MobileGL

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
swung0x48	8a445a3098	[docs] (P7): every cited feat/disaggregated commit is the rewritten one without the attribution trailer - 144 commits from `785fed0b0` onward were rewritten to drop the Co-Authored-By trailer the project forbids; origin/feat/disaggregated moved from 1135c664 to `3c80cd62` (same trees) - the old->new map is ~/w7/logs/sha-map-20260922.txt; every 7..40-hex citation in the Disaggregated docs and the MG_Remote contracts that matched an old SHA is replaced by the same-length prefix of its rewrite; no other content changes	2026-09-22 20:51:15 -04:00
swung0x48	db62d674d0	[MG_Remote] (P6/lk): regroup RingControl by writer, and make the asserts that pin it falsifiable The shared control page both roles map had a mixed-writer cache line: {appliedSeq, submittedSeq, retiredSeq, completedFrameSerial, presentAckSerial} sat together, but submittedSeq is producer-written (Ring.h's "THE FIVE WATERMARKS") while the other four are consumer-written. That is why no single-writer progress block could be aliased over it, and it is what this package fixes: submittedSeq moves up beside cmdHead, the other thing the producer writes, and the four that remain become a named LinkProgress member - the struct c6 declared in ILink.h - so a data plane with no shared page can own the same four values and every wait predicate in SessionRings.h keeps ONE implementation at source level. The two event flags deliberately stay in the doorbell group. Promoting them would put the client's per-drain exchange(0) on eventRingFull (EventRing.h:200) onto the line the client's own spin predicate reads 1e5-1e6 times a frame. 73 call sites rewritten, 15 in the library and 58 in tests. The rewrite is receiver-scoped rather than field-scoped, because SplitRuntimePeek.h:77 has its own struct with a field of the same name and SplitRuntimePeek.cpp:146 has both on one line - a field-scoped rename would have silently broken the peek struct that MagmaRunAheadScenario reads nine times. THE ASSERTS ARE THE PART THAT NEEDED A SECOND PASS. The first revision shipped four aggregate asserts and an adversarial review broke them by counterexample: swapping retiredSeq and completedFrameSerial inside LinkProgress compiled clean, passed all four, and passed the runtime layout test too - because appliedSeq stays at offset 0. Three wire-visible offsets on a shared page were pinned by nothing. Nothing else in the tree covers it either: the ABI fingerprint takes no input from this page, and sizeof(RingControl) is 4096 whatever the members do, because alignas(4096) makes it so. So the block is now per-field as CONTRACT-P6 §8.3 actually asked, plus a standard-layout precondition, a tail bound that alignas cannot satisfy for us, and the LinkEventFlags mirror. Each was run red: the field swap reds the per-field asserts by name, a fifth member inside LinkProgress reds sizeof. One of them cannot go red, and Ring.h now says so rather than implying otherwise. A SMALL member inserted between Progress and serverEpoch lands at offset 288, inside Progress's own line, and serverEpoch's alignas(64) absorbs up to 32 bytes of it - so both line asserts still pass. The review's proposed fix does not catch it either; I tried it. A gate nobody can falsify is worse than no gate, so the limit is written down beside the asserts. Also: RingTest.ControlPageLayoutIsTheSharedContract said nothing about the one field this package moved, and now asserts the producer/consumer separation and the event flags' exclusion itself rather than borrowing the claim from Ring.h. Ring.h grew 30 lines, so the Ring.h:NN citations this package and c6 authored are re-anchored to named blocks instead of line numbers. ARCHITECTURE.md §11.2 is updated for the new layout, and a factual error introduced in the previous revision of that paragraph - submittedSeq annotated as releasing staging, which retiredSeq does - is corrected. Gates: pull 0 added / 0 removed, .text size 10822147 unchanged; split 0/0, .text size 11681395 unchanged; unit suite 2326/2328 with the same two pre-existing environmental failures as the baseline. The five edits behind MGITEST_SPLIT_RUNTIME_PEEK were proven compiled by a red-once, not assumed. Note on the .text claim: that is a SIZE, not the bytes - field offsets moved, so immediates moved with them. And this page's layout IS observable across binaries; what is unobservable is behaviour within one binary. The contract already books the layout change deliberately, before spawn exists to care.	2026-09-21 09:23:48 -04:00
swung0x48	99649a9087	[MG_Remote] (P6/lk): the pre-flight itemisation, and a correction to c6's regroup design CONTRACT-P6 §8.5 requires lk to publish its blast radius before it starts, because an earlier draft's ratchet baseline was wrong by a factor of three and a ratchet installed on the wrong number is red on its first CI run for reasons that have nothing to do with a leak. The itemisation is mechanical, per file, with the grep spelling stated: 250 seam-identifier references outside Transport/ across 23 files (127 production, 123 test), and 44 member-access sites that the regroup itself must rewrite, across 9 files - 17 of them in MG_IntegrationTest, which is why lk builds with the integration tests ON. The earlier build did not, and a missed edit there would have been green. THE CORRECTION. Measuring that radius turned up a mistake in c6, landed two commits ago. §8.3 and ILink.h both said lk should promote eventRingFull and eventDropped into the watermark group and called the result single-writer. eventRingFull has TWO writers: the server latches it with store(1) when SEG_EVENT fills (EventRing.h:140) and the CLIENT clears it with an exchange(0) on EVERY DRAIN (:200). Promoting it would put a per-drain read-modify-write by the client on the same cache line as appliedSeq - which the server release-stores every 64 records and the client's spin predicate reads 1e5-1e6 times a frame. That is new false sharing on the hottest line in the system, and it would land in exactly the numbers this package's gate has to hold constant. It is also the same class of error the earlier draft made with submittedSeq, one field over. So LinkProgress is now the four consumer-written watermarks and nothing else - genuinely single-writer - and the two flags stay in the doorbell/generation group, where mixed writers already live beside consumerParked/producerParked, crossing the seam through a separate EventFlags() accessor on its own line. The contract records the correction and its reasoning rather than quietly restating the rule. ALSO CORRECTED, from running the baseline suite: a6's link-experiment report said the silently-empty build stamp had "no log and no gate to say so". That is false. SessionHandshakeTest.cpp:140 asserts BuildStamp[0] != '\0' and :180 asserts that perturbing it changes the fingerprint, and BOTH GO RED in this configuration right now - the worktree's .git holds a Windows path WSL's git cannot resolve, so GIT_COMMIT_HASH_SHORT is "". The finding is therefore stronger, not weaker: the gate that catches it already exists and is already red. What is silent is the BUILD, and hs owes a named configure-time failure rather than a new gate. Baseline for lk, recorded: 3878 tests, two failures, both environmental and understood - the fingerprint one above, and PipeCatalogue.FrontendNeverTakes- AnApplierAddress, which walks up from cwd looking for MobileGL/MG_Impl and so fails for any out-of-source build directory. No behaviour change. The headers are still included by nothing.	2026-09-21 08:54:48 -04:00

