Merge branch 'feat/disaggregated' into p5/v1

# Conflicts:
#	MobileGL/MG_Test/Wire/CMakeLists.txt

.github/workflows/test.yml

@@ -1074,57 +1074,32 @@ jobs:
       # Split entries SKIP and ctest reports green whatever the knob says, so an unconditional
       # control would be red for the whole of P5 for a reason that is not a defect.
       #
-      # So the expected state is DERIVED rather than assumed, from the same fact the lanes derive
+      # So the expected state is DERIVED FROM BEHAVIOUR rather than assumed. The first version read
-      # it from: MG_IntegrationTest/CMakeLists.txt puts MGITEST_REMOTE_CLIENT_PRESENT=1 into the
+      # MGITEST_REMOTE_CLIENT_PRESENT out of the generated *_tests.cmake, which was a restatement of
-      # Split entries' ENVIRONMENT exactly when MG_Remote carries no c0 signature stub, and that
+      # the CMake source probe review finding M-1 falsified; the arming condition is a runtime fact
-      # string is in the generated ctest include files this artifact ships. When it is there the
+      # inside each test process (MG_Config::Transport, ClientSession::Active() and
-      # controls MUST fire; when it is not, the step says so loudly and does not pretend.
+      # ImplementedVerbCount(), read by Harness/SplitRuntimePeek), so the only honest way to ask it
+      # from a shell is to look at what the entries DID. When entries passed, the controls MUST
+      # fire; when every one of them skipped, the step says so loudly and does not pretend.
+      #
+      # THE BODY OF THIS STEP IS scripts/ci/split_negative_controls.sh, and the move is the point
+      # rather than tidiness. A `run:` block executes nowhere but on a runner, so these lines were
+      # unreviewable and untestable: when the wave-1 cross-family review said they were broken,
+      # CONFIRMING it needed a hand-made copy of them (wave1-codex-verify.md 8), and a copy is not
+      # the thing. scripts/ci/control_smoke_test.sh now drives the very file this step runs.
+      #
+      # What that smoke test pins, and what ID-46 finding 8 found missing: each control asserts its
+      # OWN failure reason. A non-zero ctest exit used to be enough, so a timeout, a setup abort or
+      # any unrelated assertion printed "turned N selected entries red, as it must" and this step
+      # went green. The arming run's `|| true` had the matching defect - it counted a case that ran
+      # and FAILED as evidence the lane was live, so the controls could be measured against a
+      # baseline that was already red.
       - name: Negative controls - the verb barrier and the persistent-map push must be load-bearing
         working-directory: build-split
         env:
           MOBILEGL_ITEST_REQUIRE_GPU: "1"
-        run: |
+          CONTROL_TMPDIR: ${{ runner.temp }}
-          # THE ARMED STATE IS DERIVED FROM BEHAVIOUR, not from a marker string in the generated
+        run: bash "${GITHUB_WORKSPACE}/scripts/ci/split_negative_controls.sh"
-          # ctest files. The first version read MGITEST_REMOTE_CLIENT_PRESENT out of
-          # *_tests.cmake, which was a restatement of the CMake source probe review finding M-1
-          # falsified; the arming condition is now a runtime fact inside each test process, so the
-          # only honest way to ask it from a shell is to look at what the entries DID.
-          ctest -L integration-split -j 4 --no-tests=error --output-junit "${RUNNER_TEMP}/isplit.xml" || true
-          armed=$(python3 - "${RUNNER_TEMP}/isplit.xml" <<'PY'
-          import sys, xml.etree.ElementTree as ET
-          ran = 0
-          for case in ET.parse(sys.argv[1]).getroot().iter('testcase'):
-              if case.find('skipped') is None and case.get('status') not in ('notrun', 'disabled'):
-                  ran += 1
-          print(ran)
-          PY
-          )
-          echo "split entries that actually ran: ${armed}"
-          if [ "${armed}" -lt 1 ]; then
-            echo "::warning::every DirectGLES.Split. entry SKIPPED, so neither negative control can fire. The arming condition is a runtime fact - MG_Config::Transport, ClientSession::Active() and ImplementedVerbCount(), read by Harness/SplitRuntimePeek - and it becomes true on the commit that lands the last of c1/s1/v1. This step becomes a gate then, with no edit; it is not a green that asserted anything today."
-            exit 0
-          fi
-          run_control() {
-            name="$1"; filter="$2"; shift 2
-            matched=$(ctest -N -L integration-split -R "${filter}" | grep -cE '^ *Test *#[0-9]+:')
-            if [ "${matched}" -lt 1 ]; then
-              echo "::error::${name} selected ${matched} tests; its filter no longer matches anything"
-              exit 1
-            fi
-            if env "$@" ctest --output-on-failure -L integration-split -R "${filter}" --no-tests=error; then
-              echo "::error::${name} left ${matched} split entries GREEN, so the knob it turns is not load-bearing and the gate it controls proves nothing."
-              exit 1
-            fi
-            echo "${name} turned ${matched} selected entries red, as it must"
-          }
-          # E1: R-1's lockstep verb barrier. Without it the client keeps pulling fields from a live
-          # GLContext while the server runs ahead, so the server reads future values.
-          run_control "negative control E1 (MOBILEGL_IPC_VERB_BARRIER=0)" \
-            'DirectGLES\.Split\.(Triangle|ClearThenReadPixels)' MOBILEGL_IPC_VERB_BARRIER=0
-          # E3(a): the persistent-map push. 0 is admitted by ConfigLoader on purpose and is
-          # documented there as this control.
-          run_control "negative control E3(a) (MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0)" \
-            'DirectGLES\.Split\.PersistentCoherentMapScenario' MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0
 
       - name: Upload split lane logs
         if: always()
@@ -1959,37 +1934,25 @@ jobs:
       # The rerun replays into the same case directory, so the good run's images are put aside and
       # restored whichever way the control goes; "Upload actual image" below runs `if: always()`
       # and would otherwise ship the deliberately-wrong run's output under the good run's name.
+      # THE BODY OF THIS STEP IS scripts/ci/retrace_pull_library_control.sh, for the reason the
+      # split lane's control gives: a `run:` block cannot be executed off a runner, so these lines
+      # could not be tested until they ran in CI. scripts/ci/control_smoke_test.sh drives that file.
+      #
+      # Two holes ID-46 finding 8(b) found in this block, both CONFIRMED against the REAL ctest in a
+      # REAL build tree, both closed in the script: it had NO selection guard at all - unlike the
+      # split lane's run_control - so a case/backend regex matching nothing exited 8 through
+      # `--no-tests=error` and was read as "the pull library turned it red"; and only "non-zero
+      # ctest" was checked after the nm identity check, so a loader failure, a missing fixture or a
+      # timeout passed it. The red must now carry run_trace_case.cmake's own sentence.
       - name: Negative control - the PULL library must red this split retrace
         working-directory: build-retrace/tools/trace_replay
-        run: |
+        env:
-          set +e
+          CONTROL_TMPDIR: ${{ runner.temp }}
-          GOOD_OUTPUT="${RUNNER_TEMP}/split-verified-output"
+          PULL_LIBRARY: ${{ github.workspace }}/pull-runtime/build-linux/libMobileGL.so
-          rm -rf "${GOOD_OUTPUT}"
+          FROZEN_LIBRARY: ${{ github.workspace }}/build-linux/libMobileGL.so
-          if [ -d "${{ matrix.case }}" ]; then cp -a "${{ matrix.case }}" "${GOOD_OUTPUT}"; fi
+        run: >-
-          # The pull library, unpacked from build-linux's artifact, over the frozen path every
+          bash "${GITHUB_WORKSPACE}/scripts/ci/retrace_pull_library_control.sh"
-          # case has baked in. It defines no MG_Remote symbol, so ConfigLoader has no transport
+          '${{ matrix.case }}' '${{ matrix.backend }}'
-          # parser and MOBILEGL_TRANSPORT=inproc is accepted and ignored - the exact shape of "the
-          # split lane ran monolith".
-          cp "${GITHUB_WORKSPACE}/pull-runtime/build-linux/libMobileGL.so" \
-             "${GITHUB_WORKSPACE}/build-linux/libMobileGL.so"
-          if nm --defined-only "${GITHUB_WORKSPACE}/build-linux/libMobileGL.so" | grep -q -i MG_Remote; then
-            echo "::error::the control's own library defines MG_Remote symbols, so it is not a pull build and this control would prove nothing"
-            exit 1
-          fi
-          export MOBILEGL_TRANSPORT=inproc
-          ctest -V --no-tests=error --timeout 10800 \
-            -R "^MobileGLTraceReplay\.${{ matrix.case }}\.${{ matrix.backend }}$"
-          control_rc=$?
-          set -e
-          if [ -d "${GOOD_OUTPUT}" ]; then
-            rm -rf "${{ matrix.case }}"; mv "${GOOD_OUTPUT}" "${{ matrix.case }}"
-            echo "restored the verified run's output over the control's"
-          fi
-          if [ "${control_rc}" -eq 0 ]; then
-            echo "::error::a PULL library passed the split retrace. OpenRA scores ssim 1.000000 under a monolith library too (measured), so the picture is not and cannot be this lane's gate - run_trace_case.cmake's transport-resolution assertion is, and it has stopped working. Every green in this job is then a monolith run under a name that says split."
-            exit 1
-          fi
-          echo "the pull library turned the split retrace red, as it must (ctest exit ${control_rc})"
 
       # The refusal census, recorded rather than gated. run_trace_case.cmake already REDS the case
       # on any Fatal{, so reaching here means the count is zero - but the number and the distinct
@@ -2314,6 +2277,21 @@ jobs:
           python3 scripts/gen_pipe_field_ownership.py --check
           python3 scripts/gen_pipe_field_ownership.py --self-test
 
+      # R-16 APPLIED TO THE NEGATIVE CONTROLS THEMSELVES. The split lane's E1/E3(a) controls and the
+      # retrace lane's pull-library control are gates, and until ID-46 finding 8 neither could be
+      # made red by anyone: their bodies were `run:` blocks, which execute only on a runner. Both
+      # bodies now live in scripts/ci/, and this step runs them against a stubbed ctest that
+      # reproduces the finding - a NON-EMPTY selection failing with UNRELATED_CONTROL_FAILURE, and a
+      # case/backend regex matching no tests - and requires each control to report FAILED. The same
+      # stub, failing with the diagnostics the scenarios really emit, must make them report PASSED.
+      #
+      # NO BRANCH GUARD: this asks "do the negative controls still reject a red that is not theirs",
+      # which is a question every branch can answer and none of which depends on the TEMPORARY
+      # feat/disaggregated trigger at the top of this file. It costs a couple of seconds and needs
+      # no build.
+      - name: The split and retrace negative controls still reject a red that is not theirs (R-16)
+        run: bash scripts/ci/control_smoke_test.sh
+
       # A GATE as of P3a (G5). "pool 与延迟释放原样搬" (ROADMAP.md:19) is meant literally: the
       # buffer pool, the deferred-release drain and the three persistently mapped rings move
       # VERBATIM, and ARCHITECTURE.md:515 says why - their retire happens only inside Present, so
@@ -2325,8 +2303,9 @@ jobs:
       # per preprocessor arm, and a push build compiles only FlushPendingRangesFrom while the
       # untouched FlushPendingRangesNow lives in the `#else`. Hashing the pull name alone would
       # protect text no shipping build compiles, so both are hashed - the pull ladder against
-      # BASELINE, the push ladder against a sha pinned in the script at 3e298c9a, because that
+      # BASELINE, the push ladder against a sha pinned in the script at 3dadd4c1 (ID-41), because
-      # one was born in P3a and has no body at the base ref to compare with.
+      # that one was born in P3a and is compared against the reviewed body rather than against the
+      # base ref.
       #
       # Scoped to the disaggregation branch and to a manual dispatch, deliberately: the question
       # is "did these eleven move since P3a started", and BASELINE is P3a's base ref. On dev,
@@ -2336,9 +2315,10 @@ jobs:
       #
       # --self-test is the half that keeps it honest, and it is not optional: a comparison that
       # silently stopped comparing produces exactly the same green as eleven untouched bodies. It
-      # runs six canned controls - eleven bodies extracted, an untouched copy compared equal, an
+      # runs eight canned controls - eleven bodies extracted, an untouched copy compared equal, an
-      # edit OUTSIDE them ignored, and each of the three perturbation targets (ClearBufferPool
+      # edit OUTSIDE them ignored, each of the three perturbation targets (ClearBufferPool and BOTH
-      # and BOTH flush ladders) reported BY NAME - and fails if any of them does not answer.
+      # flush ladders) reported BY NAME, plus the pin-precedence control and a one-token edit to the
+      # pinned ladder compared against the pin - and fails if any of them does not answer.
       # Same shape as gen_pipe.py --self-test above.
       - name: The buffer pool, the deferred-release drain and the rings did not move (G5)
         if: ${{ github.ref == 'refs/heads/feat/disaggregated' || github.event_name == 'workflow_dispatch' }}
@@ -2369,10 +2349,11 @@ jobs:
       # --self-test is the half that keeps it honest and is not optional: a comparison that silently
       # stopped comparing produces exactly the same green as seventeen untouched regions. It runs
       # three positive controls (seventeen regions extracted, an untouched copy compared equal, an
-      # edit OUTSIDE them invisible in all three files) and FOUR negative ones - ClearBufferPool,
+      # edit OUTSIDE them invisible in all three files) and NINE negative ones - ClearBufferPool,
       # FlushPendingRangesNow, RecomputeBackendColorSlots and StageBlocksIntoUnpackRing, each
-      # perturbed on its own and each required to be named BY NAME - and fails if any of them does
+      # perturbed at its HEAD and at its TAIL and each required to be named BY NAME, plus a
-      # not answer.
+      # one-token edit to the pinned FlushPendingRangesFrom body compared against the pin - and
+      # fails if any of them does not answer.
       - name: The unpack ring, the attachment permutation, the D24S8 core and the format caveat did not move (G5)
         if: ${{ github.ref == 'refs/heads/feat/disaggregated' || github.event_name == 'workflow_dispatch' }}
         run: bash scripts/p4a_untouched_regions.sh "${BASELINE}" HEAD

MobileGL/MG_Remote/CONTRACT-P5.md

@@ -144,7 +144,7 @@ These three are the reason `kHasBlob` had to be given an exact meaning (table 0)
 |---|---|---|---|---|
 | 21 | `MapPersistent` (5) | `kReplySlot\|kOptional` | **Returns `nullptr` under split, always** (R-6/R-2.4). Its `const void* seedBytes` companion (`PipeApply.h:917`) therefore never crosses in P5 and needs no carrier. The three frontend sites already tolerate a decline (`BufferObject.cpp:238`, `:603-606`, `:657-660`). Answer travels as `Status = DECLINED` with a zero-length payload. | `map_persistent.decline` |
 | 22 | `ResourceReadback` (52) | `kReplySlot` | Bytes go **server → client** in `SEG_EVENT` via `OnBufferWriteback` (#3), not in the reply slot: the destination is the client's shadow and the size is the resource's, not a fixed slot's. The reply slot carries only completion. **The ordering rule is load-bearing:** the writeback is applied **before** the mutation epoch bumps, never after (`ARCHITECTURE.md:292-294`, `Managers.cpp:2120-2136`). | `resource_readback.done` |
-| 23 | `ReadPixels` (58) / `GetTextureImage` (55) | `kReplySlot` | **`ReadPixels` blocks in P5** and its pixels come back in the reply slot, which is why `ReplyPool::SlotBytes()` is sized from the scenario's largest read rather than guessed. `MGPReadbackInfo` has `DstOffset`/`DstSize` but **no `Seg`** (`MGPipeTypes.h:1197-1206`): ruling — the destination is **always `SEG_REPLY`** in P5, so no `Seg` field is added; the PBO destination (fire-and-forget plus a client-side `MarkGpuWritten`) is b1's and also needs none, because a PBO destination is a resource handle rather than a segment. `GetTextureImage` is **not on P5's reduced path** and its slot stays `Fatal{UnmigratedVerb}`. | `read_pixels.pixels` |
+| 23 | `ReadPixels` (58) / `GetTextureImage` (55) | `kReplySlot` | **`ReadPixels` blocks in P5** and its pixels come back in the reply slot, which is why `ReplyPool::SlotBytes()` is sized from the scenario's largest read rather than guessed. **ID-47: `SEG_REPLY` is 16 MiB, eight slots of 2 MiB, `MaxReplyBytes = 2 MiB − 16 = 2,097,136`** — the canonical sizes are 8/32/16 MiB + 256 KiB (`ProtocolSmokeTest` pins them on the wire, `SessionTest` on the mapping); the largest P5 read is E2's full-surface 640×480 RGBA8 snapshot, 1,228,800 bytes, which the previous 8 MiB pool refused. **A read whose answer would exceed `MaxReplyBytes` is refused at the CLIENT before emission** with `Fatal{ReplyTooLarge, "ReadPixels <w>x<h> <format> <bytes> > <cap>"}` (`ReplySlotPool::RequireReadPixelsFits`, forwarded by `ClientSession::RequireReadPixelsReplyFits`, called once by c1's `OnReadPixels` emitter) — never truncated, never a server-side abort the client cannot name; `Post`'s own refusal stays as the last line of defence. Reads larger than 2 MiB (a 2400×1080 RGBA8 device surface) are a P6 debt, not a bigger pool; §5 has no knob for this segment by design. `MGPReadbackInfo` has `DstOffset`/`DstSize` but **no `Seg`** (`MGPipeTypes.h:1197-1206`): ruling — the destination is **always `SEG_REPLY`** in P5, so no `Seg` field is added; the PBO destination (fire-and-forget plus a client-side `MarkGpuWritten`) is b1's and also needs none, because a PBO destination is a resource handle rather than a segment. `GetTextureImage` is **not on P5's reduced path** and its slot stays `Fatal{UnmigratedVerb}`. | `read_pixels.pixels` |
 
 ---
 

MobileGL/MG_Remote/CapsCodec.cpp

@@ -175,21 +175,6 @@ namespace MobileGL::MG_Remote {
         constexpr Uint64 kFormatCells = static_cast<Uint64>(MG_Backend::kFormatCapabilityTargetCount) *
                                         static_cast<Uint64>(MG_Backend::kFormatCapabilityFormatCount);
 
-        // FNV-1a, the same mixer the tree already uses for build-stamp style fingerprints.
-        constexpr Uint64 kFnvOffset = 1469598103934665603ull;
-        constexpr Uint64 kFnvPrime = 1099511628211ull;
-
-        Uint64 FnvBytes(Uint64 hash, const void* bytes, SizeT size) {
-            const auto* p = static_cast<const Uint8*>(bytes);
-            for (SizeT i = 0; i < size; ++i) {
-                hash ^= static_cast<Uint64>(p[i]);
-                hash *= kFnvPrime;
-            }
-            return hash;
-        }
-
-        Uint64 FnvU64(Uint64 hash, Uint64 value) { return FnvBytes(hash, &value, sizeof(value)); }
-
     } // namespace
 
     // ---------------------------------------------------------------------------------
@@ -469,7 +454,7 @@ namespace MobileGL::MG_Remote {
     // The ABI assertion the handshake carries
     // ---------------------------------------------------------------------------------
 
-    Uint64 CapsAbiFingerprint() {
+    Transport::AbiFingerprintInputs CapsAbiFingerprintInputs() {
         // MGPCaps has only a COMPOSITIONAL size assertion (MGPipeTypes.h:145-146) because
         // DynamicBackendParameters still carries SizeT and GLenum members - P0.5's fixed-width
         // rewrite did not happen and P5 does not do it either (table 0's ABI row; the rewrite
@@ -479,23 +464,28 @@ namespace MobileGL::MG_Remote {
         // The git stamp is in it because two builds of the same sizes can still disagree about
         // a FIELD ORDER, which no sizeof can see; P6's spawn is same-machine and same-binary,
         // so it inherits this unchanged rather than needing a looser rule.
-        Uint64 hash = kFnvOffset;
+        Transport::AbiFingerprintInputs inputs;
-        hash = FnvU64(hash, sizeof(MG_Backend::DynamicBackendParameters));
+        inputs.DynamicParamsSize = sizeof(MG_Backend::DynamicBackendParameters);
-        hash = FnvU64(hash, sizeof(MG_Pipe::MGPCaps));
+        inputs.CapsSize = sizeof(MG_Pipe::MGPCaps);
-        hash = FnvU64(hash, sizeof(MG_Backend::GLFunctionsTable));
+        inputs.FunctionTableSize = sizeof(MG_Backend::GLFunctionsTable);
-        hash = FnvU64(hash, static_cast<Uint64>(MG_Backend::kFormatCapabilityTargetCount));
+        inputs.FormatCapabilityTargets = static_cast<Uint64>(MG_Backend::kFormatCapabilityTargetCount);
-        hash = FnvU64(hash, static_cast<Uint64>(MG_Backend::kFormatCapabilityFormatCount));
+        inputs.FormatCapabilityFormats = static_cast<Uint64>(MG_Backend::kFormatCapabilityFormatCount);
-        hash = FnvU64(hash, kFormatCapabilitiesCodecVersion);
+        inputs.FormatCapabilitiesCodecVersion = kFormatCapabilitiesCodecVersion;
-        hash = FnvU64(hash, kRendererInfoCodecVersion);
+        inputs.RendererInfoCodecVersion = kRendererInfoCodecVersion;
-        hash = FnvU64(hash, static_cast<Uint64>(MG_Pipe::MGPWireOp::kOpCount));
+        inputs.OpCount = static_cast<Uint64>(MG_Pipe::MGPWireOp::kOpCount);
         // The declared protocol ABI, carried over from s1's version of this function at
         // integration (ID-33). The sizeofs above catch a struct that changed shape; this
         // catches a peer that changed the PROTOCOL while every struct stayed the same size,
         // which is the one break the rest of the mix is blind to.
-        hash = FnvU64(hash,
+        inputs.AbiVersion =
-                      static_cast<Uint64>(MOBILEGL_ABI_VERSION(MOBILEGL_PROTOCOL_ABI_MAJOR, MOBILEGL_PROTOCOL_ABI_MINOR)));
+            static_cast<Uint32>(MOBILEGL_ABI_VERSION(MOBILEGL_PROTOCOL_ABI_MAJOR, MOBILEGL_PROTOCOL_ABI_MINOR));
-        hash = FnvBytes(hash, GIT_COMMIT_HASH_SHORT, std::strlen(GIT_COMMIT_HASH_SHORT));
+        inputs.BuildStamp = GIT_COMMIT_HASH_SHORT;
-        return hash;
+        return inputs;
     }
 
