swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-07 01:53:24 +09:00
Code Issues Packages Projects Releases Wiki Activity

[docs] (P7): ID-P7-60/61/62 - the codex closeout fixes, the spawn cold-start heartbeat, and gate 3's nondeterministic-monolith ruling; window 2 reads gate 5 PASS

Browse Source
This commit is contained in:
swung0x48
2026-09-23 19:34:55 -04:00
parent 990bc649a6
commit 78e71f2b01
4 changed files with 64 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Disaggregated/CURRENT_STAGE_STATUS.md
+9 -7
View File
@@ -4,7 +4,7 @@
**阶段：P7 DirectVulkan（Magma）全量迁移**，并行流 **P3b/P4b 深化（Espryt，wave 2-D）** 与 **Ph 小件（簇 F）**。计划 [`notes/p7/PLAN-PH-P34B-P7.md`](notes/p7/PLAN-PH-P34B-P7.md)（五波）。
**更新：2026-09-23（ID-P7-49–59）** · 当前交接 [notes/p7/HANDOFF-2026-09-23.md](notes/p7/HANDOFF-2026-09-23.md)。CI 自 P6.5 起的七个红因已修，`1997fd88` 上 Test 全绿（含 P6.5 以来首次跑的 retrace 链）；棘轮 171、门 4 关闭（ID-P7-55/56）。F2（Ph 余项 + fuzz 三臂）与门 5 预演抓出的三个 inproc CTS 缺陷已落地（ID-P7-57/58）；门 3 与 CTS AFTER 在设备窗口 2（ID-P7-59）。
**更新：2026-09-23（ID-P7-49–62）** · 当前交接 [notes/p7/HANDOFF-2026-09-23.md](notes/p7/HANDOFF-2026-09-23.md)。窗口 2（`6afa077f`）：**门 5 PASS**（五块全 ≥ BASE、0 新 crash），门 3 严格读数 33/36——三例 Iris 光影包在 monolith 上同样不逐位稳定（ID-P7-62 分布判据下 36/36）。codex 收官审查的修复、spawn 冷启动心跳（协议修订 2）、1:1 blit 最近邻已落地（ID-P7-60/61/62）；终局窗口 3 在最终 APK 上复跑门 3 / 门 5。
## 1. 出口门总览（CONTRACT-P7 §8 的 9 项分母）
@@ -17,8 +17,8 @@
| 5 | OQ-8 反射归档 `storageBlocks` | ✅ | C |
| 6 | OQ-10 `kCapResidentSubData` 按 server 表发布 | ✅ | C |
| 7 | verify × split（门 2） | ✅ | B4 集成树 verify build：unit 2439、integration-verify 1152、integration-verify-split 1086，全绿；V1/V1 r2 负控与 8 verify trace 证据仍有效 |
| 8 | 真机 ssim 1.0（门 3，分母 36） | 🔄 | p7w5 OpenRA 27/27 golden；p7w6 bsl-esc-menu DirectVulkan inproc/spawn 6/6 且图像 SHA 与 monolith 相同；DirectGLES × TCP 38 例窗口矩阵 16/29 pass、8 idle timeout、2 visual failure、3 missing result。Photon / D24 两项错图已由同 APK DirectGLES monolith 复现；36 例 DirectVulkan 三遍、同会话 monolith 对照和 M3 后 APK 回归待跑 |
| 9 | CTS 五块 AFTER ≤ 0.5 pp（门 5） | ⏳ | `$BASE` 已取（`notes/p7/device-window-1/CTS-base/`）；AFTER 在 wave 4 |
| 8 | 真机 ssim 1.0（门 3，分母 36） | 🔄 | 窗口 2（`6afa077f`，reboot-clean、pinned）：OpenRA 四臂 1.000000；严格读数 33/36，三例 Iris（sundial-lite / bliss / derivative d24.4.14）monolith 同样不逐位稳定（9/9、11/18、9/9 张不同图，derivative 是光影包自身同一 dispatch 内的 imageLoad/imageStore 竞态）→ ID-P7-62 分布判据；create-instancing 1:1 LINEAR blit 偏差已修；终局窗口 3 复跑 |
| 9 | CTS 五块 AFTER ≤ 0.5 pp（门 5） | ✅ | 窗口 2 inproc × DirectVulkan：shader-image +4.35 pp、texture +0.96 pp、ssbo / dsa / packed-pixels 持平，0 新 crash；UBO（GTF）不在本 glcts，记 unrun；终局窗口 3 复核 |
