[CI] (Workflows): run the test and apk lanes on every push to feat/disaggregated

- the MGPipe phases land as a series of pushes and each one needs the full lane; dispatching
  by hand after every merge is a step that gets forgotten
- both entries carry a remove-before-merging-to-dev note: dev's trigger set is what ships

.github/workflows/apk.yml

@@ -6,6 +6,10 @@ on:
       - dev
       - Feat/Backend-Direct-GLES
       - Feat/Backend-Direct-Vulkan
+      # TEMPORARY, remove before merging the MGPipe work into dev: the disaggregation
+      # branch runs the full lane on every push so a phase's landing is not gated on
+      # someone remembering to dispatch the workflow by hand.
+      - feat/disaggregated
   workflow_dispatch:
 
 jobs:

.github/workflows/test.yml

@@ -6,7 +6,19 @@ on:
       - dev
       - Feat/Backend-Direct-GLES
       - Feat/Backend-Direct-Vulkan
+      # TEMPORARY, remove before merging the MGPipe work into dev: the disaggregation
+      # branch runs the full lane on every push so a phase's landing is not gated on
+      # someone remembering to dispatch the workflow by hand.
+      - feat/disaggregated
   workflow_dispatch:
+    inputs:
+      baseline_sha:
+        description: >-
+          The commit monolith-symbol-report compares this tree against. P1's G1 says the pull
+          build is byte-identical to feat/disaggregated@087685d1, and that is what the default
+          names. The trigger set is unchanged: this job runs on workflow_dispatch only.
+        required: false
+        default: "087685d1"
 
 jobs:
   build-linux:
@@ -295,6 +307,399 @@ jobs:
           path: /tmp/core.*
           if-no-files-found: ignore
 
+  # THE THIRD CI MODE (ARCHITECTURE.md 13.2-(2)): the same library, built with the PipeInputs
+  # comparator compiled in, running the integration suite and a trace subset with two state models
+  # in one address space. It is a second build rather than a flag on the first because
+  # MOBILEGL_PIPE_VERIFY is a compile-time option - the snapshot, the entry compare and the
+  # compare-at-read hook do not exist in the shipped library, and are never meant to.
+  build-linux-verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      actions: write
+      contents: read
+    env:
+      BUILD_DIR: build-verify
+      CCACHE_BASEDIR: ${{ github.workspace }}
+      CCACHE_COMPRESS: "true"
+      CCACHE_DIR: ${{ github.workspace }}/.ccache
+      CCACHE_MAXSIZE: 4G
+      CCACHE_NOHASHDIR: "true"
+
+    steps:
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@v1.0
+        with:
+          swap-size-gb: 32
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Get CMake
+        uses: lukka/get-cmake@v4.3.3
+
+      - name: Restore ccache
+        uses: actions/cache/restore@v5
+        with:
+          path: .ccache
+          key: ${{ runner.os }}-test-${{ github.job }}-ccache-v1
+          restore-keys: |
+            ${{ runner.os }}-test-${{ github.job }}-ccache-
+
+      - name: Prepare Vulkan SDK
+        uses: humbletim/setup-vulkan-sdk@v1.2.1
+        with:
+          vulkan-query-version: 1.4.304.1
+          vulkan-components: Vulkan-Headers, Vulkan-Loader
+          vulkan-use-cache: true
+
+      - name: Update glslang external sources
+        working-directory: 3rdparty/glslang
+        run: python update_glslang_sources.py
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ccache clang-20 clang++-20 lld-20 libc++-20-dev libc++abi-20-dev libvulkan-dev libegl1-mesa-dev libgles2-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers ninja-build
+
+      - name: Show installed toolchain
+        run: |
+          ccache --version
+          clang-20 --version
+          clang++-20 --version
+          ld.lld-20 --version || ld.lld --version || true
+          dpkg -l 'libc++*' 'libegl*' 'libgles*' 'mesa*' 'vulkan*' || true
+
+      - name: Configure CMake
+        # Release/INFO like the shipped build on purpose. The poison arms in this configuration
+        # through MOBILEGL_PIPE_VERIFY (PipeInputs.h derives MOBILEGL_PIPE_POISON from it), so this
+        # job needs neither a Debug log level nor MOBILEGL_BUILD_DISAGGREGATED - and a Debug build
+        # would compare a different library from the one the other lanes measure. (build-linux
+        # switches to Debug under ACTIONS_STEP_DEBUG; this job deliberately does not - a Debug
+        # build flips CXX_VISIBILITY_PRESET and arms MOBILEGL_PIPE_POISON through a second, unrelated
+        # arm of its #if, so the debug switch would change what the lane is measuring.)
+        run: |
+          cmake -S . -B "${BUILD_DIR}" -G Ninja \
+            -DCMAKE_C_COMPILER=clang-20 \
+            -DCMAKE_CXX_COMPILER=clang++-20 \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DMOBILEGL_LOG_ACTIVE_LEVEL=MOBILEGL_LOG_LEVEL_INFO \
+            -DMOBILEGL_BUILD_TEST=ON \
+            -DMOBILEGL_BUILD_BENCHMARK=OFF \
+            -DMOBILEGL_BUILD_INTEGRATION_TEST=ON \
+            -DMOBILEGL_ITEST_VK_ICD=/usr/share/vulkan/icd.d/lvp_icd.json \
+            -DMOBILEGL_BUILD_TRACE_REPLAY=OFF \
+            -DMOBILEGL_PIPE_VERIFY=ON \
+            -DCMAKE_POLICY_VERSION_MINIMUM=3.5
+
+      - name: Build
+        run: cmake --build "${BUILD_DIR}" --parallel "$(nproc)"
+
+      # The lane is worthless if the option silently did not take, and that is a one-character
+      # mistake away at all times (a typo'd -D is not an error in CMake). Two checks, both cheap:
+      # the comparator's entry point must be in the library, and the fill entry point with it.
+      #
+      # `nm` and NOT `nm -D`. The library is built CXX_VISIBILITY_PRESET hidden in every non-Debug
+      # configuration (CMakeLists.txt:600-604) and the MGPipe entry points are plain namespace
+      # functions with no export attribute, so not one of them appears in the DYNAMIC table: on a
+      # perfectly healthy verify build `nm -D --defined-only ... | grep -c MGPipe` answers 0 out of
+      # ~11900 exported symbols, and a gate spelled that way is red forever for a reason that has
+      # nothing to do with what it claims to test. The static symbol table has them as local `t`
+      # entries, this artifact is never stripped, and `No MG_Remote in the pull build` below already
+      # uses this spelling. The symbol count guards the remaining hole: a stripped library would
+      # make both greps fail for a third, silent reason.
+      - name: The verify library really carries the comparator
+        run: |
+          test -f "${BUILD_DIR}/libMobileGL.so"
+          defined=$(nm --defined-only "${BUILD_DIR}/libMobileGL.so" | wc -l)
+          if [ "${defined}" -lt 1000 ]; then
+            echo "::error::nm --defined-only sees only ${defined} symbols in ${BUILD_DIR}/libMobileGL.so - it looks stripped, so the two checks below could not have failed honestly"
+            exit 1
+          fi
+          for entry in MGPipeVerifyInputs MGPipeFillForVerb; do
+            if ! nm --defined-only "${BUILD_DIR}/libMobileGL.so" | grep -q "${entry}"; then
+              echo "::error::libMobileGL.so defines no ${entry}: -DMOBILEGL_PIPE_VERIFY=ON did not take, and every lane that consumes this artifact would run the comparator-free library and pass having compared nothing"
+              exit 1
+            fi
+          done
+          echo "libMobileGL.so defines MGPipeVerifyInputs and MGPipeFillForVerb (${defined} defined symbols)"
+
+      - name: Show ccache stats
+        if: always()
+        run: ccache --show-stats
+
+      - name: Release superseded ccache entry
+        if: github.ref_name == github.event.repository.default_branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CACHE_KEY: ${{ runner.os }}-test-${{ github.job }}-ccache-v1
+        run: gh cache delete "${CACHE_KEY}" || true
+
+      - name: Save ccache
+        if: github.ref_name == github.event.repository.default_branch
+        continue-on-error: true
+        uses: actions/cache/save@v5
+        with:
+          path: .ccache
+          key: ${{ runner.os }}-test-${{ github.job }}-ccache-v1
+
+      - name: Package Linux verify runtime
+        run: |
+          mkdir -p ci-artifacts
+          mapfile -t SHARED_LIBS < <(find "${BUILD_DIR}" -type f \( -name '*.so' -o -name '*.so.*' \) -print | sort)
+          tar \
+            --exclude='*/CMakeFiles' \
+            --exclude='*.o' \
+            --exclude='*.a' \
+            --exclude='*.ninja*' \
+            --exclude='build.ninja' \
+            --exclude='cmake_install.cmake' \
+            -czf ci-artifacts/mobilegl-linux-runtime-verify.tgz \
+            "${BUILD_DIR}/CTestTestfile.cmake" \
+            "${BUILD_DIR}/MobileGL/MG_Test" \
+            "${BUILD_DIR}/MobileGL/MG_IntegrationTest" \
+            "${SHARED_LIBS[@]}"
+
+      - name: Upload Linux verify runtime
+        uses: actions/upload-artifact@v7
+        with:
+          name: mobilegl-linux-runtime-verify
+          path: ci-artifacts/mobilegl-linux-runtime-verify.tgz
+          if-no-files-found: error
+
+  # The verify lane itself, plus the two negative controls that keep it falsifiable. The controls
+  # are ALWAYS-ON steps, not a manual exercise: a gate that can only be shown to work by someone
+  # remembering to break it on purpose is a gate that has already stopped working.
+  integration-verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    needs: build-linux-verify
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Get CMake
+        uses: lukka/get-cmake@v4.3.3
+
+      - name: Install runtime dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libvulkan1 libegl1 libegl-mesa0 libgles2 libgl1-mesa-dri mesa-vulkan-drivers
+
+      - name: Download Linux verify runtime
+        uses: actions/download-artifact@v8
+        with:
+          name: mobilegl-linux-runtime-verify
+          path: .
+
+      - name: Unpack Linux verify runtime
+        run: |
+          tar -xzf mobilegl-linux-runtime-verify.tgz
+          test -f build-verify/libMobileGL.so
+
+      - name: Normalize CTest command paths
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import re
+
+          for path in Path('build-verify').rglob('CTestTestfile.cmake'):
+              text = path.read_text()
+              text = re.sub(r'"[^"]*/cmake-[^"]*/bin/cmake"', '"cmake"', text)
+              path.write_text(text)
+          PY
+
+      - name: Integration scenarios under MOBILEGL_PIPE_VERIFY
+        working-directory: build-verify
+        # --no-tests=error is half the gate: the verify entries only exist when the library was
+        # configured with -DMOBILEGL_PIPE_VERIFY=ON, so a build that lost the option matches no
+        # tests and reds here instead of reporting a green run of nothing. The other half is
+        # PipeVerifyArmingScenario.Armed, which fails when the library never printed its arming
+        # line - the failure mode a bare `MOBILEGL_PIPE_VERIFY=1` cannot detect by itself.
+        #
+        # SCOPE, stated so nobody reads more into a green than is there: this is every integration
+        # ENTRY under the comparator, not every integration CONFIGURATION. The `integration` job
+        # runs a second, filtered pass with MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH=1 for the
+        # upload ring's staged-copy tier; that pass is 186 entries here and, at the 5-10x the
+        # comparator costs, is not affordable inside this job's budget. The tier is covered by
+        # `integration`, unverified, and P2 can take it once the comparator's cost is known.
+        env:
+          MOBILEGL_ITEST_REQUIRE_GPU: "1"
+          MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH: "1"
+          MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS: "1"
+          MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER: "1"
+        run: |
+          ulimit -c unlimited
+          sudo sysctl -w kernel.core_pattern='/tmp/core.%e.%p'
+          if [ "${{ secrets.ACTIONS_STEP_DEBUG }}" = "true" ]; then
+            ctest -V -L integration-verify --no-tests=error
+          else
+            ctest --output-on-failure -L integration-verify --no-tests=error
+          fi
+
+      # The arming lanes' logs, and ONLY those. Each lane shares one MOBILEGL_LOG_FILE_PATH and the
+      # library opens it fopen(path, "w"), so after an ambient lane of 400-odd processes the file
+      # holds the LAST one - grepping it would say nothing about the other 405 and would red a
+      # healthy lane whenever the last entry happened not to issue a verb (which is what the
+      # PoisonOmissionScenario parent, the last ambient entry, does by construction: it forks,
+      # execve()s and reads files). The DirectGLES.VerifyArming. / DirectVulkan.VerifyArming.
+      # entries are one process each on a log path nothing else writes, so this grep means exactly
+      # what it says.
+      #
+      # What it proves: arming is a property of (this library, this environment), and these two
+      # processes ran the same library with the same MOBILEGL_PIPE_VERIFY=1 as their ~400 ambient
+      # siblings. It is not, and cannot be, a per-process census - the shared log cannot support one.
+      # It catches the case ctest cannot: an arming entry that SKIPPED still reports green.
+      - name: The verify lanes armed the comparator
+        working-directory: build-verify
+        run: |
+          shopt -s nullglob
+          logs=(MobileGL/MG_IntegrationTest/pipe-verify-arming-*.log)
+          if [ ${#logs[@]} -lt 2 ]; then
+            echo "::error::found ${#logs[@]} pipe-verify-arming-*.log (expected one per backend). The VerifyArming. entries did not run, so nothing in this job establishes that the comparator was ever armed."
+            exit 1
+          fi
+          for log in "${logs[@]}"; do
+            if ! grep -q "MGPipe: verify armed" "${log}"; then
+              echo "::error::${log} carries no arming line: that lane's process ran the whole scenario without the comparator, so every green entry beside it is green for no reason"
+              exit 1
+            fi
+          done
+          echo "arming line present in all ${#logs[@]} arming-lane log(s)"
+
+      # NEGATIVE CONTROL A (gate G4). The knob perturbs one field in the snapshot arm before the
+      # entry compare, so a working comparator must abort the run. This step passes when ctest
+      # FAILS - `if ctest ...; then error` - which is the only shape that can catch a comparator
+      # that silently compares nothing.
+      #
+      # The knob reaches the test process through the JOB environment: no ctest ENVIRONMENT
+      # property on the ambient Verify. entries names it (MG_IntegrationTest/CMakeLists.txt says
+      # so out loud), and a property entry would otherwise override this and the control would
+      # prove nothing. Same precedent as MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH in `integration`.
+      - name: Negative control A - a corrupted snapshot field must turn the lane red
+        working-directory: build-verify
+        env:
+          MOBILEGL_ITEST_REQUIRE_GPU: "1"
+          MOBILEGL_PIPE_VERIFY_CORRUPT: GetRenderStateParameters
+        run: |
+          FILTER='DirectGLES\.Verify\..*ClearThenReadPixels'
+          # An empty selection would ALSO make ctest exit non-zero (--no-tests=error), and this
+          # step reads non-zero as "the control worked" - so the selection is counted first. A
+          # control that passes because it ran nothing is worse than no control.
+          matched=$(ctest -N -L integration-verify -R "${FILTER}" | grep -cE '^ *Test *#[0-9]+:')
+          if [ "${matched}" -lt 1 ]; then
+            echo "::error::negative control A selected ${matched} tests; its filter no longer matches anything"
+            exit 1
+          fi
+          if ctest --output-on-failure -L integration-verify -R "${FILTER}" --no-tests=error; then
+            echo "::error::MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters left ${matched} verify entries GREEN. The comparator is not comparing, so every green entry above is green for no reason."
+            exit 1
+          fi
+          echo "the corrupted field turned ${matched} selected entries red, as it must"
+
+      # NEGATIVE CONTROL B (gate G5). The omission skips the STAMP of one field for one verb while
+      # still copying its value - indistinguishable from a fill row nobody wrote - so the poison
+      # must abort the glGenerateMipmap. Again: this step passes when ctest fails.
+      #
+      # The entry it targets is PoisonOmissionScenario.WithoutOmissionCompletes, which is green in
+      # the ambient lane above and is the ONLY integration entry in the tree that calls
+      # glGenerateMipmap at all. It deliberately does not skip itself when the knob is set, exactly
+      # so that this control has something to turn red.
+      - name: Negative control B - an omitted fill point must turn the lane red on that verb
+        working-directory: build-verify
+        env:
+          MOBILEGL_ITEST_REQUIRE_GPU: "1"
+          MOBILEGL_PIPE_POISON_OMIT: GenerateMipmap:GetActiveTextureUnit
+        run: |
+          FILTER='DirectGLES\.Verify\.PoisonOmissionScenario\.WithoutOmissionCompletes'
+          matched=$(ctest -N -L integration-verify -R "${FILTER}" | grep -cE '^ *Test *#[0-9]+:')
+          if [ "${matched}" -lt 1 ]; then
+            echo "::error::negative control B selected ${matched} tests; its filter no longer matches anything"
+            exit 1
+          fi
+          if ctest --output-on-failure -L integration-verify -R "${FILTER}" --no-tests=error; then
+            echo "::error::MOBILEGL_PIPE_POISON_OMIT=GenerateMipmap:GetActiveTextureUnit left the verify lane GREEN. The per-verb poison is not armed, so a forgotten fill row would ship silently."
+            exit 1
+          fi
+          echo "the omitted fill point turned the lane red, as it must"
+
+      - name: Upload verify lane logs
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: integration-verify-logs
+          path: build-verify/MobileGL/MG_IntegrationTest/pipe-*.log*
+          if-no-files-found: warn
+
+      - name: Upload core dumps
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: integration-verify-core-dumps
+          path: /tmp/core.*
+          if-no-files-found: ignore
+
+  # MobileGL/MG_Remote/Protocol/generated/protocol_generated.h is COMMITTED, and
+  # flatc is deliberately absent from the default build graph (a codegen step in
+  # the graph is how the earlier branch ended up cross-compiling an arm64 flatc
+  # and trying to run it on the host). This job is what keeps the committed
+  # header honest: build the pinned flatc, regenerate, and fail on any diff.
+  # It needs no MobileGL build, so it does not depend on build-linux.
+  flatc-check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Get CMake
+        uses: lukka/get-cmake@v4.3.3
+
+      - name: Check out the FlatBuffers submodule only
+        # Just this one: the schema check has nothing to do with glslang,
+        # SPIRV-Cross or the trace fixtures.
+        run: git submodule update --init 3rdparty/flatbuffers
+
+      - name: Regenerate protocol_generated.h
+        run: python3 scripts/gen_protocol.py --build-dir "${{ runner.temp }}/flatc-build"
+
+      - name: Fail if the committed header is stale
+        run: git diff --exit-code -- MobileGL/MG_Remote/Protocol/generated/protocol_generated.h
+
+  # P0.5 interface-purity gate A (ARCHITECTURE.md:501): the two extracted headers' include closure,
+  # asserted on `-H` output because `nm --undefined-only` is blind to "included but not called" -
+  # a header whose types are never named leaves no symbol behind, and "included at all" is exactly
+  # the coupling P1 and P7 have to sever. Needs a preprocessor and three header submodules, no
+  # CMake configure and no glslang sources, so like pipe-gates it does not depend on build-linux.
+  # The script's own --self-test is always on: a negative control that stopped tripping fails the
+  # job, because a gate that cannot go red is not a gate (ROADMAP.md:7).
+  include-graph-check:
+    name: Include-closure purity gate
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Check out the three header submodules the closure needs
+        # ska/flat_hash_map.hpp, xxhash.h and vulkan/vulkan.h are the only submodule headers
+        # Includes.h reaches; glslang and spirv_cross are vendored under include/.
+        run: git submodule update --init include/ska 3rdparty/xxHash 3rdparty/Vulkan-Headers
+
+      - name: Install clang and the X11 headers vulkan.h pulls on Linux
+        # Includes.h defines VK_USE_PLATFORM_XLIB_KHR before <vulkan/vulkan.h>, which then
+        # includes <X11/Xlib.h>; without libx11-dev every clang-mode probe dies in the
+        # preprocessor and the gate reports 5 problems that have nothing to do with purity.
+        run: sudo apt-get update && sudo apt-get install -y clang-20 libx11-dev
+
+      - name: Include-closure assertions and negative control
+        run: python3 scripts/check_include_closure.py --mode both --compiler clang++-20 --self-test --require-all
+
   benchmark:
     runs-on: ubuntu-latest
     needs: build-linux
@@ -506,6 +911,7 @@ jobs:
     outputs:
       matrix: ${{ steps.trace-cases.outputs.matrix }}
       names: ${{ steps.trace-cases.outputs.names }}
+      verify-matrix: ${{ steps.trace-cases.outputs.verify-matrix }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -515,6 +921,9 @@ jobs:
         run: |
           echo "matrix=$(python3 tools/trace_replay/trace_cases.py --ci --format github-test-matrix)" >> "$GITHUB_OUTPUT"
           echo "names=$(python3 tools/trace_replay/trace_cases.py --ci --format names)" >> "$GITHUB_OUTPUT"
+          # The subset the verify build retraces ("verify": true in trace_cases.json). It is a
+          # SUBSET of the matrix above, so retrace-verify needs no fixtures of its own.
+          echo "verify-matrix=$(python3 tools/trace_replay/trace_cases.py --ci --format github-verify-matrix)" >> "$GITHUB_OUTPUT"
 
