[Feat] (MG_State, MG_Util): async program linking on the job graph (P1 stage 4)

glLinkProgram with the flag on snapshots its inputs in a GL-thread prologue
(stage-sorted shaders with their compile nodes taken without joining, env,
explicit locations/fragdata/xfb, draw-buffer count), then runs the whole
link body - glslang link/mapIO, SPIR-V, reflection, routing tables - as a
ProgramLinkTask that auto-posts when its last compile dependency settles
(+1-guarded countdown; no worker ever waits on another job). The publish is
one move of the LinkArtifacts block at the join, with the second version
bump so nothing memoized during the pending window survives.

The consume-once TShader claim moved onto the shared compile node as a CAS:
two link jobs racing for one shader resolve to winner-takes-the-parse,
loser re-parses the preprocessed source against the node's own env -
identical SPIR-V pinned by test for 2 and for 12 sharing programs.

Two deliberate corrections to the design's cancel matrix, both test-proven:
attach/detach do NOT cancel a pending link (the snapshot isolates it, and
glCreateShaderProgramv's link-then-detach would otherwise discard its own
result before anyone read it); and a compile node a pending link depends on
is pinned against the orphan-name sweep - the ordinary LWJGL teardown
compile/attach/link/detach/delete used to cancel the dependency and turn a
must-pass link into GL_FALSE.

Continuations are now throw-contained per-item (a stage-3 leftover made
load-bearing by the first real continuation), and the review's deadlock
find is fixed: the dispatch loop no longer cancels a node while holding the
pool mutex, since that cancel can run OnDepSettled -> Post -> same mutex.

Explicit joins: the draw path (GetProgramForDraw, both the pipeline stage
loop and the plain-UseProgram half) and the composite-link site; destroy
paths cancel-not-join; COMPLETION_STATUS readers stay non-joining.

Gates: 506/506 unit both flag states; AsyncCompile/AsyncLink/AsyncTeardown
suites x10 repeats clean both states (teardown with 128 jobs in flight,
then re-Initialize); full NVIDIA DirectGLES retrace flag on twice - result
sets identical to flag off, zero new deltas. Compile-phase prefix-diff,
flag on vs off: complementary-reimagined 5.21s -> 2.16s, BSL 1.72s ->
0.90s - past the design's final acceptance targets before the KHR
extension is even advertised. Default remains OFF until stage 5+7.

MobileGL/MG_State/GLState/Core.cpp

@@ -368,11 +368,35 @@ namespace MobileGL::MG_State {
         const SharedPtr<ProgramObject>& GLContext::GetProgramForDraw() {
             static const SharedPtr<ProgramObject> nullProgram = nullptr;
             const auto& currentProgram = m_programState.GetCurrentProgram();
-            if (currentProgram) return currentProgram;
+            if (currentProgram) {
+                // P1 join site J1, plain glUseProgram half. The backends read a program's
+                // lifetimeId / backendStateVersion / UBO content version to decide whether
+                // their per-program caches are still valid, and none of those pass through
+                // ProgramObject's join gate - so a draw could sample a version, join later
+                // inside the same draw when it finally touched an artifact, and cache under a
+                // version the publish had already superseded. Settling here means every
+                // version a backend reads during a draw describes the program it is drawing.
+                // One null check in steady state.
+                currentProgram->JoinLink();
+                return currentProgram;
+            }
             if (m_boundProgramPipeline == 0) return nullProgram;
             const auto& pipeline = GetBoundProgramPipeline();
             if (!pipeline) return nullProgram;
 
+            // P1 join site J1. ComputeDrawProgramSignature() keys the composite cache on each
+            // stage program's lifetimeId and backendStateVersion - NON-artifact fields, so
+            // they do not pass through ProgramObject's join gate and a pending link would
+            // stay pending right through the signature. Since the version is bumped both at
+            // enqueue and at publish, the signature computed inside a pending window is one
+            // that will never be produced again: every draw would miss the cache and rebuild
+            // (and relink) the composite. Join first, so the signature describes settled
+            // programs. In steady state this is a null check per stage.
+            for (SizeT stage = 0; stage < static_cast<SizeT>(ShaderStage::ShaderStageCount); ++stage) {
+                const auto& stageProgram = pipeline->GetStageProgram(static_cast<ShaderStage>(stage));
+                if (stageProgram) stageProgram->JoinLink();
+            }
+
             const auto signature = pipeline->ComputeDrawProgramSignature();
             if (const auto& cached = pipeline->GetCachedDrawProgram(signature)) return cached;
 
@@ -400,6 +424,10 @@ namespace MobileGL::MG_State {
             // A pipeline with no fragment stage still rasterises, so the default fragment
             // shader is wanted here even though the separable stage programs never get one.
             composite->Link(true);
+            // P1 join site J2. The draw that asked for this program is the very next thing to
+            // happen, so enqueueing the composite's link buys nothing and only moves the wait
+            // to whichever backend accessor happens to touch its artifacts first.
+            composite->JoinLink();
             pipeline->SetCachedDrawProgram(signature, Move(composite));
             return pipeline->GetCachedDrawProgram(signature);
         }