8a445a3098

[docs] (P7): every cited feat/disaggregated commit is the rewritten one without the attribution trailer

- 144 commits from 785fed0b0 onward were rewritten to drop the Co-Authored-By trailer the
  project forbids; origin/feat/disaggregated moved from 1135c664 to 3c80cd62 (same trees)
- the old->new map is ~/w7/logs/sha-map-20260922.txt; every 7..40-hex citation in the
  Disaggregated docs and the MG_Remote contracts that matched an old SHA is replaced by the
  same-length prefix of its rewrite; no other content changes

2026-09-22 20:51:15 -04:00

swung0x48

db62d674d0

[MG_Remote] (P6/lk): regroup RingControl by writer, and make the asserts that pin it falsifiable

The shared control page both roles map had a mixed-writer cache line:
{appliedSeq, submittedSeq, retiredSeq, completedFrameSerial, presentAckSerial}
sat together, but submittedSeq is producer-written (Ring.h's "THE FIVE
WATERMARKS") while the other four are consumer-written. That is why no
single-writer progress block could be aliased over it, and it is what this
package fixes: submittedSeq moves up beside cmdHead, the other thing the
producer writes, and the four that remain become a named LinkProgress member -
the struct c6 declared in ILink.h - so a data plane with no shared page can own
the same four values and every wait predicate in SessionRings.h keeps ONE
implementation at source level.

The two event flags deliberately stay in the doorbell group. Promoting them
would put the client's per-drain exchange(0) on eventRingFull (EventRing.h:200)
onto the line the client's own spin predicate reads 1e5-1e6 times a frame.

73 call sites rewritten, 15 in the library and 58 in tests. The rewrite is
receiver-scoped rather than field-scoped, because SplitRuntimePeek.h:77 has its
own struct with a field of the same name and SplitRuntimePeek.cpp:146 has both
on one line - a field-scoped rename would have silently broken the peek struct
that MagmaRunAheadScenario reads nine times.

THE ASSERTS ARE THE PART THAT NEEDED A SECOND PASS. The first revision shipped
four aggregate asserts and an adversarial review broke them by counterexample:
swapping retiredSeq and completedFrameSerial inside LinkProgress compiled
clean, passed all four, and passed the runtime layout test too - because
appliedSeq stays at offset 0. Three wire-visible offsets on a shared page were
pinned by nothing. Nothing else in the tree covers it either: the ABI
fingerprint takes no input from this page, and sizeof(RingControl) is 4096
whatever the members do, because alignas(4096) makes it so.

So the block is now per-field as CONTRACT-P6 §8.3 actually asked, plus a
standard-layout precondition, a tail bound that alignas cannot satisfy for us,
and the LinkEventFlags mirror. Each was run red: the field swap reds the
per-field asserts by name, a fifth member inside LinkProgress reds sizeof.

One of them cannot go red, and Ring.h now says so rather than implying
otherwise. A SMALL member inserted between Progress and serverEpoch lands at
offset 288, inside Progress's own line, and serverEpoch's alignas(64) absorbs
up to 32 bytes of it - so both line asserts still pass. The review's proposed
fix does not catch it either; I tried it. A gate nobody can falsify is worse
than no gate, so the limit is written down beside the asserts.

Also: RingTest.ControlPageLayoutIsTheSharedContract said nothing about the one
field this package moved, and now asserts the producer/consumer separation and
the event flags' exclusion itself rather than borrowing the claim from Ring.h.
Ring.h grew 30 lines, so the Ring.h:NN citations this package and c6 authored
are re-anchored to named blocks instead of line numbers. ARCHITECTURE.md §11.2
is updated for the new layout, and a factual error introduced in the previous
revision of that paragraph - submittedSeq annotated as releasing staging, which
retiredSeq does - is corrected.

Gates: pull 0 added / 0 removed, .text size 10822147 unchanged; split 0/0,
.text size 11681395 unchanged; unit suite 2326/2328 with the same two
pre-existing environmental failures as the baseline. The five edits behind
MGITEST_SPLIT_RUNTIME_PEEK were proven compiled by a red-once, not assumed.

Note on the .text claim: that is a SIZE, not the bytes - field offsets moved,
so immediates moved with them. And this page's layout IS observable across
binaries; what is unobservable is behaviour within one binary. The contract
already books the layout change deliberately, before spawn exists to care.

2026-09-21 09:23:48 -04:00

swung0x48

99649a9087

[MG_Remote] (P6/lk): the pre-flight itemisation, and a correction to c6's regroup design

CONTRACT-P6 §8.5 requires lk to publish its blast radius before it starts,
because an earlier draft's ratchet baseline was wrong by a factor of three and
a ratchet installed on the wrong number is red on its first CI run for reasons
that have nothing to do with a leak. The itemisation is mechanical, per file,
with the grep spelling stated: 250 seam-identifier references outside
Transport/ across 23 files (127 production, 123 test), and 44 member-access
sites that the regroup itself must rewrite, across 9 files - 17 of them in
MG_IntegrationTest, which is why lk builds with the integration tests ON.
The earlier build did not, and a missed edit there would have been green.

THE CORRECTION. Measuring that radius turned up a mistake in c6, landed two
commits ago. §8.3 and ILink.h both said lk should promote eventRingFull and
eventDropped into the watermark group and called the result single-writer.
eventRingFull has TWO writers: the server latches it with store(1) when
SEG_EVENT fills (EventRing.h:140) and the CLIENT clears it with an exchange(0)
on EVERY DRAIN (:200). Promoting it would put a per-drain read-modify-write by
the client on the same cache line as appliedSeq - which the server
release-stores every 64 records and the client's spin predicate reads 1e5-1e6
times a frame. That is new false sharing on the hottest line in the system,
and it would land in exactly the numbers this package's gate has to hold
constant. It is also the same class of error the earlier draft made with
submittedSeq, one field over.

So LinkProgress is now the four consumer-written watermarks and nothing else -
genuinely single-writer - and the two flags stay in the doorbell/generation
group, where mixed writers already live beside consumerParked/producerParked,
crossing the seam through a separate EventFlags() accessor on its own line.
The contract records the correction and its reasoning rather than quietly
restating the rule.

ALSO CORRECTED, from running the baseline suite: a6's link-experiment report
said the silently-empty build stamp had "no log and no gate to say so". That
is false. SessionHandshakeTest.cpp:140 asserts BuildStamp[0] != '\0' and :180
asserts that perturbing it changes the fingerprint, and BOTH GO RED in this
configuration right now - the worktree's .git holds a Windows path WSL's git
cannot resolve, so GIT_COMMIT_HASH_SHORT is "". The finding is therefore
stronger, not weaker: the gate that catches it already exists and is already
red. What is silent is the BUILD, and hs owes a named configure-time failure
rather than a new gate.

Baseline for lk, recorded: 3878 tests, two failures, both environmental and
understood - the fingerprint one above, and PipeCatalogue.FrontendNeverTakes-
AnApplierAddress, which walks up from cwd looking for MobileGL/MG_Impl and so
fails for any out-of-source build directory.

No behaviour change. The headers are still included by nothing.

2026-09-21 08:54:48 -04:00