**40% 检查点（§8 中点）已过：6/9**，不触发重定基线。G1 全程恒等（pull `.text` `0xa52203`、符号 0/0）；census 79 站点 / 0 未标；棘轮 186 → 173 → **171**（ratchet88：`p7-magma` 余 86 全标 `# P13`，门 4 关闭，ID-P7-55）。
@@ -55,6 +55,9 @@
| F2 | Ph 余项：PH-1 (3)(4) 每会话闩、PH-6 事件通道弃投闩、PH-7 (5) fork 前认证 + 预认证有界 + 退避、fuzz 三臂进 CI；PH-4 两个回归（零尺寸层、`R8 == 0`）与 ID-49 回读在线内修掉 | F2 线 29 提交 + 集成 2 跟进（ID-P7-57） |
| 门 5 修复 | 超槽 ReadPixels 切带、深度/模板 resolve 臂由设备探针选（+ POST FIXED 行）、单采样深/模板 blit 改 copy、越界图像单元绑占位 | ID-P7-58 |
| 窗口 2 工装 | 门 3 / bsl / CTS AFTER 一条命令、可续跑、共享设备锁；判读按合同公式、五块必齐、同一 boot_id | ID-P7-59 |
| codex 收官修复 | 越界 / 空图像单元 nullDescriptor 或按单元私有占位、PH-5 最小编码宽度、闩 pop 前再查、探针按设备缓存、判读器硬编码 §7.2 常量 | ID-P7-60 |
| spawn 冷启动心跳 | server 执行 surface 操作期间发 `SurfaceProgress`，client 预算量沉默（封顶 120 s）；控制协议修订 2 | ID-P7-61 |
| 门 3 判读 + blit | monolith 不稳定的 case 用最近邻分布判据、monolith ×5；1:1 LINEAR blit 走最近邻 | ID-P7-62 |
## 3. 真机（Redmi 2f7cbe2e，Adreno 830）
@@ -66,13 +69,12 @@
| 工作 | 状态 |
|---|---|
| 设备窗口 2（p7w7） | 最终功能 APK 构建 → reboot-clean → 门 3（36 例 × monolith ×1 + inproc ×3 + spawn ×3 + `RUN_AHEAD=0` ×1）→ bsl 映射 / `wbuf[]` → CTS AFTER 五块 → 判读 |
| 终局设备窗口 3（p7w8） | 最终 APK → reboot-clean → 门 3（monolith ×5 + inproc ×3 + spawn ×3 + `RUN_AHEAD=0` ×1）→ bsl → CTS AFTER → 判读；验证 create-instancing 回到 monolith 图、Adreno robustness2 nullDescriptor |
## 5. 下一步
1. 窗口 2 判读：门 3（臂内三遍逐位、与同会话 monolith 差 ≤ 0.0005、OpenRA 1.0）与门 5（每块 ≤ 0.5 pp、新 crash = 0）。
2. P7 收官异模型整体审查（codex，ID-66）。
3. P7 收官文档（ROADMAP / 本页 / 交接）。
1. 窗口 3 判读 → 门 3 / 门 5 收官，P7 出口门 9/9。
2. P7 收官文档（ROADMAP P7 行、本页、交接）。
## 6. 阻塞 / 需要人
docs/Disaggregated/ROADMAP.md
+1 -1
View File
File diff suppressed because one or more lines are too long
docs/Disaggregated/notes/handoff/review-p7-closeout-codex.md
+51
View File
@@ -0,0 +1,51 @@
# P7 收官异模型审查（codex，2026-09-23，`6afa077f`）· 集成者分诊
codex 结论：yes-with-fixes。原文附后（`codex-review.md`）。
| # | 发现 | 分诊 | 去向 |
|---|---|---|---|
| 1 | 暂存纹理：对端在已声明的大层末尾写 4 字节，server 按终点 `resize` 零填到整层（16384² RGBA8 ≈ 1 GiB） | **记债，不修**：上限是设备限制下的整层，已认证对端用合法 `glTexStorage` 也能要到同量内存（ID-P7-3 威胁模型 = 未认证远端，已由令牌 + fork 前认证关闭）；稀疏存储是重设计 | CONTRACT-P7 §12 |
| 2 | 越界图像单元共用可写占位：单元 A 的写经 barrier 后可被单元 B 读到（GL 要求写丢、读 0） | **修**：有 `VK_EXT_robustness2` nullDescriptor 时绑空描述符（语义精确），否则每 (binding, unit) 私有占位 | cf-magma |
| 3 | PH-5 按 `sizeof(Element)` 限 count，`Vector<String>` 紧凑编码的合法归档（多个短名 + 空尾向量）被拒 → split 下丢合法程序产物 | **修**（真回归）：按该类型最小编码宽度限 count | cf-core |
| 4 | 门 3 判读信 runner 自报的遍数 / 臂 / 分母，`--repeat 1` 也能 PASS | **修**：判读器硬编码 §7.2 常量（≥3 遍、四臂齐、规范 36 例集合） | cf-reducer |
| 5 | CTS `Pass/(Pass+Fail)` 看不见 Pass→NotSupported 的流失 | **修**：BASE Pass → AFTER 非 Pass/Fail 计入非通过并列出，未裁定即 FAIL；字面公式仍打印 | cf-reducer |