+    // ONE implementation, deliberately a one-liner: the wave-1 review (ID-46 finding 6) found a
+    // second hand-rolled FNV loop here while the mixer under Transport/ had no production caller,
+    // so the sensitivity test could not see this function change. Now it starts from here.
+    Uint64 CapsAbiFingerprint() { return Transport::MixAbiFingerprint(CapsAbiFingerprintInputs()); }
+
 } // namespace MobileGL::MG_Remote

MobileGL/MG_Remote/CapsCodec.h

@@ -34,6 +34,8 @@
 #include <MG_Backend/BackendObject.h>
 #include <MG_Pipe/MGPipe.h>
 
+#include "Transport/SessionRings.h" // AbiFingerprintInputs / MixAbiFingerprint
+
 namespace MobileGL::MG_Remote {
 
     // ---- CallMask's layout (c0's ruling, extending R-8) ---------------------------------
@@ -90,10 +92,17 @@ namespace MobileGL::MG_Remote {
 
     // ---- the ABI assertion the handshake carries ----------------------------------------
     //
-    // Mixes sizeof(DynamicBackendParameters), sizeof(MGPCaps), sizeof(GLFunctionsTable) and
+    // The inputs, as this build sees them: sizeof(DynamicBackendParameters), sizeof(MGPCaps),
-    // the compile-time build fingerprint. Compared in Hello/Welcome; a mismatch is
+    // sizeof(GLFunctionsTable), the format-capability table's extents, the two caps-blob codec
-    // Fatal{AbiMismatch} and never a downgrade, because every alternative silently reads one
+    // versions, MGPWireOp::kOpCount, the protocol ABI version and the compile-time git stamp.
-    // struct as another.
+    // Public so that the sensitivity control can pin every one of them to the real value AND
+    // perturb them one at a time through the same mixer the handshake uses.
+    Transport::AbiFingerprintInputs CapsAbiFingerprintInputs();
+
+    // What Hello/Welcome carry and compare: EXACTLY Transport::MixAbiFingerprint(
+    // CapsAbiFingerprintInputs()) - one implementation, no second hash (ID-46 finding 6). A
+    // mismatch is Fatal{AbiMismatch} and never a downgrade, because every alternative silently
+    // reads one struct as another.
     Uint64 CapsAbiFingerprint();
 
 } // namespace MobileGL::MG_Remote

MobileGL/MG_Remote/Client/ClientSession.cpp

@@ -21,6 +21,7 @@
 #include <MG_Util/Debug/Log.h>
 
 #include <cstdlib>
+#include <utility>
 #include <vector>
 
 namespace MobileGL::MG_Remote::Client {
@@ -150,7 +151,25 @@ namespace MobileGL::MG_Remote::Client {
 
         // ---- 1. the control plane and the two bells. The transport owns the bells; THE
         // SESSION owns the rings, and the accessors stay off ITransport (contract §3.9).
-        Transport::InProcessTransport::CreatePair(m_clientTransport, m_serverTransport);
+        std::unique_ptr<Transport::InProcessTransport> clientEnd;
+        std::unique_ptr<Transport::InProcessTransport> serverEnd;
+        Transport::InProcessTransport::CreatePair(clientEnd, serverEnd);
+        return StartOverTransportPair(std::move(clientEnd), std::move(serverEnd));
+    }
+
+    MobileGLResult ClientSession::StartOverTransportPair(
+        std::unique_ptr<Transport::InProcessTransport> clientEnd,
+        std::unique_ptr<Transport::InProcessTransport> serverEnd) {
+        if (m_started) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        if (clientEnd == nullptr || serverEnd == nullptr) {
+            MGLOG_E("MG_Remote client: StartOverTransportPair needs both ends of one "
+                    "InProcessTransport::CreatePair");
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        m_clientTransport = std::move(clientEnd);
+        m_serverTransport = std::move(serverEnd);
         m_transport = m_clientTransport.get();
 
         // ---- 2. Hello. Sent before the server accepts: InProcessTransport queues whole
@@ -451,6 +470,15 @@ namespace MobileGL::MG_Remote::Client {
 
     Uint32 ClientSession::MaxReplyBytes() const { return m_replies.MaxReplyBytes(); }
 
+    Bool ClientSession::ReplyCanHold(Uint64 bytes) const { return m_replies.CanHold(bytes); }
+
+    // ID-47. Forwarded verbatim so that the message, the boundary and the abort are the pool's
+    // and are pinned once, in SessionTest, rather than re-derived per caller.
+    void ClientSession::RequireReadPixelsReplyFits(Uint32 width, Uint32 height, Uint32 format,
+                                                   Uint32 type, Uint64 bytes) const {
+        m_replies.RequireReadPixelsFits(width, height, format, type, bytes);
+    }
+
     Transport::EventRingConsumer& ClientSession::Events() { return m_events; }
 
     Transport::RingControl* ClientSession::Control() { return m_shm.CmdControl(); }

MobileGL/MG_Remote/Client/ClientSession.h

@@ -69,6 +69,19 @@ namespace MobileGL::MG_Remote::Client {
         // ran monolith and went green" failure, and it must be loud.
         MobileGLResult Start(MG_Config::TransportMode mode, const String& endpoint);
 
+        // Start()'s second half: the handshake and everything after it, over a transport pair
+        // the CALLER made with InProcessTransport::CreatePair. Start() refuses every mode but
+        // `inproc`, makes the pair, and calls this; it is public for exactly one reason. The
+        // Welcome guard below (envelope->msg_as_Welcome() == nullptr, ID-46 finding 7) can only
+        // be reached by a frame that arrives on the server->client direction BEFORE the
+        // server's own Welcome, and Start() builds that pair itself, so no control could put
+        // one there. SessionHandshakeTest does it through here, and the null-union Welcome must
+        // come back as MOBILEGL_ERR_PROTOCOL_MISMATCH with the guard's own line. Not a second
+        // way to start a session: MG_Backend::Init() calls Start(), and nothing else may call
+        // this with a pair it did not just create.
+        MobileGLResult StartOverTransportPair(std::unique_ptr<Transport::InProcessTransport> clientEnd,
+                                              std::unique_ptr<Transport::InProcessTransport> serverEnd);
+
         // Teardown order matters and is table 3's fourth column: publish and let the server
         // drain, Doorbell::Kill() (the ONLY thing that wakes an apply thread parked on
         // kWaitForever, Doorbell.h:211-221), then join, and only then release anything an
@@ -127,6 +140,18 @@ namespace MobileGL::MG_Remote::Client {
         // What one answer may carry. A ReadPixels bigger than this is Fatal rather than
         // chunked, so the client checks BEFORE it emits.
         Uint32 MaxReplyBytes() const;
+        // ID-47, the fifth primitive: true exactly when an answer of `bytes` can be posted.
+        Bool ReplyCanHold(Uint64 bytes) const;
+        // ID-47's named refusal, forwarded verbatim to ReplySlotPool::RequireReadPixelsFits.
+        // Returns when the answer fits; otherwise
+        //     Fatal{ReplyTooLarge, "ReadPixels <w>x<h> <format> <bytes> > <cap>"}
+        // and abort - AT THE CLIENT, BEFORE EMISSION. Package c1's OnReadPixels emitter calls
+        // this once, immediately before EmitAndWait(MGPWireOp::ReadPixels, ...), with the
+        // record's box, its Format/Type enums and the DstSize it computed; the server's Post
+        // keeps its own refusal as the last line of defence, but that one fires on the apply
+        // thread with the record already on the wire, where all the client sees is a hang.
+        void RequireReadPixelsReplyFits(Uint32 width, Uint32 height, Uint32 format, Uint32 type,
+                                        Uint64 bytes) const;
 
         // The reverse channel's reading end: OnBufferWriteback / OnGpuWritten /
         // OnSurfaceChanged. Drained by the GL thread between verbs.

MobileGL/MG_Remote/Transport/ReplySlot.h

@@ -28,10 +28,13 @@
 // uploads from the other side, and a client that folds it into OK accepts a
 // pointer the server never handed out.
 //
-// A REPLY LARGER THAN ONE SLOT IS FATAL, NOT CHUNKED. P5's only large answer is
+// A REPLY LARGER THAN ONE SLOT IS FATAL, NOT CHUNKED, AND THE CLIENT SAYS SO
-// ReadPixels, and the client knows its size before it emits the record, so an
+// FIRST (ID-47). P5's only large answer is ReadPixels, and the client knows its
-// overflow means the two sides disagree about the frame rather than that the
+// size before it emits the record, so it refuses an oversize read BY NAME before
-// pool is too small. Chunking is P8's; growing the pool is an operator's.
+// emission (RequireReadPixelsFits: Fatal{ReplyTooLarge, "ReadPixels <w>x<h>
+// <format> <bytes> > <cap>"}); Post's own refusal is the server's last line of
+// defence, and reaching it means the two sides disagree about the frame rather
+// than that the pool is too small. Chunking is a P6 debt; the pool has no knob.
 //
 // ORDERING. The client only looks at a slot after it has seen
 // RingControl::appliedSeq >= its own seq with an ACQUIRE load, and the server
@@ -77,15 +80,28 @@ namespace MobileGL::MG_Remote::Transport {
         kReplyStatusError = 2,
     };
 
-    // Eight slots of a 8 MiB SEG_REPLY is 1 MiB per answer.
+    // Eight slots of a 16 MiB SEG_REPLY is 2 MiB per slot, and MaxReplyBytes() is
+    // 2 MiB minus the 16-byte header = 2,097,136 bytes per answer (ID-47).
     //
     // Why eight and not sixty-four: while the verb barrier holds (R-1) the client
     // blocks at every verb boundary, so the in-flight depth is exactly ONE and
     // every extra slot buys nothing but a smaller maximum answer. The trade is
     // the other way round - fewer slots, bigger replies - and P5's only large
-    // answer is a blocking ReadPixels. 1 MiB covers a 512x512 RGBA8 read. P9,
+    // answer is a blocking ReadPixels. P9, which is what makes the pool
-    // which is what makes the pool asynchronous, re-chooses this geometry with
+    // asynchronous, re-chooses this geometry with real depth to size it against.
-    // real depth to size it against.
+    //
+    // WHY 2 MiB AND NOT 1. The first version of this file said "1 MiB covers a
+    // 512x512 RGBA8 read", and it did not: 512*512*4 is exactly 1 MiB and the
+    // slot header takes 16 of those bytes, so Post refused it by sixteen. Worse,
+    // the E2 retrace harness's snapshot is a full-surface GL_RGBA/GL_UNSIGNED_BYTE
+    // read of OpenRA's 640x480 surface = 1,228,800 bytes through the interposer,
+    // 17% over the old cap - Post would have aborted on the first snapshot the
+    // day the client's ReadPixels emitter landed. Contract §2 row 23 says the
+    // slot is "sized from the scenario's largest read rather than guessed";
+    // 2 MiB is that size for every P5 exit-gate read (E2 is the largest at
+    // 640x480). A 2400x1080 RGBA8 device surface is ~10.4 MB and is a P6 debt
+    // (chunked readback or a dedicated readback carrier), recorded in the
+    // ROADMAP by the integrator - the geometry here is not the place it is paid.
     inline constexpr std::uint32_t kDefaultReplySlotCount = 8;
 
     // Slot 0 exists and is used: seq is 1-based, so seq % slotCount hits slot 0
@@ -152,6 +168,44 @@ namespace MobileGL::MG_Remote::Transport {
                                     : m_slotBytes - static_cast<std::uint32_t>(sizeof(ReplySlotHeader));
         }
 
+        // ID-47: THE CLIENT'S HALF of "a reply larger than one slot is fatal". True
+        // exactly when an answer of `bytes` can be posted into this pool: the pool
+        // is configured and `bytes <= MaxReplyBytes()`. The boundary is inclusive
+        // and SessionTest pins it from both sides.
+        bool CanHold(std::uint64_t bytes) const { return m_base != nullptr && bytes <= MaxReplyBytes(); }
+
+        // ID-47's named refusal, AT THE CLIENT, BEFORE EMISSION. Returns when the
+        // answer fits; otherwise
+        //     Fatal{ReplyTooLarge, "ReadPixels <w>x<h> <format> <bytes> > <cap>"}
+        // and abort. Never truncated, never chunked, and never a server-side
+        // abort the client cannot name: Post's own refusal below stays as the
+        // last line of defence, but it fires on the apply thread with the record
+        // already on the wire, where the only thing the client sees is a hang.
+        //
+        // `format`/`type` are the GL enums the record carries (MGPReadbackInfo::
+        // Format/Type), printed as the hex pair every pipe diagnostic uses; the
+        // caller passes the byte count it computed for the record's DstSize, so
+        // what is refused is exactly what would have been posted. This is the one
+        // call c1's OnReadPixels emitter makes before EmitAndWait; the
+        // ClientSession forwards it verbatim (RequireReadPixelsReplyFits).
+        void RequireReadPixelsFits(std::uint32_t width, std::uint32_t height, std::uint32_t format,
+                                   std::uint32_t type, std::uint64_t bytes) const {
+            if (CanHold(bytes)) {
+                return;
+            }
+            WireLogFatal("MGPipe: Fatal{ReplyTooLarge, \"ReadPixels %ux%u 0x%04X/0x%04X %llu > %u\"} - "
+                         "the answer does not fit one SEG_REPLY slot (%u slots of %u bytes, payload "
+                         "cap %u; a cap of 0 means no reply pool is configured). Refused at the "
+                         "client before emission (ID-47): P5 neither truncates nor chunks a reply, "
+                         "and a read larger than the cap is a P6 debt (chunked readback), not a "
+                         "bigger pool",
+                         static_cast<unsigned>(width), static_cast<unsigned>(height),
+                         static_cast<unsigned>(format), static_cast<unsigned>(type),
+                         static_cast<unsigned long long>(bytes),
+                         static_cast<unsigned>(MaxReplyBytes()), static_cast<unsigned>(m_slots),
+                         static_cast<unsigned>(m_slotBytes), static_cast<unsigned>(MaxReplyBytes()));
+        }
+
         // Zeroes every header, so a stale seq from a previous session cannot be
         // mistaken for this session's answer. Called on the server side at Accept.
         void Clear() {
@@ -170,24 +224,25 @@ namespace MobileGL::MG_Remote::Transport {
         // chunked - see the file header.
         void Post(std::uint64_t seq, std::int32_t status, const void* bytes, std::uint64_t size) {
             if (m_base == nullptr) {
-                WireLogError("MG_Remote reply pool: Post(seq=%llu) on an unconfigured pool",
+                WireLogFatal("MG_Remote reply pool: Fatal{ProtocolCorruption} - Post(seq=%llu) on an "
+                             "unconfigured pool",
                              static_cast<unsigned long long>(seq));
-                std::abort();
             }
             if (seq == 0) {
-                WireLogError("MG_Remote reply pool: seq 0 is \"no record\" and can never name a "
+                WireLogFatal("MG_Remote reply pool: Fatal{ProtocolCorruption} - seq 0 is \"no "
-                             "slot (R-3: seq is 1-based)");
+                             "record\" and can never name a slot (R-3: seq is 1-based)");
-                std::abort();
             }
             if (size > MaxReplyBytes()) {
-                WireLogError("MG_Remote reply pool: Fatal{ProtocolCorruption} - a %llu byte answer "
+                // The server's LAST line of defence, not the first: the client refuses an
+                // oversize ReadPixels by name before it emits (RequireReadPixelsFits, ID-47),
+                // so reaching this means the two sides disagree about the frame.
+                WireLogFatal("MG_Remote reply pool: Fatal{ProtocolCorruption} - a %llu byte answer "
                              "for seq %llu does not fit a %u byte slot (payload cap %u). P5 does "
                              "not chunk replies: the client knows an answer's size before it emits "
                              "the record, so this means the two sides disagree about the frame",
                              static_cast<unsigned long long>(size),
                              static_cast<unsigned long long>(seq), static_cast<unsigned>(m_slotBytes),
                              static_cast<unsigned>(MaxReplyBytes()));
-                std::abort();
             }
             std::uint8_t* slot = SlotAt(seq);
             if (size != 0 && bytes != nullptr) {

MobileGL/MG_Remote/Transport/Ring.cpp

@@ -9,6 +9,7 @@
 #include "Ring.h"
 
 #include "SessionRings.h"
+#include "WireLog.h"
 
 #include <MG_Util/Debug/Log.h>
 
@@ -364,13 +365,15 @@ namespace MobileGL::MG_Remote::Transport {
                                   const char* name) {
                 const std::uint64_t current = watermark.load(std::memory_order_relaxed);
                 if (to < current) {
-                    MGLOG_F("MGPipe: Fatal{ProtocolCorruption, \"watermark\"} %s moved backwards, "
+                    // WireLogFatal, not MGLOG_F + abort: the line has to reach stderr
-                            "%llu -> %llu. A waiter that already resumed on the higher value cannot "
+                    // for SessionTestDeath's control to name it (WireLog.h).
-                            "be un-resumed, and every later advance of this watermark would be a "
+                    WireLogFatal("MGPipe: Fatal{ProtocolCorruption, \"watermark\"} %s moved backwards, "
-                            "no-op, so the verb barrier and every reply wait would block for ever",
+                                 "%llu -> %llu. A waiter that already resumed on the higher value "
-                            name, static_cast<unsigned long long>(current),
+                                 "cannot be un-resumed, and every later advance of this watermark "
-                            static_cast<unsigned long long>(to));
+                                 "would be a no-op, so the verb barrier and every reply wait would "
-                    std::abort();
+                                 "block for ever",
+                                 name, static_cast<unsigned long long>(current),
+                                 static_cast<unsigned long long>(to));
                 }
                 if (to == current) {
                     return;
@@ -611,13 +614,12 @@ namespace MobileGL::MG_Remote::Transport {
     // The ABI fingerprint's mixer
     // -----------------------------------------------------------------------
 
-    std::uint64_t MixAbiFingerprint(std::uint64_t dynamicParamsSize, std::uint64_t capsSize,
+    std::uint64_t MixAbiFingerprint(const AbiFingerprintInputs& inputs) {
-                                    std::uint64_t functionTableSize, std::uint32_t abiVersion,
+        // FNV-1a over every field, in declaration order, then the stamp. Not a
-                                    const char* buildStamp) {
+        // hash with any security property and not meant to be one: it has to
-        // FNV-1a over the four numbers and the stamp. Not a hash with any
+        // (a) change when ANY input changes and (b) be computable identically in
-        // security property and not meant to be one: it has to (a) change when
+        // two processes built from one source tree, which rules out anything
-        // ANY input changes and (b) be computable identically in two processes
+        // seeded at runtime.
-        // built from one source tree, which rules out anything seeded at runtime.
         std::uint64_t hash = 1469598103934665603ull;
         const auto mix = [&hash](std::uint64_t value) {
             for (int byte = 0; byte < 8; ++byte) {
@@ -625,12 +627,21 @@ namespace MobileGL::MG_Remote::Transport {
                 hash *= 1099511628211ull;
             }
         };
-        mix(dynamicParamsSize);
+        mix(inputs.DynamicParamsSize);
-        mix(capsSize);
+        mix(inputs.CapsSize);
-        mix(functionTableSize);
+        mix(inputs.FunctionTableSize);
-        mix(abiVersion);
+        mix(inputs.FormatCapabilityTargets);
-        if (buildStamp != nullptr) {
+        mix(inputs.FormatCapabilityFormats);
-            for (const char* c = buildStamp; *c != '\0'; ++c) {
+        mix(inputs.FormatCapabilitiesCodecVersion);
+        mix(inputs.RendererInfoCodecVersion);
+        mix(inputs.OpCount);
+        mix(inputs.AbiVersion);
+        // A presence marker before the bytes, so that "no stamp" (nullptr) and
+        // "an empty stamp" ("") are different inputs rather than the same
+        // absence of bytes.
+        mix(inputs.BuildStamp != nullptr ? 1u : 0u);
+        if (inputs.BuildStamp != nullptr) {
+            for (const char* c = inputs.BuildStamp; *c != '\0'; ++c) {
                 hash ^= static_cast<std::uint64_t>(static_cast<unsigned char>(*c));
                 hash *= 1099511628211ull;
             }

