diff --git a/docs/Disaggregated/CURRENT_STAGE_STATUS.md b/docs/Disaggregated/CURRENT_STAGE_STATUS.md
index b6d0737b..adb9e955 100644
--- a/docs/Disaggregated/CURRENT_STAGE_STATUS.md
+++ b/docs/Disaggregated/CURRENT_STAGE_STATUS.md
@@ -4,7 +4,9 @@
 
 **阶段：P7 DirectVulkan（Magma）全量迁移——✅ 已收官（2026-09-23，ID-P7-63）**，并行流 **P3b/P4b 深化（Espryt，wave 2-D）** 与 **Ph 小件（簇 F）**。计划 [`notes/p7/PLAN-PH-P34B-P7.md`](notes/p7/PLAN-PH-P34B-P7.md)（五波）。
 
-**更新：2026-09-23（ID-P7-49–63）** · 交接 [notes/p7/HANDOFF-2026-09-23.md](notes/p7/HANDOFF-2026-09-23.md)。**P7 收官**：§8 九项全绿——终局窗口 3（`p7w8-78e71f2b`）门 3 PASS 36/36、门 5 PASS；门 4 以 `# P13` 读法关闭。CI 七根因修、F2、门 5 三缺陷、codex 收官审查修复、spawn 冷启动心跳（协议修订 2）均已落地推送。下一阶段按 ROADMAP：P8 / P9。
+**更新：2026-09-24（P12 子集）** · 计划与交接 [notes/p12/PLAN-P12.md](notes/p12/PLAN-P12.md)。**P12「server 自有屏幕窗口」子集已实现、未收官、这条线只存在于 `p12/onscreen`**（15 提交，自 `9f669e52` 起）：Android 上的 server 自建 `ANativeWindow`（自己的 SurfaceView）把渲染流**上屏**，离屏路径保留，同一时刻只一条活跃；client 以新的 `WindowKind::ServerOwned` **完全无头**接入（控制修订 3）。主机门除一条既有环境敏感项外全绿，G1（pull 构建 `.text` `0xa52203`、符号 0/0）已独立复核；真机 Redmi `2f7cbe2e` 上七项编号检查过了双后端上屏、串行/Busy、失窗 device-lost、离屏不回归、无显示具名拒绝、一台设备一个 server。**两个出口门都还没打**：跨机 TCP（门 b）完全未做，FCL + 杀 server 的 device-lost（门 a）未做——本轮的真机是 trace_replay 经 `adb forward` 环路驱动的。上一阶段 **P7 已收官（2026-09-23，ID-P7-63）**：§8 九项全绿——终局窗口 3（`p7w8-78e71f2b`）门 3 PASS 36/36、门 5 PASS；门 4 以 `# P13` 读法关闭。
+
+**更新：2026-09-23（ID-P7-49–63）** · 交接 [notes/p7/HANDOFF-2026-09-23.md](notes/p7/HANDOFF-2026-09-23.md)。**P7 收官**：§8 九项全绿。CI 七根因修、F2、门 5 三缺陷、codex 收官审查修复、spawn 冷启动心跳（协议修订 2）均已落地推送。下一阶段按 ROADMAP：P8 / P9 / P12 余项。
 
 ## 1. 出口门总览（CONTRACT-P7 §8 的 9 项分母）
 
@@ -63,6 +65,7 @@
 
 - 当前 APK：**p7w8**（`26.09.78e71f2-trace`，控制协议修订 2），supervisor `0.0.0.0:40613`，`/data/local/tmp/mgcts` 为 `$BASE` 库。
 - 终局窗口 3 证据 `notes/p7/device-window-2/final-p7w8/`，窗口 2 `notes/p7/device-window-2/window2-p7w7/`，三例 Iris 不确定性追查在 ID-P7-62。
+- **P12 子集**：APK `26.09.29b7b28-trace`（**控制协议修订 3**，与 p7w8 的 server 不兼容），证据 `notes/p12/device/`（九格拼图 `evidence-strip.png`）。七个编号检查在三个 head 上跑过，`trial-*/` 是按 head 归档的旧轮次。
 
 ## 4. 在跑
 
@@ -70,10 +73,13 @@
 
 ## 5. 下一步
 
-1. 下一阶段按 [`ROADMAP.md`](ROADMAP.md)：monolith 跑道 P8（emulation 下放 + 索引宿主镜像）；IPC 跑道 P9（反向通道异步 reply）→ P10 → P11 → P12；P3b/P4b 余项并行。
-2. CONTRACT-P7 §12 的记录债按阶段认领。
+1. **P12 未收官，先还两个出口门**（[notes/p12/PLAN-P12.md](notes/p12/PLAN-P12.md) §3）：(b) 另一台机器的 client 经 TCP 入世界并记 P6.5 必测数；(a) FCL 同机 spawn + 杀 server 的干净 device-lost。之后补 `MG_Remote/CONTRACT-P12.md`、清 `ARCHITECTURE.md` 里那条被删掉的旧窗口路径、按惯例做一次收官审查。
+2. `p12/onscreen` 的余项：in-process server 的 `unix:` 监听、DirectGLES `g_*` 去全局、freezer、多 context、FCL env / 开关表接线、D8 白名单（拒 X11 / Win32Hwnd / None）。交接时已在树上核对，全部未做。
+3. 其余按 [`ROADMAP.md`](ROADMAP.md)：monolith 跑道 P8（emulation 下放 + 索引宿主镜像）；IPC 跑道 P9（反向通道异步 reply）→ P10 → P11；P3b/P4b 余项并行。
+4. CONTRACT-P7 §12 的记录债按阶段认领。
 
 ## 6. 阻塞 / 需要人
 
 - p7w6 TCP 矩阵和设备 monolith 对照已结束；后续门 3/CTS 仍不可同时 force-stop 同包 Service。当前没有需要用户决策的阻塞。
 - X2 已关闭 `InitialCapsStartup` 的测试夹具乱序 flake；不再列为待修。
+- **待裁定（一条，不阻塞）**：`IterationRPProgram203Scenario` 在 `integration-magma-full-split` 上偶尔红。ID-P7-22 已把它改判为**环境敏感**（钉 lavapipe ICD 即绿），`p12-onscreen` 两个 build 目录都已钉 ICD、交接时直跑 3/3 绿、整条车道重跑两遍 558/558 绿。建议给门脚本一个明确读法（钉 ICD 即绿 / 记为已知偶发），别再口头带过。另：`~/w7/notes/p12/gate.sh` 的 G1 符号比较与基准不同源，会打出 `added=N removed=N` 的误导行，P12 收尾时一并修（见 PLAN-P12 §4）。
diff --git a/docs/Disaggregated/ROADMAP.md b/docs/Disaggregated/ROADMAP.md
index 44315431..0f0fef7a 100644
--- a/docs/Disaggregated/ROADMAP.md
+++ b/docs/Disaggregated/ROADMAP.md
@@ -43,7 +43,7 @@
 | **P9** 反向通道 | 待排，**P6.5 之后**（2026-09-22 重定范围） | **异步 reply 语义**，机制建立在 P6.5 的消息式 reply 之上（不再造 `SEG_REPLY` slot 池——池今天就有，stream 链路会删它）；2 MiB reply cap 与 chunked readback（契约 §10.2.3 从 P6 改判至此，ID-47）；PACK-PBO 回读 fire-and-forget + client 侧 `MarkGpuWritten`（ID-57，P6 未做）；十个回调里未武装的四个：`OnTextureWriteback`、`OnTexturePullRequest`、`OnMipLevelsGenerated`、`OnLog` 分级（`OnXfbScatterReady` 是零生产者、零消费者、无 EventKind 的死声明——随 P3b/P4b 删除，`kMGPipeCallbackCount` 10→9；`ClientSession.cpp:429`；`OnBufferWriteback` / `OnGpuWritten` / `OnSurfaceChanged` / `OnGlError` / `OnCapsInvalidated` 已武装）；`OnGpuWritten` 收窄；`OnBufferWriteback` 批处理 + epoch 排序；`OnGlError` 有序（CONTRACT-P5C §4.2）；纹理拉取四条缓解 + 终止符；XFB 命名空间（`DeleteTransformFeedback` 的 server 侧泄漏——按裁定无行、最后两个 class-C 之一）。~~`SEG_EVENT` 溢出策略~~ 机制已由 P5e 落地（`ARCHITECTURE.md` §11.7），剩余的"不排空对端杀宿主"归 Ph | 回读 / XFB 场景在 split 下绿；`TextureRemintPullScenario`（含无解用例）；拉取计数逐 trace 发布；两条故障注入 |
 | **P10** sync / query / present 节奏 | 待排 | ~~client 铸造 query handle~~（已是：`QueryCreate` 为 `kWaitNone`）；轮询入口成门铃点 + `MOBILEGL_IPC_POLL_ESCALATE`（0 处；TCP 上是首要杠杆之一）；DirectGLES 的 fence 完成度来自逐 fence 退休（`g_completedFrameSerial` 仍只在 `Present` 前进；Magma 那半已由 run-ahead 落地）；非 present fence tick（唯一记载处）；`present` 1:1（已是）；~~credit 默认 1~~（已是默认，`ConfigLoader.cpp:414`）；**`PRESENT_CREDIT > 1` 从未量过**（重审 §8.7）——带延迟链路上的首要杠杆，inproc 臂上即可取；roundtrip 计数器与输入延迟直方图（今天只有 `MapPersistentRoundtrips`）；`SetSwapInterval`（最后一个手写 class-C，`EmitTables.cpp:1665`） | query / XFB / `AsyncCompile` 场景在 split 下绿；trace 上 draw / state / upload 路径 roundtrip 读零；零 timeout 轮询有界退出；credit 1..3 在 TCP loopback 与跨机臂上的配对记录；配对 A/B 记录 |
 | **P11** persistent map 与 ≥16 MiB 采纳 | 待排，**同机臂专属、已让位**（2026-09-22） | T0 / T1 只对共享映射成立：`dataPlane = Stream` 上点名 T0 / T1 是具名拒绝并强制 T2（重审 §6 第 5 项），今天 `MOBILEGL_IPC_ADOPT_TIER` 0/1 已是 Fatal-at-use、`kSegAdopt` 只有枚举；前置开放问题 3。POST 探针档位选择（T0 主攻，Adreno 可选 T1，T2 回退）；`SEG_ADOPT` 生命周期绑 `completedFrameSerial`；**`gPipeInputs` 版本化 / 双缓冲**（P5d 研究：draw barrier 延后一个 verb 的前提，须在 P3b/P4b 的句柄键控 twin 表之后）。**P5e 的更正**：P5e 退役 draw lockstep **没有**需要它——ra2 实测证明字段**值**已由 `SuppliedFieldMask` 分区，当时那次竞态在**元数据标量**上，修法是让守卫测事实而非断言未来（ID-135）。本行保留采纳存储的一般版本/时序问题；契约 §3.2 的 per-role stamp 已由 P5f 落地，不再是待办 | `LargeArenaAdoptionScenario` 在所选档下绿；26.3 与两个 Create fixture SSIM ≥ 0.99；Adreno 830 上 p99 帧时与峰值 RSS 对采纳基线（163→21 ms / 40→115 fps / ~400 MB）回归不超过 10% |
-| **P12** Android 生产窗口路径 | 待排，**Ph 之后** | **按重审 §6 改小**：~~Service 收 Java `Surface`~~ 删掉 Surface 传递那一半——server app 拥有自己的 SurfaceView，client 根本没有窗口，于是 minSdk 26 没有扁平化 `ANativeWindow` 的 NDK API 这条约束不再成立；`WindowKind::ServerOwned`；两个后端各一条 `CreateEGLWindowSurface` 臂；`m_windowHandle` 四处写点 + `sameHandle` 去重键（a6 §6）；DirectGLES `g_Display` / `g_Surface` / `g_Context` 去全局；`kEventSurfaceChanged` 的 Width / Height 缺口（Espryt 只发布格式，server 拥有显示时 client 默认 FBO 会停在 512×512 占位值）；client 侧不再无条件发 `SetWindowHandle`（`BackendObject_Remote.cpp:215`——今天 FCL 里开 spawn，第一次 `eglCreateWindowSurface` 就在 server 进程 abort）；server app 监听 `unix:` 与 `tcp://`（后者 Ph 之后）；server 生命周期绑 Activity；cached-app freezer（SPAWN-PLAN §8.2）；多 context（契约 §11）；FCL env 与 plugin APK 开关表接线 | 两个门：(a) Minecraft 经 FCL **同机 spawn** 在 Adreno 830 双后端入世界，杀 server 产生干净 device-lost latch；(b) **另一台机器上的 client 经 TCP** 在 Redmi 上进世界（数据面 stream），并记录 P6.5 的必测数 |
+| **P12** Android 生产窗口路径 | **子集已实现、未收官（2026-09-24，`p12/onscreen`，自 `9f669e52`，15 提交）**：上屏 server 窗口、`WindowKind::ServerOwned`、无头 client、失窗 device-lost 已落地并过真机七项检查；两个出口门均未打（见 [`notes/p12/PLAN-P12.md`](notes/p12/PLAN-P12.md) §3） | **按重审 §6 改小**：~~Service 收 Java `Surface`~~ 删掉 Surface 传递那一半——server app 拥有自己的 SurfaceView，client 根本没有窗口，于是 minSdk 26 没有扁平化 `ANativeWindow` 的 NDK API 这条约束不再成立；`WindowKind::ServerOwned`；两个后端各一条 `CreateEGLWindowSurface` 臂；`m_windowHandle` 四处写点 + `sameHandle` 去重键（a6 §6）；DirectGLES `g_Display` / `g_Surface` / `g_Context` 去全局；`kEventSurfaceChanged` 的 Width / Height 缺口（Espryt 只发布格式，server 拥有显示时 client 默认 FBO 会停在 512×512 占位值）；client 侧不再无条件发 `SetWindowHandle`（`BackendObject_Remote.cpp:215`——今天 FCL 里开 spawn，第一次 `eglCreateWindowSurface` 就在 server 进程 abort）；server app 监听 `unix:` 与 `tcp://`（后者 Ph 之后）；server 生命周期绑 Activity；cached-app freezer（SPAWN-PLAN §8.2）；多 context（契约 §11）；FCL env 与 plugin APK 开关表接线 | 两个门：(a) Minecraft 经 FCL **同机 spawn** 在 Adreno 830 双后端入世界，杀 server 产生干净 device-lost latch；(b) **另一台机器上的 client 经 TCP** 在 Redmi 上进世界（数据面 stream），并记录 P6.5 的必测数 |
 | **P13** 退役 pull 路径 | 待排 | 删 `SnapshotFromGLContext()` 非 verify 分支、`MGB_CTX`、`MOBILEGL_PIPE_PUSH`、`MOBILEGL_PIPE_LEGACY_MEMOS`；保留 `MOBILEGL_PIPE_VERIFY`；MGPipe recorder；删 `set_residual_value_state`；在计数器活着的情况下重调幸存缓存容量；建立模块 target 与边界（D12：`SOURCE_FILES` 是一张平表喂两个库 target，无模块可链）| `static_assert(sizeof(ResidualValueBlock) == 0)`；三道纯度门在非 verify 构建上转绿；recorder 金标建立；monolith 逐线程 CPU 不差于 P0 基线 |
 
 CTS 周转单独计价（`gl44to46` 约 56,271 例）：逐阶段只跑该阶段可能影响的具名块；完整 caselist 只在架构边界与合并 `dev` 之前跑，放 CI 不放关键路径。
diff --git a/docs/Disaggregated/notes/p12/BRIEF-onscreen.md b/docs/Disaggregated/notes/p12/BRIEF-onscreen.md
new file mode 100644
index 00000000..47c655c6
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/BRIEF-onscreen.md
@@ -0,0 +1,161 @@
+# P12 subset "on-screen server window" — implementation brief (2026-09-23)
+
+Base: `feat/disaggregated@9f669e52` (P7 closed). Package tree `~/w7/p12-onscreen`, branch `p12/onscreen`,
+build dirs `build-split` (disaggregated, ITEST tcp port 40813) and `build-linux` (pull build, for G1), both
+already built at base. G1 base: `.text` 0xa52203, symbols `~/w7/logs/p12/pull-syms-base.txt`.
+Gate: `bash ~/w7/notes/p12/gate.sh ~/w7/p12-onscreen <tag>`.
+
+## User rulings (binding)
+
+1. The Android server APK creates an ANativeWindow (its own SurfaceView) and renders the IPC render stream
+   ON SCREEN on it. **Both rendering paths stay available**: the existing offscreen (pbuffer) path and the
+   new on-screen path.
+2. **Only one of them is active at a time**, decided at server initialization / context creation.
+3. Topology: **in-process server** — the display Activity's own app process runs the TCP server on a thread
+   and renders straight into its SurfaceView; sessions run sequentially in that process. (Not fork + AHB.)
+4. Client side: **the client opts in via a new `WindowKind::ServerOwned`** (control protocol revision 3,
+   client env knob). In this mode the client can be **fully headless**: it asks the server to create the
+   real (window) context/surface and gets the surface geometry etc. from the server — as if the client were
+   rendering directly on the server's GPU and screen.
+
+## Design
+
+### D1 Client knob and headless window surfaces
+- New IPC knob `MOBILEGL_IPC_SURFACE=offscreen|server` (default `offscreen`), added to `MG_Config::IpcTable`
+  (`Config.h`, "a later phase's knob is added HERE") + `ConfigLoader.cpp`, printed in the IPC config log line.
+  Meaningful only when the client talks to a remote server (spawn/tcp); ignored (logged) otherwise.
+- With `server`: the client EGL layer's `eglCreateWindowSurface` / `eglCreatePlatformWindowSurface` accept ANY
+  native window, **including NULL** (today NULL is `EGL_BAD_NATIVE_WINDOW`, `EGLImpl.cpp:130-133`) — a headless
+  client has no window. `BackendObject_Remote::CreateEGLWindowSurface` then sends **one** `CreateWindowSurface`
+  with `WindowKind::ServerOwned`, `nativeToken = 0`, width/height = the size the client asked for (the
+  existing `WindowHandle.Width/Height` from `EGL_WIDTH/EGL_HEIGHT` attribs; 0/0 = "the server's own size"), and
+  **does not send `SetWindowHandle`**. The client's native window value never reaches the wire (Rule G/H).
+- `eglCreatePbufferSurface` stays a pbuffer in both modes (offscreen). See D4 for the one-mode-per-session rule.
+- With `offscreen` (default) nothing changes, byte for byte.
+- Geometry flows back: when a `kEventSurfaceChanged` with non-zero W/H arrives for the session's server-owned
+  surface, the client updates the EGL state's surface size (so `eglQuerySurface(EGL_WIDTH/HEIGHT)` answers the
+  server's real size; `state->ResizeSurface` as used at `EGLImpl.cpp:724`) in addition to the default-FB
+  reallocation `ApplySurfaceChangedToClient` already does (`ClientSession.cpp:306-347`). Make sure the client
+  has the size before `eglCreateWindowSurface` returns (the create path already drains events,
+  `BackendObject_Remote.cpp:224`).
+
+### D2 Wire
+- Append `ServerOwned = 7` to `WindowKind` (`protocol.fbs:239-250`; append-only), regenerate + commit the
+  generated header, bump `MOBILEGL_PROTOCOL_CONTROL_REVISION` 2 -> 3 (`mg_protocol_base.h`, with its comment
+  row), `protocol_revision_pin.py --write`. wireFingerprint moves: APK and host redeploy together.
+- Codec (`SurfaceOpCodec.{h,cpp}`): encoder maps the client's server-owned request to `ServerOwned`; decoder
+  accepts `ServerOwned` only on `CreateWindowSurface` (on `SetWindowHandle` it is a named refusal), only with
+  `nativeToken == 0` (non-zero = `ProtocolCorruption`, latched like the other peer-corruption rows).
+  Update the static_assert / out-of-range bound. Keep `AndroidNativeWindow@P12` / `MetalLayer@P12` refusals.
+- Do NOT add a `WindowBackend` enumerator in `MG_Backend/BackendObject.h` (pull build, G1). Carry the
+  server-owned request in the MG_Remote frame with a MG_Remote-local marker; on the server it becomes
+  `WindowBackend::Android` + the server's own `ANativeWindow*`, substituted ON THE SERVER at apply time. No
+  pointer ever crosses the wire.
+- D8 (X11/Win32/None whitelist, CONTRACT-P6 §7.2) is OUT of scope (separate follow-up).
+
+### D3 Server display (the on-screen server's window)
+- New `MG_Remote/Server/ServerDisplay.{h,cpp}`: process-wide holder of the server-owned window, set only by the
+  in-process display server (Android). API sketch: `Attach(ANativeWindow*)` (acquire), `Detach()` (blocking,
+  see D6), `HasDisplay()`, a geometry request hook (native -> Java up-call: `SurfaceHolder.setFixedSize(w,h)`
+  for w,h > 0, `setSizeFromLayout()` for 0/0), and `AcquireFor(w,h, deadline)` that waits (bounded, ~10 s,
+  wakes on detach/shutdown) until a window is attached and reports the requested size (or any size for 0/0).
+  Linux/host and the exec'd supervisor have no display: `HasDisplay()` is false.
+- `ServerLoop` `CreateWindowSurface` arm, for a ServerOwned frame: no display -> reply failure with a distinct
+  result and a named log `Refuse ServerOwned: this server owns no display` (NOT a latch — it is a
+  configuration error, not peer corruption); otherwise substitute the window and call the backend's
+  `CreateEGLWindowSurface` exactly as monolith Android does (Register -> Activate -> SetWindowHandle ->
+  InitWindowSurface). Log an arm proof once per surface: `MG_Remote server: surface=window WxH owner=server`
+  (and `surface=pbuffer WxH` on the pbuffer arm). The apply thread may wait for the window; the existing
+  `SurfaceProgress` heartbeat must keep the client's reply budget alive while it does.
+- Reporting size: Magma already publishes swapchain extent in `OnSurfaceChanged` (`SwapchainObject.cpp:323-339`).
+  Espryt publishes format only (`DirectGLES.cpp:15939-15950`): publish W/H (via `QueryCurrentSurfaceSize`) for a
+  window surface in the disaggregated build only — `DirectGLES.cpp` is in the pull build, so guard it
+  (`#if MOBILEGL_BUILD_DISAGGREGATED` or equivalent) and keep G1 byte-identical. Consider whether it must be
+  limited to server-owned windows (publishing W/H switches the client to the reallocating arm).
+- Espryt: `sameHandle` dedup (`BackendObject_DirectGLES.cpp:962-967`) keys on surface + window; with the
+  server's pointer it dedups correctly. A new surface token re-creates the context (existing behaviour).
+- Magma: a new renderer on the SAME ANativeWindow must not be created while the old renderer's VkSurface/
+  swapchain still holds it (`VK_ERROR_NATIVE_WINDOW_IN_USE_KHR`); check `BackendObject_DirectVulkan.cpp:337-352`
+  ordering and fix if needed (guard for G1 if that file is in the pull build).
+
+### D4 One mode per session ("only one active", decided at context creation)
+- A session's surface mode latches at its FIRST surface creation: ServerOwned -> on-screen; pbuffer -> offscreen.
+  A later surface of the other kind in the same session is refused by name (`SurfaceModeMismatch`, reply
+  failure, logged on both sides, no latch). A server with no display serves only offscreen sessions.
+- Server-level: the offscreen supervisor (exec'd, `MobileGLServerService`) and the on-screen display server
+  (in-process, `MobileGLDisplayActivity`) are mutually exclusive on the device (D8).
+
+### D5 In-process server
+- `RunSession` (`ServerMain.cpp:268-638`, `[[noreturn]]`, `_exit` on every path) becomes returning (an exit
+  code); every fork site becomes `_exit(RunSession(...))` so the forked shapes are unchanged.
+- A new exported entry for the in-process server (e.g. `mobilegl_server_serve_inprocess(endpoint, ...)`), same
+  env preconditions as `mobilegl_server_main` (`:1035-1049`), TCP only, `--serve` semantics with THREADS
+  instead of fork: pre-auth before hand-off unchanged, one session at a time, an authenticated second Hello
+  while a session is live -> `Refuse{Busy}`. `TcpSupervisor`'s fork body closes fds per fd-table
+  (`:990-995, 1009`); the thread hand-off must not. Reuse TcpSupervisor with a pluggable hand-off if tractable.
+- `FatalFunnel`: add `ResetSessionLatch()`; the in-process server arms the latch for every session and resets
+  it between sessions. Unarmed `SessionFail` still aborts (documented: in-process mode loses crash isolation).
+- Backend pinned for the process lifetime: an explicit extra/env, else the first session's backend becomes the
+  pin (Espryt and Magma must never share a process, `BenchService.java:12-17`); mismatch -> the existing
+  pinned-backend refusal (`:371-375`).
+- Everything else per `map-apk-process` §4 (config init per session, server role, PipeStats restartable).
+- Must be testable on the Linux host: run the in-process entry on a thread in a test (pbuffer sessions) and
+  prove two sequential sessions, latch reset (second session serves after the first latched), and Busy.
+
+### D6 Window lost
+- Java `surfaceDestroyed` -> JNI `Detach()` blocks (bounded ~3 s) until the apply thread has released the
+  backend surface (post onto the apply thread; `ReleaseEGLResources`-style), then the live on-screen session is
+  latched by name (new `FatalFamilies.def` row, e.g. `ServerWindowLost`) so the client gets a clean
+  device-lost. The display server keeps listening; the next on-screen session waits for a window (D3) or is
+  refused by name. `surfaceCreated` re-attaches. A session that never had a window is unaffected.
+
+### D7 Android (trace flavor)
+- New `MobileGLDisplayActivity` (trace flavor), `android:process=":mglwin"`, exported like the service,
+  fullscreen SurfaceView, `FLAG_KEEP_SCREEN_ON`, `configChanges` like `TraceReplayActivity`,
+  `android:hardwareAccelerated="false"` (keeps HWUI off EGL: Espryt teardown `eglTerminate`s the default
+  display, `main/AndroidManifest.xml:25-28`). Extras: `listen`, `token`, `env` (same `K=V;K` grammar as
+  `MobileGLServerService.applyEnvironment` — share the helper), optional `backend`. Applies env with
+  `Os.setenv/unsetenv` (ROLE=server, DIAL=no, LOG_FORWARD=1, scrub list, TOKEN, LOG_FILE_PATH) BEFORE
+  `System.loadLibrary("MobileGL")`. Aspect-fit (letterbox) the SurfaceView when a fixed buffer size is set.
+- JNI in libMobileGL (Android + disaggregated only, next to `DriverPostJni.cpp` in `CMakeLists.txt`):
+  start/stop the in-process server thread, attach/detach the window (`ANativeWindow_fromSurface`, acquire/
+  release), the geometry up-call.
+- Readiness line in logcat (`listening on tcp://...`) like the supervisor's.
+
+### D8 Only one server active on the device
+- The Activity on start stops `MobileGLServerService`; the service on start kills `:mglwin`
+  (`ActivityManager.getRunningAppProcesses` + `Process.killProcess`, same uid) and waits for it to go.
+- Forked session children get `prctl(PR_SET_PDEATHSIG, SIGKILL)` (+ the getppid race check) so they die with
+  their supervisor (fixes the documented child leak, `notes/p65/code-review-findings.md:9`).
+- The in-process listen retries `EADDRINUSE` for up to ~5 s (the previous server may still be dying).
+
+### D9 Tools
+- `tools/trace_replay/tcp_device_server.py --surface window|pbuffer` (default pbuffer = today): window starts
+  the Activity (`am start -n <pkg>/top.mobilegl.plugin.MobileGLDisplayActivity` + the same extras).
+- Linux glws `tools/trace_replay/apitrace_glws_egl.cpp`: `MOBILEGL_TRACE_SURFACE=window` on Linux creates
+  `eglCreateWindowSurface(dpy, cfg, (EGLNativeWindowType)0, {EGL_WIDTH,w,EGL_HEIGHT,h})` (only valid with
+  `MOBILEGL_IPC_SURFACE=server`; otherwise the create fails by name); `resize()` destroys + recreates at the new
+  size. So `trace_replay --window-surface` + `MOBILEGL_IPC_SURFACE=server` replays a trace on the phone screen.
+
+## Constraints (all must hold)
+- G1: pull build `.text` 0xa52203 and 0 symbols added/removed. Every edit to a file compiled into the pull
+  build (`MG_Backend/*`, `MG_Impl/*`, `MG_State/*`, `DirectGLES.cpp`, ...) must be guarded so the pull build is
+  byte-identical. Measure with the gate.
+- fatal_census (79, down-ratchet; every new `Fatal{Word` needs a `FatalFamilies.def` row), link ratchet 171
+  monotone, spawn_lane_parity 0 errors (device-only or new arms must be named there), protocol revision pin,
+  wire_declines_audit, hygiene (stdio grep in MG_Backend/MG_State, gen_pipe clean, doc citations strict).
+- fbs append-only; no branching on link kind above `Transport/`; handshake refusals are `Refuse`, never aborts.
+- Every existing lane stays green (base numbers at 9f669e52: unit 2568, integration-split 322, spawn 239,
+  tcp 243, magma-split 125, magma-spawn 104, magma-tcp 89, magma-full-split 558, integration-gpu 2188 x 2).
+- Red-once per behaviour (a test that is red without the fix and green with it), noted in the report.
+- Commits: single-line `[Scope, Scope] (P12): <what>` (e.g. `[MG_Remote, MG_Test] (P12): ...`), NO trailers of any
+  kind (no Co-Authored-By). Several focused commits are fine.
+
+## Working rules
+- Edit files through `\\wsl.localhost\Arch\home\swung\w7\p12-onscreen\...` with Read/Edit/Write (UNC is writable).
+- Run commands as `MSYS_NO_PATHCONV=1 wsl -d arch --cd /home/swung -- bash -lc '<cmd>'`. The Windows command
+  line mangles heredocs and nested quotes: put anything non-trivial in a script file (Write via UNC, then run
+  it; strip CR with `sed -i 's/\r$//'` if needed). Long jobs: `setsid nohup ... &` and poll the log.
+- git ONLY inside `/home/swung/w7/p12-onscreen` via `wsl`. NEVER touch `~/w7/pipe` or the Windows checkouts.
+  Never `git lfs pull`. Never push.
+- The phone (Redmi 2f7cbe2e) is shared: any adb work runs under `flock -w 3600 /home/swung/w7/locks/2f7cbe2e.lock <cmd>`.
diff --git a/docs/Disaggregated/notes/p12/PLAN-P12.md b/docs/Disaggregated/notes/p12/PLAN-P12.md
new file mode 100644
index 00000000..5d0feab6
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/PLAN-P12.md
@@ -0,0 +1,112 @@
+# P12「server 自有屏幕窗口」子集 — 计划与交接（2026-09-24）
+
+> 接 P7 收官（[`../p7/HANDOFF-2026-09-23.md`](../p7/HANDOFF-2026-09-23.md)）。基线 `feat/disaggregated@9f669e52`。
+> 包树 `~/w7/p12-onscreen`，分支 `p12/onscreen`（从 `9f669e52` 分出，15 个 `(P12)` 提交）。
+> 任务书 [`BRIEF-onscreen.md`](BRIEF-onscreen.md)，只读审计 `map-*.md`（四份），本页是**交接与余项**。
+
+## 1. 这一包做了什么
+
+按用户裁定（[`BRIEF-onscreen.md`](BRIEF-onscreen.md) §User rulings，四条）：Android 上的 server **自己创建
+`ANativeWindow`（自己的 SurfaceView）**，把 IPC 渲染流**渲染到屏幕上**；离屏（pbuffer）与上屏两条路径**都保留**，
+**同一时刻只有一条活跃**，在 server 初始化 / context 创建时决定；拓扑为**进程内 server**——display Activity
+自己的进程里用一个线程跑 TCP server 并直接渲染进它的 SurfaceView，会话在该进程内**串行**；client 侧用一个
+**新的 `WindowKind::ServerOwned`** 接入，且此模式下 client **完全无头**（`eglCreateWindowSurface` 接受 `NULL`），
+窗口几何由 server 回传。
+
+落地的形状（15 提交，53 文件，+4566/−110）：
+
+| 面 | 内容 |
+|---|---|
+| wire | `WindowKind::ServerOwned = 7`（fbs 追加）、控制修订 **2 → 3**、`SurfaceRefusal` / `SurfaceReply`（width/height/refusal）、codec 的 ServerOwned 规则（仅 `CreateWindowSurface`、`nativeToken == 0`、`SetWindowHandle` 具名拒绝）、非零 token 的 latch 行 |
+| server 窗口 | `MG_Remote/Server/ServerDisplay.{h,cpp}`（不透明窗口 + hooks + lease + 有界 `Detach`）、ServerOwned 臂的 one-mode-per-session latch、无显示时的具名拒绝、失窗在 apply 线程释放、`ServerWindowLost` 家族行 |
+| client | `MOBILEGL_IPC_SURFACE=server`（`Config.h` / `ConfigLoader.cpp`）→ 无头窗口 surface、**一次** ServerOwned `CreateWindowSurface`、**不发** `SetWindowHandle`、geteometry 进 EGL state 后才返回 |
+| 进程内 server | `RunSession` 改为返回退出码、`TcpSupervisor` 把已认证会话交给线程（Busy / 会话间 `ResetSessionLatch` / 后端按进程钉住 / 非阻塞 stop）、fork 出的会话子进程 `PR_SET_PDEATHSIG` 随监督进程去 |
+| Android | `MobileGLDisplayActivity`（`:mglwin`，全屏 SurfaceView，aspect-fit，env 在库加载前应用）、display server 的 JNI（`DisplayServerJni.cpp` + 几何 up-call）、与 `MobileGLServerService` 共享环境、**同一时刻只有一个 server**（Activity 停 service，service 杀 `:mglwin`） |
+| 工具 | `tcp_device_server.py --surface window\|pbuffer`、Linux glws 的 `MOBILEGL_TRACE_SURFACE=window` |
+| Espryt | 远端会话的 window-surface extent 随其默认 framebuffer 格式发布（仅 split 构建，pull 构建不动；G1） |
+
+## 2. 门与证据
+
+**G1（硬约束）**：pull 构建 `.text` `0xa52203` 不变、符号 0 增 0 减。门日志 `gate/gate-android1.log` 报
+`a52203`，但那一行印的是 `added=30570 removed=30570`——**这是错的读法**：比较基准
+`~/w7/logs/p12/pull-syms-base.txt` 是用 `nm --defined-only … | awk '{print $3}'` 生成的（每个目标文件
+的符号头行 + 符号），而比较时用的是无 awk 的全量 `nm` 输出，两边不同源，于是"全部新增又全部删除"。
+交接时已独立复核：在 `~/w7/pipe`（pull 构建，恰在 `9f669e52`）与 `p12-onscreen` 两个 `build-linux` 上
+直接 `nm --defined-only | awk '{print $3}' | sort` 后 `comm`，**added 0 / removed 0，符号集各 30570 全同**；
+`readelf -S` 两边 `.text` 都是 `a52203`。**G1 成立**；门脚本的那一行输出应在 P12 收尾时修好（见 §4）。
+
+**主机门**（`gate/gate-android1.log`，head `29b7b284`，dirty=0，2026-09-24 00:55–01:04）：
+
+- unit 2601、integration-split 322、spawn 239、tcp 243、magma-split 125、magma-spawn 104、magma-tcp 89、
+  integration-gpu 2188 × 2（monolith / inproc）**全绿**。
+- `integration-magma-full-split` 558 报 1 红（`IterationRPProgram203Scenario` 的 exposure texel）。**这不是本包引入的**：
+  交接时独立复核，用 ctest 注册的那组环境变量直跑该用例，`p12-onscreen` 3/3 绿、`mismatches=0/262656`；
+  整条车道 `-j 8` 重跑两遍也 558/558 绿。它是既有/环境敏感项，树上早有记录：`../p05/p05-results/value-types-v1.md`
+  判为**构建目录 configure 差异**（`MG_IntegrationTest/CMakeLists.txt` 只在 `MOBILEGL_ITEST_VK_ICD` 匹配
+  `lvp_icd|lavapipe` 时才挂三个 `MOBILEGL_MAGMA_*` 修复开关），`../p7/magma-a.md` §6.2 记它在该 worktree
+  3/3 稳定红且还原后端改动照样红，`../p7/INTEGRATOR-DECISIONS-P7.md` ID-P7-22 **改判为"环境敏感而非 tcp 专属"**。
+  `p12-onscreen` 两个 build 目录的 `MOBILEGL_ITEST_VK_ICD` 都已钉到 lavapipe，`ctest -N -V` 确认注册时带着三个修复变量。
+- 卫生 12 项全 OK；fatal census 79 / link ratchet 171 不变；parity 0；protocol revision pin 报 **revision 3 holds**。
+
+**真机**（Redmi `2f7cbe2e`，Adreno 830，证据 `device/`，`device/evidence-strip.png` 为九格拼图）：
+七个编号检查在两个 head（`984db455`、`a4a940db`、`29b7b284`）上跑过，`trial-*/` 是按 head 归档的旧轮次。
+
+| # | 检查 | 结果 |
+|---|---|---|
+| 1 | Espryt 上屏（OpenRA，`--window-surface`，`MOBILEGL_IPC_SURFACE=server`） | ssim **1.000000**；server 日志 `surface=window 640x480 owner=server`；屏幕截图非黑 |
+| 2 | Magma 上屏（OpenRA）+ 同进程第二个会话（`minecraft-1.21.4-startup`） | ssim **1.000000** / **0.999999511**；两臂都 `owner=server` |
+| 3 | 串行第二会话 + `Refuse{Busy}` | 第二会话绿；并发客户端拿到 `Refuse{Busy}`（rc=134）后长会话照常收尾绿 |
+| 4 | 失窗（`surfaceDestroyed`） | `Fatal{ServerWindowLost}` → 会话 latch → client 读**干净 device lost**；Activity 回来后新会话 ssim 1.0，`:mglwin` 存活 |
+| 5 | 离屏 service（不带旋钮） | ssim 1.0，`surface=pbuffer 640x480`（离屏路径未被破坏） |
+| 6 | 负控：`MOBILEGL_IPC_SURFACE=server` 打离屏 server | 双侧具名 `Refuse ServerOwned (NoServerDisplay)`；随后同 service 的离屏会话绿 |
+| 7 | 一台设备上只有一个 server | Activity 起来杀 service、service 起来杀 `:mglwin`，互相都验证了 |
+
+## 3. 还没做（P12 未收官）
+
+按 [`../ROADMAP.md`](../ROADMAP.md) P12 行的两个出口门，以及本包任务书列出的改小后的条目：
+
+1. **出口门 (a) 未达成。** 要求 FCL 同机 spawn、双后端**入世界**、杀 server 产生干净 device-lost latch。
+   今天验证到的是：trace_replay（**不是 FCL**）经 `--window-surface` + `MOBILEGL_IPC_SURFACE=server` 在屏上重放 OpenRA，
+   双后端都 1.0；device-lost 是**按 HOME（surfaceDestroyed）**触发的，**不是杀 server**。
+2. **出口门 (b) 完全未做。** 要求另一台机器上的 client 经 TCP 在 Redmi 入世界并记录 P6.5 的必测数。
+   本轮的 client 是 `adb forward` 后的 `tcp://127.0.0.1:40613` **环路**（`android/dev.sh:7-8` 写得很清楚），
+   **不是跨机**。
+3. **ROADMAP P12 行里仍未落地的条目**（交接时在树上核过）：
+   - `unix:` 监听（in-process server 只做了 tcp；`grep 'unix:' ServerMain.cpp` 为 0）；
+   - DirectGLES `g_Display` / `g_Surface` / `g_Context` 去全局（`DirectGLES.cpp` 仍有 40 处）；
+   - cached-app freezer 的"完整处理"（树上 0 处提及）；文档从未定义它是什么，`SPAWN-PLAN.md` §8.2 只说了它是 P12 的；
+   - 多 context（契约 §11）；
+   - FCL env 与 plugin APK 开关表接线；
+   - **`AndroidNativeWindow@P12` / `MetalLayer@P12` 的 D8 白名单**（拒 X11 / Win32Hwnd / None）——`map-docs-contract.md` §5.3 记它
+     **没落地**，且当时 `SetWindowHandle` 在 client 侧**无条件发**；本轮把 ServerOwned 模式下的
+     `SetWindowHandle` 变成了具名拒绝，但 D8 本身（X11/Win32 白名单）仍是独立跟进项。
+4. **文档债**（`map-docs-contract.md` §4 列的"落地时要记录的东西"）：
+   - **没有 `MG_Remote/CONTRACT-P12.md`**（前几个阶段都有；本页与 `BRIEF-onscreen.md` 不是契约）；
+   - 没有 `INTEGRATOR-DECISIONS-P12.md` 式的逐条裁定；
+   - `ARCHITECTURE.md:526` 仍写着被删掉的 Surface → AIDL → `ANativeWindow_fromSurface` 旧路径，`protocol.fbs:258`
+     仍写「Android transfers the window out of band」，`ARCHITECTURE.md:533` 仍描述 RESPAWN / IDLE_EXIT 可用；
+   - `CURRENT_STAGE_PROGRESS.md:244` 仍把 P12 描述成"real windows cross processes"，与 Rule H 冲突；
+   - IPC 顺序（`ROADMAP.md:19` 的 P6.5 → Ph → **P12** → P9 与 `CURRENT_STAGE_STATUS.md` / HANDOFF 的
+     P9 → P10 → P11 → P12）两处说法仍不一致；
+   - a6 行 A8-3…A8-15 的处置、CONTRACT-P6 §7.2 D8 的处置都还没写；
+   - 阶段收尾该有一次 Codex 审查（`ROADMAP.md:17` 的惯例）。
+5. **`MG_Test/SanityTest.cpp` 在本包里被改动过**——它属于 pull 构建之外的测试目标，但要确认它与 G1 的关系已在门里测到（门已绿，此处只是点名）。
+
+## 4. 立刻可做的收尾
+
+1. 把 `~/w7/notes/p12/gate.sh` 的 G1 符号比较改成与基准同源（`nm --defined-only … | awk '{print $3}'`），
+   否则下一个跑门的人还会看到 `added=N removed=N` 而误判。
+2. 决定 `IterationRPProgram203Scenario` 在 P12 的处置：既然 ID-P7-22 已判"环境敏感"，把它在门里的
+   出现方式（钉 ICD 即可绿 / 记为已知偶发）写成一句结论，别再一次次口头带过。
+3. 若要真正收官 P12：先补跨机 TCP（出口门 b），再补 FCL + 杀 server 的 device-lost（出口门 a）,
+   最后写 `CONTRACT-P12.md` 并按惯例做一次收官审查。
+
+## 5. 工装在哪
+
+- 任务书与审计：本目录 `BRIEF-onscreen.md`、`map-apk-process.md`、`map-client-surface.md`、
+  `map-docs-contract.md`、`map-server-surface.md`。
+- 门与包树：`gate.sh`、`setup-tree.sh`、`fix-icd.sh`、`g1-base-names.sh`、`p203.sh`；主机门日志 `gate/`。
+- 真机：`android/`（`dev.sh`、`check1/3/4/5/7.sh`、`final-run.sh`、`precheck.sh`、`redonce-tools.sh`、
+  `redonce-twins.sh`、`hostrepro.sh`、`verify-apk.sh` 等），证据 `device/`。
+- **没进仓库的**（按 [`../notes/README.md`](../README.md) "证据数据"的规则）：`~/w7/logs/p12/device/**/logcat*.txt`
+  等约 66 MB 设备日志、APK、`pull-syms-base.txt*`（2.5 MB nm 转储）。要复核请去产生它们的机器。
diff --git a/docs/Disaggregated/notes/p12/android/build.sh b/docs/Disaggregated/notes/p12/android/build.sh
new file mode 100644
index 00000000..3854b7db
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/build.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# build.sh <sha>: the window-2 builder (10-build.sh) on a detached tree of the P12 package tree.