| 6 | 闩：控制线程在 apply 线程每记录检查之后闩住，apply 还会再弹一条；`appliedSeq` 对闩住的记录也前进 | **修前半**（每次 pop 前再查一次）；后半记债 | cf-core / §12 |
| 7 | 深度 resolve 探针判定函数级 static，同进程换物理设备复用旧判定 | **修**：按物理设备身份缓存 | cf-magma |
| — | 跨臂 PNG 不同只报告：需收官时逐例裁定 | 判读器改为「未裁定即 PASS-NEEDS-ADJUDICATION」 | cf-reducer |
| — | 门 1 数字取自 M3、最终树未见完整门 | 最终树 `431bda67`（+ 仅文档到 `6afa077f`）已跑 v2 全门（`~/w7/logs/int2b/gate.log`）；修复轮合入后再跑一次 | 记录 |
---
## codex 原文（`6afa077f`）
## P7 closeout review
**Verdict: yes-with-fixes.** Gates 3 and 5 turning green would not, by themselves, justify closeout at `6afa077f`. The findings below include two peer-facing correctness or resource failures and two ways the window reducer can report green without proving the promised result.
I reviewed the `14e1c8b9..6afa077f` comparison and files fetched at `6afa077f` read-only. I did not build or run tests. The local shell did not return commands, so the source review used the repository connector.
### Findings
1. **Major — a tiny texture upload can allocate a gigabyte in the session child.** [StagedTextureStore.h:673](../../../../MobileGL/MG_Remote/Server/StagedTextureStore.h:673) grows `Bytes` through the *end offset*, while [the new bound](../../../../MobileGL/MG_Remote/Server/StagedTextureStore.h:196) limits dimensions and arithmetic, not staging memory. On a server allowing a 16384×16384 RGBA8 level, a peer can declare that level and send a four-byte slab at its last pixel; the computed end makes `resize` zero-fill about 1 GiB. Repeating this can exhaust memory or kill the child and put the supervisor under system memory pressure. PH-4 raw-peer tests exercise out-of-bound records; this slab is **within** the declared bound.
2. **Major — invalid image stores can become observable through a shared placeholder.** [WirePlaceholderImages.inc:77](../../../../MobileGL/MG_Backend/DirectVulkan/Renderer/WirePlaceholderImages.inc:77) keys writable storage placeholders by format and target, and [line 173](../../../../MobileGL/MG_Backend/DirectVulkan/Renderer/WirePlaceholderImages.inc:173) clears them before descriptor use. Two invalid image units of the same shape therefore bind the same Vulkan image. A shader that stores through invalid unit A and, after an image memory barrier, loads invalid unit B can see A’s value; GL requires the invalid store to be discarded and the load to return zero. The new scenario loads its invalid source **before** storing to its invalid destination, so it cannot catch this alias. CONTRACT-P7 §12 records sharing as a debt; its classification is too mild for this within-dispatch correctness failure.