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.h

@@ -0,0 +1,111 @@
+// MobileGL - MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+#include <MG_State/GLState/ProgramState/ProgramObject.h>
+#include <MG_State/GLState/ProgramState/ShaderCompileTask.h>
+#include <MG_Util/Async/JobNode.h>
+#include <MG_Util/ShaderTranspiler/CompileEnv.h>
+
+namespace MobileGL::MG_State::GLState {
+    // One attached shader, as the link sees it: never the ShaderObject, always a snapshot.
+    //
+    // The ShaderObject is GL-thread-owned and may be re-sourced, detached or destroyed while
+    // this link is still queued; everything below is either immutable or independently owned,
+    // so none of that can reach the worker.
+    struct LinkShaderInput {
+        ShaderStage stage = ShaderStage::Unknown;
+        // For the compile-error diagnostic and the compute local_size check, both of which
+        // quote the ORIGINAL source rather than the preprocessed one.
+        SharedPtr<const String> source;
+        // The authoritative compiled state. Null, or non-Complete, both read as "this shader
+        // did not compile" - the same verdict ShaderObject's join gate produces.
+        SharedPtr<const ShaderCompileTask> compiled;
+    };
+
+    // The unit of asynchronous linking: one glLinkProgram's worth of pure CPU work - glslang
+    // link + mapIO, SPIR-V generation and optimization, the GL-facing reflection surface, the
+    // global-UBO routing tables, fragment-output validation and transform-feedback
+    // resolution - with every input it needs snapshotted at enqueue.
+    //
+    // Same ownership rule as ShaderCompileTask: the body reads nothing but `in` (all of it
+    // owned or immutable) and writes nothing but `artifacts`. No GL call, no
+    // pActiveBackendObject read, no pGLContext->RecordError(); the device limits arrive
+    // through the CompileEnv snapshot and diagnostics are deferred to the join.
+    //
+    // ONE LINK IS ONE HANDLER. RunBody() runs start to finish inside a single pool handler
+    // and is the only place `artifacts` is written. Do not split it across handlers to
+    // "pipeline" the reflection half: the intermediates that GlslangToSpv and buildReflection
+    // share are mutated in a strict order (see the GenerateSpirv-before-DoReflection comment
+    // in Run()), and a second handler would let a cancel land between them and publish a
+    // program whose SPIR-V and reflection describe different things.
+    class ProgramLinkTask final : public MG_Util::Async::JobNode {
+    public:
+        // ---- inputs, snapshotted on the GL thread in ProgramObject::Link()'s prologue ----
+        struct Inputs {
+            Uint externalIndex = 0; // logs only
+            Vector<LinkShaderInput> shaders; // already stage-sorted
+            SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env;
+            // The four "takes effect at the next link" request maps. Snapshotted rather than
+            // referenced, which is precisely what makes glBindAttribLocation and friends
+            // legal to call over a pending link without cancelling it: the pending link keeps
+            // linking the inputs it was given.
+            UnorderedMap<String, Uint> explicitAttribLocations; // glBindAttribLocation
+            UnorderedMap<String, Uint> explicitFragDataLocation; // glBindFragDataLocation
+            UnorderedMap<String, Uint> explicitFragDataIndex; // glBindFragDataLocationIndexed
+            Vector<String> requestedXfbVaryings; // glTransformFeedbackVaryings
+            GLenum requestedXfbBufferMode = GL_INTERLEAVED_ATTRIBS;
+            Int maxFragmentOutputColorNumber = 8; // GL_MAX_DRAW_BUFFERS, stamped in by the entry point
+        } in;
+
+        // ---- output: valid iff IsComplete(), immutable afterwards ----
+        // Moved (never copied) into the ProgramObject by EnsureLinkJoined().
+        ProgramObject::LinkArtifacts artifacts;
+
+        // Posts this job once every compile in `deps` is terminal - and not one moment
+        // earlier, so the body never waits on anything (invariant I4: no job body may block
+        // on another job, or the pool could deadlock with all its workers waiting on each
+        // other). `deps` is the subset of the snapshot's compile nodes that were still
+        // in flight; an already-terminal one needs no edge.
+        //
+        // GL thread only, and only after the caller has stored a SharedPtr to this node:
+        // OnDepSettled takes shared_from_this().
+        void SubmitAfter(const Vector<SharedPtr<ShaderCompileTask>>& deps);
+
+    private:
+        void RunBody() override;
+
+        // Runs when one dependency goes terminal - on whichever thread drove it there, which
+        // is a pool worker for a compile that finished on one. Non-throwing by construction;
+        // see the definition.
+        void OnDepSettled();
+
+        // ---- the link body, split exactly as ProgramObject::Link() had it ----
+        // Each returns false to abort the link with `artifacts.infoLog` already set, which is
+        // GL's definition of a failed link: LINK_STATUS false plus a log, never a GL error.
+        Bool ConsumeShaders(Vector<SharedPtr<glslang::TShader>>& outShaders);
+        Bool DoReflection(const MG_Util::ShaderTranspiler::CompileEnv& env);
+        Bool ValidateFragmentOutputLocations();
+        Bool ResolveTransformFeedbackVaryings();
+        void ResolveGsTriangleStripCapture(const glslang::TIntermediate* captureIntermediate);
+        void GenerateSpirv();
+        void BuildGlobalUboRouting();
+
+        // Worker-side MGLOG replacement: appended to diagnostics.logLines and replayed by the
+        // join, on the GL thread, where a serial implementation would have printed it.
+        // Logging straight from a worker interleaves mid-line with the GL thread's output and
+        // lands out of order relative to the glLinkProgram that caused it.
+        void DeferLog(String line);
+
+        // Counts down to zero exactly once. Starts at deps + 1: the extra guard is released
+        // by SubmitAfter itself, so a dependency that settles while the edges are still being
+        // registered cannot post the job from under a half-built dependency list.
+        std::atomic<Int> m_remainingDeps{0};
+    };
+} // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ProgramObject.h

@@ -14,9 +14,22 @@
 #include <MG_Util/ShaderTranspiler/SpvcSession.h>
 
 namespace MobileGL::MG_State::GLState {
+    // The link job. Only ever held by SharedPtr here, so a forward declaration is enough -
+    // ProgramLinkTask.h includes THIS header (it outputs a LinkArtifacts), so including it
+    // back would be circular. The destructor is therefore out of line.
+    class ProgramLinkTask;
+
     class ProgramObject {
     public:
         ProgramObject(Uint externalIndex) : m_externalIndex(externalIndex), m_lifetimeId(AllocateLifetimeId()) {}
+        // Cancel-not-join, exactly like ~ShaderObject: the link job owns its inputs, so an
+        // in-flight link whose program just went away is safe to abandon where it stands.
+        // Nothing can observe its result any more - this object was the only route to it.
+        // Out of line because ProgramLinkTask is incomplete here.
+        ~ProgramObject();
+        ProgramObject(const ProgramObject&) = delete;
+        ProgramObject& operator=(const ProgramObject&) = delete;
+
         bool ShaderIsAttached(const SharedPtr<ShaderObject>& shader);
         // GL-visible attachment: in the attach list and not pending detach (glDetachShader
         // defers the actual removal to the next link).
@@ -151,14 +164,7 @@ namespace MobileGL::MG_State::GLState {
                                                                      : -1;
         }
 
-        Bool IsValidUniformLocation(Int location) const {
-            if (location < 0 || location > static_cast<Int>(Artifacts().maxUniformLocation)) return false;
-            if (static_cast<SizeT>(location) >= Artifacts().uniformIndexInTProgram.size()) return false;
-            const Int uniformIndexInProgram = Artifacts().uniformIndexInTProgram[location];
-            return uniformIndexInProgram != glslang::TQualifier::layoutLocationEnd &&
-                   uniformIndexInProgram >= 0 &&
-                   uniformIndexInProgram < static_cast<Int>(Artifacts().tProgramUniformIndexToGl.size());
-        }
+        Bool IsValidUniformLocation(Int location) const { return IsValidUniformLocation(Artifacts(), location); }
 
         GLenum GetUniformType(Uint location) const {
             auto& uniform = Artifacts().program->getUniform(Artifacts().uniformIndexInTProgram[location]);
@@ -176,12 +182,7 @@ namespace MobileGL::MG_State::GLState {
         // for both. GL 3.3 core uniforms are always sized. Takes a TProgram uniform index (the space
         // the artifacts' uniformIndexInTProgram stores).
         GLint GetUniformArraySizeByTIndex(Int tIndex) const {
-            const auto& uniform = Artifacts().program->getUniform(tIndex);
-            const glslang::TType* type = uniform.getType();
-            if (type != nullptr && type->isSizedArray()) {
-                return type->getOuterArraySize();
-            }
-            return uniform.size < 1 ? 1 : uniform.size;
+            return GetUniformArraySizeByTIndex(Artifacts(), tIndex);
         }
 
         GLint GetActiveUniformArraySize(Uint index) const {
@@ -371,7 +372,7 @@ namespace MobileGL::MG_State::GLState {
         // can skip re-uploading an unchanged UBO on every draw. ~0u is reserved as the
         // backends' "never uploaded" sentinel, so skip over it on wrap.
         Uint32 GetUBOContentVersion() const { return m_uboContentVersion; }
-        void MarkUBOContentDirty() {
+        void MarkUBOContentDirty() const {
             if (++m_uboContentVersion == ~0u) m_uboContentVersion = 0;
         }
         Uint32 GetBackendStateVersion() const { return m_backendStateVersion; }
@@ -439,8 +440,13 @@ namespace MobileGL::MG_State::GLState {
         // glProgramBinary always fails here (there is no format it could accept) and the
         // spec then requires the program's LINK_STATUS to read FALSE.
         void MarkLinkFailedByProgramBinary() {
+            // Before anything reads m_artifacts: a pending link would otherwise publish its
+            // (possibly successful) result over the failure this call is required to install
+            // - and Artifacts() below would be the thing that let it. Cancel-not-join: GL
+            // gives glProgramBinary no reason to wait for a link it is about to invalidate.
+            CancelLink();
             BumpLinkObservableVersions();
-            ResetLinkArtifacts();
+            ResetLinkArtifacts(Artifacts());
             Artifacts().infoLog = "No program binary format is supported.";
         }
         Bool GetValidateStatus() const { return m_validateStatus; }
@@ -633,12 +639,68 @@ namespace MobileGL::MG_State::GLState {
             Uint32 xfbPackedStride = 0;
         };
 
-        // Blocks until a pending link (P1 stage 4 onwards) has published its artifacts.
-        // Public because a few call sites have to join without reading anything - see the
-        // explicit-join list in the P1 design. Today there is never a pending link, so this
-        // is a no-op; it is wired up when glLinkProgram starts enqueueing.
+        // ---- artifacts-only helpers, shared with ProgramLinkTask ----
+        // Static and taking the block explicitly, because from stage 4 the link BODY needs
+        // them while its artifacts still live on the job node, not on any ProgramObject. The
+        // member overloads above are the same functions read through the join gate.
+
+        // Clears every field one link produces, EXCEPT infoLog, linkedFragDataLocation/Index
+        // and the geometry strip-capture pair. That exception is load-bearing: the callers
+        // that survive (glProgramBinary's mandated failure, and the link body's own mid-link
+        // aborts) write infoLog immediately AFTER calling here. Link()'s prologue does not
+        // use this at all - it assigns a whole default-constructed LinkArtifacts, where the
+        // ordering is explicit and nothing is exempt.
+        static void ResetLinkArtifacts(LinkArtifacts& artifacts);
+
+        static Bool IsValidUniformLocation(const LinkArtifacts& artifacts, Int location) {
+            if (location < 0 || location > static_cast<Int>(artifacts.maxUniformLocation)) return false;
+            if (static_cast<SizeT>(location) >= artifacts.uniformIndexInTProgram.size()) return false;
+            const Int uniformIndexInProgram = artifacts.uniformIndexInTProgram[location];
+            return uniformIndexInProgram != glslang::TQualifier::layoutLocationEnd &&
+                   uniformIndexInProgram >= 0 &&
+                   uniformIndexInProgram < static_cast<Int>(artifacts.tProgramUniformIndexToGl.size());
+        }
+
+        // Number of active array elements (GL_UNIFORM_SIZE / GL_ARRAY_SIZE); 1 for a non-array.
+        // glslang's TObjectReflection.size only carries the element count for a NON-block array; for
+        // a block array member it reports 1, so take the count from the TType, which is authoritative
+        // for both. GL 3.3 core uniforms are always sized. Takes a TProgram uniform index (the space
+        // the artifacts' uniformIndexInTProgram stores).
+        static GLint GetUniformArraySizeByTIndex(const LinkArtifacts& artifacts, Int tIndex) {
+            const auto& uniform = artifacts.program->getUniform(tIndex);
+            const glslang::TType* type = uniform.getType();
+            if (type != nullptr && type->isSizedArray()) {
+                return type->getOuterArraySize();
+            }
+            return uniform.size < 1 ? 1 : uniform.size;
+        }
+
+        // Blocks until a pending link has published its artifacts. Public because a few call
+        // sites have to join without reading anything - see the explicit-join list (J1-J8) in
+        // the P1 design. GL thread only.
         void JoinLink() const { EnsureLinkJoined(); }
 
+        // Drops a link that is still in flight, without waiting for it. Called at the points
+        // where the pending link's result stops being the answer to "what did this program
+        // link to": a re-link supersedes it, glProgramBinary must force LINK_STATUS false,
+        // and a destroyed program has no observers left.
+        //
+        // Deliberately NOT called by the "takes effect at the next link" setters
+        // (glBindAttribLocation, glBindFragDataLocation(Indexed), glTransformFeedbackVaryings,
+        // glProgramParameteri) NOR by glAttachShader/glDetachShader. Every one of those is
+        // defined by GL to leave the CURRENT link result alone, and the pending link already
+        // snapshotted its own inputs at enqueue, so it is computing exactly the answer GL
+        // requires. Cancelling on any of them would make
+        //   glLinkProgram(p); <setter>; glGetProgramiv(p, GL_LINK_STATUS)
+        // report FALSE for a link that succeeded - and for the attach/detach pair it would
+        // additionally break glCreateShaderProgramv, which detaches immediately after linking.
+        void CancelLink();
+
+        // MUST NOT JOIN - this is what GL_COMPLETION_STATUS_KHR reads when the extension
+        // surface lands. "No job at all" counts as complete: there is nothing outstanding to
+        // wait for.
+        Bool IsLinkComplete() const { return m_pendingLink == nullptr || IsPendingLinkTerminal(); }
+
         void SetTransformFeedbackVaryings(Vector<String>&& names, GLenum bufferMode) {
             m_requestedXfbVaryings = Move(names);
             m_requestedXfbBufferMode = bufferMode;
@@ -685,19 +747,22 @@ namespace MobileGL::MG_State::GLState {
     private:
         // ---- The one and only join gate for link output (P1 invariant I5) ----
         // Blocks until a pending link has finished and its LinkArtifacts have been
-        // published into m_artifacts. Today no link is ever pending - glLinkProgram still
-        // runs the whole body inline - so this is an unconditional no-op, and the whole
-        // Artifacts() indirection compiles away. It exists NOW so that the ~120 readers of
-        // link output are already routed through it when stage 4 makes it block: the edit
-        // that turns links asynchronous then touches this function and nothing else.
+        // published into m_artifacts. It exists so that the ~120 readers of link output are
+        // routed through it by the compiler rather than by review: m_artifacts is private
+        // and Artifacts() is the only spelling that reaches it.
         //
-        // Defined inline (not in ProgramObject.cpp) on purpose: this is called from every
-        // Artifacts() read - ~1200 call sites project-wide - and the project never builds
-        // with LTO (MOBILEGL_ENABLE_LTO=OFF), so an out-of-line empty body would leave a
-        // real cross-TU call at every one of them instead of folding away. Stage 4's
-        // version, which actually blocks, moves the wait itself out-of-line behind a
-        // `m_pendingLink` check that stays inline here.
-        void EnsureLinkJoined() const {}
+        // The fast path - no pending link - is one predictable branch and stays inline: it
+        // runs on every Artifacts() read (~1200 call sites project-wide) and the project
+        // never builds with LTO (MOBILEGL_ENABLE_LTO=OFF), so an out-of-line body would be a
+        // real cross-TU call at every one of them. The blocking half is out of line.
+        void EnsureLinkJoined() const {
+            if (m_pendingLink) JoinPendingLink();
+        }
+        void JoinPendingLink() const;
+        // ProgramLinkTask is incomplete here, so IsLinkComplete()'s non-joining peek at the
+        // node's state goes through this out-of-line helper.
+        Bool IsPendingLinkTerminal() const;
+
         LinkArtifacts& Artifacts() {
             EnsureLinkJoined();
             return m_artifacts;
@@ -707,28 +772,10 @@ namespace MobileGL::MG_State::GLState {
             return m_artifacts;
         }
 
-        void ResetLinkArtifacts();
-        // GL-thread-only companion to ResetLinkArtifacts (see its definition).
-        void BumpLinkObservableVersions();
-        // Builds the GL-facing reflection surface from the linked TProgram. Returns false
-        // (with the artifacts' infoLog set and link artifacts reset) when reflection itself fails or an
-        // explicit-uniform-location conflict makes the link invalid.
-        Bool DoReflection(const MG_Util::ShaderTranspiler::CompileEnv& env);
-        // Resolves the requested transform feedback varyings against the linked
-        // vertex stage; fails the link (GL semantics) on unknown or duplicate
-        // names or exceeded capture limits.
-        Bool ResolveTransformFeedbackVaryings();
-        void ResolveGsTriangleStripCapture(const glslang::TIntermediate* captureIntermediate);
-        // The former GenerateBinary, split around DoReflection's data dependencies:
-        // SPIR-V must be generated BEFORE buildReflection touches the linked TProgram (its
-        // live-variable analysis mutates the intermediates enough to change
-        // GlslangToSpv output), while the glUniform*-to-global-UBO routing tables are
-        // sized and keyed by reflection results (maxUniformLocation, uniformLocations)
-        // and so must run AFTER it.
-        void GenerateSpirv();
-        void BuildGlobalUboRouting();
+        // GL-thread-only companion to ResetLinkArtifacts (see its definition). Const because
+        // the publish half of the join calls it; see the mutable counters below.
+        void BumpLinkObservableVersions() const;
         void AddDefaultFragmentShaderIfMissing();
-        Bool ValidateFragmentOutputLocations();
 
         static Uint64 AllocateLifetimeId();
 
@@ -762,7 +809,10 @@ namespace MobileGL::MG_State::GLState {
         Bool m_binaryRetrievableHint = false;
         Bool m_separable = false;
         Bool m_validateStatus = true;
-        Uint32 m_backendStateVersion = 0;
+        // Mutable, like m_artifacts and for the same reason: publishing a pending link is a
+        // READ-side operation (the first gated getter is what pulls the result in), and the
+        // publish has to bump these. Still GL-thread-only - a worker never touches them.
+        mutable Uint32 m_backendStateVersion = 0;
 
         // Backend-owned content-hash memo (see GetBackendHashMemo): valid only while
         // m_backendStateVersion matches. Several slots, not one: a backend may resolve the same
@@ -778,12 +828,20 @@ namespace MobileGL::MG_State::GLState {
         mutable Array<BackendHashMemoSlot, kBackendHashMemoSlotCount> m_backendHashMemoSlots{};
         mutable SizeT m_backendHashMemoNextSlot = 0;
         mutable Uint32 m_backendHashMemoVersion = ~0u;
-        Uint32 m_uboContentVersion = 0;
-        Uint32 m_linkVersion = 0;
+        mutable Uint32 m_uboContentVersion = 0;
+        mutable Uint32 m_linkVersion = 0;
 
         // ---- Link OUTPUT ----
         // Written by the link and by the post-link setters GL allows (glUniform1i's sampler
         // unit, glUniformBlockBinding). Reachable only through Artifacts(); see LinkArtifacts.
-        LinkArtifacts m_artifacts;
+        //
+        // Mutable because publishing is a READ-side operation: a const getter has to be able
+        // to settle an outstanding link before answering it.
+        mutable LinkArtifacts m_artifacts;
+
+        // The link job, from enqueue until the first observable read pulls its result. Null
+        // means m_artifacts is already the answer - which is the state every reader outside
+        // the pending window sees, and the whole reason the gate above is one branch.
+        mutable SharedPtr<ProgramLinkTask> m_pendingLink;
     };
 } // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ProgramState.cpp