+#
+# 10-build.sh would create the tree with `git -C ~/w7/pipe worktree add` and copy submodules from
+# pipe, and falls back to `git lfs pull` for pointer fixtures. The P12 rules forbid touching pipe
+# and pulling LFS, so the tree is prepared HERE, from the package tree (same object store): the
+# detached worktree, its submodules and glslang External copied from the package tree's copies
+# (the p12 branch moves no gitlink), and the hydrated fixtures copied + assume-unchanged. Then
+# 10-build.sh runs with W2_PIPE=<package tree>, finds everything in place and only builds.
+set -euo pipefail
+PKG=/home/swung/w7/p12-onscreen
+SHA=$(git -C "$PKG" rev-parse --verify "$1^{commit}")
+SHA8=${SHA:0:8}
+STAMP=${2:-p12w1-$SHA8}
+TREE=$HOME/w7/p7w7-tree-$SHA8
+if [ ! -e "$TREE/.git" ]; then
+    git -C "$PKG" worktree add --detach "$TREE" "$SHA"
+fi
+[ "$(git -C "$TREE" rev-parse HEAD)" = "$SHA" ] || { echo "tree $TREE not at $SHA"; exit 1; }
+for path in $(git -C "$TREE" submodule status | awk '{print $2}'); do
+    want=$(git -C "$TREE" ls-tree HEAD "$path" | awk '{print $3}')
+    base=$(git -C "$PKG" ls-tree HEAD "$path" | awk '{print $3}')
+    [ "$want" = "$base" ] || { echo "gitlink $path differs from the package tree's ($want vs $base)"; exit 1; }
+    if [ -z "$(ls -A "$TREE/$path" 2>/dev/null)" ]; then
+        rm -rf "$TREE/$path"
+        cp -a "$PKG/$path" "$TREE/$path"
+        rm -f "$TREE/$path/.git"
+        echo "submodule $path copied from the package tree ($want)"
+    fi
+done
+[ -d "$TREE/3rdparty/glslang/External/spirv-tools" ] || cp -a "$PKG/3rdparty/glslang/External" "$TREE/3rdparty/glslang/"
+git -C "$TREE" ls-files -z tools/trace_replay/fixtures | while IFS= read -r -d "" f; do
+    if head -c 40 "$TREE/$f" 2>/dev/null | grep -q git-lfs && ! head -c 40 "$PKG/$f" | grep -q git-lfs; then
+        cp "$PKG/$f" "$TREE/$f"
+    fi
+done
+git -C "$TREE" ls-files -z tools/trace_replay/fixtures | xargs -0 -r git -C "$TREE" update-index --assume-unchanged
+if head -c 40 "$TREE/tools/trace_replay/fixtures/openra.tgz" | grep -q git-lfs; then
+    echo "openra.tgz is still an LFS pointer - refusing (no git lfs pull)"; exit 1
+fi
+echo "tree ready: $TREE @ $SHA8, stamp $STAMP"
+W2_PIPE=$PKG bash /home/swung/w7/notes/p7/window2/10-build.sh "$SHA" "$STAMP"
diff --git a/docs/Disaggregated/notes/p12/android/check1.sh b/docs/Disaggregated/notes/p12/android/check1.sh
new file mode 100644
index 00000000..317e5e9e
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/check1.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Device check 1 (and 2 with BACKEND=DirectVulkan): on-screen replay through the display Activity.
+#   STAMP=p12w1-<sha8> [BACKEND=DirectGLES|DirectVulkan] [CASE=OpenRA] bash check1.sh
+. "$(dirname "$0")/dev.sh"
+BACKEND=${BACKEND:-DirectGLES}
+CASE=${CASE:-OpenRA}
+CHECK_NAME=${CHECK_NAME:-$([ "$BACKEND" = DirectVulkan ] && echo 2-onscreen-magma || echo 1-onscreen-espryt)}
+OUT=$DEV/$CHECK_NAME
+rm -rf "$OUT"; mkdir -p "$OUT"
+{
+log "check $CHECK_NAME: stamp $STAMP backend $BACKEND case $CASE"
+log "found: $(ps_mobilegl | tr '\n' ';')"
+force_stop; sleep 1
+wake
+T0=$(devtime); echo "$T0" > "$OUT/devtime0"
+PIN=(); [ "$BACKEND" = DirectVulkan ] && PIN=(--backend DirectVulkan)
+tds start --surface window --forward "${PIN[@]}" > "$OUT/tds-start.txt" 2>&1; cat "$OUT/tds-start.txt"
+if wait_logcat "$T0" 'listening on tcp://127\.0\.0\.1:40613 \(in-process display server, display installed\)' 30; then
+    log "READY"
+else
+    log "NOT READY within 30 s"
+fi
+WIN=$(pid_of "$PKG:mglwin"); log ":mglwin pid=$WIN"; echo "$WIN" > "$OUT/mglwin.pid"
+Ash dumpsys window | grep -E "mCurrentFocus|mFocusedApp" | head -2
+log "replay $CASE $BACKEND --window-surface MOBILEGL_IPC_SURFACE=server"
+replay_with_shots "$OUT/replay" "$CASE" "$BACKEND" window MOBILEGL_IPC_SURFACE=server
+log "replay rc=$?"
+result_summary "$OUT/replay"
+shot_report "$OUT/replay"
+log ":mglwin pid after: $(pid_of "$PKG:mglwin")"
+if [ -n "${SECOND_CASE:-}" ]; then
+    log "a second $BACKEND session in the same process: $SECOND_CASE on-screen"
+    replay_with_shots "$OUT/second" "$SECOND_CASE" "$BACKEND" window MOBILEGL_IPC_SURFACE=server
+    log "second session rc=$?"
+    result_summary "$OUT/second"
+    shot_report "$OUT/second" | tail -2
+    log ":mglwin pid after the second session: $(pid_of "$PKG:mglwin")"
+fi
+logcat_since "$T0" > "$OUT/logcat.txt"
+mglines "$OUT/logcat.txt" | head -60
+A shell run-as "$PKG" cat files/mglwin.server.log > "$OUT/mglwin.server.log" 2>&1
+log "done $CHECK_NAME"
+} 2>&1 | tee "$OUT/check.log"
diff --git a/docs/Disaggregated/notes/p12/android/check3.sh b/docs/Disaggregated/notes/p12/android/check3.sh
new file mode 100644
index 00000000..4ed3c356
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/check3.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Device check 3: two sequential on-screen sessions in ONE display-Activity process (the second
+# works), and a second concurrent authenticated client is refused Busy. Runs on the Activity check 1
+# left serving (it re-checks the pid).
+#   STAMP=p12w1-<sha8> [LONG_CASE=...] bash check3.sh
+. "$(dirname "$0")/dev.sh"
+OUT=$DEV/3-sequential-and-busy
+LONG_CASE=${LONG_CASE:-minecraft-1.21.4-startup}
+rm -rf "$OUT"; mkdir -p "$OUT"
+{
+PREV=$(cat "$DEV/1-onscreen-espryt/mglwin.pid" 2>/dev/null)
+WIN=$(pid_of "$PKG:mglwin")
+log ":mglwin pid now=$WIN (check 1's session ran in pid=$PREV)"
+[ -n "$WIN" ] || { log "no display Activity process - run check1.sh first"; exit 1; }
+wake
+T0=$(devtime); echo "$T0" > "$OUT/devtime0"
+
+log "=== session 2 in the same process: OpenRA on-screen"
+replay_with_shots "$OUT/second" OpenRA DirectGLES window MOBILEGL_IPC_SURFACE=server
+log "second session rc=$?"
+result_summary "$OUT/second"
+shot_report "$OUT/second" | tail -2
+log "Welcome server pids seen by the two clients (check 1, this one):"
+grep -ho "control=tcp data=stream server=[^ ]* pid=[0-9]*" "$DEV/1-onscreen-espryt/replay/output/mobilegl.client.log" "$OUT/second/output/mobilegl.client.log" | sort | uniq -c
+
+log "=== Busy: a long on-screen session ($LONG_CASE), then a second authenticated client"
+T1=$(devtime)
+mkdir -p "$OUT/long"; : > "$OUT/long/shots.tsv"
+replay "$OUT/long" "$LONG_CASE" DirectGLES window MOBILEGL_IPC_SURFACE=server &
+LONG=$!
+shots "$OUT/long" $LONG &
+SHOOTER=$!
+if wait_logcat "$T1" 'owner=server' 60; then log "long session is on screen"; else log "long session never reached surface=window"; fi
+sleep 2
+kill -0 $LONG 2>/dev/null && log "long session still live - starting the second client" || log "WARNING: the long session already ended"
+replay "$OUT/concurrent" OpenRA DirectGLES window MOBILEGL_IPC_SURFACE=server
+log "concurrent client rc=$?"
+grep -hiE "busy|refuse" "$OUT/concurrent/replay.log" "$OUT/concurrent/output/"mobilegl*.log 2>/dev/null | cut -c1-260 | sort | uniq -c | head
+wait $LONG; log "long session rc=$?"
+wait $SHOOTER 2>/dev/null
+result_summary "$OUT/long"
+shot_report "$OUT/long" | tail -3
+log ":mglwin pid after: $(pid_of "$PKG:mglwin")"
+logcat_since "$T0" > "$OUT/logcat.txt"
+mglines "$OUT/logcat.txt" | grep -E "MobileGLDisplay|in-process session|Busy|owner=server|surface=window|listening" | head -60
+log "done 3"
+} 2>&1 | tee "$OUT/check.log"
diff --git a/docs/Disaggregated/notes/p12/android/check4.sh b/docs/Disaggregated/notes/p12/android/check4.sh
new file mode 100644
index 00000000..061970d3
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/check4.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Device check 4: HOME during an on-screen replay. The session must end with the named
+# ServerWindowLost latch, :mglwin must survive, the client must read a clean device loss; bringing
+# the Activity back must let the next session render.
+#   STAMP=p12w1-<sha8> [LONG_CASE=...] bash check4.sh
+. "$(dirname "$0")/dev.sh"
+OUT=$DEV/4-window-lost
+LONG_CASE=${LONG_CASE:-minecraft-1.21.4-startup}
+rm -rf "$OUT"; mkdir -p "$OUT"
+{
+WIN=$(pid_of "$PKG:mglwin")
+log ":mglwin pid before=$WIN"
+[ -n "$WIN" ] || { log "no display Activity process - run check1.sh first"; exit 1; }
+wake
+T0=$(devtime); echo "$T0" > "$OUT/devtime0"
+mkdir -p "$OUT/lost"; : > "$OUT/lost/shots.tsv"
+replay "$OUT/lost" "$LONG_CASE" DirectGLES window MOBILEGL_IPC_SURFACE=server &
+LONG=$!
+shots "$OUT/lost" $LONG &
+SHOOTER=$!
+if wait_logcat "$T0" 'owner=server' 60; then log "session is on screen"; else log "session never reached surface=window"; fi
+sleep 3
+kill -0 $LONG 2>/dev/null && log "session live - pressing HOME" || log "WARNING: the session already ended before HOME"
+date +%s.%N > "$OUT/lost/t-home"
+Ash input keyevent KEYCODE_HOME
+wait $LONG; RC=$?
+wait $SHOOTER 2>/dev/null
+log "client rc=$RC after HOME ($(python3 -c "print(round($(cat "$OUT/lost/t1")-$(cat "$OUT/lost/t-home"),2))") s after the key)"
+result_summary "$OUT/lost"
+grep -hiE "ServerWindowLost|device.lost|ServerCrashed|SessionFault|latched" "$OUT/lost/replay.log" "$OUT/lost/output/"mobilegl*.log 2>/dev/null | cut -c1-260 | sort | uniq -c | head -12
+sleep 2
+WIN2=$(pid_of "$PKG:mglwin")
+log ":mglwin pid after HOME=$WIN2 (before=$WIN): $([ "$WIN" = "$WIN2" ] && echo SURVIVED || echo CHANGED)"
+logcat_since "$T0" > "$OUT/logcat-lost.txt"
+mglines "$OUT/logcat-lost.txt" | grep -E "surfaceDestroyed|ServerWindowLost|in-process session|detached|reaped|latch" | head -20
+
+log "=== bring the Activity back, then a new on-screen session"
+T1=$(devtime)
+wake
+tds start --surface window > "$OUT/tds-restart.txt" 2>&1
+if wait_logcat "$T1" 'surfaceCreated: server window' 20; then log "window re-attached"; else log "no surfaceCreated within 20 s"; fi
+Ash dumpsys window | grep -E "mCurrentFocus|mFocusedApp" | head -2
+replay_with_shots "$OUT/after" OpenRA DirectGLES window MOBILEGL_IPC_SURFACE=server
+log "after-return session rc=$?"
+result_summary "$OUT/after"
+shot_report "$OUT/after" | tail -2
+log ":mglwin pid at the end=$(pid_of "$PKG:mglwin")"
+logcat_since "$T0" > "$OUT/logcat.txt"
+mglines "$OUT/logcat.txt" | grep -E "MobileGLDisplay|in-process session|ServerWindowLost|owner=server|window .* (attached|detached)" | head -40
+A shell run-as "$PKG" cat files/mglwin.server.log > "$OUT/mglwin.server.log" 2>&1
+log "done 4"
+} 2>&1 | tee "$OUT/check.log"
diff --git a/docs/Disaggregated/notes/p12/android/check5.sh b/docs/Disaggregated/notes/p12/android/check5.sh
new file mode 100644
index 00000000..70eb623c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/check5.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Device checks 5 and 6 (and 7b): the offscreen service.
+#   5  start MobileGLServerService while the display Activity runs -> :mglwin is gone; the same
+#      fixture WITHOUT the knob replays as before (ssim), server log surface=pbuffer.
+#   6  MOBILEGL_IPC_SURFACE=server against it -> refused by name on both sides; the service still
+#      serves the next (offscreen) session.
+#   STAMP=p12w1-<sha8> bash check5.sh
+. "$(dirname "$0")/dev.sh"
+OUT=$DEV/5-offscreen-service
+OUT6=$DEV/6-negative-serverowned-vs-offscreen
+rm -rf "$OUT" "$OUT6"; mkdir -p "$OUT" "$OUT6"
+{
+WIN=$(pid_of "$PKG:mglwin")
+log "before: :mglwin pid=${WIN:-none}"
+ps_mobilegl
+wake
+T0=$(devtime); echo "$T0" > "$OUT/devtime0"
+tds start --forward > "$OUT/tds-start.txt" 2>&1; cat "$OUT/tds-start.txt"
+if wait_logcat "$T0" 'listening on tcp://127\.0\.0\.1:40613' 30; then log "supervisor READY"; else log "supervisor NOT READY"; fi
+sleep 1
+log "after: :mglwin pid=$(pid_of "$PKG:mglwin" || true) (was ${WIN:-none})"
+ps_mobilegl | tee "$OUT/ps-after-start.txt"
+logcat_since "$T0" > "$OUT/logcat-start.txt"; mglines "$OUT/logcat-start.txt" | head -20
+
+log "=== 5: offscreen replay, no knob"
+replay "$OUT/offscreen" OpenRA DirectGLES pbuffer
+log "offscreen rc=$?"
+result_summary "$OUT/offscreen"
+logcat_since "$T0" > "$OUT/logcat.txt"
+log "done 5"
+} 2>&1 | tee "$OUT/check.log"
+{
+T0=$(devtime); echo "$T0" > "$OUT6/devtime0"
+log "=== 6: MOBILEGL_IPC_SURFACE=server --window-surface against the offscreen service"
+replay "$OUT6/refused" OpenRA DirectGLES window MOBILEGL_IPC_SURFACE=server
+log "refused client rc=$?"
+result_summary "$OUT6/refused"
+grep -hE "NoServerDisplay|owns no display|EGL window surface creation failed|SurfaceRefusal|Refuse ServerOwned" \
+    "$OUT6/refused/replay.log" "$OUT6/refused/output/"mobilegl*.log 2>/dev/null | cut -c1-300 | sort | uniq -c | head
+log "=== 6: the next offscreen session on the same service"
+replay "$OUT6/next" OpenRA DirectGLES pbuffer
+log "next offscreen rc=$?"
+result_summary "$OUT6/next"
+ps_mobilegl | tee "$OUT6/ps-end.txt"
+logcat_since "$T0" > "$OUT6/logcat.txt"
+mglines "$OUT6/logcat.txt" | grep -E "listening|reaped|Refuse|no display|surface=" | head -20
+log "done 6"
+} 2>&1 | tee "$OUT6/check.log"
diff --git a/docs/Disaggregated/notes/p12/android/check7.sh b/docs/Disaggregated/notes/p12/android/check7.sh
new file mode 100644
index 00000000..fbb34547
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/check7.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Device check 7: only one server active.
+#   7a  the offscreen service runs with a LIVE session child; starting the display Activity stops
+#       the service - the supervisor goes, and its session child with it (PR_SET_PDEATHSIG) - and the
+#       Activity's server takes the port (listen retry).
+#   7b  starting the service kills :mglwin (also recorded by check 5).
+#   STAMP=p12w1-<sha8> [LONG_CASE=...] bash check7.sh
+. "$(dirname "$0")/dev.sh"
+OUT=$DEV/7-one-server
+LONG_CASE=${LONG_CASE:-minecraft-1.21.4-startup}
+rm -rf "$OUT"; mkdir -p "$OUT"
+{
+wake
+T0=$(devtime); echo "$T0" > "$OUT/devtime0"
+if [ -z "$(Ash "ps -A -o ARGS" | grep "libMobileGLServer.so $LISTEN --serve")" ]; then
+    log "no supervisor running - starting the service"
+    tds start --forward > "$OUT/tds-service.txt" 2>&1
+    wait_logcat "$T0" 'listening on tcp://127\.0\.0\.1:40613' 30 || log "supervisor NOT READY"
+fi
+log "=== 7a: a live offscreen session, then the display Activity"
+T1=$(devtime)
+replay "$OUT/victim" "$LONG_CASE" DirectGLES pbuffer &
+VICTIM=$!
+if wait_logcat "$T1" 'surface=pbuffer' 60; then log "offscreen session live"; else log "offscreen session never reached surface=pbuffer"; fi
+sleep 1
+ps_mobilegl | tee "$OUT/ps-before.txt"
+SUP=$(Ash "ps -A -o PID,ARGS" | grep "libMobileGLServer.so $LISTEN --serve" | grep -v grep | awk '{print $1}' | head -1)
+CHILD=$(Ash "ps -A -o PID,PPID,NAME" | awk -v p="$SUP" '$2==p && $3 ~ /libMobileGLServer/ {print $1}' | head -1)
+log "supervisor pid=$SUP session child pid=${CHILD:-none}"
+T2=$(devtime)
+tds start --surface window > "$OUT/tds-activity.txt" 2>&1; cat "$OUT/tds-activity.txt"
+if wait_logcat "$T2" 'listening on tcp://127\.0\.0\.1:40613 \(in-process display server, display installed\)' 30; then
+    log "display server READY"
+else
+    log "display server NOT READY"
+fi
+sleep 1
+log "supervisor $SUP alive? $(Ash "[ -d /proc/$SUP ] && echo yes || echo no")  child ${CHILD:-none} alive? $([ -n "$CHILD" ] && Ash "[ -d /proc/$CHILD ] && echo yes || echo no")"
+ps_mobilegl | tee "$OUT/ps-after-activity.txt"
+wait $VICTIM; log "the offscreen session's client rc=$? (its server went away)"
+grep -hiE "device.lost|ServerCrashed|hung up|PeerHungUp|EOF|lost" "$OUT/victim/replay.log" "$OUT/victim/output/"mobilegl.client.log 2>/dev/null | cut -c1-240 | sort | uniq -c | head -8
+logcat_since "$T2" > "$OUT/logcat-7a.txt"; mglines "$OUT/logcat-7a.txt" | grep -vE "pre-auth deadline" | head -24
+
+log "=== 7b: the service again - :mglwin must go"
+WIN=$(pid_of "$PKG:mglwin"); log ":mglwin pid=$WIN"
+T3=$(devtime)
+tds start > "$OUT/tds-service2.txt" 2>&1
+wait_logcat "$T3" 'listening on tcp://127\.0\.0\.1:40613' 30 && log "supervisor READY" || log "supervisor NOT READY"
+sleep 1
+log ":mglwin pid now=$(pid_of "$PKG:mglwin") (was $WIN); /proc/$WIN exists? $(Ash "[ -d /proc/$WIN ] && echo yes || echo no")"
+ps_mobilegl | tee "$OUT/ps-after-service.txt"
+logcat_since "$T3" > "$OUT/logcat-7b.txt"; mglines "$OUT/logcat-7b.txt" | head -16
+logcat_since "$T0" > "$OUT/logcat.txt"
+log "done 7"
+} 2>&1 | tee "$OUT/check.log"
diff --git a/docs/Disaggregated/notes/p12/android/cleanup.sh b/docs/Disaggregated/notes/p12/android/cleanup.sh
new file mode 100644
index 00000000..7dd873e7
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/cleanup.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Leaves the phone clean: both servers stopped (am force-stop), the new APK kept, the adb forward
+# this stage added removed, the Doze whitelist and stay-on setting left as found (never touched).
+#   STAMP=p12w1-<sha8> bash cleanup.sh
+. "$(dirname "$0")/dev.sh"
+OUT=$DEV/99-cleanup
+mkdir -p "$OUT"
+{
+force_stop
+A forward --remove tcp:40613 2>/dev/null || true
+Ash input keyevent KEYCODE_HOME
+sleep 1
+echo "processes : $(ps_mobilegl | tr '\n' ';')"
+echo "forwards  : $(A forward --list | tr '\n' ';')"
+echo "doze wl   : $(Ash 'dumpsys deviceidle whitelist' | grep -i mobilegl | tr '\n' ' ')"
+echo "stay_on   : $(Ash 'settings get global stay_on_while_plugged_in')"
+echo "focus     : $(Ash 'dumpsys window' | grep -m1 mCurrentFocus | tr -s ' ')"
+echo "installed : $(Ash "dumpsys package $PKG" | grep -E 'versionName|lastUpdateTime' | tr -s ' ' | tr '\n' ' ')"
+} 2>&1 | tee "$OUT/final-state.txt"
diff --git a/docs/Disaggregated/notes/p12/android/client-devicelost-probe.patch b/docs/Disaggregated/notes/p12/android/client-devicelost-probe.patch
new file mode 100644
index 00000000..b4d27f79
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/client-devicelost-probe.patch
@@ -0,0 +1,37 @@
+diff --git a/MobileGL/MG_Impl/Pipe/PipeFill.cpp b/MobileGL/MG_Impl/Pipe/PipeFill.cpp
+index 3fb7278c..ea80cba2 100644
+--- a/MobileGL/MG_Impl/Pipe/PipeFill.cpp
++++ b/MobileGL/MG_Impl/Pipe/PipeFill.cpp
+@@ -1112,7 +1112,14 @@ namespace MobileGL::MG_Pipe {
+             // below and this aborts by name on the first glBufferData that carries data.
+             const Uint64 before = MG_Remote::Client::ClientWireRecordsEmitted();
+             MGPipeEmitResourceSubData(buffer, 0, static_cast<SizeT>(buffer.GetSize()));
+-            if (MG_Remote::Client::ClientWireRecordsEmitted() == before) {
++            // EXCEPT ON A LOST DEVICE (P12). Once the session latched device-lost every verb is
++            // DECLINED by design (CONTRACT-P6 5.3) - the resource_subdata above included - so "it
++            // emitted nothing" is the latch working, not bytes this client forgot to carry: there
++            // is no server left for them to exist on. Aborting here turned every clean device loss
++            // (a killed server; the on-screen server's window destroyed under the session) into a
++            // client SIGABRT at its next glBufferData with data.
++            if (MG_Remote::Client::ClientWireRecordsEmitted() == before &&
++                !MG_Remote::Client::ClientSession::DeviceLost()) {
+                 // UncarriedInitialBytes, not a second word for the same family: WireTables.cpp:418
+                 // already dies of exactly this - a respecify that crossed with no initial bytes -
+                 // under that name, and two words for one family is the vocabulary drift a6
+diff --git a/MobileGL/MG_Remote/Client/EmitTables.cpp b/MobileGL/MG_Remote/Client/EmitTables.cpp
+index fc14e81a..6472e1d6 100644
+--- a/MobileGL/MG_Remote/Client/EmitTables.cpp
++++ b/MobileGL/MG_Remote/Client/EmitTables.cpp
+@@ -1577,6 +1577,12 @@ namespace MobileGL::MG_Remote::Client {
+             Uint64 replyBytes = 0;
+             session.EmitAndWait(op, payload, bytes, nullptr, 0, &result, sizeof(result),
+                                 &status, &replyBytes);
++            // A LOST DEVICE ANSWERS AS A RESET CONTEXT DOES (P12). After the latch every verb is
++            // DECLINED (CONTRACT-P6 5.3), so there is no reply to read - and GL's reset rule is
++            // that sync waits then return at once as signaled (ClientWaitSync ALREADY_SIGNALED,
++            // the status SIGNALED), not that the client dies of a "malformed" reply.
++            if (status != Wire::ReplySink::kStatusOk && ClientSession::DeviceLost())
++                return op == MG_Pipe::MGPWireOp::FenceWait ? static_cast<Uint32>(GL_ALREADY_SIGNALED) : 1u;
+             if (status != Wire::ReplySink::kStatusOk || replyBytes != sizeof(result))
+                 Wire::WireProtocolFatal("Fence.reply", "missing or malformed sync result");
+             return result;
diff --git a/docs/Disaggregated/notes/p12/android/commit1.sh b/docs/Disaggregated/notes/p12/android/commit1.sh
new file mode 100644
index 00000000..17a65b48
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/commit1.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd /home/swung/w7/p12-onscreen
+git add MobileGL/MG_Remote/Server/DisplayServerJni.cpp CMakeLists.txt
+git commit -q -m "[MG_Remote] (P12): the in-process display server's JNI - install the display with ANativeWindow hooks and a JVM-attached geometry up-call, serve/stop on a Java thread, attach from surfaceCreated/Changed and a blocking detach from surfaceDestroyed (Android split build only)"
+git add android-plugin/app/src/trace/AndroidManifest.xml \
+        android-plugin/app/src/trace/java/top/mobilegl/plugin/MobileGLDisplayActivity.java \
+        android-plugin/app/src/trace/java/top/mobilegl/plugin/ServerEnvironment.java \
+        android-plugin/app/src/trace/java/top/mobilegl/plugin/MobileGLServerService.java \
+        tools/trace_replay/ServerEnvironmentTest.java tools/trace_replay/test_android_lifecycle.py
+git commit -q -m "[android-plugin, tools] (P12): MobileGLDisplayActivity - the on-screen display server in :mglwin (software window, fullscreen SurfaceView, aspect-fit geometry, env applied before the library loads), one shared server environment with MobileGLServerService, and one server at a time (the Activity stops the service, the service kills :mglwin)"
+git add tools/trace_replay/tcp_device_server.py scripts/ci/tcp_lane_tools_test.py
+git commit -q -m "[tools, scripts] (P12): tcp_device_server.py --surface window|pbuffer (default pbuffer, unchanged) starts the on-screen display Activity on a lit screen, and --backend pins either server"
+git log --oneline -4
diff --git a/docs/Disaggregated/notes/p12/android/commit2.sh b/docs/Disaggregated/notes/p12/android/commit2.sh
new file mode 100644
index 00000000..313f9b5c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/commit2.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd /home/swung/w7/p12-onscreen
+git add MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp MobileGL/MG_Backend/DirectGLES/Managers.cpp \
+        MobileGL/MG_Backend/DirectGLES/Managers.h MobileGL/MG_Test/SanityTest.cpp
+git commit -q -m "[MG_Backend, MG_Test] (P12): the server backend's destruction drops every Espryt twin under a transport, so the in-process display server's next session no longer adopts the ended session's programs, VAOs and buffers (split build only; the pull build is unchanged, G1)"
+git add MobileGL/MG_Remote/Server/DisplayServerJni.cpp
+git commit -q -m "[MG_Remote] (P12): the display geometry up-call attaches the apply thread to the JVM under its own name, so the rest of the session is not logged as the up-call's thread"
+git log --oneline -3
diff --git a/docs/Disaggregated/notes/p12/android/commit3.sh b/docs/Disaggregated/notes/p12/android/commit3.sh
new file mode 100644
index 00000000..1b5ab898
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/commit3.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd /home/swung/w7/p12-onscreen
+git add MobileGL/MG_Remote/Server/ServerMain.cpp
+git commit -q -m "[MG_Remote] (P12): the in-process pin line names the pin it records - MOBILEGL_BACKEND_TYPE when the environment set it, the first session's otherwise"
+git add android-plugin/app/src/trace/java/top/mobilegl/plugin/MobileGLServerService.java
+git commit -q -m "[android-plugin] (P12): MobileGLServerService logs its supervisor's closed output as the service stopping, not as a failure with a stack trace, when the display Activity stops it"
+git add tools/trace_replay/README.md
+git commit -q -m "[tools] (P12): trace_replay README - the two device servers, tcp_device_server.py --surface window, and the headless client's MOBILEGL_IPC_SURFACE=server --window-surface replay"
+git log --oneline -3
+git status --short | grep -v '^??' || true
diff --git a/docs/Disaggregated/notes/p12/android/dev.sh b/docs/Disaggregated/notes/p12/android/dev.sh
new file mode 100644
index 00000000..f2747198
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/dev.sh
@@ -0,0 +1,163 @@
+# P12 android stage - device check helpers. Sourced, never run. Needs STAMP (p12w1-<sha8>).
+# Every script that sources this re-runs itself under the shared device lock (flock -o, like
+# window-2's lib.sh), so nothing it leaves running keeps the phone locked.
+SERIAL=2f7cbe2e
+PKG=top.mobilegl.plugin.p7w1.trace
+TOKEN=p7w1b-lan-token-20260922      # >= 16 bytes
+LISTEN=tcp://127.0.0.1:40613        # loopback on the phone, reached through adb forward
+ENDPOINT=tcp://127.0.0.1:40613
+: "${STAMP:?set STAMP=p12w1-<sha8>}"
+BUILD_OUT=$HOME/w7/logs/p7w7/$STAMP
+HOST=$BUILD_OUT/host
+BUILD_TREE=$(. "$BUILD_OUT/build.env"; echo "$BUILD_TREE")
+FIX=$BUILD_TREE/tools/trace_replay/fixtures
+DEV=$HOME/w7/logs/p12/device
+LOCK=$HOME/w7/locks/$SERIAL.lock
+
+if [ "${P12_LOCK_HELD:-}" != 1 ]; then
+    export P12_LOCK_HELD=1
+    exec flock -o -w 3600 "$LOCK" bash "$0" "$@"
+fi
+
+A() { adb -s "$SERIAL" "$@"; }
+Ash() { adb -s "$SERIAL" shell "$@" | tr -d '\r'; }
+log() { printf '[%s] %s\n' "$(date +%T)" "$*"; }
+devtime() { Ash "date +'%m-%d %H:%M:%S.000'"; }
+wake() { Ash input keyevent KEYCODE_WAKEUP; Ash wm dismiss-keyguard > /dev/null 2>&1 || true; }
+tds() { python3 "$BUILD_TREE/tools/trace_replay/tcp_device_server.py" "$@" --serial "$SERIAL" --package "$PKG" \
+            --listen "$LISTEN" --token "$TOKEN"; }
+force_stop() { Ash am force-stop "$PKG"; }
+pid_of() { Ash "pidof $1" | awk '{print $1}'; }
+ps_mobilegl() { Ash "ps -A -o PID,PPID,NAME,ARGS" | grep -E "mobilegl|MobileGL" | grep -v grep; }
+logcat_since() { A logcat -d -v threadtime -T "$1"; }   # <devtime>
+# mglines <logcat file>: only this package's own tags (MobileGL native lines, the Activity, the service).
+mglines() { grep -E " [VDIWEF] (MobileGL|MobileGLDisplay|MobileGLServer) *:" "$1" | cut -c1-300; }
+
+# wait_logcat <devtime> <extended-regex> <seconds>: 0 once logcat since <devtime> matches.
