[MG_Backend, MG_Remote, MG_Impl, MG_State] (Disaggregated): P5c hd - sinks and twins resolve by the handle the record carried

A split-only verb-handle workspace in MGPipeApplierState (written by the sinks before
dispatch, read by the backend within the same verb) carries the record's handles to the
backend entries whose shared function-table signatures cannot grow them without moving
G1. OnBlit resolves ReadFbo/DrawFbo through the FBO twin table by handle (the named arm
of BlitFramebuffer, a loud refusal when the backend does not consume it) and the split
path's ScopedBlitBindings rebinding is deleted; CopyTex resolves MGPCopyFromFramebuffer::Dst;
the mip descriptor check resolves MGPMipPlan::Res; the indirect families resolve their
buffer handles from the records and read the bytes from the server staged shadow with
RequireStagedCoverage. EnsureBufferResourceForHandle answers HasDefinedContent from
Desc.HasDefinedContent OR the staged coverage set (the streaming idiom defines content
through subdata with no new descriptor). The minting GetOrCreate(StatePtr), HandleOf and
the death switch's lifetime-id arms take Fatal{RoleViolation, MGPipeSlots} from the apply
thread, as do the three MGPipeSlots() entry points; the frontend BufferObject legacy
accessors take Fatal{RoleViolation, buffer-legacy-arm}; Magma's four caps reads go to the
server's own backend and the client-mirror fallback arm is a named refusal.

Evidence: unit 2156/2156 (incl. 9 new RemoteF1 + 10 new RemoteGuards death tests pinning
the four Fatal names); monolith smoke green; six production mutations each turned their
named test red and were restored; c1f_redcheck M5 RED then RESTORED GREEN. The mip
descriptor check overlaps tx and is coordinated at the merge (tx's sync rekey wins the
sync body, this handle resolution wins the identity check). CONTRACT-P5C section 3.

MobileGL/MG_Remote/Client/EmitTables.cpp

@@ -734,42 +734,19 @@ namespace MobileGL::MG_Remote::Client {
                                 nullptr, 0, nullptr);
         }
 
-        // DSA blits use the existing bound-form backend while the verb barrier holds.
-        // Only client shadow bindings change here; no driver call or frontend pointer crosses
-        // the wire. Bind() bumps their versions on entry and restore, so the next ordinary
-        // verb republishes the application's original bindings even if no GL bind intervenes.
-        class ScopedBlitBindings {
-        public:
-            using Fbo = MG_State::GLState::FramebufferObject;
-            ScopedBlitBindings(const SharedPtr<Fbo>& read, const SharedPtr<Fbo>& draw)
-                : m_read(MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Read)),
-                  m_draw(MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw)),
-                  m_savedRead(m_read.GetBoundObject()), m_savedDraw(m_draw.GetBoundObject()) {
-                m_read.Bind(read);
-                m_draw.Bind(draw);
-            }
-            ~ScopedBlitBindings() {
-                m_read.Bind(m_savedRead);
-                m_draw.Bind(m_savedDraw);
-            }
-            ScopedBlitBindings(const ScopedBlitBindings&) = delete;
-            ScopedBlitBindings& operator=(const ScopedBlitBindings&) = delete;
-        private:
-            BindingSlot<Fbo>& m_read;
-            BindingSlot<Fbo>& m_draw;
-            SharedPtr<Fbo> m_savedRead;
-            SharedPtr<Fbo> m_savedDraw;
-        };
-
         void EmitBlitNamedFramebuffer(
             const SharedPtr<MG_State::GLState::FramebufferObject>& read,
             const SharedPtr<MG_State::GLState::FramebufferObject>& draw,
             GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0,
             GLint dstY0, GLint dstX1, GLint dstY1, GLbitfield mask, GLenum filter) {
             ClientSession& session = RequireSession("BlitNamedFramebuffer");
-            const ScopedBlitBindings bindings(read, draw);
-            // The frontend's first validate preceded this temporary lowering. Refresh both
-            // emitted framebuffer state and the existing BARRIER-PULLED binding fields now.
+            // P5c (hd, CONTRACT-P5C §3.3): the scoped rebind of the client's own read/draw
+            // binding slots is DELETED. It existed only to stage values for the server's
+            // binding-slot read, and that read is gone: the sink resolves both framebuffers
+            // from the record's handles. The validate still refreshes both framebuffers'
+            // emitted state (their Named set_framebuffer_state records), which is now the
+            // only description the server syncs from. No driver call or binding change
+            // happens on the client.
             MG_Pipe::MGPipeValidateForVerb(MG_Pipe::MGPipeVerb::BlitNamedFramebuffer);
             BeforeReadOnlyVerb();
             MG_Pipe::MGPBlit record{};