- the forgotten mapping's next-frame write must also miss the server; the re-announce must ship the latest write
- the case is left out of the ambient, Verify, VerifySplit and Magma Full registrations, where it only skipped
- DirectVulkan.Split pins MOBILEGL_IPC_ADOPT_TIER=2 for it, so its emulated declaration holds
- snapshots doubled the cache restore (25 to 52 s) and device-offline retries went from 3 to 10
- the AVD job boots the new AVD once and powers it off; retrace jobs cold-boot it as before
- the AVD job boots the new AVD once per GPU mode and saves a snapshot into the cache
- retrace jobs load their mode's snapshot, log whether it loaded, and skip SDK setup on a hit
- scripts/ci/retrace_verify_reason.py holds the retrace-verify control's reason check, a plain search for Fatal{PipeVerifyDiffer, "GetRenderStateParameters@ (run_trace_case.cmake prints the library log through message(STATUS), which never re-wraps, so the old prefix stripping and whitespace collapse are gone); the workflow step and test_run_trace_case.py both run it, so the test can no longer pass on a copy
- canned reds carrying a different Fatal (Fatal{UnmigratedPipeInput, "GetPixelStoreParameters@ReadPixels"}) or the comparator's divergence on another field (Fatal{PipeVerifyDiffer, "GetPixelStoreParameters@ReadPixels"}) must fail the check
- skip_census.py check --require LANE: an optional lane the run took the path for is red when absent, and a name the baseline lacks is red too; self-test cases
- skip-census needs build-guard and reads integration-split's new defaults-on output: any verdict but identical requires unit-split, arm-inproc and arm-monolith, and unproven IPC defaults require the two arm rows
- when transport_pinned.py cannot prove the exclusion, the inproc-acceptance leg runs every entry under its own JUnit stems, integration-all and integration-staged-copy-all
- skip_census.py: an optional row with "instead_of" stands in for a trimmed lane; when it ran, that lane may be absent, and it is required otherwise; self-test on a fallback-shaped directory (green, and red on a vanished name, a new skip or neither lane); write from a fallback run keeps the row of the lane the fallback stood in for
- skip census: two optional -all rows for the inproc-acceptance leg, names borrowed from the monolith-control rows and skip lists equal to the old inproc-acceptance lists (285 and 49)
- the integration legs compute the ctest selection only on the disaggregation branches, which are the only ones that read it
- a new build-guard job configures both Linux lines on one runner (configure only, disaggregation branches) and outputs identical, different or unknown with its runner image and compiler; it is continue-on-error at job level, so it never fails the run, and it takes MOBILEGL_CI_DISAGGREGATED from build-linux's branch expression, so a drifted branch list gives different
- build_fingerprint.py guard: one shared FetchContent directory (normalised as @DEPS@) so only the first configure fetches, a failed configure, or one killed with its process group after 10 minutes, retried once, and unknown for a configure that failed twice, any error or too little evidence; different is a warning annotation and unknown a notice, each with its first reasons; the toolchain is recorded, not compared; self-test cases for both sides thin, no libMobileGL.so link, a hung configure, the retry after a failure and after a timeout, the annotations, the shared directory and every verdict
- build-linux-split builds nothing only on identical, and the consumers take build-linux's artifacts only then; different and unknown keep both builds, the full split matrix, A/B and the split unit run, and no consumer can red on a disagreement
- build-linux drops its probe and runs the link ratchet on every disaggregation build as link-ratchet-primary; integration-split reds on it when it takes that build and prints both jobs' image and compiler
- build-linux exports its build type, and the split consumers refuse to reuse a build-linux that is not Release (split_reuse_build_type.sh, self-test in pipe-gates): a debug-logging re-run of failed jobs keeps the guard's Release verdict
- configure_build.sh passes extra arguments through to cmake