   trace-fixtures:
     name: trace fixture (${{ matrix.case }})
@@ -728,10 +1137,295 @@ jobs:
           archive: false
           if-no-files-found: error
 
+  # The trace half of the third CI mode. Same replay, same goldens, but the library underneath is
+  # the verify build and MOBILEGL_PIPE_VERIFY=1 is in the environment, so every backend read of
+  # frontend state is checked against a snapshot taken at the verb boundary. Eight cases rather
+  # than the full lane's 40 (tools/trace_replay/trace_cases.json, "verify": true): the comparator
+  # is budgeted at 5-10x, and the full sweep is a phase-exit / workflow_dispatch run.
+  retrace-verify:
+    name: retrace verify (${{ matrix.backend }}, ${{ matrix.case }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 240
+    needs:
+      - build-linux-verify
+      - build-retrace
+      - trace-cases
+      - trace-fixtures
+    if: ${{ always() && needs.build-linux-verify.result == 'success' && needs.build-retrace.result == 'success' && needs.trace-cases.result == 'success' }}
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix: ${{ fromJSON(needs.trace-cases.outputs.verify-matrix) }}
+
+    steps:
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@v1.0
+        with:
+          swap-size-gb: 16
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Download trace fixture
+        uses: actions/download-artifact@v8
+        with:
+          name: trace-fixture-${{ matrix.case }}
+          path: trace-fixture-download
+
+      - name: Install trace fixture
+        run: |
+          mkdir -p tools/trace_replay/fixtures
+          find trace-fixture-download -type f -exec cp {} tools/trace_replay/fixtures/ \;
+
+      - name: Get CMake
+        uses: lukka/get-cmake@v4.3.3
+
+      - name: Install runtime dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libvulkan1 libegl1-mesa-dev libgles2-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers
+          test -e /usr/lib/x86_64-linux-gnu/libEGL.so
+          test -e /usr/lib/x86_64-linux-gnu/libGLESv2.so
+
+      - name: Download Linux verify runtime
+        uses: actions/download-artifact@v8
+        with:
+          name: mobilegl-linux-runtime-verify
+          path: .
+
+      - name: Download trace replay
+        uses: actions/download-artifact@v8
+        with:
+          name: mobilegl-trace-replay
+          path: .
+
+      - name: Unpack the VERIFY runtime as the library under test
+        # build-retrace's CTestTestfile.cmake has the absolute path
+        # <workspace>/build-linux/libMobileGL.so frozen into every case, so the swap happens here
+        # rather than through a variable: the verify .so is put where that path points. The nm
+        # check is what makes the swap falsifiable - a run against the ordinary library would
+        # carry no comparator, ignore MOBILEGL_PIPE_VERIFY entirely, and match its golden.
+        #
+        # `nm`, not `nm -D`, for the reason spelled out in build-linux-verify: everything MGPipe is
+        # hidden-visibility in a Release build and the dynamic table has none of it.
+        run: |
+          tar -xzf mobilegl-linux-runtime-verify.tgz
+          tar -xzf mobilegl-trace-replay.tgz
+          test -f build-verify/libMobileGL.so
+          test -f build-retrace/tools/trace_replay/mobilegl_trace_replay
+          mkdir -p build-linux
+          cp build-verify/libMobileGL.so build-linux/libMobileGL.so
+          if ! nm --defined-only build-linux/libMobileGL.so | grep -q MGPipeVerifyInputs; then
+            echo "::error::the library unpacked at build-linux/libMobileGL.so defines no MGPipeVerifyInputs, so this retrace would replay against a comparator-free build and pass on its golden having verified nothing"
+            exit 1
+          fi
+          echo "the library at build-linux/libMobileGL.so is the verify build"
+
+      - name: Retrace and validate under MOBILEGL_PIPE_VERIFY
+        working-directory: build-retrace/tools/trace_replay
+        # run_trace_case.cmake turns MOBILEGL_PIPE_VERIFY into three assertions of its own (the
+        # arming line, no Fatal{PipeVerifyDiffer, no Fatal{UnmigratedPipeInput), so a case that
+        # somehow ran the wrong library reds here instead of passing on its golden.
+        # --timeout 10800: the 1800s cases run 5-10x slower with both comparator arms live, which
+        # is well past ctest's 1500s default.
+        run: |
+          ulimit -c unlimited
+          sudo sysctl -w kernel.core_pattern='/tmp/core.%e.%p'
+          export MOBILEGL_PIPE_VERIFY=1
+          if [ '${{ matrix.backend }}' = 'DirectVulkan' ]; then
+            export MOBILEGL_MAGMA_R11G11B10F_FALLBACK=1
+          fi
+          if [ '${{ matrix.backend }}' = 'DirectVulkan' ] \
+             && [ '${{ matrix.case }}' = 'improved-transparency-minecraft-26.3' ]; then
+            export MOBILEGL_MAGMA_DISABLE_BLENDED_DEPTH_WRITE=1
+          fi
+          ctest -V --no-tests=error --timeout 10800 \
+            -R '^MobileGLTraceReplay\.${{ matrix.case }}\.${{ matrix.backend }}$'
+
+      # The retrace lane's own always-on negative control, on one case so it costs one short trace:
+      # with a snapshot field corrupted, the SAME replay must fail. Without it, "40 traces, zero
+      # divergences" would be a statement about a comparator nobody watched.
+      #
+      # The rerun replays into the SAME case directory, so the verified run's images are put aside
+      # first and restored before the verdict: "Upload actual image" below runs `if: always()` and
+      # would otherwise ship the deliberately corrupted run's output under the name of the good one.
+      # The restore happens whichever way the control goes, which is why the ctest exit status is
+      # captured rather than tested inline.
+      - name: Negative control - a corrupted snapshot field must red this retrace
+        if: ${{ matrix.case == 'OpenRA' && matrix.backend == 'DirectGLES' }}
+        working-directory: build-retrace/tools/trace_replay
+        run: |
+          export MOBILEGL_PIPE_VERIFY=1
+          export MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters
+          GOOD_OUTPUT="${RUNNER_TEMP}/openra-verified-output"
+          rm -rf "${GOOD_OUTPUT}"
+          if [ -d OpenRA ]; then
+            cp -a OpenRA "${GOOD_OUTPUT}"
+          fi
+          set +e
+          ctest -V --no-tests=error --timeout 10800 \
+            -R '^MobileGLTraceReplay\.OpenRA\.DirectGLES$'
+          control_rc=$?
+          set -e
+          if [ -d "${GOOD_OUTPUT}" ]; then
+            rm -rf OpenRA
+            mv "${GOOD_OUTPUT}" OpenRA
+            echo "restored the verified run's OpenRA output over the corrupted rerun's"
+          fi
+          if [ "${control_rc}" -eq 0 ]; then
+            echo "::error::MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters left the OpenRA retrace GREEN, so the comparator is not comparing and the whole verify retrace lane proves nothing."
+            exit 1
+          fi
+          echo "the corrupted field turned the retrace red, as it must (ctest exit ${control_rc})"
+
+      - name: Upload core dumps
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: retrace-verify-core-dumps-${{ matrix.backend }}-${{ matrix.case }}
+          path: /tmp/core.*
+          if-no-files-found: ignore
+
+      - name: Upload actual image
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: retrace-verify-result-${{ matrix.backend }}-${{ matrix.case }}
+          path: |
+            build-retrace/tools/trace_replay/${{ matrix.case }}/actual-images/**
+            build-retrace/tools/trace_replay/${{ matrix.case }}/${{ matrix.backend }}/output/**
+          if-no-files-found: warn
+
+  # G1's own job: the pull build must be the tree before P1, symbol for symbol and byte for byte.
+  # workflow_dispatch only - it builds the library twice from scratch, and its answer is about a
+  # BASELINE rather than about this push, so a per-push run would be measuring the wrong pair.
+  monolith-symbol-report:
+    name: monolith symbol report
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    if: ${{ github.event_name == 'workflow_dispatch' }}
+    env:
+      CCACHE_BASEDIR: ${{ github.workspace }}
+      CCACHE_COMPRESS: "true"
+      CCACHE_DIR: ${{ github.workspace }}/.ccache
+      CCACHE_MAXSIZE: 4G
+      CCACHE_NOHASHDIR: "true"
+
+    steps:
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@v1.0
+        with:
+          swap-size-gb: 32
+
+      - name: Checkout repo
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Get CMake
+        uses: lukka/get-cmake@v4.3.3
+
+      - name: Restore ccache
+        uses: actions/cache/restore@v5
+        with:
+          path: .ccache
+          key: ${{ runner.os }}-test-${{ github.job }}-ccache-v1
+          restore-keys: |
+            ${{ runner.os }}-test-${{ github.job }}-ccache-
+
+      - name: Prepare Vulkan SDK
+        uses: humbletim/setup-vulkan-sdk@v1.2.1
+        with:
+          vulkan-query-version: 1.4.304.1
+          vulkan-components: Vulkan-Headers, Vulkan-Loader
+          vulkan-use-cache: true
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ccache clang-20 clang++-20 lld-20 libc++-20-dev libc++abi-20-dev libvulkan-dev libegl1-mesa-dev libgles2-mesa-dev libgl1-mesa-dri mesa-vulkan-drivers ninja-build binutils
+
+      # Both sides with IDENTICAL flags, LTO off, the same compiler and the same standard library:
+      # symbol_report.py's guard rails (scripts/symbol_report.py) say a mismatched pair "adds"
+      # thousands of symbols and the comparison then means nothing. The library alone - no tests,
+      # no benchmark, no integration test, no trace replay - because those targets do not ship.
+      - name: Build the baseline library (${{ inputs.baseline_sha }})
+        run: |
+          git worktree add ../baseline "${{ inputs.baseline_sha }}"
+          cd ../baseline
+          git submodule update --init --recursive
+          (cd 3rdparty/glslang && python update_glslang_sources.py)
+          cmake -S . -B build-sym-base -G Ninja \
+            -DCMAKE_C_COMPILER=clang-20 -DCMAKE_CXX_COMPILER=clang++-20 \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DMOBILEGL_LOG_ACTIVE_LEVEL=MOBILEGL_LOG_LEVEL_INFO \
+            -DMOBILEGL_BUILD_TEST=OFF -DMOBILEGL_BUILD_BENCHMARK=OFF \
+            -DMOBILEGL_BUILD_INTEGRATION_TEST=OFF -DMOBILEGL_BUILD_TRACE_REPLAY=OFF \
+            -DMOBILEGL_BUILD_DISAGGREGATED=OFF \
+            -DMOBILEGL_PIPE_PUSH=OFF -DMOBILEGL_PIPE_VERIFY=OFF \
+            -DMOBILEGL_ENABLE_LTO=OFF \
+            -DCMAKE_POLICY_VERSION_MINIMUM=3.5
+          cmake --build build-sym-base --parallel "$(nproc)"
+          cp build-sym-base/libMobileGL.so "${GITHUB_WORKSPACE}/libMobileGL-baseline.so"
+
+      - name: Build the head library
+        run: |
+          (cd 3rdparty/glslang && python update_glslang_sources.py)
+          cmake -S . -B build-sym-head -G Ninja \
+            -DCMAKE_C_COMPILER=clang-20 -DCMAKE_CXX_COMPILER=clang++-20 \
+            -DCMAKE_C_COMPILER_LAUNCHER=ccache -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DMOBILEGL_LOG_ACTIVE_LEVEL=MOBILEGL_LOG_LEVEL_INFO \
+            -DMOBILEGL_BUILD_TEST=OFF -DMOBILEGL_BUILD_BENCHMARK=OFF \
+            -DMOBILEGL_BUILD_INTEGRATION_TEST=OFF -DMOBILEGL_BUILD_TRACE_REPLAY=OFF \
+            -DMOBILEGL_BUILD_DISAGGREGATED=OFF \
+            -DMOBILEGL_PIPE_PUSH=OFF -DMOBILEGL_PIPE_VERIFY=OFF \
+            -DMOBILEGL_ENABLE_LTO=OFF \
+            -DCMAKE_POLICY_VERSION_MINIMUM=3.5
+          cmake --build build-sym-head --parallel "$(nproc)"
+
+      # The monolith must not have grown a remote half. ARCHITECTURE.md:506: MG_Remote lives behind
+      # MOBILEGL_BUILD_DISAGGREGATED and nothing of it may reach a shipped pull build.
+      - name: No MG_Remote in the pull build
+        run: |
+          if nm --defined-only build-sym-head/libMobileGL.so | grep -q MG_Remote; then
+            echo "::error::the pull build defines MG_Remote symbols; the disaggregated half leaked into the monolith"
+            nm --defined-only build-sym-head/libMobileGL.so | grep MG_Remote | head -20
+            exit 1
+          fi
+          echo "no MG_Remote symbols in the pull build"
+
+      - name: Symbol report (G1)
+        run: |
+          python3 scripts/symbol_report.py \
+            --before libMobileGL-baseline.so \
+            --after build-sym-head/libMobileGL.so \
+            --threshold 0 \
+            --fail-on-symbol-set-change \
+            --fail-on-added-bytes 0 \
+            --markdown symbol-report.md \
+            --json symbol-report.json
+
+      - name: Upload the symbol report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: monolith-symbol-report
+          path: |
+            symbol-report.md
+            symbol-report.json
+          if-no-files-found: error
+
   remove-artifact-clutter:
     name: remove artifact clutter
     runs-on: ubuntu-latest
-    needs: retrace-summary
+    # (d) retrace-verify too: this job deletes the trace-fixture-* artifacts, and the verify
+    # retraces download the same ones.
+    needs:
+      - retrace-summary
+      - retrace-verify
     if: always()
     permissions:
       actions: write
@@ -740,14 +1434,19 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          # Both retrace lanes, not just the pull one: `retrace verify (backend, case)` downloads
+          # the same trace-fixture-<case> artifact, and a failed verify retrace is exactly when
+          # someone needs that fixture to reproduce locally. The two prefixes are stripped in
+          # order, longest first, because "retrace (" is not a prefix of "retrace verify (".
           declare -A failed_cases=()
           while IFS= read -r job_name; do
-            case_name="${job_name#retrace (*, }"
+            case_name="${job_name#retrace verify (*, }"
+            case_name="${case_name#retrace (*, }"
             case_name="${case_name%)}"
             failed_cases["${case_name}"]=1
           done < <(
             gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/jobs?per_page=100" \
-              --jq '.jobs[] | select(.name | startswith("retrace (")) | select(.conclusion == "failure" or .conclusion == "cancelled" or .conclusion == "timed_out" or .conclusion == "action_required") | .name'
+              --jq '.jobs[] | select((.name | startswith("retrace (")) or (.name | startswith("retrace verify ("))) | select(.conclusion == "failure" or .conclusion == "cancelled" or .conclusion == "timed_out" or .conclusion == "action_required") | .name'
           )
 
           if ((${#failed_cases[@]})); then
@@ -778,3 +1477,69 @@ jobs:
           )
 
           echo "Deleted ${deleted} intermediate Linux artifact(s); retained ${retained} failed-retrace fixture(s)."
+
+  pipe-gates:
+    name: MGPipe generators and hygiene gates
+    runs-on: ubuntu-latest
+    # Deliberately independent of build-linux: these are source-level gates, they take
+    # seconds, and a broken build must not hide a drifted interface.
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      # The seven generators all read MG_Pipe/*.def, so regenerating and diffing is what
+      # keeps the two interface tables, the wire records, the verify comparators, the
+      # PipeInputs field ids, the read-inventory coverage and the render-state member list
+      # from drifting apart from the catalogue. The generated files are committed
+      # deliberately: the build must not depend on python.
+      - name: Regenerate the MGPipe interface (G1-G7)
+        run: |
+          python3 scripts/gen_pipe.py
+          git diff --exit-code -- MobileGL/MG_Pipe/generated
+
+      # The generators' own negative controls: canned inputs that MUST trip each structural check
+      # (a field list that does not cover its struct's members, a verb set that is not the function
+      # table's). Regenerating and diffing above cannot see a check that silently stopped
+      # checking - a broken gate and a clean tree produce the same green.
+      - name: The MGPipe generators' checks can still fail
+        run: python3 scripts/gen_pipe.py --self-test
+
+      # The same question for the symbol tool the P1 gate is written in terms of.
+      - name: The symbol report's buckets and gates can still fail
+        run: python3 scripts/symbol_report.py --self-test
+
+      # Per-draw fprintf/printf instrumentation has repeatedly been committed by accident,
+      # once inside a mutex critical section. Nothing under these two trees prints to a
+      # stdio stream today - MGLOG_D compiles out in INFO builds and is the only channel
+      # they are allowed to use - so this gate starts with no exceptions, and any addition
+      # to it needs a reason in the pull request rather than a quiet whitelist entry. The
+      # alternation names every stdio spelling, not just the two that were committed:
+      # fprintf to either stream, printf, puts, and the iostream pair.
+      - name: No stdio instrumentation in MG_Backend or MG_State
+        run: |
+          if grep -rnE 'fprintf[[:space:]]*\((stderr|stdout)|(^|[^[:alnum:]_>.])printf[[:space:]]*\(|(^|[^[:alnum:]_>.:])puts[[:space:]]*\(|std::(cout|cerr)' \
+              MobileGL/MG_Backend MobileGL/MG_State; then
+            echo "::error::stdio instrumentation found; use MGLOG_D (compiled out in INFO builds)"
+            exit 1
+          fi
+          echo "no fprintf(stderr/stdout / printf( / puts( / std::cout|cerr under MobileGL/MG_Backend or MobileGL/MG_State"
+
+      # Informational: the frontend mutation surface an MGPipe aggregate generation has to
+      # cover. It becomes a gate in P2, when the mapping file exists to diff against
+      # (ROADMAP.md:18 puts the first mapping round in P2, not P1).
+      - name: MGPipe dirty-surface report
+        run: python3 scripts/gen_pipe_dirty_surface.py --summary
+
+      # Warning only for now: the disaggregation documents are still being written, and a
+      # lint that fails a rewrite in progress teaches people to ignore it. It becomes
+      # --strict when the documents settle.
+      - name: Documentation citation lint
+        run: |
+          shopt -s nullglob
+          documents=(docs/Disaggregated/*.md)
+          if [ ${#documents[@]} -eq 0 ]; then
+            echo "no disaggregation documents to check"
+            exit 0
+          fi
+          python3 scripts/check_doc_citations.py "${documents[@]}" || true

.gitmodules

@@ -34,3 +34,6 @@
 [submodule "include/ska"]
 	path = include/ska
 	url = https://github.com/MobileGL-Dev/flat_hash_map.git
+[submodule "3rdparty/flatbuffers"]
+	path = 3rdparty/flatbuffers
+	url = https://github.com/google/flatbuffers.git

CMakeLists.txt

@@ -14,6 +14,19 @@ option(MOBILEGL_ENABLE_TRACY      "Enable tracy for profiling"
 option(MOBILEGL_BUILD_TRACE_REPLAY "Build desktop apitrace replay runner"            OFF)
 option(MOBILEGL_TRACE_ANGLE_VARIANTS "Enable signed trace-APK ANGLE variant loading" OFF)
 option(MOBILEGL_IOS               "Build MobileGL for iOS instead of macOS when APPLE is set" OFF)
+# The disaggregated (two-process) shape. OFF is the shipping default and OFF
+# must stay byte-comparable to a tree without MG_Remote at all: nothing under
+# MobileGL/MG_Remote/ is compiled, no include path is added, and no library is
+# linked, so `nm --defined-only libMobileGL.so | grep -i MG_Remote` is empty.
+# That emptiness is one of the two byte-level equalities the plan's validation
+# gates keep (section 10.3).
+option(MOBILEGL_BUILD_DISAGGREGATED "Build the MG_Remote transport layer (two-process shape)" OFF)
+option(MOBILEGL_BUILD_SERVER_SPIKE "Build the P0 spike-A MobileGLServer delivery-chain executable (Android only)" OFF)
+# The PipeInputs strangler (ARCHITECTURE.md 9.2). OFF is the pull build and must stay
+# byte-identical to a tree without either option: MGB_CTX is the live GLContext, no
+# MGPipe/PipeInputs source is compiled, every MGP_FILL is ((void)0).
+option(MOBILEGL_PIPE_PUSH "Backends read frontend state through the MGPipe PipeInputs block instead of MG_State::pGLContext (ARCHITECTURE.md 9.2 phase A)" OFF)
+option(MOBILEGL_PIPE_VERIFY "Compile SnapshotFromGLContext() and the G4 per-verb shadow comparator; implies MOBILEGL_PIPE_PUSH; never shipped" OFF)
 set(MOBILEGL_LOG_ACTIVE_LEVEL "MOBILEGL_LOG_LEVEL_INFO" CACHE STRING "MobileGL active log level macro")
 set(MOBILEGL_VULKAN_LIBRARY "" CACHE FILEPATH "Vulkan loader/MoltenVK library to link for iOS builds")
 
@@ -238,6 +251,8 @@ set(SOURCE_FILES
 
     MobileGL/MG_Util/Metrics/BufferMetrics.cpp
 
+    MobileGL/MG_Util/Metrics/PipeStats.cpp
+
     MobileGL/MG_Util/Converters/GLToStr/GLEnumConverter.cpp
     MobileGL/MG_Util/Converters/EGLToStr/EGLEnumConverter.cpp
     MobileGL/MG_Util/Converters/MGToStr/DataTypeConverter.cpp
@@ -307,6 +322,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeFragmentOutputIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeResourceArrayIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenAtomicCounterBlockPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DemotePointSizePass.cpp
 
     MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.cpp
     MobileGL/MG_Util/BackendLoaders/Vulkan/Loader.cpp
@@ -314,6 +330,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/SelfTest/DriverBugProbes.cpp
     MobileGL/MG_Util/SelfTest/DriverPost.cpp
     MobileGL/MG_Util/SelfTest/DriverPostIterationRPWitness.cpp
+    MobileGL/MG_Util/SelfTest/PrimitivesGeneratedNoXfbProbe.cpp
 
     MobileGL/MG_Util/Texture/PixelStoreProcessor.cpp
     MobileGL/MG_Util/Texture/TextureFormatProcessor.cpp
@@ -415,6 +432,65 @@ set(SOURCE_FILES
     MobileGL/MG_State/GLState/RenderbufferState/RenderbufferState.cpp
 )
 
+# ---------------------------------------------------------------------------
+# MG_Remote (disaggregated transport). Everything below is gated: with the
+# option OFF not one file here is compiled and no include path is added.
+# ---------------------------------------------------------------------------
+
+# FlatBuffers is a submodule and its runtime is header-only. Guard both ways:
+# a checkout without the submodule must configure and build, just without the
+# disaggregated shape, rather than fail with a missing-header error a hundred
+# lines later. Note this only checks for the RUNTIME headers - flatc is never
+# built here (see scripts/gen_protocol.py).
+if (MOBILEGL_BUILD_DISAGGREGATED AND
+    NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/3rdparty/flatbuffers/include/flatbuffers/flatbuffers.h")
+    message(WARNING
+        "MOBILEGL_BUILD_DISAGGREGATED=ON but 3rdparty/flatbuffers/include is missing. "
+        "Run `git submodule update --init 3rdparty/flatbuffers`. Building without the "
+        "disaggregated shape for this configure; the cached ON takes effect once the "
+        "submodule is present.")
+    # A NORMAL variable, deliberately not `CACHE BOOL ... FORCE`: forcing OFF into the cache
+    # made the plain re-configure after `git submodule update` stay OFF with no message at
+    # all. Shadowing the cache entry for this configure only keeps the operator's ON where it
+    # was, so the next configure - with the submodule there - honours it.
+    set(MOBILEGL_BUILD_DISAGGREGATED OFF)
+endif()
+
+# MOBILEGL_PIPE_VERIFY implies MOBILEGL_PIPE_PUSH: the comparator compares the pushed block
+# against a snapshot, so there has to be a pushed block. A normal variable, not a forced
+# cache write, for the same reason as the disaggregated fallback above.
+if (MOBILEGL_PIPE_VERIFY AND NOT MOBILEGL_PIPE_PUSH)
+    message(STATUS "MobileGL: MOBILEGL_PIPE_VERIFY=ON forces MOBILEGL_PIPE_PUSH ON for this configure")
+    set(MOBILEGL_PIPE_PUSH ON)
+endif()
+
+if (MOBILEGL_PIPE_PUSH)
+    message(STATUS "MobileGL: PipeInputs push ON, appending the MGPipe fill sources")
+    list(APPEND SOURCE_FILES
+        MobileGL/MG_Backend/MGPipe/PipeInputs.cpp
+        MobileGL/MG_Impl/Pipe/PipeFill.cpp
+    )
+endif()
+
+if (MOBILEGL_BUILD_DISAGGREGATED)
+    message(STATUS "MobileGL: disaggregated transport ON, appending MG_Remote sources")
+    list(APPEND SOURCE_FILES
+        MobileGL/MG_Remote/Transport/Ring.cpp
+        MobileGL/MG_Remote/Transport/Doorbell.cpp
+        MobileGL/MG_Remote/Transport/ShmSegment.cpp
+        # Both platform halves are listed unconditionally and each is empty on
+        # the other OS, so neither can rot behind an `if (WIN32)` nobody
+        # configures.
+        MobileGL/MG_Remote/Transport/ShmSegmentPosix.cpp
+        MobileGL/MG_Remote/Transport/ShmSegmentWin32.cpp
+        MobileGL/MG_Remote/Transport/FdPassing.cpp
+        MobileGL/MG_Remote/Transport/InProcessTransport.cpp
+        # Keeps MG_Util/Debug/Log.h - and through it the GL frontend's
+        # umbrella header - out of the header-only wire code (WireLog.h).
+        MobileGL/MG_Remote/Transport/WireLog.cpp
+    )
+endif()
+
 if (APPLE AND NOT MOBILEGL_IOS)
     list(APPEND SOURCE_FILES
         MobileGL/MG_Impl/CGLImpl/CGLImpl.cpp
@@ -465,11 +541,26 @@ set(MOBILEGL_COMPILE_DEF
         -DASIO_NO_DEPRECATED
 )
 