3. **Major — PH-5 can reject an archive produced by its own encoder.** [ProgramArtifactsCodec.cpp:309](../../../../MobileGL/MG_State/GLState/ProgramState/ProgramArtifactsCodec.cpp:309) requires remaining serialized bytes to cover `count * sizeof(Element)` before decoding every vector. A `Vector<String>` element can serialize as an eight-byte length plus a short name while occupying roughly 32 bytes in the vector. A valid `LinkArtifacts` archive with, for example, ten short [XFB interface names](../../../../MobileGL/MG_State/GLState/ProgramState/ProgramArtifacts.h:593) and empty later vectors can fail decode solely because its compact wire form is smaller than its in-memory form. The round-trip test uses two longer names; the PH-5 negative controls test malicious counts, not this valid compact case. A split client then loses a valid program artifact that monolith can use.
4. **Major — gate 3 can report PASS without the specified repetitions or control arm.** [60-reduce.py:182](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:182) accepts the repeat count written by the runner; [line 251](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:251) checks against that count, not three. `30-gate3.sh --repeat 1` can thus yield PASS for 36 cases after one inproc and one spawn image each. [The `RUN_AHEAD=0` arm is optional to the reducer](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:279), and [the denominator check](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:298) tests only the number 36, not the canonical case set. The default runbook uses the intended inputs, but its green verdict does not prove they were used; reducer self-tests do not enforce these contract constants.
5. **Major — ID-P7-59’s CTS rate can hide loss of supported cases.** [60-reduce.py:410](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:410) implements the agreed `Pass/(Pass+Fail)` formula, but [line 525](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:525) only warns when `NotSupported` changes. If 123 of the 124 baseline-passing SSBO cases become `NotSupported` and one still passes, the block remains 100% by that formula, has no new crash, and can be marked PASS. This is a flaw in the **recorded gate criterion**, rather than a mismatch between code and contract. The reducer even lists Pass-to-other-status regressions but does not gate on them. The CTS tests cannot catch a loss that their verdict rule explicitly accepts.
6. **Minor — the latch’s “no further record” guarantee has a control/apply race.** [ServerLoop.cpp:673](../../../../MobileGL/MG_Remote/Server/ServerLoop.cpp:673) checks the latch before the batch and [line 711](../../../../MobileGL/MG_Remote/Server/ServerLoop.cpp:711) after applying each record. If the control thread latches a malformed SurfaceOp just after that latter check, the apply thread can pop and execute the next queued command before checking again. Separately, [SessionRings.h:465](../../../../MobileGL/MG_Remote/Transport/SessionRings.h:465) advances `appliedSeq` even when the record’s callback latched a refusal, so a waiter can briefly see that record as applied before the fault reaches it. The batch negative controls latch on the apply path; they do not arrange this cross-thread ordering. The child still exits, limiting the impact to that session.
7. **Minor — the depth-resolve verdict belongs to the first device in a process.** [VulkanRenderer.cpp:15840](../../../../MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.cpp:15840) stores a choice derived from `this` device in a function-static value. If inproc tears down a renderer and initializes another physical device or changed driver environment in the same process, it reuses the first verdict and skips the new device’s probe. The current device gate and host controls start with one device, so they do not exercise that lifetime.
### Gate evidence and decisions
The notes substantiate gates 2–7 on their stated host scopes, with **gate 4 achieved by reclassifying 86 still-linked symbols as `# P13`**, not by removing all 101 original Magma references. That deferral is explicit and defensible while the disaggregated monolith reference arm remains required. The closeout should preserve that wording.
Gate 1’s displayed Magma counts in [CURRENT_STAGE_STATUS.md:13](../../../../docs/Disaggregated/CURRENT_STAGE_STATUS.md:13) are from M3. F2 has a later full local gate, while the gate-5 review records targeted tests for subsequent changes. The notes do not establish a full gate run on the final `6afa077f` tree. Gates 3 and 5 are correctly shown as pending.