+wait_logcat() {
+    local since=$1 pattern=$2 limit=$3 n=0
+    while [ $n -lt $((limit * 2)) ]; do
+        if logcat_since "$since" 2>/dev/null | grep -Eq -- "$pattern"; then return 0; fi
+        sleep 0.5; n=$((n + 1))
+    done
+    return 1
+}
+
+# case_args <case>: archive trace golden target width height crop_x crop_y crop_w crop_h
+case_args() {
+    python3 - "$BUILD_TREE/tools/trace_replay/trace_cases.json" "$1" <<'EOF'
+import json, sys
+m = json.load(open(sys.argv[1])); d = m["defaults"]
+c = next(c for c in m["cases"] if c["name"] == sys.argv[2])
+g = lambda k: c.get(k, d.get(k))
+print(g("trace_archive"), g("trace_file"), g("golden"), g("target_call"), g("width"), g("height"),
+      g("crop_x"), g("crop_y"), g("crop_width"), g("crop_height"), g("ssim_threshold"))
+EOF
+}
+
+# replay <dir> <case> <backend> <window|pbuffer> [K=V ...]: one host retrace against ENDPOINT, the
+# run_trace_case.cmake invocation plus the surface flag. Writes <dir>/{replay.log,rc,t0,t1,output/}.
+replay() {
+    local dir=$1 case=$2 backend=$3 surface=$4; shift 4
+    local archive trace golden target w h cx cy cw ch ssim
+    read -r archive trace golden target w h cx cy cw ch ssim < <(case_args "$case")
+    rm -rf "$dir/input" "$dir/output"; mkdir -p "$dir/input" "$dir/output"
+    tar xzf "$FIX/$archive" -C "$dir/input"
+    local flag=--pbuffer-surface; [ "$surface" = window ] && flag=--window-surface
+    date +%s.%N > "$dir/t0"
+    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE \
+        MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream \
+        MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 \
+        MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" \
+        timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" \
+            --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" \
+            --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" \
+            --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" \
+            "$flag" > "$dir/replay.log" 2>&1
+    local rc=$?
+    date +%s.%N > "$dir/t1"
+    echo "$rc" > "$dir/rc"
+    rm -rf "$dir/input"
+    return $rc
+}
+
+# shots <dir> <pid>: adb screencaps every ~1 s while <pid> lives -> <dir>/shots/NN.png + shots.tsv
+shots() {
+    local dir=$1 pid=$2 n=0
+    mkdir -p "$dir/shots"
+    while kill -0 "$pid" 2> /dev/null; do
+        local t0 t1 f
+        f=$(printf '%s/shots/%02d.png' "$dir" "$n")
+        t0=$(date +%s.%N)
+        A exec-out screencap -p > "$f" 2> /dev/null
+        t1=$(date +%s.%N)
+        printf '%s\t%s\t%s\n' "$n" "$t0" "$t1" >> "$dir/shots.tsv"
+        n=$((n + 1))
+        sleep 0.7
+    done
+}
+
+# replay_with_shots <dir> <case> <backend> <surface> [K=V ...]
+replay_with_shots() {
+    local dir=$1
+    mkdir -p "$dir"; : > "$dir/shots.tsv"
+    replay "$@" &
+    local pid=$!
+    shots "$dir" "$pid" &
+    local shooter=$!
+    wait "$pid"; local rc=$?
+    wait "$shooter" 2> /dev/null
+    return $rc
+}
+
+# shot_report <dir>: per screencap, whether it was taken DURING the replay and how much of the
+# screen is non-black; the best during-replay shot is copied (and a 540p copy made) as evidence.
+shot_report() {
+    python3 - "$1" <<'EOF'
+import sys, pathlib
+from PIL import Image
+d = pathlib.Path(sys.argv[1])
+t0 = float((d / "t0").read_text()); t1 = float((d / "t1").read_text())
+best = None
+rows = []
+for line in (d / "shots.tsv").read_text().splitlines():
+    n, a, b = line.split("\t"); a = float(a); b = float(b)
+    f = d / "shots" / f"{int(n):02d}.png"
+    try:
+        im = Image.open(f).convert("L")
+    except Exception as e:
+        rows.append(f"{n} unreadable {e}"); continue
+    small = im.resize((im.width // 4, im.height // 4))
+    px = list(small.getdata())
+    lit = sum(1 for p in px if p > 24) / len(px)
+    mean = sum(px) / len(px)
+    during = a >= t0 and b <= t1
+    rows.append(f"{n} t=+{a - t0:6.2f}s..+{b - t0:6.2f}s during={during} nonblack={lit:.3f} mean={mean:.1f}")
+    if during and (best is None or lit > best[1]):
+        best = (f, lit, mean, a - t0)
+print(f"replay ran {t1 - t0:.2f}s; {len(rows)} screencaps")
+print("\n".join(rows))
+if best:
+    f, lit, mean, at = best
+    ev = d / "evidence-during-replay.png"
+    ev.write_bytes(f.read_bytes())
+    im = Image.open(f); h = 540; w = max(1, im.width * h // im.height)
+    im.resize((w, h)).save(d / "evidence-during-replay-540p.png")
+    print(f"BEST during-replay screencap: {f.name} at +{at:.2f}s nonblack={lit:.3f} mean={mean:.1f} -> {ev}")
+else:
+    print("NO screencap was taken during the replay")
+EOF
+}
+
+# result_summary <dir>: the runner's own verdict (result.json) and the arm proofs from the logs.
+result_summary() {
+    local dir=$1
+    echo "rc=$(cat "$dir/rc" 2>/dev/null)"
+    python3 - "$dir/output/result.json" <<'EOF' 2>/dev/null || echo "result.json: missing"
+import json, sys
+r = json.load(open(sys.argv[1]))
+print("result.json:", {k: r.get(k) for k in ("passed", "statusCode", "ssim", "message", "matchedGoldenPath")})
+EOF
+    grep -hE "surface=(window|pbuffer)|control=tcp data=stream server=|owner=server|Refuse ServerOwned|NoServerDisplay|SurfaceModeMismatch|ServerWindowLost|device lost|DEVICE_LOST|Welcome" \
+        "$dir"/output/mobilegl*.log 2>/dev/null | cut -c1-300 | sort | uniq -c | sort -rn | head -20
+}
diff --git a/docs/Disaggregated/notes/p12/android/final-run.sh b/docs/Disaggregated/notes/p12/android/final-run.sh
new file mode 100644
index 00000000..e66e85c3
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/final-run.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# final-run.sh <stamp>: install and run every device check in order on one build.
+set -uo pipefail
+STAMP=$1
+D=/home/swung/w7/logs/p12/device
+H=/home/swung/w7/notes/p12/android
+prev=$(ls -d "$D"/[1-7]-* 2>/dev/null | head -1)
+if [ -n "$prev" ]; then
+    arch=$D/trial-$(cat "$D/.stamp" 2>/dev/null || echo unknown)
+    mkdir -p "$arch"; mv "$D"/[1-7]-* "$arch"/
+fi
+echo "${STAMP#p12w1-}" > "$D/.stamp"
+bash /home/swung/w7/notes/p7/window2/20-install.sh "$STAMP" 2>&1 | tail -3
+export STAMP
+bash "$H/check1.sh" > /dev/null 2>&1                                          # 1 Espryt on-screen
+bash "$H/check3.sh" > /dev/null 2>&1                                          # 3 sequential + Busy
+LONG_CASE=minecraft-1.21.4-fabric-iris-bsl-esc-menu-854 bash "$H/check4.sh" > /dev/null 2>&1   # 4 window lost
+BACKEND=DirectVulkan SECOND_CASE=minecraft-1.21.4-startup bash "$H/check1.sh" > /dev/null 2>&1 # 2 Magma
+bash "$H/check5.sh" > /dev/null 2>&1                                          # 5 + 6 offscreen service
+LONG_CASE=minecraft-1.21.4-fabric-iris-bsl-esc-menu-854 bash "$H/check7.sh" > /dev/null 2>&1   # 7 one server
+echo "all checks ran for $STAMP"
+ls "$D"
diff --git a/docs/Disaggregated/notes/p12/android/g1.sh b/docs/Disaggregated/notes/p12/android/g1.sh
new file mode 100644
index 00000000..f409ac16
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/g1.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# g1.sh: the pull build's libMobileGL against the P12 base - .text size and full nm lines (the
+# base file holds full `nm` lines, so both sides are compared whole and as names).
+set -uo pipefail
+cd /home/swung/w7/p12-onscreen || exit 1
+export MOBILEGL_FLATC_EXECUTABLE=/home/swung/w7/flatc-build/flatc
+ninja -C build-linux -j 24 MobileGL 2>&1 | tail -1
+readelf -S -W build-linux/libMobileGL.so | awk '$2==".text"{print "G1 text size (hex):", $6, "(base a52203)"}'
+T=$(mktemp -d)
+nm --defined-only build-linux/libMobileGL.so | sort > "$T/now.txt"
+sort /home/swung/w7/logs/p12/pull-syms-base.txt > "$T/base.txt"
+echo "G1 full nm lines: added=$(comm -13 "$T/base.txt" "$T/now.txt" | wc -l) removed=$(comm -23 "$T/base.txt" "$T/now.txt" | wc -l)"
+awk '{print $3}' "$T/now.txt" | sort > "$T/now-n.txt"; awk '{print $3}' "$T/base.txt" | sort > "$T/base-n.txt"
+echo "G1 names: added=$(comm -13 "$T/base-n.txt" "$T/now-n.txt" | wc -l) removed=$(comm -23 "$T/base-n.txt" "$T/now-n.txt" | wc -l)"
+rm -rf "$T"
diff --git a/docs/Disaggregated/notes/p12/android/host-inproc-server.py b/docs/Disaggregated/notes/p12/android/host-inproc-server.py
new file mode 100644
index 00000000..5647ada9
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/host-inproc-server.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+"""host-inproc-server.py <libMobileGL.so> <endpoint>: the in-process display server entry
+(mobilegl_server_serve_inprocess) hosted by a plain host process, no display installed - the host
+twin of MobileGLDisplayActivity's server thread, for reproducing sequential-session behaviour."""
+import ctypes, os, sys, signal, threading
+lib_path, endpoint = sys.argv[1], sys.argv[2]
+for k in ("MOBILEGL_TRANSPORT", "MOBILEGL_IPC_SERVER_PATH", "MOBILEGL_IPC_RING_MB", "MOBILEGL_IPC_STAGE_MB",
+          "MOBILEGL_IPC_CONTROL", "DISPLAY", "WAYLAND_DISPLAY"):
+    os.environ.pop(k, None)
+os.environ.update(MOBILEGL_IPC_ROLE="server", MOBILEGL_IPC_DIAL="no", MOBILEGL_IPC_LOG_FORWARD="1")
+os.environ.setdefault("EGL_PLATFORM", "surfaceless")
+lib = ctypes.CDLL(lib_path)
+lib.mobilegl_server_serve_inprocess.argtypes = [ctypes.c_char_p]
+lib.mobilegl_server_serve_inprocess.restype = ctypes.c_int
+def stop(*_):
+    lib.mobilegl_server_stop_inprocess()
+signal.signal(signal.SIGTERM, stop)
+signal.signal(signal.SIGINT, stop)
+rc = [None]
+t = threading.Thread(target=lambda: rc.__setitem__(0, lib.mobilegl_server_serve_inprocess(endpoint.encode())))
+t.start()
+while t.is_alive():
+    t.join(0.2)
+print("serve returned", rc[0], flush=True)
+sys.exit(rc[0] or 0)
diff --git a/docs/Disaggregated/notes/p12/android/hostkill.sh b/docs/Disaggregated/notes/p12/android/hostkill.sh
new file mode 100644
index 00000000..bc059a7c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/hostkill.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# hostkill.sh <libdir> <outdir> [case] [kill-after-s]: a replay against the host in-process server,
+# whose process is SIGKILLed mid-session. The client must latch DEVICE LOST and end without a
+# SIGABRT (rc 134).
+set -uo pipefail
+LIBDIR=$1; OUT=$2; CASE=${3:-minecraft-1.21.4-fabric-iris-bsl-esc-menu-854}; AFTER=${4:-6}
+TREE=/home/swung/w7/p12-onscreen
+FIX=$TREE/tools/trace_replay/fixtures
+REPLAY=${REPLAY:-/home/swung/w7/logs/p7w7/p12w1-a4a940db/host/mobilegl_trace_replay}
+EP=tcp://127.0.0.1:41998
+TOKEN=p12-host-repro-token-0001
+rm -rf "$OUT"; mkdir -p "$OUT"
+export VK_ICD_FILENAMES=/usr/share/vulkan/icd.d/lvp_icd.json __EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json
+MOBILEGL_IPC_TOKEN=$TOKEN MOBILEGL_LOG_FILE_PATH=$OUT/server.log \
+    python3 /home/swung/w7/notes/p12/android/host-inproc-server.py "$LIBDIR/libMobileGL.so" "$EP" > "$OUT/server.out" 2>&1 &
+SERVER=$!
+sleep 1.5
+read -r archive trace golden target w h cx cy cw ch ssim < <(python3 - "$TREE/tools/trace_replay/trace_cases.json" "$CASE" <<'EOF'
+import json, sys
+m = json.load(open(sys.argv[1])); d = m["defaults"]
+c = next(c for c in m["cases"] if c["name"] == sys.argv[2])
+g = lambda k: c.get(k, d.get(k))
+print(g("trace_archive"), g("trace_file"), g("golden"), g("target_call"), g("width"), g("height"),
+      g("crop_x"), g("crop_y"), g("crop_width"), g("crop_height"), g("ssim_threshold"))
+EOF
+)
+d=$OUT/run; mkdir -p "$d/input" "$d/output"; tar xzf "$FIX/$archive" -C "$d/input"
+env -u DISPLAY -u WAYLAND_DISPLAY MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL=$EP MOBILEGL_IPC_DATA=stream \
+    MOBILEGL_IPC_TOKEN=$TOKEN MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH=$d/output/mobilegl.log \
+    timeout 600 "$REPLAY" --trace "$d/input/$trace" --golden "$FIX/$golden" --diff "$d/output/diff.png" \
+    --output "$d/output" --backend DirectGLES --mobilegl-library "$LIBDIR/libMobileGL.so" --target-call "$target" \
+    --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" \
+    --crop-height "$ch" --pbuffer-surface > "$d/replay.log" 2>&1 &
+CLIENT=$!
+sleep "$AFTER"
+kill -0 $CLIENT 2>/dev/null && echo "client live after ${AFTER}s: SIGKILL the server" || echo "WARNING: client already ended"
+kill -KILL $SERVER
+wait $CLIENT; RC=$?
+echo "client rc=$RC $( [ $RC = 134 ] && echo '(SIGABRT)')"
+grep -hE "DEVICE LOST|FATAL" "$d/output/mobilegl.client.log" | cut -c1-200 | head -4
+rm -rf "$d/input"
diff --git a/docs/Disaggregated/notes/p12/android/hostrepro.sh b/docs/Disaggregated/notes/p12/android/hostrepro.sh
new file mode 100644
index 00000000..614a1026
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/hostrepro.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# hostrepro.sh <libdir> <outdir> [case] [backend] [runs]: the in-process server on the host (no display),
+# then <runs> sequential offscreen replays of <case> against it. Reproduces cross-session state leaks.
+set -uo pipefail
+LIBDIR=$1; OUT=$2; CASE=${3:-OpenRA}; BACKEND=${4:-DirectGLES}; RUNS=${5:-2}
+TREE=/home/swung/w7/p12-onscreen
+FIX=$TREE/tools/trace_replay/fixtures
+REPLAY=${REPLAY:-/home/swung/w7/logs/p7w7/p12w1-984db455/host/mobilegl_trace_replay}
+EP=tcp://127.0.0.1:41999
+TOKEN=p12-host-repro-token-0001
+rm -rf "$OUT"; mkdir -p "$OUT"
+export VK_ICD_FILENAMES=/usr/share/vulkan/icd.d/lvp_icd.json __EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json
+MOBILEGL_IPC_TOKEN=$TOKEN MOBILEGL_LOG_FILE_PATH=$OUT/server.log ${SERVER_ENV:-} \
+    python3 /home/swung/w7/notes/p12/android/host-inproc-server.py "$LIBDIR/libMobileGL.so" "$EP" > "$OUT/server.out" 2>&1 &
+SERVER=$!
+sleep 1.5
+CASES=${CASES:-$(for _ in $(seq 1 "$RUNS"); do printf '%s ' "$CASE"; done)}
+n=0
+for CASE in $CASES; do
+    n=$((n + 1))
+read -r archive trace golden target w h cx cy cw ch ssim < <(python3 - "$TREE/tools/trace_replay/trace_cases.json" "$CASE" <<'EOF'
+import json, sys
+m = json.load(open(sys.argv[1])); d = m["defaults"]
+c = next(c for c in m["cases"] if c["name"] == sys.argv[2])
+g = lambda k: c.get(k, d.get(k))
+print(g("trace_archive"), g("trace_file"), g("golden"), g("target_call"), g("width"), g("height"),
+      g("crop_x"), g("crop_y"), g("crop_width"), g("crop_height"), g("ssim_threshold"))
+EOF
+)
+    echo "run$n: $CASE"
+    d=$OUT/run$n; mkdir -p "$d/input" "$d/output"; tar xzf "$FIX/$archive" -C "$d/input"
+    env -u DISPLAY -u WAYLAND_DISPLAY MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL=$EP MOBILEGL_IPC_DATA=stream \
+        MOBILEGL_IPC_TOKEN=$TOKEN MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH=$d/output/mobilegl.log ${CLIENT_ENV:-} \
+        timeout 600 "$REPLAY" --trace "$d/input/$trace" --golden "$FIX/$golden" --diff "$d/output/diff.png" \
+        --output "$d/output" --backend "$BACKEND" --mobilegl-library "$LIBDIR/libMobileGL.so" --target-call "$target" \
+        --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" \
+        --crop-height "$ch" ${SURFACE_FLAG:---pbuffer-surface} > "$d/replay.log" 2>&1
+    echo "run$n rc=$? $(python3 -c "import json;r=json.load(open('$d/output/result.json'));print(r['passed'],r.get('ssim'))" 2>/dev/null)"
+    grep -hcE "Program linking failed" "$d/output/mobilegl.server.log" 2>/dev/null | sed "s/^/  link failures: /"
+    rm -rf "$d/input"
+done
+kill -TERM $SERVER; wait $SERVER
+tail -3 "$OUT/server.out"
diff --git a/docs/Disaggregated/notes/p12/android/launch-build.sh b/docs/Disaggregated/notes/p12/android/launch-build.sh
new file mode 100644
index 00000000..312464c4
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/launch-build.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# launch-build.sh [<sha>]: starts build.sh for the package tree's HEAD (or <sha>) in the background.
+set -euo pipefail
+SHA=$(git -C /home/swung/w7/p12-onscreen rev-parse "${1:-HEAD}")
+mkdir -p /home/swung/w7/logs/p12/android
+LOG=/home/swung/w7/logs/p12/android/build-${SHA:0:8}.log
+setsid nohup bash /home/swung/w7/notes/p12/android/build.sh "$SHA" > "$LOG" 2>&1 < /dev/null &
+echo "started build of ${SHA:0:8}, log $LOG"
diff --git a/docs/Disaggregated/notes/p12/android/pidlines.sh b/docs/Disaggregated/notes/p12/android/pidlines.sh
new file mode 100644
index 00000000..6900abba
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/pidlines.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# pidlines.sh <logcat> <pid> <from HH:MM:SS> <to HH:MM:SS> [exclude-regex]: that pid's lines in a window.
+f=$1; pid=$2; from=$3; to=$4; ex=${5:-'^$'}
+awk -v p="$pid" -v a="$from" -v b="$to" '$3==p && substr($2,1,8)>=a && substr($2,1,8)<=b' "$f" | grep -vE "$ex" | cut -c1-240
diff --git a/docs/Disaggregated/notes/p12/android/precheck.sh b/docs/Disaggregated/notes/p12/android/precheck.sh
new file mode 100644
index 00000000..60a3722d
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/precheck.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Quick compile checks before the full APK build: the trace flavour's new/changed Java against
+# android-34, and DisplayServerJni.cpp for aarch64-linux-android26 with the split build's flags.
+set -uo pipefail
+cd /home/swung/w7/p12-onscreen || exit 1
+export JAVA_HOME=/usr/lib/jvm/java-21-openjdk PATH=/usr/lib/jvm/java-21-openjdk/bin:$PATH
+OUT=$(mktemp -d /tmp/p12-precheck-XXXX)
+J=android-plugin/app/src/trace/java/top/mobilegl/plugin
+echo "--- javac (android-34)"
+javac --release 11 -Xlint:all -cp /home/swung/android-sdk/platforms/android-34/android.jar -d "$OUT/classes" \
+    $J/MobileGLDisplayActivity.java $J/MobileGLServerService.java $J/ServerEnvironment.java 2>&1 | grep -v "^warning: \[options\]" | tail -30
+echo "javac rc=${PIPESTATUS[0]}"
+
+echo "--- clang++ -fsyntax-only DisplayServerJni.cpp (android26)"
+NDK=/home/swung/android-sdk/ndk/27.3.13750724/toolchains/llvm/prebuilt/linux-x86_64
+# The split build's command line for ServerDisplay.cpp gives the include dirs and defines.
+CMD=$(python3 - <<'EOF'
+import json,shlex
+db=json.load(open('build-split/compile_commands.json'))
+e=next(x for x in db if x['file'].endswith('MG_Remote/Server/ServerDisplay.cpp'))
+args=shlex.split(e['command'])
+keep=[a for a in args if a.startswith(('-I','-D','-isystem','-std=')) ]
+# -isystem takes the next arg
+out=[];i=0
+while i<len(args):
+    a=args[i]
+    if a=='-isystem': out+= [a,args[i+1]]; i+=2; continue
+    if a.startswith(('-I','-D','-std=')): out.append(a)
+    i+=1
+print(' '.join(shlex.quote(a) for a in out))
+EOF
+)
+eval "$NDK/bin/clang++ --target=aarch64-linux-android26 -fsyntax-only -Wall -Wextra $CMD \
+    MobileGL/MG_Remote/Server/DisplayServerJni.cpp" 2>&1 | grep -E "error|warning: .*DisplayServerJni" | head -30
+echo "clang rc=${PIPESTATUS[0]}"
+eval "$NDK/bin/clang++ --target=aarch64-linux-android26 -fsyntax-only $CMD \
+    MobileGL/MG_Remote/Server/ServerDisplay.cpp" 2>&1 | grep -E "error" | head -10
+echo "clang ServerDisplay.cpp (android arm) rc=${PIPESTATUS[0]}"
+rm -rf "$OUT"
diff --git a/docs/Disaggregated/notes/p12/android/redonce-tools.sh b/docs/Disaggregated/notes/p12/android/redonce-tools.sh
new file mode 100644
index 00000000..d9e25465
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/redonce-tools.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Red-once for the Android stage's host-side tool tests: each mutation must turn its test red, and
+# the working file is restored from a backup copy (never git checkout) afterwards.
+set -uo pipefail
+cd /home/swung/w7/p12-onscreen || exit 1
+export JAVA_HOME=/usr/lib/jvm/java-21-openjdk PATH=/usr/lib/jvm/java-21-openjdk/bin:$PATH
+B=$(mktemp -d /tmp/p12-redonce-XXXX)
+run() { "$@" > "$B/out.txt" 2>&1; local rc=$?; tail -3 "$B/out.txt" | sed 's/^/      /'; echo "    rc=$rc"; }
+
+echo "=== 1. tcp_device_server.py at base (no --surface): DeviceServerSurface must be red"
+cp tools/trace_replay/tcp_device_server.py "$B/tds.py"
+git show HEAD:tools/trace_replay/tcp_device_server.py > tools/trace_replay/tcp_device_server.py
+run python3 scripts/ci/tcp_lane_tools_test.py DeviceServerSurface
+cp "$B/tds.py" tools/trace_replay/tcp_device_server.py
+echo "    restored; green again:"; run python3 scripts/ci/tcp_lane_tools_test.py DeviceServerSurface
+
+echo "=== 2. ServerEnvironment.changes without unsets: ServerEnvironmentTest must be red"
+F=android-plugin/app/src/trace/java/top/mobilegl/plugin/ServerEnvironment.java
+cp "$F" "$B/se.java"
+sed -i 's/if (!after.containsKey(name)) edits.put(name, null);/if (false) edits.put(name, null);/' "$F"
+grep -c 'if (false) edits.put' "$F"
+run python3 tools/trace_replay/test_android_lifecycle.py
+cp "$B/se.java" "$F"
+
+echo "=== 3. applyServerRole keeping the scrub list: ServerEnvironmentTest must be red"
+sed -i 's/for (String name : SCRUBBED) env.remove(name);/for (String name : SCRUBBED) { }/' "$F"
+grep -c 'SCRUBBED) { }' "$F"
+run python3 tools/trace_replay/test_android_lifecycle.py
+cp "$B/se.java" "$F"
+
+echo "=== 4. the display Activity without android:process: the manifest check must be red"
+M=android-plugin/app/src/trace/AndroidManifest.xml
+cp "$M" "$B/manifest.xml"
+sed -i '/android:process=":mglwin"/d' "$M"
+run python3 tools/trace_replay/test_android_lifecycle.py
+cp "$B/manifest.xml" "$M"
+
+echo "=== restored: all green"
+run python3 tools/trace_replay/test_android_lifecycle.py
+git status --short
+rm -rf "$B"
diff --git a/docs/Disaggregated/notes/p12/android/redonce-twins.sh b/docs/Disaggregated/notes/p12/android/redonce-twins.sh
new file mode 100644
index 00000000..5aebbcb0
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/redonce-twins.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Red-once for the twin drop: the call removed from ~BackendObject_DirectGLES must turn the unit
+# case red, and the host sequential repro red again; the file is restored from a backup copy.
+set -uo pipefail
+cd /home/swung/w7/p12-onscreen || exit 1
+export MOBILEGL_FLATC_EXECUTABLE=/home/swung/w7/flatc-build/flatc
+F=MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp
+B=$(mktemp /tmp/p12-bodg-XXXX.cpp); cp "$F" "$B"
+sed -i 's/if (MG_Config::Transport != MG_Config::TransportMode::Monolith) DropEveryTwinForEndedServerSession();/(void)0;/' "$F"
+echo "mutation applied: $(grep -c '(void)0;' "$F") site(s)"
+ninja -C build-split -j 24 SanityTest MobileGL 2>&1 | tail -1
+echo "--- unit case WITHOUT the drop"
+./build-split/MobileGL/MG_Test/SanityTest --gtest_filter='EsprytServerSession.*' 2>&1 | grep -E "Failure|OK \]|FAILED \]|still live" | head -8
+echo "--- host sequential sessions WITHOUT the drop"
+bash /home/swung/w7/notes/p12/android/hostrepro.sh /home/swung/w7/p12-onscreen/build-split /tmp/p12-redonce-twins OpenRA DirectGLES 2 2>&1 | grep -E "^run"
+cp "$B" "$F"; rm -f "$B"
+touch "$F"
+ninja -C build-split -j 24 SanityTest MobileGL 2>&1 | tail -1
+echo "--- restored"
+./build-split/MobileGL/MG_Test/SanityTest --gtest_filter='EsprytServerSession.*' 2>&1 | grep -E "OK \]|FAILED \]"
+git diff --stat
diff --git a/docs/Disaggregated/notes/p12/android/run-tool-tests.sh b/docs/Disaggregated/notes/p12/android/run-tool-tests.sh
new file mode 100644
index 00000000..82b4c874
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/run-tool-tests.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Runs the host-side tool tests the Android stage touches, in the package tree.
+set -uo pipefail
+cd /home/swung/w7/p12-onscreen || exit 1
+export JAVA_HOME=/usr/lib/jvm/java-21-openjdk PATH=/usr/lib/jvm/java-21-openjdk/bin:$PATH
+echo "--- test_android_lifecycle.py"
+python3 tools/trace_replay/test_android_lifecycle.py; echo "rc=$?"
+echo "--- tcp_lane_tools_test.py DeviceServerSurface + DeviceIdleExemption"
+python3 -m pytest -q scripts/ci/tcp_lane_tools_test.py 2>/dev/null | tail -3 || true
+python3 scripts/ci/tcp_lane_tools_test.py 2>&1 | tail -4; echo "rc=${PIPESTATUS[0]}"
diff --git a/docs/Disaggregated/notes/p12/android/sanity-test-append.cpp b/docs/Disaggregated/notes/p12/android/sanity-test-append.cpp
new file mode 100644
index 00000000..689652b2
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/sanity-test-append.cpp
@@ -0,0 +1,69 @@
+
+// P12 (on-screen server window): A SERVER SESSION ENDS IN A PROCESS THAT OUTLIVES IT.
+//
+// The in-process display server (the display Activity's process) runs its sessions one after
+// another in ONE process, and each new client mints its handles from the same {slot, gen} space
+// again. The twin tables are process globals, so the twins the previous session built - naming ids
+// of the context its backend destroyed - answered for the next session's objects: on the device
+// the second on-screen OpenRA replay linked no program (ssim 0.00004) and the third crashed inside
+// Adreno's glDrawElements; on llvmpipe the second replay failed the same way. The server backend's
+// destruction under a transport - the end of a session - now drops every twin (without a driver
+// call), and monolith keeps its twins. Red once: remove the DropEveryTwinForEndedServerSession
+// call from ~BackendObject_DirectGLES and the first half of this case fails at every kind.
+#if MOBILEGL_BUILD_DISAGGREGATED
+TEST(EsprytServerSession, TheServerBackendsDestructionDropsEveryTwinTheSessionBuilt) {
+    using namespace MobileGL;
+    namespace GL = MG_Backend::DirectGLES;
+    const auto previousTransport = MG_Config::Transport;
+    const MG_Pipe::MGPipeHandle program{7u, 3u};
+    const MG_Pipe::MGPipeHandle texture{4u, 2u};
+    const MG_Pipe::MGPipeHandle buffer{5u, 1u};
+    // A session's twins: LIVE entries at the generations its client minted. A null twin object is
+    // enough for the program and texture kinds - what the next session trips over is the live
+    // entry itself (its generation, and the driver id a real twin would carry).
+    const auto populate = [&] {
+        ASSERT_NE(GL::PrgramImpl::g_backendProgramObjects.GetOrCreateByHandle(program), nullptr);
+        ASSERT_NE(GL::TextureImpl::g_backendTextureObjects.GetOrCreateByHandle(texture), nullptr);
+        GL::BufferImpl::g_backendBufferResources.GetOrCreate(buffer) =
+            MakeShared<GL::BufferImpl::GLESBufferResource>();
+        ASSERT_EQ(GL::PrgramImpl::g_backendProgramObjects.LiveGenAt(program.Slot), 3u);
+        ASSERT_EQ(GL::TextureImpl::g_backendTextureObjects.LiveGenAt(texture.Slot), 2u);
+        ASSERT_NE(GL::BufferImpl::g_backendBufferResources.FindByHandle(buffer), nullptr);
+    };
+
+    // Under a transport this backend is the SERVER's: its destruction ends the session.
+    MG_Config::Transport = MG_Config::TransportMode::Spawn;
+    populate();
+    { GL::BackendObject_DirectGLES serverBackend; }
+    EXPECT_EQ(GL::PrgramImpl::g_backendProgramObjects.LiveGenAt(program.Slot), 0u)
+        << "the ended session's program twin is still live: the next session's client mints {7, 0} "
+           "and is refused as ProtocolCorruption, or adopts a program of the destroyed context";
+    EXPECT_EQ(GL::TextureImpl::g_backendTextureObjects.LiveGenAt(texture.Slot), 0u)
+        << "the ended session's texture twin is still live";
+    EXPECT_EQ(GL::BufferImpl::g_backendBufferResources.FindByHandle(buffer), nullptr)
+        << "the ended session's buffer twin is still live";
+    // The next session starts from empty tables: its first handle at that slot is a fresh twin.
+    MG_Pipe::MGPipeHandle nextSession{7u, 0u};
+    auto* fresh = GL::PrgramImpl::g_backendProgramObjects.GetOrCreateByHandle(nextSession);
+    ASSERT_NE(fresh, nullptr);
+    EXPECT_EQ(*fresh, nullptr);
+
+    // Monolith keeps its twins: its backend is not a session's, and nothing here changed for it.
+    GL::PrgramImpl::g_backendProgramObjects = {};
+    MG_Config::Transport = MG_Config::TransportMode::Monolith;
+    populate();
+    { GL::BackendObject_DirectGLES monolithBackend; }
+    EXPECT_EQ(GL::PrgramImpl::g_backendProgramObjects.LiveGenAt(program.Slot), 3u);
+    EXPECT_EQ(GL::TextureImpl::g_backendTextureObjects.LiveGenAt(texture.Slot), 2u);
+    EXPECT_NE(GL::BufferImpl::g_backendBufferResources.FindByHandle(buffer), nullptr);
+
+    GL::PrgramImpl::g_backendProgramObjects = {};
+    GL::TextureImpl::g_backendTextureObjects = {};
+    GL::BufferImpl::g_backendBufferResources = {};
+    MG_Config::Transport = previousTransport;
+}
+#else
+TEST(EsprytServerSession, TheServerBackendsDestructionDropsEveryTwinTheSessionBuilt) {
+    GTEST_SKIP() << "a server backend exists only in the split build (MOBILEGL_BUILD_DISAGGREGATED)";
+}
+#endif
diff --git a/docs/Disaggregated/notes/p12/android/show.sh b/docs/Disaggregated/notes/p12/android/show.sh
new file mode 100644
index 00000000..7f53aa19
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/show.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# show.sh <check-dir>...: the non-logcat lines of each check.log, then its logcat lines (trimmed).
+for c in "$@"; do
+    f=/home/swung/w7/logs/p12/device/$c/check.log
+    echo "######## $c"
+    grep -vE "^09-24" "$f" | grep -v Deprecation | cut -c1-260
+    echo "---- logcat lines"
+    grep -E "^09-24" "$f" | cut -c1-250 | head -${LINES_MAX:-30}
+done
diff --git a/docs/Disaggregated/notes/p12/android/thumbs.py b/docs/Disaggregated/notes/p12/android/thumbs.py
new file mode 100644
index 00000000..2f4fd223
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/thumbs.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+"""thumbs.py <out.png> <png>...: a side-by-side strip of 540p-high thumbnails with labels."""
+import sys
+from PIL import Image, ImageDraw
+out, files = sys.argv[1], sys.argv[2:]
+thumbs = []
+for f in files:
+    im = Image.open(f).convert("RGB")
+    h = 540
+    w = max(1, im.width * h // im.height)
+    t = im.resize((w, h))
+    ImageDraw.Draw(t).text((8, 8), f.split("/")[-1], fill=(255, 0, 255))
+    thumbs.append(t)
+strip = Image.new("RGB", (sum(t.width for t in thumbs) + 8 * (len(thumbs) - 1), 540), (40, 40, 40))
+x = 0
+for t in thumbs:
+    strip.paste(t, (x, 0))
+    x += t.width + 8
+strip.save(out)
+print(out, strip.size)
diff --git a/docs/Disaggregated/notes/p12/android/verify-apk.sh b/docs/Disaggregated/notes/p12/android/verify-apk.sh
new file mode 100644
index 00000000..b5a33ad7
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/android/verify-apk.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# verify-apk.sh <stamp>: the APK carries the display Activity, its JNI and the in-process entry.