MobileGL/MG_Remote/Transport/RoleMemory.h

@@ -34,6 +34,7 @@
 
 #pragma once
 
+#include <atomic>
 #include <cstdint>
 
 namespace MobileGL::MG_Remote::Transport {
@@ -55,6 +56,19 @@ namespace MobileGL::MG_Remote::Transport {
     // from one that was not sampled.
     std::uint64_t ProcessCurrentRssBytes();
 
+    // BOTH, FROM ONE PASS OVER /proc/self/status. The kernel does not keep
+    // hiwater_rss up to date on growth - it stores it only when RSS is about to
+    // DROP, and task_mem() reports max(stored hiwater, rss-at-this-read) - so
+    // two separate reads are not comparable: the fopen of the second read can
+    // itself grow RSS past the VmHWM the first read reported. That is exactly
+    // what GitHub run 35079459114 caught (VmHWM 4,784,128 < VmRSS 4,849,664 on
+    // ubuntu-24.04) and what ~/w7/p5-s1-probe reproduced locally: two reads
+    // disagree by 128 KiB with nothing allocated between them, one read never
+    // does (0/1000 with 64 KiB of growth per iteration). One pass is therefore
+    // the only way to read a pair, and even then the pair is a snapshot, not a
+    // bound - see SampleRoleMemoryInto.
+    void ProcessRssBytes(std::uint64_t* outPeakBytes, std::uint64_t* outCurrentBytes);
+
     // The ledger. ShmSegment does NOT update it itself: a segment is also created
     // by tests and by P6's adopt path, and a ledger that counted those would stop
     // meaning "this session's footprint". The SESSION books its own segments.
@@ -68,6 +82,17 @@ namespace MobileGL::MG_Remote::Transport {
     std::uint64_t LedgerMappedBytesAllRoles();
 
     // One sample, both halves, for one role.
+    //
+    // PeakRssBytes IS THE LEDGER'S OWN RUNNING MAXIMUM, not the kernel's VmHWM.
+    // It is the largest of every kernel peak and every kernel current this
+    // process has folded in through SampleRoleMemoryInto, so it is >= this
+    // sample's CurrentRssBytes BY CONSTRUCTION and never decreases. The kernel's
+    // VmHWM feeds it (it is a lower bound on the true peak that this process's
+    // own samples may have missed) but is never reported on its own: as
+    // ProcessRssBytes explains, the kernel's peak is not a monotone bound on the
+    // kernel's current at read time, so a sample that reported VmHWM verbatim
+    // could show a peak below its own current - which is a number t1 cannot put
+    // in MEASUREMENTS and a test cannot assert against. GitHub run 35079459114.
     struct RoleMemorySample {
         std::uint64_t PeakRssBytes = 0;
         std::uint64_t CurrentRssBytes = 0;
@@ -75,8 +100,21 @@ namespace MobileGL::MG_Remote::Transport {
         MemoryRole Role = MemoryRole::Client;
     };
 
+    // One pass over /proc/self/status folded into the PROCESS's running peak.
     RoleMemorySample SampleRoleMemory(MemoryRole role);
 
+    // The fold itself, over a running peak the CALLER owns: `runningPeak`
+    // becomes max(runningPeak, kernelPeakRssBytes, kernelCurrentRssBytes) and
+    // the sample reports that as PeakRssBytes beside `kernelCurrentRssBytes`.
+    // SampleRoleMemory calls this with the process-wide running peak and the
+    // numbers it just read; SessionTest calls it with a running peak of its own
+    // and a stubbed reader whose current EXCEEDS its peak, which must not fail
+    // (R-16's control on this rule: revert PeakRssBytes to the kernel's peak and
+    // it does).
+    RoleMemorySample SampleRoleMemoryInto(std::atomic<std::uint64_t>& runningPeak, MemoryRole role,
+                                          std::uint64_t kernelPeakRssBytes,
+                                          std::uint64_t kernelCurrentRssBytes);
+
     // Emits one line at INFO level, which is what every P5 lane builds at, so
     // t1's harness can grep it out of a lane log without a new log sink. Not
     // DEBUG, which the INFO build compiles out; not ERROR, which this is not.

MobileGL/MG_Remote/Transport/SessionRings.h

@@ -53,7 +53,8 @@
 //
 // SegmentRef.sizeBytes therefore announces the MAPPING size (ring + page), which
 // is what a spawn peer must mmap. The four numbers a reader recognises - 8 MiB /
-// 32 MiB / 8 MiB / 256 KiB - are the RING sizes, which is what the knobs name.
+// 32 MiB / 16 MiB / 256 KiB (ID-47) - are the RING sizes, which is what the
+// knobs name.
 //
 // SEG_STAGE has no control page of its own: RingControl carries TWO cursor
 // triples (Ring.h:101-109) and the stage triple is the second. So SEG_STAGE is
@@ -86,8 +87,13 @@ namespace MobileGL::MG_Remote::Transport {
         // two either. Rounding was a ring requirement and keeping it would have
         // silently turned an operator's MOBILEGL_IPC_STAGE_MB=24 into 16.
         std::uint64_t StageBytes = 32ull * 1024 * 1024;
-        std::uint64_t ReplyBytes = 8ull * 1024 * 1024; // slot pool, not a ring
+        // SEG_REPLY: a slot pool, not a ring, and NO KNOB MOVES IT (contract §5 has
-        std::uint64_t EventRingBytes = 256ull * 1024;  // + one control page
+        // none). ID-47: 16 MiB = eight slots of 2 MiB, sized from the largest P5
+        // read - the E2 retrace's full-surface 640x480 RGBA8 snapshot, 1,228,800
+        // bytes - which the previous 8 MiB / 1 MiB-per-slot pool could not hold
+        // (ReplySlot.h says how it was found). ProtocolSmokeTest pins the number.
+        std::uint64_t ReplyBytes = 16ull * 1024 * 1024;
+        std::uint64_t EventRingBytes = 256ull * 1024; // + one control page
         std::uint32_t ReplySlotCount = kDefaultReplySlotCount;
     };
 
@@ -473,17 +479,48 @@ namespace MobileGL::MG_Remote::Transport {
     };
 
     // -----------------------------------------------------------------------
-    // The ABI fingerprint's mixer.
+    // The ABI fingerprint's mixer - THE ONE IMPLEMENTATION.
     //
-    // It lives under Transport/ rather than in CapsCodec.cpp so that it can be
+    // CapsCodec.cpp's CapsAbiFingerprint(), the value both handshakes compare,
-    // tested without the GL frontend's umbrella header, and so that the SIZES it
+    // is exactly MixAbiFingerprint(CapsAbiFingerprintInputs()). It lives under
-    // mixes are the caller's - CapsCodec.cpp passes the three real sizeofs, a
+    // Transport/ so that it can be tested without the GL frontend's umbrella
-    // unit test passes made-up ones and can then prove a one-byte difference
+    // header, and it takes its inputs as a struct so that the SAME function the
-    // changes the answer. A fingerprint that cannot be shown to change is
+    // handshake calls can be driven with one field perturbed at a time.
-    // indistinguishable from one that is never compared.
+    //
+    // The wave-1 review (ID-46 finding 6) found the previous shape - a
+    // five-argument mixer here and a SEPARATE hand-rolled FNV loop in
+    // CapsCodec.cpp - had exactly one caller of this function: the sensitivity
+    // test. Production never called it, so replacing CapsAbiFingerprint() with
+    // `return 1;` left every fingerprint test green and both peers agreeing on
+    // nothing. Now there is one mixer, the sensitivity case starts from the
+    // production entry point, and that perturbation turns it red.
     // -----------------------------------------------------------------------
-    std::uint64_t MixAbiFingerprint(std::uint64_t dynamicParamsSize, std::uint64_t capsSize,
+    struct AbiFingerprintInputs {
-                                    std::uint64_t functionTableSize, std::uint32_t abiVersion,
+        // The three struct shapes table 0's ABI-agreement row names.
-                                    const char* buildStamp);
+        std::uint64_t DynamicParamsSize = 0;
+        std::uint64_t CapsSize = 0;
+        std::uint64_t FunctionTableSize = 0;
+        // The caps blob's own geometry and the two blob codecs' versions: the
+        // format-capability table's extents and the codec version stamps.
+        std::uint64_t FormatCapabilityTargets = 0;
+        std::uint64_t FormatCapabilityFormats = 0;
+        std::uint64_t FormatCapabilitiesCodecVersion = 0;
+        std::uint64_t RendererInfoCodecVersion = 0;
+        // The catalogue's length (ID-33): a peer with one more opcode is a
+        // different wire even if every struct kept its size.
+        std::uint64_t OpCount = 0;
+        // MOBILEGL_ABI_VERSION(major, minor): a protocol change that left every
+        // struct the same size, which nothing above can see.
+        std::uint32_t AbiVersion = 0;
+        // GIT_COMMIT_HASH_SHORT: two builds of the same sizes can still disagree
+        // about a FIELD ORDER, which no sizeof can see. nullptr and "" are
+        // distinct inputs and neither equals a real stamp.
+        const char* BuildStamp = nullptr;
+    };
+
+    // FNV-1a over every field above, in declaration order. Never 0: that value is
+    // reserved for "not stated", so a peer that forgot to fill the field cannot
+    // accidentally agree with one that did.
+    std::uint64_t MixAbiFingerprint(const AbiFingerprintInputs& inputs);
 
 } // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/ShmSegment.cpp

@@ -78,43 +78,73 @@ namespace MobileGL::MG_Remote::Transport {
             return role == MemoryRole::Server ? "server" : "client";
         }
 
-        // One pass over /proc/self/status for a "VmHWM:" / "VmRSS:" line. The
+        // "<key>:\t   <number> kB" -> bytes. The unit suffix is part of the
-        // values are in kB and the unit suffix is part of the line, so it is
+        // line, so it is parsed rather than assumed; anything else is a kernel
-        // parsed rather than assumed.
+        // this code has not seen, and 0 ("not measured") is the honest answer.
-        std::uint64_t ProcStatusBytes(const char* key) {
+        bool ParseKilobyteLine(const char* line, const char* key, std::uint64_t* outBytes) {
-#if defined(__linux__) || defined(__ANDROID__)
-            std::FILE* file = std::fopen("/proc/self/status", "re");
-            if (file == nullptr) {
-                return 0;
-            }
             const std::size_t keyLength = std::strlen(key);
-            char line[256];
+            if (std::strncmp(line, key, keyLength) != 0) {
-            std::uint64_t bytes = 0;
+                return false;
-            while (std::fgets(line, sizeof(line), file) != nullptr) {
-                if (std::strncmp(line, key, keyLength) != 0) {
-                    continue;
-                }
-                unsigned long long kilobytes = 0;
-                // The format is "<key>:\t   <number> kB". Anything else is a
-                // kernel this code has not seen, and 0 ("not measured") is the
-                // honest answer for it.
-                if (std::sscanf(line + keyLength, ": %llu kB", &kilobytes) == 1) {
-                    bytes = static_cast<std::uint64_t>(kilobytes) * 1024ull;
-                }
-                break;
             }
-            std::fclose(file);
+            unsigned long long kilobytes = 0;
-            return bytes;
+            if (std::sscanf(line + keyLength, ": %llu kB", &kilobytes) == 1) {
-#else
+                *outBytes = static_cast<std::uint64_t>(kilobytes) * 1024ull;
-            (void)key;
+            }
-            return 0;
+            return true;
-#endif
+        }
+
+        // The process-wide running peak SampleRoleMemory folds into. One per
+        // process, like VmHWM itself; under inproc both roles share it and the
+        // log line says so.
+        std::atomic<std::uint64_t>& ProcessRunningPeak() {
+            static std::atomic<std::uint64_t> peak{0};
+            return peak;
         }
     } // namespace
 
-    std::uint64_t ProcessPeakRssBytes() { return ProcStatusBytes("VmHWM"); }
+    // ONE PASS FOR BOTH KEYS - see RoleMemory.h. A pass per key was the wave-1
+    // shape and it is what GitHub run 35079459114 caught: the second fopen grew
+    // RSS past the VmHWM the first pass had reported, because the kernel only
+    // stores hiwater_rss when RSS is about to drop and reports max(stored, now)
+    // otherwise, so the two reads were snapshots of different "now"s.
+    void ProcessRssBytes(std::uint64_t* outPeakBytes, std::uint64_t* outCurrentBytes) {
+        std::uint64_t peak = 0;
+        std::uint64_t current = 0;
+#if defined(__linux__) || defined(__ANDROID__)
+        std::FILE* file = std::fopen("/proc/self/status", "re");
+        if (file != nullptr) {
+            char line[256];
+            bool sawPeak = false;
+            bool sawCurrent = false;
+            while ((!sawPeak || !sawCurrent) && std::fgets(line, sizeof(line), file) != nullptr) {
+                if (!sawPeak && ParseKilobyteLine(line, "VmHWM", &peak)) {
+                    sawPeak = true;
+                } else if (!sawCurrent && ParseKilobyteLine(line, "VmRSS", &current)) {
+                    sawCurrent = true;
+                }
+            }
+            std::fclose(file);
+        }
+#endif
+        if (outPeakBytes != nullptr) {
+            *outPeakBytes = peak;
+        }
+        if (outCurrentBytes != nullptr) {
+            *outCurrentBytes = current;
+        }
+    }
 
-    std::uint64_t ProcessCurrentRssBytes() { return ProcStatusBytes("VmRSS"); }
+    std::uint64_t ProcessPeakRssBytes() {
+        std::uint64_t peak = 0;
+        ProcessRssBytes(&peak, nullptr);
+        return peak;
+    }
+
+    std::uint64_t ProcessCurrentRssBytes() {
+        std::uint64_t current = 0;
+        ProcessRssBytes(nullptr, &current);
+        return current;
+    }
 
     void LedgerAddSegment(MemoryRole role, std::uint64_t bytes) {
         LedgerSlot(role).fetch_add(bytes, std::memory_order_relaxed);
@@ -140,15 +170,35 @@ namespace MobileGL::MG_Remote::Transport {
         return total;
     }
 
-    RoleMemorySample SampleRoleMemory(MemoryRole role) {
+    RoleMemorySample SampleRoleMemoryInto(std::atomic<std::uint64_t>& runningPeak, MemoryRole role,
+                                          std::uint64_t kernelPeakRssBytes,
+                                          std::uint64_t kernelCurrentRssBytes) {
+        // max(running, kernel peak, kernel current), as a CAS loop: two threads
+        // sampling at once (the GL thread and the apply thread both log memory
+        // at phase boundaries) must not let a lower value overwrite a higher.
+        const std::uint64_t observed =
+            kernelPeakRssBytes > kernelCurrentRssBytes ? kernelPeakRssBytes : kernelCurrentRssBytes;
+        std::uint64_t peak = runningPeak.load(std::memory_order_relaxed);
+        while (observed > peak &&
+               !runningPeak.compare_exchange_weak(peak, observed, std::memory_order_relaxed)) {
+        }
         RoleMemorySample sample;
         sample.Role = role;
-        sample.PeakRssBytes = ProcessPeakRssBytes();
+        // THE RUNNING MAXIMUM, never the kernel's peak verbatim - RoleMemory.h
-        sample.CurrentRssBytes = ProcessCurrentRssBytes();
+        // says why, and SessionTest's stubbed-reader control is the gate on it.
+        sample.PeakRssBytes = observed > peak ? observed : peak;
+        sample.CurrentRssBytes = kernelCurrentRssBytes;
         sample.MappedSegmentBytes = LedgerMappedBytes(role);
         return sample;
     }
 
+    RoleMemorySample SampleRoleMemory(MemoryRole role) {
+        std::uint64_t kernelPeak = 0;
+        std::uint64_t kernelCurrent = 0;
+        ProcessRssBytes(&kernelPeak, &kernelCurrent);
+        return SampleRoleMemoryInto(ProcessRunningPeak(), role, kernelPeak, kernelCurrent);
+    }
+
     void LogRoleMemory(const char* phase, const RoleMemorySample& sample) {
         // INFO, not DEBUG: t1 greps this out of a lane log and MGLOG_D is compiled out at the
         // INFO level every P5 lane builds at. It is a handful of lines per session - the

MobileGL/MG_Remote/Transport/WireLog.cpp

@@ -12,6 +12,7 @@
 
 #include <cstdarg>
 #include <cstdio>
+#include <cstdlib>
 
 namespace MobileGL::MG_Remote::Transport {
 
@@ -30,4 +31,23 @@ namespace MobileGL::MG_Remote::Transport {
         MGLOG_E("%s", line);
     }
 
+    void WireLogFatal(const char* format, ...) {
+        char line[512];
+        va_list args;
+        va_start(args, format);
+        const int written = std::vsnprintf(line, sizeof(line), format, args);
+        va_end(args);
+        if (written < 0) {
+            std::snprintf(line, sizeof(line),
+                          "MG_Remote wire: unformattable Fatal diagnostic (format=%s)", format);
+        }
+        MGLOG_F("%s", line);
+        // The stderr echo is the half a death test can see (WireLog.h). Unbuffered
+        // by default and flushed anyway: abort() does not flush stdio.
+        std::fputs(line, stderr);
+        std::fputc('\n', stderr);
+        std::fflush(stderr);
+        std::abort();
+    }
+
 } // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/WireLog.h

@@ -19,9 +19,9 @@
 // the one header under Transport/ that broke the rule; it now calls this
 // instead, and the umbrella stays inside WireLog.cpp.
 //
-// ERROR only, deliberately. Everything routed here is a latched protocol
+// ERROR and FATAL only, deliberately. Everything routed here is a latched
-// violation, never per-frame noise; non-critical wire lines use MGLOG_D from a
+// protocol violation, never per-frame noise; non-critical wire lines use
-// .cpp, where the INFO build compiles them out entirely.
+// MGLOG_D from a .cpp, where the INFO build compiles them out entirely.
 
 #pragma once
 
@@ -35,4 +35,25 @@ namespace MobileGL::MG_Remote::Transport {
     void
     WireLogError(const char* format, ...);
 
+    // Formats one line, emits it at FATAL level (MGLOG_F), ECHOES IT TO STDERR,
+    // and aborts. Every `Fatal{...}` this layer raises goes through here.
+    //
+    // WHY STDERR AS WELL. Defines.h builds the logger with the console sink OFF
+    // and the file sink ON, so an MGLOG line reaches exactly one place: the log
+    // file. A Fatal is the last thing the process says, and three readers need
+    // it somewhere other than a file whose path they may not know: a terminal,
+    // a CI job log, and a gtest death test - which matches its regex against
+    // the CHILD'S STDERR and nothing else. The wave-1 review (ID-46 finding 10)
+    // found both SessionTestDeath controls written with an empty regex for
+    // precisely that reason: with the diagnostic reachable only through the
+    // file sink there was nothing on stderr to name, so a bare std::abort() or
+    // a segfault satisfied them. The echo is what lets a death control name
+    // its diagnostic (R-16: a negative control asserts its own failure reason).
+    [[noreturn]]
+#if defined(__GNUC__) || defined(__clang__)
+    __attribute__((format(printf, 1, 2)))
+#endif
+    void
+    WireLogFatal(const char* format, ...);
+
 } // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Wire/PipeWireCodec.cpp