+if (MOBILEGL_BUILD_DISAGGREGATED)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_BUILD_DISAGGREGATED=1)
+endif()
+
+if (MOBILEGL_PIPE_PUSH)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_PIPE_PUSH=1)
+endif()
+if (MOBILEGL_PIPE_VERIFY)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_PIPE_VERIFY=1)
+endif()
+
 message(STATUS "MOBILEGL_COMPILE_DEF=${MOBILEGL_COMPILE_DEF}")
 
 set(MOBILEGL_INCLUDE_DIR
         ${CMAKE_SOURCE_DIR}/include
         ${CMAKE_SOURCE_DIR}/MobileGL
+        # The MGPipe boundary headers. They are reachable as <MG_Pipe/MGPipe.h> through the
+        # line above too; this entry lets the client, the backends and MG_Remote spell them
+        # as <MGPipe.h> once MG_Pipe stops being a leaf of the frontend tree.
+        ${CMAKE_SOURCE_DIR}/MobileGL/MG_Pipe
         ${spirv-tools_SOURCE_DIR}
         ${spirv-tools_SOURCE_DIR}/include
         ${spirv-tools_BINARY_DIR}
@@ -480,6 +571,13 @@ set(MOBILEGL_INCLUDE_DIR
         ${CMAKE_SOURCE_DIR}/3rdparty/asio/include
 )
 
+if (MOBILEGL_BUILD_DISAGGREGATED)
+    # Header-only runtime: an include path, no add_subdirectory, no link
+    # target, and above all no flatc in the build graph. protocol_generated.h
+    # is committed and regenerated by scripts/gen_protocol.py.
+    list(APPEND MOBILEGL_INCLUDE_DIR ${CMAKE_SOURCE_DIR}/3rdparty/flatbuffers/include)
+endif()
+
 add_library(${CMAKE_PROJECT_NAME} SHARED
     ${SOURCE_FILES}
 )
@@ -696,3 +794,43 @@ endif()
 if (ANDROID AND MOBILEGL_BUILD_INTEGRATION_TEST)
     add_subdirectory(MobileGL/MG_IntegrationTest)
 endif()
+
+# ---------------------------------------------------------------------------
+# P0 spike A: the Android delivery chain for a second native executable.
+#
+# The disaggregated design needs a server process on Android (PLAN-B.md §8.1,
+# inheriting PLAN.md §11.1-§11.6). An APK's only exec-able install location is
+# lib/<abi>/, and the packager only puts a file there if it is named lib*.so -
+# so a second executable has to be built with an .so name and exec'd out of
+# getApplicationInfo().nativeLibraryDir. This target is the stub that proves the
+# chain end to end: it is packaged like a library, exec'd from the app's own
+# untrusted_app process, and writes a marker the parent reads back.
+#
+# Off by default and ANDROID-only, so no shipping configuration builds it. The
+# trace flavour of the plugin APK turns it on (android-plugin/build.gradle).
+# ---------------------------------------------------------------------------
+if (ANDROID AND MOBILEGL_BUILD_SERVER_SPIKE)
+    add_executable(MobileGLServer
+        ${CMAKE_CURRENT_SOURCE_DIR}/tools/spikes/server_stub/main.cpp)
+
+    # An executable that is named like a shared library still has to be a real
+    # PIE executable: Android has refused non-PIE executables since API 21, and
+    # the name alone does not change what the loader demands of the file.
+    set_target_properties(MobileGLServer PROPERTIES
+        PREFIX "lib"
+        SUFFIX ".so"
+        OUTPUT_NAME "MobileGLServer"
+        POSITION_INDEPENDENT_CODE ON)
+    target_compile_options(MobileGLServer PRIVATE -fPIE)
+    target_link_options(MobileGLServer PRIVATE -pie)
+
+    # AGP packages what the external native build drops into the per-ABI output
+    # directory, and it selects by the .so extension. CMake puts executables in
+    # CMAKE_RUNTIME_OUTPUT_DIRECTORY, which is not the directory AGP hands to
+    # CMAKE_LIBRARY_OUTPUT_DIRECTORY, so point this target's runtime output at
+    # the library directory when the generator gave us one.
+    if (CMAKE_LIBRARY_OUTPUT_DIRECTORY)
+        set_target_properties(MobileGLServer PROPERTIES
+            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
+    endif()
+endif()

MobileGL/Config.h

@@ -152,6 +152,19 @@ namespace MobileGL::MG_Config {
         // lavapipe carry a located block correctly and would otherwise never run this code -
         // and ForceOff is the negative control. See StripIoBlockLocationsPass.
         QuirkOverride EsprytUnlocatedIoBlocks = QuirkOverride::Auto;
+        // MOBILEGL_POINT_SIZE_DEMOTION: demote gl_PointSize out of tessellation/geometry
+        // stages into an ordinary varying (ShaderCompiler::
+        // DemoteTessellationGeometryPointSizeForProgram) instead of declining such programs
+        // on a device that advertises neither EXT/OES_tessellation_point_size /
+        // geometry_point_size (DirectGLES) nor shaderTessellationAndGeometryPointSize
+        // (DirectVulkan). Auto arms it exactly where the detection says the capability is
+        // absent, which is the right setting everywhere. ForceOn exists so the demotion can
+        // be exercised on a healthy driver - llvmpipe and lavapipe host the built-in
+        // natively and would otherwise never run this code, which is what the pinned
+        // integration lane uses - and ForceOff restores the plain declines (escape hatch /
+        // negative control). Cross-backend by design: the demotion runs in the shared
+        // phase-B chain, so one switch covers both. See DemotePointSizePass.
+        QuirkOverride PointSizeDemotion = QuirkOverride::Auto;
         // MOBILEGL_COHERENT_AS_FLUSH: app-compat for engines (e.g. Flywheel) that write
         // GPU-read data through persistent GL_MAP_FLUSH_EXPLICIT_BIT maps they never
         // flush. Persistent FLUSH_EXPLICIT map requests are rewritten to coherent
@@ -184,6 +197,15 @@ namespace MobileGL::MG_Config {
         // on Mali both the immediate glBufferSubData and a staged copy into a busy
         // mutable store ghost the whole destination on the CPU.
         Bool EsprytDisableInvalidateFlush = false;
+        // MOBILEGL_DISABLE_LARGE_BUFFER_ADOPTION: keep mesh-arena-sized buffer stores
+        // (>= 16MiB) on the CPU-shadow model instead of backing them with the backend's
+        // persistently+coherently mapped storage at definition time (negative control /
+        // escape hatch). Frontend-scoped: it engages only where the active backend
+        // provides AcquirePersistentMap. With adoption on, an app SubData into a busy
+        // 128MB arena is a plain memcpy into GPU-visible memory; every driver-mediated
+        // route for the same write stalls the thread or ghost-copies the whole arena on
+        // this class of Mali driver, and the arena stops costing its size again in RAM.
+        Bool DisableLargeBufferAdoption = false;
         // MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION: make DirectGLES skip the native ES
         // depth/stencil reads and always go through the shader-sampling emulation. Core GL
         // ES has no depth or stencil readback, but some drivers accept it anyway (Mesa does,
@@ -278,6 +300,82 @@ namespace MobileGL::MG_Config {
         // negative control that replays the corruption. Costs 2x the memory of the affected
         // formats where it engages, which is why Auto is probe-gated rather than always-on.
         QuirkOverride EsprytWidenPacked16Storage = QuirkOverride::Auto;
+        // MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE: DirectVulkan's GL_PRIMITIVES_GENERATED
+        // reroute for draws made while transform feedback is INACTIVE. The stream query
+        // (VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT primitivesNeeded) is defined to count
+        // them, but a Mali driver - and Mesa lavapipe - answers 0 unless a capture span is
+        // open, which is exactly the shape the CTS uses to measure the tessellator, so ~29
+        // tessellation tests per tree size a capture buffer from the 0 and die on the
+        // zero-length map. Auto defers to a device probe at renderer bring-up
+        // (SelfTest::RunPrimitivesGeneratedNoXfbProbe), which measures two substitutes on
+        // the same capture-less draws and arms the best proven one: the dedicated
+        // VK_EXT_primitives_generated_query (exact semantics by definition; lavapipe passes
+        // it, rasterizer discard included), else a clipping-invocations pipeline-statistics
+        // pool (see the verdict vocabulary for its rasterizer-discard split). ForceOn pins
+        // the reroute structurally wherever a pool can exist (the arming-observable lane,
+        // immune to the probe's verdict moving), and ForceOff is the negative control that
+        // replays the driver's silence.
+        QuirkOverride MagmaPrimGenQueryReroute = QuirkOverride::Auto;
+        // --- MGPipe (the disaggregation plan's explicit frontend/backend boundary) ---
+        // MOBILEGL_PIPE_PUSH: per-subsystem bitmask selecting which state the frontend
+        // PUSHES over MGPipe instead of leaving the backend to pull it out of GLContext.
+        // 0 - the default and the only shipped value until the migration lands - is "pull
+        // everything", i.e. exactly today's behaviour. One bit of it also turns OFF
+        // client-side content addressing of CSOs, which is the negative control the CSO
+        // design is measured against. Accepts decimal or 0x-prefixed hex.
+        Uint64 PipePush = 0;
+        // MOBILEGL_PIPE_VERIFY: per-draw, per-FIELD shadow comparison of the pushed state
+        // against a snapshot taken from GLContext the old way, printing the first field
+        // that differs and the draw serial. Roughly 5-10x slower and never shipped; it is
+        // the semantic gate that replaces byte identity, and it catches the dangerous
+        // direction - a dirty bit that fires too RARELY - which no purity gate can see.
+        Bool PipeVerify = false;
+#if MOBILEGL_PIPE_PUSH
+        // The three knobs of the MOBILEGL_PIPE_VERIFY build (P1 brief D2). Compiled only
+        // under MOBILEGL_PIPE_PUSH so the pull build's FeaturesTable does not change size.
+        // MOBILEGL_PIPE_VERIFY_FATAL: the first divergence aborts (default). 0 logs and
+        // counts instead, for triage and for the lane that must survive to read its own
+        // log. Tri-state parse like PipeLegacyMemos: only an explicit falsy value turns it
+        // off.
+        Bool PipeVerifyFatal = true;
+        // MOBILEGL_PIPE_VERIFY_CORRUPT: a field name from kMGPipeInputFieldNames[]; the
+        // comparator perturbs that field in the SNAPSHOT arm before the entry compare, so a
+        // green verify run goes red naming it (negative control A). Unknown name is
+        // Fatal{PipeVerifyBadKnob}.
+        String PipeVerifyCorrupt;
+        // MOBILEGL_PIPE_POISON_OMIT: <Verb>:<FieldName>; the filler skips the STAMP (not
+        // the value) of that field for that verb, an omission indistinguishable from a
+        // forgotten FillPoints.def row, so that verb's read of it is
+        // Fatal{UnmigratedPipeInput} (negative control B). Unknown name is
+        // Fatal{PipeVerifyBadKnob}.
+        String PipePoisonOmit;
+#endif
+        // MOBILEGL_PIPE_STATS: dump the boundary counters (bytes, calls, roundtrips,
+        // texture pulls, upload shapes, residual-block bytes, index mirror bytes).
+        Bool PipeStats = false;
+        // MOBILEGL_PIPE_LEGACY_MEMOS: keep the pre-handle registries and TwinLookupMemos
+        // alive so the first handle waves have a real old-versus-new arm to be compared
+        // against. ON by default for the whole migration window, deleted with the pull
+        // path itself.
+        Bool PipeLegacyMemos = true;
+        // MOBILEGL_PIPE_TEXEL_RETAIN_MB: LRU budget for texels retained against a
+        // server-initiated texture re-send. Default 0, i.e. OFF: MipmapStorage already
+        // holds a complete CPU shadow, so this cache buys latency, never correctness.
+        Uint32 PipeTexelRetainMb = 0;
+        // MOBILEGL_PIPE_INDEX_MIRROR_MB: budget for the server-side index host mirror,
+        // which is what lets primitive-restart rewriting and multi-draw flattening stay on
+        // the server without shipping index bytes per draw. Over budget it degrades to
+        // per-draw staging, counted separately in the stats.
+        Uint32 PipeIndexMirrorMb = 64;
+        // MOBILEGL_PIPE_STATS_PERIOD: frames per boundary-counter summary line. 120 is the
+        // steady-state cadence; the device retrace harness never reaches the teardown dump
+        // and a trimmed fixture (create-indirect) is shorter than 120 frames, so a run that
+        // needs its numbers at all sets this low enough to land at least one window.
+        Uint32 PipeStatsPeriod = 120;
+        // MOBILEGL_PIPE_STATS_FILE: where the boundary counters' teardown JSON dump goes.
+        // Empty (the default) means no dump; the per-120-frame summary line still goes to
+        // the log whenever PipeStats is on, so a device run needs no writable path.
+        String PipeStatsFile;
     };
     extern FeaturesTable Features;
 } // namespace MobileGL::MG_Config

MobileGL/ConfigLoader.cpp

@@ -159,6 +159,38 @@ namespace MobileGL::MG_ConfigLoader {
         return static_cast<Uint32>(parsedValue);
     }
 
+    // Same contract as QueryEnvUint32, over 64 bits and accepting an explicit 0x prefix: the
+    // one consumer is a subsystem BITMASK, and a bitmask written in decimal is unreadable.
+    // Decimal otherwise - never strtoull's base 0, whose "leading zero means octal" rule
+    // silently read MOBILEGL_PIPE_PUSH=010 as 8 - and a '-' anywhere is rejected rather than
+    // wrapped, which strtoull would otherwise do without complaint (-1 -> every bit set).
+    inline Uint64 QueryEnvUint64(const String& key, Uint64 defaultValue) {
+        auto it = acceptedEnvVariablesMap->find(key);
+        if (it == acceptedEnvVariablesMap->end()) {
+            return defaultValue;
+        }
+
+        const String& value = it->second;
+        const char* text = value.c_str();
+        int base = 10;
+        if (value.size() > 2 && text[0] == '0' && (text[1] == 'x' || text[1] == 'X')) {
+            text += 2;
+            base = 16;
+        }
+        char* parseEnd = nullptr;
+        errno = 0;
+        const bool negative = value.find('-') != String::npos;
+        const unsigned long long parsedValue = negative ? 0 : std::strtoull(text, &parseEnd, base);
+        if (negative || parseEnd == text || *parseEnd != '\0' || errno == ERANGE) {
+            MGLOG_W("Config: Ignoring invalid env variable %s='%s'; expected a non-negative integer "
+                    "(decimal, or 0x-prefixed hexadecimal), using default %llu",
+                    key.c_str(), value.c_str(), static_cast<unsigned long long>(defaultValue));
+            return defaultValue;
+        }
+
+        return static_cast<Uint64>(parsedValue);
+    }
+
     inline void InitFeatures() {
         auto& features = MG_Config::Features;
         features.DisableTimerQuery = QueryEnvFlag("MOBILEGL_DISABLE_TIMERQUERY");
@@ -181,12 +213,14 @@ namespace MobileGL::MG_ConfigLoader {
             QueryEnvFlag("MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER");
         features.EsprytAvoidExplicitLodBias = QueryEnvFlag("MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS");
         features.EsprytUnlocatedIoBlocks = QueryEnvQuirkOverride("MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS");
+        features.PointSizeDemotion = QueryEnvQuirkOverride("MOBILEGL_POINT_SIZE_DEMOTION");
         features.CoherentAsFlush = QueryEnvFlag("MOBILEGL_COHERENT_AS_FLUSH");
         features.TraceSkipAutodestroy = QueryEnvFlag("MOBILEGL_TRACE_SKIP_AUTODESTROY");
         features.EsprytDisableUboRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UBO_RING");
         features.EsprytDisableUnpackRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UNPACK_RING");
         features.EsprytDisableUploadRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING");
         features.EsprytDisableInvalidateFlush = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH");
+        features.DisableLargeBufferAdoption = QueryEnvFlag("MOBILEGL_DISABLE_LARGE_BUFFER_ADOPTION");
         features.EsprytForceDepthStencilReadbackEmulation =
             QueryEnvFlag("MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION");
         features.RelaxedSemantics = QueryEnvFlag("MOBILEGL_RELAXED_SEMANTICS");
@@ -204,6 +238,29 @@ namespace MobileGL::MG_ConfigLoader {
             QueryEnvQuirkOverride("MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION");
         features.EsprytWidenPacked16Storage =
             QueryEnvQuirkOverride("MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE");
+        features.MagmaPrimGenQueryReroute = QueryEnvQuirkOverride("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE");
+        // MGPipe. Nothing here needs adding to an allow-list: InitializeAcceptedEnvVariables
+        // accepts every MOBILEGL_ / LIBGL_ prefixed variable in the environment, so a name
+        // that starts with MOBILEGL_ is visible to these queries by construction.
+        features.PipePush = QueryEnvUint64("MOBILEGL_PIPE_PUSH", 0);
+        features.PipeVerify = QueryEnvFlag("MOBILEGL_PIPE_VERIFY");
+#if MOBILEGL_PIPE_PUSH
+        // Defaults ON: read as a tri-state so only an explicitly falsy value turns it off.
+        features.PipeVerifyFatal =
+            QueryEnvQuirkOverride("MOBILEGL_PIPE_VERIFY_FATAL") != MG_Config::QuirkOverride::ForceOff;
+        QueryEnvVariable("MOBILEGL_PIPE_VERIFY_CORRUPT", features.PipeVerifyCorrupt, "");
+        QueryEnvVariable("MOBILEGL_PIPE_POISON_OMIT", features.PipePoisonOmit, "");
+#endif
+        features.PipeStats = QueryEnvFlag("MOBILEGL_PIPE_STATS");
+        // Defaults ON, so the flag has to be read as a tri-state rather than as a plain
+        // truthy check: unset must keep the memos, and only an explicitly falsy value may
+        // drop them.
+        features.PipeLegacyMemos =
+            QueryEnvQuirkOverride("MOBILEGL_PIPE_LEGACY_MEMOS") != MG_Config::QuirkOverride::ForceOff;
+        features.PipeTexelRetainMb = QueryEnvUint32("MOBILEGL_PIPE_TEXEL_RETAIN_MB", 0, 0, 4096);
+        features.PipeIndexMirrorMb = QueryEnvUint32("MOBILEGL_PIPE_INDEX_MIRROR_MB", 64, 0, 4096);
+        features.PipeStatsPeriod = QueryEnvUint32("MOBILEGL_PIPE_STATS_PERIOD", 120, 1, 1000000);
+        QueryEnvVariable("MOBILEGL_PIPE_STATS_FILE", features.PipeStatsFile, "");
     }
 
     inline void InitBackendType() {

MobileGL/Init.cpp

@@ -17,6 +17,7 @@
 #include <MG_Impl/GLImpl/Sync/GL_Sync.h>
 #include <MG_Impl/GLImpl/Query/GL_Query.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_State/GLState/ProgramState/ProgramTranslationCache.h>
 #include <MG_Util/ShaderTranspiler/TranslationCache.h>
@@ -42,6 +43,11 @@ namespace MobileGL {
             if (logLifecycle) {
                 MGLOG_I("MobileGL closing...");
             }
+            // Before any subsystem the counters name goes away, and before the last frame's
+            // numbers can be lost: emits the final summary line and, when
+            // MOBILEGL_PIPE_STATS_FILE is set, the JSON dump. A no-op when the counters are
+            // off, and idempotent.
+            MG_Util::PipeStats::Shutdown();
             // First, before anything else is torn down. In-flight compile/link jobs own
             // their own inputs and are safe against everything below EXCEPT glslang's
             // process globals and the TShader/TProgram objects hanging off pGLContext,
@@ -102,6 +108,10 @@ namespace MobileGL {
         MGLOG_I("Initializing MobileGL...");
         MG_ConfigLoader::Init();
         MGLOG_I("Config loaded");
+        // Immediately after the config load and before anything can count: the MGPipe
+        // boundary counters latch their enable flag here, so every counting site in the
+        // two backends is a load of an already-settled global for the rest of the run.
+        MG_Util::PipeStats::Init();
         MG_State::Init();
         MGLOG_D("MG_State initialized");
         MG_Backend::Init();

MobileGL/MG_Backend/BackendObject.h

@@ -192,9 +192,23 @@ namespace MobileGL {
             void (*MemoryBarrierByRegion)(GLbitfield barriers);
             void (*BindImageTexture)(GLuint unit, GLuint texture, GLint level, GLboolean layered, GLint layer,
                                      GLenum access, GLenum format);
+            // The ONLY indexed query that is genuinely a backend one, and only for the pnames
+            // MG_Impl/GLImpl/Getter/GL_Getter.cpp does not already own. Every indexed pname that
+            // names FRONTEND state - the indexed buffer bindings, the per-unit texture/sampler
+            // bindings, the image-unit bindings, the viewport rectangles, the indexed capabilities
+            // - is answered in GL_Getter::GetIntegeri_v and never reaches this entry; the
+            // 64-bit and float/double widths are derived there from the same answer, which is why
+            // no GetInteger64i_v/GetFloati_v/GetDoublei_v table entry exists. In practice this
+            // leaves GL_MAX_COMPUTE_WORK_GROUP_COUNT / _SIZE (also asked directly by
+            // MG_Util/ShaderTranspiler/CompileEnv.cpp) plus whatever pname the frontend has no
+            // case for at all.
             void (*GetIntegeri_v)(GLenum target, GLuint index, GLint* data);
-            void (*GetInteger64i_v)(GLenum target, GLuint index, GLint64* data);
-            void (*GetProgramiv)(GLuint program, GLenum pname, GLint* params);
+            // There is deliberately NO GetProgramiv entry: glGetProgramiv describes the program
+            // the APPLICATION wrote - link status, the transform-feedback mode, the compute local
+            // size - all of which are frontend link artifacts on ProgramObject, and
+            // MG_Impl/GLImpl/Program/GL_Program.cpp answers every one of them from there. Asking a
+            // backend would mean asking about a DIFFERENT program (a SPIRV-Cross-generated ESSL
+            // one, or a SPIR-V module), in a namespace the application never sees.
             // The GL program interface (glGetProgramInterfaceiv / glGetProgramResource*) is NOT
             // a backend query: it describes the program the application wrote, in the
             // application's namespace, which neither backend program is in. It is answered
@@ -364,6 +378,19 @@ namespace MobileGL {
             Int MaxFragmentShaderStorageBlocks = 8;
             Int MaxComputeUniformBlocks = 12;
             Int MaxComputeWorkGroupInvocations = 128;
+            // GL_MAX_COMPUTE_WORK_GROUP_COUNT / GL_MAX_COMPUTE_WORK_GROUP_SIZE, one value per
+            // axis. These six, with the invocations limit above, are the only indexed limits a
+            // backend genuinely OWNS - the device answers them (glGetIntegeri_v on DirectGLES,
+            // VkPhysicalDeviceLimits::maxComputeWorkGroupCount/Size on DirectVulkan) - and so
+            // the only ones that survive the retirement of the GetIntegeri_v table entry: they
+            // cross the MGPipe boundary inside MGPCaps, by inclusion of this struct (plan B
+            // section 4.4.1). Every other indexed pname names frontend state. RAW driver
+            // answers, like the invocations limit: GL_Getter and the compile environment floor
+            // them at the shared MIN_COMPUTE_WORK_GROUP_* minimums themselves. The defaults are
+            // the GL 4.3 core minimums (table 23.60) and describe the no-backend case, as
+            // MaxClipDistances' does.
+            Int MaxComputeWorkGroupCount[3] = {65535, 65535, 65535};
+            Int MaxComputeWorkGroupSize[3] = {1024, 1024, 64};
             Int MaxShaderStorageBufferBindings = 8;
             Int MaxTextureBufferSize = 65536;
             // GL_TEXTURE_BUFFER_OFFSET_ALIGNMENT; 1 means the offset is unconstrained.
@@ -495,6 +522,24 @@ namespace MobileGL {
             // halves (PackDoubleVertexInputsPass and VertexInputStateFactory::ToVkVertexFormat)
             // still see one consistent world.
             Bool SupportsFloat64VertexAttributes = false;
+            // Whether a TESSELLATION stage of this backend may access gl_PointSize - i.e.
+            // whether a module declaring OpCapability TessellationPointSize can reach the
+            // driver at all. DirectVulkan sets both this and the geometry twin from the one
+            // shaderTessellationAndGeometryPointSize feature; DirectGLES sets them
+            // independently from the EXT/OES_tessellation_point_size /
+            // geometry_point_size extension pairs (PointSizeTier), which really do come
+            // separately. When absent, ProgramSpirvTask demotes the built-in to an ordinary
+            // varying program-wide (ShaderCompiler::
+            // DemoteTessellationGeometryPointSizeForProgram); MOBILEGL_POINT_SIZE_DEMOTION
+            // overrides the detection in either direction at backend init.
+            //
+            // Defaults TRUE, deliberately against the house "assume absent" rule: false
+            // ARMS a rewrite, so the conservative no-backend answer (standalone compiles,
+            // unit tests) is the one that leaves modules untouched. A backend that never
+            // sets it gets standard modules and, at worst, the old honest declines.
+            Bool SupportsTessellationPointSize = true;
+            // The geometry-stage twin (OpCapability GeometryPointSize).
+            Bool SupportsGeometryPointSize = true;
             SizeT MaxShaderStorageBlockSize = 128 * 1024 * 1024;
             Uint32 SubgroupSize = 0;
             Uint32 SubgroupSupportedStages = 0;

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -1255,8 +1255,6 @@ namespace MobileGL::MG_Backend::DirectGLES {
             funcsTable.GL.MemoryBarrierByRegion = MemoryBarrierByRegion;
             funcsTable.GL.BindImageTexture = BindImageTexture;
             funcsTable.GL.GetIntegeri_v = GetIntegeri_v;
-            funcsTable.GL.GetInteger64i_v = GetInteger64i_v;
-            funcsTable.GL.GetProgramiv = GetProgramiv;
             funcsTable.GL.ShaderStorageBlockBinding = ShaderStorageBlockBinding;
             funcsTable.GL.Clear = Clear;
             funcsTable.GL.ClearBufferfi = ClearBufferfi;
@@ -1417,6 +1415,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
             clampStageStorageBlocks(m_GLESCapabilities.MaxFragmentShaderStorageBlocks);
         m_dynamicParameters.MaxComputeUniformBlocks = m_GLESCapabilities.MaxComputeUniformBlocks;
         m_dynamicParameters.MaxComputeWorkGroupInvocations = m_GLESCapabilities.MaxComputeWorkGroupInvocations;
+        // The six per-axis compute limits: the driver's raw glGetIntegeri_v answers, the same
+        // numbers GLFunctionsTable::GetIntegeri_v forwards live. Carried here so that MGPCaps has
+        // them once the table entry retires (plan B section 4.4.1); GL_Getter floors them.
+        for (SizeT axis = 0; axis < 3; ++axis) {
+            m_dynamicParameters.MaxComputeWorkGroupCount[axis] = m_GLESCapabilities.MaxComputeWorkGroupCount[axis];
+            m_dynamicParameters.MaxComputeWorkGroupSize[axis] = m_GLESCapabilities.MaxComputeWorkGroupSize[axis];
+        }
         // (MaxShaderStorageBufferBindings is assigned above, before the per-stage clamp reads it.)
         // This is the number glGetIntegerv(GL_MAX_TEXTURE_BUFFER_SIZE) hands the application, and
         // on a host without buffer textures it is knowingly a floor MobileGL cannot honour rather
@@ -1479,6 +1484,36 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // Follows the line above, and must: OpenGL ES has no double-precision vertex format and no
         // fp64 type to consume one with, so a 64-bit vertex attribute has nowhere to land here.
         m_dynamicParameters.SupportsFloat64VertexAttributes = false;
+        // Whether a tessellation / geometry stage's ESSL may name gl_PointSize at all: the two
+        // extension pairs the loader probed, independently, because they really do come
+        // separately. False arms the shared phase-B demotion
+        // (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram), whose ESSL then
+        // never names the built-in in those stages and needs no extension.
+        // MOBILEGL_POINT_SIZE_DEMOTION=1 pretends both are absent so the demotion can be
+        // exercised on a healthy driver (the pinned integration lane); =0 restores the
+        // detected answer's declines.
+        m_dynamicParameters.SupportsTessellationPointSize =
+            m_GLESCapabilities.TessellationPointSizeSupport !=
+            MG_External::GLESCapabilities::PointSizeTier::None;
+        m_dynamicParameters.SupportsGeometryPointSize =
+            m_GLESCapabilities.GeometryPointSizeSupport !=
+            MG_External::GLESCapabilities::PointSizeTier::None;
+        switch (MG_Config::Features.PointSizeDemotion) {
+        case MG_Config::QuirkOverride::ForceOn:
+            MGLOG_I("DirectGLES: MOBILEGL_POINT_SIZE_DEMOTION=1 - treating tessellation/geometry "
+                    "gl_PointSize as unhosted so the demotion runs on this driver");
+            m_dynamicParameters.SupportsTessellationPointSize = false;
+            m_dynamicParameters.SupportsGeometryPointSize = false;
+            break;
+        case MG_Config::QuirkOverride::ForceOff:
+            MGLOG_I("DirectGLES: MOBILEGL_POINT_SIZE_DEMOTION=0 - keeping the built-in and the "
+                    "plain declines regardless of the driver's extensions");
+            m_dynamicParameters.SupportsTessellationPointSize = true;
+            m_dynamicParameters.SupportsGeometryPointSize = true;
+            break;
+        case MG_Config::QuirkOverride::Auto:
+            break;
+        }
         m_dynamicParameters.MaxDrawBuffers = m_GLESCapabilities.MaxDrawBuffers;
         m_dynamicParameters.MaxColorAttachments = m_GLESCapabilities.MaxColorAttachments;
         m_dynamicParameters.MaxClipDistances = m_GLESCapabilities.MaxClipDistances;

MobileGL/MG_Backend/DirectGLES/DirectGLES.cpp

@@ -16,6 +16,7 @@
 #include <MG_Util/Classifiers/TextureEnumClassifier.h>
 #include <MG_Util/Metrics/TextureMetrics.h>
 #include <MG_State/GLState/Core.h>
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include <MG_State/GLState/ErrorState/Error.h>
 #include <MG_State/GLState/TextureState/TextureObjectBuffer.h>
 #include <MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h>
@@ -28,6 +29,7 @@
 #include <MG_Util/Converters/MGToGL/RenderStateEnumConverter.h>
 #include <MG_Util/Math/HalfFloat.h>
 #include <MG_Util/Metrics/BufferMetrics.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <MG_Util/Texture/PixelStoreProcessor.h>
 #include <Config.h>
 #include <atomic>
@@ -139,14 +141,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // addresses again - the cached pointers cannot go stale. Invalidation is
     // exactly the pointer compare below.
     using FbBindingSlot =
-        std::remove_reference_t<decltype(MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw))>;
-    static const MG_State::GLState::GLContext* g_fbSlotCacheContext = nullptr;
+        std::remove_reference_t<decltype(MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Draw))>;
+    static const void* g_fbSlotCacheContext = nullptr;
     static Array<FbBindingSlot*, SizeT(FramebufferTarget::FramebufferTargetCount)> g_fbSlotCache = {};
     static inline FbBindingSlot& GetFramebufferBindingSlotFast(FramebufferTarget target) {
-        MG_State::GLState::GLContext* ctx = MG_State::pGLContext.get();
+        const void* ctx = MGB_CTX_IDENTITY;
         if (ctx != g_fbSlotCacheContext) {
+            auto& live = *MGB_CTX;
             for (SizeT i = 0; i < g_fbSlotCache.size(); ++i) {
-                g_fbSlotCache[i] = &ctx->GetFramebufferBindingSlot(static_cast<FramebufferTarget>(i));
+                g_fbSlotCache[i] = &live.GetFramebufferBindingSlot(static_cast<FramebufferTarget>(i));
             }
             g_fbSlotCacheContext = ctx;
         }
@@ -257,7 +260,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     }
 
     const Uint8* ResolveIndirectCommandBytes(const void* indirect, SizeT requiredBytes, const char* label) {
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             drawBuffer->SyncPersistentMappedRange();
             const SizeT commandOffset = reinterpret_cast<SizeT>(indirect);
@@ -353,7 +356,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #endif
             // Only sync up to the high-water mark of app-touched points; the fixed array is 84
             // deep but apps bind a handful, so the never-touched tail is already at GL default 0.
-            auto bindingPointCnt = MG_State::pGLContext->GetTouchedBufferBindingPointCount(target);
+            auto bindingPointCnt = MGB_CTX->GetTouchedBufferBindingPointCount(target);
             // ...and never past what the ES driver itself can hold. MobileGL advertises the GL 4.5
             // minimum of 84 uniform binding points while the ES 3.2 minimum is 72, so a frontend
             // index in that gap would reach glBindBufferBase as GL_INVALID_VALUE. Nothing is lost
@@ -366,7 +369,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                            static_cast<SizeT>(g_GLESCapabilities.MaxUniformBufferBindings));
             }
             for (SizeT i = 0; i < bindingPointCnt; ++i) {
-                auto& point = MG_State::pGLContext->GetBufferBindingPoint(target, i);
+                auto& point = MGB_CTX->GetBufferBindingPoint(target, i);
                 auto& obj = point.GetBoundObject();
                 if (!obj) {
                     BindBufferBaseCached(glTarget, static_cast<GLuint>(i), 0);
@@ -425,7 +428,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             const SizeT pointCount = std::min<SizeT>(
                 bufferCount, MG_State::GLState::GLContext::MAX_TRANSFORM_FEEDBACK_BUFFERS);
             for (SizeT i = 0; i < pointCount; ++i) {
-                auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::TransformFeedback, i);
+                auto& point = MGB_CTX->GetBufferBindingPoint(BufferTarget::TransformFeedback, i);
                 const auto& obj = point.GetBoundObject();
                 // A stride-0 slot (two consecutive gl_NextBuffer entries) captures nothing and
                 // needs no binding; anything else with no buffer never got past the frontend.
@@ -458,10 +461,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // pull the real contents back (BufferObject::SyncGpuWrites).
         void MarkShaderStorageBuffersGpuWritten() {
             const SizeT bindingPointCnt =
-                MG_State::pGLContext->GetTouchedBufferBindingPointCount(BufferTarget::ShaderStorage);
+                MGB_CTX->GetTouchedBufferBindingPointCount(BufferTarget::ShaderStorage);
             for (SizeT i = 0; i < bindingPointCnt; ++i) {
                 const auto& obj =
-                    MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, i).GetBoundObject();
+                    MGB_CTX->GetBufferBindingPoint(BufferTarget::ShaderStorage, i).GetBoundObject();
                 if (obj) obj->MarkGpuWritten();
             }
         }
@@ -470,14 +473,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
-            const SizeT pointCount = MG_State::pGLContext->GetBufferBindingPointCount(BufferTarget::AtomicCounter);
+            const SizeT pointCount = MGB_CTX->GetBufferBindingPointCount(BufferTarget::AtomicCounter);
             for (const Int glBinding : glBindings) {
                 if (glBinding < 0 || static_cast<SizeT>(glBinding) >= pointCount) continue;
                 const Int esslBinding = esslBindingTop - glBinding;
                 // Already diagnosed once when the block was transpiled; nothing was bound to it
                 // there either, so there is nothing to unbind here.
                 if (esslBinding < 0) continue;
-                auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::AtomicCounter,
+                auto& point = MGB_CTX->GetBufferBindingPoint(BufferTarget::AtomicCounter,
                                                                           static_cast<Uint>(glBinding));
                 auto& obj = point.GetBoundObject();
                 if (!obj) {
@@ -514,7 +517,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
-            auto& bufferObject = MG_State::pGLContext->GetBufferBindingSlot(target).GetBoundObject();
+            auto& bufferObject = MGB_CTX->GetBufferBindingSlot(target).GetBoundObject();
             if (!bufferObject) {
                 g_GLESFuncs.glBindBuffer(glTarget, 0);
                 return;
@@ -658,7 +661,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // context since indirect draws now execute natively on the GPU.
             if (includeIndirectBuffer) {
                 auto& possibleIndirectBuffer =
-                    MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+                    MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
                 if (possibleIndirectBuffer) {
                     SyncBoundBuffer(BufferTarget::DrawIndirect, GL_DRAW_INDIRECT_BUFFER);
                 }
@@ -888,7 +891,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
                 const SizeT packedStride = program->GetTransformFeedbackPackedStride();
                 const SizeT modelledVertices =
-                    static_cast<SizeT>(MG_State::pGLContext->GetTransformFeedbackCapturedVertices());
+                    static_cast<SizeT>(MGB_CTX->GetTransformFeedbackCapturedVertices());
                 const SizeT vertices = std::min<SizeT>(modelledVertices, xfb.scatterCapacityVertices);
                 if (packedStride == 0 || vertices == 0) {
                     // The scatter path redirected the DRIVER's capture into the scratch buffer,
@@ -983,7 +986,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // not captured, and opening the span would also subject it to the capture
             // primitive-mode rule the paused draw is exempt from.
             if (!xfb.pending || xfb.paused) return;
-            const auto& program = MG_State::pGLContext->GetTransformFeedbackProgram();
+            const auto& program = MGB_CTX->GetTransformFeedbackProgram();
             if (!program) {
                 // The pending flag is deliberately NOT consumed here. It used to be cleared
                 // before this check, so a single draw that could not see the capture program
@@ -1003,7 +1006,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // recording it here keeps End independent of the frontend capture state.
             const SizeT bufferCount = program->GetTransformFeedbackBufferCount();
             for (SizeT i = 0; i < bufferCount; ++i) {
-                auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::TransformFeedback,
+                auto& point = MGB_CTX->GetBufferBindingPoint(BufferTarget::TransformFeedback,
                                                                           static_cast<Uint>(i));
                 const auto& bufferObject = point.GetBoundObject();
                 if (!bufferObject) continue;
@@ -1240,7 +1243,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #endif
             if (!program) return;
 
-            const auto& vao = MG_State::pGLContext->GetBoundVertexArray();
+            const auto& vao = MGB_CTX->GetBoundVertexArray();
             if (!vao || !vaoTwin) return;
 
             const Uint32 activeAttribMask = program->GetActiveAttributeLocationMask();
@@ -1271,7 +1274,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             for (Uint32 remaining = memo.pendingMask; remaining != 0; remaining &= remaining - 1) {
                 const Uint32 location = static_cast<Uint32>(std::countr_zero(remaining));
 
-                const auto& currentValue = MG_State::pGLContext->GetCurrentVertexAttribute(location);
+                const auto& currentValue = MGB_CTX->GetCurrentVertexAttribute(location);
                 const auto typeInfo = MG_State::GLState::ClassifyVertexAttribType(program->GetAttribType(location));
                 switch (typeInfo.baseType) {
                 case MG_State::GLState::VertexAttribBaseType::Float:
@@ -1369,7 +1372,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         static void CaptureUnitBindings(Int maxTouchedUnit, Vector<UnitBindingsSnapshot>& out) {
             out.resize(static_cast<SizeT>(maxTouchedUnit + 1));
             for (Int unit = 0; unit <= maxTouchedUnit; ++unit) {
-                auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+                auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
                 auto& snapshot = out[static_cast<SizeT>(unit)];
                 const auto& slots = textureUnit.GetAllBindingSlots();
                 for (SizeT i = 0; i < slots.size(); ++i) {
@@ -1382,7 +1385,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         static Bool UnitBindingsUnchanged(Int maxTouchedUnit, const Vector<UnitBindingsSnapshot>& snapshots) {
             if (snapshots.size() != static_cast<SizeT>(maxTouchedUnit + 1)) return false;
             for (Int unit = 0; unit <= maxTouchedUnit; ++unit) {
-                auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+                auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
                 const auto& snapshot = snapshots[static_cast<SizeT>(unit)];
                 const auto& slots = textureUnit.GetAllBindingSlots();
                 for (SizeT i = 0; i < slots.size(); ++i) {
@@ -1410,12 +1413,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // bump - so epoch equality alone proves the bindings a consumer resolved against
         // are the bindings on the units now.
         static Uint64 CurrentUnitBindingsEpoch(Int maxTouchedUnit) {
-            const Uint64 contextId = MG_State::pGLContext->GetTextureContextId();
-            const Uint64 bindGeneration = MG_State::pGLContext->GetTextureBindGeneration();
+            const Uint64 contextId = MGB_CTX->GetTextureContextId();
+            const Uint64 bindGeneration = MGB_CTX->GetTextureBindGeneration();
+            if (MG_Util::PipeStats::Enabled()) {
+                // Two accessor calls whichever way the shutter goes; only the unit WALK is
+                // gated, and that walk reads no GLContext accessor of its own.
+                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::AccessorCalls, 2);
+            }
             if (g_observedUnitBindingsContextId == contextId && g_observedUnitBindingsMaxUnit == maxTouchedUnit &&
                 g_observedUnitBindingsGeneration == bindGeneration) {
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::CountGate(MG_Util::PipeStats::Gate::EsprytUnitBindingsEpoch, /*hit=*/true);
+                }
                 return g_unitBindingsEpoch;
             }
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::CountGate(MG_Util::PipeStats::Gate::EsprytUnitBindingsEpoch, /*hit=*/false);
+            }
             if (g_observedUnitBindingsContextId != contextId || g_observedUnitBindingsMaxUnit != maxTouchedUnit ||
                 !UnitBindingsUnchanged(maxTouchedUnit, g_observedUnitBindings)) {
                 CaptureUnitBindings(maxTouchedUnit, g_observedUnitBindings);
@@ -1500,11 +1514,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         DrawTextureSyncKeys CaptureDrawTextureSyncKeys() {
             DrawTextureSyncKeys keys;
-            keys.contextId = MG_State::pGLContext->GetTextureContextId();
+            keys.contextId = MGB_CTX->GetTextureContextId();
             // Units past the frontend's high-water mark have provably-empty slots.
-            keys.maxTouchedUnit = MG_State::pGLContext->GetMaxTouchedTextureUnit();
-            keys.samplingGeneration = MG_State::pGLContext->GetSamplingResolutionGeneration();
+            keys.maxTouchedUnit = MGB_CTX->GetMaxTouchedTextureUnit();
+            keys.samplingGeneration = MGB_CTX->GetSamplingResolutionGeneration();
             keys.unitBindingsEpoch = CurrentUnitBindingsEpoch(keys.maxTouchedUnit);
+            if (MG_Util::PipeStats::Enabled()) {
+                // The three reads above; CurrentUnitBindingsEpoch counts its own two.
+                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::AccessorCalls, 3);
+            }
             return keys;
         }
 
