diff --git a/MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp b/MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp index dfc754d5..a5acb240 100644 --- a/MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp +++ b/MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp @@ -68,7 +68,7 @@ namespace MobileGL::MG_Backend::DirectVulkan { } // P7 wave 0, the descriptor half of WireFramebuffer.inc's MagmaWireFatal - same message, - // same seam, same reason. Four of the fifteen `@P7` refusals die here. + // same seam, same reason. Four of the fifteen P7-marked refusals die here. [[noreturn]] static void WireDescriptorFatal(const char* detail) { MG_Pipe::MGPipeSessionFail(MG_Pipe::MGPipeFatalFamily::UnmigratedVerb, "MGPipe: Fatal{UnmigratedVerb, \"Magma:%s\"}", detail); diff --git a/MobileGL/MG_Backend/DirectVulkan/Renderer/WireFramebuffer.inc b/MobileGL/MG_Backend/DirectVulkan/Renderer/WireFramebuffer.inc index fe444d96..bd3519e3 100644 --- a/MobileGL/MG_Backend/DirectVulkan/Renderer/WireFramebuffer.inc +++ b/MobileGL/MG_Backend/DirectVulkan/Renderer/WireFramebuffer.inc @@ -2,7 +2,7 @@ // belong to the applier; no frontend object, lifetime-id lookup or allocator is used. #if MOBILEGL_BUILD_DISAGGREGATED // P7 wave 0. THE MESSAGE IS UNCHANGED; where it goes is not. This funnel is how eleven of - // the fifteen `@P7` refusals die (the other four are WireDescriptorFatal's), and until now + // the fifteen P7-marked refusals die (the other four are WireDescriptorFatal's), and until now // every one of them raised its own abort: no SessionFault frame for the peer, no // SessionFaultCount() for exit gate S8, and nothing tying the hand-typed word to // FatalFamilies.def. MGPipeSessionFail hands the line to the hook MG_Remote installs at diff --git a/MobileGL/MG_Pipe/PipeSessionFail.h b/MobileGL/MG_Pipe/PipeSessionFail.h index 446092fd..a50beab6 100644 --- a/MobileGL/MG_Pipe/PipeSessionFail.h +++ b/MobileGL/MG_Pipe/PipeSessionFail.h @@ -6,13 +6,13 @@ // SPDX-License-Identifier: LGPL-3.0-only // End of Source File Header -// P7 wave 0 (plan section 1.3 row `@P7`, item (0); Ph slice (2)). HOW A BACKEND DEATH REACHES +// P7 wave 0 (plan section 1.3's P7-marked refusal row, item (0); Ph slice (2)). HOW A BACKEND DEATH REACHES // Session::Fail WITHOUT THE BACKEND KNOWING MG_Remote EXISTS. // // The three Magma wire funnels - MagmaWireFatal (Renderer/WireFramebuffer.inc), // WireDescriptorFatal (Renderer/UniformManager.cpp) and WireBufferLegacyFatal // (Renderer/WireDraw.inc) - each logged their line and raised their OWN std::abort(). Fifteen -// `@P7` refusals and two more sites die through them, and every one of those deaths: +// P7-marked refusals (the grep key is the at-sign form, not spelled here) and two more sites die through them, and every one of those deaths: // // * published NO SessionFault frame, so the peer read a bare EOF and could not name what // ended the session (CONTRACT-P6 5.2's whole point); @@ -35,7 +35,7 @@ // // THE MESSAGE STRING IS PASSED VERBATIM, family word and all - the same rule FatalFunnel.h // states. The lines these three funnels write are already counted by name in the retrace refusal -// census and in every recorded `@P7` measurement, so they are byte-identical before and after. +// census and in every recorded P7-refusal measurement, so they are byte-identical before and after. #pragma once diff --git a/MobileGL/MG_Test/Wire/FatalFamilyTest.cpp b/MobileGL/MG_Test/Wire/FatalFamilyTest.cpp index da55628e..482187a3 100644 --- a/MobileGL/MG_Test/Wire/FatalFamilyTest.cpp +++ b/MobileGL/MG_Test/Wire/FatalFamilyTest.cpp @@ -113,7 +113,7 @@ TEST(FatalFamily, TheAnchorFamiliesProjectWhereTheirMeaningSays) { // --------------------------------------------------------------------------------------------- // P7 wave 0: the seam MG_Backend's three Magma wire funnels die through (MG_Pipe/ // PipeSessionFail.h). Until this package they logged and raised their own std::abort(), so -// fifteen `@P7` refusals plus WireBufferLegacyFatal published no SessionFault to the peer, bumped +// fifteen P7-marked refusals plus WireBufferLegacyFatal published no SessionFault to the peer, bumped // no SessionFaultCount() and were invisible to the census gate. These three cases are the // red-once for that: delete InstallPipeSessionFailHook()'s call in InitServerRoleCommon and the // first two go red on the exit code, point a funnel back at MGLOG_F + abort and all three do. @@ -137,7 +137,7 @@ TEST(FatalFunnelSeam, TheMagmaWireVerbDeathReachesSessionFailAndBumpsTheFaultCou #else using namespace MobileGL; // WireFramebuffer.inc's MagmaWireFatal, character for character - the funnel eleven of the - // fifteen `@P7` refusals die through. + // fifteen