+O=/home/swung/w7/logs/p7w7/$1
+NM=/home/swung/android-sdk/ndk/27.3.13750724/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-nm
+BT=$(ls -d /home/swung/android-sdk/build-tools/* | sort -V | tail -1)
+echo "--- JNI + in-process entry exported by the APK's libMobileGL.so"
+$NM -D --defined-only "$O/apk/lib/libMobileGL.so" | grep -E "MobileGLDisplayActivity|serve_inprocess|stop_inprocess"
+echo "--- manifest"
+"$BT/aapt2" dump xmltree --file AndroidManifest.xml "$O/apk/trace-$1.apk" | grep -B2 -A14 'MobileGLDisplayActivity' | grep -E "name|process|hardware|launchMode|taskAffinity|exported|configChanges" | head -12
+echo "--- classes"
+unzip -p "$O/apk/trace-$1.apk" classes.dex | strings | grep -E "^Ltop/mobilegl/plugin/(MobileGLDisplayActivity|ServerEnvironment|MobileGLServerService);" | sort -u
+echo "--- stamp"
+strings "$O/apk/lib/libMobileGL.so" | grep -F "$1" | head -2
+cat "$O/build.env"
diff --git a/docs/Disaggregated/notes/p12/device/00-found-state.txt b/docs/Disaggregated/notes/p12/device/00-found-state.txt
new file mode 100644
index 00000000..27799b9a
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/00-found-state.txt
@@ -0,0 +1,9 @@
+Device 2f7cbe2e as found by the P12 android stage (2026-09-24 ~00:10, before any change):
+- installed top.mobilegl.plugin.p7w1.trace (window-2 build), its :mglsrv service running the supervisor
+  `libMobileGLServer.so tcp://0.0.0.0:40613 --serve` (window-2's 90-restore.sh left it up)
+- doze whitelist: user,top.mobilegl.plugin.p7w1.trace,10318 (window-2 state file
+  ~/.cache/mobilegl/tcp-server/2f7cbe2e-top.mobilegl.plugin.p7w1.trace.json, originally_whitelisted=false)
+- settings global stay_on_while_plugged_in = 15
+- adb forward --list: empty
+- screen: mWakefulness=Awake, isKeyguardShowing=false
+The APK install (20-install.sh, 00:25) replaced the package and ended that supervisor.
diff --git a/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/check.log b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/check.log
new file mode 100644
index 00000000..e4721381
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/check.log
@@ -0,0 +1,95 @@
+[00:55:16] check 1-onscreen-espryt: stamp p12w1-29b7b284 backend DirectGLES case OpenRA
+[00:55:16] found: 
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+[00:55:18] READY
+[00:55:18] :mglwin pid=16893
+  mCurrentFocus=Window{f185636 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{78532545 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t661}
+[00:55:18] replay OpenRA DirectGLES --window-surface MOBILEGL_IPC_SURFACE=server
+[00:55:31] replay rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png'}
+      1 [12:55:22] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac32cb0 generation 1)
+      1 [12:55:22] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+      1 [00:55:19] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [00:55:18] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [00:55:18] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=16893 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+replay ran 11.21s; 12 screencaps
+0 t=+ -0.07s..+  0.20s during=False nonblack=0.023 mean=1.9
+1 t=+  0.90s..+  1.18s during=True nonblack=0.000 mean=0.0
+2 t=+  1.88s..+  2.23s during=True nonblack=0.090 mean=5.4
+3 t=+  2.93s..+  3.24s during=True nonblack=0.090 mean=5.4
+4 t=+  3.94s..+  4.23s during=True nonblack=0.090 mean=5.4
+5 t=+  4.93s..+  5.24s during=True nonblack=0.090 mean=5.4
+6 t=+  5.94s..+  6.25s during=True nonblack=0.090 mean=5.4
+7 t=+  6.95s..+  7.29s during=True nonblack=0.090 mean=5.4
+8 t=+  7.99s..+  8.30s during=True nonblack=0.090 mean=5.4
+9 t=+  9.00s..+  9.33s during=True nonblack=0.090 mean=5.4
+10 t=+ 10.03s..+ 10.32s during=True nonblack=0.090 mean=5.4
+11 t=+ 11.03s..+ 11.67s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.88s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/evidence-during-replay.png
+[00:55:31] :mglwin pid after: 16893
+09-24 12:55:21.624 16893 16893 I MobileGL: [12:55:21] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:55:21.624 16893 16893 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=16893, backend pinned by the first session)
+09-24 12:55:21.625 16893 18709 E MobileGL: [12:55:21] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 listening on tcp://127.0.0.1:40613 (in-process display server, display installed)
+09-24 12:55:21.625 16893 18709 E MobileGL: [12:55:21] [Android mgl-display-ser/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+09-24 12:55:21.652 16893 16893 I MobileGL: [12:55:21] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac32cb0 attached at 1280x2620 (generation 1)
+09-24 12:55:21.652 16893 16893 I MobileGLDisplay: surfaceCreated: server window 1280x2620 attached
+09-24 12:55:21.652 16893 16893 I MobileGL: [12:55:21] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac32cb0 is now 1280x2620
+09-24 12:55:21.652 16893 16893 I MobileGLDisplay: surfaceChanged: server window 1280x2620 attached
+09-24 12:55:21.883 16893 18709 E MobileGL: [12:55:21] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #1 started on a thread (pid=16893)
+09-24 12:55:21.883 16893 18729 I MobileGL: [12:55:21] [Android mgl-display-ser/INFO]: Config: Active backend type set to DirectGLES
+09-24 12:55:21.883 16893 18729 E MobileGL: [12:55:21] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 in-process display server pinned backend type 0 for the process lifetime (the first session's; MOBILEGL_BACKEND_TYPE unset)
+09-24 12:55:21.884 16893 18729 I MobileGL: [12:55:21] [Android mgl-display-ser/INFO]: Loaded GL backend library: libEGL.so
+09-24 12:55:21.884 16893 18729 F MobileGL: [12:55:21] [Android mgl-display-ser/FATAL]: Failed to load EGL function: eglSwapBuffersWithDamageEXT
+09-24 12:55:21.890 16893 18729 E MobileGL: [12:55:21] [Android mgl-display-ser/ERROR]: Failed to load GLES function: glShaderStorageBlockBinding
+09-24 12:55:21.905 16893 18729 I MobileGL: [12:55:21] [Android mgl-display-ser/INFO]: MG_Remote memory[accept/server]: peakRss=249167872 currentRss=249167872 roleMapped=58990592 allRolesMapped=58990592 (peakRss is the PROCESS's; under inproc both roles share it)
+09-24 12:55:21.905 16893 18729 E MobileGL: [12:55:21] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 transport=spawn role=server ready control=tcp data=stream
+09-24 12:55:21.908 16893 18731 I MobileGL: [12:55:21] [Android mgl-srv-apply/INFO]: MG_Remote server: mgl-srv-apply started. MOBILEGL_IPC_SERVER_AFFINITY='auto' requested mask 0xc0, RESOLVED mask 0xc0 (0 = no affinity applied), spin 50 us
+09-24 12:55:22.037 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]: MG_Remote server: display geometry 640x480 requested (SurfaceHolder.setFixedSize)
+09-24 12:55:22.038 16893 16893 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:55:22.045 16893 16893 I MobileGL: [12:55:22] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac32cb0 is now 640x480
+09-24 12:55:22.045 16893 16893 I MobileGLDisplay: surfaceChanged: server window 640x480 attached
+09-24 12:55:22.052 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]: GL_VENDOR: Qualcomm
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]: GL_RENDERER: Adreno (TM) 830
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]: Detected 125 OpenGL ES extensions:
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_EGL_image
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_EGL_image_external
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_EGL_sync
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_vertex_half_float
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_framebuffer_object
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_rgb8_rgba8
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_compressed_ETC1_RGB8_texture
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_AMD_compressed_ATC_texture
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_KHR_texture_compression_astc_sliced_3d
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_KHR_texture_compression_astc_ldr
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_KHR_texture_compression_astc_hdr
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_compression_astc
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_s3tc
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_s3tc_srgb
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_rgtc
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_bptc
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_npot
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_filter_anisotropic
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_format_BGRA8888
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_read_format_bgra
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_3D
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_color_buffer_float
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_color_buffer_half_float
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_float_blend
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_QCOM_alpha_test
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_depth24
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_packed_depth_stencil
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_depth_texture
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_depth_texture_cube_map
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_sRGB
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_float
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_float_linear
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_half_float
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_OES_texture_half_float_linear
+09-24 12:55:22.079 16893 18731 I MobileGL: [12:55:22] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_type_2_10_10_10_REV
+[00:55:32] done 1-onscreen-espryt
diff --git a/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/output/result.json b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/output/result.json
new file mode 100644
index 00000000..b11f5912
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/replay/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/tds-start.txt b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/tds-start.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/1-onscreen-espryt/tds-start.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/check.log b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/check.log
new file mode 100644
index 00000000..1a630d20
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/check.log
@@ -0,0 +1,106 @@
+[00:56:15] check 2-onscreen-magma: stamp p12w1-29b7b284 backend DirectVulkan case OpenRA
+[00:56:16] found: 16893  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin;
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+[00:56:17] READY
+[00:56:17] :mglwin pid=17622
+  mCurrentFocus=Window{1e71822 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{113535615 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t662}
+[00:56:17] replay OpenRA DirectVulkan --window-surface MOBILEGL_IPC_SURFACE=server
+[00:56:30] replay rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:56:18] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:56:21] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+      1 [12:56:21] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+      1 [00:56:18] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=17622 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+replay ran 11.53s; 12 screencaps
+0 t=+ -0.07s..+  0.20s during=False nonblack=0.019 mean=1.7
+1 t=+  0.90s..+  1.19s during=True nonblack=0.000 mean=0.0
+2 t=+  1.89s..+  2.19s during=True nonblack=0.090 mean=5.4
+3 t=+  2.89s..+  3.18s during=True nonblack=0.090 mean=5.4
+4 t=+  3.89s..+  4.18s during=True nonblack=0.090 mean=5.4
+5 t=+  4.88s..+  5.21s during=True nonblack=0.090 mean=5.4
+6 t=+  5.92s..+  6.24s during=True nonblack=0.090 mean=5.4
+7 t=+  6.95s..+  7.29s during=True nonblack=0.090 mean=5.4
+8 t=+  7.99s..+  8.31s during=True nonblack=0.090 mean=5.4
+9 t=+  9.01s..+  9.34s during=True nonblack=0.090 mean=5.4
+10 t=+ 10.04s..+ 10.37s during=True nonblack=0.090 mean=5.4
+11 t=+ 11.08s..+ 11.74s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.89s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/2-onscreen-magma/replay/evidence-during-replay.png
+[00:56:31] :mglwin pid after: 17622
+[00:56:31] a second DirectVulkan session in the same process: minecraft-1.21.4-startup on-screen
+[00:56:40] second session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 0.999999511, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=520, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png'}
+      2 [00:56:31] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [12:56:34] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+      1 [12:56:34] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+      1 [00:56:31] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=17622 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+8 t=+  8.56s..+  8.88s during=False nonblack=0.261 mean=31.8
+BEST during-replay screencap: 01.png at +1.30s nonblack=0.261 mean=31.7 -> /home/swung/w7/logs/p12/device/2-onscreen-magma/second/evidence-during-replay.png
+[00:56:41] :mglwin pid after the second session: 17622
+09-24 12:56:20.787 17622 17622 I MobileGL: [12:56:20] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:56:20.787 17622 17622 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=17622, backend DirectVulkan)
+09-24 12:56:20.787 17622 19362 E MobileGL: [12:56:20] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=17622 listening on tcp://127.0.0.1:40613 (in-process display server, display installed)
+09-24 12:56:20.787 17622 19362 E MobileGL: [12:56:20] [Android mgl-display-ser/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+09-24 12:56:20.814 17622 17622 I MobileGL: [12:56:20] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 attached at 1280x2620 (generation 1)
+09-24 12:56:20.814 17622 17622 I MobileGLDisplay: surfaceCreated: server window 1280x2620 attached
+09-24 12:56:20.814 17622 17622 I MobileGL: [12:56:20] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 is now 1280x2620
+09-24 12:56:20.814 17622 17622 I MobileGLDisplay: surfaceChanged: server window 1280x2620 attached
+09-24 12:56:21.071 17622 19362 E MobileGL: [12:56:21] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #1 started on a thread (pid=17622)
+09-24 12:56:21.071 17622 19385 I MobileGL: [12:56:21] [Android mgl-display-ser/INFO]: Config: Active backend type set to DirectVulkan
+09-24 12:56:21.071 17622 19385 E MobileGL: [12:56:21] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=17622 in-process display server pinned backend type 1 for the process lifetime (MOBILEGL_BACKEND_TYPE)
+09-24 12:56:21.084 17622 19385 I MobileGL: [12:56:21] [Android mgl-display-ser/INFO]: MG_Remote memory[accept/server]: peakRss=246738944 currentRss=246738944 roleMapped=58990592 allRolesMapped=58990592 (peakRss is the PROCESS's; under inproc both roles share it)
+09-24 12:56:21.084 17622 19385 E MobileGL: [12:56:21] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=17622 transport=spawn role=server ready control=tcp data=stream
+09-24 12:56:21.087 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: MG_Remote server: mgl-srv-apply started. MOBILEGL_IPC_SERVER_AFFINITY='auto' requested mask 0xc0, RESOLVED mask 0xc0 (0 = no affinity applied), spin 50 us
+09-24 12:56:21.218 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: MG_Remote server: display geometry 640x480 requested (SurfaceHolder.setFixedSize)
+09-24 12:56:21.218 17622 17622 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:56:21.225 17622 17622 I MobileGL: [12:56:21] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 is now 640x480
+09-24 12:56:21.225 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+09-24 12:56:21.225 17622 17622 I MobileGLDisplay: surfaceChanged: server window 640x480 attached
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: Got 14 Vulkan instance extensions: 
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_surface (r.25)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_surface_protected_capabilities (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_android_surface (r.6)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_swapchain_colorspace (r.5)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_get_surface_capabilities2 (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_GOOGLE_surfaceless_query (r.2)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_surface_maintenance1 (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_debug_report (r.10)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_get_physical_device_properties2 (r.2)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_external_semaphore_capabilities (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_external_memory_capabilities (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_device_group_creation (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_debug_utils (r.2)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_external_fence_capabilities (r.1)
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: Validation layers not available.
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: Validation layers not requested.
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: Enabling 2 Vulkan instance extensions:
+09-24 12:56:21.270 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_surface
+09-24 12:56:21.271 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_android_surface
+09-24 12:56:21.277 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: Found 1 physical device(s).
+09-24 12:56:21.277 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     Adreno (TM) 830 (Vulkan 1.3.284, INTEGRATED_GPU)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]: Got 165 Vulkan device extensions: 
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_incremental_present (r.2)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_hdr_metadata (r.3)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_shared_presentable_image (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_GOOGLE_display_timing (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_image_compression_control (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_image_compression_control_swapchain (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_swapchain_maintenance1 (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_swapchain_mutable_format (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_depth_range_unrestricted (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_subgroup_size_control (r.2)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_ray_tracing_maintenance1 (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_external_memory (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_pipeline_creation_feedback (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_shader_float16_int8 (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_EXT_multisampled_render_to_single_sampled (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_get_memory_requirements2 (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_copy_commands2 (r.1)
+09-24 12:56:21.278 17622 19387 I MobileGL: [12:56:21] [Android mgl-srv-apply/INFO]:     VK_KHR_deferred_host_operations (r.4)
+[00:56:41] done 2-onscreen-magma
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/output/result.json b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/output/result.json
new file mode 100644
index 00000000..302cffd6
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/replay/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/replay/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/replay/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/replay/output/OpenRA-diff.png",
+  "backend": "DirectVulkan",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/evidence-during-replay-540p.png
new file mode 100644
index 00000000..8276ac1e
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/evidence-during-replay.png
new file mode 100644
index 00000000..3d687a1d
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/output/result.json b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/output/result.json
new file mode 100644
index 00000000..17624c95
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/second/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=520, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/second/input/trace.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/second/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/second/output/minecraft-1.21.4-startup-diff.png",
+  "backend": "DirectVulkan",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 92195,
+  "width": 854,
+  "height": 480,
+  "cropX": 0,
+  "cropY": 0,
+  "cropWidth": 0,
+  "cropHeight": 0,
+  "ssim": 0.999999511,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 520
+}
diff --git a/docs/Disaggregated/notes/p12/device/2-onscreen-magma/tds-start.txt b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/tds-start.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/2-onscreen-magma/tds-start.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/check.log b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/check.log
new file mode 100644
index 00000000..67ca34af
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/check.log
@@ -0,0 +1,47 @@
+[00:55:32] :mglwin pid now=16893 (check 1's session ran in pid=16893)
+[00:55:32] === session 2 in the same process: OpenRA on-screen
+[00:55:44] second session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:55:32] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:55:35] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac32cb0 generation 1)
+      1 [12:55:35] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+      1 [00:55:32] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=16893 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+10 t=+ 10.86s..+ 11.57s during=False nonblack=0.340 mean=30.0
+BEST during-replay screencap: 02.png at +2.37s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/3-sequential-and-busy/second/evidence-during-replay.png
+[00:55:45] Welcome server pids seen by the two clients (check 1, this one):
+      2 control=tcp data=stream server=127.0.0.1:40613 pid=16893
+[00:55:45] === Busy: a long on-screen session (minecraft-1.21.4-startup), then a second authenticated client
+[00:55:46] long session is on screen
+[00:55:48] long session still live - starting the second client
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3978928 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:55:48] concurrent client rc=134
+      1 [00:55:48] [Linux mobilegl_trace_/ERROR]: MGPipe: peer Refuse{Busy} one session is already active expected=0 actual=0
+[00:55:52] long session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 0.999999511, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=520, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png'}
+      2 [00:55:45] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [12:55:48] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac32cb0 generation 1)
+      1 [12:55:48] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+      1 [00:55:45] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=16893 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+5 t=+  5.50s..+  5.83s during=True nonblack=0.261 mean=32.0
+6 t=+  6.53s..+  6.84s during=True nonblack=0.261 mean=31.9
+BEST during-replay screencap: 01.png at +1.36s nonblack=0.261 mean=31.8 -> /home/swung/w7/logs/p12/device/3-sequential-and-busy/long/evidence-during-replay.png
+[00:55:53] :mglwin pid after: 16893
+09-24 12:55:35.571 16893 18709 E MobileGL: [12:55:35] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #2 started on a thread (pid=16893)
+09-24 12:55:35.786 16893 16893 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:55:35.789 16893 18851 I MobileGL: [12:55:35] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+09-24 12:55:35.860 16893 16893 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:55:35.864 16893 18851 I MobileGL: [12:55:35] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac32cb0 generation 1)
+09-24 12:55:47.107 16893 18709 E MobileGL: [12:55:47] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #2 pid=16893 reaped exit=0 sessionsFaulted=0
+09-24 12:55:48.458 16893 18709 E MobileGL: [12:55:48] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #3 started on a thread (pid=16893)
+09-24 12:55:48.630 16893 16893 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:55:48.647 16893 16893 I MobileGLDisplay: surfaceChanged: server window 854x480 attached
+09-24 12:55:48.650 16893 18956 I MobileGL: [12:55:48] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+09-24 12:55:48.697 16893 16893 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:55:48.701 16893 18956 I MobileGL: [12:55:48] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac32cb0 generation 1)
+09-24 12:55:51.238 16893 18709 E MobileGL: [12:55:51] [Android mgl-display-ser/ERROR]: MG_Remote server: Refuse{Busy} one session is already active
+09-24 12:55:55.993 16893 18709 E MobileGL: [12:55:55] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #3 pid=16893 reaped exit=0 sessionsFaulted=0
+[00:55:53] done 3
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/evidence-during-replay-540p.png
new file mode 100644
index 00000000..3d50256a
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/evidence-during-replay.png
new file mode 100644
index 00000000..6258e569
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/output/result.json b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/output/result.json
new file mode 100644
index 00000000..09631660
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/long/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=520, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/long/input/trace.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/long/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/long/output/minecraft-1.21.4-startup-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 92195,
+  "width": 854,
+  "height": 480,
+  "cropX": 0,
+  "cropY": 0,
+  "cropWidth": 0,
+  "cropHeight": 0,
+  "ssim": 0.999999511,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 520
+}
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/output/result.json b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/output/result.json
new file mode 100644
index 00000000..265dbf52
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/3-sequential-and-busy/second/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/4-window-lost/after/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/4-window-lost/after/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/4-window-lost/after/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/4-window-lost/after/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/4-window-lost/after/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/4-window-lost/after/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/4-window-lost/after/output/result.json b/docs/Disaggregated/notes/p12/device/4-window-lost/after/output/result.json
new file mode 100644
index 00000000..697c2add
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/4-window-lost/after/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/4-window-lost/after/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/4-window-lost/after/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/4-window-lost/after/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/4-window-lost/check.log b/docs/Disaggregated/notes/p12/device/4-window-lost/check.log
new file mode 100644
index 00000000..29bc0811
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/4-window-lost/check.log
@@ -0,0 +1,62 @@
+[00:55:53] :mglwin pid before=16893
+[00:55:54] session is on screen
+[00:55:57] session live - pressing HOME
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3979042 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:55:59] client rc=134 after HOME (0.82 s after the key)
+rc=134
+result.json: missing
+      1 [12:56:01] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session ends so the client reads a clean device loss. 
+      1 [12:56:01] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the next connection (PH-1, ID-P7-1)
+      1 [12:56:01] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+      1 [12:55:57] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+      1 [00:55:54] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [00:55:53] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=16893 dial=connect
+      1 [00:55:58] [Linux mobilegl_trace_/ERROR]: MGPipe: DEVICE LOST - the barrier woke on a peer that had hung up. The server process is gone; every verb from here is DECLINED and glGetGraphicsResetStatus reports GL_UNKNOWN_CONTEXT_RESET. This is latched from the pe
+      1 [12:56:01] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+      1 [12:56:01] [Android mgl-srv-apply/ERROR]: MG_Remote server: mgl-srv-apply leaves its loop - the session latched a named fault and declines the rest of the ring (PH-1)
+      1 [12:56:01] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the next
+      1 [12:56:01] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session ends s
+[00:56:01] :mglwin pid after HOME=16893 (before=16893): SURVIVED
+09-24 12:55:56.897 16893 18709 E MobileGL: [12:55:56] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 started on a thread (pid=16893)
+09-24 12:56:01.355 16893 19061 F MobileGL: [12:56:01] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session end
+09-24 12:56:01.355 16893 19061 E MobileGL: [12:56:01] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the n
+09-24 12:56:01.355 16893 19061 E MobileGL: [12:56:01] [Android mgl-srv-apply/ERROR]: MG_Remote server: mgl-srv-apply leaves its loop - the session latched a named fault and declines the rest of the ring (PH-1)
+09-24 12:56:01.355 16893 16893 I MobileGL: [12:56:01] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac32cb0 detached (ReleasedBySession)
+09-24 12:56:01.355 16893 16893 I MobileGLDisplay: surfaceDestroyed: server window detached (ReleasedBySession) in 10 ms
+09-24 12:56:01.378 16893 19054 E MobileGL: [12:56:01] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+09-24 12:56:01.457 16893 18709 E MobileGL: [12:56:01] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 pid=16893 reaped exit=75 (latched fault) sessionsFaulted=1
+[00:56:01] === bring the Activity back, then a new on-screen session
+[00:56:02] window re-attached
+  mCurrentFocus=Window{f185636 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{78532545 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t661}
+[00:56:15] after-return session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:56:02] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:56:06] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac2d290 generation 3)
+      1 [12:56:05] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac2d290 generation 3)
+      1 [00:56:02] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=16893 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+11 t=+ 11.12s..+ 11.76s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.93s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/4-window-lost/after/evidence-during-replay.png
+[00:56:15] :mglwin pid at the end=16893
+09-24 12:55:56.897 16893 18709 E MobileGL: [12:55:56] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 started on a thread (pid=16893)
+09-24 12:55:57.108 16893 16893 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:55:57.111 16893 19061 I MobileGL: [12:55:57] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac32cb0 generation 1)
+09-24 12:56:01.355 16893 19061 F MobileGL: [12:56:01] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session end
+09-24 12:56:01.355 16893 19061 E MobileGL: [12:56:01] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the n
+09-24 12:56:01.355 16893 16893 I MobileGL: [12:56:01] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac32cb0 detached (ReleasedBySession)
+09-24 12:56:01.355 16893 16893 I MobileGLDisplay: surfaceDestroyed: server window detached (ReleasedBySession) in 10 ms
+09-24 12:56:01.378 16893 19054 E MobileGL: [12:56:01] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=16893 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+09-24 12:56:01.457 16893 18709 E MobileGL: [12:56:01] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 pid=16893 reaped exit=75 (latched fault) sessionsFaulted=1
+09-24 12:56:05.455 16893 16893 I MobileGL: [12:56:05] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac2d290 attached at 854x480 (generation 3)
+09-24 12:56:05.455 16893 16893 I MobileGLDisplay: surfaceCreated: server window 854x480 attached
+09-24 12:56:05.455 16893 16893 I MobileGLDisplay: surfaceChanged: server window 854x480 attached
+09-24 12:56:05.686 16893 18709 E MobileGL: [12:56:05] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #5 started on a thread (pid=16893)
+09-24 12:56:05.925 16893 16893 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:56:05.934 16893 16893 I MobileGLDisplay: surfaceChanged: server window 640x480 attached
+09-24 12:56:05.944 16893 19187 I MobileGL: [12:56:05] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac2d290 generation 3)
+09-24 12:56:06.019 16893 16893 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:56:06.028 16893 19187 I MobileGL: [12:56:06] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac2d290 generation 3)
+09-24 12:56:16.959 16893 18709 E MobileGL: [12:56:16] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #5 pid=16893 reaped exit=0 sessionsFaulted=1
+[00:56:15] done 4
diff --git a/docs/Disaggregated/notes/p12/device/4-window-lost/tds-restart.txt b/docs/Disaggregated/notes/p12/device/4-window-lost/tds-restart.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/4-window-lost/tds-restart.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/5-offscreen-service/check.log b/docs/Disaggregated/notes/p12/device/5-offscreen-service/check.log
new file mode 100644
index 00000000..58f3556d
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/5-offscreen-service/check.log
@@ -0,0 +1,21 @@
+[00:56:41] before: :mglwin pid=17622
+17622  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin
+Starting service: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLServerService (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGLServer
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613
+[00:56:42] supervisor READY
+[00:56:43] after: :mglwin pid= (was 17622)
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19649 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+09-24 12:56:45.241 19605 19605 I MobileGLServer: removing the on-screen display server's task (P12 D8: one server at a time)
+09-24 12:56:45.245 19605 19605 I MobileGLServer: stopping the on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=17622 (P12 D8: one server at a time)
+09-24 12:56:45.297 19605 19605 I MobileGLServer: on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=17622 is gone
+09-24 12:56:45.376 19649 19649 E MobileGL: [12:56:45] [Android libMobileGLServ/ERROR]: MG_Remote server: pid=19649 listening on tcp://127.0.0.1:40613
+09-24 12:56:45.376 19649 19649 E MobileGL: [12:56:45] [Android libMobileGLServ/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+[00:56:44] === 5: offscreen replay, no knob
+[00:56:56] offscreen rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [12:56:47] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+      1 [00:56:44] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19676 dial=connect
+[00:56:56] done 5
diff --git a/docs/Disaggregated/notes/p12/device/5-offscreen-service/offscreen/output/result.json b/docs/Disaggregated/notes/p12/device/5-offscreen-service/offscreen/output/result.json
new file mode 100644
index 00000000..16000656
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/5-offscreen-service/offscreen/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/5-offscreen-service/offscreen/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/5-offscreen-service/offscreen/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/5-offscreen-service/offscreen/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": true,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/5-offscreen-service/ps-after-start.txt b/docs/Disaggregated/notes/p12/device/5-offscreen-service/ps-after-start.txt
new file mode 100644
index 00000000..eaed205b
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/5-offscreen-service/ps-after-start.txt
@@ -0,0 +1,2 @@
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19649 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/5-offscreen-service/tds-start.txt b/docs/Disaggregated/notes/p12/device/5-offscreen-service/tds-start.txt
new file mode 100644
index 00000000..2710e91c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/5-offscreen-service/tds-start.txt
@@ -0,0 +1,3 @@
+Starting service: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLServerService (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGLServer
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613
diff --git a/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/check.log b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/check.log
new file mode 100644
index 00000000..0b0cc993
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/check.log
@@ -0,0 +1,25 @@
+[00:56:56] === 6: MOBILEGL_IPC_SURFACE=server --window-surface against the offscreen service
+[00:56:57] refused client rc=5
+rc=5
+result.json: {'passed': False, 'statusCode': 5, 'ssim': -1.0, 'message': 'retrace failed with status 1', 'matchedGoldenPath': ''}
+      1 [12:57:00] [Android mgl-srv-apply/ERROR]: MG_Remote server: Refuse ServerOwned: this server owns no display - a client (MOBILEGL_IPC_SURFACE=server) asked for a 640x480 window surface on the server's own window, and this process is an offscreen server. Start the on-screen display server, or run the 
+      1 [00:56:57] [Linux mobilegl_trace_/ERROR]: MG_Remote client: Refuse ServerOwned (NoServerDisplay) - MOBILEGL_IPC_SURFACE=server asked the server to create this 640x480 window surface on its own window, and the server owns no display: it is an offscreen server. eglCreateWindowSurface fails with EGL_BA
+      1 [00:56:56] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19702 dial=connect
+      1 [00:56:57] [Linux mobilegl_trace_/ERROR]: MG_Remote client: Refuse ServerOwned (NoServerDisplay) - MOBILEGL_IPC_SURFACE=server asked the server to create this 640x480 window surface on its own window, and the server owns no display: it is an offscreen server. eglCreateWindowSurface fails with EGL_BA
+      1 [12:57:00] [Android mgl-srv-apply/ERROR]: MG_Remote server: Refuse ServerOwned: this server owns no display - a client (MOBILEGL_IPC_SURFACE=server) asked for a 640x480 window surface on the server's own window, and this process is an offscreen server. Start the on-screen display server, or run the 
+[00:56:57] === 6: the next offscreen session on the same service
+[00:57:09] next offscreen rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [12:57:00] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+      1 [00:56:57] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19708 dial=connect
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19649 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+19708 19649 [libMobileGLServ]           [libMobileGLServ]
+09-24 12:56:59.590 19649 19649 E MobileGL: [12:56:59] [Android libMobileGLServ/ERROR]: MG_Remote server: session pid=19676 reaped exit=0 sessionsFaulted=0
+09-24 12:57:00.090 19702 19704 E MobileGL: [12:57:00] [Android mgl-srv-apply/ERROR]: MG_Remote server: Refuse ServerOwned: this server owns no display - a client (MOBILEGL_IPC_SURFACE=server) asked for a 640x480 window surface on the server's own window, and this process is an offscreen server. Star
+09-24 12:57:00.188 19649 19649 E MobileGL: [12:57:00] [Android libMobileGLServ/ERROR]: MG_Remote server: session pid=19702 reaped exit=0 sessionsFaulted=0
+09-24 12:57:00.454 19708 19710 I MobileGL: [12:57:00] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+09-24 12:57:00.577 19708 19710 I MobileGL: [12:57:00] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+09-24 12:57:12.288 19649 19649 E MobileGL: [12:57:12] [Android libMobileGLServ/ERROR]: MG_Remote server: session pid=19708 reaped exit=0 sessionsFaulted=0
+[00:57:09] done 6
diff --git a/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/next/output/result.json b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/next/output/result.json
new file mode 100644
index 00000000..e3423537
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/next/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/next/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/next/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/next/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": true,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/ps-end.txt b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/ps-end.txt
new file mode 100644
index 00000000..4d3edca6
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/ps-end.txt
@@ -0,0 +1,3 @@
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19649 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+19708 19649 [libMobileGLServ]           [libMobileGLServ]
diff --git a/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/refused/output/result.json b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/refused/output/result.json
new file mode 100644
index 00000000..80468837
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/6-negative-serverowned-vs-offscreen/refused/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": false,
+  "statusCode": 5,
+  "message": "retrace failed with status 1",
+  "tracePath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/refused/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-29b7b284/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "",
+  "actualPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/refused/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/refused/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": -1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": -1
+}
diff --git a/docs/Disaggregated/notes/p12/device/7-one-server/check.log b/docs/Disaggregated/notes/p12/device/7-one-server/check.log
new file mode 100644
index 00000000..a1e0e0e9
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/7-one-server/check.log
@@ -0,0 +1,38 @@
+[00:57:09] === 7a: a live offscreen session, then the display Activity
+[00:57:10] offscreen session live
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19649 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+19773 19649 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+[00:57:11] supervisor pid=19649 session child pid=19773
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 4060364 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:57:12] display server READY
+[00:57:13] supervisor 19649 alive? no  child 19773 alive? no
+18033  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+[00:57:13] the offscreen session's client rc=134 (its server went away)
+      1 [00:57:12] [Linux mobilegl_trace_/ERROR]: MGPipe: DEVICE LOST - the barrier woke on a peer that had hung up. The server process is gone; every verb from here is DECLINED and glGetGraphicsResetStatus reports GL_UNKNOWN_CONTEXT_RESET. This is
+09-24 12:57:14.098 19773 19782 I MobileGL: [12:57:14] [Android mgl-srv-apply/INFO]: [driver-bug] layered blit destination probe: a blit asking for destination layer 1 landed on layer 0 - THE DESTINATION LAYER IS IGNORED
+09-24 12:57:15.200 18033 18033 I MobileGLDisplay: stopped MobileGLServerService (the offscreen supervisor): one server at a time (P12 D8)
+09-24 12:57:15.204 18033 18033 I MobileGL: [12:57:15] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:57:15.204 18033 18033 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=18033, backend pinned by the first session)
+09-24 12:57:15.209 19605 19651 I MobileGLServer: supervisor output closed: the service is stopping
+09-24 12:57:15.230 18033 18033 I MobileGL: [12:57:15] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 attached at 1280x2620 (generation 1)
+09-24 12:57:15.230 18033 18033 I MobileGLDisplay: surfaceCreated: server window 1280x2620 attached
+09-24 12:57:15.230 18033 18033 I MobileGL: [12:57:15] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 is now 1280x2620
+09-24 12:57:15.230 18033 18033 I MobileGLDisplay: surfaceChanged: server window 1280x2620 attached
+09-24 12:57:15.454 18033 19848 E MobileGL: [12:57:15] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=18033 listening on tcp://127.0.0.1:40613 (in-process display server, display installed)
+[00:57:14] === 7b: the service again - :mglwin must go
+[00:57:14] :mglwin pid=18033
+[00:57:15] supervisor READY
+[00:57:16] :mglwin pid now= (was 18033); /proc/18033 exists? no
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19914 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+09-24 12:57:17.407 19605 19605 I MobileGLServer: removing the on-screen display server's task (P12 D8: one server at a time)
+09-24 12:57:17.411 19605 19605 I MobileGLServer: stopping the on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=18033 (P12 D8: one server at a time)
+09-24 12:57:17.463 19605 19605 I MobileGLServer: on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=18033 is gone
+09-24 12:57:17.534 19914 19914 E MobileGL: [12:57:17] [Android libMobileGLServ/ERROR]: MG_Remote server: pid=19914 listening on tcp://127.0.0.1:40613
+09-24 12:57:17.534 19914 19914 E MobileGL: [12:57:17] [Android libMobileGLServ/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+[00:57:16] done 7
diff --git a/docs/Disaggregated/notes/p12/device/7-one-server/ps-after-activity.txt b/docs/Disaggregated/notes/p12/device/7-one-server/ps-after-activity.txt
new file mode 100644
index 00000000..85682946
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/7-one-server/ps-after-activity.txt
@@ -0,0 +1,2 @@
+18033  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
diff --git a/docs/Disaggregated/notes/p12/device/7-one-server/ps-after-service.txt b/docs/Disaggregated/notes/p12/device/7-one-server/ps-after-service.txt
new file mode 100644
index 00000000..03ea35bf
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/7-one-server/ps-after-service.txt
@@ -0,0 +1,2 @@
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19914 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/7-one-server/ps-before.txt b/docs/Disaggregated/notes/p12/device/7-one-server/ps-before.txt
new file mode 100644
index 00000000..05d5dbd2
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/7-one-server/ps-before.txt
@@ -0,0 +1,3 @@
+19605  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+19649 19605 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+19773 19649 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/7-one-server/tds-activity.txt b/docs/Disaggregated/notes/p12/device/7-one-server/tds-activity.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/7-one-server/tds-activity.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/7-one-server/tds-service2.txt b/docs/Disaggregated/notes/p12/device/7-one-server/tds-service2.txt
new file mode 100644
index 00000000..2710e91c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/7-one-server/tds-service2.txt
@@ -0,0 +1,3 @@
+Starting service: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLServerService (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGLServer
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613
diff --git a/docs/Disaggregated/notes/p12/device/99-cleanup/final-state.txt b/docs/Disaggregated/notes/p12/device/99-cleanup/final-state.txt
new file mode 100644
index 00000000..e1a9845b
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/99-cleanup/final-state.txt
@@ -0,0 +1,6 @@
+processes : 
+forwards  : ;
+doze wl   : user,top.mobilegl.plugin.p7w1.trace,10318 
+stay_on   : 15
+focus     :  mCurrentFocus=Window{48ecc69 u0 com.miui.home/com.miui.home.launcher.Launcher}
+installed :  versionName=26.09.29b7b28-trace  lastUpdateTime=2026-09-24 12:55:19 
diff --git a/docs/Disaggregated/notes/p12/device/evidence-strip.png b/docs/Disaggregated/notes/p12/device/evidence-strip.png
new file mode 100644
index 00000000..d2caf2b6
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/evidence-strip.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/check.log b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/check.log
new file mode 100644
index 00000000..29ee6464
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/check.log
@@ -0,0 +1,115 @@
+[00:25:58] check DESKTOP-OP19A6G: stamp p12w1-984db455 backend DirectGLES case OpenRA
+[00:25:58] found: 
+40613
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+[00:26:00] READY
+[00:26:00] :mglwin pid=19108
+  mCurrentFocus=Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+[00:26:00] replay OpenRA DirectGLES --window-surface MOBILEGL_IPC_SURFACE=server
+[00:26:13] replay rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:26:01] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:26:04] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac38060 generation 1)
+      1 [12:26:04] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac38060 generation 1)
+      1 [00:26:01] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19108 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+replay ran 11.39s; 12 screencaps
+0 t=+ -0.07s..+  0.19s during=False nonblack=0.018 mean=1.4
+1 t=+  0.90s..+  1.21s during=True nonblack=0.000 mean=0.0
+2 t=+  1.91s..+  2.25s during=True nonblack=0.090 mean=5.4
+3 t=+  2.95s..+  3.27s during=True nonblack=0.090 mean=5.4
+4 t=+  3.97s..+  4.30s during=True nonblack=0.090 mean=5.4
+5 t=+  5.00s..+  5.35s during=True nonblack=0.090 mean=5.4
+6 t=+  6.05s..+  6.38s during=True nonblack=0.090 mean=5.4
+7 t=+  7.09s..+  7.41s during=True nonblack=0.090 mean=5.4
+8 t=+  8.11s..+  8.40s during=True nonblack=0.090 mean=5.4
+9 t=+  9.11s..+  9.44s during=True nonblack=0.090 mean=5.4
+10 t=+ 10.14s..+ 10.43s during=True nonblack=0.090 mean=5.4
+11 t=+ 11.13s..+ 11.80s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.91s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/DESKTOP-OP19A6G/replay/evidence-during-replay.png
+[00:26:14] :mglwin pid after: 19108
+09-24 12:26:03.573  2903  2903 I adbd    : in ShellService: am start -n top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity --es listen tcp://127.0.0.1:40613 --es token p7w1b-lan-token-20260922 --es env ''
+09-24 12:26:03.614  3149  4298 I CamOpt_Service: notifyActivityStart: intent = Intent { flg=0x10000000 xflg=0x4 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+09-24 12:26:03.619  3149  6759 D WindowManager: Collecting in transition 875: ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t-1} init visibleRequested:false dc:null
+09-24 12:26:03.624  3149  6759 D As.MonitorAppForegroundStateHelper: onTaskMovedToFront: mTopActivityPackageName: top.mobilegl.plugin.p7w1.trace mTopActivityClassName: top.mobilegl.plugin.MobileGLDisplayActivity mPreTopActivityPackageName: com.miui.home mPreTo
+09-24 12:26:03.624  3149  6759 D As.ActivityMmReduceLoadHelper: onTaskMovedToFront: mTopActivityPackageName: top.mobilegl.plugin.p7w1.trace mTopActivityClassName: top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.625  3149  6759 I WindowManager: Try to add startingWindow type = STARTING_WINDOW_TYPE_SPLASH_SCREEN this = ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} mOccludesParent = true preAl
+09-24 12:26:03.626  3149  6759 D WindowManager: Collecting in transition 875: ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} init visibleRequested:false dc:Display{#0 state=ON size=1280x2772 ROTATIO
+09-24 12:26:03.627  3149  6759 I ActivityTaskManager: START u0 {flg=0x10000000 xflg=0x4 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras)} with LAUNCH_SINGLE_TOP from uid 2000 from pid 14658 callingPackage com.android.
