled here) and two more sites die through them, and every one of those deaths:
 //
 //   * published NO SessionFault frame, so the peer read a bare EOF and could not name what
 //     ended the session (CONTRACT-P6 5.2's whole point);
@@ -35,7 +35,7 @@
 //
 // THE MESSAGE STRING IS PASSED VERBATIM, family word and all - the same rule FatalFunnel.h
 // states. The lines these three funnels write are already counted by name in the retrace refusal
-// census and in every recorded `@P7` measurement, so they are byte-identical before and after.
+// census and in every recorded P7-refusal measurement, so they are byte-identical before and after.

 #pragma once

@@ -113,7 +113,7 @@ TEST(FatalFamily, TheAnchorFamiliesProjectWhereTheirMeaningSays) {
 // ---------------------------------------------------------------------------------------------
 // P7 wave 0: the seam MG_Backend's three Magma wire funnels die through (MG_Pipe/
 // PipeSessionFail.h). Until this package they logged and raised their own std::abort(), so
-// fifteen `@P7` refusals plus WireBufferLegacyFatal published no SessionFault to the peer, bumped
+// fifteen P7-marked refusals plus WireBufferLegacyFatal published no SessionFault to the peer, bumped
 // no SessionFaultCount() and were invisible to the census gate. These three cases are the
 // red-once for that: delete InstallPipeSessionFailHook()'s call in InitServerRoleCommon and the
 // first two go red on the exit code, point a funnel back at MGLOG_F + abort and all three do.
@@ -137,7 +137,7 @@ TEST(FatalFunnelSeam, TheMagmaWireVerbDeathReachesSessionFailAndBumpsTheFaultCou
 #else
    using namespace MobileGL;
    // WireFramebuffer.inc's MagmaWireFatal, character for character - the funnel eleven of the
-    // fifteen `@P7` refusals die through.
+    // fifteen P7-marked refusals die through.
    EXPECT_EXIT(
        {
            std::signal(SIGABRT, &ReportFaultCountAndExit);
@@ -30,26 +30,38 @@ because the Magma wire arms live in Renderer/Wire*.inc and nothing else compiles
 TEST TREES ARE OUT. A death test's deliberate abort is not a production death, and the benchmark
 and integration harnesses drive the library rather than being it.

-THE 83 SITES OF THE WIDENED PERIMETER, TRIAGED. Every one was read; the triage is the argument
-for why the gate can be green with eighty-three deaths in it, and the two tables below are the
-only places an unnamed one is tolerated.
+THE SITES OF THE WIDENED PERIMETER, TRIAGED. The widening found 83; the same package routed
+five of them through Session::Fail and added one funnel of its own, so the floor the baseline
+records is 79 over 20 files. The triage is the argument for why the gate can be green with
+seventy-nine deaths inside it. The ENFORCEABLE artefact is the baseline's per-file map - this
+prose is why that map reads the way it does.

-  (i)   INSIDE A SANCTIONED FUNNEL - 4 sites. The abort is reached only through a function whose
-        CALLERS carry the family word, so the death is named by the caller. FUNNEL_FILES exempts
-        the two whole files that are nothing but funnel; FUNNEL_SITES exempts the individual
-        funnels that live inside a file with ordinary named deaths around them.
-  (ii)  NAMED, AND OWNED BY A Ph / P7 ROW - 20 sites. The Magma wire arms (WireFramebuffer.inc,
-        WireDraw.inc, UniformManager.cpp, VulkanRenderer.cpp) hold the 15 `@P7` refusals due for
-        retirement in P7 wave 2; StagedShadow.h / StagedTextureStore.h and the D11 rows are Ph's.
-        They carry their family word today, which is the whole point of widening the perimeter:
-        the census can now SEE them, and the ratchet below means retiring one is visible.
-  (iii) NAMED, BUT NOT SESSION-SCOPED - the remainder. Startup and role self-checks that predate
-        the split (Init.cpp's ConsumerMaskLie pair, MagmaPipeArms.h's PipeLegacyMemosDisabled,
-        DirectGLES.cpp's UnnamedIdentity, the PipeVerify knob parser) plus the backend-internal
-        resource failures in Managers.cpp / VkBufferManager.cpp. They die before or beside a
-        session rather than inside one, so routing them through SessionFail would publish a
-        SessionFault to a peer that does not exist yet. They are named, which is what this gate
-        asks of them; converting them to latches is Ph's fuzz arm 2, not wave 0's.
+  (i)   INSIDE A SANCTIONED FUNNEL - 5 sites, and the only ones allowed to carry no marker. The
+        abort is reached only through a function whose CALLERS carry the family word, so the
+        death is named by the caller. FUNNEL_FILES exempts the two whole files that are nothing
+        but funnel (WireLog.cpp, FatalFunnel.cpp); FUNNEL_SITES exempts the three that live
+        inside a file with ordinary named deaths around them, one argued line each.
+  (ii)  NAMED, AND PEER-REACHABLE - the bulk. DirectGLES.cpp 15, Managers.cpp 12,
+        VkBufferManager.cpp 11, PipeRoute.cpp 7, ResourceTracker.h 5, PipeInputs.cpp 3,
+        MultiDraw.cpp / SlotAllocator.cpp / BufferObject.cpp / DirectVulkan.cpp 2 each, and the
+        singletons. A record the peer sent can reach these, and most already sit in a function
+        that returns Bool or MobileGLResult - which is exactly why ID-P7-1 scopes their
+        conversion to latch-and-decline as Ph's fuzz arm 2, AFTER P7, rather than as wave 0's.
+        They carry their family word today, which is the point of widening the perimeter: the
+        census can SEE them now, and the ratchet makes retiring one visible.
+  (iii) NAMED, BUT NOT SESSION-SCOPED - Init.cpp's ConsumerMaskLie pair, MagmaPipeArms.h's and
+        Managers.cpp's PipeLegacyMemosDisabled, DirectGLES.cpp:227's UnnamedIdentity,
+        PipeFill.cpp's PipeVerify knob parser. Startup and role self-checks that predate the
+        split: they die BEFORE a session exists, so routing them through SessionFail would
+        publish a SessionFault to a peer that has not connected. They are named, which is what
+        this gate asks of them.
+
+WHAT THE SAME PACKAGE RETIRED, so the numbers above can be checked: StagedShadow.h:115 and
+StagedTextureStore.h:344 now call SessionFail, and the three Magma wire funnels
+(WireFramebuffer.inc, UniformManager.cpp, WireDraw.inc) - through which all fifteen `@P7`
+refusals die - go through MG_Pipe's MGPipeSessionFail seam. Those fifteen are now visible to
+every consumer of the funnel: a SessionFault frame for the peer, a SessionFaultCount() for exit
+gate S8, and a family word that FatalFamilies.def projects.

 THE FOUR RULES, spelled out rather than inferred: