[MG_Remote, MG_Impl, MG_Backend] (Disaggregated): P5c ev - SEG_EVENT is the only reverse channel

The three reverse MGPipeCallbacks entries become the SERVER session's producer callbacks
(Reserve + fill the head + copy the payload inline + PublishEvents; the host pointer never
reaches the wire), installed at Accept and uninstalled at Close, a second installation
over a claimed entry being Fatal{RoleViolation, callback-double-install}. Producers wired:
buffer writeback (the mapped bytes are copied into the record's inline tail instead of a
raw pointer in MGPBlobRef::Offset), GPU-written (Magma's three direct MarkGpuWritten
bypasses are routed through the callback), surface-changed (the backend posts
MGPSurfaceInfo; the client consumer replays the allocate/format writes against
pDefaultFramebufferInfo on the GL thread, where R3's ownership always was), and
kEventGlError = 4 for PipeInputs::RecordError (ordering stays P9's).
PipeInputs::InvalidateCompileEnv's forward is deleted with an active transport - R-12's
caps re-publication already does its job. The consumer's monolith guard is replaced by
the three segment arms (kSegEvent resolves through the session's SegmentTable;
kMGHostSpanSegNone is monolith-only and Fatal{ProtocolCorruption} on the wire; anything
else the same), and DrainEventRing calls the client consumers BY NAME, never through the
global table. Overflow is Fatal{EventRingOverflow} - P5c's events are lossless, P9 owns
the drop policy. Monolith arms keep the pre-P5c expressions character for character.

Evidence: unit 2139/2139 (incl. the new kEventGlError round-trip), integration-split
107/107, monolith GPU subset 24/24; negative control executed - a writeback blobref
reverted to the raw-pointer shape turns DirectGLES.Split.AtomicCounterScenario.
SubDataAfterDispatchSurvivesAnImmediateReadback red with Fatal{ProtocolCorruption,
OnBufferWriteback.Seg}. CONTRACT-P5C sections 1, 4.

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp

@@ -11,6 +11,10 @@
 #include "MG_Backend/DirectVulkan/DirectVulkanResourceState.h"
 #include "MG_State/GLState/Core.h"
 #include <MG_Pipe/PipeInputsSwitch.h>
+#if MOBILEGL_PIPE_PUSH
+// P5c ev: the GPU-write announcement routes through the reverse channel (R2).
+#include <MG_Impl/Pipe/ResourceTracker.h>
+#endif
 #include "MG_State/GLState/ProgramState/ProgramObject.h"
 #include "MG_State/GLState/TextureState/TextureObject1D.h"
 #include "MG_State/GLState/TextureState/TextureObject2D.h"
@@ -1072,7 +1076,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // changed a byte of it.
         bufferObject->EnsureGpuResidentStorage();
         if (imageBinding.Access != GL_READ_ONLY) {
+#if MOBILEGL_PIPE_PUSH
+            // P5c ev (R2, CONTRACT-P5C §4.2): the announcement goes through the reverse
+            // channel - the apply thread may not poke the client object directly.
+            MG_Pipe::MGPipeAnnounceBufferGpuWritten(bufferObject);
+#else
             bufferObject->MarkGpuWritten();
+#endif
         }
 
         BufferSlice slice{};
@@ -1228,7 +1238,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // results are visible without a readback path, exactly as for a capture buffer.
         bufferObject->EnsureGpuResidentStorage();
         // ... and the read that follows has to wait for this draw or dispatch to retire.
+#if MOBILEGL_PIPE_PUSH
+        // P5c ev (R2, CONTRACT-P5C §4.2): through the reverse channel, not a direct poke of
+        // the client object from the apply thread.
+        MG_Pipe::MGPipeAnnounceBufferGpuWritten(bufferObject);
+#else
         bufferObject->MarkGpuWritten();
+#endif
 
         BufferSlice slice{};
         if (!m_bufferManager->AcquireResidentSlice(BufferKind::ShaderStorage, bufferObject, slice) || !slice.IsValid()) {