+09-24 12:26:03.627  3149  6759 I AppStartScenario: notifyScenarioChanged: active=true param=Bundle[{uid=10318, name=top.mobilegl.plugin.MobileGLDisplayActivity, type=2, preStartProc=false, state=1, processName=top.mobilegl.plugin.p7w1.trace, packageName=top.mo
+09-24 12:26:03.628  5038  5293 I SoScStageCoordinator: Transition requested:TransitionRequestInfo { type = OPEN, triggerTask = TaskInfo{userId=0 taskId=655 effectiveUid=10318 displayId=0 isRunning=true baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin
+09-24 12:26:03.628  3149  5465 D WindowManager:    ChangeInfo{e72dc38 container=ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} flags=0x0}
+09-24 12:26:03.631  5038  5038 D KeyguardEditorHelper: onTopActivityMayChanged, topActivity=ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}; mState=IDEL
+09-24 12:26:03.632  3149  5465 D WindowManager: Collecting in transition 875: ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} init visibleRequested:false dc:Display{#0 state=ON size=1280x2772 ROTATIO
+09-24 12:26:03.632  3149  5465 D WindowManager:    ChangeInfo{e72dc38 container=ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} flags=0x0}
+09-24 12:26:03.633  3149  5465 D WindowManager: isSyncFinished true. ar: ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.634  3149  5465 D WindowManager: isSyncFinished true. ar: ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.634  3149  5465 D WindowManager:    ChangeInfo{e72dc38 container=ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} flags=0x0}
+09-24 12:26:03.635  3149  3396 I AppStartScenario: notifyScenarioChanged: active=true param=Bundle[{hostingRecordName={top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}, hostingRecordType=next-top-activity, uid=10318, type=1, state=2,
+09-24 12:26:03.636  5038  5293 D MiuiDecorationController: relayout::taskId=655, visible=true, bounds=Rect(0, 0 - 1280, 2772), focused=false, oldImmersive=false, newImmersive=false, windowMode=1, activityType=1, displayId=0, baseActivity=ComponentInfo{top.mobi
+09-24 12:26:03.638  4384  5363 D WindowTransitionCompat:  printLeash::taskInfo = TaskInfo{userId=0 taskId=655 effectiveUid=10318 displayId=0 isRunning=true baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDispla
+09-24 12:26:03.638  4384  5956 W RecentsModel: getRunningTask   taskInfo=TaskInfo{userId=0 taskId=655 effectiveUid=10318 displayId=0 isRunning=true baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivit
+09-24 12:26:03.638  4384  5363 D TransitionUtil: get key :ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}#655
+09-24 12:26:03.639  3149  3421 I AppStartScenario: notifyScenarioChanged: active=true param=Bundle[{hostingRecordName={top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}, hostingRecordType=next-top-activity, pid=19108, uid=10318, type=
+09-24 12:26:03.639  4384  5956 E ActivityManagerWrapper:  mainTaskId=655   userId=0   windowMode=1   isExcludedFromRecents=false   baseIntent=Intent { act=null flag=268435456 cmp=ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayA
+09-24 12:26:03.640  3149  3421 I ActivityManager: Start proc 19108:top.mobilegl.plugin.p7w1.trace:mglwin/u0a318 for next-top-activity {top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity} caller=com.android.shell
+09-24 12:26:03.641  4384  5956 W RecentsModel: getRunningTask   taskInfo=TaskInfo{userId=0 taskId=655 effectiveUid=10318 displayId=0 isRunning=true baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivit
+09-24 12:26:03.642  4384  5956 E ActivityManagerWrapper:  mainTaskId=655   userId=0   windowMode=1   isExcludedFromRecents=false   baseIntent=Intent { act=null flag=268435456 cmp=ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayA
+09-24 12:26:03.642  1816  1891 I ANDR-PWR-OPT: GAMEPOWEROPT: sendEvents() 231: Start hint for app top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity/26091169, hintID : 4099, hintID hex : 1003 value: -1
+09-24 12:26:03.642  4384  5956 D RecentsTaskLoader: reloadTasksData [TaskKey{id=655, stackId=0, baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity }, userId=0, lastActiveTime=17217161, windowingMod
+09-24 12:26:03.642  1816  1891 I ANDR-PWR-OPT: GAMEPOWEROPT: sendEvents() 231: Start hint for app top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity/26091169, hintID : 4099, hintID hex : 1003 value: -1
+09-24 12:26:03.644  4384  5956 D RecentsTaskLoader: reloadTasksData [TaskKey{id=655, stackId=0, baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity }, userId=0, lastActiveTime=17217161, windowingMod
+09-24 12:26:03.654  3149  5757 I WindowManager: Allow fixed rotation for not collecting:ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.656  3149 12140 I WindowManager: Allow fixed rotation for not collecting:ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.681  5038  5038 D DynamicIslandController: onTopActivityChanged: ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.682  5038  5038 D DynamicIslandWindowViewController: onTopActivityChange: topActivity ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}, inSmallWindow false, isSupportPip false, isFocus false fullScreenPkg
+09-24 12:26:03.688  3149 12140 I AppStartScenario: notifyScenarioChanged: active=true param=Bundle[{applicationThread=android.os.BinderProxy@287c674, hostingRecordName={top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}, hostingRecordT
+09-24 12:26:03.692 26308 26355 D VA_ActivityUtils: getTopActivity packageName:ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.692 26308 26355 D VA_AppStateWatcher: currentPkgName:top.mobilegl.plugin.p7w1.trace, className:top.mobilegl.plugin.MobileGLDisplayActivity, lastPkgName:com.miui.home
+09-24 12:26:03.720  7308  7976 D MyLog   : -->log(0): [Tid:308] GamePopupListeneronForegroundAppEnter: pkg=top.mobilegl.plugin.p7w1.trace cls=top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.720  7308  7976 D MyLog   : -->log(0): [Tid:308] GamePopupJudgefindMatchedPlans: matched 0 plans for pkg=top.mobilegl.plugin.p7w1.trace, cls=top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.720  7308  7976 D MyLog   : -->log(0): [Tid:308] GamePopupListeneronForegroundAppEnter: no matching plans found, pkg=top.mobilegl.plugin.p7w1.trace, cls=top.mobilegl.plugin.MobileGLDisplayActivity, totalPlans=0
+09-24 12:26:03.726  3149  5435 I WindowManager: Allow fixed rotation for not collecting:ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.726  3149  5435 I WindowManager: Allow fixed rotation for not collecting:ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.727  5038  5293 D MiuiDecorationController: relayout::taskId=655, visible=true, bounds=Rect(0, 0 - 1280, 2772), focused=false, oldImmersive=false, newImmersive=false, windowMode=1, activityType=1, displayId=0, baseActivity=ComponentInfo{top.mobi
+09-24 12:26:03.730  3149  4297 I CameraActivitySceneMode: decideSceneMode: ActivityStateChange activityName = top.mobilegl.plugin.MobileGLDisplayActivity, displayId = 0, state = 2
+09-24 12:26:03.733  4945  5545 D NetworkMetricsController: processUidChangeEvent :activity is:ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.735  4384  5956 W RecentsModel: getRunningTask   taskInfo=TaskInfo{userId=0 taskId=655 effectiveUid=10318 displayId=0 isRunning=true baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivit
+09-24 12:26:03.736  4384  5956 E ActivityManagerWrapper:  mainTaskId=655   userId=0   windowMode=1   isExcludedFromRecents=false   baseIntent=Intent { act=null flag=268435456 cmp=ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayA
+09-24 12:26:03.737  4384  5956 D RecentsTaskLoader: reloadTasksData [TaskKey{id=655, stackId=0, baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity }, userId=0, lastActiveTime=17217262, windowingMod
+09-24 12:26:03.751 19108 19108 I MobileGL: [12:26:03] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:26:03.751 19108 19108 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=19108, backend pinned by the first session)
+09-24 12:26:03.751 19108 14698 E MobileGL: [12:26:03] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19108 listening on tcp://127.0.0.1:40613 (in-process display server, display installed)
+09-24 12:26:03.751 19108 14698 E MobileGL: [12:26:03] [Android mgl-display-ser/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+09-24 12:26:03.752 19108 19108 D Activity: Activity = ActivityInfo{68651d2 top.mobilegl.plugin.MobileGLDisplayActivity}, Resume onConfigurationChanged = {1.0 ?mcc0mnc [zh_CN] ldltr sw394dp w394dp h790dp 520dpi nrml long hdr widecg port finger -keyb/v/h -nav/h 
+09-24 12:26:03.755 19108 14696 I ContentCatcher: SettingTrigger : register screen QA status observer top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.756 19108 14696 I ContentCatcher: SettingTrigger : register global collect status observer top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.757 19108 14696 I ContentCatcher: SettingTrigger : registerUIAgentListener top.mobilegl.plugin.MobileGLDisplayActivity, uid:10318
+09-24 12:26:03.761 19108 19108 I ViewRootImpl: top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity use first frame acceleration
+09-24 12:26:03.762 19108 19108 D InsetsController: top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity hide: statusBars navigationBars captionBar android.view.InsetsController@f698c64 android.view.InsetsController.applyAnimation:2241 and
+09-24 12:26:03.766  4384  4384 D RecentsImpl: mActivityStateObserver top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.766  7264  7339 I ActivityObserverUtil: activityResumed ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.766  4384  4384 W RecentsImpl: updateGestureWindowVisibleImpl, className=top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.766 26308 14168 I VA_ActivityStateHelper: activityResumed componentName ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.766  7264  7339 I TopActivityMonitor: send TopActivityChangeEvent=TopActivityChangeEvent(prev=ComponentInfo{com.miui.home/com.miui.home.launcher.Launcher}, current=ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayA
+09-24 12:26:03.766  7264 19875 I travelService_ActivityObserverUtils: activityResumed ComponentInfo{top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.766 19108 19108 D DecorViewImmersiveImpl: getWindowType: 1 title:top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity
+09-24 12:26:03.767  3149  6759 D CoreBackPreview: Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}: Setting back callback OnBackInvokedCallbackInfo{mCallback=android.window.IOnBackInvokedCallback$Stub$Proxy@67e5504,
+09-24 12:26:03.769  3149  5757 I AppCompatLetterboxPolicy: updateLetterboxSurfaceIfNeeded applySurfaceChanges Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.769  3149  5757 I Letterbox: applySurfaceChanges Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity} remove letterbox  com.android.server.wm.Letterbox@7b933b3
+09-24 12:26:03.769  3149  5757 I LetterboxSurface: applySurfaceChanges created ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} top Surface(name=Letterbox - top#17195)/@0x70dbd70 false com.android.ser
+09-24 12:26:03.769  3149  5757 D BarFollowAnimation: current status bar control target is : Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.770  3149  5757 D WindowManager: updateSystemBarAttributes displayId: 0 Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity} winAppearance=
+09-24 12:26:03.770  3149  5757 D WindowManager: wms.Input focus has changed to Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity} display=0 updateInputWindows = true
+09-24 12:26:03.770  5038  5293 D MiuiDecorationController: relayout::taskId=655, visible=true, bounds=Rect(0, 0 - 1280, 2772), focused=true, oldImmersive=false, newImmersive=true, windowMode=1, activityType=1, displayId=0, baseActivity=ComponentInfo{top.mobile
+09-24 12:26:03.770  3149  5757 I WindowManager: Allow fixed rotation for not collecting:ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+09-24 12:26:03.770  5038  5293 D MiuiFreeformModeController: onFocusTaskChanged taskInfo: TaskInfo{userId=0 taskId=655 effectiveUid=10318 displayId=0 isRunning=true baseIntent=Intent { flg=0x10000000 cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.Mobil
+09-24 12:26:03.774  3149 12140 I AppCompatLetterboxPolicy: updateLetterboxSurfaceIfNeeded applySurfaceChanges Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+09-24 12:26:03.774  3149 12140 I Letterbox: applySurfaceChanges Window{d31f83b u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity} remove letterbox  com.android.server.wm.Letterbox@7b933b3
+09-24 12:26:03.774  3149 12140 I LetterboxSurface: applySurfaceChanges created ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655} top Surface(name=Letterbox - top#17195)/@0x70dbd70 false com.android.ser
+09-24 12:26:03.774  3149 12140 I WindowManager: Allow fixed rotation for not collecting:ActivityRecord{208930475 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t655}
+[00:26:14] done DESKTOP-OP19A6G
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/output/result.json b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/output/result.json
new file mode 100644
index 00000000..1c82b6e1
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/replay/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/DESKTOP-OP19A6G/replay/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/DESKTOP-OP19A6G/replay/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/DESKTOP-OP19A6G/replay/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/tds-start.txt b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/tds-start.txt
new file mode 100644
index 00000000..e0a0574e
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-984db455/1-onscreen-espryt/tds-start.txt
@@ -0,0 +1,4 @@
+40613
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/check.log b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/check.log
new file mode 100644
index 00000000..2e211c2f
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/check.log
@@ -0,0 +1,42 @@
+[00:27:22] :mglwin pid now=19108 (check 1's session ran in pid=19108)
+[00:27:22] === session 2 in the same process: OpenRA on-screen
+[00:27:34] second session rc=6
+rc=6
+result.json: {'passed': False, 'statusCode': 6, 'ssim': 3.6422e-05, 'message': 'retrace completed; ssim=0.000036, ssimThreshold=0.990000, mismatchPixels=295296, matchedGoldenPath=/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:27:22] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:27:25] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac38060 generation 1)
+      1 [12:27:25] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac38060 generation 1)
+      1 [00:27:22] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19108 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+10 t=+ 10.67s..+ 11.02s during=True nonblack=0.000 mean=0.0
+BEST during-replay screencap: 01.png at +1.33s nonblack=0.000 mean=0.0 -> /home/swung/w7/logs/p12/device/3-sequential-and-busy/second/evidence-during-replay.png
+[00:27:34] Welcome server pids seen by the two clients (check 1, this one):
+      2 control=tcp data=stream server=127.0.0.1:40613 pid=19108
+[00:27:34] === Busy: a long on-screen session (minecraft-1.21.4-startup), then a second authenticated client
+[00:27:35] long session is on screen
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3958019 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:27:37] WARNING: the long session already ended
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3958047 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:27:37] concurrent client rc=134
+[00:27:37] long session rc=134
+rc=134
+result.json: missing
+      1 [12:27:38] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac38060 generation 1)
+      1 [12:27:38] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac38060 generation 1)
+      1 [00:27:35] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [00:27:34] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [00:27:34] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19108 dial=connect
+[00:27:37] :mglwin pid after: 
+09-24 12:27:25.562 19108 14698 E MobileGL: [12:27:25] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #2 started on a thread (pid=19108)
+09-24 12:27:25.721 19108 19108 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:27:25.724 19108 14970 I MobileGL: [12:27:25] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac38060 generation 1)
+09-24 12:27:25.791 19108 19108 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:27:25.797 19108 14970 I MobileGL: [12:27:25] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac38060 generation 1)
+09-24 12:27:37.094 19108 14698 E MobileGL: [12:27:37] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #2 pid=19108 reaped exit=0 sessionsFaulted=0
+09-24 12:27:37.844 19108 14698 E MobileGL: [12:27:37] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #3 started on a thread (pid=19108)
+09-24 12:27:37.980 19108 19108 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:27:37.991 19108 19108 I MobileGLDisplay: surfaceChanged: server window 854x480 attached
+09-24 12:27:38.003 19108 15040 I MobileGL: [12:27:38] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac38060 generation 1)
+09-24 12:27:38.068 19108 19108 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:27:38.076 19108 15040 I MobileGL: [12:27:38] [Android mgl-srv-geometr/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac38060 generation 1)
+[00:27:37] done 3
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/evidence-during-replay-540p.png
new file mode 100644
index 00000000..be59fdb6
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/evidence-during-replay.png
new file mode 100644
index 00000000..657016cc
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/output/result.json b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/output/result.json
new file mode 100644
index 00000000..9ebe9058
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-984db455/3-sequential-and-busy/second/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": false,
+  "statusCode": 6,
+  "message": "retrace completed; ssim=0.000036, ssimThreshold=0.990000, mismatchPixels=295296, matchedGoldenPath=/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-984db455/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 0.000036422,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 295296
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/check.log
new file mode 100644
index 00000000..995f9725
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/check.log
@@ -0,0 +1,94 @@
+[00:44:44] check 1-onscreen-espryt: stamp p12w1-a4a940db backend DirectGLES case OpenRA
+[00:44:44] found: 
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+[00:44:46] READY
+[00:44:46] :mglwin pid=19603
+  mCurrentFocus=Window{5e9116f u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{218119468 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t657}
+[00:44:46] replay OpenRA DirectGLES --window-surface MOBILEGL_IPC_SURFACE=server
+[00:44:59] replay rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:44:47] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:44:50] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+      1 [12:44:50] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+      1 [00:44:46] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19603 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+replay ran 11.63s; 12 screencaps
+0 t=+ -0.07s..+  0.20s during=False nonblack=0.019 mean=1.7
+1 t=+  0.90s..+  1.18s during=True nonblack=0.000 mean=0.0
+2 t=+  1.88s..+  2.23s during=True nonblack=0.090 mean=5.4
+3 t=+  2.93s..+  3.24s during=True nonblack=0.090 mean=5.4
+4 t=+  3.94s..+  4.30s during=True nonblack=0.090 mean=5.4
+5 t=+  5.01s..+  5.32s during=True nonblack=0.090 mean=5.4
+6 t=+  6.02s..+  6.39s during=True nonblack=0.090 mean=5.4
+7 t=+  7.09s..+  7.42s during=True nonblack=0.090 mean=5.4
+8 t=+  8.13s..+  8.45s during=True nonblack=0.090 mean=5.4
+9 t=+  9.16s..+  9.53s during=True nonblack=0.090 mean=5.4
+10 t=+ 10.23s..+ 10.59s during=True nonblack=0.090 mean=5.4
+11 t=+ 11.29s..+ 11.99s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.88s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/evidence-during-replay.png
+[00:44:59] :mglwin pid after: 19603
+09-24 12:44:49.490 19603 19603 I MobileGL: [12:44:49] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:44:49.491 19603 19603 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=19603, backend pinned by the first session)
+09-24 12:44:49.491 19603 16847 E MobileGL: [12:44:49] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 listening on tcp://127.0.0.1:40613 (in-process display server, display installed)
+09-24 12:44:49.491 19603 16847 E MobileGL: [12:44:49] [Android mgl-display-ser/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+09-24 12:44:49.519 19603 19603 I MobileGL: [12:44:49] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 attached at 1280x2620 (generation 1)
+09-24 12:44:49.519 19603 19603 I MobileGLDisplay: surfaceCreated: server window 1280x2620 attached
+09-24 12:44:49.519 19603 19603 I MobileGL: [12:44:49] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 is now 1280x2620
+09-24 12:44:49.519 19603 19603 I MobileGLDisplay: surfaceChanged: server window 1280x2620 attached
+09-24 12:44:49.749 19603 16847 E MobileGL: [12:44:49] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #1 started on a thread (pid=19603)
+09-24 12:44:49.750 19603 16867 I MobileGL: [12:44:49] [Android mgl-display-ser/INFO]: Config: Active backend type set to DirectGLES
+09-24 12:44:49.750 19603 16867 E MobileGL: [12:44:49] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 in-process display server pinned backend type 0 for the process lifetime (the first session's; MOBILEGL_BACKEND_TYPE unset)
+09-24 12:44:49.751 19603 16867 I MobileGL: [12:44:49] [Android mgl-display-ser/INFO]: Loaded GL backend library: libEGL.so
+09-24 12:44:49.751 19603 16867 F MobileGL: [12:44:49] [Android mgl-display-ser/FATAL]: Failed to load EGL function: eglSwapBuffersWithDamageEXT
+09-24 12:44:49.757 19603 16867 E MobileGL: [12:44:49] [Android mgl-display-ser/ERROR]: Failed to load GLES function: glShaderStorageBlockBinding
+09-24 12:44:49.773 19603 16867 I MobileGL: [12:44:49] [Android mgl-display-ser/INFO]: MG_Remote memory[accept/server]: peakRss=249241600 currentRss=249241600 roleMapped=58990592 allRolesMapped=58990592 (peakRss is the PROCESS's; under inproc both roles share it)
+09-24 12:44:49.774 19603 16867 E MobileGL: [12:44:49] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 transport=spawn role=server ready control=tcp data=stream
+09-24 12:44:49.776 19603 16870 I MobileGL: [12:44:49] [Android mgl-srv-apply/INFO]: MG_Remote server: mgl-srv-apply started. MOBILEGL_IPC_SERVER_AFFINITY='auto' requested mask 0xc0, RESOLVED mask 0xc0 (0 = no affinity applied), spin 50 us
+09-24 12:44:50.094 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]: MG_Remote server: display geometry 640x480 requested (SurfaceHolder.setFixedSize)
+09-24 12:44:50.094 19603 19603 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:44:50.096 19603 19603 I MobileGL: [12:44:50] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 is now 640x480
+09-24 12:44:50.096 19603 19603 I MobileGLDisplay: surfaceChanged: server window 640x480 attached
+09-24 12:44:50.111 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]: GL_VENDOR: Qualcomm
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]: GL_RENDERER: Adreno (TM) 830
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]: Detected 125 OpenGL ES extensions:
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_EGL_image
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_EGL_image_external
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_EGL_sync
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_vertex_half_float
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_framebuffer_object
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_rgb8_rgba8
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_compressed_ETC1_RGB8_texture
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_AMD_compressed_ATC_texture
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_KHR_texture_compression_astc_sliced_3d
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_KHR_texture_compression_astc_ldr
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_KHR_texture_compression_astc_hdr
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_compression_astc
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_s3tc
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_s3tc_srgb
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_rgtc
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_compression_bptc
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_npot
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_filter_anisotropic
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_format_BGRA8888
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_read_format_bgra
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_3D
+09-24 12:44:50.140 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_color_buffer_float
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_color_buffer_half_float
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_float_blend
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_QCOM_alpha_test
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_depth24
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_packed_depth_stencil
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_depth_texture
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_depth_texture_cube_map
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_sRGB
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_float
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_float_linear
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_half_float
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_OES_texture_half_float_linear
+09-24 12:44:50.141 19603 16870 I MobileGL: [12:44:50] [Android mgl-srv-apply/INFO]:     GL_EXT_texture_type_2_10_10_10_REV
+[00:45:00] done 1-onscreen-espryt
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/output/result.json
new file mode 100644
index 00000000..a4654d4f
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/replay/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/1-onscreen-espryt/replay/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/tds-start.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/tds-start.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/1-onscreen-espryt/tds-start.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/check.log
new file mode 100644
index 00000000..2b5f9396
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/check.log
@@ -0,0 +1,94 @@
+[00:48:54] check 2-onscreen-magma: stamp p12w1-a4a940db backend DirectVulkan case OpenRA
+[00:48:55] found: 19603  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin;
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+[00:48:56] READY
+[00:48:56] :mglwin pid=20413
+  mCurrentFocus=Window{c7b1000 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{3013292 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t658}
+[00:48:57] replay OpenRA DirectVulkan --window-surface MOBILEGL_IPC_SURFACE=server
+[00:49:09] replay rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:48:57] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:49:00] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac393b0 generation 1)
+      1 [12:49:00] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac393b0 generation 1)
+      1 [00:48:57] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=20413 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+replay ran 11.60s; 12 screencaps
+0 t=+ -0.07s..+  0.19s during=False nonblack=0.018 mean=1.6
+1 t=+  0.89s..+  1.20s during=True nonblack=0.000 mean=0.0
+2 t=+  1.90s..+  2.22s during=True nonblack=0.090 mean=5.4
+3 t=+  2.92s..+  3.23s during=True nonblack=0.090 mean=5.4
+4 t=+  3.93s..+  4.24s during=True nonblack=0.090 mean=5.4
+5 t=+  4.94s..+  5.27s during=True nonblack=0.090 mean=5.4
+6 t=+  5.98s..+  6.29s during=True nonblack=0.090 mean=5.4
+7 t=+  7.00s..+  7.34s during=True nonblack=0.090 mean=5.4
+8 t=+  8.04s..+  8.36s during=True nonblack=0.090 mean=5.4
+9 t=+  9.06s..+  9.40s during=True nonblack=0.090 mean=5.4
+10 t=+ 10.10s..+ 10.43s during=True nonblack=0.090 mean=5.4
+11 t=+ 11.14s..+ 11.84s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.90s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/2-onscreen-magma/replay/evidence-during-replay.png
+[00:49:10] :mglwin pid after: 20413
+09-24 12:48:59.883 20413 20413 I MobileGL: [12:48:59] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:48:59.884 20413 20413 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=20413, backend DirectVulkan)
+09-24 12:48:59.884 20413 17575 E MobileGL: [12:48:59] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=20413 listening on tcp://127.0.0.1:40613 (in-process display server, display installed)
+09-24 12:48:59.884 20413 17575 E MobileGL: [12:48:59] [Android mgl-display-ser/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+09-24 12:48:59.912 20413 20413 I MobileGL: [12:48:59] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac393b0 attached at 1280x2620 (generation 1)
+09-24 12:48:59.912 20413 20413 I MobileGLDisplay: surfaceCreated: server window 1280x2620 attached
+09-24 12:48:59.912 20413 20413 I MobileGL: [12:48:59] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac393b0 is now 1280x2620
+09-24 12:48:59.912 20413 20413 I MobileGLDisplay: surfaceChanged: server window 1280x2620 attached
+09-24 12:49:00.176 20413 17575 E MobileGL: [12:49:00] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #1 started on a thread (pid=20413)
+09-24 12:49:00.176 20413 17597 I MobileGL: [12:49:00] [Android mgl-display-ser/INFO]: Config: Active backend type set to DirectVulkan
+09-24 12:49:00.176 20413 17597 E MobileGL: [12:49:00] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=20413 in-process display server pinned backend type 1 for the process lifetime (the first session's; MOBILEGL_BACKEND_TYPE unset)
+09-24 12:49:00.191 20413 17597 I MobileGL: [12:49:00] [Android mgl-display-ser/INFO]: MG_Remote memory[accept/server]: peakRss=247119872 currentRss=247119872 roleMapped=58990592 allRolesMapped=58990592 (peakRss is the PROCESS's; under inproc both roles share it)
+09-24 12:49:00.191 20413 17597 E MobileGL: [12:49:00] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=20413 transport=spawn role=server ready control=tcp data=stream
+09-24 12:49:00.194 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: MG_Remote server: mgl-srv-apply started. MOBILEGL_IPC_SERVER_AFFINITY='auto' requested mask 0xc0, RESOLVED mask 0xc0 (0 = no affinity applied), spin 50 us
+09-24 12:49:00.369 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: MG_Remote server: display geometry 640x480 requested (SurfaceHolder.setFixedSize)
+09-24 12:49:00.369 20413 20413 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:49:00.374 20413 20413 I MobileGL: [12:49:00] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac393b0 is now 640x480
+09-24 12:49:00.374 20413 20413 I MobileGLDisplay: surfaceChanged: server window 640x480 attached
+09-24 12:49:00.374 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac393b0 generation 1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: Got 14 Vulkan instance extensions: 
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_surface (r.25)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_surface_protected_capabilities (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_android_surface (r.6)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_swapchain_colorspace (r.5)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_get_surface_capabilities2 (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_GOOGLE_surfaceless_query (r.2)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_surface_maintenance1 (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_debug_report (r.10)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_get_physical_device_properties2 (r.2)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_external_semaphore_capabilities (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_external_memory_capabilities (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_device_group_creation (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_debug_utils (r.2)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_external_fence_capabilities (r.1)
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: Validation layers not available.
+09-24 12:49:00.430 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: Validation layers not requested.
+09-24 12:49:00.431 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: Enabling 2 Vulkan instance extensions:
+09-24 12:49:00.431 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_surface
+09-24 12:49:00.431 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_android_surface
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: Found 1 physical device(s).
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     Adreno (TM) 830 (Vulkan 1.3.284, INTEGRATED_GPU)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]: Got 165 Vulkan device extensions: 
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_incremental_present (r.2)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_hdr_metadata (r.3)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_shared_presentable_image (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_GOOGLE_display_timing (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_image_compression_control (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_image_compression_control_swapchain (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_swapchain_maintenance1 (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_swapchain_mutable_format (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_depth_range_unrestricted (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_subgroup_size_control (r.2)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_ray_tracing_maintenance1 (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_external_memory (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_pipeline_creation_feedback (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_shader_float16_int8 (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_EXT_multisampled_render_to_single_sampled (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_get_memory_requirements2 (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_copy_commands2 (r.1)
+09-24 12:49:00.438 20413 17599 I MobileGL: [12:49:00] [Android mgl-srv-apply/INFO]:     VK_KHR_deferred_host_operations (r.4)
+[00:49:10] done 2-onscreen-magma
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/output/result.json
new file mode 100644
index 00000000..c8271bae
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/replay/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/replay/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/replay/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/2-onscreen-magma/replay/output/OpenRA-diff.png",
+  "backend": "DirectVulkan",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/tds-start.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/tds-start.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/2-onscreen-magma/tds-start.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/check.log
new file mode 100644
index 00000000..a7d5ba34
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/check.log
@@ -0,0 +1,43 @@
+[00:45:04] :mglwin pid now=19603 (check 1's session ran in pid=19603)
+[00:45:04] === session 2 in the same process: OpenRA on-screen
+[00:45:16] second session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:45:04] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:45:07] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+      1 [12:45:07] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+      1 [00:45:04] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19603 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+9 t=+ 10.74s..+ 11.42s during=True nonblack=0.167 mean=14.0
+BEST during-replay screencap: 01.png at +1.29s nonblack=0.340 mean=32.4 -> /home/swung/w7/logs/p12/device/3-sequential-and-busy/second/evidence-during-replay.png
+[00:45:17] Welcome server pids seen by the two clients (check 1, this one):
+      2 control=tcp data=stream server=127.0.0.1:40613 pid=19603
+[00:45:17] === Busy: a long on-screen session (minecraft-1.21.4-startup), then a second authenticated client
+[00:45:17] long session is on screen
+[00:45:19] long session still live - starting the second client
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3968856 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:45:20] concurrent client rc=134
+      1 [00:45:19] [Linux mobilegl_trace_/ERROR]: MGPipe: peer Refuse{Busy} one session is already active expected=0 actual=0
+[00:45:25] long session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 0.999999511, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=520, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png'}
+      2 [00:45:17] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [12:45:20] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+      1 [12:45:20] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+      1 [00:45:17] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19603 dial=connect
+[00:45:25] :mglwin pid after: 19603
+09-24 12:45:07.513 19603 16847 E MobileGL: [12:45:07] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #2 started on a thread (pid=19603)
+09-24 12:45:07.676 19603 19603 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:45:07.679 19603 16987 I MobileGL: [12:45:07] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+09-24 12:45:07.746 19603 19603 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:45:07.751 19603 16987 I MobileGL: [12:45:07] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+09-24 12:45:19.303 19603 16847 E MobileGL: [12:45:19] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #2 pid=19603 reaped exit=0 sessionsFaulted=0
+09-24 12:45:20.281 19603 16847 E MobileGL: [12:45:20] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #3 started on a thread (pid=19603)
+09-24 12:45:20.472 19603 19603 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:45:20.493 19603 19603 I MobileGLDisplay: surfaceChanged: server window 854x480 attached
+09-24 12:45:20.507 19603 17056 I MobileGL: [12:45:20] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+09-24 12:45:20.569 19603 19603 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:45:20.579 19603 17056 I MobileGL: [12:45:20] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 6, window 0xb40000789ac37380 generation 1)
+09-24 12:45:23.062 19603 16847 E MobileGL: [12:45:23] [Android mgl-display-ser/ERROR]: MG_Remote server: Refuse{Busy} one session is already active
+09-24 12:45:28.565 19603 16847 E MobileGL: [12:45:28] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #3 pid=19603 reaped exit=0 sessionsFaulted=0
+[00:45:25] done 3
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/long/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/long/output/result.json
new file mode 100644
index 00000000..a668fb92
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/long/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=520, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/long/input/trace.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/minecraft-1.21.4-startup.0000092195.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/long/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/long/output/minecraft-1.21.4-startup-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 92195,
+  "width": 854,
+  "height": 480,
+  "cropX": 0,
+  "cropY": 0,
+  "cropWidth": 0,
+  "cropHeight": 0,
+  "ssim": 0.999999511,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 520
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/evidence-during-replay-540p.png
new file mode 100644
index 00000000..8bc10cec
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/evidence-during-replay.png
new file mode 100644
index 00000000..ac8f9661
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/output/result.json
new file mode 100644
index 00000000..aefa37fa
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/3-sequential-and-busy/second/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/3-sequential-and-busy/second/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/evidence-during-replay-540p.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/evidence-during-replay-540p.png
new file mode 100644
index 00000000..b1978b10
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/evidence-during-replay-540p.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/evidence-during-replay.png b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/evidence-during-replay.png
new file mode 100644
index 00000000..d857e277
Binary files /dev/null and b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/evidence-during-replay.png differ
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/output/result.json
new file mode 100644
index 00000000..1304ec7e
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/after/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/4-window-lost/after/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/4-window-lost/after/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/4-window-lost/after/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/check.log
new file mode 100644
index 00000000..8a38c173
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/check.log
@@ -0,0 +1,62 @@
+[00:45:33] :mglwin pid before=19603
+[00:45:34] session is on screen
+[00:45:37] session live - pressing HOME
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3968995 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:45:39] client rc=134 after HOME (0.84 s after the key)
+rc=134
+result.json: missing
+      1 [12:45:41] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session ends so the client reads a clean device loss. 
+      1 [12:45:41] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the next connection (PH-1, ID-P7-1)
+      1 [12:45:41] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+      1 [12:45:37] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+      1 [00:45:34] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 854x480 owner=server (MOBILEGL_IPC_SURFACE=server, 854x480 requested)
+      1 [00:45:33] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19603 dial=connect
+      1 [00:45:38] [Linux mobilegl_trace_/ERROR]: MGPipe: DEVICE LOST - the barrier woke on a peer that had hung up. The server process is gone; every verb from here is DECLINED and glGetGraphicsResetStatus reports GL_UNKNOWN_CONTEXT_RESET. This is latched from the pe
+      1 [12:45:41] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+      1 [12:45:41] [Android mgl-srv-apply/ERROR]: MG_Remote server: mgl-srv-apply leaves its loop - the session latched a named fault and declines the rest of the ring (PH-1)
+      1 [12:45:41] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the next
+      1 [12:45:41] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session ends s
+[00:45:42] :mglwin pid after HOME=19603 (before=19603): SURVIVED
+09-24 12:45:36.970 19603 16847 E MobileGL: [12:45:36] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 started on a thread (pid=19603)
+09-24 12:45:41.448 19603 17131 F MobileGL: [12:45:41] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session end
+09-24 12:45:41.448 19603 17131 E MobileGL: [12:45:41] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the n
+09-24 12:45:41.448 19603 17131 E MobileGL: [12:45:41] [Android mgl-srv-apply/ERROR]: MG_Remote server: mgl-srv-apply leaves its loop - the session latched a named fault and declines the rest of the ring (PH-1)
+09-24 12:45:41.448 19603 19603 I MobileGL: [12:45:41] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 detached (ReleasedBySession)
+09-24 12:45:41.448 19603 19603 I MobileGLDisplay: surfaceDestroyed: server window detached (ReleasedBySession) in 10 ms
+09-24 12:45:41.475 19603 17124 E MobileGL: [12:45:41] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+09-24 12:45:41.535 19603 16847 E MobileGL: [12:45:41] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 pid=19603 reaped exit=75 (latched fault) sessionsFaulted=1
+[00:45:42] === bring the Activity back, then a new on-screen session
+[00:45:42] window re-attached
+  mCurrentFocus=Window{5e9116f u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity}
+  mFocusedApp=ActivityRecord{218119468 u0 top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity t657}
+[00:45:55] after-return session rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [00:45:43] [Linux mobilegl_trace_/INFO]: MG_Remote client: surface=window 640x480 owner=server (MOBILEGL_IPC_SURFACE=server, 640x480 requested)
+      1 [12:45:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac34ce0 generation 3)
+      1 [12:45:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac34ce0 generation 3)
+      1 [00:45:42] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=19603 dial=connect
+<stdin>:15: DeprecationWarning: Image.Image.getdata is deprecated and will be removed in Pillow 14 (2027-10-15). Use get_flattened_data instead.
+11 t=+ 11.23s..+ 11.93s during=False nonblack=0.340 mean=32.4
+BEST during-replay screencap: 02.png at +1.96s nonblack=0.090 mean=5.4 -> /home/swung/w7/logs/p12/device/4-window-lost/after/evidence-during-replay.png
+[00:45:56] :mglwin pid at the end=19603
+09-24 12:45:36.970 19603 16847 E MobileGL: [12:45:36] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 started on a thread (pid=19603)
+09-24 12:45:37.201 19603 19603 I MobileGLDisplay: geometry request 854x480 (setFixedSize, aspect-fit)
+09-24 12:45:37.204 19603 17131 I MobileGL: [12:45:37] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 854x480 owner=server (ServerOwned seq 2, window 0xb40000789ac37380 generation 1)
+09-24 12:45:41.448 19603 17131 F MobileGL: [12:45:41] [Android mgl-srv-apply/FATAL]: MGPipe: Fatal{ServerWindowLost, "surfaceDestroyed"} - the server's own display window was destroyed under this on-screen session; its surface was released on mgl-srv-apply before the window went, and the session end
+09-24 12:45:41.448 19603 17131 E MobileGL: [12:45:41] [Android mgl-srv-apply/ERROR]: MG_Remote server: SessionLatch{ServerWindowLost} - the first named fault of this session is latched; every further record and control op is declined and the session closes (exit 75) for the supervisor to serve the n
+09-24 12:45:41.448 19603 19603 I MobileGL: [12:45:41] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac37380 detached (ReleasedBySession)
+09-24 12:45:41.448 19603 19603 I MobileGLDisplay: surfaceDestroyed: server window detached (ReleasedBySession) in 10 ms
+09-24 12:45:41.475 19603 17124 E MobileGL: [12:45:41] [Android mgl-display-ser/ERROR]: MG_Remote server: pid=19603 session closed on a latched fault (ServerWindowLost; 1 named fault(s) latched or declined); exiting 75 for the supervisor to reap - PH-1
+09-24 12:45:41.535 19603 16847 E MobileGL: [12:45:41] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #4 pid=19603 reaped exit=75 (latched fault) sessionsFaulted=1
+09-24 12:45:45.689 19603 19603 I MobileGL: [12:45:45] [Android w1.trace:mglwin/INFO]: MG_Remote server: server window 0xb40000789ac34ce0 attached at 854x480 (generation 3)
+09-24 12:45:45.689 19603 19603 I MobileGLDisplay: surfaceCreated: server window 854x480 attached
+09-24 12:45:45.689 19603 19603 I MobileGLDisplay: surfaceChanged: server window 854x480 attached
+09-24 12:45:45.935 19603 16847 E MobileGL: [12:45:45] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #5 started on a thread (pid=19603)
+09-24 12:45:46.135 19603 19603 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:45:46.139 19603 19603 I MobileGLDisplay: surfaceChanged: server window 640x480 attached
+09-24 12:45:46.143 19603 17251 I MobileGL: [12:45:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 2, window 0xb40000789ac34ce0 generation 3)
+09-24 12:45:46.215 19603 19603 I MobileGLDisplay: geometry request 640x480 (setFixedSize, aspect-fit)
+09-24 12:45:46.222 19603 17251 I MobileGL: [12:45:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=window 640x480 owner=server (ServerOwned seq 6, window 0xb40000789ac34ce0 generation 3)
+09-24 12:45:57.710 19603 16847 E MobileGL: [12:45:57] [Android mgl-display-ser/ERROR]: MG_Remote server: in-process session #5 pid=19603 reaped exit=0 sessionsFaulted=1
+[00:45:56] done 4
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/tds-restart.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/tds-restart.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/4-window-lost/tds-restart.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/check.log
new file mode 100644
index 00000000..953c3014
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/check.log
@@ -0,0 +1,21 @@
+[00:49:27] before: :mglwin pid=20413
+20413  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin
+Starting service: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLServerService (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGLServer
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613
+[00:49:28] supervisor READY
+[00:49:29] after: :mglwin pid= (was 20413)
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+17770 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+09-24 12:49:31.147 17726 17726 I MobileGLServer: removing the on-screen display server's task (P12 D8: one server at a time)
+09-24 12:49:31.153 17726 17726 I MobileGLServer: stopping the on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=20413 (P12 D8: one server at a time)
+09-24 12:49:31.204 17726 17726 I MobileGLServer: on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=20413 is gone
+09-24 12:49:31.281 17770 17770 E MobileGL: [12:49:31] [Android libMobileGLServ/ERROR]: MG_Remote server: pid=17770 listening on tcp://127.0.0.1:40613
+09-24 12:49:31.281 17770 17770 E MobileGL: [12:49:31] [Android libMobileGLServ/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+[00:49:30] === 5: offscreen replay, no knob
+[00:49:42] offscreen rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [12:49:33] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+      1 [00:49:30] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=17806 dial=connect
+[00:49:42] done 5
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/offscreen/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/offscreen/output/result.json
new file mode 100644
index 00000000..4741d336
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/offscreen/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/5-offscreen-service/offscreen/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/5-offscreen-service/offscreen/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/5-offscreen-service/offscreen/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": true,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/ps-after-start.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/ps-after-start.txt
new file mode 100644
index 00000000..debddf43
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/ps-after-start.txt
@@ -0,0 +1,2 @@
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+17770 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/tds-start.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/tds-start.txt
new file mode 100644
index 00000000..2710e91c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/5-offscreen-service/tds-start.txt
@@ -0,0 +1,3 @@
+Starting service: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLServerService (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGLServer
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/check.log
new file mode 100644
index 00000000..b8272039
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/check.log
@@ -0,0 +1,24 @@
+[00:49:42] === 6: MOBILEGL_IPC_SURFACE=server --window-surface against the offscreen service
+[00:49:42] refused client rc=5
+rc=5
+result.json: {'passed': False, 'statusCode': 5, 'ssim': -1.0, 'message': 'retrace failed with status 1', 'matchedGoldenPath': ''}
+      1 [12:49:45] [Android mgl-srv-apply/ERROR]: MG_Remote server: Refuse ServerOwned: this server owns no display - a client (MOBILEGL_IPC_SURFACE=server) asked for a 640x480 window surface on the server's own window, and this process is an offscreen server. Start the on-screen display server, or run the 
+      1 [00:49:42] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=17833 dial=connect
+      1 [00:49:42] [Linux mobilegl_trace_/ERROR]: MG_Remote client: Refuse ServerOwned (NoServerDisplay) - MOBILEGL_IPC_SURFACE=server asked the server to create this 640x480 window surface on its own window, and the server owns no display: it is an offscreen server. eglCreateWindowSurface fails with EGL_BA
+      1 [00:49:42] [Linux mobilegl_trace_/ERROR]: MG_Remote client: Refuse ServerOwned (NoServerDisplay) - MOBILEGL_IPC_SURFACE=server asked the server to create this 640x480 window surface on its own window, and the server owns no display: it is an offscreen server. eglCreateWindowSurface fails with EGL_BA
+      1 [12:49:45] [Android mgl-srv-apply/ERROR]: MG_Remote server: Refuse ServerOwned: this server owns no display - a client (MOBILEGL_IPC_SURFACE=server) asked for a 640x480 window surface on the server's own window, and this process is an offscreen server. Start the on-screen display server, or run the 
+[00:49:42] === 6: the next offscreen session on the same service
+[00:49:55] next offscreen rc=0
+rc=0
+result.json: {'passed': True, 'statusCode': 0, 'ssim': 1.0, 'message': 'retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png', 'matchedGoldenPath': '/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png'}
+      2 [12:49:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+      1 [00:49:43] [Linux mobilegl_trace_/INFO]: MG_Remote client: control=tcp data=stream server=127.0.0.1:40613 pid=17836 dial=connect
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+17770 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+09-24 12:49:45.570 17770 17770 E MobileGL: [12:49:45] [Android libMobileGLServ/ERROR]: MG_Remote server: session pid=17806 reaped exit=0 sessionsFaulted=0
+09-24 12:49:45.919 17833 17835 E MobileGL: [12:49:45] [Android mgl-srv-apply/ERROR]: MG_Remote server: Refuse ServerOwned: this server owns no display - a client (MOBILEGL_IPC_SURFACE=server) asked for a 640x480 window surface on the server's own window, and this process is an offscreen server. Star
+09-24 12:49:46.027 17770 17770 E MobileGL: [12:49:46] [Android libMobileGLServ/ERROR]: MG_Remote server: session pid=17833 reaped exit=0 sessionsFaulted=0
+09-24 12:49:46.358 17836 17838 I MobileGL: [12:49:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+09-24 12:49:46.425 17836 17838 I MobileGL: [12:49:46] [Android mgl-srv-apply/INFO]: MG_Remote server: surface=pbuffer 640x480
+09-24 12:49:58.441 17770 17770 E MobileGL: [12:49:58] [Android libMobileGLServ/ERROR]: MG_Remote server: session pid=17836 reaped exit=0 sessionsFaulted=0
+[00:49:55] done 6
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/next/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/next/output/result.json
new file mode 100644
index 00000000..3550fa33
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/next/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": true,
+  "statusCode": 0,
+  "message": "retrace completed; ssim=1.000000, ssimThreshold=0.990000, mismatchPixels=0, matchedGoldenPath=/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "tracePath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/next/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "actualPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/next/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/next/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": 1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": true,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": 0
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/ps-end.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/ps-end.txt
new file mode 100644
index 00000000..debddf43
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/ps-end.txt
@@ -0,0 +1,2 @@
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+17770 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/refused/output/result.json b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/refused/output/result.json
new file mode 100644
index 00000000..3ab8fde9
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/6-negative-serverowned-vs-offscreen/refused/output/result.json
@@ -0,0 +1,32 @@
+{
+  "passed": false,
+  "statusCode": 5,
+  "message": "retrace failed with status 1",
+  "tracePath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/refused/input/openra.trace",
+  "goldenPath": "/home/swung/w7/p7w7-tree-a4a940db/tools/trace_replay/fixtures/openra.0000031249.png",
+  "alternateGoldenPaths": [],
+  "matchedGoldenPath": "",
+  "actualPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/refused/output/actual.png",
+  "diffPath": "/home/swung/w7/logs/p12/device/6-negative-serverowned-vs-offscreen/refused/output/OpenRA-diff.png",
+  "backend": "DirectGLES",
+  "angleVariant": "",
+  "targetFrame": -1,
+  "targetCall": 31249,
+  "width": 640,
+  "height": 480,
+  "cropX": 1,
+  "cropY": 1,
+  "cropWidth": 638,
+  "cropHeight": 478,
+  "ssim": -1.000000000,
+  "ssimThreshold": 0.990000000,
+  "useAngle": false,
+  "usePbuffer": false,
+  "avoidAngleLlvmpipeSamplerMipmapMinFilter": false,
+  "avoidAngleLlvmpipeExplicitLodBias": false,
+  "fixIterationRPSubgroupScratch": false,
+  "deriveNumSubgroups": false,
+  "iterationRPFixBarrier": false,
+  "holdMs": 0,
+  "mismatchPixels": -1
+}
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/check.log b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/check.log
new file mode 100644
index 00000000..0fa81fe2
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/check.log
@@ -0,0 +1,52 @@
+[00:50:05] === 7a: a live offscreen session, then the display Activity
+[00:50:06] offscreen session live
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+17770 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+17893 17770 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+[00:50:08] supervisor pid=17770 session child pid=17893
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
+/home/swung/w7/notes/p12/android/dev.sh: line 60: 3971364 Aborted                    env -u DISPLAY -u WAYLAND_DISPLAY -u MOBILEGL_IPC_SURFACE MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_CONTROL="$ENDPOINT" MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_TOKEN="$TOKEN" MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_LOG_FORWARD=1 MOBILEGL_LOG_FILE_PATH="$dir/output/mobilegl.log" "$@" timeout 900 "$HOST/mobilegl_trace_replay" --trace "$dir/input/$trace" --golden "$FIX/$golden" --diff "$dir/output/$case-diff.png" --output "$dir/output" --backend "$backend" --mobilegl-library "$HOST/libMobileGL.so" --target-call "$target" --width "$w" --height "$h" --ssim-threshold "$ssim" --crop-x "$cx" --crop-y "$cy" --crop-width "$cw" --crop-height "$ch" "$flag" > "$dir/replay.log" 2>&1
+[00:50:09] display server READY
+[00:50:10] supervisor 17770 alive? no  child 17893 alive? no
+14838  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+[00:50:10] the offscreen session's client rc=134 (its server went away)
+      1 [00:50:08] [Linux mobilegl_trace_/ERROR]: MGPipe: DEVICE LOST - the barrier woke on a peer that had hung up. The server process is gone; every verb from here is DECLINED and glGetGraphicsResetStatus reports GL_UNKNOWN_CONTEXT_RESET. This is
+09-24 12:50:11.562 14838 14838 I MobileGLDisplay: stopped MobileGLServerService (the offscreen supervisor): one server at a time (P12 D8)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: supervisor output failed
+09-24 12:50:11.564 17726 17773 E MobileGLServer: java.io.InterruptedIOException: read interrupted by close() on another thread
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at libcore.io.Linux.readBytes(Native Method)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at libcore.io.Linux.read(Linux.java:229)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at libcore.io.ForwardingOs.read(ForwardingOs.java:618)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at libcore.io.BlockGuardOs.read(BlockGuardOs.java:325)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at libcore.io.ForwardingOs.read(ForwardingOs.java:618)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at libcore.io.IoBridge.read(IoBridge.java:604)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.FileInputStream.read(FileInputStream.java:353)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.BufferedInputStream.read1(BufferedInputStream.java:277)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.BufferedInputStream.read(BufferedInputStream.java:338)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:291)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:355)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:181)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.InputStreamReader.read(InputStreamReader.java:177)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.BufferedReader.fill(BufferedReader.java:172)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.BufferedReader.readLine(BufferedReader.java:337)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.io.BufferedReader.readLine(BufferedReader.java:403)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at top.mobilegl.plugin.MobileGLServerService.lambda$onStartCommand$0$top-mobilegl-plugin-MobileGLServerService(MobileGLServerService.java:123)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at top.mobilegl.plugin.MobileGLServerService$$ExternalSyntheticLambda0.run(D8$$SyntheticClass:0)
+09-24 12:50:11.564 17726 17773 E MobileGLServer: 	at java.lang.Thread.run(Thread.java:1119)
+09-24 12:50:11.566 14838 14838 I MobileGL: [12:50:11] [Android w1.trace:mglwin/INFO]: MG_Remote server: this process owns a display (ServerDisplay installed); a ServerOwned window surface is served on its window
+09-24 12:50:11.566 14838 14838 I MobileGLDisplay: starting the in-process display server on tcp://127.0.0.1:40613 (pid=14838, backend pinned by the first session)
+[00:50:10] === 7b: the service again - :mglwin must go
+[00:50:10] :mglwin pid=14838
+[00:50:11] supervisor READY
+[00:50:12] :mglwin pid now= (was 14838); /proc/14838 exists? no
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+18028 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+09-24 12:50:13.835 17726 17726 I MobileGLServer: removing the on-screen display server's task (P12 D8: one server at a time)
+09-24 12:50:13.840 17726 17726 I MobileGLServer: stopping the on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=14838 (P12 D8: one server at a time)
+09-24 12:50:13.892 17726 17726 I MobileGLServer: on-screen display server top.mobilegl.plugin.p7w1.trace:mglwin pid=14838 is gone
+09-24 12:50:13.964 18028 18028 E MobileGL: [12:50:13] [Android libMobileGLServ/ERROR]: MG_Remote server: pid=18028 listening on tcp://127.0.0.1:40613
+09-24 12:50:13.964 18028 18028 E MobileGL: [12:50:13] [Android libMobileGLServ/ERROR]: MG_Remote server: pre-auth deadline=2000 ms, at most 8 pending, backoff after 5 failures from 1000 ms (0 = off)
+[00:50:13] done 7
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-after-activity.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-after-activity.txt
new file mode 100644
index 00000000..f311d2dc
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-after-activity.txt
@@ -0,0 +1,2 @@
+14838  1666 top.mobilegl.plugin.p7w1.trace:mglwin top.mobilegl.plugin.p7w1.trace:mglwin
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-after-service.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-after-service.txt
new file mode 100644
index 00000000..9c176067
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-after-service.txt
@@ -0,0 +1,2 @@
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+18028 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-before.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-before.txt
new file mode 100644
index 00000000..67c92687
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/ps-before.txt
@@ -0,0 +1,3 @@
+17726  1666 top.mobilegl.plugin.p7w1.trace:mglsrv top.mobilegl.plugin.p7w1.trace:mglsrv
+17770 17726 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
+17893 17770 libMobileGLServer.so        libMobileGLServer.so tcp://127.0.0.1:40613 --serve
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/tds-activity.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/tds-activity.txt
new file mode 100644
index 00000000..89d19b30
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/tds-activity.txt
@@ -0,0 +1,3 @@
+Starting: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLDisplayActivity (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGL MobileGLDisplay (MG_Remote server: ... listening on ... in-process display server, display installed)
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_SURFACE=server MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613 (trace_replay --window-surface)
diff --git a/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/tds-service2.txt b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/tds-service2.txt
new file mode 100644
index 00000000..2710e91c
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/device/trial-a4a940db/7-one-server/tds-service2.txt
@@ -0,0 +1,3 @@
+Starting service: Intent { cmp=top.mobilegl.plugin.p7w1.trace/top.mobilegl.plugin.MobileGLServerService (has extras) }
+Read readiness: adb -s 2f7cbe2e logcat -s MobileGLServer
+Client: MOBILEGL_TRANSPORT=spawn MOBILEGL_IPC_DATA=stream MOBILEGL_IPC_REQUIRE_SAME_BUILD=1 MOBILEGL_IPC_CONTROL=tcp://<device-address>:40613
diff --git a/docs/Disaggregated/notes/p12/fix-icd.sh b/docs/Disaggregated/notes/p12/fix-icd.sh
new file mode 100644
index 00000000..ca3f4db0
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/fix-icd.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Pin the lavapipe ICD like pipe's build-split (it forces the three iterationRP repairs into the Vulkan
+# test env), rebuild, rerun the one lane that differed.
+set -e
+T=/home/swung/w7/p12-onscreen
+export MOBILEGL_FLATC_EXECUTABLE=/home/swung/w7/flatc-build/flatc
+unset DISPLAY WAYLAND_DISPLAY
+cmake -S "$T" -B "$T/build-split" -DMOBILEGL_ITEST_VK_ICD=/usr/share/vulkan/icd.d/lvp_icd.json > /dev/null
+cmake -S "$T" -B "$T/build-linux" -DMOBILEGL_ITEST_VK_ICD=/usr/share/vulkan/icd.d/lvp_icd.json > /dev/null
+ninja -C "$T/build-split" -j 24 | tail -1
+cd "$T/build-split"
+ctest -L '^integration-magma-full-split$' -j 8 2>&1 | grep -E 'tests passed|tests failed'
diff --git a/docs/Disaggregated/notes/p12/g1-base-names.sh b/docs/Disaggregated/notes/p12/g1-base-names.sh
new file mode 100644
index 00000000..e6a2701e
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/g1-base-names.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# The G1 base was saved as full nm lines; gate.sh compares names. Keep the full file, write the names list.
+B=/home/swung/w7/logs/p12/pull-syms-base.txt
+[ -f "$B.full" ] || cp "$B" "$B.full"
+awk '{print $3}' "$B.full" | sort > "$B"
+head -2 "$B"; wc -l < "$B"
diff --git a/docs/Disaggregated/notes/p12/gate.sh b/docs/Disaggregated/notes/p12/gate.sh
new file mode 100644
index 00000000..a7ac2684
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/gate.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# gate.sh <tree> <tag>: the P7 v2 local gate (logs/p7-gate-template2.sh) for a P12 package tree, minus
+# build-verify and the retrace leg (both run at integration). G1 compares against the p12 base
+# (9f669e52: .text a52203, symbols in logs/p12/pull-syms-base.txt).
+TREE=${1:?tree}; TAG=${2:?tag}
+T=/tmp/p12gate-$TAG; mkdir -p "$T"
+cd "$TREE" || exit 1
+export MOBILEGL_FLATC_EXECUTABLE=/home/swung/w7/flatc-build/flatc
+unset DISPLAY WAYLAND_DISPLAY
+echo "=== START $(date) head=$(git rev-parse --short HEAD) dirty=$(git status --porcelain --untracked-files=no | wc -l) ==="
+ninja -C build-split -j 24 2>&1 | tail -1; echo "=== split build rc=${PIPESTATUS[0]} ==="
+ninja -C build-linux -j 24 2>&1 | tail -1; lrc=${PIPESTATUS[0]}; echo "=== linux build rc=$lrc ==="
+readelf -S -W build-linux/libMobileGL.so | awk '$2==".text"{print "G1 text size (hex):", $6, "(base a52203)"}'
+nm --defined-only build-linux/libMobileGL.so | awk '{print $3}' | sort > "$T/pull-syms.txt"
+echo "G1 syms added=$(comm -13 /home/swung/w7/logs/p12/pull-syms-base.txt "$T/pull-syms.txt" | wc -l) removed=$(comm -23 /home/swung/w7/logs/p12/pull-syms-base.txt "$T/pull-syms.txt" | wc -l)"
+python3 scripts/ci/fatal_census.py 2>&1 | tail -1
+python3 scripts/link_ratchet.py --build-dir build-split --baseline scripts/data/link_ratchet_baseline.txt --assert-monotone 2>&1 | tail -1
+python3 scripts/ci/spawn_lane_parity.py build-split 2>&1 | grep -c -i error | sed 's/^/parity errors: /'
+python3 scripts/ci/protocol_revision_pin.py 2>&1 | tail -1
+python3 scripts/ci/wire_declines_audit.py . 2>&1 | tail -1
+
+echo "=== HYGIENE ==="
+hyg() { local name=$1; shift; if "$@" > "$T/hyg-$name.log" 2>&1; then echo "hygiene $name OK"; else echo "hygiene $name RED"; tail -5 "$T/hyg-$name.log" | sed 's/^/    /'; fi; }
+hyg gen_pipe bash -c 'python3 scripts/gen_pipe.py && git diff --exit-code'
+hyg gen_pipe_self python3 scripts/gen_pipe.py --self-test
+hyg link_seam python3 scripts/ci/link_seam_purity.py --self-test
+hyg memo_purity python3 scripts/ci/espryt_memo_purity.py --self-test
+hyg symbol_report python3 scripts/symbol_report.py --self-test
+hyg stdio bash -c "! grep -rnE 'fprintf[[:space:]]*\((stderr|stdout)|(^|[^[:alnum:]_>.])printf[[:space:]]*\(|(^|[^[:alnum:]_>.:])puts[[:space:]]*\(|std::(cout|cerr)' MobileGL/MG_Backend MobileGL/MG_State"
+hyg dirty_surface bash -c 'python3 scripts/gen_pipe_dirty_surface.py --check && python3 scripts/gen_pipe_dirty_surface.py --self-test'
+hyg field_ownership bash -c 'python3 scripts/gen_pipe_field_ownership.py --check && python3 scripts/gen_pipe_field_ownership.py --self-test'
+hyg r16 bash -c 'bash scripts/ci/control_smoke_test.sh && python3 scripts/ci/test_trace_infrastructure.py && python3 scripts/ci/tcp_lane_tools_test.py && python3 tools/trace_replay/test_run_tcp_matrix.py && python3 tools/trace_replay/test_compare_actuals.py'
+hyg g5_p3a bash scripts/p3a_untouched_regions.sh 37da3c3a HEAD
+hyg g5_p4a bash scripts/p4a_untouched_regions.sh 37da3c3a HEAD
+hyg doc_citations python3 scripts/check_doc_citations.py --rev HEAD --strict docs/Disaggregated/*.md docs/Disaggregated/notes/p7/INTEGRATOR-DECISIONS-P7.md MobileGL/MG_Remote/CONTRACT-P7.md
+
+cd build-split
+for L in unit integration-split integration-spawn integration-tcp integration-magma-split integration-magma-spawn integration-magma-tcp integration-magma-full-split; do
+  printf "lane %-28s " "$L"; ctest -L "^$L\$" -j 8 2>&1 | grep -E 'tests passed|tests failed|No tests' | head -1 | tee "$T/lane-$L.txt"
+  if grep -qE "[1-9][0-9]* tests failed" "$T/lane-$L.txt" 2>/dev/null; then sed 's/^/    FAILED: /' Testing/Temporary/LastTestsFailed.log | head -8; fi
+done
+for M in monolith inproc; do
+  printf "lane %-28s " "integration-gpu[$M]"
+  MOBILEGL_TRANSPORT=$M MOBILEGL_IPC_ROLE_SPLIT_STATE=1 MOBILEGL_IPC_STRICT_ERRORS=1 MOBILEGL_IPC_RUN_AHEAD=1 \
+  MOBILEGL_ITEST_REQUIRE_GPU=1 MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1 \
+  MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS=1 MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER=1 \
+    ctest -L integration-gpu -j 4 2>&1 | grep -E 'tests passed|tests failed|No tests' | head -1 | tee "$T/lane-gpu-$M.txt"
+  if grep -qE "[1-9][0-9]* tests failed" "$T/lane-gpu-$M.txt" 2>/dev/null; then sed 's/^/    FAILED: /' Testing/Temporary/LastTestsFailed.log | grep -v Skipped | head -8; fi
+done
+echo "=== DONE $(date) ==="
diff --git a/docs/Disaggregated/notes/p12/gate/build-29b7b284.log b/docs/Disaggregated/notes/p12/gate/build-29b7b284.log
new file mode 100644
index 00000000..09f48bfa
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/gate/build-29b7b284.log
@@ -0,0 +1,20 @@
+Preparing worktree (detached HEAD 29b7b284)
+HEAD is now at 29b7b284 [tools] (P12): trace_replay README - the two device servers, tcp_device_server.py --surface window, and the headless client's MOBILEGL_IPC_SURFACE=server --window-surface replay
+submodule 3rdparty/DiligentCore copied from the package tree (f36e63880566649d9d8b2336a7c5aa9c8ddb174b)
+submodule 3rdparty/SPIRV-Cross copied from the package tree (072444287f4e139c178d6d8fe32e04a0d2c34e8b)
+submodule 3rdparty/SPIRV-Reflect copied from the package tree (10b4f09a24d7ac1603071e767c089551dc6a3949)
+submodule 3rdparty/Vulkan-Headers copied from the package tree (ad9ce1235e88dc09287e19171dfac384db8ec32c)
+submodule 3rdparty/Vulkan-Utility-Libraries copied from the package tree (738ec97a3f659dd6469bff3c4078ef981b0a343f)
+submodule 3rdparty/VulkanMemoryAllocator copied from the package tree (e722e57c891a8fbe3cc73ca56c19dd76be242759)
+submodule 3rdparty/apitrace copied from the package tree (c8036190fcb79ce0d64cf44ab419c54c3307cd71)
+submodule 3rdparty/asio copied from the package tree (8806a6803cde7054c3049d3666d3ec36786568c5)
+submodule 3rdparty/flatbuffers copied from the package tree (7e163021e59cca4f8e1e35a7c828b5c6b7915953)
+submodule 3rdparty/glslang copied from the package tree (d89cf443bcd220e9205defa0cc4c4b8d8f75dfa2)
+submodule 3rdparty/tracy copied from the package tree (e6b9ea460993a6f093283055ef3c98025b19f909)
+submodule 3rdparty/xxHash copied from the package tree (1d7b2a9d21bf9a740ead540aa93f4bc4caf11ae0)
+submodule include/ska copied from the package tree (21c1cec95abee1beef827e4a7c95f692875d9594)
+tree ready: /home/swung/w7/p7w7-tree-29b7b284 @ 29b7b284, stamp p12w1-29b7b284
+[00:51:25] build sha=29b7b284b9f1cbc77650ad123402f5f5ddbf0edb stamp=p12w1-29b7b284 tree=/home/swung/w7/p7w7-tree-29b7b284 out=/home/swung/w7/logs/p7w7/p12w1-29b7b284 mode=all
+[00:52:54] APK 9159517 bytes sha256 275e0b616efbcbf7, stamp strings in lib: 1
+[00:55:02] host artefacts in /home/swung/w7/logs/p7w7/p12w1-29b7b284/host (stamp strings: 1)
+[00:55:02] === BUILD DONE p12w1-29b7b284 ===
diff --git a/docs/Disaggregated/notes/p12/gate/build-984db455.log b/docs/Disaggregated/notes/p12/gate/build-984db455.log
new file mode 100644
index 00000000..c898ca85
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/gate/build-984db455.log
@@ -0,0 +1,21 @@
+Preparing worktree (detached HEAD 984db455)
+Updating files:  96% (1946/2010)
Updating files:  97% (1950/2010)
Updating files:  98% (1970/2010)
Updating files:  99% (1990/2010)
Updating files: 100% (2010/2010)
Updating files: 100% (2010/2010), done.
+HEAD is now at 984db455 [tools, scripts] (P12): tcp_device_server.py --surface window|pbuffer (default pbuffer, unchanged) starts the on-screen display Activity on a lit screen, and --backend pins either server
+submodule 3rdparty/DiligentCore copied from the package tree (f36e63880566649d9d8b2336a7c5aa9c8ddb174b)
+submodule 3rdparty/SPIRV-Cross copied from the package tree (072444287f4e139c178d6d8fe32e04a0d2c34e8b)
+submodule 3rdparty/SPIRV-Reflect copied from the package tree (10b4f09a24d7ac1603071e767c089551dc6a3949)
+submodule 3rdparty/Vulkan-Headers copied from the package tree (ad9ce1235e88dc09287e19171dfac384db8ec32c)
+submodule 3rdparty/Vulkan-Utility-Libraries copied from the package tree (738ec97a3f659dd6469bff3c4078ef981b0a343f)
+submodule 3rdparty/VulkanMemoryAllocator copied from the package tree (e722e57c891a8fbe3cc73ca56c19dd76be242759)
+submodule 3rdparty/apitrace copied from the package tree (c8036190fcb79ce0d64cf44ab419c54c3307cd71)
+submodule 3rdparty/asio copied from the package tree (8806a6803cde7054c3049d3666d3ec36786568c5)
+submodule 3rdparty/flatbuffers copied from the package tree (7e163021e59cca4f8e1e35a7c828b5c6b7915953)
+submodule 3rdparty/glslang copied from the package tree (d89cf443bcd220e9205defa0cc4c4b8d8f75dfa2)
+submodule 3rdparty/tracy copied from the package tree (e6b9ea460993a6f093283055ef3c98025b19f909)
+submodule 3rdparty/xxHash copied from the package tree (1d7b2a9d21bf9a740ead540aa93f4bc4caf11ae0)
+submodule include/ska copied from the package tree (21c1cec95abee1beef827e4a7c95f692875d9594)
+tree ready: /home/swung/w7/p7w7-tree-984db455 @ 984db455, stamp p12w1-984db455
+[00:22:01] build sha=984db45576a413bd83b867230d834995ddf67547 stamp=p12w1-984db455 tree=/home/swung/w7/p7w7-tree-984db455 out=/home/swung/w7/logs/p7w7/p12w1-984db455 mode=all
+[00:23:30] APK 9159517 bytes sha256 ddd8f29737e1b673, stamp strings in lib: 1
+[00:25:44] host artefacts in /home/swung/w7/logs/p7w7/p12w1-984db455/host (stamp strings: 1)
+[00:25:44] === BUILD DONE p12w1-984db455 ===
diff --git a/docs/Disaggregated/notes/p12/gate/build-a4a940db.log b/docs/Disaggregated/notes/p12/gate/build-a4a940db.log
new file mode 100644
index 00000000..557ba9ce
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/gate/build-a4a940db.log
@@ -0,0 +1,21 @@
+Preparing worktree (detached HEAD a4a940db)
+Updating files:  96% (1946/2010)
Updating files:  97% (1950/2010)
Updating files:  98% (1970/2010)
Updating files:  99% (1990/2010)
Updating files: 100% (2010/2010)
Updating files: 100% (2010/2010), done.
+HEAD is now at a4a940db [MG_Remote] (P12): the display geometry up-call attaches the apply thread to the JVM under its own name, so the rest of the session is not logged as the up-call's thread
+submodule 3rdparty/DiligentCore copied from the package tree (f36e63880566649d9d8b2336a7c5aa9c8ddb174b)
+submodule 3rdparty/SPIRV-Cross copied from the package tree (072444287f4e139c178d6d8fe32e04a0d2c34e8b)
+submodule 3rdparty/SPIRV-Reflect copied from the package tree (10b4f09a24d7ac1603071e767c089551dc6a3949)
+submodule 3rdparty/Vulkan-Headers copied from the package tree (ad9ce1235e88dc09287e19171dfac384db8ec32c)
+submodule 3rdparty/Vulkan-Utility-Libraries copied from the package tree (738ec97a3f659dd6469bff3c4078ef981b0a343f)
+submodule 3rdparty/VulkanMemoryAllocator copied from the package tree (e722e57c891a8fbe3cc73ca56c19dd76be242759)
+submodule 3rdparty/apitrace copied from the package tree (c8036190fcb79ce0d64cf44ab419c54c3307cd71)
+submodule 3rdparty/asio copied from the package tree (8806a6803cde7054c3049d3666d3ec36786568c5)
+submodule 3rdparty/flatbuffers copied from the package tree (7e163021e59cca4f8e1e35a7c828b5c6b7915953)
+submodule 3rdparty/glslang copied from the package tree (d89cf443bcd220e9205defa0cc4c4b8d8f75dfa2)
+submodule 3rdparty/tracy copied from the package tree (e6b9ea460993a6f093283055ef3c98025b19f909)
+submodule 3rdparty/xxHash copied from the package tree (1d7b2a9d21bf9a740ead540aa93f4bc4caf11ae0)
+submodule include/ska copied from the package tree (21c1cec95abee1beef827e4a7c95f692875d9594)
+tree ready: /home/swung/w7/p7w7-tree-a4a940db @ a4a940db, stamp p12w1-a4a940db
+[00:40:50] build sha=a4a940db2beaded2e9ea3936f1a735687a2cec4b stamp=p12w1-a4a940db tree=/home/swung/w7/p7w7-tree-a4a940db out=/home/swung/w7/logs/p7w7/p12w1-a4a940db mode=all
+[00:42:20] APK 9159517 bytes sha256 db197a3ab79e9cc2, stamp strings in lib: 1
+[00:44:35] host artefacts in /home/swung/w7/logs/p7w7/p12w1-a4a940db/host (stamp strings: 1)
+[00:44:35] === BUILD DONE p12w1-a4a940db ===
diff --git a/docs/Disaggregated/notes/p12/gate/gate-android1.log b/docs/Disaggregated/notes/p12/gate/gate-android1.log
new file mode 100644
index 00000000..62fee258
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/gate/gate-android1.log
@@ -0,0 +1,37 @@
+=== START Thu Sep 24 12:55:07 AM -04 2026 head=29b7b284 dirty=0 ===
+[119/120] Linking CXX executable MobileGL/MG_IntegrationTest/MobileGLIntegrationTest
+=== split build rc=0 ===
+[82/82] Linking CXX executable MobileGL/MG_Test/Texture/TextureTest
+=== linux build rc=0 ===
+G1 text size (hex): a52203 (base a52203)
+G1 syms added=30570 removed=30570
+fatal census: 79 abort sites over 20 files of the split server image, 45 distinct family words, 3 refusal words, 0 unmarked
+link-ratchet: ratchet: unchanged at 171 symbol(s)
+parity errors: 0
+protocol revision pin: revision 3 holds (sha256 da09f0acb48cf245..., 3 revision(s) pinned)
+wire-declines: 53 rows, 53 with sites, 53 site(s) total, 0 unlogged, 0 unknown
+=== HYGIENE ===
+hygiene gen_pipe OK
+hygiene gen_pipe_self OK
+hygiene link_seam OK
+hygiene memo_purity OK
+hygiene symbol_report OK
+hygiene stdio OK
+hygiene dirty_surface OK
+hygiene field_ownership OK
+hygiene r16 OK
+hygiene g5_p3a OK
+hygiene g5_p4a OK
+hygiene doc_citations OK
+lane unit                         100% tests passed, 0 tests failed out of 2601
+lane integration-split            100% tests passed, 0 tests failed out of 322
+lane integration-spawn            100% tests passed, 0 tests failed out of 239
+lane integration-tcp              100% tests passed, 0 tests failed out of 243
+lane integration-magma-split      100% tests passed, 0 tests failed out of 125
+lane integration-magma-spawn      100% tests passed, 0 tests failed out of 104
+lane integration-magma-tcp        100% tests passed, 0 tests failed out of 89
+lane integration-magma-full-split 99% tests passed, 1 tests failed out of 558
+    FAILED: 5975:DirectVulkan.Split.Full.IterationRPProgram203Scenario.FixedCompleteInputProducesFixedCompleteGoldenOutput
+lane integration-gpu[monolith]    100% tests passed, 0 tests failed out of 2188
+lane integration-gpu[inproc]      100% tests passed, 0 tests failed out of 2188
+=== DONE Thu Sep 24 01:04:00 AM -04 2026 ===
diff --git a/docs/Disaggregated/notes/p12/map-apk-process.md b/docs/Disaggregated/notes/p12/map-apk-process.md
new file mode 100644
index 00000000..4ad80e41
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/map-apk-process.md
@@ -0,0 +1,131 @@
+# MobileGL-disagg: Android APK and process model for an on-screen server path (commit 9f669e52)
+
+Paths below are relative to `C:\Users\geekerwan\AndroidStudioProjects\FoldCraftLauncher\MobileGL-disagg\`. **[V]** means I read it in the code. **[I]** means I inferred it. **[A]** is an Android platform fact I'm confident of but did not check in this tree.
+
+## 1. How the APK is built and packaged [V]
+- The app module has `minSdk = 26`, `targetSdk = 34` and ABI default `arm64-v8a` (`android-plugin/app/build.gradle.kts:124-125, 24-31, 152-154`). The library module and CMake also pin API 26 (`build.gradle:43`, `CMakeLists.txt:80`).
+- There are two flavors, `plugin` and `trace` (`.trace` suffix), at `build.gradle.kts:171-181`. The app's own CMake is `src/trace/cpp/CMakeLists.txt` and builds `libtrace_replay_runner.so` for both flavors (`build.gradle.kts:204-209`). The `plugin` flavor then strips it (`:229-233`).
+- `libMobileGL.so` comes from `implementation(project(":MobileGL"))` (`build.gradle.kts:236`), which is the root `build.gradle`: `com.android.library` using the root `CMakeLists.txt`. The disaggregated/inproc/push switches are passed in `build.gradle:58-66`.
+- `useLegacyPackaging = true` (`build.gradle.kts:211-216`) extracts the `.so` files to `nativeLibraryDir`, and the exec path needs that.
+- `libMobileGLServer.so` is `add_executable(MobileGLServer ServerEntry.cpp)`, built when `MOBILEGL_BUILD_DISAGGREGATED AND NOT WIN32`. It is PIE, links libMobileGL, has `RPATH $ORIGIN`, and on Android uses `PREFIX lib SUFFIX .so` inside `CMAKE_LIBRARY_OUTPUT_DIRECTORY` (`CMakeLists.txt:1000-1053`).
+- `main()` in `MG_Remote/Server/ServerEntry.cpp:19` just calls `mobilegl_server_main`.
+- `MOBILEGL_BUILD_SERVER_SPIKE` builds a separate `libMobileGLServerSpike.so` stub (`CMakeLists.txt:1055-1080`), passed only by the trace flavor (`build.gradle:96-110`).
+- libMobileGL already carries Android JNI code (`DriverPostJni.cpp` and `DriverBenchJni.cpp`, `CMakeLists.txt:675-680`) and links `android` and `log` (`:866-867`).
+
+## 2. Existing ownership of a Surface: TraceReplayActivity [V]
+- The Activity runs in the default process (trace manifest `:67-76`, no `android:process`). It loads `trace_replay_runner` (`TraceReplayActivity.java:22-24`) and creates a `SurfaceView` (`:41-42`).