@@ -1534,6 +1552,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 g_unitTextureSyncListEpoch == unitBindingsEpoch &&
                 g_unitTextureSyncListSamplingGeneration == samplingGeneration &&
                 PairingsIntact(g_unitTextureSyncList)) {
+                if (MG_Util::PipeStats::Enabled()) {
+                    // Gate 2 of section 2.3.1. The served path walks the memoised entries
+                    // and reads no GLContext accessor at all.
+                    MG_Util::PipeStats::CountGate(MG_Util::PipeStats::Gate::EsprytTextureSyncList, /*hit=*/true);
+                }
                 for (const auto& entry : g_unitTextureSyncList) {
                     // Aggregate gate == the conjunction of the three callees' own
                     // early-outs (see IsDrawSyncClean); skipping on true is
@@ -1546,10 +1569,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     entry.backend->SyncMipmapsToBackend(*entry.slot);
                 }
             } else {
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::CountGate(MG_Util::PipeStats::Gate::EsprytTextureSyncList, /*hit=*/false);
+                    // One GetTextureUnitObject per touched unit in the rebuild walk below.
+                    MG_Util::PipeStats::AddCalls(
+                        MG_Util::PipeStats::CallClass::AccessorCalls,
+                        maxTouchedUnit >= 0 ? static_cast<Uint64>(maxTouchedUnit) + 1u : 0u);
+                }
                 g_unitTextureSyncListValid = false;
                 g_unitTextureSyncList.clear();
                 for (Int index = 0; index <= maxTouchedUnit; ++index) {
-                    auto& unit = MG_State::pGLContext->GetTextureUnitObject(index);
+                    auto& unit = MGB_CTX->GetTextureUnitObject(index);
                     for (const auto& bindingSlot : unit.GetAllBindingSlots()) {
                         auto& textureObject = bindingSlot.GetBoundObject();
                         // An image-less default texture (name 0) is the slot's initial / "unbound"
@@ -1697,7 +1727,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(unit));
+            auto& imageBinding = MGB_CTX->GetImageTextureBinding(static_cast<Int>(unit));
             TrackWritableImageBufferUnit(unit, IsWritableImageBufferTexture(imageBinding));
             if (imageBinding.Texture && unit + 1 > g_imageUnitHighWaterMark) {
                 g_imageUnitHighWaterMark = unit + 1;
@@ -1789,7 +1819,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             if (g_writableImageBufferUnitCount == 0) return;
             for (Uint unit = 0; unit < g_writableImageBufferUnits.size(); ++unit) {
                 if (!g_writableImageBufferUnits[unit]) continue;
-                const auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(unit));
+                const auto& imageBinding = MGB_CTX->GetImageTextureBinding(static_cast<Int>(unit));
                 if (!IsWritableImageBufferTexture(imageBinding)) {
                     TrackWritableImageBufferUnit(unit, false);
                     continue;
@@ -1995,7 +2025,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
-            Uint16 currentRenderStateVersion = MG_State::pGLContext->GetRenderStateParametersVersion();
+            Uint16 currentRenderStateVersion = MGB_CTX->GetRenderStateParametersVersion();
             const Bool forceFullPush = g_forceFullRenderStateResync;
             g_forceFullRenderStateResync = false;
             // The alpha discipline for widened colour attachments (see the header comment on
@@ -2006,10 +2036,24 @@ namespace MobileGL::MG_Backend::DirectGLES {
             const Bool colorMaskWidenDirty = appliedWidenMask != g_syncedColorMaskAlphaWidenMask;
             if (!forceFullPush && !colorMaskWidenDirty && g_hasSyncedRenderState &&
                 currentRenderStateVersion == g_syncedRenderStateVersion) {
+                // Gate 1 of section 2.3.1: the steady-state cost of this whole function is
+                // the one Uint16 read above plus this compare.
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::CountGate(MG_Util::PipeStats::Gate::EsprytRenderState, /*hit=*/true);
+                    MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::AccessorCalls, 1);
+                }
                 return;
             }
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::CountGate(MG_Util::PipeStats::Gate::EsprytRenderState, /*hit=*/false);
+                // The version read above, the parameter-block fetch and the viewport fetch
+                // below - the three accessor calls this function makes unconditionally on a
+                // miss. The conditional sRGB capability read further down is deliberately
+                // NOT counted (see the inventory in PipeStats.cpp).
+                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::AccessorCalls, 3);
+            }
 
-            const auto& parameters = MG_State::pGLContext->GetRenderStateParameters();
+            const auto& parameters = MGB_CTX->GetRenderStateParameters();
 
             // The frontend has ONE version for the whole parameter block, so a per-draw blend
             // toggle used to re-diff all ~40 pieces of state field by field on every draw
@@ -2038,7 +2082,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 !g_hasSyncedRenderState || std::memcmp(currentBytes + kBlendSpanEnd, syncedBytes + kBlendSpanEnd,
                                                        sizeof(RenderStateParameters) - kBlendSpanEnd) != 0;
 
-            IntVec4 backendViewport = MG_State::pGLContext->GetViewport();
+            IntVec4 backendViewport = MGB_CTX->GetViewport();
             if (backendViewport.z() <= 0 || backendViewport.w() <= 0) {
                 Int surfaceWidth = 0;
                 Int surfaceHeight = 0;
@@ -2121,7 +2165,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
               // never turns it on, so the driver has to be told to write raw. Without this a render
               // into an sRGB colour buffer comes back encoded once too often (the shader's own
               // decode on the next fetch then leaves the value one conversion short).
-                const Bool srgbWrites = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::FramebufferSrgb);
+                const Bool srgbWrites = MGB_CTX->IsCapabilityEnabled(CapabilityInput::FramebufferSrgb);
                 if (g_GLESCapabilities.SupportsSrgbWriteControl &&
                     (forceFullPush || srgbWrites != g_syncedSrgbFramebufferWrites)) {
                     srgbWrites ? g_GLESFuncs.glEnable(GL_FRAMEBUFFER_SRGB)
@@ -2797,11 +2841,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 // member set it has to be told.
                 (twin->GetPassthroughTessControlPatchVertices() >= 0 &&
                  (twin->GetPassthroughTessControlPatchVertices() !=
-                      static_cast<Int>(MG_State::pGLContext->GetPatchVertices()) ||
+                      static_cast<Int>(MGB_CTX->GetPatchVertices()) ||
                   !BitwiseEqual(twin->GetPassthroughTessControlOuterLevel(),
-                                MG_State::pGLContext->GetPatchDefaultOuterLevel()) ||
+                                MGB_CTX->GetPatchDefaultOuterLevel()) ||
                   !BitwiseEqual(twin->GetPassthroughTessControlInnerLevel(),
-                                MG_State::pGLContext->GetPatchDefaultInnerLevel())))) {
+                                MGB_CTX->GetPatchDefaultInnerLevel())))) {
                 twin->SyncToBackend(currentProgram);
             }
             g_currentDrawFrontendProgram = currentProgram.get();
@@ -2912,7 +2956,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // resolved-buffers memo on the twin), the VAO sync and the draw-time bind
         // below. Nothing in between can invalidate it — the bound VAO is pinned by
         // the context, and no step here erases or replaces a live VAO's twin.
-        const auto& currentVAO = MG_State::pGLContext->GetBoundVertexArray();
+        const auto& currentVAO = MGB_CTX->GetBoundVertexArray();
         VertexArrayImpl::BackendVertexArrayObject* vaoTwin =
             currentVAO ? VertexArrayImpl::ResolveVaoTwin(currentVAO) : nullptr;
         // Early config-version read: see the note on SyncNeccessaryBuffers - issuing
@@ -2923,7 +2967,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // either, and none can run inside this preparation. GetProgramForDraw is a
         // cross-TU call with a guarded static inside - repeating it per stage showed
         // up in draw-loop profiles.
-        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
+        const auto& currentProgram = MGB_CTX->GetProgramForDraw();
+        if (MG_Util::PipeStats::Enabled()) {
+            // THE per-draw denominator for Espryt, plus this function's own two accessor
+            // calls (the VAO and the draw program). Everything the callees below read is
+            // counted by the callees that are instrumented; the rest is not counted (see
+            // the inventory in PipeStats.cpp).
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::Draws, 1);
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::AccessorCalls, 2);
+        }
         const TextureImpl::DrawTextureSyncKeys textureKeys = TextureImpl::CaptureDrawTextureSyncKeys();
 
         BufferImpl::SyncNeccessaryBuffers(currentVAO, vaoTwin, vaoConfigVersion,
@@ -2995,7 +3047,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         };
 
         for (Int unit = 0; unit <= maxTouchedUnit; ++unit) {
-            auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+            auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
             Array<Bool, (SizeT)TextureTarget::TextureTargetCount> boundBackendTargets{};
             Array<TextureTarget, (SizeT)TextureTarget::TextureTargetCount> claimedByFrontendTarget{};
             claimedByFrontendTarget.fill(TextureTarget::Unknown);
@@ -3159,7 +3211,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         }
         g_unitSamplerWalkValid = false;
         for (Int unit = 0; unit <= maxTouchedUnit; ++unit) {
-            const auto& samplerObject = MG_State::pGLContext->GetTextureUnitObject(unit).GetSamplerObject();
+            const auto& samplerObject = MGB_CTX->GetTextureUnitObject(unit).GetSamplerObject();
             if (samplerObject) {
                 if (auto* backendSampler = ResolveUnitSamplerBackend(unit, samplerObject)) {
                     backendSampler->Bind(unit);
@@ -3309,7 +3361,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     }
 
     void BindCurrentTextures() {
-        BindCurrentTextures(TextureImpl::CaptureDrawTextureSyncKeys(), MG_State::pGLContext->GetProgramForDraw());
+        BindCurrentTextures(TextureImpl::CaptureDrawTextureSyncKeys(), MGB_CTX->GetProgramForDraw());
     }
 
     // Binds the current program's backend object and re-establishes its per-program
@@ -3370,6 +3422,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             if (BufferImpl::UboRingAllocate(bindSize, offset)) {
                                 std::memcpy(static_cast<Uint8*>(BufferImpl::UboRingMappedPtr()) + offset,
                                             currentProgram->MapUBO(), uboSize);
+                                if (MG_Util::PipeStats::Enabled()) {
+                                    MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageUboGlobal,
+                                                                 static_cast<Uint64>(uboSize));
+                                }
                                 ringSlot = {uboContentVersion, BufferImpl::UboRingGeneration(), frameSerial,
                                             offset};
                                 slotValid = true;
@@ -3389,6 +3445,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             g_GLESFuncs.glBindBuffer(GL_UNIFORM_BUFFER, backendProgram.GetBackendGlobalUBOId());
                             g_GLESFuncs.glBufferSubData(GL_UNIFORM_BUFFER, 0, currentProgram->GetUBOSize(),
                                                         currentProgram->MapUBO());
+                            if (MG_Util::PipeStats::Enabled()) {
+                                MG_Util::PipeStats::AddBytes(
+                                    MG_Util::PipeStats::ByteClass::StageUboGlobal,
+                                    static_cast<Uint64>(currentProgram->GetUBOSize()));
+                            }
                             g_GLESFuncs.glBindBuffer(GL_UNIFORM_BUFFER, 0);
                             backendProgram.SetLastUploadedGlobalUboVersion(uboContentVersion);
                         }
@@ -3420,7 +3481,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
                         // Connect buffer to backend binding point
                         auto binding = currentProgram->GetUniformBlockBinding(i);
-                        auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::Uniform, binding);
+                        auto& point = MGB_CTX->GetBufferBindingPoint(BufferTarget::Uniform, binding);
                         auto& bufferObj = point.GetBoundObject();
                         auto range = point.GetRange();
 
@@ -3518,7 +3579,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                 samplerBinding.lastAssignedUnit = unit;
                             }
 
-                            auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+                            auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
                             auto& samplerObject = textureUnit.GetSamplerObject();
                             const auto& texture2D =
                                 textureUnit.GetBindingSlot(TextureTarget::Texture2D).GetBoundObject();
@@ -3600,7 +3661,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // PrepareForCompute, where the current program (and therefore its registry twin)
     // is pinned for the duration. Prefers the per-draw stash those preparations wrote.
     static PrgramImpl::BackendProgramObjectImpl* GetCurrentBackendProgram() {
-        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
+        const auto& currentProgram = MGB_CTX->GetProgramForDraw();
         if (!currentProgram || !currentProgram->GetLinkStatus() || !currentProgram->GetSpirvStatus()) {
             return nullptr;
         }
@@ -3650,7 +3711,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // flattening a batch that turns out to need per-sub-draw values is unrecoverable -
     // so an unanswerable program counts as needing them.
     Bool CurrentProgramMayNeedPerSubDrawBuiltins(Bool batchCarriesBaseVertices) {
-        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
+        const auto& currentProgram = MGB_CTX->GetProgramForDraw();
         const auto program = GetCurrentBackendProgram();
         if (!currentProgram || program == nullptr ||
             program->GetSyncedLinkVersion() != currentProgram->GetLinkVersion()) {
@@ -3759,12 +3820,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // times; rasterizer discard means there are no fragments to gate at all, so replaying
         // would be pure cost with nothing to show for it. Both fall back to a single pass with an
         // open gate, i.e. to the pre-emulation behaviour, rather than to wrong data.
-        if (MG_State::pGLContext->IsTransformFeedbackActive() ||
-            MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::RasterizerDiscard)) {
+        if (MGB_CTX->IsTransformFeedbackActive() ||
+            MGB_CTX->IsCapabilityEnabled(CapabilityInput::RasterizerDiscard)) {
             return 1;
         }
 
-        const auto& parameters = MG_State::pGLContext->GetRenderStateParameters();
+        const auto& parameters = MGB_CTX->GetRenderStateParameters();
         Int surfaceWidth = 0;
         Int surfaceHeight = 0;
         if (!QueryCurrentSurfaceSize(surfaceWidth, surfaceHeight)) {
@@ -4000,7 +4061,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // PrepareForDraw (nothing below can move either). The DISPATCH accessor: with a
         // pipeline bound this is its compute stage program, which is a whole program on its
         // own - the graphics composite a draw builds carries no compute stage.
-        const auto& currentProgram = MG_State::pGLContext->GetProgramForDispatch();
+        const auto& currentProgram = MGB_CTX->GetProgramForDispatch();
         const TextureImpl::DrawTextureSyncKeys textureKeys = TextureImpl::CaptureDrawTextureSyncKeys();
 
         BufferImpl::SyncComputeBuffers(includeDispatchIndirectBuffer);
@@ -4026,12 +4087,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
     }
 
     GLuint GetBackendProgramId(GLuint program) {
-        if (!MG_State::pGLContext->ValidateProgramName(program)) {
+        if (!MGB_CTX->ValidateProgramName(program)) {
             MGLOG_E_ONCE("Invalid frontend program object: %u", program);
             return 0;
         }
 
-        auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+        auto& programObject = MGB_CTX->GetProgramObject(program);
         if (!programObject) {
             MGLOG_E_ONCE("Program object %u is null.", program);
             return 0;
@@ -4094,7 +4155,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // color must go through glClearBufferfv, which GLES does not clamp.
         GLbitfield remainingMask = mask;
         if ((mask & GL_COLOR_BUFFER_BIT) != 0) {
-            const FloatVec4& cc = MG_State::pGLContext->GetRenderStateParameters().ClearColor;
+            const FloatVec4& cc = MGB_CTX->GetRenderStateParameters().ClearColor;
             const Bool outOfRange = cc.x() < 0.f || cc.x() > 1.f || cc.y() < 0.f || cc.y() > 1.f || cc.z() < 0.f ||
                                     cc.z() > 1.f || cc.w() < 0.f || cc.w() > 1.f;
             // A widened attachment's stored alpha has to end up 1.0, and glClear applies ONE
@@ -4153,7 +4214,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         g_GLESFuncs.glReadPixels(100, 100, 1, 1, GL_RGBA, GL_FLOAT, rb);
                         const GLenum rbErr = g_GLESFuncs.glGetError();
                         const auto& feFbo =
-                            MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
+                            MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
                         int feDb0 = -1, feDb1 = -1;
                         Uint feIdx = 0, feVer = 0;
                         if (feFbo) {
@@ -4306,13 +4367,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
             g_restartIndices.capacity = capacity;
             if (data != nullptr && bytes != 0) {
                 g_GLESFuncs.glBufferSubData(BufferImpl::TempBufferTarget, 0, static_cast<GLsizeiptr>(bytes), data);
+                if (MG_Util::PipeStats::Enabled()) {
+                    // Rewritten index list staged on the draw path: in a split build these
+                    // bytes are the index-mirror-versus-ship decision of section 8.
+                    MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageIndexClient,
+                                                 static_cast<Uint64>(bytes));
+                }
             }
             return true;
         }
 
         const SharedPtr<MG_State::GLState::BufferObject>& BoundElementArrayBuffer() {
             static const SharedPtr<MG_State::GLState::BufferObject> none;
-            const auto& vao = MG_State::pGLContext->GetBoundVertexArray();
+            const auto& vao = MGB_CTX->GetBoundVertexArray();
             if (!vao) return none;
             return vao->GetIndexBufferBindingSlot().GetBoundObject();
         }
@@ -4328,13 +4395,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
     } // namespace
 