@@ -31,6 +31,9 @@
 #include <Config.h>
 #include <MG_Pipe/MGPipeRenderStateSpans.h>
 #include <MG_Pipe/PipeApply.h>
+// R-6's tier gate, and the ONE spelling of it (b1's file, unchanged by this package): the
+// MapPersistent arm below asks it the same question MGPipeApplyMapPersistent asks.
+#include <MG_Remote/Client/PersistentMapTracker.h>
 #include <MG_Remote/Protocol/generated/protocol_generated.h>
 #include <MG_State/GLState/ProgramState/ProgramArtifactsCodec.h>
 #include <MG_Util/Debug/Log.h>
@@ -457,6 +460,36 @@ namespace MobileGL::MG_Remote::Wire {
                     WireOpName(op), static_cast<unsigned long long>(blob.Size));
             std::abort();
         }
+        // R-2.3's SECOND HALF: "inside SOME segment" IS NOT THE RULE. Contract table 1 gives
+        // every client->server content blob - groups A, B and C, all nineteen rows - the ONE
+        // carrier SEG_STAGE, and R-10 sends blobs there whole. Until this arm existed the only
+        // test was that the run resolved, so `CreateSamplerState.Parameters={Seg=SEG_REPLY,...}`
+        // was accepted and APPLIED: a server-owned segment, whose reuse is the reply pool's
+        // business and has nothing to do with stage retirement, carrying bytes the applier
+        // then read. It also went unpoisoned - NoteResolvedRun skipped every non-stage carrier
+        // - so rule C's only mechanical control read zero on exactly the record that needed it.
+        //
+        // The segment is checked BEFORE the resolve, deliberately: a forged SEG_REPLY run that
+        // happens to lie inside a mapped reply pool must be refused for naming the wrong
+        // carrier, not left to pass or fail on whether that pool is mapped at all.
+        //
+        // NOT A NEW FATAL FAMILY. The review suggested `Fatal{BlobNotStaged}`; this is
+        // ProtocolCorruption like every other R-2 honesty arm, because the families are the
+        // vocabulary the operator and the CI greps share (ProtocolCorruption, AbiMismatch,
+        // UnmigratedVerb, UnmigratedPipeInput, UnsetCallMask, RingOverrun) and a one-off
+        // seventh name would be a token nothing else in the tree recognises. The SEGMENT is in
+        // the message, which is what has to be greppable.
+        if (blob.Seg != kSegStage) {
+            MGLOG_F("MGPipe: Fatal{ProtocolCorruption, \"%s.blob\"} seg=%u offset=%llu "
+                    "size=%llu is not SEG_STAGE(%u); every client->server content blob is "
+                    "staged whole in SEG_STAGE (contract table 1 groups A/B/C, R-10) and no "
+                    "other segment may carry one",
+                    WireOpName(op), static_cast<unsigned>(blob.Seg),
+                    static_cast<unsigned long long>(blob.Offset),
+                    static_cast<unsigned long long>(blob.Size),
+                    static_cast<unsigned>(kSegStage));
+            std::abort();
+        }
         if (segments.Resolve(blob.Seg, blob.Offset, blob.Size) == nullptr) {
             MGLOG_F("MGPipe: Fatal{ProtocolCorruption, \"%s.blob\"} seg=%u offset=%llu size=%llu "
                     "does not lie inside that segment (R-2.3)",
@@ -717,6 +750,12 @@ namespace MobileGL::MG_Remote::Wire {
         }
 
         for (int attempt = 0; attempt < 2; ++attempt) {
+            // THE WRAP SKIP MAY ONLY BE CHARGED AGAINST BYTES THAT ARE STILL IN FLIGHT. When
+            // there are none the allocator starts over at offset zero, so a blob the segment
+            // can hold whole is never refused (see RebaseEmptyStage). On attempt 1 this runs
+            // AFTER ReclaimStagedBytes, which is the case the finding describes: 8 MiB
+            // allocated, then retired, then a 28 MiB request that used to abort.
+            RebaseEmptyStage();
             const Uint64 offset = m_stageHead % m_stageCapacity;
             // A run is always contiguous: one that would straddle the end skips the remainder,
             // exactly as the ring's wrap pad does, and the skipped bytes are reclaimed with
@@ -936,6 +975,32 @@ namespace MobileGL::MG_Remote::Wire {
         return m_emitSeq;
     }
 
+    // THE EMPTY-STAGE REBASE. Head and tail are monotonic byte counts, so "every staged byte
+    // has retired" reads head == tail, NOT head == tail == 0, and `head % capacity` is left
+    // wherever the last run ended. Charging a wrap skip against that offset then costs the
+    // unused suffix a second time: with head == tail == 64 in a 256 KiB stage, the allocator's
+    // test became `2*capacity - 64 <= capacity`, which is false at EVERY occupancy, so a blob
+    // that fits the segment whole was refused with `Fatal{RingOverrun, "SEG_STAGE"}` - whose
+    // own message then reported `0 bytes still in flight`. ReclaimStagedBytes cannot help,
+    // because an already-empty tail has nothing left to move.
+    //
+    // THE MARK QUEUE COMES WITH IT. A mark holds the ABSOLUTE head cursor it was pushed at and
+    // ReclaimStagedBytes assigns that value straight to m_stageTail. Every mark not yet
+    // consumed has StageCursor <= head == tail - the head is monotonic and marks are pushed in
+    // order - so each of them names a region that is already reclaimed and zero is the
+    // truthful rebasing of it. Without that, one reclaim after a rebase would put the tail
+    // AHEAD of the head and StagedBytesInFlight() would underflow to about 2^64.
+    void PipeWireEncoder::RebaseEmptyStage() {
+        if (m_stageHead != m_stageTail || m_stageHead == 0) {
+            return;
+        }
+        m_stageHead = 0;
+        m_stageTail = 0;
+        for (SizeT i = 0; i < m_stageMarks.size(); ++i) {
+            m_stageMarks[i].StageCursor = 0;
+        }
+    }
+
     void PipeWireEncoder::ReclaimStagedBytes() {
         if (m_control == nullptr) {
             return;
@@ -1083,8 +1148,22 @@ namespace MobileGL::MG_Remote::Wire {
     }
 
     void PipeWireDecoder::NoteResolvedRun(MGPWireOp op, const MGPBlobRef& blob) {
+        // UNREACHABLE NOW, AND LOUD RATHER THAN SILENT. This used to `return`, and that made
+        // the audit's bookkeeping quietly optional: a record naming a non-SEG_STAGE carrier
+        // was applied AND recorded nothing, so PoisonedStageBytes() stayed zero and rule C's
+        // only mechanical control was dark on exactly the record it existed to catch. The one
+        // caller is ResolveOrFatal, which runs RequireDeclaredBlob first, and that now refuses
+        // both an undeclared blob and a non-SEG_STAGE one by name. If either ever arrives here
+        // the audit has stopped covering the carrier, which is the same failure as no audit at
+        // all - the reason the run-count overflow just below is a Fatal too.
         if (blob.Size == 0 || blob.Seg != kSegStage) {
-            return;
+            MGLOG_F("MGPipe: Fatal{ProtocolCorruption, \"%s\"} the audit was asked to record a "
+                    "resolved run with seg=%u size=%llu; only declared SEG_STAGE(%u) runs "
+                    "reach the poison fill (R-2.5)",
+                    WireOpName(op), static_cast<unsigned>(blob.Seg),
+                    static_cast<unsigned long long>(blob.Size),
+                    static_cast<unsigned>(kSegStage));
+            std::abort();
         }
         if (m_resolvedCount >= sizeof(m_resolved) / sizeof(m_resolved[0])) {
             // LOUD, NOT A SILENT DROP. This array is what the 0xDD fill covers, and a poison
@@ -1303,6 +1382,19 @@ namespace MobileGL::MG_Remote::Wire {
             //
             // DECLINED is a real answer, not a failure: the three frontend sites already
             // tolerate it (BufferObject.cpp:238, :603-606, :657-660).
+            //
+            // THE TIER IS CONSULTED HERE, AND IT IS THE SAME CONJUNCTION THE MONOLITH APPLIER
+            // USES (PipeApply.cpp's `Transport != Monolith && AdoptTierIsEmulate()`). The arm
+            // used to decline UNCONDITIONALLY and AdoptTier had no reference anywhere on the
+            // codec path, so MOBILEGL_IPC_ADOPT_TIER=0 and =1 - which contract §5 promises
+            // "parse and are Fatal at use, naming P11" - decoded as an ordinary DECLINED and
+            // the operator got a run that looked like a working T0. AdoptTierIsEmulate returns
+            // true at T2 and ABORTS at T0/T1 on its own named diagnostic, so the return value
+            // is deliberately not a branch: P5 declines at every tier it survives (R-6), and
+            // the two forbidden ones never get this far.
+            if (MG_Config::Transport != MG_Config::TransportMode::Monolith) {
+                (void)MG_Remote::Client::AdoptTierIsEmulate();
+            }
             PostReply(op, seq, ReplySink::kStatusDeclined, nullptr, 0);
             return true;
 

MobileGL/MG_Remote/Wire/PipeWireCodec.h

@@ -290,6 +290,17 @@ namespace MobileGL::MG_Remote::Wire {
         // RingControl - see ReclaimStagedBytes above.
         Uint8* StageAllocate(Uint64 size);
 
+        // AN EMPTY STAGE STARTS OVER AT ZERO, so that the wrap skip is only ever charged
+        // against bytes that are really still in flight. Head and tail are monotonic, so once
+        // everything has retired they are EQUAL BUT NOT ZERO, and `head % capacity` is
+        // wherever the last run happened to end - a wrap skip charged against that offset
+        // costs the suffix a second time and refused a blob the whole segment could hold, with
+        // a message that reported zero bytes in flight while it did so. Rebasing also rewrites
+        // the marks still held: a mark stores an ABSOLUTE head cursor and a later reclaim
+        // assigns it to m_stageTail, so leaving a stale one behind would drive the tail past
+        // the head and underflow StagedBytesInFlight().
+        void RebaseEmptyStage();
+
         Transport::RingControl* m_control = nullptr;
         Transport::RingProducer* m_cmd = nullptr;
         Transport::RingProducer* m_stage = nullptr;

MobileGL/MG_Test/Wire/CMakeLists.txt

@@ -66,6 +66,36 @@ endif ()
 
 gtest_discover_tests(PipeWireCodecTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
 
+# P5 s1's handshake suite (wave 1.5, ID-46 findings 6 and 7): the two null-union guards driven
+# THROUGH ServerSession::Accept and ClientSession::StartOverTransportPair, and the ABI
+# fingerprint's sensitivity case driven from CapsAbiFingerprint(), the production entry point.
+# Separate from SessionTest for two reasons: it needs CapsCodec.h and the sessions, i.e. the GL
+# frontend's umbrella header that the ring-owning suite deliberately keeps out; and each guard's
+# refusal is asserted BY MESSAGE, which with the console sink compiled out (Defines.h) means a
+# log file this process names before anything logs - PipeWireCodecTest's own-main() shape.
+add_executable(SessionHandshakeTest SessionHandshakeTest.cpp)
+
+target_include_directories(SessionHandshakeTest PRIVATE
+        ${MGL_ROOT}/include
+        ${MGL_ROOT}/MobileGL
+        ${MGL_ROOT}/MobileGL/MG_Pipe
+        ${MGL_ROOT}/3rdparty/flatbuffers/include
+        ${MGL_ROOT}/3rdparty/xxHash
+        ${MGL_ROOT}/3rdparty/Vulkan-Headers/include
+        ${MGL_ROOT}/3rdparty/SPIRV-Reflect
+)
+
+target_link_libraries(SessionHandshakeTest PRIVATE
+        GTest::gtest
+        ${LINK_LIBRARIES}
+)
+
+if (MSVC)
+    target_compile_options(SessionHandshakeTest PRIVATE /Zc:preprocessor)
+endif ()
+
+gtest_discover_tests(SessionHandshakeTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
+
 # P5 v1's suite: the apply thread, the blocking control mailbox, the verb stamp and R-11's
 # server-owned staging copy. Registered on its own for PipeWireCodecTest's reason - it links
 # gtest and carries its own main(), because the Fatal arms report through MGLOG_F + std::abort

MobileGL/MG_Test/Wire/PipeWireCodecTest.cpp

@@ -34,6 +34,8 @@
 
 #include "Includes.h"
 
+// MG_Config::Transport and MG_Config::Ipc.AdoptTier: the two knobs R-6's tier gate reads.
+#include <Config.h>
 #include <MG_Pipe/MGPipe.h>
 #include <MG_Pipe/MGPipeRenderStateSpans.h>
 #include <MG_Pipe/PipeApply.h>
@@ -516,6 +518,37 @@ TEST_F(PipeWireCodecTest, KReplySlotMapPersistentIsAConstantDecline) {
     EXPECT_TRUE(wire.Answers().All[0].Bytes.empty());
 }
 
+TEST_F(PipeWireCodecTest, TierTwoUnderSplitTransportStillDeclinesRatherThanRefusing) {
+    // The POSITIVE half of the two AdoptTier death cases below. Without it, those two could
+    // be satisfied by an arm that aborted on every tier, which is the opposite mistake to the
+    // one wave1-codex-verify.md §4 found. T2 is the only tier P5 implements and R-6 says the
+    // answer there is DECLINED - a real answer, not a failure - even when the transport is
+    // the split one that makes the tier question live at all.
+    const MG_Config::TransportMode savedTransport = MG_Config::Transport;
+    const Uint32 savedTier = MG_Config::Ipc.AdoptTier;
+    struct Restore {
+        MG_Config::TransportMode T;
+        Uint32 A;
+        ~Restore() {
+            MG_Config::Transport = T;
+            MG_Config::Ipc.AdoptTier = A;
+        }
+    } restore{savedTransport, savedTier};
+    MG_Config::Transport = MG_Config::TransportMode::InProcess;
+    MG_Config::Ipc.AdoptTier = 2u;
+
+    Wire2 wire;
+    const MGPHandleOnly handle = HandleOnly(5, MGPipeKind::Buffer);
+    ASSERT_NE(wire.Encoder().EncodeRecord(MGPWireOp::MapPersistent, &handle, sizeof(handle)),
+              kInvalidSeq);
+    bool applied = false;
+    ASSERT_TRUE(wire.PumpOne(&applied));
+    EXPECT_TRUE(applied);
+    ASSERT_EQ(wire.Answers().All.size(), 1u);
+    EXPECT_EQ(wire.Answers().All[0].Status, ReplySink::kStatusDeclined);
+    EXPECT_TRUE(wire.Answers().All[0].Bytes.empty());
+}
+
 TEST_F(PipeWireCodecTest, KNeedsAckRespecifyCarriesItsRedefinitionScope) {
     // Contract table 1 row 19b. Without the carrier every per-level glTexImage*D would take
     // the whole-resource arm on the far side and eat the other levels' pending uploads, so
@@ -1135,6 +1168,43 @@ TEST_F(PipeWireCodecTest, StagedBytesAreReclaimedOnlyBehindRetiredSeq) {
     ASSERT_TRUE(wire.PumpOne(&applied));
     wire.Encoder().ReclaimStagedBytes();
     EXPECT_EQ(wire.Encoder().StagedBytesInFlight(), 0u);
+
+    // ---- AND AN EMPTY STAGE TAKES THE WHOLE SEGMENT ---------------------------------
+    // The verifier's extension of this case, kept (wave1-codex-verify.md §1). The 64-byte
+    // run has retired and in-flight bytes are ZERO, so every byte of SEG_STAGE is free -
+    // but head and tail are monotonic and both sit at 64, so `head % capacity` is 64 and the
+    // allocator used to charge a `capacity - 64` wrap skip against a capacity that had
+    // nothing in it. The test then read `2*capacity - 64 <= capacity`, false at every
+    // occupancy, and a blob the segment holds WHOLE aborted with
+    // `Fatal{RingOverrun, "SEG_STAGE"} ... with 0 bytes still in flight`.
+    //
+    // I made it red once, by doing X: X = deleting the `RebaseEmptyStage()` call at the top
+    // of StageAllocate's attempt loop (PipeWireCodec.cpp). The case then dies with SIGABRT
+    // inside PipeWireEncoder::StageAllocate on that message, exactly as the verifier
+    // recorded it.
+    //
+    // THE EXACT MAXIMUM. `need = Align8(size)` and the first bound is `need > capacity`, so
+    // an empty stage takes a blob of exactly the capacity the encoder adopted - here
+    // Wire2::kStageBytes, and in a real session the whole SEG_STAGE view, i.e.
+    // MOBILEGL_IPC_STAGE_MB (32 MiB by default; SessionRings.h keeps SEG_STAGE un-ringed and
+    // un-rounded, so there is no control page to subtract).
+    const Uint64 maxRecordBefore = wire.Encoder().MaxRecordBytesSeen();
+    std::vector<std::uint8_t> whole(Wire2::kStageBytes, 0x5A);
+    const MGPBlobRef full = wire.Encoder().StageBytes(whole.data(), whole.size());
+    EXPECT_EQ(full.Offset, 0u) << "an empty stage must hand a whole-capacity blob offset zero";
+    EXPECT_EQ(full.Size, Wire2::kStageBytes);
+    EXPECT_EQ(full.Seg, static_cast<Uint32>(kSegStage));
+    EXPECT_EQ(wire.Encoder().StagedBytesInFlight(), Wire2::kStageBytes);
+    const void* back = wire.Segments().Resolve(full.Seg, full.Offset, full.Size);
+    ASSERT_NE(back, nullptr);
+    EXPECT_EQ(back, wire.StageBase());
+
+    // R-10's max-record counter DOES NOT SEE IT, and that is the point of R-10's carrier
+    // rule: EncodeRecord feeds m_maxRecordBytes from `layout.TotalBytes` - header + payload +
+    // tails, all of it SEG_CMD - while the blob leaves only {Seg, Offset, Size} in the
+    // record. A quarter-megabyte of staging moved the counter by zero bytes. SEG_STAGE has
+    // its own bound and its own named Fatal, and MaxRecordBytesSeen() is not it.
+    EXPECT_EQ(wire.Encoder().MaxRecordBytesSeen(), maxRecordBefore);
 }
 
 // ---- M2 / M3: SEG_STAGE's cursors and the mark queue --------------------------------------
@@ -1463,6 +1533,69 @@ TEST_F(PipeWireCodecTest, ARunThatLeavesItsSegmentIsFatal) {
     EXPECT_NE(r.Log.find("does not lie inside that segment"), std::string::npos) << r.Log;
 }
 
+TEST_F(PipeWireCodecTest, AContentBlobCarriedOutsideSegStageIsFatalAtTheDecoder) {
+    // R-2.3's second half, and the verifier's finding-3 fixture kept as its own case
+    // (wave1-codex-verify.md §3). Contract table 1 row 17 puts CreateSamplerState's bytes in
+    // SEG_STAGE; here they sit in a mapped SEG_REPLY - the SERVER-owned reply pool, whose
+    // reuse has nothing to do with stage retirement - and the record names that segment. It
+    // used to be ACCEPTED and APPLIED, because the only test was that the run resolved
+    // somewhere: the verifier's probe printed `seg=3 accepted=1 poisoned=0`.
+    //
+    // The audit is armed, so the second half of the finding is nailed down too: with the
+    // poison ON, the record must DIE rather than be applied with PoisonedStageBytes() left at
+    // zero. NoteResolvedRun used to return silently for any non-stage carrier, which made
+    // rule C's only mechanical control dark on exactly the record it exists to catch; it is
+    // now a Fatal of its own and unreachable behind this arm.
+    //
+    // I made it red once, by doing X: X = deleting the `blob.Seg != kSegStage` arm in
+    // CheckBlobIsHonest (PipeWireCodec.cpp). The child then exits 0 instead of aborting and
+    // this case fails on DiedOfAbort - the verifier's `accepted=1` state.
+    const ChildResult r = RunInChild([] {
+        Wire2 wire;
+        std::vector<std::uint8_t> replyBytes(4096, 0);
+        SamplerParameters params{};
+        params.borderColorForm = BorderColorForm::Int;
+        std::memcpy(replyBytes.data(), &params, sizeof(params));
+        wire.Segments().Install(kSegReply, SegmentView{replyBytes.data(), replyBytes.size()});
+        wire.Decoder().SetAuditPoison(true);
+
+        MGPSamplerDesc desc{};
+        desc.Cso = MakeHandle(88);
+        desc.Parameters.Seg = static_cast<Uint32>(kSegReply);
+        desc.Parameters.Offset = 0;
+        desc.Parameters.Size = sizeof(SamplerParameters);
+        ForgeAndDecode(wire, MGPWireOp::CreateSamplerState, &desc, sizeof(desc), nullptr, 0);
+    });
+    ASSERT_TRUE(DiedOfAbort(r)) << DescribeStatus(r) << "\n" << r.Log;
+    EXPECT_NE(r.Log.find("is not SEG_STAGE"), std::string::npos) << r.Log;
+    EXPECT_NE(r.Log.find("CreateSamplerState.blob"), std::string::npos) << r.Log;
+    EXPECT_NE(r.Log.find("seg=3"), std::string::npos) << r.Log;
+}
+
+TEST_F(PipeWireCodecTest, TheEncoderRefusesTheNonStageCarrierTheDecoderCallsFatal) {
+    // THE ENCODER MUST NOT ACCEPT A RECORD THE DECODER FATALS ON - the same symmetry
+    // TheEncoderRefusesThePerStageSpirvRunTheDecoderCallsFatal states one arm over. Under
+    // `inproc` a SEG_REPLY pointer resolves, so an emitter that staged into the reply pool
+    // would get a valid seq here and a Fatal on a peer, which is the asymmetry EncodeRecord's
+    // own honesty loop exists to prevent.
+    //
+    // I made it red once, by doing X: X = deleting the `blob.Seg != kSegStage` arm in
+    // CheckBlobIsHonest. EncodeRecord then returns a real seq and the child exits 0.
+    const ChildResult r = RunInChild([] {
+        Wire2 wire;
+        std::vector<std::uint8_t> replyBytes(4096, 0);
+        wire.Segments().Install(kSegReply, SegmentView{replyBytes.data(), replyBytes.size()});
+        MGPSamplerDesc desc{};
+        desc.Cso = MakeHandle(88);
+        desc.Parameters.Seg = static_cast<Uint32>(kSegReply);
+        desc.Parameters.Offset = 0;
+        desc.Parameters.Size = sizeof(SamplerParameters);
+        (void)wire.Encoder().EncodeRecord(MGPWireOp::CreateSamplerState, &desc, sizeof(desc));
+    });
+    ASSERT_TRUE(DiedOfAbort(r)) << DescribeStatus(r) << "\n" << r.Log;
+    EXPECT_NE(r.Log.find("is not SEG_STAGE"), std::string::npos) << r.Log;
+}
+
 TEST_F(PipeWireCodecTest, AHalfDeclaredBlobIsFatalRatherThanReadAsAbsent) {
     // The shape a MONOLITH emitter produces - Seg None, Offset a host address, Size 0. Reading
     // it as "absent" would silently drop the bytes of every record an unconverted emitter sent.
@@ -1718,6 +1851,59 @@ TEST_F(PipeWireCodecTest, ASecondProcessResolverIsFatalRatherThanASilentRace) {
     EXPECT_NE(r.Log.find("already installed"), std::string::npos) << r.Log;
 }
 