+- If `width`/`height` extras are given, it calls `setFixedSize` (`:82-84`).
+- `surfaceCreated` and `surfaceChanged` both call `scheduleReplay`, which starts the replay after 250 ms, only once (`:85-104, 121-134`). **`surfaceDestroyed` is empty** (`:96-98`).
+- The session survives Activity recreation through `onRetainNonConfigurationInstance` (`:69-79, 106-109`). However, a recreated Activity's new Surface is never handed to the running replay, because of the `hasStarted` early return (`:122`).
+- `configChanges=0x80000f80` (`res/values/config.xml:3-10`) exists precisely so rotation and overlay changes don't recreate the Activity and kill the Surface.
+- JNI (`trace_replay_jni.cpp`):
+  - A per-process lease blocks concurrent replays (`:125-133`).
+  - With `use_pbuffer` there is no window at all (`:187`). Otherwise it calls `ANativeWindow_fromSurface`, or fails if the surface is already gone (`:188-196`).
+  - The `:179-183` comment records that a spawned server cannot take a window until P12.
+- GLWS (`apitrace_glws_android.cpp`):
+  - A global `gNativeWindow` is acquired and released (`:60, 414-425`).
+  - `createSurface` chooses `eglCreateWindowSurface` plus `setBuffersGeometry` when there is a window, else a pbuffer (`:198-219`). The config's `EGL_SURFACE_TYPE` follows the same choice (`:337`).
+  - The `eglSwapBuffers` result is ignored (`:185-195`).
+  - The app's own glws calls `eglTerminate` in `cleanup` (`:315-321`).
+- **Conclusion:** today's harness is one-shot. It never re-targets a new Surface; after a destroy it keeps rendering into an abandoned one, and the window reference only prevents a use-after-free.
+
+## 3. Today's server process model [V]
+- **Service:** `MobileGLServerService` is an exported foreground service in `:mglsrv` (trace manifest `:11-15`) with a wake lock (`MobileGLServerService.java:26-39`).
+  - It runs `ProcessBuilder(nativeLibraryDir/libMobileGLServer.so, endpoint, "--serve")` (`:60-61`).
+  - Environment it sets: `ROLE=server`, `DIAL=no`, `LOG_FORWARD=1`; removes `TRANSPORT`, `CONTROL`, `ENDPOINT`, `SERVER_PATH`, `RING_MB`, `STAGE_MB`; sets `TOKEN`, `LOG_FILE_PATH`, `LD_LIBRARY_PATH` (`:63-75`).
+  - Extras are `listen`, `token` and `env` (grammar `K=V;K`, `:42-50`). A reader thread pipes stdout to logcat and calls `stopSelf` on exit (`:78-88`). `onDestroy` calls `destroy()` (`:96-102`).
+  - It is driven by `tools/trace_replay/tcp_device_server.py:77-79`.
+- **`mobilegl_server_main`** (`ServerMain.cpp:1028-1139`):
+  - It forces `ROLE=server` (`:1035-1038`).
+  - Hard preconditions: `DIAL=no`, else exit 64; the scrub list, else exit 65 (`:1039-1049`).
+  - `tcp://` with `--serve` runs `TcpSupervisor::Run` (`:1072-1079`). It authenticates each Hello before forking (`Judge` `:910-976`), then `Fork` (`:978-1010`).
+  - In the fork child it closes the listener and every other pending fd and calls `RunSession` with `HandoffSource`. In the parent it calls `CloseLocalCopy` on its copy of the connection.
+  - Unix `--serve` forks per session (`:1123-1133`).
+  - **Single-session shape (no `--serve`):** the process *is* the session, with no fork. TCP uses `ListenerSource` (`:1096-1105`); unix uses `DataSource::None` (`:1106-1108`).
+- **`RunSession` is `[[noreturn]]`** (`:268-638`). Every exit path calls `_exit`: `ExitBeforeAccept` (`:235-239`), and `:412, 429, 437, 455, 482, 637`.
+  - Per-session process-global setup: `MG_ConfigLoader::Init`, `Transport=Spawn`, `MGPipeSetServerProcessRole(true)`, `ArmSessionLatch`, `PipeStats::Init`, `ActiveBackendType=hello` with the pinned-backend refusal, then `InitServerRoleForSpawn` (`:356-377`).
+  - The log forwarder is a global (`:474-476, 634`).
+- Design intent: one process per session means Espryt's process-level `eglTerminate` teardown is isolated. This is D9 (`docs/Disaggregated/ROADMAP.md:103`).
+
+## 4. Could a session run inside an app process (no fork, no exec)?
+**What `RunSession` and the server assume** [V unless marked]:
+1. **`_exit` on every path** (§3). Inside an app it would kill the Activity at the end of every session, so a returning variant is needed.
+2. **Session latch is process-global and never reset.**
+   - `g_latchArmed`/`g_latched`/`g_latchCount`/`g_latchedLine` (`FatalFunnel.cpp:99-107, 145`) have no reset function.
+   - After one latched session, every later session in that process is declined: `ServerApplyWireSurfaceOp` returns `MISMATCH` (`SurfaceOpCodec.cpp:211`), and the latch also stops the apply loop.
+   - Unarmed faults go to `SessionFail`, which calls `std::abort()` (`FatalFunnel.cpp:131-133, 168-180`) and would take down the UI process.
+3. **Server role is per process.** `g_serverProcessRole` makes every thread a server thread (`PipeInputs.cpp:357-375`). That is harmless only in a process where nothing else calls libMobileGL. [I]
+4. **Backend latch.** `BenchService.java:12-17` says Espryt and Magma can never share a process. Sessions that switch backend within one process are unsafe; pin the backend with `MOBILEGL_BACKEND_TYPE`, which is already enforced at `ServerMain.cpp:371-375`.
+5. **D9 / eglTerminate.**
+   - Espryt uses `eglGetDisplay(EGL_DEFAULT_DISPLAY)` (`DirectGLES.cpp:16177`).
+   - `DestroyEGLContext` calls `eglTerminate` (`:16876-16919`), and it runs at the start of *every* surface init (`InitDisplayAndContext` → `:16159`).
+   - The repo claims this terminates HWUI's display (`main/AndroidManifest.xml:25-28`, `BenchService.java:14-16`). [A, medium confidence] AOSP libEGL reference-counts `eglTerminate` per display, which would contradict that. This has to be measured. The ANGLE path loads `libEGL_angle.so` separately (`Loader.cpp:570-580`).
+6. **Everything else is reusable** (so no blockers there):
+   - `ServerSession::Close` resets everything (`ServerSession.cpp:968-1007`).
+   - `ServerLoop::Stop` resets the backend (`ServerLoop.cpp:920-926`; the `CreateBackend` guard is at `:169-172`).
+   - `PipeStats` Init/Shutdown can be restarted (`PipeStats.cpp:381-422`).
+   - Sockets use `MSG_NOSIGNAL`, so there is no SIGPIPE hazard (`SocketTransport.cpp:466`, `FdPassing.cpp:151`).
+   - The server installs no signal handlers (the only `sigaction` is client-side, `PersistentMapTracker.cpp:423`).
+   - There is no Android load-time constructor in libMobileGL.
+7. **Environment and logging.** Reads from env include `DIAL`, the scrub list, `ROLE` (cached at first log), `LOG_FORWARD`, `BACKEND_TYPE`, `PreAuthKnobs::FromEnvironment` and `MOBILEGL_TEST_*`. In-process these must be set with `Os.setenv` or JNI `setenv` before the first libMobileGL call and before any server thread starts. [I]
+8. **Supervisor re-used with threads instead of fork.** The `Fork` body assumes separate fd tables: the child closes the listener and pending fds, and the parent calls `CloseLocalCopy`. Doing either on a thread would close the supervisor's or the session's live fds (`ServerMain.cpp:990-995, 1009`). The single-session shape also closes the listener after Accept (`:402-405`).
+9. **Different driver in an app process.** [A] `GraphicsEnvironment` (ANGLE and updatable-driver selection) applies only to app processes, and the driver sees a different process name (the logcat evidence has Adreno printing "Process Name: libMobileGLServer.so"). Numbers measured in the exec'd server may not transfer.
+
+## 5. Options
+- **(a) Session inside the app process that owns the SurfaceView** (JNI, background thread, no fork). Feasible.
+  - Precedent: `BenchService` (`:bench`, `System.loadLibrary("MobileGL")`, JNI in libMobileGL at `DriverBenchJni.cpp:327`, `System.exit` after each run; `BenchService.java:45-73`).
+  - The window is `ANativeWindow_fromSurface` in the same process, which is exactly what ROADMAP P12 assumes: "server app owns its own SurfaceView" (`ROADMAP.md:46`, `P6-ENDSTATE-REVIEW.md:313`).
+  - Isolation lost:
+    - Per-session address-space reset (D9, backend latch, session latch).
+    - Crash containment: an abort or driver crash now kills the display Activity too.
+    - Privilege separation between the display UI and code handling network bytes.
+- **(b) Exec'd supervisor plus fork child, and pass the Surface to it.** Not feasible at minSdk 26.
+  - [A] The NDK API to parcel an `ANativeWindow` (`ANativeWindow_writeToParcel` / `readFromParcel`) is API 34, and minSdk is 26 (verified).
+  - [A] An untrusted app cannot register with servicemanager.
+  - [A] libbinder refuses use in a fork child of a process that already used binder. The exec'd server does use binder freshly for gralloc and SurfaceFlinger (verified in logcat: `.trace-work/p7w6/bsl-spawn/.../logcat.txt:1778-1814`), but it has no channel over which to receive a Surface.
+  - A Java `Surface` is Parcelable (AIDL Activity → `:mglsrv` service) [A], but that only lands the window in `:mglsrv`'s Java process, not in its exec'd children. That collapses into option (a).
+- **(c) Child renders into AHardwareBuffers, sends them over a unix socket, app presents.** Feasible at API 26.
+  - `AHardwareBuffer_sendHandleToUnixSocket` is API 26 [A], and the repo notes it at `P6-ENDSTATE-REVIEW.md:138`.
+  - Presenting at minSdk 26 needs an EGLImage (`EGL_ANDROID_get_native_client_buffer`) and a GL blit in the app, because `ASurfaceTransaction_setBuffer` is API 29 [A].
+  - It keeps fork-per-session and D9 intact. But it requires a new buffer-ring/fence protocol, an Espryt default-framebuffer-to-AHB FBO, Magma AHB import, and one copy per frame. It is the largest change.
+- **(d) Existing precedent in the tree:** only `BenchService` for in-process work and the one-shot `TraceReplayActivity`. There is no AIDL, Messenger or AHB code.
+- **Recommendation: (a)**, in a dedicated process such as `:mglwin` holding the Activity and the session thread. The offscreen FGS, exec and fork path in `:mglsrv` stays unchanged, and the user picks a path by which component they start.
+  - Stage 1: one session per process launch (BenchService-style exit), which keeps D9, the backend latch and the latch semantics.
+  - Stage 2: sequential sessions in one process, after the latch reset and the `eglTerminate`/HWUI measurement.
+
+## 6. Surface lifecycle
+- [A] After `surfaceDestroyed` returns, the window must no longer be rendered to. The callback has to block until the apply thread has released the EGL surface or swapchain; this is the GLSurfaceView pattern.
+- Backgrounding destroys the surface and returning creates a new producer. Rotation with `configChanges` gives only `surfaceChanged`.
+- While there is no surface, the session must keep consuming records. It should render offscreen and drop presents (or apply backpressure) rather than fail.
+- Current backends make re-targeting expensive:
+  - Espryt: any different window surface runs `DestroyEGLContext` plus `eglTerminate`, which loses every GL object (`BackendObject_DirectGLES.cpp:962-972`, `DirectGLES.cpp:16159`).
+  - Magma: `InitWindowSurface` replaces the whole `VulkanRenderer` (`BackendObject_DirectVulkan.cpp:343-350`).
+- [A] Once the Activity is backgrounded, the cached-app freezer can freeze `:mglwin` with no hangup (repo: `P6-CONTRACT-DRAFT.md:128`). Hold a foreground service in `:mglwin` for the duration of a session.
+
+## OPEN QUESTIONS / RISKS
+1. Does Espryt's `eglTerminate(EGL_DEFAULT_DISPLAY)` break HWUI in the same process? The repo comment and my AOSP understanding disagree; measure on Adreno and Redmi.
+2. A window/context swap that keeps the context (Espryt) and a swapchain-only recreate (Magma) are prerequisites for surviving backgrounding. Without them a surface loss ends the session.
+3. `kEventSurfaceChanged` has no width/height, so the client's default framebuffer size would not follow the server window (`ROADMAP.md:46`).
+4. The client still sends `SetWindowHandle` unconditionally (`BackendObject_Remote.cpp:215`). Android handles latch by name (`SurfaceOpCodec.cpp:165-171`). X11 and Win32 tokens pass through to `UnpackWindowHandle` (`ServerLoop.cpp:1050-1058`). A server-owned substitution rule is needed.
+5. Driver and profile differences in an app process versus the exec'd server (§4.9).
+6. Both `MobileGLServerService` and the new Activity are exported with no permission, so any app on the device can start a network listener.
+7. A single-session in-process listener cannot answer Busy while a session is live. A thread-based `TcpSupervisor` has the fd-table hazards in §4.8.
+
+## MINIMAL CHANGE LIST
+- **`android-plugin/app/src/trace/AndroidManifest.xml`:** add `ServerDisplayActivity` (`android:process=":mglwin"`, `configChanges=@integer/trace_replay_config_changes`, exported, fullscreen). Optionally add a foreground service in `:mglwin`. Leave `MobileGLServerService` as the offscreen path.
+- **New `android-plugin/app/src/trace/java/top/mobilegl/plugin/ServerDisplayActivity.java`:**
+  - Parse `listen`/`token`/`env` using the `applyEnvironment` grammar. Apply them with `Os.setenv`/`unsetenv` (`ROLE=server`, `DIAL=no`, `LOG_FORWARD=1`, scrub list, `TOKEN`, `LOG_FILE_PATH`, pinned `BACKEND_TYPE`) before `System.loadLibrary("MobileGL")`.
+  - Start a server thread calling `nativeServe(endpoint)`.
+  - `surfaceCreated`/`surfaceChanged` → `nativeSetWindow(surface, w, h)`. `surfaceDestroyed` → `nativeWindowLost()`, which blocks.
+  - On session end, `finish()` and exit the process (stage 1).
+- **New `MobileGL/MG_Remote/Server/ServerWindowJni.cpp`** (Android and disaggregated only), listed in `CMakeLists.txt:675-680` under `MOBILEGL_BUILD_DISAGGREGATED`: `ANativeWindow_fromSurface` and acquire/release, plus calls into the new server API.
+- **`ServerMain.cpp`:**
+  - Make `RunSession` return its exit code; fork sites become `_exit(RunSession(...))`, and `ExitBeforeAccept` returns.
+  - Add `extern "C" int mobilegl_server_serve_inprocess(const char* endpoint)`. It runs the same env checks as `:1035-1049`, then the single-session shape (`:1096-1108`) without `_exit`. Stage 2 wraps it in a loop that keeps the listener open.
+- **`FatalFunnel.{h,cpp}`:** add `ResetSessionLatch()`, needed for stage 2.
+- **Server window slot** (e.g. `ServerLoop.{h,cpp}`):
+  - A process-global server-owned `ANativeWindow*` with generation and size. The `CreateWindowSurface` / `UnpackWindowHandle` arm (`ServerLoop.cpp:1126-1138, 1050-1058`) substitutes it when it is set.
+  - New internal `SurfaceControlOp`s, `WindowArrived` and `WindowLost`, posted from JNI through `RunSurfaceControlFrame` and executed on the apply thread.
+- **Backends (other slices):** an Espryt window swap that keeps the context (`BackendObject_DirectGLES.cpp:948-972`, `DirectGLES.cpp:16159/16225`); Magma swapchain-only recreate (`BackendObject_DirectVulkan.cpp:337-352`); surface-changed width/height; `WindowKind::ServerOwned` plus a client-side change at `BackendObject_Remote.cpp:215`.
+- **`tools/trace_replay/tcp_device_server.py`:** a `--window` mode that runs `am start -n …/.ServerDisplayActivity` with the same extras.
+- **`build.gradle.kts` / `build.gradle`:** no changes needed.
\ No newline at end of file
diff --git a/docs/Disaggregated/notes/p12/map-client-surface.md b/docs/Disaggregated/notes/p12/map-client-surface.md
new file mode 100644
index 00000000..1ac9e7cb
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/map-client-surface.md
@@ -0,0 +1,163 @@
+# Client-side surfaces in split mode: map, open questions and change list (commit 9f669e52)
+
+Tags used below: **[V]** means I read it in code. **[I]** means it is my inference. Paths are relative to `MobileGL-disagg/`.
+
+## 1. How the client's EGL layer creates surfaces in split mode
+
+**Entry points.** These are `MobileGL/MG_Impl/EGLImpl/Exporting/Definitions.cpp:12-15` (`eglCreateWindowSurface`), `:49-51` (`eglMakeCurrent`), `:112-117` (`eglSwapBuffers`) and `:120-122` (`eglCreatePbufferSurface`). Each forwards to `MG_Impl/EGLImpl/EGLImpl.cpp`. [V]
+
+**Window surface** (`EGLImpl.cpp:116-160`). [V]
+- A null native window is refused with `EGL_BAD_NATIVE_WINDOW` (`:130-133`). A surfaceless client therefore cannot reach this path at all.
+- The `WindowHandle` is built as `{Backend = DetectWindowBackend(), Handle = window, Width/Height = attrib or 0}` (`:135-140`).
+- `DetectWindowBackend` is a compile-time `#if` chain (`:59-71`): Android, then Apple (MetalLayer), then Win32, then Linux (X11).
+- Next come `state->CreateWindowSurface` (`:142`) and then `backendObject->CreateEGLWindowSurface` (`:153`). `CreatePlatformWindowSurface` (`:673-717`) follows the same shape.
+- The client's EGL state records a window surface with **no size** (`MG_State/EGLState/Core.cpp:811-839`; defaults `Width/Height = 0` at `Core.h:181-182`). `eglQuerySurface(EGL_WIDTH)` answers from that record (`Core.cpp:1076-1082`), so it returns 0 for a window unless `ResizePlatformWindowSurface` has run (`EGLImpl.cpp:719-739`).
+
+**Pbuffer** (`EGLImpl.cpp:453-476`). The size defaults to 1x1 when no attribute is given (`:458-459`). It then goes through `backendObject->CreateEGLPbufferSurface(surface, w, h)` (`:469`). [V]
+
+**Remote backend** (`MG_Remote/Client/BackendObject_Remote.cpp`). [V]
+- `CreateEGLWindowSurface` (`:210-226`):
+  - waits for the apply thread to catch up (`:214`);
+  - calls `Server::ServerSetWindowHandle(handle)` **unconditionally** (`:215`);
+  - calls `ServerCreateEGLWindowSurface` (`:216`);
+  - calls `DrainPublishedEvents()` (`:224`) so the server's surface-changed event is applied immediately;
+  - finally runs the base-class bookkeeping (`:225`).
+- `CreateEGLPbufferSurface` (`:237-244`) has the same shape without the window handle.
+- `MakeEGLCurrent` (`:246-277`) forwards first, then pumps the control plane, drains events and refreshes caps (`:266-275`).
+- `SwapEGLBuffers` is deliberately **not forwarded** (`:279-288`). Present travels as a record.
+- `SetEGLSwapInterval` is forwarded (`:290-298`).
+
+**Forwarders** (`MG_Remote/Server/ServerLoop.cpp`). [V]
+- `PackWindowHandle` (`:1023-1028`) stores `windowBackend = (Int)handle.Backend` and `nativeToken = (Uint64)handle.Handle`, plus width and height.
+- `ServerCreateEGLWindowSurface` (`:1304-1311`), `ServerCreateEGLPbufferSurface` (`:1323-1331`) and `ServerSetWindowHandle` (`:1399-1404`) all funnel into `RunSurfaceControlFrame`.
+- Under spawn or tcp, `RunSurfaceControlFrame` diverts to `m_remoteSink` (`:793-795`). `ClientSession` installs that sink at `ClientSession.cpp:1140`.
+
+**Wire encoding** (`ClientSession::RunRemoteSurfaceControlFrame`, `ClientSession.cpp:1205-1413`). [V]
+- It mints a sequence number (`:1212-1214`) and calls `EncodeSurfaceOpFrame` (`:1217`). An encode error returns `MOBILEGL_ERR_UNSUPPORTED` (`:1218-1226`).
+- `EncodeSurfaceOpFrame` (`Protocol/SurfaceOpCodec.cpp:125-148`) maps the op to a `WindowKind`:
+  - a pbuffer op is written as `WindowKind::Pbuffer` (`:133-135`);
+  - a window or SetWindowHandle op goes through `WireWindowKindForWindowBackend` (`:102-111`): Android→`AndroidNativeWindow`, X11→`X11`, MetalLayer→`MetalLayer`, Win32→`Win32Hwnd`, Unknown→`None`;
+  - `nativeToken` is copied raw into `SurfaceOp.nativeToken` (`:142-144`; schema at `protocol.fbs:239-268`).
+- **There is no client-side refusal.** An Android client's `ANativeWindow*` encodes cleanly and is only refused on the server. This contradicts CONTRACT-P6 §7.3 (`MG_Remote/CONTRACT-P6.md:451-456`).
+
+**Reply wait and cold-start budget.** [V]
+- `ControlReplyBudgetMs` (`ClientSession.cpp:124-134`): the three bring-up ops (CreatePbufferSurface, CreateWindowSurface, MakeCurrent) get `max(MOBILEGL_IPC_CONTROL_TIMEOUT_MS=5000, MOBILEGL_IPC_COLD_START_MS=20000)` until the first successful MakeCurrent sets `m_serverBackendWarm` (`:1411`). Knobs are parsed at `ConfigLoader.cpp:432-433`.
+- Before sending, the client flushes and waits out its command prefix (`:1238-1244`).
+- Each `SurfaceProgress` restarts the budget, up to `max(budget, kBarrierTimeoutMs)` (`:1265-1276`, `:1352-1375`). A progress message naming the wrong seq is a protocol mismatch.
+- A `CapsSnapshot` arriving mid-wait is adopted (`:1341-1351`), and `Fatal` latches device-lost (`:1376-1390`).
+- After a `SurfaceReply`, the client waits for event delivery up to `eventHead` (`:1405-1408`).
+- `SurfaceReply.defaultFb` is dead: the encoder writes 0 (`SurfaceOpCodec.cpp:192-193`) and the decoder never reads it (`:199-205`).
+
+**Default framebuffer size** (`MG_Impl/Init.cpp:26-50`). [V]
+- The client's framebuffer 0 is a 512x512 RGBA8 placeholder with `Depth32FStencil8` attachments.
+- The consumer is `ApplySurfaceChangedToClient` (`ClientSession.cpp:306-347`), reached from the `kEventSurfaceChanged` case of `DrainEventRing` (`:407-420`). The payload is `EventSurfaceChangedHead{Width, Height, InternalFormat, ...}` (`Transport/EventRing.h:91-100`).
+  - When Width and Height are non-zero, it reallocates all three attachments at that extent (`:316-338`).
+  - When they are zero, it changes formats only and **the 512x512 extent is kept** (`:339-346`).
+- DirectGLES posts **format only** (`MG_Backend/DirectGLES/DirectGLES.cpp:15938-15951`). Magma posts the swapchain extent (`DirectVulkan/Renderer/SwapchainObject.cpp:323-339`).
+- So under Espryt the client's default FBO is 512x512 **even for pbuffers today**.
+- The event never updates the client EGL state's `SurfaceObject.Width/Height`.
+
+**Present.** [V]
+- The `MGPPresent` record carries only `FrameSerial` (`MG_Pipe/MGPipeTypes.h:1768-1771`), emitted at `EmitTables.cpp:1116-1132`. There is no surface identity in it.
+- On the server, DirectGLES calls `eglSwapBuffers(g_Display, g_Surface)` (`DirectGLES.cpp:16842`). The swap therefore hits whatever surface is current when the record is applied.
+
+## 2. How the Linux/WSL client replays traces today
+
+**glretrace windowing layer.** The build uses its own EGL layer, `tools/trace_replay/apitrace_glws_egl.cpp`, compiled into `mobilegl_trace_glretrace_common` (`tools/trace_replay/CMakeLists.txt:206-249`). [V]
+- It uses `MOBILEGL_TRACE_SURFACE=window` to choose between window and pbuffer (`:321-324`, `:432-438`, `:592`, `:616`).
+- **The window path exists only under `__APPLE__`** (`:443-466`). On Linux it always calls `eglCreatePbufferSurface(w, h)` (`:467-476`), even when the config was chosen with `EGL_WINDOW_BIT`.
+- `resize()` destroys and recreates the pbuffer (`:387-400`). A trace can therefore produce several pbuffers over its lifetime.
+
+**Knobs.** [V]
+- `trace_replay_core.cpp:169` sets `MOBILEGL_TRACE_SURFACE` from `request.usePbuffer`, which defaults to true (`trace_replay_core.hpp:58`).
+- The CLI flags are `--window-surface` and `--pbuffer-surface` (`trace_replay_cli.cpp:22-24`, `:142-145`).
+- glretrace is **not** run with apitrace's own `--pbuffer` flag. The surface choice is made entirely inside the custom layer.
+
+**Transport setup.** [V]
+- `run_trace_case.cmake:46-60` sets `MOBILEGL_TRANSPORT`, `IPC_SERVER_PATH`, `IPC_CONTROL`, `DATA=stream`, `TOKEN`, `REQUIRE_SAME_BUILD` and `LOG_FORWARD`.
+- ctest adds `EGL_PLATFORM=surfaceless` for DirectGLES (`tools/trace_replay/CMakeLists.txt:440-447`).
+- `run_tcp_matrix.py:118-139` sets `MOBILEGL_TRANSPORT=spawn` plus a `tcp://` endpoint, and adds run-ahead and verb-barrier when requested.
+- The local server fixture `scripts/ci/tcp_server_fixture.py:60-77` pins `EGL_PLATFORM=surfaceless`, removes `DISPLAY` and `WAYLAND_DISPLAY`, and runs `<server> <endpoint> --serve`.
+
+**Integration harness** (`MG_IntegrationTest/Harness/HeadlessGL.cpp`). [V]
+- On Linux it always uses a pbuffer (`UseWindowSurface` returns false at `:138-139`; pbuffer at `:276-277`) and forces `EGL_PLATFORM=surfaceless` (`:181-196`).
+- On Android it uses a window from an `AImageReader` (`:136-137`, `:268-273`).
+- The Split, Spawn, Tcp and TcpDevice arms are all host clients (`MG_IntegrationTest/CMakeLists.txt:2329-2336`).
+
+**Can a Linux client create a window surface at all?** Yes, but only mechanically, and no lane does. [V]
+- It would announce `WindowKind::X11` plus an XID.
+- **At HEAD, X11 is NOT a named refusal.** `WindowBackendForWireWindowKind` accepts X11 and Win32 (`SurfaceOpCodec.cpp:113-123`). `DecodeWireSurfaceOp` refuses only `AndroidNativeWindow` and `MetalLayer` (`:165-175`, latched at `:217-228`).
+- An accepted token is cast straight to `void*` by `UnpackWindowHandle` (`ServerLoop.cpp:1050-1058`) and used by `CreateEGLWindowSurface` / `SetWindowHandle` (`:1126-1138`, `:1232-1241`). That is a wild pointer in the server process.
+- P6-ENDSTATE-REVIEW §2.1 (`docs/Disaggregated/P6-ENDSTATE-REVIEW.md:62-79`) and CONTRACT-P6 §7.1/§7.2 "D8" (`MG_Remote/CONTRACT-P6.md:426-449`) specify an allow-list:
+  - X11 → `Fatal{UnmigratedSurface,"X11@P12"}`;
+  - `None` on a window op is a Fatal;
+  - `nativeToken != 0` is a Fatal;
+  - reason: "Rule G": a value whose meaning comes from the peer's window system never crosses the wire.
+- **None of D8 is implemented.**
+- Android clients hit `AndroidNativeWindow@P12`. That is why the device lanes require `--use-pbuffer` (`run_android_retrace_local.py:604-611`, `trace_replay_jni.cpp:180-187`, `tools/device_bench/p6/README.md:117-120`).
+
+**Surfaceless client and "show my framebuffer on the server's screen": options.**
+
+- **A. Server-side policy, no client or wire change.** [I]
+  - The APK (session config) says "present". The `CreatePbufferSurface` case of `ApplySurfaceControlFrame` (`ServerLoop.cpp:1144-1151`) then creates the session's surface as a **window surface on the APK's `ANativeWindow`**, after `ANativeWindow_setBuffersGeometry(win, frame.width, frame.height, fmt)`.
+  - This keeps the client-fixed pbuffer size authoritative. SurfaceFlinger scales the buffer to the view, so client viewports, readbacks and goldens stay valid.
+  - The offscreen path is unchanged when the policy is off.
+  - The client keeps believing it has a pbuffer (EGL state, swap behaviour).
+- **B. Client opt-in, the P12 shape.** [I]
+  - Add a new knob, e.g. `MOBILEGL_IPC_SURFACE=server`, in `MG_Config::Ipc`. With it set, `BackendObject_Remote::CreateEGLPbufferSurface` and `CreateEGLWindowSurface` send `CreateWindowSurface` with an appended `WindowKind::ServerOwned` and `nativeToken=0`, and skip `ServerSetWindowHandle`.
+  - The server refuses by name if it owns no window.
+  - This needs a schema append and revision bump, and should land together with D8.
+  - Size: for a pbuffer, the client's width and height are the requested buffer geometry. For a client window, the server's size has to flow back through `kEventSurfaceChanged` with a non-zero W/H, **and** into the client EGL state's surface size, which nothing updates today.
+- **Recommendation.** [I] Use B's wire shape, gated by a server switch, with A's sizing rule (the client size wins via `setBuffersGeometry`). Map exactly **one** surface per session to the view: the first pbuffer or window created, or the one current at Present. All others stay offscreen, because an `ANativeWindow` accepts only one connected EGL surface.
+- **Multiple pbuffers, verified caveat.** DirectGLES destroys and recreates the native context whenever a different surface is created (`BackendObject_DirectGLES.cpp:969-972`, `:1001-1004`). glretrace's `resize()` recreation therefore already costs a context today.
+
+## 3. Tests and gates that pin today's behaviour
+
+| Test / gate | Location | What it pins | Effect of the goal / D8 |
+|---|---|---|---|
+| `WindowBackendAndWireWindowKindMapExplicitlyBothWays` | `MG_Test/Wire/SurfaceControlFrameTest.cpp:193-228` | Mapping table, including X11 and Win32 | Needs a ServerOwned row [V] |
+| `EveryFramedOpRoundTripsThroughTheWireEnvelope` | `SurfaceControlFrameTest.cpp:230-274` | **X11 plus token 0xDEADBEEF decodes as None** | Breaks under D8 [V] |
+| `AnAndroidNativeWindowOnTheWireIsRefusedByName`, `AMetalLayerOnTheWireIsRefusedByName`, `AWireWindowKindThatNamesNoBackendFailsDecodeByName` | `:320-390` | Current refusals | Keep [V] |
+| `ServerLoopEglTest.SuccessfulVoidWireOperationsReplyWithSuccessAndOriginalSequence` | `ServerLoopTest.cpp:1713-1740` | `SetWindowHandle` with `WindowKind::None` answers ok | Breaks under D8 [V] |
+| PeerLatchTest rows | `PeerLatchTest.cpp:1249-1261`; sender at `:476-495`, token 0x1234 | AndroidNativeWindow and MetalLayer latched | Add X11, Win32, ServerOwned-without-a-window [V] |
+| S5 | CONTRACT-P6 `:597` | Requires X11 to be refused and "token never reached `UnpackWindowHandle`" | **Not implemented**; only the AndroidNativeWindow row exists [V] |
+| `ph_latch_sites.py` | `scripts/ci/ph_latch_sites.py:65-67` | `"SurfaceOp.windowBackend"` declared unreachable | Still true if the codec keeps mapping [V] |
+| `fatal_census` | `scripts/ci/fatal_census_baseline.json:65` | Family `UnmigratedSurface` already present | New refusal strings in that family need no new family [V] |
+| `protocol_revision_pin` | `scripts/ci/protocol_revision_pin.py`, pins json | Revisions 1 and 2 only | Any `protocol.fbs` append needs a bump plus `--write` [V] |
+| `spawn_lane_parity` | `scripts/ci/spawn_lane_parity.py:34`, `:43` | Split and Spawn case sets must match | A device-only on-screen arm must be named there or kept outside the `integration-*` labels [V] |
+| Pbuffer bring-up tests | `ServerSpawnTest.cpp:994-1070`, `ServerLoopTest.cpp:1627`, `:1871`, `:1936`, `:2188` | Pbuffer bring-up only | Stays green (offscreen default) [V] |
+
+## OPEN QUESTIONS / RISKS
+
+1. **D8 is specified but not landed.** Landing it breaks two existing tests (see §3). Should it ship before or together with ServerOwned? [V]
+2. **Espryt's size gap.** The client default FBO stays at 512x512 and a client window's `eglQuerySurface` returns 0. The server window's size needs a return path: `kEventSurfaceChanged` with W/H, plus an update of the client EGL state's surface size. [V]
+3. **Readback after swap on a window surface is undefined** (`EGL_BUFFER_DESTROYED`). The retrace snapshot timing in `apitrace_fbo_dump.cpp` has not been checked, so goldens could break on the on-screen path. [I]
+4. **Present pacing.** A vsync-blocked server swap slows credit return (`MOBILEGL_IPC_PRESENT_CREDIT`). This is good for display, but on-screen benchmark numbers are not comparable to offscreen ones. [I]
+5. **Server-side hazards.** `ForgetCurrentTuple` after a surface is (re)created (`ServerLoop.cpp:1136`, `:1150`) and the DirectGLES process-global `g_Surface` interact with any SurfaceView `surfaceDestroyed`/`surfaceChanged` that happens mid-session. [I]
+6. **The pbuffer-to-window mapping, if silent, is a semantic lie** (EGL state says pbuffer, the swap really presents). It must be an explicit, logged mode that `runtime_mode_proof`-style gates can prove. [I]
+
+## MINIMAL CHANGE LIST
+
+- **`MG_Remote/Protocol/protocol.fbs:249`**: append `ServerOwned = 7`. Bump `MOBILEGL_PROTOCOL_CONTROL_REVISION` (`mg_protocol_base.h`), regenerate `protocol_generated.h`, run `protocol_revision_pin.py --write`.
+- **`MG_Backend/BackendObject.h:569-577`**: add `WindowBackend::ServerOwned` before `WindowBackendCount`. The range check in `ServerLoop.cpp:1039-1048` follows automatically.
+- **`Protocol/SurfaceOpCodec.cpp`**:
+  - add both mapping rows (`:102-123`);
+  - move the out-of-range upper bound from MetalLayer to ServerOwned (`:178-179`) and the `static_assert` (`:58`);
+  - implement D8: X11 and Win32 give `UnmigratedSurface` "X11@P12"/"Win32Hwnd@P12"; `None` on a window op and `nativeToken != 0` give `ProtocolCorruption`, with latches next to `:217-235`;
+  - refuse a ServerOwned op when the server has no window (named).
+- **`Client/BackendObject_Remote.cpp:210-244`**:
+  - when the new knob is set on spawn/tcp, send CreateWindowSurface / ServerOwned with token 0 and skip `ServerSetWindowHandle` (`:215`);
+  - for a pbuffer, carry the client's w and h as the requested geometry;
+  - mirror the refusal of `AndroidNativeWindow`/X11 on the client, before sending (CONTRACT-P6 §7.3).
+- **`Config.h` ~`:596` and `ConfigLoader.cpp` ~`:433`**: add the knob (e.g. `MOBILEGL_IPC_SURFACE=offscreen|server`, default `offscreen`) and log it in the IPC line (`:476-484`).
+- **`Client/ClientSession.cpp:306-347`**: when a surface-changed event carries W/H for the session's server-owned surface, also resize the client EGL state's surface (`state->ResizeSurface`, as used at `EGLImpl.cpp:724`).
+- **`DirectGLES.cpp:15947-15950`**: publish the surface width and height (currently format only). Server side, and needed so the client's default FBO stops being 512x512.
+- **Server side** (other slices; listed for completeness):
+  - `ServerLoop.cpp:1126-1151`: a ServerOwned arm that substitutes the APK's `ANativeWindow` and calls `setBuffersGeometry`;
+  - `BackendObject.cpp:232-238` register point and `BackendObject_DirectGLES.cpp:962-964` `sameHandle` key;
+  - a CreateEGLWindowSurface arm per backend (DirectGLES `:955`, Vulkan `BackendObject_DirectVulkan.cpp:424`).
+- **Trace tooling** (optional): no glws change is needed for approach B, because it maps pbuffers. Update the help text in `run_android_retrace_local.py:604-611` and `device_bench/p6/README.md:117-120`.
+- **Tests**:
+  - update `SurfaceControlFrameTest.cpp:193-274` (X11 becomes a refusal, add a ServerOwned row) and `ServerLoopTest.cpp:1713-1740` (drop `SetWindowHandle`/`None` from the "void ok" list);
+  - add PeerLatch rows for X11, Win32 and ServerOwned-without-a-window (this is S5);
+  - add a unit test proving the client knob's encode, and a device-only TcpDevice on-screen smoke test named in `spawn_lane_parity.py`.
\ No newline at end of file
diff --git a/docs/Disaggregated/notes/p12/map-docs-contract.md b/docs/Disaggregated/notes/p12/map-docs-contract.md
new file mode 100644
index 00000000..5289dc12
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/map-docs-contract.md
@@ -0,0 +1,139 @@
+# Design docs and contracts for a server-owned on-screen window (P12 subset)
+
+Paths are relative to `C:\Users\geekerwan\AndroidStudioProjects\FoldCraftLauncher\MobileGL-disagg\` at 9f669e52. **[V]** means I read it in the doc or code. **[I]** means it is my inference.