@@ -39,6 +39,14 @@ namespace MobileGL::MG_State::GLState {
 
     void ProgramState::DestroyProgramSlot(const Uint program) {
         auto& programObject = m_programObjects[program];
+        // P1 join site J4/J5 (glDeleteProgram, and the deferred destroy UseProgram performs
+        // when a deletion-flagged program stops being current). The program's name is about
+        // to go, so nothing can observe its link any more: cancel-not-join, so a delete never
+        // blocks the GL thread on a worker. Explicit rather than left to ~ProgramObject,
+        // because the reset below only destroys the object if this table held the last
+        // reference - a program still bound as current, or still referenced by a pipeline,
+        // outlives it, and its link should stop the moment the name does.
+        programObject->CancelLink();
         // Snapshot the attachments: deleting the program is a detach point for shaders
         // that were flagged with glDeleteShader while still attached.
         const Vector<SharedPtr<ShaderObject>> attachedShaders = programObject->GetAttachedShaders();

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.cpp

@@ -185,24 +185,16 @@ namespace {
         return result;
     }
 
-    // glslang has no "detach this thread" API in the vendored revision (there is no
-    // InitThread/DetachThread pair any more; thread attachment is implicit through
-    // thread_local state, and glslang::InitializeProcess() is process-wide, refcounted and
-    // mutex-guarded, so it needs no per-worker counterpart).
-    //
-    // What DOES need undoing is the thread pool allocator: TShader::parse sets the calling
-    // thread's TLS allocator to the shader's own pool and never restores it. Left pointing
-    // there, the next allocation this worker makes - in an unrelated job, or in glslang code
-    // reached from a different object - would come out of a pool the GL thread may already
-    // have deleted with the TShader. SetThreadPoolAllocator(nullptr) reverts the thread to
-    // its own thread_local default and is the documented idiom. A scope guard, so it also
-    // runs when a body throws.
-    struct GlslangThreadAllocatorGuard {
-        ~GlslangThreadAllocatorGuard() { glslang::SetThreadPoolAllocator(nullptr); }
-    };
 } // namespace
 
 namespace MobileGL::MG_State::GLState {
+    // glslang has no "detach this thread" API in the vendored revision (there is no
+    // InitThread/DetachThread pair any more; thread attachment is implicit through
+    // thread_local state, and glslang::InitializeProcess() is process-wide, refcounted and
+    // mutex-guarded, so it needs no per-worker counterpart). The pool allocator is the part
+    // that needs undoing; see the declaration in ShaderCompileTask.h.
+    GlslangThreadAllocatorGuard::~GlslangThreadAllocatorGuard() { glslang::SetThreadPoolAllocator(nullptr); }
+
     // Pure CPU work only. Everything this reads is either an input the node owns or a
     // process-wide constant; everything it writes is `artifacts`. Do not add a GL/EGL call,
     // a pActiveBackendObject read, or a pGLContext->RecordError() here - the first two are
@@ -300,4 +292,47 @@ namespace MobileGL::MG_State::GLState {
             }
         }
     }
+
+    SharedPtr<glslang::TShader> ShaderCompileTask::ClaimParsedShader(String& outReparseLog) const {
+        MOBILEGL_ASSERT(IsComplete(),
+                        "ShaderCompileTask::ClaimParsedShader() on a job that has not completed; its artifacts "
+                        "are still being written");
+
+        if (artifacts.shader) {
+            // The whole race, in one instruction. Acquire-release because the winner is about
+            // to hand the TShader to glslang's linker on a possibly different thread from the
+            // one that parsed it - the node's terminal transition already published the
+            // parse, and this orders the two claimants against each other.
+            Bool expected = false;
+            if (m_parseClaimed.compare_exchange_strong(expected, true, std::memory_order_acq_rel,
+                                                       std::memory_order_acquire)) {
+                return artifacts.shader;
+            }
+        }
+
+        // Either another link already consumed the stored parse (and mapIO mutated its
+        // intermediate), or there never was one. Re-parse the preprocessed source through the
+        // identical configuration; that costs one glslang parse, which is what GenerateBinary
+        // used to spend here on EVERY link rather than only on reuse.
+        //
+        // The guard is not optional on this path: from stage 4 this runs on a pool worker,
+        // and TShader::parse would leave that worker's TLS allocator pointing at a pool the
+        // GL thread is about to free. (ProgramLinkTask::RunBody holds one too; they nest
+        // harmlessly - both just reset the thread to its own default.)
+        const GlslangThreadAllocatorGuard glslangGuard;
+        using namespace MG_Util::ShaderTranspiler;
+        ShaderAttrib attrib{.shaderType = MG_Util::ConvertShaderStageToGLEnum(stage),
+                            .sourceStr = artifacts.preprocessedSource,
+                            .flags = 0,
+                            // Re-parse against the SAME environment the original parse used,
+                            // not against whatever the backend reports now.
+                            .env = artifacts.env.get()};
+        auto result = ShaderCompiler::CompileShader(attrib);
+        if (!result) {
+            // Should be unreachable: the same source parsed successfully at Compile().
+            outReparseLog = result.error().log;
+            return nullptr;
+        }
+        return result.value();
+    }
 } // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.h

@@ -13,6 +13,23 @@
 #include <MG_State/GLState/ProgramState/ShaderPreprocessCache.h>
 
 namespace MobileGL::MG_State::GLState {
+    // glslang has no "detach this thread" API in the vendored revision, but TShader::parse
+    // leaves the calling thread's TLS pool allocator pointing at the shader's own pool and
+    // never restores it. Left there, the next allocation this thread makes - in an unrelated
+    // job, or in glslang code reached from a different object - would come out of a pool the
+    // GL thread may already have deleted with the TShader. SetThreadPoolAllocator(nullptr)
+    // reverts the thread to its own thread_local default and is the documented idiom.
+    //
+    // A scope guard, so it also runs when a body throws. Declared here rather than kept
+    // file-local because stage 4 gave it a second user: ProgramLinkTask's body parses (the
+    // claim-CAS loser's re-parse), links and emits SPIR-V, all on a pool thread.
+    struct GlslangThreadAllocatorGuard {
+        GlslangThreadAllocatorGuard() = default;
+        ~GlslangThreadAllocatorGuard();
+        GlslangThreadAllocatorGuard(const GlslangThreadAllocatorGuard&) = delete;
+        GlslangThreadAllocatorGuard& operator=(const GlslangThreadAllocatorGuard&) = delete;
+    };
+
     // Everything one glCompileShader PRODUCES, in one block.
     //
     // This is exactly the set a single run of the compile pipeline writes, which is what
@@ -21,21 +38,16 @@ namespace MobileGL::MG_State::GLState {
     // it in, and the GL thread reads it through ShaderObject's join gate.
     struct ShaderCompileArtifacts {
         // The CompileEnv snapshot this compile ran against. Held so the consume-once
-        // re-parse in TakeShaderForLink() reproduces the original parse exactly, instead of
+        // re-parse in ClaimParsedShader() reproduces the original parse exactly, instead of
         // re-reading whatever the backend says now.
         SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env;
         SharedPtr<glslang::TShader> shader;
         // The source the parse actually consumed (after PreprocessShaderSource), kept for
-        // TakeShaderForLink's re-parse so a later link never depends on the preprocessor
+        // ClaimParsedShader's re-parse so a later link never depends on the preprocessor
         // being deterministic across backend-state changes.
         String preprocessedSource;
         UnorderedMap<String, Int> explicitUniformLocations;
         UnorderedMap<String, Uint> explicitOpaqueBindings;
-        // GL-thread-owned, and the one field here a worker never touches: TakeShaderForLink
-        // flips it after the join. Stage 4 replaces it with an atomic claim on this node,
-        // because two ProgramLinkTasks for two programs sharing this shader can then race
-        // for the parse on two workers.
-        Bool shaderConsumedByLink = false;
         String infoLog;
         Bool compileStatus = false;
     };
@@ -75,9 +87,50 @@ namespace MobileGL::MG_State::GLState {
         // ---- output: valid iff IsComplete(), immutable afterwards ----
         ShaderCompileArtifacts artifacts;
 
+        // Hands out a link-consumable TShader, exactly once for the stored parse.
+        //
+        // glslang's mapIO mutates the TShader's aliased intermediate, so the parse this node
+        // produced may feed exactly ONE link; every later link (a relink, or the same shader
+        // attached to a second program) needs a fresh parse. The claim is a CAS on this
+        // shared node rather than a flag on the ShaderObject because from stage 4 the two
+        // callers can be two ProgramLinkTasks running on two workers: two programs sharing
+        // one shader, linked back to back. Copying the parse out and tracking consumed-ness
+        // per program would let both of them decide they were the first, run mapIO over the
+        // same intermediate twice, and ship silently corrupt SPIR-V.
+        //
+        // The CAS loser re-parses artifacts.preprocessedSource against THIS node's own
+        // CompileEnv (not against whatever the backend reports now), through the identical
+        // CompileShader path - so winner and loser produce byte-identical SPIR-V. Callable
+        // only once IsComplete() and compileStatus are true. Returns null only if that
+        // re-parse fails, and outReparseLog then carries its diagnostics.
+        //
+        // Const because the claim is the node's own synchronization, not a mutation of its
+        // published artifacts: a claim that is taken and then abandoned (its link was
+        // cancelled) costs one extra re-parse later and nothing else.
+        SharedPtr<glslang::TShader> ClaimParsedShader(String& outReparseLog) const;
+
+        // Sticky marker for "a ProgramLinkTask has this node in its input snapshot".
+        //
+        // It exists to keep a cancel from eating a result someone still needs. A pending link
+        // holds its dependencies by SharedPtr, so the NODE always outlives the ShaderObject -
+        // but Cancel() is not about lifetime, it discards the result. The reachable sequence
+        // is the ordinary one: compile, attach, glLinkProgram (enqueued), glDetachShader,
+        // glDeleteShader. The detach makes the shader GL-invisible, so the delete frees its
+        // name, and ReleaseShaderNameIfOrphaned would cancel a compile the enqueued link is
+        // waiting on - turning a link that must report GL_TRUE into GL_FALSE. Set on the GL
+        // thread in Link()'s prologue, read on the GL thread by ShaderObject::CancelCompile.
+        //
+        // Never cleared: the worst case is one stale node compiling to completion for nobody,
+        // which is exactly what the pre-stage-3 implementation always did.
+        void MarkLinkReferenced() { m_linkReferenced.store(true, std::memory_order_release); }
+        Bool IsLinkReferenced() const { return m_linkReferenced.load(std::memory_order_acquire); }
+
     private:
         void RunBody() override;
         // The real body; RunBody wraps it so a throw becomes a GL-visible compile failure.
         void RunCompilePipeline();
+
+        mutable std::atomic<Bool> m_parseClaimed{false};
+        std::atomic<Bool> m_linkReferenced{false};
     };
 } // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ShaderObject.cpp