+// ---- R-6 / contract §5: the two forbidden adoption tiers die ON THE WIRE PATH TOO --------
+//
+// wave1-codex-verify.md §4: `AdoptTier` had ZERO references anywhere on the codec path, so
+// MOBILEGL_IPC_ADOPT_TIER=0 and =1 - which contract §5 promises "parse and are Fatal at use,
+// naming P11" - decoded as an ordinary DECLINED. The verifier set each forbidden tier inside
+// KReplySlotMapPersistentIsAConstantDecline and watched its successful-decline assertions
+// still pass, on BOTH tiers.
+//
+// THESE ARE FORKED, NOT EXPECT_DEATH, for the reason at the top of this file - and forking is
+// what lets the case REQUIRE THE DIAGNOSTIC rather than any abort: r.Log is searched for the
+// exact sentence AdoptTierIsEmulate prints. ID-46 finding 10 is an empty death regex; the
+// EXPECT_NE lines below are the opposite of that, and a crash for any other reason fails the
+// case on the log it prints.
+//
+// I made both red once, by doing X: X = restoring the unconditional decline in
+// PipeWireCodec.cpp's MapPersistent arm (deleting the AdoptTierIsEmulate call). Both children
+// then exit 0 having posted a clean DECLINED, and both cases fail on DiedOfAbort.
+
+TEST_F(PipeWireCodecTest, AdoptTierZeroIsFatalOnTheWirePathAndNamesP11) {
+    const ChildResult r = RunInChild([] {
+        // The child dies; nothing needs restoring. The transport half is the same conjunction
+        // MGPipeApplyMapPersistent uses - a monolith TRANSPORT mints like push (ID-42) and is
+        // not the arm this record can arrive on.
+        MG_Config::Transport = MG_Config::TransportMode::InProcess;
+        MG_Config::Ipc.AdoptTier = 0u;
+        Wire2 wire;
+        const MGPHandleOnly handle = HandleOnly(5, MGPipeKind::Buffer);
+        (void)wire.Encoder().EncodeRecord(MGPWireOp::MapPersistent, &handle, sizeof(handle));
+        bool applied = false;
+        (void)wire.PumpOne(&applied);
+    });
+    ASSERT_TRUE(DiedOfAbort(r)) << DescribeStatus(r) << "\n" << r.Log;
+    EXPECT_NE(r.Log.find("MOBILEGL_IPC_ADOPT_TIER=0 names adoption tier T0, which P11 implements"),
+              std::string::npos)
+        << r.Log;
+}
+
+TEST_F(PipeWireCodecTest, AdoptTierOneIsFatalOnTheWirePathAndNamesP11) {
+    const ChildResult r = RunInChild([] {
+        MG_Config::Transport = MG_Config::TransportMode::InProcess;
+        MG_Config::Ipc.AdoptTier = 1u;
+        Wire2 wire;
+        const MGPHandleOnly handle = HandleOnly(5, MGPipeKind::Buffer);
+        (void)wire.Encoder().EncodeRecord(MGPWireOp::MapPersistent, &handle, sizeof(handle));
+        bool applied = false;
+        (void)wire.PumpOne(&applied);
+    });
+    ASSERT_TRUE(DiedOfAbort(r)) << DescribeStatus(r) << "\n" << r.Log;
+    EXPECT_NE(r.Log.find("MOBILEGL_IPC_ADOPT_TIER=1 names adoption tier T1, which P11 implements"),
+              std::string::npos)
+        << r.Log;
+}
+
 #else
 
 TEST_F(PipeWireCodecTest, TheFatalArmsNeedFork) {

MobileGL/MG_Test/Wire/ProtocolSmokeTest.cpp

@@ -69,11 +69,15 @@ TEST(ProtocolSmokeTest, HelloRoundTrips) {
     EXPECT_EQ(envelope->msg_as_Welcome(), nullptr);
 }
 
+// The four canonical sizes: 8 MiB / 32 MiB / 16 MiB / 256 KiB. SEG_REPLY is 16 MiB by ID-47
+// (eight slots of 2 MiB, sized from the largest P5 read - E2's 640x480 RGBA8 snapshot - which
+// the previous 8 MiB pool could not hold); SessionTest pins the same number on the mapping and
+// CONTRACT-P5 §2 row 23 on paper. All three move together or not at all.
 TEST(ProtocolSmokeTest, WelcomeCarriesTheFourSegmentAnnouncements) {
     ::flatbuffers::FlatBufferBuilder builder(1024);
     auto cmd = CreateSegmentRefDirect(builder, 1, SegmentKind::Cmd, 8ull * 1024 * 1024, "cmd");
     auto stage = CreateSegmentRefDirect(builder, 2, SegmentKind::Stage, 32ull * 1024 * 1024, "stage");
-    auto reply = CreateSegmentRefDirect(builder, 3, SegmentKind::Reply, 8ull * 1024 * 1024, "reply");
+    auto reply = CreateSegmentRefDirect(builder, 3, SegmentKind::Reply, 16ull * 1024 * 1024, "reply");
     auto event = CreateSegmentRefDirect(builder, 4, SegmentKind::Event, 256ull * 1024, "event");
     auto welcome = CreateWelcome(builder, MOBILEGL_PROTOCOL_ABI_MAJOR, MOBILEGL_PROTOCOL_ABI_MINOR,
                                  /*serverPid=*/99, cmd, stage, reply, event);
@@ -91,6 +95,11 @@ TEST(ProtocolSmokeTest, WelcomeCarriesTheFourSegmentAnnouncements) {
     EXPECT_EQ(parsed->cmdRing()->sizeBytes(), 8ull * 1024 * 1024);
     ASSERT_NE(parsed->stageRing(), nullptr);
     EXPECT_EQ(parsed->stageRing()->sizeBytes(), 32ull * 1024 * 1024);
+    // The pin never read the reply announcement back before ID-47; a size that moved on the
+    // wire and not here would have gone unnoticed.
+    ASSERT_NE(parsed->replyPool(), nullptr);
+    EXPECT_EQ(parsed->replyPool()->kind(), SegmentKind::Reply);
+    EXPECT_EQ(parsed->replyPool()->sizeBytes(), 16ull * 1024 * 1024);
     ASSERT_NE(parsed->eventRing(), nullptr);
     EXPECT_EQ(parsed->eventRing()->sizeBytes(), 256ull * 1024);
 }

MobileGL/MG_Test/Wire/SessionHandshakeTest.cpp

@@ -0,0 +1,292 @@
+// MobileGL - MobileGL/MG_Test/Wire/SessionHandshakeTest.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The two handshakes, driven for real (P5 s1, wave 1.5 - ID-46 findings 6 and 7).
+//
+// WHY THIS SUITE EXISTS BESIDE SessionTest. SessionTest is the ring-owning suite and keeps the
+// GL frontend's umbrella header out on purpose. Both of the wave-1 review's findings against it
+// were the same defect seen twice: a case that observed a property of the thing it built itself
+// - a null-union frame it never sent anywhere, a mixer production never called - and so could
+// not go red when the production code it was named for was deleted. The cure for both is to
+// start from the production entry point, and the production entry points (ServerSession::Accept,
+// ClientSession::StartOverTransportPair, CapsAbiFingerprint) all reach Includes.h. So they are
+// exercised here, in a target that carries the include paths and links gtest rather than
+// gtest_main: each guard's refusal is asserted BY MESSAGE, and with the console sink compiled
+// out (Defines.h) an MGLOG line reaches exactly one place, the log file this process names
+// before anything logs - PipeWireCodecTest's main() shape.
+//
+// EVERY CASE BELOW CARRIES ITS RED-ONCE LINE, and each of those perturbations was run.
+
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "Includes.h"
+
+#include <MG_Remote/CapsCodec.h>
+#include <MG_Remote/Client/ClientSession.h>
+#include <MG_Remote/Protocol/generated/protocol_generated.h>
+#include <MG_Remote/Server/ServerSession.h>
+#include <MG_Remote/Transport/InProcessTransport.h>
+#include <MG_Remote/Transport/SessionRings.h>
+
+#if __has_include(<MGGitHash.h>)
+#include <MGGitHash.h>
+#define MGL_HANDSHAKE_TEST_HAS_GIT_HASH 1
+#else
+#define MGL_HANDSHAKE_TEST_HAS_GIT_HASH 0
+#endif
+
+#if defined(_WIN32)
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
+
+using namespace MobileGL;
+using namespace MobileGL::MG_Remote;
+namespace Transport = MobileGL::MG_Remote::Transport;
+
+namespace {
+
+    std::string g_logPath;
+
+    std::string ReadLog() {
+        std::ifstream in(g_logPath, std::ios::binary);
+        std::ostringstream ss;
+        ss << in.rdbuf();
+        return ss.str();
+    }
+
+    long ProcessId() {
+#if defined(_WIN32)
+        return static_cast<long>(::_getpid());
+#else
+        return static_cast<long>(::getpid());
+#endif
+    }
+
+    bool Contains(const std::string& haystack, const char* needle) {
+        return haystack.find(needle) != std::string::npos;
+    }
+
+    // The reviewer's 24-byte shape (SessionTest.ANullUnionFrameVerifiesWhichIsThePremiseOf-
+    // BothHandshakeGuards proves it verifies): the envelope's tag says `tag` and its union
+    // member is NULL, because FlatBuffers' Verifier::VerifyTable is `return !table ||
+    // table->Verify(*this)`.
+    std::vector<Uint8> BuildNullUnionFrame(::MobileGL::Wire::CtrlMsg tag) {
+        ::flatbuffers::FlatBufferBuilder builder(256);
+        auto envelope =
+            ::MobileGL::Wire::CreateCtrlEnvelope(builder, tag, ::flatbuffers::Offset<void>());
+        ::MobileGL::Wire::FinishCtrlEnvelopeBuffer(builder, envelope);
+        const Uint8* begin = builder.GetBufferPointer();
+        return std::vector<Uint8>(begin, begin + builder.GetSize());
+    }
+
+} // namespace
+
+// ---------------------------------------------------------------------------
+// The ABI fingerprint, from the production entry point (ID-46 finding 6)
+// ---------------------------------------------------------------------------
+
+// The value Hello and Welcome carry is CapsAbiFingerprint(). This case starts THERE, requires it
+// to be the mixer over its own published inputs, pins those inputs to the real sizeofs and
+// constants (ID-33's list: the three struct sizes, kOpCount, the protocol ABI version, the git
+// stamp - plus the caps blob's extents and the two codec versions), and then perturbs every
+// input by one through the same mixer and requires the answer to move. RED ONCE by replacing
+// CapsAbiFingerprint()'s body with `return 1;` - the verifier's exact perturbation, which left
+// the whole unit lane green before this case existed - and it fails on the first EXPECT_EQ
+// below. Also red, separately, by deleting any one `mix(...)` line from MixAbiFingerprint: the
+// matching EXPECT_NE names the input that stopped being mixed. Both perturbations were run.
+TEST(SessionHandshakeTest, TheAbiFingerprintChangesWhenAnyOfItsInputsDoes) {
+    const Uint64 production = CapsAbiFingerprint();
+    EXPECT_NE(production, 0u) << "0 is reserved for \"not stated\"";
+    EXPECT_EQ(production, CapsAbiFingerprint()) << "not stable within one build";
+
+    const Transport::AbiFingerprintInputs inputs = CapsAbiFingerprintInputs();
+    EXPECT_EQ(production, Transport::MixAbiFingerprint(inputs))
+        << "CapsAbiFingerprint() is not MixAbiFingerprint over CapsAbiFingerprintInputs(): the "
+           "handshake compares a value this case cannot reach, which is finding 6 again";
+
+    // The inputs are the real ones, so a CapsAbiFingerprintInputs() that hard-coded a size
+    // would be caught here rather than agreed with by a peer built from a different tree.
+    EXPECT_EQ(inputs.DynamicParamsSize, sizeof(MG_Backend::DynamicBackendParameters));
+    EXPECT_EQ(inputs.CapsSize, sizeof(MG_Pipe::MGPCaps));
+    EXPECT_EQ(inputs.FunctionTableSize, sizeof(MG_Backend::GLFunctionsTable));
+    EXPECT_EQ(inputs.FormatCapabilityTargets,
+              static_cast<Uint64>(MG_Backend::kFormatCapabilityTargetCount));
+    EXPECT_EQ(inputs.FormatCapabilityFormats,
+              static_cast<Uint64>(MG_Backend::kFormatCapabilityFormatCount));
+    EXPECT_NE(inputs.FormatCapabilitiesCodecVersion, 0u);
+    EXPECT_NE(inputs.RendererInfoCodecVersion, 0u);
+    EXPECT_EQ(inputs.OpCount, static_cast<Uint64>(MG_Pipe::MGPWireOp::kOpCount));
+    EXPECT_EQ(inputs.AbiVersion, static_cast<Uint32>(MOBILEGL_ABI_VERSION(
+                                     MOBILEGL_PROTOCOL_ABI_MAJOR, MOBILEGL_PROTOCOL_ABI_MINOR)));
+    ASSERT_NE(inputs.BuildStamp, nullptr);
+    EXPECT_NE(inputs.BuildStamp[0], '\0');
+#if MGL_HANDSHAKE_TEST_HAS_GIT_HASH
+    EXPECT_STREQ(inputs.BuildStamp, GIT_COMMIT_HASH_SHORT);
+#endif
+
+    // Every input moves the answer. Each lambda changes exactly one field of a copy of the
+    // REAL inputs, so what is proven is that the production value depends on that field.
+    const auto perturbed = [&](auto&& mutate) {
+        Transport::AbiFingerprintInputs copy = inputs;
+        mutate(copy);
+        return Transport::MixAbiFingerprint(copy);
+    };
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { ++i.DynamicParamsSize; }))
+        << "sizeof(DynamicBackendParameters) is not mixed";
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { ++i.CapsSize; }))
+        << "sizeof(MGPCaps) is not mixed";
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { ++i.FunctionTableSize; }))
+        << "sizeof(GLFunctionsTable) is not mixed";
+    EXPECT_NE(production,
+              perturbed([](Transport::AbiFingerprintInputs& i) { ++i.FormatCapabilityTargets; }))
+        << "kFormatCapabilityTargetCount is not mixed";
+    EXPECT_NE(production,
+              perturbed([](Transport::AbiFingerprintInputs& i) { ++i.FormatCapabilityFormats; }))
+        << "kFormatCapabilityFormatCount is not mixed";
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) {
+                  ++i.FormatCapabilitiesCodecVersion;
+              }))
+        << "kFormatCapabilitiesCodecVersion is not mixed";
+    EXPECT_NE(production,
+              perturbed([](Transport::AbiFingerprintInputs& i) { ++i.RendererInfoCodecVersion; }))
+        << "kRendererInfoCodecVersion is not mixed";
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { ++i.OpCount; }))
+        << "MGPWireOp::kOpCount is not mixed (ID-33)";
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { ++i.AbiVersion; }))
+        << "the protocol ABI version is not mixed (ID-33)";
+    EXPECT_NE(production,
+              perturbed([](Transport::AbiFingerprintInputs& i) { i.BuildStamp = "not-this-build"; }))
+        << "the git stamp is not mixed";
+    // A missing stamp is not the same as an empty one, and neither is the same as a real build.
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { i.BuildStamp = nullptr; }));
+    EXPECT_NE(production, perturbed([](Transport::AbiFingerprintInputs& i) { i.BuildStamp = ""; }));
+    EXPECT_NE(perturbed([](Transport::AbiFingerprintInputs& i) { i.BuildStamp = nullptr; }),
+              perturbed([](Transport::AbiFingerprintInputs& i) { i.BuildStamp = ""; }))
+        << "\"no stamp\" and \"an empty stamp\" collapsed into one input";
+}
+
+// ---------------------------------------------------------------------------
+// The two null-union guards, driven THROUGH the handshakes (ID-46 finding 7)
+// ---------------------------------------------------------------------------
+
+// A frame whose tag says Hello and whose Hello is NULL, sent on a real InProcessTransport pair to
+// a real ServerSession::Accept - a session of this case's own, not the process singleton. Accept
+// must answer MOBILEGL_ERR_PROTOCOL_MISMATCH with its guard's own line, and must not have
+// dereferenced the member: nothing Fatal in the log, nothing accepted. RED ONCE by deleting
+// `envelope->msg_as_Hello() == nullptr` from the guard in ServerSession.cpp: the tag check
+// passes, `hello` is nullptr, and `hello->buildFingerprint()` reads address 0 - the case dies
+// instead of returning. That perturbation was run.
+TEST(SessionHandshakeTest, ANullUnionHelloIsRefusedByAcceptRatherThanDereferenced) {
+    std::unique_ptr<Transport::InProcessTransport> client;
+    std::unique_ptr<Transport::InProcessTransport> server;
+    Transport::InProcessTransport::CreatePair(client, server);
+    ASSERT_NE(client, nullptr);
+    ASSERT_NE(server, nullptr);
+
+    const std::vector<Uint8> frame = BuildNullUnionFrame(::MobileGL::Wire::CtrlMsg::Hello);
+    ASSERT_EQ(client->SendFrame(MobileGLByteSpan{frame.data(), frame.size()}), MOBILEGL_OK);
+
+    Server::ServerSession session;
+    const std::string before = ReadLog();
+    EXPECT_EQ(session.Accept(*server), MOBILEGL_ERR_PROTOCOL_MISMATCH)
+        << "a null-union Hello was not refused by the handshake";
+    EXPECT_FALSE(session.Accepted());
+    const std::string delta = ReadLog().substr(before.size());
+    EXPECT_TRUE(Contains(delta, "MG_Remote server: the first control frame is not a verifiable Hello"))
+        << "Accept refused, but not with the guard's own line. Log delta:\n"
+        << delta;
+    EXPECT_FALSE(Contains(delta, "Fatal{")) << "the refusal became a Fatal. Log delta:\n" << delta;
+    session.Close();
+}
+
+// The Welcome guard. ClientSession::Start builds its transport pair itself, so nothing could put
+// a frame on the server->client direction ahead of the server's Welcome - which is why
+// StartOverTransportPair, Start's second half, is public (ClientSession.h). The frame is queued
+// there BEFORE Start sends Hello: the server's Accept then runs for real (segments, Welcome,
+// resolver), its genuine Welcome queues behind the null-union one, the client reads the
+// null-union one first and must refuse it with the guard's own line, and Stop()'s not-started
+// path must have closed the server the handshake had accepted. RED ONCE by deleting
+// `envelope->msg_as_Welcome() == nullptr` from the guard in ClientSession.cpp: `welcome` is then
+// nullptr and `welcome->buildFingerprint()` reads address 0 - the case dies. That perturbation
+// was run.
+TEST(SessionHandshakeTest, ANullUnionWelcomeIsRefusedByStartRatherThanDereferenced) {
+    std::unique_ptr<Transport::InProcessTransport> client;
+    std::unique_ptr<Transport::InProcessTransport> server;
+    Transport::InProcessTransport::CreatePair(client, server);
+    ASSERT_NE(client, nullptr);
+    ASSERT_NE(server, nullptr);
+
+    const std::vector<Uint8> frame = BuildNullUnionFrame(::MobileGL::Wire::CtrlMsg::Welcome);
+    ASSERT_EQ(server->SendFrame(MobileGLByteSpan{frame.data(), frame.size()}), MOBILEGL_OK);
+
+    Client::ClientSession& session = Client::ClientSessionInstance();
+    Server::ServerSession& serverSession = Server::ServerSessionInstance();
+    ASSERT_FALSE(session.Started());
+    ASSERT_FALSE(serverSession.Accepted());
+
+    const std::string before = ReadLog();
+    EXPECT_EQ(session.StartOverTransportPair(std::move(client), std::move(server)),
+              MOBILEGL_ERR_PROTOCOL_MISMATCH)
+        << "a null-union Welcome was not refused by the handshake";
+    EXPECT_FALSE(session.Started());
+    EXPECT_EQ(Client::ClientSession::Active(), nullptr);
+    // Stop()'s not-started path closes the server FIRST (ClientSession.cpp); a server left
+    // m_accepted would refuse every later Start in this process.
+    EXPECT_FALSE(serverSession.Accepted());
+    EXPECT_EQ(Server::ServerSession::Active(), nullptr);
+
+    const std::string delta = ReadLog().substr(before.size());
+    EXPECT_TRUE(Contains(delta,
+                         "MG_Remote client: the server's first control frame is not a verifiable "
+                         "Welcome"))
+        << "Start refused, but not with the guard's own line. Log delta:\n"
+        << delta;
+    EXPECT_FALSE(Contains(delta, "Fatal{AbiMismatch"))
+        << "the null-union Welcome reached the fingerprint compare. Log delta:\n"
+        << delta;
+    // And the server's half of the handshake DID run - the Hello it received was this
+    // client's real one - so the case drove Start past the point a stub would stop at.
+    EXPECT_TRUE(Contains(delta, "MG_Remote server: accepted with NO backend"))
+        << "ServerSession::Accept never ran, so the Welcome guard was not reached the way "
+           "Start reaches it. Log delta:\n"
+        << delta;
+}
+
+int main(int argc, char** argv) {
+    // Before anything logs: MG_Util::Debug::InitFile() reads the variable once, on the first
+    // write, and caches the FILE*. The name carries this process's pid, because
+    // gtest_discover_tests runs every case as its own process, in parallel under ctest -j.
+    namespace fs = std::filesystem;
+    const fs::path path = fs::temp_directory_path() /
+                          ("mobilegl-sessionhandshake-test-" + std::to_string(ProcessId()) + ".log");
+    std::error_code ec;
+    fs::remove(path, ec);
+    g_logPath = path.string();
+#if defined(_WIN32)
+    _putenv_s("MOBILEGL_LOG_FILE_PATH", g_logPath.c_str());
+#else
+    setenv("MOBILEGL_LOG_FILE_PATH", g_logPath.c_str(), 1);
+#endif
+    ::testing::InitGoogleTest(&argc, argv);
+    const int rc = RUN_ALL_TESTS();
+    fs::remove(path, ec);
+    return rc;
+}