+
+## 1. Decisions already made about the server-owned window
+
+- **P12 scope was made smaller** [V] (`docs/Disaggregated/ROADMAP.md:46`, `P6-ENDSTATE-REVIEW.md:313`, row 6):
+  - The Surface-passing half is deleted: no Java `Surface` → Messenger/AIDL → `ANativeWindow_fromSurface`.
+  - The server app owns its own SurfaceView and the client has no window. The docs say minSdk 26's lack of an NDK call to flatten an `ANativeWindow` "no longer matters, since nothing needs flattening".
+  - P12 items, verbatim:
+    - an appended `WindowKind::ServerOwned`;
+    - one `CreateEGLWindowSurface` arm per backend;
+    - the four `m_windowHandle` stores plus the `sameHandle` dedup key;
+    - DirectGLES `g_Display/g_Surface/g_Context` de-globalisation;
+    - the `kEventSurfaceChanged` Width/Height gap;
+    - the client stops sending `SetWindowHandle` unconditionally;
+    - the server listens on `unix:` and `tcp://`;
+    - server lifecycle bound to the Activity;
+    - the freezer;
+    - multi-context;
+    - the FCL env / plugin switch table.
+- **Rule H is permanent** [V] (`MobileGL/MG_Remote/CONTRACT-P6.md:43-45`, ENDSTATE:400). A value from the peer's window system never crosses, "not until P12". P12 gives the *server* its own display. So the `AndroidNativeWindow@P12` and `MetalLayer@P12` refusals stay forever. Rule G (CONTRACT-P6:31-37) allows only tokens.
+- **Append timing** [V] (CONTRACT-P6:448-449): "Do not append `WindowKind::ServerOwned` in P6… P12 appends it." Today the enum ends at `MetalLayer = 6` (`protocol.fbs:239-250`), so the new value is 7.
+- **Where to latch the window** [V] (CONTRACT-P6:458-466; `docs/Disaggregated/notes/p6/a6-audit-rows.md:292`):
+  - one substitution at `RegisterEGLWindowSurface` (`MG_Backend/BackendObject.cpp:235`);
+  - one refusal at the wire `SetWindowHandle` case (now `Server/ServerLoop.cpp:1232-1241`);
+  - one preserve in `ResetEGLRuntimeState` (`:365`);
+  - a new `sameHandle` key (`BackendObject_DirectGLES.cpp:962-964`) based on the surface token, not the window pointer (A8-10, rows:307).
+- **Other a6 rows owned by P12** [V]:
+  - A8-5 and A8-6 (rows:302-303): two `MakeEGLCurrent` paths reach `ActivateEGLSurface` → `SetWindowHandle(surfaceState->Window)` (`BackendObject.cpp:283`) with no wire op in front.
+  - A8-7 (rows:304): a pbuffer create or a client release zeroes the window.
+  - A8-8 (rows:305): the Width/Height writes at `:206-207` are dead today and become a clobber in P12.
+  - A8-15 (rows:312): a client `eglTerminate` must not zero a Service-owned window.
+  - Review additions (rows:331-332): the incoming-handle allow-lists at `BackendObject_DirectGLES.cpp:955-960` and `BackendObject_DirectVulkan.cpp:415-419` would refuse every create unless re-keyed.
+  - A4-32 (rows:180): `SetWindowHandle` is a redundant blocking round trip.
+- **Default-framebuffer shape** [V]: `kEventSurfaceChanged` is the only carrier. `SurfaceReply.defaultFb` is burned (CONTRACT-P6:75).
+- **Magma is closer** [V] (ENDSTATE:313): rotation and preTransform are already server-side and keyed on the server's own surface.
+- **Where the offscreen boundary came from** [V] (`P6-CONTRACT-DRAFT.md:104-109`; `P6-SPAWN-PLAN.md:36-42`; `CONTRACT-P65.md:7`): pbuffer / surfaceless is the P6 and P6.5 path, and real windows are excluded.
+- **P12 acceptance gates** [V] (ROADMAP:46):
+  - (a) FCL, same-machine spawn, Adreno 830, both backends in-world; killing the server gives a clean device-lost latch.
+  - (b) a client on another machine over TCP reaches in-world on the Redmi, and the P6.5 mandatory numbers are recorded.
+- **TLS** is kept as an open P12 item [V] (ROADMAP:279).
+
+## 2. Constraints and gates the new path must satisfy
+
+| Constraint | Source [V] | What it means here |
+|---|---|---|
+| G1: pull build 0/0/0/0 symbols, `.text` unchanged (`0xa52203`) | ROADMAP:15, :113; CONTRACT-P6:570; STATUS:23 | `BackendObject*.cpp`, `DirectGLES.cpp` (`g_*` at :15814-15817) and `MG_Impl/Init.cpp` compile into the pull build. Edits need `#if MOBILEGL_BUILD_DISAGGREGATED` with the pull arm byte-identical. Precedent: `BackendObject_DirectGLES.cpp:974-977` |
+| G2/G14: test names may only be added | ROADMAP:15 | New lanes are additive |
+| S5 named refusals | CONTRACT-P6:597; tests `SurfaceControlFrameTest.cpp:366,:388`, `PeerLatchTest.cpp:1250-1257` (`Outcome::Latched`) | AndroidNativeWindow and MetalLayer must stay refused |
+| Handshake answers with `Refuse`, never aborts | CONTRACT-P6:249-257; CONTRACT-P65:15 | `RefuseCode` is append-only (`protocol.fbs:74-84`, max `MalformedHello = 8`) |
+| Fatal census | CONTRACT-P7:79 | Scan roots include `MG_Backend`. `abort_sites` is a down-ratchet (79). Every `Fatal{Word` needs a `FatalFamilies.def` row; `UnmigratedSurface` already exists (:65) |
+| Link ratchet at 171; a rising commit is refused | CONTRACT-P7:138; CONTRACT-P6:704-710 | Server-side code must not start calling client-only symbols |
+| fbs is append-only; commit the generated header; flatc-check | CONTRACT-P6:93-102 (`Create*` arity trap); ARCHITECTURE:396-397 | Use builders with explicit `add_*` if appending table fields |
+| Control-schema revision | `Protocol/mg_protocol_base.h:54-68` | Bump 2 → 3 and run `protocol_revision_pin.py --write`. `wireFingerprint` moves (`CapsCodec.cpp:480-485`), so the APK and the client redeploy together. An old server sends a new client no Refuse (CONTRACT-P7:182) |
+| No branching on link kind above `Transport/` | ARCHITECTURE:451; CONTRACT-P6:640-641 | On-screen vs pbuffer must not be keyed off tcp vs shm |
+| One session at a time (`Refuse{Busy}`); one guest per process | CONTRACT-P65:45; CONTRACT-P6:726-734 (D9: `eglTerminate` is process-wide) | — |
+| TCP arrival order | CONTRACT-P65:39 | `SurfaceReply.eventHead` is how `SurfaceChanged` delivery is ordered today |
+| Control-reply bound | CONTRACT-P6:334-340 | 5000 ms, reset by a `SurfaceProgress` every 250 ms, capped at 120 s. A server blocked waiting for `surfaceCreated` must heartbeat or it reads as "alive but silent" |
+| Arm proof (ID-124) and red-once per package (R-16) | CONTRACT-P6:575-577; ROADMAP:12 | Each lane must log which arm actually ran |
+| Offscreen stays a gate | CONTRACT-P7:111 (gate 3 runs `--use-pbuffer`) | This path must survive unchanged |
+| Don't fix `dev` bugs in passing | ROADMAP:16 | — |
+
+## 3. Documented lifecycle expectations
+
+- **Activity-bound lifecycle** is named but not specified [V] (ROADMAP:46).
+- **Freezer** [V]: SPAWN-PLAN:53 and :113 say the full handling is P12's and the diagnostic is P6's; `P6-CONTRACT-DRAFT.md:128-129` says the same. CONTRACT-P6:329-340 rules that a frozen peer gets a named diagnostic, not a device-lost latch. No doc defines what P12's "full handling" is.
+- **Death** [V]: the latch comes only from `PeerHungUp()`, never from a timeout (CONTRACT-P6:310-312, :371-378). `MOBILEGL_IPC_RESPAWN=1` is a named refusal (CONTRACT-P6:312).
+- **Today's form** [V]:
+  - a foreground `dataSync` Service in `:mglsrv` (trace manifest:11-15) that exec's the supervisor, which forks one child per session (CONTRACT-P65:45, :49; ROADMAP:103);
+  - clean client close is a half-close (CONTRACT-P65:47);
+  - `onDestroy` destroys only the supervisor, so session children leak. This finding is explicitly deferred "→ P12" (`notes/p65/code-review-findings.md:9`; `MobileGLServerService.java:96-101`).
+- **EGL teardown hazard** [V]: "Espryt teardown kills the process-default EGL display, so the bench must never share a process with the POST UI" (main `AndroidManifest.xml:25-28`).
+
+## 4. What the docs require be recorded when this lands
+
+- [V] ROADMAP P12 row status plus a milestone entry (the pattern at :230-231); `CURRENT_STAGE_STATUS.md` on every merge, push or device window (:3); red-once per package in notes (CONTRACT-P7:138); the five-part stage-exit gate (ARCHITECTURE §13.2); one Codex review at stage close (ROADMAP:17).
+- [V] A comment row in `mg_protocol_base.h` plus the pins json.
+- [I] Dispositions for a6 rows A8-3…A8-15 and for CONTRACT-P6 §7.2 D8.
+- [I] By precedent: a new `MG_Remote/CONTRACT-P12.md` and an integrator decision log (the ID-P7-n pattern).
+- [I] Rewrite ARCHITECTURE §15.2. Do not edit ENDSTATE; it says it is frozen (:22).
+
+## 5. Contradictions between docs and the tree that matter here
+
+1. **Stale P12 path.** `ARCHITECTURE.md:526` still describes the deleted Surface → AIDL → `:mgl` → `ANativeWindow_fromSurface` path. `protocol.fbs:258` still says "Android transfers the window out of band".
+2. **Process name.** The docs say `:mgl` (ARCHITECTURE:526, CONTRACT-P6:667, SPAWN-PLAN:122). The tree uses `:mglsrv` (trace manifest:15).
+3. **The D8 whitelist and the client-side mirror did NOT land** [V]:
+   - `SurfaceOpCodec.cpp:113-123` and `:165-185` still accept X11, Win32Hwnd and None and copy `nativeToken`.
+   - `ServerLoop.cpp:1050-1058` casts it to `void*`.
+   - The string `"X11@P12"` exists only in CONTRACT-P6:440.
+   - `BackendObject_Remote.cpp:215` still posts `SetWindowHandle` unconditionally, with no client refusal.
+   - Consequence: a WSL client that announces X11 sends an XID straight into Android's `eglCreateWindowSurface`.
+4. **Abort vs latch.** ROADMAP:46 says the first `eglCreateWindowSurface` "aborts" the server. Since Ph it latches the session instead (`ServerMain.cpp:363` arms the latch; `SurfaceOpCodec.cpp:215-219`).
+5. **IPC order.** ROADMAP:19 has P6.5 → Ph → **P12** → P9. `CURRENT_STAGE_STATUS.md:73` and HANDOFF:22 have P9 → P10 → P11 → P12.
+6. **Rule H.** `CURRENT_STAGE_PROGRESS.md:244` describes P12 as "real windows cross processes", which Rule H contradicts.
+7. **Drifted line numbers.** The DirectGLES `SurfaceChanged` site is now `DirectGLES.cpp:15939-15950`, not :15793-15805. It still posts format only with W/H = 0, so the client keeps the 512×512 placeholder (`MG_Impl/Init.cpp:30-38`). The ServerLoop citations moved (:875-882 → :1050-1058; :1015 → :1232). The BackendObject.cpp citations still resolve.
+8. **Death knobs.** ARCHITECTURE:533 describes RESPAWN / IDLE_EXIT as working; CONTRACT-P6:305-312 says they are parsed nowhere.
+
+## OPEN QUESTIONS / RISKS
+
+1. **[I, critical] Process topology.** "Server app owns a SurfaceView, nothing to flatten" only holds if rendering runs inside the ART process that owns that Surface. Today's server is an exec'd native child forked per session, and on minSdk 26 it cannot get that `ANativeWindow`. The options are:
+   - run the session in-process (via JNI), which runs into D9 (`eglTerminate` is process-wide) and the manifest's warning that Espryt teardown kills the process-default EGL display;
+   - have the child render into AHardwareBuffers and pass them over SCM_RIGHTS for the Activity to present;
+   - some other approach. No doc decides this.
+2. **Choosing the mode per session is undecided.** Options: a supervisor flag, a `Hello`/`Welcome` field, or a caps bit. Any schema field means another revision bump.
+3. **Same-phone gate (a):** if the server app is in the foreground, FCL is backgrounded, and neither input forwarding nor the freezer's effect on the *client* is in any doc.
+4. **Server-initiated resize or rotation** has no RPC to carry `eventHead` (CONTRACT-P65:39). The Width/Height `SurfaceChanged` would only be seen at the client's drain points.
+5. The freezer's "full handling" is undefined.
+6. [I] The `dataSync` foreground-service type may be time-limited on newer Android versions.
+7. Multi-context and `g_*` de-globalisation are probably unnecessary while there is one session per process.
+
+## MINIMAL CHANGE LIST
+
+- **`MG_Remote/Protocol/protocol.fbs`:** append `ServerOwned = 7` to `WindowKind`; regenerate `generated/protocol_generated.h`; any mode field is appended the same way.
+- **`Protocol/mg_protocol_base.h:68`:** `MOBILEGL_PROTOCOL_CONTROL_REVISION` → 3, plus a comment row; update the pins json.
+- **`Protocol/SurfaceOpCodec.cpp`:**
+  - update the static_assert (:58) and the `IsOutRange` bound (:178-179);
+  - accept `ServerOwned` only with `nativeToken == 0` and only on a display-owning server; otherwise a named refusal;
+  - land D8 (refuse X11, Win32Hwnd and None).
+- **`MG_Remote/Client/BackendObject_Remote.cpp:210-216`:**
+  - drop `ServerSetWindowHandle`;
+  - send `CreateWindowSurface` as `ServerOwned` when the server announces a display;
+  - otherwise keep today's offscreen path.
+- **`Server/ServerLoop.cpp`:** in `UnpackWindowHandle` (:1050), substitute the server's window for `ServerOwned`; `SetWindowHandle` (:1232) becomes a named no-op or refusal.
+- **`MG_Backend/BackendObject.cpp`:** substitute at :235, preserve at :365, ignore client extents at :206-207. All under `#if` so G1 holds.
+- **`BackendObject_DirectGLES.cpp:955-964`:** new allow-list and a `sameHandle` keyed on the surface token.
+- **`BackendObject_DirectVulkan.cpp:415-419`:** the equivalent allow-list change.
+- **`DirectGLES.cpp:15939-15950`:** fill Width/Height from `eglQuerySurface` when the server owns the window.
+- **android-plugin (trace flavour):**
+  - add an Activity with a SurfaceView and the window hand-off chosen in Open Question 1;
+  - add a mode extra on `MobileGLServerService`;
+  - fix the `onDestroy` child leak.
+- **Tests:** keep S5. Add red-once tests for:
+  - `ServerOwned` with a non-zero token;
+  - `ServerOwned` sent to an offscreen-only server;
+  - the X11 whitelist.
+
+  Add an arm-proof log line `window=server-owned|pbuffer`.
+- **Docs:** see §4, and fix the contradictions in §5, items 1, 2, 5 and 6.
\ No newline at end of file
diff --git a/docs/Disaggregated/notes/p12/map-server-surface.md b/docs/Disaggregated/notes/p12/map-server-surface.md
new file mode 100644
index 00000000..197ecc0e
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/map-server-surface.md
@@ -0,0 +1,150 @@
+# Server-side surface path and both backends' window surfaces (commit 9f669e52)
+
+Everything below was read in code unless it is marked **[INFER]**. Nothing was edited or built.
+
+## 1. How the control/surface ops travel today [VERIFIED]
+
+**Wire schema**
+- `SurfaceOpKind` is 0..11 (`protocol.fbs:218-237`). `WindowKind` is `None=0, AndroidNativeWindow=1, X11=2, Win32Hwnd=3, Surfaceless=4, Pbuffer=5, MetalLayer=6` (`:239-250`). Both are append-only.
+- `SurfaceOp` carries `seq, kind, display, surface, windowKind, nativeToken, width, height, swapInterval, readSurface, context` (`:252-268`). The comment says "Android transfers the window out of band" (`:258`).
+- `SurfaceReply.defaultFb` still exists in the schema (`:275`), but the encoder writes 0 (`SurfaceOpCodec.cpp:192-193`) and CONTRACT-P6.md:75 calls the slot burned.
+- `SurfaceProgress` is at `:351-354`.
+
+**Client emission**
+- Every `Server*` forwarder builds a `SurfaceControlFrame` (`ServerLoop.cpp:1289-1404`) and calls `RunSurfaceControlFrame`.
+- Under spawn or tcp, `m_remoteSink` routes the frame to `ClientSession::RunRemoteSurfaceControlFrame` (`ServerLoop.cpp:793-795`, `ClientSession.cpp:1205-1249`). An encode error there comes back as `MOBILEGL_ERR_UNSUPPORTED` (`:1217-1226`).
+- `BackendObject_Remote::CreateEGLWindowSurface` always sends `ServerSetWindowHandle(handle)` first and then `ServerCreateEGLWindowSurface` (`BackendObject_Remote.cpp:215-216`). There is no split check.
+- SwapBuffers is never forwarded (`:279-288`). Present travels as a class-B record.
+- The frame is values only, and a compile-time binding enforces it (`SurfaceControlFrame.h:75-100`, `:113-114`). The four inproc-only kinds are 12..14 plus `InitCapabilities=11` on the wire (`:46-73`, `SurfaceControlFrame.cpp:34-54`).
+
+**Server intake**
+- Path: `ServerMain.cpp:594-612` → `ServerApplyWireSurfaceOp` (`SurfaceOpCodec.cpp:207-246`) → `DecodeWireSurfaceOp` (`:150-188`) → `ServerLoop::RunSurfaceControlFrame` (`:785-807`), which posts to the apply thread or runs inline if already on it (`:803`) → `ApplySurfaceControlFrame` (`:1097-1283`).
+- `OpNeedsAWindowBackend` is true only for CreateWindowSurface and SetWindowHandle (`SurfaceOpCodec.cpp:60-62`).
+- For a pbuffer, the encoder fills in `WindowKind::Pbuffer` itself (`:133-135`).
+
+**Dispatch in `ApplySurfaceControlFrame`**
+- A null backend answers `NOT_INITIALIZED` for every op (`:1110-1111`).
+- **CreateWindowSurface**: `UnpackWindowHandle` (`:1050-1058`) turns the token back into a `void*`, then calls `backend->CreateEGLWindowSurface` and `ForgetCurrentTuple` (`:1126-1138`).
+- **ResizeWindowSurface** (`:1139-1143`) and **CreatePbufferSurface** (`:1144-1151`) call the matching backend method.
+- **MakeCurrent**: `ApplyMakeCurrent`, then a CapsSnapshot republish on a native bind (`:1152-1188`).
+- **ReleaseCurrent**: recorded, not forwarded (`:1189-1200`).
+- **SetSwapInterval**: `:1201-1204`.
+- **ReleaseSurface**: `:1205-1216`.
+- **ReleaseResources**: `ReleaseEGLResources` plus `SetContextLive(false)` (`:1217-1231`).
+- **SetWindowHandle**: `backend->SetWindowHandle` (`:1232-1241`).
+- **InitCapabilities**: `:1242-1254`.
+- **Present**: `ServerVerbSink::OnPresent` → `table->Present()` (`PipeApplier.cpp:313-331`), then the present credit is returned (`:357-359`).
+
+**Refusals, by name**
+- `Fatal{UnmigratedSurface,"AndroidNativeWindow@P12"}` for AndroidNativeWindow on a window op (`SurfaceOpCodec.cpp:166-171` and `:217-223`).
+- `Fatal{UnmigratedSurface,"MetalLayer@P12"}` (`:172-175`, `:224-228`).
+- `WindowKindNamesNoBackend` for Surfaceless/Pbuffer on a window op, and `UnknownWindowKind`; both become `Fatal{ProtocolCorruption,"SurfaceOp"}` (`:176-182`, `:229-235`).
+- `SurfaceOp.windowBackend` for an out-of-range tag (`ServerLoop.cpp:1039-1048`).
+- `SurfaceOp.kind` for an unknown kind (`:1279-1282`).
+- `ApplyThreadNotRunning` (`:815-831`).
+- In an armed session child all of these latch the session instead of aborting (`SurfaceOpCodec.cpp:211`, `:215-216`).
+- **The X11 refusal is not in the code.** X11, Win32Hwnd and None are accepted, and their token is copied through (`:183-184`). CONTRACT-P6.md:438-446 specifies `X11@P12` and `Win32Hwnd@P12`; they never landed.
+- The client-side mirror of the Android refusal (CONTRACT-P6.md:451-456) is also missing: there are no `@P12` hits under `MG_Remote/Client`.
+
+## 2. Backend window surfaces [VERIFIED]
+
+**Base class, `BackendObject`**
+- `WindowBackend {Android, X11, MetalLayer, Win32, Count, Unknown=-1}` (`BackendObject.h:569-577`); `WindowHandle` (`:579-584`); `SurfaceKind {None, Window, Pbuffer}` (`:616-620`).
+- `CreateEGLWindowSurface` = `RegisterEGLWindowSurface` + `ActivateEGLSurface` (`BackendObject.cpp:191-194`).
+- Register refuses Unknown/null (`:227-230`) and stores `surfaceState.Window = handle` (`:232-238`).
+- Activate calls `SetWindowHandle(surfaceState->Window)` (`:283`), then `InitWindowSurface()` (`:284`). For a pbuffer it calls `InitPbufferSurface(w,h)` (`:288-292`).
+- MakeCurrent activates lazily (`:318-323`, `:332`).
+- **Stores to `m_windowHandle`:** `:475` (SetWindowHandle), `:365` (ResetEGLRuntimeState), and `:206-207` (Resize, width/height only; nothing reads those).
+- `SwapEGLBuffers` → `Present()` (`:396`).
+
+**DirectGLES (Espryt)**
+- `InitWindowSurface` casts `m_windowHandle.Handle` → `DirectGLES::InitWindowSurface` (`BackendObject_DirectGLES.cpp:899-907`).
+- `CreateEGLWindowSurface` checks the window backend (`:955-960`). The **sameHandle** dedup key (`:962-967`) requires the same surface, kind Window, and the same Backend and Handle. Otherwise it runs `DestroyEGLContext` + `ResetEGLRuntimeState` (`:969-972`).
+- Process globals `g_Display/g_Context/g_Surface/g_Config` (`DirectGLES.cpp:15814-15817`).
+- `InitDisplayAndContext` destroys the old context first (`:16159`), then `eglGetDisplay(EGL_DEFAULT_DISPLAY)` (`:16177`). The config has a single surface bit (`:16085`).
+- `InitWindowSurface` → `eglCreateWindowSurface` (`:16230`) → MakeCurrent → publish (`:16225-16241`). The pbuffer twin is `:16243-16258`.
+- `Present` → `eglSwapBuffers(g_Display, g_Surface)`, **return value ignored** (`:16842`).
+- `DestroyEGLContext` destroys the surface and context and calls `eglTerminate` (`:16907-16919`).
+- Resize is not overridden (`BackendObject_DirectGLES.h:39-44`), so it only updates bookkeeping.
+- **Width/Height gap:** `PublishDefaultFramebufferDepthStencilFormat` posts `MGPSurfaceInfo` with the format only, W/H = 0 (`DirectGLES.cpp:15850-15852`, `:15943-15950`). `QueryCurrentSurfaceSize` exists (`:15819-15837`) but is not used for publishing.
+
+**DirectVulkan (Magma)**
+- `CreateEGLWindowSurface` only registers (`BackendObject_DirectVulkan.cpp:418-431`). The real creation happens at the client's MakeCurrent: `Activate` → `InitWindowSurface` → `VulkanRenderer(nativeWindow)` (`:337-352`).
+- `InitPbufferSurface` uses a config with `SurfaceWidth/Height` and a null window (`:354-365`).
+- Resize → `RequestSwapchainResize` (`:433-446`, `VulkanRenderer.cpp:16533-16542`).
+- Window: `vkCreateAndroidSurfaceKHR` (`VulkanRenderer.cpp:16196-16202`).
+- Offscreen on Android: headless surface (`:16112-16121`), otherwise **an AImageReader ANativeWindow** (`:16129-16158`).
+- Swapchain extent = `currentExtent`, or the clamped desired extent when currentExtent is UINT32_MAX (`SwapchainObject.cpp:194-202`). Quarter-turn swap (`:204-207`). `preTransform = currentTransform` (`:234`).
+- `OnSurfaceChanged` carries **Width/Height** plus format (`:323-339`).
+- On present: OUT_OF_DATE, or an extent/transform change (`VulkanRenderer.cpp:16501-16531`), → `RecreateSwapchain` (`:14381-14418`) → re-publish. Zero area sets `m_presentSuspended` (`:14386`). `VK_VERIFY` aborts on any other present or acquire result (`:14394`, `:14456`).
+
+**How the size and format reach the client**
+- `ServerOnSurfaceChanged` → `kEventSurfaceChanged` (`ServerSession.cpp:483-499`, installed at `:827-828`).
+- `ApplySurfaceChangedToClient` (`ClientSession.cpp:306-347`): if W/H ≠ 0 it reallocates all three attachments (`:316-338`); otherwise it changes the format only (`:339-346`).
+- The client drains after create, resize and make-current (`BackendObject_Remote.cpp:224`, `:233`, `:272`).
+
+## 3. What the device split path renders into today [VERIFIED]
+
+- The trace app forces a pbuffer for spawn (`trace_replay_jni.cpp:173-188`). apitrace creates a pbuffer sized `ResolveWidth/Height` (`apitrace_glws_android.cpp:198-219`).
+- `EGLImpl.cpp:458-469` passes `EGL_WIDTH/EGL_HEIGHT` (default 1) → frame width/height → server `InitPbufferSurface(w,h)`.
+  - Espryt: `eglCreatePbufferSurface`.
+  - Magma: a headless surface or an AImageReader swapchain at w×h.
+- Present on Espryt is `eglSwapBuffers` on a pbuffer (a no-op). On Magma it is `vkQueuePresent` to a surface nobody sees.
+- The service exec's `libMobileGLServer.so --serve` (`MobileGLServerService.java:60-61`). The supervisor forks one child per session (`ServerMain.cpp:985`, `:1123`). The child runs `RunSession` (`:268`, `[[noreturn]]`), sets `Transport=Spawn` (`:356-358`) and calls `InitServerRoleForSpawn` (`:377`).
+- This whole pbuffer chain is what must stay.
+
+## 4. What `WindowKind::ServerOwned` needs on the server
+
+- **Injection point [VERIFIED as the natural seam].** Substitute the server's window token in `ServerApplyWireSurfaceOp`, after decode and before `RunSurfaceControlFrame` (`SurfaceOpCodec.cpp:243`). Downstream nothing changes: `UnpackWindowHandle` → Register (`:232`) → Activate → SetWindowHandle (`:283`), which is exactly the inproc path today.
+- **sameHandle** (`BackendObject_DirectGLES.cpp:962-964`) then compares the server's pointer with the server's pointer and dedups correctly. The concern a6 §6(d) raised disappears.
+- **Present:** unchanged. The Present record → `DirectGLES::Present` `eglSwapBuffers` on the window surface, or Magma `vkQueuePresentKHR` on the real swapchain.
+- **Size and rotation**
+  - Magma already reports window resize and rotation (`SwapchainObject.cpp:323-339`); rotation is compensated inside the server via preTransform.
+  - Espryt reports nothing (§2 gap).
+  - Resize requests from the client do not move the extent on either backend. Espryt only updates bookkeeping; Magma uses currentExtent. A client-requested size therefore has to be applied to the window itself: `ANativeWindow_setBuffersGeometry` or Java `SurfaceHolder.setFixedSize`, which is the lever the code comment names (`VulkanRenderer.cpp:14402-14405`).
+- **Window absent:** an absent window must be checked both when CreateWindowSurface is decoded and when the surface is activated, because on Magma activation is deferred to MakeCurrent (`BackendObject.cpp:319`, `:332`).
+- **Existing precedent:** the codebase refuses by name and never falls back silently (`ServerLoop.cpp:180-186`, `:824-831`).
+
+## OPEN QUESTIONS / RISKS
+
+1. **Process topology is the main blocker [INFER].** An ANativeWindow from a SurfaceView is a Binder proxy living in the APK's JVM process. The server is an exec'd binary that forks one child per session, and neither exec nor fork carries a usable window (Binder does not survive fork). The options:
+   - (a) Run the session in-process via JNI, in a dedicated `android:process` that is restarted per session. `RunSession` exits the process when it ends, and `ServerLoopInstance` is a leaked singleton (`ServerLoop.cpp:980-984`).
+   - (b) Pass a Parcel to the exec'd child. This needs API 34 and a binder route to a native process; impractical.
+   - (c) Keep the server offscreen and send `AHardwareBuffer`s over the existing AF_UNIX socket (API 26) to an APK-side presenter.
+2. **Selection knob.** Should the mode be client-driven (the client sends ServerOwned) or a server environment policy? Should a client pbuffer be allowed to go on-screen?
+3. **Espryt Width/Height publishing.** Publishing W/H through the transport arm switches the client to the reallocating arm (`ClientSession.cpp:316-338`), which is a divergence from monolith. It should be gated to ServerOwned only.
+4. **Initial viewport and client default-FB extent.** Does the frontend's initial viewport or the default-FB extent depend on the 512×512 placeholder? That is another slice.
+5. **Losing the window mid-session.**
+   - Espryt: destroying `g_Surface` destroys the context as well (`DirectGLES.cpp:16907-16919`). Parking on a pbuffer would need `g_*` de-globalisation and a config with both WINDOW and PBUFFER bits (`:16085`).
+   - Magma: it aborts on `SURFACE_LOST` (`:14394`), and `vkCreateAndroidSurfaceKHR` failure is `VK_VERIFY` rather than a `false` return.
+   - Espryt ignores the `eglSwapBuffers` error (`:16842`).
+6. **`surfaceDestroyed` threading.** Teardown must be serialized onto the apply thread before the Java callback returns.
+7. **Unrelated gap.** The X11/Win32/None hole in CONTRACT-P6 §7.2 is still open.
+
+## MINIMAL CHANGE LIST
+
+- **`protocol.fbs:249`**: append `ServerOwned = 7` and regenerate. **`SurfaceOpCodec.cpp`**:
+  - Add a static_assert for the new value; widen the `IsOutRange` bound (`:178-179`).
+  - In the decoder, add a ServerOwned arm before the Android refusal. It requires `nativeToken==0` (otherwise `Fatal{ProtocolCorruption,"SurfaceOp.nativeToken"}`) and sets `windowBackend=Android`.
+  - In `ServerApplyWireSurfaceOp`, fill the token from the provider. Add a new `SurfaceWireError::ServerWindowAbsent` that answers `ok=false`, is logged by name, and does not latch; the client then gets `EGL_BAD_NATIVE_WINDOW` (`EGLImpl.cpp:153-156`).
+  - Encoder (client side): under spawn/tcp, map `WindowBackend::Android` → ServerOwned with token 0, and send the client's desired w/h.
+- **New `Server/ServerWindowProvider.{h,cpp}`**:
+  - A process-wide holder, `SetServerOwnedWindow(ANativeWindow*)` with acquire/release, a generation counter, and `ApplyGeometry(w,h)`.
+  - It is set by the APK's JNI before a session starts; no window means the ServerOwned path is refused.
+  - This is the "both paths" switch: pbuffer ops are untouched.
+- **`SurfaceControlFrame.h/.cpp`, `ServerLoop.cpp`**:
+  - Append an inproc-only `ServerWindowLost` kind (15), posted by the provider on `surfaceDestroyed`.
+  - Its dispatch releases the surface and latches through a new `FatalFamilies.def` row (e.g. `ServerWindowLost`).
+  - Recheck the provider at activation (`BackendObject.cpp:283-284`) or in `UnpackWindowHandle` (`ServerLoop.cpp:1050-1058`).
+- **`DirectGLES.cpp`**:
+  - `:15947-15950`: fill W/H from `QueryCurrentSurfaceSize` when the surface is a server-owned window.
+  - `:16842`: check the `eglSwapBuffers` result, re-query the size after the swap, and call `OnSurfaceChanged` when it changed.
+  - `g_*` de-globalisation is not needed while there is one backend per session process.
+- **`VulkanRenderer.cpp:14394`, `:14456`, `:16202`**: turn `SURFACE_LOST` and a failed surface creation into named latches instead of aborts. The on-screen path itself needs nothing new, because `InitWindowSurface` already takes a real window.
+- **`BackendObject_DirectGLES.cpp:962-967`**: no change once the token is the server's.
+- **`ServerMain.cpp`, `MobileGLServerService.java`, JNI**: decide the topology in risk 1. Option (a) needs an in-process entry point without fork; the service is gated by environment or intent extras.
+- **Tests**:
+  - `SurfaceControlFrameTest.cpp:125-163`, `:236-249`, `:323`, `:376` (enum bounds).
+  - `PeerLatchTest.cpp:1250-1257`: add ServerOwned rows (absent, nonzero token).
+  - `ServerLoopTest`: a lost-window control.
+- **Client (another slice)**: `BackendObject_Remote.cpp:215` currently sends the client pointer unconditionally. With the encoder mapping above it becomes harmless.
\ No newline at end of file
diff --git a/docs/Disaggregated/notes/p12/p203.sh b/docs/Disaggregated/notes/p12/p203.sh
new file mode 100644
index 00000000..34b6c4b5
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/p203.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+unset DISPLAY WAYLAND_DISPLAY
+for t in pipe p12-onscreen; do
+  echo "== $t"
+  cd /home/swung/w7/$t/build-split || continue
+  ctest -R "DirectVulkan.Split.Full.IterationRPProgram203Scenario" -V --timeout 300 2>&1 \
+    | grep -E "SKIPPED|PASSED|FAILED|OK \]|Test command|MOBILEGL_|tests passed|tests failed" | head -14
+done
diff --git a/docs/Disaggregated/notes/p12/setup-tree.sh b/docs/Disaggregated/notes/p12/setup-tree.sh
new file mode 100644
index 00000000..7c2a16e6
--- /dev/null
+++ b/docs/Disaggregated/notes/p12/setup-tree.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# setup-tree.sh <slug> <base-sha> <itest-port>: package worktree ~/w7/p12-<slug> on branch p12/<slug>,
+# submodules copied from pipe, build-split (disaggregated) + build-linux (pull, for G1) configured and built.
+set -euo pipefail
+SLUG=$1; BASE=$2; PORT=$3
+PIPE=$HOME/w7/pipe; TREE=$HOME/w7/p12-$SLUG
+export MOBILEGL_FLATC_EXECUTABLE=/home/swung/w7/flatc-build/flatc
+if [ ! -e "$TREE/.git" ]; then git -C "$PIPE" worktree add -b "p12/$SLUG" "$TREE" "$BASE"; fi
+git -C "$TREE" submodule status | while read -r st path _; do
+  want=${st#[-+U ]}
+  [ -z "$(ls -A "$TREE/$path" 2>/dev/null)" ] || continue
+  have=$(git -C "$PIPE/$path" rev-parse HEAD 2>/dev/null || true)
+  if [ "$have" = "$want" ]; then
+    rm -rf "$TREE/$path"; cp -a "$PIPE/$path" "$TREE/$path"; rm -f "$TREE/$path/.git"; echo "copied $path"
+  else
+    echo "submodule update $path"; git -C "$TREE" submodule update --init --recursive -- "$path"
+  fi
+done
+[ -d "$TREE/3rdparty/glslang/External/spirv-tools" ] || cp -a "$PIPE/3rdparty/glslang/External" "$TREE/3rdparty/glslang/"
+# LFS fixtures: copy the hydrated copies from pipe (never git lfs pull; see lfs-fixture-policy).
+git -C "$TREE" ls-files -z tools/trace_replay/fixtures | while IFS= read -r -d "" f; do
+  if head -c 40 "$TREE/$f" 2>/dev/null | grep -q git-lfs && ! head -c 40 "$PIPE/$f" | grep -q git-lfs; then
+    cp "$PIPE/$f" "$TREE/$f"
+  fi
+done
+git -C "$TREE" ls-files -z tools/trace_replay/fixtures | xargs -0 -r git -C "$TREE" update-index --assume-unchanged
+COMMON=(-G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
+        -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+        -DMOBILEGL_ITEST_VK_ICD=/usr/share/vulkan/icd.d/lvp_icd.json
+        -DMOBILEGL_BUILD_TEST=ON -DMOBILEGL_BUILD_INTEGRATION_TEST=ON -DMOBILEGL_FORCE_RELEASE_OPT=ON -DMOBILEGL_BUILD_BENCHMARK=OFF)
+cmake -S "$TREE" -B "$TREE/build-split" "${COMMON[@]}" -DMOBILEGL_BUILD_DISAGGREGATED=ON \
+      -DMOBILEGL_BUILD_DISAGGREGATED_INPROC=ON -DMOBILEGL_PIPE_PUSH=ON \
+      -DMOBILEGL_ITEST_TCP_ENDPOINT="tcp://127.0.0.1:$PORT" > "$TREE/cfg-split.log" 2>&1
+cmake -S "$TREE" -B "$TREE/build-linux" "${COMMON[@]}" -DMOBILEGL_BUILD_DISAGGREGATED=OFF \
+      -DMOBILEGL_BUILD_DISAGGREGATED_INPROC=OFF -DMOBILEGL_PIPE_PUSH=OFF > "$TREE/cfg-linux.log" 2>&1
+set +e
+ninja -C "$TREE/build-split" -j 24 > "$TREE/build-split.log" 2>&1; echo "split rc=$?"
+ninja -C "$TREE/build-linux" -j 24 > "$TREE/build-linux.log" 2>&1; echo "linux rc=$?"
+readelf -S -W "$TREE/build-linux/libMobileGL.so" | awk '$2==".text"{print "G1 base text:", $6}'
+echo "=== SETUP DONE $TREE ==="