ID-P7-59’s **report-only cross-arm SHA** rule follows CONTRACT-P7 §7.2, but [the reducer can PASS a stable split-only pixel difference](../../../../docs/Disaggregated/notes/p7/device-window-2/tools/60-reduce.py:284) when its SSIM change stays within 0.0005. Any such mismatch needs explicit image-diff adjudication at closeout; a green summary alone is insufficient.
**Must fix before closing:** bound total staged texture allocation; make invalid image writes truly discard without aliasing loads; preserve valid compact artifact archives; make gate 3 enforce three repeats, the required arms, and the named 36 cases; gate or adjudicate Pass-to-NotSupported CTS regressions; and run the full host gate on the final code after those fixes. Then assess the device-window gates 3 and 5 on that same code.
docs/Disaggregated/notes/p7/INTEGRATOR-DECISIONS-P7.md
+3
View File
@@ -62,4 +62,7 @@
| ID-P7-57 | 2026-09-23 | **F2 落地：Ph 余项全做完（PH-6、PH-1 (3)(4)、PH-7 (5)、fuzz 三臂），集成者审查 = land。** 基底四提交（Luna 审查 land）只跑过 49 条定向测试；全车道 + 主机 CTS 抓出 PH-4 两个真缺陷——零尺寸 `glTexImage*` 被判 `Fatal{ProtocolCorruption,"ResourceRespecify.ExtentCarrier"}`（dEQP 每例 reset 都发，inproc 下**每个** KHR 用例 abort）、`TextureInternalFormat::R8 == 0` 被当「未声明」（设备 dsa 块 11 个新 crash）——另 PH-3 把 ID-49「DstSize≠tight 读 tight」改成了拒绝；三者在 F2 线内各修一次（空层修复 + f2-latch 片 A）。PH-1：只有 spawn/TCP 会话子进程武装的每会话闩（首错胜出、未武装 = `SessionFail` 原样、inproc 保持 Fatal），DrainRing 入口 + 每记录后查闩、`_exit(75)`、supervisor 照常服务下一连接；64 处闩调用 53 行有原始对端负控、8 处论证不可达（`ph_latch_sites.py --self-test`）。PH-6：drop-with-latch、`MOBILEGL_IPC_EVENT_WAIT_MS`（默认 2000）。PH-7 (5)：supervisor 在 fork **前**读 Hello、先验令牌（未认证只回 `Refuse{Authentication}`，不泄漏指纹）、预认证队列按地址共享 + 退避（`MOBILEGL_IPC_PREAUTH_{MS,MAX}`、`AUTH_BACKOFF_{AFTER,MS}`）。三臂 fuzz 全进 CI 车道。**流程裁定**：F2 类「server 字节界」包落地必须跑全车道 + 主机 CTS 子集，定向测试不算门。 | F2 线 29 提交 + 集成 2 个跟进（`TcpLane.EventForfeitPeer` 取 `mobilegl-tcp` 锁、`EventForfeitPeerTest` 钉 headless EGL）；审查 `notes/handoff/review-f2.md` | `FatalFunnel.{h,cpp}`、`ServerMain.cpp`、`PreAuthGate.h`、`ServerSession.cpp`、`ServerLoop.cpp`、`PipeWireCodec.cpp`、`PipeApplier.cpp`、`StagedTextureStore.h` |