MobileGL/MG_Test/Wire/SessionTest.cpp

@@ -198,7 +198,8 @@ TEST(SessionTest, TheDefaultGeometryIsTheFourContractRingSizes) {
     ASSERT_EQ(segments.Create(SessionSegmentSizes{}, MemoryRole::Server), MOBILEGL_OK);
     EXPECT_EQ(segments.CmdRingCapacity(), 8ull * 1024 * 1024);
     EXPECT_EQ(segments.StageBytes(), 32ull * 1024 * 1024);
-    EXPECT_EQ(segments.ReplyBytes(), 8ull * 1024 * 1024);
+    // ID-47: 16 MiB, eight slots of 2 MiB. ProtocolSmokeTest pins the same number on the wire.
+    EXPECT_EQ(segments.ReplyBytes(), 16ull * 1024 * 1024);
     EXPECT_EQ(segments.EventRingCapacity(), 256ull * 1024);
 
     EXPECT_EQ(segments.AnnouncedSize(SessionSegmentSlot::Cmd),
@@ -206,12 +207,60 @@ TEST(SessionTest, TheDefaultGeometryIsTheFourContractRingSizes) {
     // SEG_STAGE is not a ring at all - no control page, no cursor triple, no power-of-two
     // rounding - and neither is SEG_REPLY, so both announce exactly what was asked for.
     EXPECT_EQ(segments.AnnouncedSize(SessionSegmentSlot::Stage), 32ull * 1024 * 1024);
-    EXPECT_EQ(segments.AnnouncedSize(SessionSegmentSlot::Reply), 8ull * 1024 * 1024);
+    EXPECT_EQ(segments.AnnouncedSize(SessionSegmentSlot::Reply), 16ull * 1024 * 1024);
     EXPECT_EQ(segments.AnnouncedSize(SessionSegmentSlot::Event),
               256ull * 1024 + sizeof(RingControl));
     segments.Close();
 }
 
+// ID-47 (ID-46 finding 2). The DEFAULT reply pool must hold the largest P5 read: the E2 retrace
+// harness snapshots OpenRA's whole 640x480 surface as GL_RGBA/GL_UNSIGNED_BYTE through the
+// interposer, 1,228,800 bytes, and the previous geometry (8 MiB / 8 slots, 1 MiB minus a 16-byte
+// header) refused it by 180,240 bytes - and refused the 512x512 RGBA8 read s1-v1.md:134 claimed
+// it covered, by sixteen. This is the verifier's case, committed: it posts exactly 640*480*4
+// bytes into a pool built from SessionSegmentSizes{} and reads them back. RED ONCE by reverting
+// SessionSegmentSizes::ReplyBytes to 8 MiB: Post then takes its oversize-abort branch and the
+// case dies, which is the verifier's original outcome. That perturbation was run.
+TEST(SessionTest, TheDefaultReplyGeometryHoldsTheLargestP5Read) {
+    SessionSegments segments;
+    ASSERT_EQ(segments.Create(SessionSegmentSizes{}, MemoryRole::Server), MOBILEGL_OK);
+    ReplySlotPool pool(segments.ReplyBase(), segments.ReplyBytes(), segments.ReplySlotCount());
+    ASSERT_TRUE(pool.Valid());
+    EXPECT_EQ(pool.SlotCount(), 8u);
+    EXPECT_EQ(pool.SlotBytes(), 2u * 1024 * 1024);
+    EXPECT_EQ(pool.MaxReplyBytes(), 2u * 1024 * 1024 - 16u);
+
+    const std::uint64_t kOpenRaSnapshot = 640ull * 480 * 4; // E2's read, the largest in P5
+    const std::uint64_t kHalfKSquare = 512ull * 512 * 4;    // the read s1-v1.md:134 got wrong
+    EXPECT_TRUE(pool.CanHold(kOpenRaSnapshot));
+    EXPECT_TRUE(pool.CanHold(kHalfKSquare));
+
+    std::vector<std::uint8_t> answer(static_cast<std::size_t>(kOpenRaSnapshot));
+    for (std::size_t i = 0; i < answer.size(); ++i) {
+        answer[i] = static_cast<std::uint8_t>(i * 7 + (i >> 12));
+    }
+    pool.Post(1, kReplyStatusOk, answer.data(), answer.size());
+
+    std::vector<std::uint8_t> back(answer.size(), 0);
+    std::int32_t status = -1;
+    std::uint64_t size = 0;
+    ASSERT_TRUE(pool.Read(1, back.data(), back.size(), &status, &size))
+        << "the E2 snapshot does not fit the default reply pool";
+    EXPECT_EQ(status, kReplyStatusOk);
+    EXPECT_EQ(size, kOpenRaSnapshot);
+    EXPECT_EQ(std::memcmp(back.data(), answer.data(), answer.size()), 0);
+
+    // And the 512x512 read, in the next slot, so a geometry that only just clears 640x480 by
+    // some accident of rounding cannot pass this case either.
+    answer.resize(static_cast<std::size_t>(kHalfKSquare));
+    pool.Post(2, kReplyStatusOk, answer.data(), answer.size());
+    back.assign(answer.size(), 0);
+    ASSERT_TRUE(pool.Read(2, back.data(), back.size(), &status, &size));
+    EXPECT_EQ(size, kHalfKSquare);
+    EXPECT_EQ(std::memcmp(back.data(), answer.data(), answer.size()), 0);
+    segments.Close();
+}
+
 // The ledger is per role and DOES double-count under inproc, deliberately: the two roles map
 // the same pages here and will not under spawn, so the per-role numbers are what t1 subtracts
 // with and a silently deduplicated total would hide exactly that difference.
@@ -229,9 +278,12 @@ TEST(SessionTest, TheMemoryLedgerIsPerRoleAndIsReleasedOnClose) {
         const RoleMemorySample sample = SampleRoleMemory(MemoryRole::Client);
         EXPECT_EQ(sample.MappedSegmentBytes, clientBefore + mapped);
 #if defined(__linux__) || defined(__ANDROID__)
-        // VmHWM is the PROCESS's high-water mark, so it is the same number for both roles and
+        // The peak is the PROCESS's, so it is the same number for both roles and is only
-        // is only meaningful beside the ledger - which is why RoleMemorySample carries both.
+        // meaningful beside the ledger - which is why RoleMemorySample carries both.
         EXPECT_GT(sample.PeakRssBytes, 0u);
+        // Holds BY CONSTRUCTION now (the ledger's own running max, RoleMemory.h), not by
+        // the kernel's grace: GitHub run 35079459114 failed exactly this line with VmHWM
+        // 4,784,128 < VmRSS 4,849,664. The control on the construction is the next case.
         EXPECT_GE(sample.PeakRssBytes, sample.CurrentRssBytes);
 #endif
     }
@@ -239,6 +291,50 @@ TEST(SessionTest, TheMemoryLedgerIsPerRoleAndIsReleasedOnClose) {
     EXPECT_EQ(LedgerMappedBytes(MemoryRole::Server), serverBefore);
 }
 
+// The kernel's VmHWM is NOT a monotone bound on the kernel's VmRSS at read time: hiwater_rss
+// is stored only when RSS is about to drop, task_mem() reports max(stored, rss-now), and the
+// wave-1 sampler read the two keys in two passes, so the second fopen could grow RSS past the
+// peak the first pass reported. GitHub run 35079459114 (ubuntu-24.04) caught it; the probe under
+// ~/w7/p5-s1-probe reproduced it locally. The rule is therefore that the ledger keeps ITS OWN
+// running peak and folds the kernel's two numbers into it, so a stubbed reader whose current
+// exceeds its peak must not fail. RED ONCE by reverting SampleRoleMemoryInto to
+// `sample.PeakRssBytes = kernelPeakRssBytes;` - the first EXPECT_EQ below then reads 100 against
+// 200 and the EXPECT_GE beside it is the CI line again. That perturbation was run.
+TEST(SessionTest, TheLedgersPeakIsItsOwnRunningMaxAndNeverTheKernelsHighWaterMarkVerbatim) {
+    std::atomic<std::uint64_t> runningPeak{0};
+
+    // The CI shape: the kernel says peak 100, current 200.
+    RoleMemorySample sample = SampleRoleMemoryInto(runningPeak, MemoryRole::Client, 100, 200);
+    EXPECT_EQ(sample.PeakRssBytes, 200u)
+        << "the kernel's peak was reported verbatim although its current exceeded it";
+    EXPECT_GE(sample.PeakRssBytes, sample.CurrentRssBytes);
+    EXPECT_EQ(sample.CurrentRssBytes, 200u);
+    EXPECT_EQ(runningPeak.load(), 200u);
+
+    // A later, smaller sample does not lower it: a running max never decreases.
+    sample = SampleRoleMemoryInto(runningPeak, MemoryRole::Server, 150, 120);
+    EXPECT_EQ(sample.PeakRssBytes, 200u);
+    EXPECT_EQ(sample.CurrentRssBytes, 120u);
+    EXPECT_EQ(sample.Role, MemoryRole::Server);
+
+    // The kernel's peak still counts when it IS the larger number: it is a lower bound on
+    // the true peak that this process's own samples may have missed.
+    sample = SampleRoleMemoryInto(runningPeak, MemoryRole::Client, 300, 100);
+    EXPECT_EQ(sample.PeakRssBytes, 300u);
+    EXPECT_EQ(runningPeak.load(), 300u);
+
+    // And the production sampler reads BOTH keys in ONE pass, so the pair it folds is one
+    // snapshot: on Linux neither number is 0 and the pair is self-consistent.
+#if defined(__linux__) || defined(__ANDROID__)
+    std::uint64_t kernelPeak = 0;
+    std::uint64_t kernelCurrent = 0;
+    ProcessRssBytes(&kernelPeak, &kernelCurrent);
+    EXPECT_GT(kernelPeak, 0u);
+    EXPECT_GT(kernelCurrent, 0u);
+    EXPECT_GE(kernelPeak, kernelCurrent) << "one pass over /proc/self/status disagreed with itself";
+#endif
+}
+
 // ---------------------------------------------------------------------------
 // Two real threads, twenty thousand records
 // ---------------------------------------------------------------------------
@@ -571,14 +667,72 @@ TEST(SessionTest, DeclinedIsARealAnswerWithNoPayload) {
 #if defined(GTEST_HAS_DEATH_TEST) && GTEST_HAS_DEATH_TEST
 // A reply larger than a slot is FATAL, not chunked and not truncated: P5's only large answer is
 // a blocking ReadPixels whose size the client knows before it emits, so an overflow means the
-// two sides disagree about the frame. A gate that cannot go red is not a gate.
+// two sides disagree about the frame. A gate that cannot go red is not a gate - and a death
+// control with an empty regex is not a gate either (ID-46 finding 10: a bare std::abort(), or a
+// segfault in a broken refusal path, satisfied the previous `""`). The regex below is the
+// diagnostic's own wording, which WireLogFatal echoes to stderr for exactly this reader. RED ONCE
+// by replacing the oversize branch's WireLogFatal with a bare std::abort(): the process still
+// dies, the regex finds nothing, and the case fails on "died but not with the expected error".
+// That perturbation was run. The boundary is a pair: exactly MaxReplyBytes() posts and reads
+// back, one more byte is the named refusal.
 TEST(SessionTestDeath, AReplyLargerThanItsSlotIsFatalRatherThanTruncated) {
     SessionSegments segments;
     ASSERT_EQ(segments.Create(TestSizes(), MemoryRole::Server), MOBILEGL_OK);
     ReplySlotPool pool(segments.ReplyBase(), segments.ReplyBytes(), segments.ReplySlotCount());
     ASSERT_TRUE(pool.Valid());
-    std::vector<std::uint8_t> oversize(pool.SlotBytes() + 1, 0xAB);
+    ASSERT_EQ(pool.SlotBytes(), 8192u);
-    EXPECT_DEATH(pool.Post(1, kReplyStatusOk, oversize.data(), oversize.size()), "");
+    ASSERT_EQ(pool.MaxReplyBytes(), 8176u);
+
+    std::vector<std::uint8_t> exact(pool.MaxReplyBytes(), 0xAB);
+    EXPECT_TRUE(pool.CanHold(exact.size()));
+    pool.Post(1, kReplyStatusOk, exact.data(), exact.size());
+    std::vector<std::uint8_t> back(exact.size(), 0);
+    std::uint64_t size = 0;
+    ASSERT_TRUE(pool.Read(1, back.data(), back.size(), nullptr, &size));
+    EXPECT_EQ(size, exact.size());
+
+    std::vector<std::uint8_t> oversize(pool.MaxReplyBytes() + 1, 0xAB);
+    EXPECT_FALSE(pool.CanHold(oversize.size()));
+    EXPECT_DEATH(pool.Post(2, kReplyStatusOk, oversize.data(), oversize.size()),
+                 "reply pool: Fatal\\{ProtocolCorruption\\} - a 8177 byte answer for seq 2 does not "
+                 "fit a 8192 byte slot \\(payload cap 8176\\)");
+}
+
+// ID-47's client half, on the DEFAULT geometry so the numbers are the ruling's: exactly
+// MaxReplyBytes() = 2,097,136 passes, one more byte is refused BY NAME before emission, and the
+// 1024x512 RGBA8 read - exactly 2 MiB, sixteen bytes over the cap, the same sixteen-byte shape
+// that sank the previous geometry's 512x512 claim - is refused with its own dimensions in the
+// line. The message is the contract's verbatim: `ReadPixels <w>x<h> <format> <bytes> > <cap>`.
+// RED ONCE by replacing RequireReadPixelsFits's WireLogFatal with a bare std::abort() (the two
+// death regexes then match nothing) and, separately, by making CanHold `<` instead of `<=` (the
+// exact-cap call then dies). Both perturbations were run.
+TEST(SessionTestDeath, AReadPixelsLargerThanAReplySlotIsRefusedAtTheClientByName) {
+    SessionSegments segments;
+    ASSERT_EQ(segments.Create(SessionSegmentSizes{}, MemoryRole::Server), MOBILEGL_OK);
+    ReplySlotPool pool(segments.ReplyBase(), segments.ReplyBytes(), segments.ReplySlotCount());
+    ASSERT_TRUE(pool.Valid());
+    const std::uint64_t cap = pool.MaxReplyBytes();
+    ASSERT_EQ(cap, 2097136u);
+    constexpr std::uint32_t kGlRgba = 0x1908;
+    constexpr std::uint32_t kGlUnsignedByte = 0x1401;
+
+    // Exactly the cap: 524,284 RGBA8 pixels in one row. Returns, no death.
+    ASSERT_EQ(524284ull * 1 * 4, cap);
+    EXPECT_TRUE(pool.CanHold(cap));
+    pool.RequireReadPixelsFits(524284, 1, kGlRgba, kGlUnsignedByte, cap);
+
+    // One more byte.
+    EXPECT_FALSE(pool.CanHold(cap + 1));
+    EXPECT_DEATH(pool.RequireReadPixelsFits(524284, 1, kGlRgba, kGlUnsignedByte, cap + 1),
+                 "Fatal\\{ReplyTooLarge, \"ReadPixels 524284x1 0x1908/0x1401 2097137 > 2097136\"\\}");
+
+    // The read a caller would actually make: 1024x512 RGBA8 = 2 MiB, 16 over.
+    EXPECT_DEATH(pool.RequireReadPixelsFits(1024, 512, kGlRgba, kGlUnsignedByte, 1024ull * 512 * 4),
+                 "Fatal\\{ReplyTooLarge, \"ReadPixels 1024x512 0x1908/0x1401 2097152 > 2097136\"\\}");
+
+    // And E2's read, the reason for the geometry, is not refused.
+    pool.RequireReadPixelsFits(640, 480, kGlRgba, kGlUnsignedByte, 640ull * 480 * 4);
+    segments.Close();
 }
 #endif
 
@@ -766,27 +920,16 @@ TEST(SessionTest, ShutdownUnparksTheApplyThreadAndTheJoinIsBounded) {
 }
 
 // ---------------------------------------------------------------------------
-// The ABI fingerprint's mixer
+// The ABI fingerprint's mixer: MOVED to SessionHandshakeTest (ID-46 finding 6).
+//
+// The case that lived here drove MixAbiFingerprint with made-up sizes and never touched
+// CapsAbiFingerprint(), the value the two handshakes actually compare - which had its own
+// second FNV loop and no caller of the mixer at all, so `return 1;` in production left the
+// whole unit lane green. The sensitivity case now starts from CapsAbiFingerprint(), which
+// needs CapsCodec.h and therefore the GL frontend's umbrella header that this suite keeps
+// out; it lives in SessionHandshakeTest.cpp beside the two handshake-guard controls.
 // ---------------------------------------------------------------------------
 
-// A fingerprint that cannot be SHOWN to change is indistinguishable from one that is never
-// compared, which is why the mixer takes its sizes as arguments instead of reading sizeof
-// directly: a test can vary one byte and prove the answer moves.
-TEST(SessionTest, TheAbiFingerprintChangesWhenAnyOfItsInputsDoes) {
-    const std::uint64_t base = MixAbiFingerprint(1024, 1080, 552, 0x00010000, "abc1234");
-    EXPECT_NE(base, 0u) << "0 is reserved for \"not stated\"";
-    EXPECT_EQ(base, MixAbiFingerprint(1024, 1080, 552, 0x00010000, "abc1234"));
-
-    EXPECT_NE(base, MixAbiFingerprint(1025, 1080, 552, 0x00010000, "abc1234"));
-    EXPECT_NE(base, MixAbiFingerprint(1024, 1081, 552, 0x00010000, "abc1234"));
-    EXPECT_NE(base, MixAbiFingerprint(1024, 1080, 553, 0x00010000, "abc1234"));
-    EXPECT_NE(base, MixAbiFingerprint(1024, 1080, 552, 0x00010001, "abc1234"));
-    EXPECT_NE(base, MixAbiFingerprint(1024, 1080, 552, 0x00010000, "abc1235"));
-    // A missing stamp is not the same as an empty one, and neither is the same as a real build.
-    EXPECT_NE(MixAbiFingerprint(1024, 1080, 552, 0x00010000, nullptr),
-              MixAbiFingerprint(1024, 1080, 552, 0x00010000, "abc1234"));
-}
-
 // ---------------------------------------------------------------------------
 // Fix round 1 - the cases the adversarial review's findings earned
 // ---------------------------------------------------------------------------
@@ -796,13 +939,19 @@ TEST(SessionTest, TheAbiFingerprintChangesWhenAnyOfItsInputsDoes) {
 // appliedSeq is behind, every later advance is a no-op for ever and every WaitForApplied on
 // kWaitForever - the verb barrier and every reply wait - blocks permanently. A hang whose only
 // evidence is one ERROR line is not a diagnosis.
+//
+// The regex names the diagnostic (ID-46 finding 10; see the reply-pool death control for why an
+// empty one was not a gate). RED ONCE by replacing AdvanceMonotonic's WireLogFatal block with a
+// bare std::abort(): the case then fails on "died but not with the expected error". That
+// perturbation was run.
 #if defined(GTEST_HAS_DEATH_TEST) && GTEST_HAS_DEATH_TEST
 TEST(SessionTestDeath, AWatermarkThatMovesBackwardsIsFatalRatherThanIgnored) {
     alignas(4096) RingControl control{};
     InitRingControl(control);
     Watermark::AdvanceApplied(control, 10);
     ASSERT_EQ(control.appliedSeq.load(), 10u);
-    EXPECT_DEATH(Watermark::AdvanceApplied(control, 9), "");
+    EXPECT_DEATH(Watermark::AdvanceApplied(control, 9),
+                 "Fatal\\{ProtocolCorruption, \"watermark\"\\} appliedSeq moved backwards, 10 -> 9");
 }
 #endif
 
@@ -925,10 +1074,17 @@ TEST(SessionTest, TheProducerRemembersWhatItPublishedEvenIfTheWatermarkLags) {
 