- the split fixture fails an armed Split/Spawn/Tcp entry whose process did not resolve the transport its registration claims, or whose server is not where the claim says: a thread here for inproc, a process of its own for spawn and tcp (SplitRuntimePeek now names spawn, reads ClientSession::PeerServerPid() and this process's pid, _getpid() on Windows; an unknown own pid leaves only that comparison unjudged)
- SplitLaneHarness.TransportClaimRule, a GL-free unit test, proves the rule red and green on canned inputs; skip census: added to junit-integration-split-strict/unit-strict (test/unit and unit-split borrow that list)
- integration-split drops its post-hoc grep of one entry's log; the step keeps the IPC default proof as 'Default-knob resolution check', on the disaggregation branches only, and a strict default that changed falls back to Transport A/B like the other two
- with build-linux reused, retrace-split runs its spawn rows plus OpenRA's inproc rows (the wire evidence); the other 75 inproc rows are replayed by the retrace job's inproc-acceptance rows on the same library
- trace_cases.py: github-split-matrix takes --transports and --keep-inproc; the self-test proves the spawn rows unchanged and every dropped inproc row an inproc-acceptance row; only a narrowed matrix that comes out empty raises, so the workflow's named error for an empty full subset still prints
- trace-cases: the spawn-only subset is only a saving, so a failed self-test or an empty result is a warning, the output is not written and retrace-split takes the full subset
- run_trace_case.cmake: MGTRACE_EXPECT_IPC (a harness name) requires the client's IPC line to carry the listed tokens; retrace-split legs prove strict=0 role-split-state=1 run-ahead=1 and a changed default reds every leg with the rows to restore; the acceptance rows prove strict=1 role-split-state=1 run-ahead=1 and gain the refusal census; canned tests in test_run_trace_case.py
- on the disaggregation branches the dual-block census step's first run leaves MOBILEGL_IPC_ROLE_SPLIT_STATE at its default, which makes its environment the strict split lane's; the step proves per entry that strict, the dual block and run-ahead resolved on, and makes the strict lane's checks on that run
- junit_tally.py --select-from/--write-selected carves the integration-split part out of dualblock.xml as strict-split.xml, every name exactly once (exit 3 otherwise); tests in tcp_lane_tools_test.py
- 'Strict split lane' runs on dev only; 'Magma split lane' is skipped when the dual-block run proved its defaults, since that run covers the label in the same environment; a changed default reruns the census with the knob set
- the inproc-acceptance leg excludes, by exact name, every integration-gpu entry whose own ENVIRONMENT sets MOBILEGL_TRANSPORT (inproc, spawn and monolith pins) and the fixtures only they require; their pin overrides the one variable the legs differ in, so the monolith-control leg's run is the same run
- transport_pinned.py selects them, proves the trimmed ctest selection lost exactly that set (or the leg runs everything, with a warning rather than an error), and proves in the monolith-control leg that every one of them ran; self-test in pipe-gates
- skip census: junit-integration-monolith-control-monolith/integration and integration-staged-copy get their own name lists; the inproc-acceptance lanes drop the pinned names (3628 -> 1450, 888 -> 336); arm-monolith and arm-inproc borrow from monolith-control
- build-linux and build-linux-split each probe the other's configure line with build_fingerprint.py on their own runner (disaggregation branches only); when it matches, build-linux-split skips its compile and the split consumers take build-linux's runtime and library
- the consumers red when build-linux-split skipped but build-linux's guard did not agree, or when the link ratchet, now also run in build-linux, did not pass; a difference falls back to the old two builds, and dev is unchanged apart from the consumers also waiting for build-linux
- the transport resolution check moves after 'Split lanes' and proves the IPC defaults from each passed entry's client log (split_log_paths.py ipc-config, canned tests); with both proven, Transport A/B and the non-strict split unit run are skipped as repeats
- the test job carries REQUIRE_GPU and libegl-mesa0 on the three branches; skip census: arm-monolith, arm-inproc and unit-split become optional rows
- a baseline row may carry "optional": "<reason>": the lane's absence is a note, and when it runs it is checked like any other lane
- write keeps an optional row (names resolved) when the run did not produce that lane, and keeps the reason on rows it rewrites
- self-test: an absent optional lane is green, a present one with a new skip is red, a plain lane stays required
- scripts/ci/configure_build.sh holds build-linux's (primary) and build-linux-split's (split) configure lines, flag for flag as before
- scripts/ci/build_fingerprint.py compares two configured trees (cache, compile commands, link statements, CTest files, toolchain) with the build path normalised and the benchmarks left out; its guard configures a probe through the script and never counts thin evidence as equal
- pipe-gates runs its self-test; no job uses the guard yet
- Strict split lane: drop the kMGPipeP5eRunAheadReady grep and its red-by-design pre-flip arm; the constant is true, so the arm never ran
- Dual-block census lane: drop the "green with rows outstanding" rule, inert while dualblock-expected-fatals.txt is empty; the empty-census rule and expect-fatal stay
- delete scripts/ci/tcp_log_forwarding_control.py, which nothing calls
- integration-verify: drop control B, whose pair the in-lane PoisonOmitted entries already pin with a stricter check; the arming grep becomes junit_tally --require-entry-passed on the six VerifyArming, VerifyCorrupted and PoisonOmitted entries (a skip fails)
- integration-verify-split: drop the server-side-read rerun and control B; the same check covers the eight VerifySplit control entries, which assert those properties in-test
- controls A and A2 stay: nothing in-lane covers the FATAL=1 abort half or the capability field
- retrace-verify: the corrupted-snapshot control must go red with its own Fatal{PipeVerifyDiffer, "GetRenderStateParameters@"; test_run_trace_case.py proves the check on canned output
- MG_IntegrationTest/CMakeLists.txt: the comments on the VerifySplit control entries say how CI now checks them
- PoisonOmissionScenario.cpp: WithoutOmissionCompletes is described as the ambient half of the pair, and its failure note no longer names a CI step
- 'Split lanes' keeps its first ctest's exit code beside split-baseline.xml; the controls step tallies that JUnit (DirectGLES.Split. entries) with the same refusals instead of re-running 802 entries, on every branch
- the rerun stays as the fallback when the lane step never ran, the case where the baseline was the only run of those entries
- smoke cases: reuse, fallback, a red exit code under a green JUnit, and a JUnit with no DirectGLES.Split. entry
- skip census: retire lane junit-integration-split/isplit (nothing borrows it; split-baseline covers the names)
- MOBILEGL_IPC_E2_DROP_DRAW and MOBILEGL_IPC_E2_DROP_CLEAR leave the shipped emitter with their per-draw and per-clear branches, setters, counters and per-frame evidence line; nothing sets them since the dropped-draws control left CI
- the wire-volume assertion on the OpenRA split legs replaces the control (758 DrawVbo records and 758/788 server draws locally, both backends, inproc and spawn)
- retire the unit case RemoteEmitTable.TheE2DropSwitchStartsDisarmed, which only toggled the clear setter; skip census: removed from junit-integration-split-strict/unit-strict (test/unit and unit-split borrow that list)
- retrace-split loses its two negative controls, which re-ran every leg (~68 runner-min per run), and its dependency on the monolith-control artifact; the in-test evidence check from the previous commit replaces them
- build-linux-monolith-control keeps its zero-MG_Remote proof and its upload; on the disaggregation branches the new retrace-shipped job replays OpenRA on both backends through that library (elsewhere the retrace job's library has that shape), so the shipped shape is still replayed on every branch
- delete retrace_transport_control.sh, retrace_drop_draw_control.sh, their smoke cases and stub modes, and the uncalled redcheck_control_smoke_test.sh
- control-runtime/build-push-control leaves the eleven metadata loops; remove-artifact-clutter waits for retrace-shipped
- run_trace_case.cmake writes output/split-evidence.txt only after its transport assertions pass
- MGTRACE_WIRE_EVIDENCE (a harness name) turns on the library's counters and requires DrawVbo records on the wire and draws on the server role
- retrace-split's OpenRA legs ask for wire evidence; every split leg, and every inproc retrace row, checks its evidence file with retrace_split_evidence.py
- test_run_trace_case.py runs the real script on canned logs: each assertion goes red on its bad log, and pipe-gates runs it
- the first ubuntu-26.04 unit run failed 41 log-reading cases: 239 raw cores from intentional aborts filled /tmp, and the library's log writes then failed silently
- setup-test-runner pipes cores through a zstd handler that keeps honouring each process's RLIMIT_CORE; steps keep their ulimit -c and lose their own core_pattern lines
- the unit job prints free disk space and the core count after its run
- test hooks stay out of production code: ShaderCompiler::BuiltinsPrewarmed() existed only for ShaderPrewarmTest and is gone
- Initialize() logs at INFO whether it prewarmed the built-in tables or skipped them for MOBILEGL_DISABLE_SHADER_PREWARM; the test reads that line from a private log file
- still red with the knob's gate removed and with Destroy's latch reset removed; passes on the split and monolith builds
- ubuntu-latest moves to 26.04 job by job from 2026-10-19 to 11-19; a build on one image and its tests on the other would fail on glibc, so all 32 jobs move together now, pinned
- the ccache keys say ubuntu26: the 24.04 compiler's objects would not hit anyway
- the unit and integration lanes set MOBILEGL_DISABLE_SHADER_PREWARM=1: every entry is its own process and none compiles enough to repay ~100 ms of table building
- the retrace legs and the benchmark keep the prewarm; they replay or measure real application startup
- locally the unit suite took 71 s with it set against 101 s without, all 3114 entries passing both ways
- Initialize() still prewarms glslang's built-in tables by default; a truthy MOBILEGL_DISABLE_SHADER_PREWARM skips it, for short-lived processes that never repay the ~100 ms
- ShaderPrewarmTest covers the default, a truthy and a falsy value, and the latch Destroy clears; red with the gate removed and with the reset removed
- the prewarm comments said both parses share one table; glslang picks it from each shader's own #version, so they build 460 core and 330 core
- the four runtime tarballs (0.5-0.8 GB each) took 65-100 s to pack with single-threaded gzip, two of them on the critical path, and every consumer spent about 16 s unpacking
- unit, integration and integration-verify ctest run at -j nproc; the same labels already run at -j in the split lanes, with the same names and results
- build-linux, -split and -verify also publish the library (and the server image) alone; the retrace legs load nothing else, yet downloaded and unpacked the 0.5-0.8 GB test runtime
- build-retrace no longer waits for build-linux: it fetched the runtime only to test -f a path configure does not read
- every branch saves its own rolling ccache entry, deleting only its own old one (--ref); only dev saved, and dev has not run since the key rename, so every build was cold
- !cancelled() replaces job-level always() on the retrace, summary and skip-census jobs: a superseded run kept starting its pending legs and held the next run in the concurrency group for up to 154 minutes
- retrace and retrace-split run 8 legs at a time, not 4; the cap dates from per-leg LFS checkouts
- apt requests time out after 30 s and retry 3 times; install steps time out at 15 minutes, not 45
- the APK trace case matrix no longer waits for the build, which it does not read
- retrace-split prepares its metadata once, after the split library is unpacked
- the red controls ran spawn_lane_parity and junit_tally main() uncaptured, so every passing run showed their ::error:: line as a failure annotation on the pipe-gates job
- quiet_main captures a gate's output; each red control now also asserts the reason it printed
- ServerLoopEglLatchTest.AGuiltyReset... failed 8 times in CI under load (exit 8): d1b3a332 fixed the race, but its waits still had 2 s deadlines a slow runner could reach
- every wait now ends on its event and is bounded by 10 s, which only a failing run reaches
- "the GUILTY record is never applied" is no longer a 2 s wait for a record that must not come: the test waits for the latched apply thread to leave its loop, joins it, then reads the applied seq; the case takes about 40 ms instead of 2 s
- still red as its comment says: no LatchIfGpuFaulted in the apply loop exits 6, an INNOCENT reset that latches sets bit 1
- MOBILEGL_DEBUG_INJECT_DEVICE_LOST_PID=file:<path> takes the pid from a file read at every ask, so a running server can be aimed, as the Android property already can
- CompositorRecovery and ClientRecovery's pid-targeted case aim it once their target says it got there (its first frame; current): under load the 100 ms clock lost the compositor inside its first make-current
- the knob's comment no longer promises an ordering a clock cannot keep
- FatalFunnelSeam.TheSessionLossKnobTakesAPidOrAFileThatHoldsOne covers both forms
- the file-size baseline drops by the 83 lines the previous commit moved out of PipeApply.cpp
- PipeDeviceLossKnobs.cpp holds MGPipeDebugDeviceLossDue and MGPipeDebugSessionLossDue as they were; PipeApply.cpp keeps the session-fail seam its comment places there
- EGLSurfaceRegistry owns the display, the surface records, the active surface, each thread's binding and the one recursive lock; BackendObject holds one and is its hooks, so the EGL virtuals keep their signatures and their defaults
- the backends reach it through EGLRegistry(): lookups return copies, and the steps they compose (adopting an already-bound surface, a window's surfaces, a window's new extent) are named operations instead of writes to protected fields
- WindowBackend and WindowHandle move with it
- BackendObjectEglStateTest only re-points its accessors; the same 235 mutants, carried over, get the same verdicts except three that need a kind-None record, which no call can make, and one that cannot be written against the registry
- comments that cited BackendObject.cpp line numbers name the function
- BackendObjectEglStateTest: 90 cases over the display, the surface records, the active surface, each thread's binding, the capability probe, the deferred destroy and the locking, driven through a double with no device; every hook is logged with its thread and the state it saw from inside
- the double reads the base's state only in a few accessors, so moving the bookkeeping re-points them and no case
- checked against 235 hand-made mutants of the bookkeeping: every one is caught except those that cannot change an outcome, one that is undefined behaviour and three that only drop an outer lock
- ServerHooks and ClientHooks (BackendRoles.h) hold the virtuals that only the server, or only a client of a remote server, calls, with the defaults they had; BackendObject::AsServer and AsClient return them, or null for a backend without the role
- DirectGLES and DirectVulkan implement ServerHooks, BackendObject_Remote implements ClientHooks, and the test doubles that run as a server's backend take the server role
- every call site keeps its answer: where no backend and a backend without the role answered differently, the backend check stays and the role check gives the old default
- ServerLoop::BackendHooks is the server's accessor, asked at each use
- comments that placed the function table in BackendObject.h name BackendFunctions.h
- BackendFunctions.h holds GLFunctionsTable, GlobalBackendFunctionsTable, CopyImageEndpoint, the sync and query handles and the present damage; files that only call through the table include it instead of the backend object
- SharedImageTypes.h holds the shared-image structs
- FormatCapabilities.cpp holds the BackendCaps.h helpers that BackendObject.cpp defined
- gen_pipe.py reads the table from its new header
- two comments that cited a BackendObject.cpp line name the function instead
- A process-wide map keyed by GL name gave a deleted texture's flag to the
next texture created under the recycled name.
- The flag is now texture object state, so it dies with its texture.
- The 19 calls that bound their texture first now share object cores with the target forms
- GL 4.6 rules the binding hid: cube maps in TextureSubImage3D and level queries, named target errors
- GenerateTextureMipmap and CopyTextureSubImage2D emit the records their target slots emit
- RemoteEmitTable.TheThreeClassesPartitionAllSeventyOneSlots is renamed ...PartitionEverySlot
swung0x48