| ID-P7-58 | 2026-09-23 | **门 5 的三个 inproc × DirectVulkan CTS 缺陷修掉（窗口 2 预演 dry run 发现）。** (1) `direct_state_access.renderbuffers_storage`：256×512 RGBA/FLOAT 恰 2 MiB，比回复槽大 16 字节 → `Fatal{ReplyTooLarge}`（ID-47 旧债）：客户端把超槽的 ReadPixels 切成行带（单行超槽切行内片），每带一条普通 `read_pixels`、tight DstSize，server PH-3 界不变——CONTRACT-P6 归 P9 的「分块回读」ReadPixels 部分提前还；(2) `renderbuffers_storage_multisample`：Adreno 830 的无 draw render-pass 深度/模板 resolve 不写目标 → **运行时探针**（六格式、生产同一 render-pass 臂、对照组 = 生产着色器臂、对照不过则 inconclusive）选臂 + POST「Known Driver Bugs」FIXED 行；包最初按 Qualcomm vendorID 选臂，按用户 2026-08-22 规则（后端限制一律 POST 探针、不按驱动名硬编码）返工；顺带单采样深/模板 1:1 blit 改 copy（Adreno 深度格式无 BLIT_DST、单面 blit 会踩另一面）；(3) `shader_image_load_store.incomplete_textures`：图像单元指向纹理没有的 level/layer 时 wire 臂 `Fatal{UnmigratedVerb,"Magma:image-view-window"}` → 按 GL 4.6 §8.26 绑存储占位（读 0、写丢）。主机 CTS 三例 inproc 全 Pass（monolith `incomplete_textures` 仍 Fail = BASE）；红米 msrbo 3/3。 | 审查 `notes/handoff/review-g5.md`；`docs/Disaggregated/notes/p7/g5-msrbo.md` | `EmitTables.{h,cpp}`、`WireDepthResolveProbe.{h,cpp}`、`WireDepthResolveArm.h`、`DriverBugProbes.cpp`、`UniformManager.cpp`、`VkTextureManager.cpp`、`WirePlaceholderImages.inc` |
| ID-P7-59 | 2026-09-23 | **设备窗口 2 工装与判读裁定。** `docs/Disaggregated/notes/p7/device-window-2/tools/`（= `~/w7/notes/p7/window2/`）一条命令：构建 → reboot-clean preflight → 安装 → 门 3（36 例 × monolith ×1 + inproc ×3 + spawn ×3 + inproc `RUN_AHEAD=0` ×1）→ bsl 映射/wbuf → CTS AFTER 五块 → 判读 → 复原；可续跑、共享设备锁。**裁定**：门 3 的「三遍逐位相同」按臂内判；inproc/spawn/monolith 跨臂同图只报告、不同则 WARN、不设门；同一 boot_id 贯穿（否则 INVALID-SESSION）；CTS 每块率 = Pass/(Pass+Fail)（NS、CompatibilityWarning 不入分母），缺块 / 空读 / 子集一律不给 PASS，新 crash = 0 单独硬红；UBO（GTF）块记 unrun。跑器修复：POSIX 主机可起跑、每遍先清上一遍产物（旧行为会把死掉的一遍归档成通过且逐位相同）。 | window-2 工装 6 提交；dry run 证据 `device-window-2/dry-run/` | `run_android_retrace_local.py`、`60-reduce.py` |
| ID-P7-60 | 2026-09-23 | **P7 收官异模型审查（codex，`6afa077f`）= yes-with-fixes，分诊后修掉五项、记债两项。** 修：越界 / 空存储图像单元有 `VK_EXT_robustness2` nullDescriptor 时绑空描述符（读 0、写丢，GL §8.26 精确），否则按 (形状, 单元) 私有占位（上限 384）——原共享占位让单元 A 的写被单元 B 读到；PH-5 改按元素最小编码宽度限 count（原 `sizeof(T)` 会拒掉编码器自己产出的紧凑合法归档，如多个短 XFB 名）；DrainRing 每次 pop 前再查闩（控制线程闩住后的窗口收窄到 check→pop）；深度 resolve 探针判定按物理设备身份缓存；窗口 2 判读器硬编码 §7.2 常量（≥3 遍、四臂齐、规范 36 例集合）、CTS 的 Pass→NotSupported 流失计入非通过（裁定过的出分母）、跨臂不同图未裁定即 PASS-NEEDS-ADJUDICATION。记债：对端在已声明大层末尾写几字节会按整层零填（上限 = 设备限制，已认证对端用合法大纹理也能要到同量，不在 ID-P7-3 威胁模型内）；`SessionRings` 对闩住的记录也前进 `appliedSeq`。 | 分诊 `notes/handoff/review-p7-closeout-codex.md`；修复 `p7/int3` | `WirePlaceholderImages.inc`、`WirePlaceholderKey.h`、`ProgramArtifactsCodec.cpp`、`ServerLoop.cpp`、`WireDepthResolveArm.h`、`60-reduce.py` |
| ID-P7-61 | 2026-09-23 | **spawn 冷启动：client 的回复预算改量「沉默」而不是「操作时长」，控制协议修订 1 → 2。** `6afa077f` 的 CI 有一条 spawn retrace 腿「ALIVE BUT SILENT，20 s 内没有 CreatePbufferSurface 回复」；同签名在 F2 之前（5 s 预算时 11/77、17/77 腿）就有，本地 4,820 次拉起 0 复现，模拟 21 s 冷拉起与 CI 逐行同形——根因是冷 runner 上首次 `eglInitialize` 装载 libLLVM/libgallium ≈ 20 s，而不是丢唤醒。修法：server 在 apply 线程执行 surface 操作期间每 250 ms 发 `SurfaceProgress{seq, elapsedMs}`，client 每收到一个就重置预算（从发送起封顶 120 s）；冻住的 server 照样按名超时；≥1 s 的控制分派记日志。red-once：3 s 拉起对 1 s 预算修前 10/10 红、修后 30/30 绿。**wireFingerprint 变，设备 server 随 APK 重部署。** | `p7/spawnhang` `307535dc` | `ServerLoop.cpp`、`ServerMain.cpp`、`ClientSession.cpp`、`protocol.fbs` |
| ID-P7-62 | 2026-09-23 | **门 3 判读裁定：monolith 自身不逐位稳定的 case 改用分布判据；create-instancing 的 1:1 LINEAR blit 偏差修掉。** 窗口 2（`6afa077f`）门 3 严格读数 33/36：sundial-lite、bliss、derivative d24.4.14 的 split 三遍各三张不同图。同会话设备追查：monolith 也不稳定（sundial 9/9 不同、derivative 9/9、bliss 11/18），两臂变动的是同一批像素（Jaccard 与 split-vs-split 基线相当），lockstep / FIF=1 都不稳定，主机 syncval 0 hazard；derivative 的根因在光影包自身（同一 dispatch 内对同一图像 `imageLoad`/`imageStore` 的边框竞态）。**规则（CONTRACT-P7 §7.2 修订）**：同会话 monolith ≥3 遍不逐位相同的 case，split 的逐位条款换成「每遍对每个 monolith 读数 \|Δssim\| ≤ 0.0005，且每个 split 遍对最近的 monolith 遍：差异像素 ≤ 1.25 × D_mm + 32、最大通道差 ≤ 1.5 × Δ_mm + 8（D_mm / Δ_mm 取 monolith 留一最近邻的最大值）」，monolith 臂改跑 ×5；按窗口 2 的实拍图模拟，×5 下 sundial / bliss / derivative 通过率 100% / 99.9% / 100%、纯噪声对照 100%，窗口 2 加同会话追查的 monolith 读数重判 36/36；monolith 稳定的 case 仍逐位严格。create-instancing：split 两臂逐位稳定但与 monolith 差 712 px ±1 LSB——wire 臂把 1:1 `GL_LINEAR` 默认帧缓冲 blit 走着色器 + 线性采样，Adreno 采样位置微偏；未缩放时改最近邻（结构性单测，lavapipe 看不到）。 | 追查 `~/w7/logs/g3det/{DEVICE,HOST,VERDICT}.md`；终局窗口读数见 §7.2 | `WireColorBlit.inc`、`30-gate3.sh`、`60-reduce.py` |
| ID-P7-19 | 2026-09-22 | OpenRA 真机分歧改判为 **wire 臂的 GPU 时序竞态**（冷驱动缓存 = 慢 pipeline 创建 → 最终帧回读在最后几批 draw 完成前采样），归 wave 2-B 第 0 片；主机 red-once 用 pipeline 创建延迟旋钮复现；真机验收 = 三次 `pm clear` 冷跑 1.0。F1 保留（机制正确）但不再被当作分歧原因。 | E7：`pm clear` 三遍 0.976493989 / 14658 逐字相同、热跑 1.0、冷 monolith 1.0、`FRAMESINFLIGHT=1` 一绿一红；两臂 client/server 日志逐行相同；diff 只缺最后画的对象。 | `WireFramebuffer.inc`、`VulkanRenderer.cpp`、`F1-verify/README.md` |