 // M-3. FlatBuffers' Verifier::VerifyTable is `return !table || table->Verify(*this)`, so a NULL
 // union member PASSES verification: a 24-byte frame verifies, carries the file identifier,
-// reports msg_type() == Hello, and returns nullptr from msg_as_Hello(). Both handshakes now
+// reports msg_type() == Hello, and returns nullptr from msg_as_Hello(). Both handshakes fold
-// fold that into their guard instead of dereferencing it. This case is the proof the shape is
+// that into their guard instead of dereferencing it.
-// reachable at all, so the guard cannot be "simplified" away later.
+//
-TEST(SessionTest, AVerifiableFrameCanCarryANullUnionPayload) {
+// THIS CASE IS THE PREMISE, NOT THE CONTROL. It proves the shape is reachable - a FlatBuffers
+// property - and nothing about MobileGL: the wave-1 review (ID-46 finding 7) deleted both
+// `msg_as_*() == nullptr` clauses and this case stayed green, because it never calls Accept or
+// Start. The controls on the two guards are SessionHandshakeTest's, which drive this exact
+// frame THROUGH ServerSession::Accept and ClientSession::StartOverTransportPair and require
+// each guard's own refusal line. s1-v1.md:338 claimed this case meant "the guard cannot be
+// simplified away"; it did not, and s1-v3.md says so.
+TEST(SessionTest, ANullUnionFrameVerifiesWhichIsThePremiseOfBothHandshakeGuards) {
     ::flatbuffers::FlatBufferBuilder builder(256);
     auto envelope = ::MobileGL::Wire::CreateCtrlEnvelope(builder, ::MobileGL::Wire::CtrlMsg::Hello,
                                                          ::flatbuffers::Offset<void>());
@@ -1028,26 +1184,69 @@ TEST(SessionTest, TheStageCursorTripleStaysDeadAcrossAWholeSession) {
 // have every var-tail record SKIPPED by Pop, silently, with the record lost and nothing logged on
 // either side. Pop now requires a filler to carry both the flag AND kind == kRingPadRecordKind, so
 // a real record wearing that bit is delivered instead of eaten.
+//
+// THE BIT HAS TO BE ON THE WIRE. The first version of this case asked Reserve(7, kRecPad, 16),
+// and RingProducer::Reserve MASKS kRecPad OUT of whatever the caller passes (Ring.cpp: `flags &
+// ~kRecPad`), so the header it stored had flags == 0, Pop's pad arm was never entered, and the
+// case stayed green with the kind check deleted (ID-46 finding 5, executed by the verifier). So
+// this producer writes the header ITSELF after Reserve, the way a codec with its own header
+// struct does - MGPWireRecHeader and RingRecordHeader are the same eight bytes - which is the one
+// path Reserve's mask cannot cover. RingTest.TheTwoFlagSpacesAreDisjointByTranslation (ID-43) is
+// the same control at the ring; this one is at the SESSION, where what is pinned in addition is
+// that appliedSeq counts the delivered record and does NOT count the genuine filler beside it.
+// RED ONCE by deleting `&& header.kind == kRingPadRecordKind` from RingConsumer::Pop: the record
+// vanishes into the wrap-filler skip, `seen` stays 0 and appliedSeq stays 0, and the case fails
+// on the first EXPECT's message. That perturbation was run.
 TEST(SessionTest, ARecordWearingThePadBitIsDeliveredRatherThanEatenAsAFiller) {
     SessionFixture session;
     ASSERT_TRUE(session.Build(TestSizes()));
 
     // kRecPad is MGPipeCallFlags::kVarTail's bit. Kind 7 is a real opcode, not a filler.
-    void* payload = session.cmdProducer.Reserve(7, kRecPad, 16);
+    void* payload = session.cmdProducer.Reserve(7, kRecNone, 16);
     ASSERT_NE(payload, nullptr);
     std::memset(payload, 0xAB, 16);
+    // Stamp the bit past Reserve's mask, exactly where the codec's header struct would put it.
+    auto* headerBytes = static_cast<std::uint8_t*>(payload) - sizeof(RingRecordHeader);
+    RingRecordHeader stamped{};
+    std::memcpy(&stamped, headerBytes, sizeof(stamped));
+    ASSERT_EQ(stamped.kind, 7u);
+    ASSERT_EQ(stamped.flags & kRecPad, 0u) << "Reserve stopped masking kRecPad";
+    stamped.flags = static_cast<std::uint16_t>(stamped.flags | kRecPad);
+    std::memcpy(headerBytes, &stamped, sizeof(stamped));
     session.producer.PublishAndNotify(1);
 
     int seen = 0;
     std::uint16_t seenKind = 0;
+    std::uint16_t seenFlags = 0;
     while (session.consumer.ApplyOne([&](const RingRecordView& view) {
         seenKind = view.kind;
+        seenFlags = view.flags;
         ++seen;
     })) {
     }
-    EXPECT_EQ(seen, 1) << "the record was skipped as a wrap filler because it wore bit 2";
+    EXPECT_EQ(seen, 1) << "the record was skipped as a wrap filler because it wore bit 2 - Pop's "
+                          "kind check (a filler is kRecPad AND kind == kRingPadRecordKind) is the "
+                          "only thing between a stamped header and a silently deleted record";
     EXPECT_EQ(seenKind, 7);
+    EXPECT_NE(seenFlags & kRecPad, 0u)
+        << "the bit arrives intact: the kind check narrows the SKIP, it does not scrub the bit";
     EXPECT_EQ(session.Control().appliedSeq.load(), 1u);
+
+    // The opposite control, so that "delivered" cannot be satisfied by not skipping anything:
+    // a header wearing kRecPad whose kind IS kRingPadRecordKind is a genuine wrap filler, still
+    // vanishes, and is NOT counted by appliedSeq (R-9: a filler does not advance seq).
+    void* filler = session.cmdProducer.Reserve(kRingPadRecordKind, kRecNone, 16);
+    ASSERT_NE(filler, nullptr);
+    headerBytes = static_cast<std::uint8_t*>(filler) - sizeof(RingRecordHeader);
+    std::memcpy(&stamped, headerBytes, sizeof(stamped));
+    stamped.flags = static_cast<std::uint16_t>(stamped.flags | kRecPad);
+    std::memcpy(headerBytes, &stamped, sizeof(stamped));
+    session.producer.PublishAndNotify(2);
+    while (session.consumer.ApplyOne([&](const RingRecordView&) { ++seen; })) {
+    }
+    EXPECT_EQ(seen, 1) << "a genuine filler was delivered as a record: Pop's skip was removed, "
+                          "not narrowed";
+    EXPECT_EQ(session.Control().appliedSeq.load(), 1u) << "a filler advanced appliedSeq (R-9)";
 }
 
 // The kHostSpan/kRecBorrowSlot collision, made loud. P5 implements no borrowed slots and is ruled

docs/Disaggregated/ARCHITECTURE.md

@@ -419,7 +419,7 @@ P13：删 `SnapshotFromGLContext()` 的非 verify 分支、`MGB_CTX`、`MOBILEGL
 |---|---|---|---|
 | `SEG_CMD` | client（server 只读） | 8 MiB，2 的幂 | `RingControl`（4 KiB 页）+ POD 记录 + ≤4 KiB 内联负载 |
 | `SEG_STAGE` | client | 32 MiB，上限实测定 | bulk 字节：buffer sub-data、纹理紧密重打包区域、UBO scratch、client 顶点/索引/indirect 数组、multi-draw 参数块、具名 UBO host payload、persistent-map 脏块 |
-| `SEG_REPLY` | server（client 只读） | 8 MiB，4 KiB slot | readback 像素、buffer writeback |
+| `SEG_REPLY` | server（client 只读） | 16 MiB，8 个 2 MiB slot（ID-47：按最大场景读回 640×480 RGBA8 定尺，超过即 client 侧具名拒绝） | readback 像素、buffer writeback |
 | `SEG_EVENT` | server | 256 KiB SPSC ring | 十个回调的事件 + `EvQueryResult/EvFenceSignaled/EvReadbackDone` |
 | `SEG_SHADOW[n]` | client | 每对象，≥256 KiB shadow（Phase 2） | 零拷贝 buffer/texture shadow |
 | `SEG_ADOPT[n]` | server（client RW） | 每 buffer，≥16 MiB adopted store（P11） | 应用直写 GPU 内存 |

scripts/ci/control_smoke_test.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# R-16 FOR THE CI NEGATIVE CONTROLS THEMSELVES: a control-run smoke test.
+#
+# BRIEF-P5 13 (R-16) says a negative control must assert its own failure reason and that every gate
+# carries a line saying "I made it red once, by doing X". The two controls this file exercises ARE
+# gates, and until ID-46 finding 8 nobody could make either of them red, because a workflow `run:`
+# block only executes on a runner. The wave-1 verification agent had to hand-copy the blocks into
+# throwaway harnesses to show they were broken (wave1-codex-verify.md 8). This file is that
+# experiment, kept: it runs the REAL control scripts - the same files .github/workflows/test.yml
+# invokes, not copies of them - against a stubbed ctest, and checks that each one passes exactly
+# when it should.
+#
+# The case that matters is the first one. A stubbed ctest reports a NON-EMPTY selection and then
+# fails with UNRELATED_CONTROL_FAILURE: a reason that has nothing to do with the knob the control
+# turns. Before ID-48's fix both controls printed their success message and the step exited 0. They
+# must now report FAILED.
+#
+# usage: control_smoke_test.sh
+set -u
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "${WORK}"' EXIT
+
+STUB_DIR="${WORK}/stub"
+mkdir -p "${STUB_DIR}"
+cp "${HERE}/testdata/stub_ctest.sh" "${STUB_DIR}/ctest"
+chmod +x "${STUB_DIR}/ctest"
+
+passes=0
+failures=0
+
+# expect <expected: PASSED|FAILED> <label> -- <command...>
+expect() {
+  want="$1"; label="$2"; shift 3   # shift past the literal "--"
+  outfile="${WORK}/run.out"
+  "$@" > "${outfile}" 2>&1
+  rc=$?
+  if [ "${rc}" -eq 0 ]; then got="PASSED"; else got="FAILED"; fi
+  if [ "${got}" = "${want}" ]; then
+    passes=$((passes + 1))
+    printf 'ok       %-58s %s (rc=%d)\n' "${label}" "${got}" "${rc}"
+  else
+    failures=$((failures + 1))
+    printf 'NOT OK   %-58s expected %s, got %s (rc=%d)\n' "${label}" "${want}" "${got}" "${rc}"
+    sed 's/^/           | /' "${outfile}"
+  fi
+}
+
+run_split() { # $1 = STUB_MODE
+  env -i PATH="${STUB_DIR}:/usr/bin:/bin" STUB_MODE="$1" \
+      CTEST=ctest CONTROL_TMPDIR="${WORK}/tmp-$1" \
+      bash "${HERE}/split_negative_controls.sh"
+}
+
+run_retrace() { # $1 = STUB_MODE
+  cd "${WORK}" || return 127
+  mkdir -p "${WORK}/OpenRA"
+  env -i PATH="${STUB_DIR}:/usr/bin:/bin" STUB_MODE="$1" \
+      CTEST=ctest CONTROL_TMPDIR="${WORK}/tmp-$1" \
+      PULL_LIBRARY="${WORK}/pull.so" FROZEN_LIBRARY="${WORK}/frozen.so" \
+      bash "${HERE}/retrace_pull_library_control.sh" OpenRA DirectGLES
+}
+
+echo "=== the split lane's E1 / E3(a) controls (scripts/ci/split_negative_controls.sh)"
+# THE FINDING, REPRODUCED. Non-empty selection, green baseline, and a red that is not the knob's.
+expect FAILED "unrelated failure with a non-empty selection" -- run_split unrelated
+# ... and the same control on the same stub, failing for its own reason: it must PASS.
+expect PASSED "the scenarios' own diagnostic"               -- run_split evidence
+# The pre-existing half of the control, which was never broken: a knob that reds nothing.
+expect FAILED "the knob leaves the selection green"          -- run_split green
+# The arming counter's half of the finding: a baseline that is already red cannot arm anything.
+expect FAILED "the baseline is already red"                  -- run_split red-baseline
+# The disarmed lane, which is a legitimate exit 0 while c1/s1/v1 are landing.
+expect PASSED "every split entry skipped (lane not armed)"   -- run_split all-skipped
+
+echo
+echo "=== the retrace lane's pull-library control (scripts/ci/retrace_pull_library_control.sh)"
+# A pull-shaped library the nm identity check accepts: a real ELF .so defining no MG_Remote symbol.
+if command -v cc > /dev/null 2>&1; then
+  printf '%s\n' 'int mobilegl_pull_only(void) { return 1; }' > "${WORK}/pull.c"
+  cc -shared -fPIC -o "${WORK}/pull.so" "${WORK}/pull.c" || { echo "cannot build the stand-in library"; exit 1; }
+else
+  echo "no cc available; the retrace half of this smoke test needs one" >&2
+  exit 1
+fi
+: > "${WORK}/frozen.so"
+
+# THE FINDING, part (b): a regex matching no tests. --no-tests=error exits non-zero and the old
+# control read that as "the pull library turned it red".
+expect FAILED "empty selection (--no-tests=error exit)"      -- run_retrace retrace-noselect
+# A red that never names the transport: a fixture failure, a loader failure, a timeout.
+expect FAILED "red without the transport-resolution message" -- run_retrace retrace-unrelated
+# The real thing - and note the stub emits it CMake-wrapped across two lines, which a line-oriented
+# grep for the literal sentence would miss.
+expect PASSED "run_trace_case.cmake's own sentence, wrapped" -- run_retrace retrace-evidence
+# The pull library replaying green is the failure this control exists to catch.
+expect FAILED "a pull library passed the split retrace"      -- run_retrace retrace-green
+
+echo
+echo "smoke test: ${passes} passed, ${failures} failed"
+if [ "${failures}" -gt 0 ]; then
+  echo "CONTROL_SMOKE_TEST_FAILED"
+  exit 1
+fi
+echo "CONTROL_SMOKE_TEST_OK"

scripts/ci/junit_tally.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Tally a ctest --output-junit file as "passed failed skipped".
+
+Split out of .github/workflows/test.yml's negative-control step so that the workflow, the local
+gate and the control smoke test all count a run the same way.
+
+WHY THIS EXISTS AT ALL (ID-46 finding 8, second half). The counter this replaces lived inline in
+the workflow and counted a case as having "run" when it was merely not <skipped/>:
+
+    if case.find('skipped') is None and case.get('status') not in ('notrun', 'disabled'):
+        ran += 1
+
+so a case that RAN AND FAILED armed the negative controls below it. Combined with the `|| true`
+that hid the baseline's exit code, a lane in which every split entry was already red reported
+itself armed, and a control that turns an already-red entry red then "passed". Passed, failed and
+skipped are three different answers and the caller needs all three.
+"""
+
+import sys
+import xml.etree.ElementTree as ET
+
+
+def tally(path):
+    passed = failed = skipped = 0
+    for case in ET.parse(path).getroot().iter('testcase'):
+        if case.find('failure') is not None or case.find('error') is not None:
+            failed += 1
+        elif case.find('skipped') is not None or case.get('status') in ('notrun', 'disabled'):
+            skipped += 1
+        else:
+            passed += 1
+    return passed, failed, skipped
+
+
+def main():
+    if len(sys.argv) != 2:
+        print("usage: junit_tally.py <junit.xml>", file=sys.stderr)
+        return 2
+    try:
+        passed, failed, skipped = tally(sys.argv[1])
+    except Exception as exc:  # a malformed file is not "zero of everything"
+        print(f"junit_tally: cannot parse {sys.argv[1]}: {exc}", file=sys.stderr)
+        return 1
+    print(f"{passed} {failed} {skipped}")
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

scripts/ci/redcheck_control_smoke_test.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# R-16's "I made it red once, by doing X" for scripts/ci/control_smoke_test.sh, mechanised so the
+# claim can be re-checked rather than believed.
+#
+# X = revert the message check in each control, i.e. put the controls back in the state ID-46
+#     finding 8 found them in: a non-zero ctest exit is accepted whatever the failure was.
+#
+# The smoke test must then FAIL, and it must fail on the two cases that exist for this defect -
+# "unrelated failure with a non-empty selection" and "red without the transport-resolution
+# message" - and not merely somewhere. A smoke test that goes red for any other reason when the
+# evidence check is removed would not be pinning the evidence check.
+set -u
+HERE="$(cd "$(dirname "$0")" && pwd)"
+WORK="$(mktemp -d)"
+trap 'cp "${WORK}/split.orig" "${HERE}/split_negative_controls.sh"; cp "${WORK}/retrace.orig" "${HERE}/retrace_pull_library_control.sh"; rm -rf "${WORK}"' EXIT
+
+cp "${HERE}/split_negative_controls.sh" "${WORK}/split.orig"
+cp "${HERE}/retrace_pull_library_control.sh" "${WORK}/retrace.orig"
+
+echo "=== baseline: the smoke test must be GREEN before anything is perturbed"
+if ! bash "${HERE}/control_smoke_test.sh" > "${WORK}/before.log" 2>&1; then
+  echo "the smoke test is ALREADY RED; the red-check below would prove nothing"
+  cat "${WORK}/before.log"
+  exit 1
+fi
+tail -1 "${WORK}/before.log"
+
+echo
+echo "=== perturbation: remove the evidence check from both controls"
+python3 - "${HERE}/split_negative_controls.sh" "${HERE}/retrace_pull_library_control.sh" <<'PY'
+import sys
+split, retrace = sys.argv[1], sys.argv[2]
+for path, needle in ((split, 'grep -qE "${evidence}"'), (retrace, 'grep -qF "${EVIDENCE}"')):
+    text = open(path).read()
+    out, hit = [], 0
+    for line in text.splitlines(keepends=True):
+        if needle in line and line.lstrip().startswith('if ! '):
+            indent = line[:len(line) - len(line.lstrip())]
+            out.append(f"{indent}if false; then\n")
+            hit += 1
+        else:
+            out.append(line)
+    if hit != 1:
+        raise SystemExit(f"expected exactly one evidence check in {path}, found {hit}")
+    open(path, 'w').write(''.join(out))
+print("both evidence checks reverted to 'any non-zero ctest exit is accepted'")
+PY
+
+echo
+echo "=== the smoke test on the reverted controls (it MUST be red, on those two cases)"
+bash "${HERE}/control_smoke_test.sh" > "${WORK}/after.log" 2>&1
+rc=$?
+cat "${WORK}/after.log"
+
+if [ "${rc}" -eq 0 ]; then
+  echo
+  echo "RED-CHECK FAILED: the controls accept an unrelated failure again and the smoke test still passed."
+  exit 1
+fi
+
+missed=0
+grep -q "NOT OK   unrelated failure with a non-empty selection" "${WORK}/after.log" || missed=1
+grep -q "NOT OK   red without the transport-resolution message" "${WORK}/after.log" || missed=1
+if [ "${missed}" -ne 0 ]; then
+  echo
+  echo "RED-CHECK FAILED: the smoke test went red, but not on the two cases the evidence check exists for."
+  exit 1
+fi
+
+echo
+echo "P5_T1_CONTROL_SMOKE_REDCHECK_OK - removing the evidence check reds exactly the two cases that pin it"

scripts/ci/retrace_pull_library_control.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+# THE RETRACE-SPLIT LANE'S NEGATIVE CONTROL: a PULL library must red this split retrace.
+#
+# This file is the body of .github/workflows/test.yml's "Negative control - the PULL library must
+# red this split retrace" step, extracted for the reason given at the top of
+# scripts/ci/split_negative_controls.sh: a `run:` block is unreviewable and untestable off a
+# runner, and scripts/ci/control_smoke_test.sh now runs THIS file rather than a hand-made copy.
+#
+# WHAT THE CONTROL IS FOR. The retrace-split job replays a trace against the SPLIT runtime under
+# MOBILEGL_TRANSPORT=inproc. OpenRA scores ssim 1.000000 against a MONOLITH library too - measured -
+# so the picture is not and cannot be this lane's gate. What stands between the job and a green that
+# ran monolith end to end is run_trace_case.cmake's transport-resolution assertion
+# (run_trace_case.cmake:265-289): the library must have logged
+# "MOBILEGL_TRANSPORT=inproc - the MGPipe record stream", which exists only in
+# ConfigLoader::InitTransport's InProcess arm, which exists only under MOBILEGL_BUILD_DISAGGREGATED.
+# This control swaps the pull library over the frozen path and requires the same replay to fail FOR
+# THAT REASON.
+#
+# WHAT THE REVIEW FOUND (ID-46 finding 8 part (b), CONFIRMED by execution against the REAL ctest in
+# a REAL build tree; ID-48 assigns it here). Two holes, both of which let the control pass while
+# asserting nothing:
+#
+#   1. NO SELECTION GUARD AT ALL - unlike the split lane's run_control, which has had one since
+#      review finding M-4. With a case/backend regex matching no tests, `--no-tests=error` exits 8,
+#      and the old `if [ "${control_rc}" -eq 0 ]` accepted 8 as "the pull library turned it red".
+#      The verifier measured exactly that: "real ctest exit for a regex matching NO tests: 8",
+#      HARNESS_EXIT=0. An empty selection was the one thing this control could not tell apart from
+#      a working transport-identity assertion.
+#   2. ONLY "non-zero ctest" WAS CHECKED after the nm identity check. The nm check establishes that
+#      the library IS a pull build; it says nothing about why the replay failed. A loader failure, a
+#      missing fixture or a timeout all passed the control.
+#
+# Both are closed below: the selection is counted before the run, and the red must carry
+# run_trace_case.cmake's own words.
+#
+# Usage:  retrace_pull_library_control.sh <case> <backend>
+#   CTEST           ctest binary                      (default: ctest)
+#   CONTROL_TMPDIR  scratch dir                       (default: ${RUNNER_TEMP:-/tmp})
+#   PULL_LIBRARY    the pull libMobileGL.so to swap in
+#   FROZEN_LIBRARY  the path every case has baked in, which PULL_LIBRARY is copied over
+set -u
+
+CASE="${1:?usage: retrace_pull_library_control.sh <case> <backend>}"
+BACKEND="${2:?usage: retrace_pull_library_control.sh <case> <backend>}"
+
+CTEST="${CTEST:-ctest}"
+CONTROL_TMPDIR="${CONTROL_TMPDIR:-${RUNNER_TEMP:-/tmp}}"
+PULL_LIBRARY="${PULL_LIBRARY:?PULL_LIBRARY must name the pull build libMobileGL.so}"
+FROZEN_LIBRARY="${FROZEN_LIBRARY:?FROZEN_LIBRARY must name the path the cases have baked in}"
+mkdir -p "${CONTROL_TMPDIR}"
+
+# run_trace_case.cmake's own sentence for "this library never resolved the transport". Anchored on
+# the distinctive clause rather than on the whole paragraph, which carries substituted paths.
+EVIDENCE='never reported resolving it'
+
+selector="^MobileGLTraceReplay\.${CASE}\.${BACKEND}$"
+
+# The rerun replays into the same case directory, so the good run's images are put aside and
+# restored whichever way the control goes; "Upload actual image" runs `if: always()` and would
+# otherwise ship the deliberately-wrong run's output under the good run's name.
+GOOD_OUTPUT="${CONTROL_TMPDIR}/split-verified-output"
+rm -rf "${GOOD_OUTPUT}"
+if [ -d "${CASE}" ]; then cp -a "${CASE}" "${GOOD_OUTPUT}"; fi
+
+restore_good_output() {
+  if [ -d "${GOOD_OUTPUT}" ]; then
+    rm -rf "${CASE}"; mv "${GOOD_OUTPUT}" "${CASE}"
+    echo "restored the verified run's output over the control's"
+  fi
+}
+
+# HOLE 1: COUNT THE SELECTION FIRST. `--no-tests=error` turns an empty selection into a non-zero
+# exit, which is indistinguishable from a working control unless the selection is counted.
+matched=$("${CTEST}" -N -R "${selector}" | grep -cE '^ *Test *#[0-9]+:')
+if [ "${matched}" -lt 1 ]; then
+  restore_good_output
+  echo "::error::the control selected ${matched} tests with -R '${selector}', so there is nothing for the pull library to red. --no-tests=error would have exited non-zero on the empty selection and this control used to read that as success (ID-46 finding 8b, measured: ctest exit 8, step green)."
+  exit 1
+fi
+
+# The pull library, unpacked from build-linux's artifact, over the frozen path every case has baked
+# in. It defines no MG_Remote symbol, so ConfigLoader has no transport parser and
+# MOBILEGL_TRANSPORT=inproc is accepted and ignored - the exact shape of "the split lane ran
+# monolith".
+cp "${PULL_LIBRARY}" "${FROZEN_LIBRARY}"
+if nm --defined-only "${FROZEN_LIBRARY}" | grep -q -i MG_Remote; then
+  restore_good_output
+  echo "::error::the control's own library defines MG_Remote symbols, so it is not a pull build and this control would prove nothing"
+  exit 1
+fi
+
+out="${CONTROL_TMPDIR}/retrace-control-output.txt"
+export MOBILEGL_TRANSPORT=inproc
+"${CTEST}" -V --no-tests=error --timeout 10800 -R "${selector}" > "${out}" 2>&1
+control_rc=$?
+cat "${out}"
+
+restore_good_output
+
+if [ "${control_rc}" -eq 0 ]; then
+  echo "::error::a PULL library passed the split retrace. OpenRA scores ssim 1.000000 under a monolith library too (measured), so the picture is not and cannot be this lane's gate - run_trace_case.cmake's transport-resolution assertion is, and it has stopped working. Every green in this job is then a monolith run under a name that says split."
+  exit 1
+fi
+
+# HOLE 2: THE RED MUST BE THIS CONTROL'S RED.
+#
+# Whitespace is normalised across the WHOLE file before the match, newlines included, because the
+# sentence is emitted by CMake's message(FATAL_ERROR ...) and CMake re-wraps that text to its own
+# width: "never reported resolving it" arrives split over two lines with a two-space continuation
+# indent, and a line-oriented grep for the literal finds nothing. That is not hypothetical - it is
+# the shape the stub reproduces in scripts/ci/testdata/stub_ctest.sh.
+if ! tr -s '[:space:]' ' ' < "${out}" | grep -qF "${EVIDENCE}"; then
+  echo "::error::the split retrace went red (ctest exit ${control_rc}) with the pull library in place, but the failure never says the library did not resolve the transport - run_trace_case.cmake's \"${EVIDENCE}\" is absent from the output. A loader failure, a missing fixture, a timeout or an SSIM drop all land here, and none of them establishes that the transport-identity assertion is what caught the pull library. Only 'non-zero ctest' used to be checked (ID-46 finding 8b)."
+  exit 1
+fi
+
+echo "the pull library turned the split retrace red for its own reason (ctest exit ${control_rc}): ${matched} selected case(s) named the transport, not the picture"

scripts/ci/split_negative_controls.sh

@@ -0,0 +1,151 @@
+#!/bin/bash
+# EXIT GATE E1's NEGATIVE CONTROL and EXIT GATE E3(a)'s.
+#
+# This file is the body of .github/workflows/test.yml's "Negative controls - the verb barrier and
+# the persistent-map push must be load-bearing" step. It lives in the repository rather than inline
+# in the workflow for one reason: a workflow `run:` block cannot be executed anywhere except on a
+# runner, so the logic below was unreviewable and untestable until it ran in CI - and when the
+# wave-1 cross-family review claimed it was broken, confirming the claim needed a hand-made copy of
+# these lines with their inputs stubbed (wave1-codex-verify.md 8). A copy is not the thing. The
+# smoke test at scripts/ci/control_smoke_test.sh now runs THIS file, so the lines CI executes and
+# the lines the smoke test proves are the same lines.
+#
+# WHAT THE REVIEW FOUND (ID-46 finding 8, CONFIRMED by execution; ID-48 assigns it here).
+# The previous version accepted ANY non-zero ctest exit as "the knob is load-bearing". A timeout, a
+# setup abort, an unrelated assertion, a harness that died before it read the knob at all - every
+# one of them printed "turned N selected entries red, as it must" and the step went green. The
+# verifier demonstrated it: a stubbed ctest with a NON-EMPTY selection that failed with
+# `UNRELATED_CONTROL_FAILURE` produced both controls' success messages and HARNESS_EXIT=0.
+#
+# So each control now has to say WHY the red is its own:
+#
+#   1. THE BASELINE MUST BE GREEN. The arming run below used to end in `|| true` and count every
+#      case that was not <skipped/> as "ran" - so a case that RAN AND FAILED armed the controls,
+#      and a control that turns an already-red entry red proves nothing at all. It now counts
+#      PASSED cases, and a baseline with any failure in it is a hard error rather than an arming
+#      signal.
+#   2. THE RED MUST CARRY THE SELECTED CASE'S OWN FAILURE TEXT. Each control names a regex of the
+#      diagnostics its scenarios emit when that knob is off, and the red is refused if the output
+#      carries none of them.
+#
+# WHY THE EVIDENCE IS THE SCENARIO'S ASSERTION TEXT AND NOT THE KNOB'S OWN LOG LINE.
+# ConfigLoader logs a named line for both knobs (ConfigLoader.cpp:385-393, "is the R-1 NEGATIVE
+# CONTROL", "is the E3(a) NEGATIVE CONTROL"), and it is tempting to grep for that. It is not
+# evidence: it is written at config load, by every process in the run, whatever happens next. A
+# setup abort would carry it too. It proves the knob was READ, never that the knob caused the red.
+# Only the failing case's own diagnostic does that. (It is also unreachable from here: the three
+# DirectGLES.Split. lanes set no MOBILEGL_LOG_FILE_PATH, and the library's console sink is compiled
+# out of this configuration, so no MGLOG_ output of any level reaches ctest's transcript. Measured:
+# ~/w7/p5-v1-joint-isplit-barrier0.log, 18 aborted entries, zero occurrences of the string "Fatal".)
+#
+# Usage:  split_negative_controls.sh
+#   CTEST          ctest binary                       (default: ctest)
+#   CONTROL_TMPDIR scratch dir for the junit + output  (default: ${RUNNER_TEMP:-/tmp})
+set -u
+
+CTEST="${CTEST:-ctest}"
+CONTROL_TMPDIR="${CONTROL_TMPDIR:-${RUNNER_TEMP:-/tmp}}"
+mkdir -p "${CONTROL_TMPDIR}"
+
+junit="${CONTROL_TMPDIR}/isplit.xml"
+
+# ---- the baseline ---------------------------------------------------------------------------
+#
+# THE ARMED STATE IS DERIVED FROM BEHAVIOUR, not from a marker string in the generated ctest files.
+# The first version read MGITEST_REMOTE_CLIENT_PRESENT out of *_tests.cmake, which was a
+# restatement of the CMake source probe review finding M-1 falsified; the arming condition is a
+# runtime fact inside each test process (MG_Config::Transport, ClientSession::Active(),
+# ImplementedVerbCount(), read by Harness/SplitRuntimePeek), so the only honest way to ask it from a
+# shell is to look at what the entries DID.
+"${CTEST}" -L integration-split -j 4 --no-tests=error --output-junit "${junit}"
+baseline_rc=$?
+
+if [ ! -f "${junit}" ]; then
+  echo "::error::the baseline run wrote no ${junit} (ctest exit ${baseline_rc}), so nothing below can tell an armed lane from a broken one"
+  exit 1
+fi
+
+tally=$(python3 "$(dirname "$0")/junit_tally.py" "${junit}")
+if [ -z "${tally}" ]; then
+  echo "::error::could not tally ${junit}; a run whose result cannot be read is not an arming signal"
+  exit 1
+fi
+baseline_passed=$(echo "${tally}" | cut -d' ' -f1)
+baseline_failed=$(echo "${tally}" | cut -d' ' -f2)
+baseline_skipped=$(echo "${tally}" | cut -d' ' -f3)
+
+echo "split entries - passed: ${baseline_passed}, failed: ${baseline_failed}, skipped: ${baseline_skipped} (ctest exit ${baseline_rc})"
+
+# A RED BASELINE DISARMS THE CONTROLS RATHER THAN ARMING THEM (review finding 8, second half).
+# `|| true` plus a "not skipped" counter used to treat a case that ran and FAILED as evidence the
+# lane was live. Turning an already-red entry red is not a measurement.
+if [ "${baseline_failed}" -gt 0 ]; then
+  echo "::error::${baseline_failed} DirectGLES.Split. entries are ALREADY RED with both knobs at their defaults, so neither negative control below can attribute its red to the knob it turns. Fix the lane first; a control measured against a red baseline is not a control. (This used to be swallowed by an unconditional '|| true' and counted as 'the lane is armed'.)"
+  exit 1
+fi
+
+if [ "${baseline_passed}" -lt 1 ]; then
+  echo "::warning::every DirectGLES.Split. entry SKIPPED, so neither negative control can fire. The arming condition is a runtime fact - MG_Config::Transport, ClientSession::Active() and ImplementedVerbCount(), read by Harness/SplitRuntimePeek - and it becomes true on the commit that lands the last of c1/s1/v1. This step becomes a gate then, with no edit; it is not a green that asserted anything today."
+  exit 0
+fi
+
+# ---- the controls ---------------------------------------------------------------------------
+#
+# run_control <name> <filter> <evidence regex> <VAR=VALUE>...
+run_control() {
+  name="$1"; filter="$2"; evidence="$3"; shift 3
+
+  matched=$("${CTEST}" -N -L integration-split -R "${filter}" | grep -cE '^ *Test *#[0-9]+:')
+  if [ "${matched}" -lt 1 ]; then
+    echo "::error::${name} selected ${matched} tests; its filter no longer matches anything"
+    exit 1
+  fi
+
+  out="${CONTROL_TMPDIR}/control-output.txt"
+  env "$@" "${CTEST}" --output-on-failure -L integration-split -R "${filter}" --no-tests=error > "${out}" 2>&1
+  control_rc=$?
+  cat "${out}"
+
+  if [ "${control_rc}" -eq 0 ]; then
+    echo "::error::${name} left ${matched} split entries GREEN, so the knob it turns is not load-bearing and the gate it controls proves nothing."
+    exit 1
+  fi
+
+  # THE HALF THAT WAS MISSING. A non-zero exit is necessary and nowhere near sufficient.
+  # Whitespace is normalised across the whole file first, for the reason given in
+  # retrace_pull_library_control.sh: a diagnostic that arrives wrapped is still the diagnostic.
+  if ! tr -s '[:space:]' ' ' < "${out}" | grep -qE "${evidence}"; then
+    echo "::error::${name} turned ${matched} selected entries red, but the red carries NONE of the diagnostics those scenarios emit when this knob is off, so it is not this control's red. Required one of: ${evidence}. A timeout, a setup abort, a harness that died before it read the knob, or any unrelated assertion lands here - and every one of them used to print the success message below and leave this step green (ID-46 finding 8). If the entries aborted with no output at all, that is the barrier path having no named diagnostic of its own: see t1-v2.md, it is a debt on the server package, not a reason to accept the red."
+    exit 1
+  fi
+
+  echo "${name} turned ${matched} selected entries red, and the red carries the scenario's own diagnostic, as it must"
+}
+
+# E1: R-1's lockstep verb barrier. Without it the client keeps pulling fields from a live GLContext
+# while the server runs ahead, so the server reads future values.
+#
+# THE SELECTION INCLUDES THE SmallRing LANE, and that is not cosmetic. Measured on v1's joint tree
+# (~/w7/p5-v1-joint-isplit-barrier0.log): with the barrier off, every entry the OLD filter selected
+# aborted with no output whatsoever, and the one entry in the whole run that failed with a readable
+# assertion - ClearThenReadPixelsScenario.cpp:290/:295, reading back 0 where >200 was cleared - was
+# a DirectGLES.Split.SmallRing. entry, which the old filter excluded. A control whose selection
+# contains no case able to say why it failed cannot assert its own failure reason. The SmallRing
+# entries are the same two scenarios under the same transport with SEG_CMD/SEG_STAGE at their floor,
+# so including them widens E1's selection strictly within E1's charter.
+run_control "negative control E1 (MOBILEGL_IPC_VERB_BARRIER=0)" \
+  'DirectGLES\.Split\.(SmallRing\.)?(Triangle|ClearThenReadPixels)' \
+  'ClearThenReadPixelsScenario\.cpp:(290|295)|the bottom band should be red after the resolve|the top band should be blue after the resolve|TriangleScenario\.cpp:[0-9]+: Failure' \
+  MOBILEGL_IPC_VERB_BARRIER=0
+
+# E3(a): the persistent-map push. 0 is admitted by ConfigLoader on purpose and is documented there
+# as this control. The evidence is the scenario's own wording for "the second write never arrived":
+# with the push off, the write that no GL call announces cannot reach its draw, which is exactly
+# what TwoWritesThroughTheCoherentPointerEachReachTheirOwnDraw and
+# AWriteAfterAFrameBoundaryReachesTheNextFramesDraw read back
+# (PersistentCoherentMapScenario.cpp:414-417, :442-443). The counting case's pmap= assertion
+# (:531-541) is listed too, for the lane where it is the one that runs.
+run_control "negative control E3(a) (MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0)" \
+  'DirectGLES\.Split\.(SmallRing\.)?PersistentCoherentMapScenario' \
+  "the SECOND write through the same mapping, announced by nothing|frame 1's write through the SAME mapping|cannot have pushed|PersistentCoherentMapScenario\.cpp:[0-9]+: Failure" \
+  MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0

scripts/ci/testdata/stub_ctest.sh

@@ -0,0 +1,119 @@
+#!/bin/bash
+# A stubbed `ctest` for scripts/ci/control_smoke_test.sh.
+#
+# Descended from the verification agent's stub (wave1-codex-verify.md 8, ~/w7/p5-verify-f8-stub/ctest),
+# which is what CONFIRMED that the negative controls accepted an unrelated failure. Every mode below
+# is deliberately the BEST case for the control under test: the selection is never empty except in
+# the mode that exists to test the empty-selection guard, and the baseline is green except in the
+# mode that exists to test the red-baseline guard. If a control passes here it is because the
+# control's logic is wrong, not because the stub starved it.
+#
+# STUB_MODE:
+#   unrelated          baseline green; the control's own run fails with UNRELATED_CONTROL_FAILURE
+#   evidence           baseline green; the control's own run fails with the scenarios' own wording
+#   green              baseline green; the control's own run PASSES (the knob is not load-bearing)
+#   red-baseline       the baseline itself has a failed entry
+#   all-skipped        the baseline is entirely skipped (the disarmed lane, a legitimate exit 0)
+#   retrace-noselect   `ctest -N` matches nothing; the run exits 8 the way --no-tests=error does
+#   retrace-unrelated  one match; the run fails without naming the transport
+#   retrace-evidence   one match; the run fails with run_trace_case.cmake's own sentence
+#   retrace-green      one match; the run PASSES
+set -u
+
+mode="${STUB_MODE:?STUB_MODE must be set}"
+
+listing=1
+junit=""
+prev=""
+for a in "$@"; do
+  [ "$a" = "-N" ] && listing_requested=1
+  if [ "$prev" = "--output-junit" ]; then junit="$a"; fi
+  prev="$a"
+done
+listing_requested="${listing_requested:-0}"
+
+emit_listing() {
+  echo "Test project /stub"
+  if [ "${mode}" = "retrace-noselect" ]; then
+    echo "Total Tests: 0"
+    return
+  fi
+  echo "  Test #1: DirectGLES.Split.ClearThenReadPixelsScenario.ClearWithNoDrawIsVisibleToDefaultFramebufferReadPixels"
+  echo "Total Tests: 1"
+}
+
+write_junit() {
+  case "${mode}" in
+    red-baseline)
+      body='<testcase name="DirectGLES.Split.TriangleScenario.AVboBackedTriangleReachesReadPixels" status="failed"><failure message="already red"/></testcase>'
+      ;;
+    all-skipped)
+      body='<testcase name="DirectGLES.Split.TriangleScenario.AVboBackedTriangleReachesReadPixels" status="notrun"><skipped/></testcase>'
+      ;;
+    *)
+      body='<testcase name="DirectGLES.Split.TriangleScenario.AVboBackedTriangleReachesReadPixels" status="run" time="0.3"/>'
+      ;;
+  esac
+  printf '%s\n' '<?xml version="1.0" encoding="UTF-8"?>' "<testsuite name=\"stub\">" "  ${body}" '</testsuite>' > "$1"
+}
+
+if [ "${listing_requested}" = "1" ]; then
+  emit_listing
+  exit 0
+fi
+
+if [ -n "${junit}" ]; then
+  write_junit "${junit}"
+  case "${mode}" in
+    red-baseline) echo "1/1 Test #1: ... ***Failed"; exit 8 ;;
+    *)            echo "100% tests passed, 0 tests failed out of 1"; exit 0 ;;
+  esac
+fi
+
+# The control's own run.
+case "${mode}" in
+  unrelated)
+    echo "1/1 Test #1: DirectGLES.Split.ClearThenReadPixelsScenario.ClearWithNoDrawIsVisibleToDefaultFramebufferReadPixels ...***Failed"
+    echo "UNRELATED_CONTROL_FAILURE: the harness aborted in setup before the knob was read"
+    exit 8
+    ;;
+  evidence)
+    # Both controls' required wording, so one stub serves E1 and E3(a). Copied from the real
+    # diagnostics: ~/w7/p5-v1-joint-isplit-barrier0.log for the first, and
+    # PersistentCoherentMapScenario.cpp:414-417 for the second.
+    echo "1/1 Test #1: DirectGLES.Split.ClearThenReadPixelsScenario.ClearWithNoDrawIsVisibleToDefaultFramebufferReadPixels ...***Failed"
+    echo "../MobileGL/MG_IntegrationTest/Scenarios/ClearThenReadPixelsScenario.cpp:290: Failure"
+    echo "Expected: (bottom.r) > (200), actual: '\\0' vs 200"
+    echo "the SECOND write through the same mapping, announced by nothing: this is exit gate E3(b)"
+    exit 8
+    ;;
+  green)
+    echo "100% tests passed, 0 tests failed out of 1"
+    exit 0
+    ;;
+  retrace-noselect)
+    echo "No tests were found!!!"
+    exit 8
+    ;;
+  retrace-unrelated)
+    echo "1/1 Test #1: MobileGLTraceReplay.OpenRA.DirectGLES ...***Failed"
+    echo "CMake Error: the fixture could not be unpacked"
+    exit 8
+    ;;
+  retrace-evidence)
+    echo "1/1 Test #1: MobileGLTraceReplay.OpenRA.DirectGLES ...***Failed"
+    echo "CMake Error at run_trace_case.cmake:279 (message):"
+    echo "  MOBILEGL_TRANSPORT=inproc is set for OpenRA DirectGLES and the library never"
+    echo "  reported resolving it: mobilegl.log carries no"
+    echo '  "MOBILEGL_TRANSPORT=inproc - the MGPipe record stream".'
+    exit 8
+    ;;
+  retrace-green)
+    echo "100% tests passed, 0 tests failed out of 1"
+    exit 0
+    ;;
+  *)
+    echo "stub_ctest: unknown STUB_MODE '${mode}'" >&2
+    exit 127
+    ;;
+esac