@@ -77,7 +77,14 @@ namespace MobileGL::MG_State::GLState {
         // Cooperative and non-blocking. A node that no worker has picked up settles
         // immediately; one that is running is flagged and settles when its body returns,
         // writing only into itself the whole time.
-        m_compiled->Cancel();
+        //
+        // Unless a pending LINK is waiting on it. Cancelling is about discarding a result
+        // nothing can observe any more, and this object is no longer the only route to this
+        // one: an enqueued ProgramLinkTask holds the node as a dependency, and a cancel would
+        // turn its link into GL_FALSE. Reached by the ordinary link-then-detach-then-delete
+        // shader teardown - see ShaderCompileTask::MarkLinkReferenced. Dropping our own
+        // reference is still right; the link keeps the node alive and finishes it.
+        if (!m_compiled->IsLinkReferenced()) m_compiled->Cancel();
         m_compiled.reset();
     }
 
@@ -91,7 +98,7 @@ namespace MobileGL::MG_State::GLState {
         // The failure case is covered too: the info log stays queryable because nothing is
         // cleared. And if the stored TShader already fed a link, the no-op leaves
         // preprocessedSource and both side-channel maps intact, which is precisely what
-        // TakeShaderForLink's on-demand re-parse needs - a real recompile would have handed
+        // ClaimParsedShader's on-demand re-parse needs - a real recompile would have handed
         // the next link a fresh parse, the no-op hands it a fresh re-parse of the identical
         // source instead. Same result, one parse either way.
         if (HasMemoizedCompile()) return;
@@ -119,43 +126,6 @@ namespace MobileGL::MG_State::GLState {
         MG_Util::Async::ShaderCompilePool::Get().Post(m_compiled);
     }
 
-    SharedPtr<glslang::TShader> ShaderObject::TakeShaderForLink(String& outReparseLog) {
-        EnsureCompileJoined();
-        // Unreachable through the GL frontend: callers gate on GetCompileStatus().
-        if (!m_compiled) return nullptr;
-
-        // Mutating the node's artifacts from here is legal precisely because the node is
-        // terminal by now: no worker will ever touch it again, and this thread is the GL
-        // thread. Stage 4, where two link JOBS can reach the same node concurrently,
-        // replaces this flag with an atomic claim on the node.
-        ShaderCompileArtifacts& compiled = m_compiled->artifacts;
-        if (compiled.shader && !compiled.shaderConsumedByLink) {
-            compiled.shaderConsumedByLink = true;
-            return compiled.shader;
-        }
-
-        // The stored parse already fed a link, whose mapIO mutated its intermediate.
-        // Re-parse the preprocessed source through the identical configuration; this
-        // costs one glslang parse, which is exactly what GenerateBinary used to spend
-        // here on EVERY link rather than only on reuse.
-        using namespace MG_Util::ShaderTranspiler;
-        ShaderAttrib attrib{.shaderType = MG_Util::ConvertShaderStageToGLEnum(m_stage),
-                            .sourceStr = compiled.preprocessedSource,
-                            .flags = 0,
-                            // Re-parse against the SAME environment the original parse used,
-                            // not against whatever the backend reports now.
-                            .env = compiled.env.get()};
-        auto result = ShaderCompiler::CompileShader(attrib);
-        if (!result) {
-            // Should be unreachable: the same source parsed successfully at Compile().
-            outReparseLog = result.error().log;
-            MGLOG_E("ShaderObject::TakeShaderForLink: re-parse of shader %d failed:\n%s", m_externalIndex,
-                    outReparseLog.c_str());
-            return nullptr;
-        }
-        return result.value();
-    }
-
     void ShaderObject::MarkAsDeleted() {
         m_deleteStatus = true;
     }

MobileGL/MG_State/GLState/ProgramState/ShaderObject.h

@@ -51,14 +51,17 @@ namespace MobileGL {
             void CancelCompile();
             void MarkAsDeleted();
 
-            // Hands out a link-consumable TShader. glslang's mapIO mutates the TShader's
-            // aliased intermediate, so the parse stored by Compile() may feed exactly one
-            // link; every later link (relink, or the same shader attached to a second
-            // program) gets a fresh parse of the stored preprocessed source through the
-            // byte-identical CompileShader path (including the legacy-460 retry). Only
-            // callable while GetCompileStatus() is true. Returns null only if that
-            // re-parse fails - outReparseLog then carries its diagnostics.
-            SharedPtr<glslang::TShader> TakeShaderForLink(String& outReparseLog);
+            // The compile job node itself, for ProgramObject::Link()'s input snapshot.
+            // DELIBERATELY DOES NOT JOIN, and that is the entire point of stage 4: the link
+            // takes the node as a dependency and is posted only once the node is terminal,
+            // so glLinkProgram never blocks on glCompileShader. Null means this object has
+            // never been compiled (or its last compile was abandoned), which the link reads
+            // as COMPILE_STATUS false - the same verdict the joining path produces.
+            //
+            // The caller must MarkLinkReferenced() whatever it keeps: from here on the node's
+            // result has an observer this object knows nothing about (see the marker's
+            // comment in ShaderCompileTask.h).
+            const SharedPtr<ShaderCompileTask>& CompiledNodeForLink() const { return m_compiled; }
 
             Uint GetExternalIndex() const { return m_externalIndex; }
             ShaderStage GetShaderStage() const { return m_stage; }