[Fix] (MG_Impl, MG_Pipe, MG_IntegrationTest): close the four cross-package rows nobody claimed - symmetric vertex-input pairing asserts, the counter G10 reads, and the buffer ABA's Magma-only evidence

MobileGL/MG_Impl/Pipe/PipeFill.cpp

@@ -995,36 +995,35 @@ namespace MobileGL::MG_Pipe {
                           MGPipeSubsystemForDirty(MGPipeDirty::NewVertexAttribDefaults),
                       "set_vertex_attrib_defaults and NEW_VERTEX_ATTRIB_DEFAULTS must name one subsystem");
 
-        // P3a's pairing, in the two halves the contract commit can actually state.
+        // P3a's pairing, now stated as the SAME EQUALITY the four above are (contract-review
+        // m4, closed here).
         //
-        // The four above compare the two maps directly, which is only possible once BOTH
-        // sides name the subsystem. MGPipeSubsystemForDirty is MG_Impl/Pipe/Tracker.h's and
-        // its bit 5 / 9 / 10 arms land with the client emitters, not here - so the direct
-        // form would fail at this commit for a reason that is not a defect. What is stated
-        // instead is exactly as strong in the direction that matters:
+        // It was written with an escape hatch - `MGPipeSubsystemForDirty(...) == 0 ||` - because
+        // at the contract commit Tracker.h's bit 5 / 9 / 10 arms did not exist yet and the
+        // direct form would have failed for a reason that was not a defect. That hatch was
+        // explicitly conditional on the dirty half being unmapped, and the dirty half is now
+        // mapped (Tracker.h:145-148), so it is removed: leaving it would mean a later edit that
+        // unmapped one of these bits again passed silently, which is precisely what these
+        // assertions exist to catch.
         //
-        //   (a) the emitter half names the vertex-input subsystem, so a later edit that moved
-        //       it onto a different one fails here;
-        //   (b) the two maps AGREE OR THE DIRTY HALF IS NOT MAPPED YET. The escape hatch is
-        //       the not-yet-mapped case only: the moment Tracker.h maps NEW_VERTEX_ELEMENTS
-        //       onto anything at all, this becomes the equality the four above are;
-        //   (c) and while the dirty half is unmapped the subsystem is NOT in
-        //       kMGPipeWiredSubsystems below, so no field can be skipped on the strength of a
-        //       call nobody emits. (c) is what makes (b)'s hatch safe rather than convenient.
+        // AND ALL THREE COMPARE AGAINST SubsystemForEmitter, not against the constant. Two of
+        // them named kMGPipeSubsystemVertexInput directly, which asks a different and weaker
+        // question: it pins the dirty half to a constant instead of pinning the two MAPS to
+        // each other, so an emitter row moved onto another subsystem would still satisfy them
+        // while the emission gate and the residual-fill skip had begun to disagree. C.5's trap
+        // is exactly that kind of near-miss. bind_vertex_elements is the family's only
+        // Coverage.def emitter row, so it is the emitter side of all three.
         static_assert(SubsystemForEmitter(MGPipeFieldEmitter::BindVertexElements) ==
                           kMGPipeSubsystemVertexInput,
                       "bind_vertex_elements must name the vertex-input subsystem");
-        static_assert(MGPipeSubsystemForDirty(MGPipeDirty::NewVertexElements) == 0 ||
-                          MGPipeSubsystemForDirty(MGPipeDirty::NewVertexElements) ==
-                              SubsystemForEmitter(MGPipeFieldEmitter::BindVertexElements),
+        static_assert(MGPipeSubsystemForDirty(MGPipeDirty::NewVertexElements) ==
+                          SubsystemForEmitter(MGPipeFieldEmitter::BindVertexElements),
                       "bind_vertex_elements and NEW_VERTEX_ELEMENTS must name one subsystem");
-        static_assert(MGPipeSubsystemForDirty(MGPipeDirty::NewVertexBuffers) == 0 ||
-                          MGPipeSubsystemForDirty(MGPipeDirty::NewVertexBuffers) ==
-                              kMGPipeSubsystemVertexInput,
+        static_assert(MGPipeSubsystemForDirty(MGPipeDirty::NewVertexBuffers) ==
+                          SubsystemForEmitter(MGPipeFieldEmitter::BindVertexElements),
                       "set_vertex_buffers and NEW_VERTEX_BUFFERS must name one subsystem");
-        static_assert(MGPipeSubsystemForDirty(MGPipeDirty::NewIndexBuffer) == 0 ||
-                          MGPipeSubsystemForDirty(MGPipeDirty::NewIndexBuffer) ==
-                              kMGPipeSubsystemVertexInput,
+        static_assert(MGPipeSubsystemForDirty(MGPipeDirty::NewIndexBuffer) ==
+                          SubsystemForEmitter(MGPipeFieldEmitter::BindVertexElements),
                       "set_index_buffer and NEW_INDEX_BUFFER must name one subsystem");
         // The two vertex views' capacity is one number on both sides of the boundary. This is
         // the one translation unit that sees the frontend constant and the MG_Pipe one, so it

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -892,6 +892,24 @@ gtest_discover_tests(MobileGLIntegrationTest
 # table, and LookupVaoDrawMemo); it steers nothing on DirectGLES, and a lane that configured it
 # there would be a permanent skip claiming to be a control.
 #
+# SO THE BUFFER ABA's CORRUPTION EVIDENCE IS MAGMA-ONLY, AND THAT IS RECORDED RATHER THAN LEFT
+# AS AN ABSENCE (gates m10, closed here as a statement rather than as a lane). P3a re-keys the
+# BUFFER on DirectGLES - resource_* now dispatches by handle - so the obvious next move is a
+# DirectGLES `.AbaControl` lane over ABufferAtARecycledAddressDoesNotInheritItsPredecessorsContents.
+# It is not a registration-only change and it is therefore not made here: the knob has exactly
+# one consumer in the tree (MG_Backend/DirectVulkan/Renderer/MagmaPipeArms.h's
+# MagmaPipeAbaControlDefeatsIdentity, which is what the MGL_ITEST_MAGMA_ABA probe above looks
+# for), so a DirectGLES lane would run with the knob inert, fail to reproduce the corruption it
+# asserts, and go RED in an always-on integration-gpu lane - the exact failure mode the header
+# of HandleRecycleScenario.cpp records this file already having had once.
+#
+# What that costs, stated so the next reader does not have to re-derive it: on DirectGLES the
+# buffer case's Handles arm proves the re-key does NOT alias, and nothing proves the reproducer
+# could still see an aliasing that was reintroduced there. The positive control for that is a
+# Features.PipeHandleAbaControl consumer over Espryt's resource slot table - one `if` in
+# GetOrCreate / FindByHandle, the way MagmaPipeClaimSlotMemos is Magma's - and it belongs with
+# whoever next touches that table, not with a lane registration.
+#
 # It gets TWO lanes, because there are two arms and the control has to reach the one P2 SHIPS.
 # `AbaControl` is D18's lane verbatim (MOBILEGL_PIPE_PUSH=0, the pre-handle arm) and defeats the
 # lifetime-id/address guards; `AbaControlHandles` runs the handle arm (MOBILEGL_PIPE_LEGACY_MEMOS=0,

MobileGL/MG_Pipe/PipeApply.cpp

@@ -628,6 +628,20 @@ namespace MobileGL::MG_Pipe {
         g_applier.VertexBufferCount = 0;
         g_applier.VertexFetchBaseInstance = 0;
         g_applier.IndexBuffer = MGPIndexBuffer{};
+        // m6 / wire n6, written down rather than left to be rediscovered: THIS counter is
+        // per-applier and is zeroed at every make-current, while MG_Util::PipeStats' `mpr` -
+        // emitted from the CLIENT at MG_Impl/Pipe/PipeFill.cpp's MGPipeEmitMapPersistent - is
+        // process-wide and is windowed by EndFrame. The two therefore disagree across a context
+        // switch, by design and not by accident: this one answers "how many round trips has THIS
+        // applier been asked for since it was last reset", which is what a unit case driving the
+        // applier directly wants, and PipeStats' answers "how many did the process take in this
+        // window", which is what a lane reading a log line wants.
+        //
+        // WHICH ONE THE GATES ASSERT ON, because that was the open question: G10
+        // (StorageBufferRegrow) and G12 read PipeStats' `mpr` out of the lane's own log through
+        // MG_IntegrationTest/Harness/PipeStatsWindow.h - they cannot link this symbol at all, on
+        // Android or anywhere else - so a make-current inside a scenario cannot silently reset
+        // what they measure. Nothing outside MG_Test reads the member below.
         g_applier.MapPersistentRoundtrips = 0;
         // THE TWO SERIALS ADVANCE; THEY ARE NOT ZEROED. They are MGGens, and an MGGen that
         // walks backwards is not one. There are exactly three things a reset can do to a