P7-marked refusals die through. EXPECT_EXIT( { std::signal(SIGABRT, &ReportFaultCountAndExit); diff --git a/scripts/ci/fatal_census.py b/scripts/ci/fatal_census.py index 6c163685..29507bb0 100644 --- a/scripts/ci/fatal_census.py +++ b/scripts/ci/fatal_census.py @@ -30,26 +30,38 @@ because the Magma wire arms live in Renderer/Wire*.inc and nothing else compiles TEST TREES ARE OUT. A death test's deliberate abort is not a production death, and the benchmark and integration harnesses drive the library rather than being it. -THE 83 SITES OF THE WIDENED PERIMETER, TRIAGED. Every one was read; the triage is the argument -for why the gate can be green with eighty-three deaths in it, and the two tables below are the -only places an unnamed one is tolerated. +THE SITES OF THE WIDENED PERIMETER, TRIAGED. The widening found 83; the same package routed +five of them through Session::Fail and added one funnel of its own, so the floor the baseline +records is 79 over 20 files. The triage is the argument for why the gate can be green with +seventy-nine deaths inside it. The ENFORCEABLE artefact is the baseline's per-file map - this +prose is why that map reads the way it does. - (i) INSIDE A SANCTIONED FUNNEL - 4 sites. The abort is reached only through a function whose - CALLERS carry the family word, so the death is named by the caller. FUNNEL_FILES exempts - the two whole files that are nothing but funnel; FUNNEL_SITES exempts the individual - funnels that live inside a file with ordinary named deaths around them. - (ii) NAMED, AND OWNED BY A Ph / P7 ROW - 20 sites. The Magma wire arms (WireFramebuffer.inc, - WireDraw.inc, UniformManager.cpp, VulkanRenderer.cpp) hold the 15 `@P7` refusals due for - retirement in P7 wave 2; StagedShadow.h / StagedTextureStore.h and the D11 rows are Ph's. - They carry their family word today, which is the whole point of widening the perimeter: - the census can now SEE them, and the ratchet below means retiring one is visible. - (iii) NAMED, BUT NOT SESSION-SCOPED - the remainder. Startup and role self-checks that predate - the split (Init.cpp's ConsumerMaskLie pair, MagmaPipeArms.h's PipeLegacyMemosDisabled, - DirectGLES.cpp's UnnamedIdentity, the PipeVerify knob parser) plus the backend-internal - resource failures in Managers.cpp / VkBufferManager.cpp. They die before or beside a - session rather than inside one, so routing them through SessionFail would publish a - SessionFault to a peer that does not exist yet. They are named, which is what this gate - asks of them; converting them to latches is Ph's fuzz arm 2, not wave 0's. + (i) INSIDE A SANCTIONED FUNNEL - 5 sites, and the only ones allowed to carry no marker. The + abort is reached only through a function whose CALLERS carry the family word, so the + death is named by the caller. FUNNEL_FILES exempts the two whole files that are nothing + but funnel (WireLog.cpp, FatalFunnel.cpp); FUNNEL_SITES exempts the three that live + inside a file with ordinary named deaths around them, one argued line each. + (ii) NAMED, AND PEER-REACHABLE - the bulk. DirectGLES.cpp 15, Managers.cpp 12, + VkBufferManager.cpp 11, PipeRoute.cpp 7, ResourceTracker.h 5, PipeInputs.cpp 3, + MultiDraw.cpp / SlotAllocator.cpp / BufferObject.cpp / DirectVulkan.cpp 2 each, and the + singletons. A record the peer sent can reach these, and most already sit in a function + that returns Bool or MobileGLResult - which is exactly why ID-P7-1 scopes their + conversion to latch-and-decline as Ph's fuzz arm 2, AFTER P7, rather than as wave 0's. + They carry their family word today, which is the point of widening the perimeter: the + census can SEE them now, and the ratchet makes retiring one visible. + (iii) NAMED, BUT NOT SESSION-SCOPED - Init.cpp's ConsumerMaskLie pair, MagmaPipeArms.h's and + Managers.cpp's PipeLegacyMemosDisabled, DirectGLES.cpp:227's UnnamedIdentity, + PipeFill.cpp's PipeVerify knob parser. Startup and role self-checks that predate the + split: they die BEFORE a session exists, so routing them through SessionFail would + publish a SessionFault to a peer that has not connected. They are named, which is what + this gate asks of them. + +WHAT THE SAME PACKAGE RETIRED, so the numbers above can be checked: StagedShadow.h:115 and +StagedTextureStore.h:344 now call SessionFail, and the three Magma wire funnels +(WireFramebuffer.inc, UniformManager.cpp, WireDraw.inc) - through which all fifteen `@P7` +refusals die - go through MG_Pipe's MGPipeSessionFail seam. Those fifteen are now visible to +every consumer of the funnel: a SessionFault frame for the peer, a SessionFaultCount() for exit +gate S8, and a family word that FatalFamilies.def projects. THE FOUR RULES, spelled out rather than inferred: