From 77cbd1763684e9d755e2483cfb6dd078aaa75b4c Mon Sep 17 00:00:00 2001
From: Swung0x48 <swung0x48@outlook.com>
Date: Mon, 21 Sep 2026 21:52:18 -0400
Subject: [PATCH] [MG_Remote] (P6/dl): record the Session::Fail funnel as
 landed in the contract
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

§5.2 gains a LANDED note: the three steps (the FatalFamilies.def vocabulary,
the SessionFail funnel that byte-identically routes ~90 aborts through one
place, and the SessionFault frame that names the family to the peer), and the
one deliberate deviation from the prose - seq/op are not threaded through the
90 sites because the message already names the op, so the frame carries code,
family and message rather than a field that is always zero.
---
 MobileGL/MG_Remote/CONTRACT-P6.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/MobileGL/MG_Remote/CONTRACT-P6.md b/MobileGL/MG_Remote/CONTRACT-P6.md
index f7d635f8..e2528bf0 100644
--- a/MobileGL/MG_Remote/CONTRACT-P6.md
+++ b/MobileGL/MG_Remote/CONTRACT-P6.md
@@ -276,6 +276,20 @@ red-once are byte-identical. What the funnel buys, and what makes it worth `dl`'
 - one telemetry point;
 - a CI census gate refusing any **new** bare abort outside the funnel.
 
+> **LANDED, in three steps.** (1) `FatalFamilies.def` + `FatalFamily.h` generate `MGFatalFamily`,
+> its total projection `FatalCodeForFamily` and `FatalFamilyName`; 32 rows, tested. (2) `SessionFail`
+> (`FatalFunnel.{h,cpp}`) is the funnel: the ~90 scattered `MGLOG_F("...Fatal{...}"); abort();` pairs
+> under `MG_Remote/` become one call each, the message string passed **verbatim** so every line and
+> grep is byte-identical, the family enum riding alongside for the coarse code. `SessionFaultCount()`
+> is the telemetry point. The census now also requires every `SessionFail`/`WireLogFatal` call's
+> string to carry a `Fatal{` word, and its baseline drops from 93 bare aborts to 4 (both funnels).
+> (3) `table Fatal` gains `family: string`; `SessionFail` publishes the frame on whichever session
+> control plane is active before aborting, and the client's control-reply loop recognizes it, names
+> the family and latches device-lost. **seq/op are NOT threaded** through the 90 sites — the message
+> already names the op — so the frame carries `code`, `family` and `message`, not a field always 0.
+> A `kill -9` bypasses `abort()` and is caught by `dl`'s hangup witness instead; the self-detected
+> fatal is the one that publishes.
+
 **The policy flip is not P6's.** Making `Fail` return needs a real return path invented at every site
 whose callers rely on `[[noreturn]]`, and a6 counted how many do. That is `Ph`'s (§11).