     RestartSubstitutionKind ResolveRestartSubstitution(GLenum indexType) {
-        if (!MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::PrimitiveRestart) ||
-            MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::PrimitiveRestartFixedIndex)) {
+        if (!MGB_CTX->IsCapabilityEnabled(CapabilityInput::PrimitiveRestart) ||
+            MGB_CTX->IsCapabilityEnabled(CapabilityInput::PrimitiveRestartFixedIndex)) {
             return RestartSubstitutionKind::None;
         }
         const Uint32 fixedMax = MG_Util::FixedRestartIndexForGLType(indexType);
         if (fixedMax == 0) return RestartSubstitutionKind::None;
-        const Uint32 restartIndex = MG_State::pGLContext->GetPrimitiveRestartIndex();
+        const Uint32 restartIndex = MGB_CTX->GetPrimitiveRestartIndex();
         if (restartIndex == fixedMax) return RestartSubstitutionKind::None;
         // Strictly greater, never truncated. GL 4.6 core 10.3.6 compares the fetched index
         // zero-extended against the full 32-bit state, so an index this type cannot hold matches
@@ -4374,7 +4441,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         }
         const SizeT sourceIndexSize = MG_Util::GetGLTypeSize(indexType);
         const Uint32 fixedMax = MG_Util::FixedRestartIndexForGLType(indexType);
-        const Uint32 applicationRestartIndex = MG_State::pGLContext->GetPrimitiveRestartIndex();
+        const Uint32 applicationRestartIndex = MGB_CTX->GetPrimitiveRestartIndex();
         const auto& indexBuffer = BoundElementArrayBuffer();
 
         const Uint8* source = nullptr;
@@ -4502,7 +4569,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #endif
         DrawSyncFlags syncBit = DrawSyncBit::None;
         PrepareForDraw(syncBit);
-        const auto& currentVAO = MG_State::pGLContext->GetBoundVertexArray();
+        const auto& currentVAO = MGB_CTX->GetBoundVertexArray();
         if (currentVAO) {
             auto* backendVAOSlot = VertexArrayImpl::g_backendVertexArrayObjects.Find(currentVAO.get());
             if (backendVAOSlot && *backendVAOSlot) {
@@ -4541,7 +4608,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // ladder and the indirect executors do. Without it every sub-draw of a
         // glMultiDrawArrays read draw index 0.
         const Bool feedDrawID = CurrentProgramReadsDrawID();
-        const auto& currentVAO = MG_State::pGLContext->GetBoundVertexArray();
+        const auto& currentVAO = MGB_CTX->GetBoundVertexArray();
         for (GLsizei i = 0; i < drawcount; ++i) {
             // Client-side arrays are uploaded per sub-draw range, like the single DrawArrays path.
             if (currentVAO) {
@@ -4612,7 +4679,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         }
 
         const auto& drawIndirectBuffer =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         ExecuteIndexedIndirectCommands(mode, type, indexSize, commandBytes, reinterpret_cast<SizeT>(indirect),
                                        drawIndirectBuffer, drawcount, stride, "MultiDrawElementsIndirect");
     }
@@ -4643,8 +4710,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return;
         }
 
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
-        auto parameterBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto parameterBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
         if (!drawBuffer) {
             MGLOG_E_ONCE("MultiDrawElementsIndirectCount skipped: no GL_DRAW_INDIRECT_BUFFER is bound");
             return;
@@ -4714,7 +4781,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         }
 
         const auto& drawIndirectBuffer =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         ExecuteArraysIndirectCommands(mode, commandBytes, reinterpret_cast<SizeT>(indirect), drawIndirectBuffer,
                                       drawcount, stride, "MultiDrawArraysIndirect");
     }
@@ -4745,8 +4812,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
         DrawSyncFlags syncBit = DrawSyncBit::IndirectBuffer | DrawSyncBit::Instancing;
         PrepareForDraw(syncBit);
 
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
-        auto parameterBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto parameterBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
         if (!drawBuffer) {
             MGLOG_E_ONCE("MultiDrawArraysIndirectCount skipped: no GL_DRAW_INDIRECT_BUFFER is bound");
             return;
@@ -4905,7 +4972,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         }
 
         const auto& drawIndirectBuffer =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         ExecuteIndexedIndirectCommands(mode, type, indexSize, commandBytes, reinterpret_cast<SizeT>(indirect),
                                        drawIndirectBuffer, 1, sizeof(DrawElementsIndirectCommand),
                                        "DrawElementsIndirect");
@@ -4946,7 +5013,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         }
 
         const auto& drawIndirectBuffer =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         ExecuteArraysIndirectCommands(mode, commandBytes, reinterpret_cast<SizeT>(indirect), drawIndirectBuffer, 1,
                                       sizeof(DrawArraysIndirectCommand), "DrawArraysIndirect");
     }
@@ -5191,8 +5258,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // restore. Drop the flag so it is not misattributed to the emulation's own work.
             DrainBlitErrors();
 
-            if (MG_State::pGLContext->IsTransformFeedbackActive() &&
-                !MG_State::pGLContext->IsTransformFeedbackPaused() && g_GLESFuncs.glPauseTransformFeedback) {
+            if (MGB_CTX->IsTransformFeedbackActive() &&
+                !MGB_CTX->IsTransformFeedbackPaused() && g_GLESFuncs.glPauseTransformFeedback) {
                 g_GLESFuncs.glPauseTransformFeedback();
                 m_pausedTransformFeedback = true;
                 DrainBlitErrors();
@@ -5976,8 +6043,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // A no-op on every driver that honours a non-zero destination array layer, which is all
         // of them but the probed one. Whatever it performs itself is taken out of the mask.
         mask &= ~BlitLayeredDestinationAspects(
-            MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject(),
-            MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject(), srcX0, srcY0,
+            MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject(),
+            MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject(), srcX0, srcY0,
             srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask);
         if (mask != 0) {
             IssueBlitWithResolveFallback(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask, filter);
@@ -6039,8 +6106,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #ifdef TRACY_ENABLE
         ZoneScopedNC(__func__, TRACY_ZONECOLOR_BACKEND);
 #endif
-        auto unit = MG_State::pGLContext->GetActiveTextureUnit();
-        auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+        auto unit = MGB_CTX->GetActiveTextureUnit();
+        auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
 
         auto textureTarget = MG_Util::ConvertGLEnumToTextureTarget(target);
         if (!TextureImpl::IsSupportedTextureTarget(textureTarget)) {
@@ -6117,7 +6184,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // The frontend's current PACK parameters, for readbacks the ES driver serves
     // directly with the client's layout.
     static PixelStoreImpl::PackState PackStateFromContext() {
-        const auto packParams = MG_State::pGLContext->GetPixelStoreParameters(false);
+        const auto packParams = MGB_CTX->GetPixelStoreParameters(false);
         return {static_cast<GLint>(packParams.Alignment), static_cast<GLint>(packParams.RowLength),
                 static_cast<GLint>(packParams.SkipRows), static_cast<GLint>(packParams.SkipPixels)};
     }
@@ -6307,7 +6374,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 MG_Util::ConvertGLEnumToString(err).c_str(),
                 MG_Util::ConvertGLEnumToString(target).c_str(),
                 MG_Util::ConvertTextureInternalFormatToString(format).c_str());
-        MG_State::pGLContext->RecordError(
+        MGB_CTX->RecordError(
             ConvertGLESErrorToErrorCode(err),
             MakeUnique<GenericErrorInfo>("DirectGLES", operation,
                                          MG_Util::ConvertGLEnumToString(err)));
@@ -6631,8 +6698,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         // Bind necessary FBO and texture
         BindCurrentFBO(FramebufferTarget::Read);
-        Uint activeTextureUnit = MG_State::pGLContext->GetActiveTextureUnit();
-        const auto& textureObject = MG_State::pGLContext->GetTextureUnitObject((Int)activeTextureUnit)
+        Uint activeTextureUnit = MGB_CTX->GetActiveTextureUnit();
+        const auto& textureObject = MGB_CTX->GetTextureUnitObject((Int)activeTextureUnit)
                                         .GetBindingSlot(MG_Util::ConvertGLEnumToTextureTarget(target))
                                         .GetBoundObject();
         auto* backendTextureSlot = TextureImpl::g_backendTextureObjects.Find(textureObject.get());
@@ -6726,8 +6793,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         // Bind necessary FBO and texture
         BindCurrentFBO(FramebufferTarget::Read);
-        auto activeTextureUnit = MG_State::pGLContext->GetActiveTextureUnit();
-        const auto& textureObject = MG_State::pGLContext->GetTextureUnitObject(activeTextureUnit)
+        auto activeTextureUnit = MGB_CTX->GetActiveTextureUnit();
+        const auto& textureObject = MGB_CTX->GetTextureUnitObject(activeTextureUnit)
                                         .GetBindingSlot(MG_Util::ConvertGLEnumToTextureTarget(target))
                                         .GetBoundObject();
         auto* backendTextureSlot = TextureImpl::g_backendTextureObjects.Find(textureObject.get());
@@ -6864,8 +6931,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #if MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG && MOBILEGL_ENABLE_SCOPE_MARKER
         DebugImpl::OpenGLScopeMarker marker(__func__);
 #endif
-        auto unitIndex = MG_State::pGLContext->GetActiveTextureUnit();
-        auto& unit = MG_State::pGLContext->GetTextureUnitObject(unitIndex);
+        auto unitIndex = MGB_CTX->GetActiveTextureUnit();
+        auto& unit = MGB_CTX->GetTextureUnitObject(unitIndex);
         auto& slot = unit.GetBindingSlot(MG_Util::ConvertGLEnumToTextureTarget(target));
         auto& texture = slot.GetBoundObject();
         MOBILEGL_ASSERT(texture != nullptr, "GenerateMipmap requires a bound texture.");
@@ -7252,138 +7319,22 @@ namespace MobileGL::MG_Backend::DirectGLES {
         TextureImpl::SyncImageTextureBinding(unit);
     }
 
+    // Only the pnames MG_Impl/GLImpl/Getter/GL_Getter.cpp has no case for reach here. Every
+    // indexed pname naming FRONTEND state - the indexed buffer bindings, the per-unit
+    // texture/sampler bindings, the image-unit bindings, the viewport rectangles, the indexed
+    // capabilities - is answered there and returns before the table is consulted, so the arms
+    // this function used to carry for GL_SHADER_STORAGE_BUFFER_* and GL_IMAGE_BINDING_* were
+    // unreachable duplicates of the frontend's, and they did not even agree with it (the
+    // frontend reports the range glBindBufferRange was ASKED for, verbatim and unclamped; these
+    // clamped it to the buffer's current storage). In practice what arrives is
+    // GL_MAX_COMPUTE_WORK_GROUP_COUNT / _SIZE, which the driver owns.
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data) {
         if (!data) return;
-
-        switch (target) {
-        case GL_SHADER_STORAGE_BUFFER_BINDING: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            *data = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
+        if (g_GLESFuncs.glGetIntegeri_v) {
+            g_GLESFuncs.glGetIntegeri_v(target, index, data);
+        } else {
+            *data = 0;
         }
-        case GL_SHADER_STORAGE_BUFFER_START: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            *data = static_cast<GLint>(point.GetRange().start);
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_SIZE: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            if (!obj) {
-                *data = 0;
-                return;
-            }
-            const auto& range = point.GetRange();
-            const auto start = std::min(range.start, obj->GetSize());
-            const auto end = std::min(range.end, obj->GetSize());
-            *data = static_cast<GLint>(end - start);
-            return;
-        }
-        case GL_IMAGE_BINDING_NAME: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            *data = imageBinding.Texture ? static_cast<GLint>(imageBinding.Texture->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_IMAGE_BINDING_LEVEL: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            *data = imageBinding.Level;
-            return;
-        }
-        case GL_IMAGE_BINDING_LAYERED: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            *data = imageBinding.Layered;
-            return;
-        }
-        case GL_IMAGE_BINDING_LAYER: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            *data = imageBinding.Layer;
-            return;
-        }
-        case GL_IMAGE_BINDING_ACCESS: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            *data = static_cast<GLint>(imageBinding.Access);
-            return;
-        }
-        case GL_IMAGE_BINDING_FORMAT: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            *data = static_cast<GLint>(imageBinding.Format);
-            return;
-        }
-        default:
-            if (g_GLESFuncs.glGetIntegeri_v) {
-                g_GLESFuncs.glGetIntegeri_v(target, index, data);
-            } else {
-                *data = 0;
-            }
-            return;
-        }
-    }
-
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data) {
-        if (!data) return;
-
-        switch (target) {
-        case GL_SHADER_STORAGE_BUFFER_START: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            *data = static_cast<GLint64>(point.GetRange().start);
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_SIZE: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            if (!obj) {
-                *data = 0;
-                return;
-            }
-            const auto& range = point.GetRange();
-            const auto start = std::min(range.start, obj->GetSize());
-            const auto end = std::min(range.end, obj->GetSize());
-            *data = static_cast<GLint64>(end - start);
-            return;
-        }
-        default:
-            if (g_GLESFuncs.glGetInteger64i_v) {
-                g_GLESFuncs.glGetInteger64i_v(target, index, data);
-            } else {
-                *data = 0;
-            }
-            return;
-        }
-    }
-
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params) {
-        if (!params) return;
-        GLuint backendProgramId = GetBackendProgramId(program);
-        if (!backendProgramId) {
-            params[0] = 0;
-            return;
-        }
-        g_GLESFuncs.glGetProgramiv(backendProgramId, pname, params);
     }
 
     // NOTE the shape here, and do not "simplify" it back to GetBackendProgramId(): this entry
@@ -7405,8 +7356,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // effect by the block's next use.
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding) {
         if (!storageBlockName) return;
-        if (!MG_State::pGLContext->ValidateProgramName(program)) return;
-        auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+        if (!MGB_CTX->ValidateProgramName(program)) return;
+        auto& programObject = MGB_CTX->GetProgramObject(program);
         if (!programObject) return;
 
         auto* backendProgramSlot = PrgramImpl::g_backendProgramObjects.Find(programObject.get());
@@ -7602,7 +7553,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     template <typename FillRow>
     static Bool StoreReadbackRowsToClient(GLsizei width, GLsizei height, SizeT dstPixelBytes, void* pixels,
                                           const char* what, FillRow&& fillRow) {
-        const auto packParams = MG_State::pGLContext->GetPixelStoreParameters(false);
+        const auto packParams = MGB_CTX->GetPixelStoreParameters(false);
         const SizeT rowPixels = static_cast<SizeT>(packParams.RowLength > 0 ? packParams.RowLength : width);
         const SizeT dstRowStride = AlignPixelRow(rowPixels * dstPixelBytes, packParams.Alignment);
         const SizeT dstOffset = static_cast<SizeT>(std::max(packParams.SkipRows, 0)) * dstRowStride +
@@ -7610,7 +7561,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         const SizeT rowBytes = static_cast<SizeT>(width) * dstPixelBytes;
         const SizeT packedSize = dstOffset + static_cast<SizeT>(height - 1) * dstRowStride + rowBytes;
         const auto& pixelPackBufferObject =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
         const SizeT pboOffset = reinterpret_cast<SizeT>(pixels);
         if (pixelPackBufferObject && pboOffset + packedSize > pixelPackBufferObject->GetSize()) {
             MGLOG_E_ONCE("ReadPixels: %s readback PBO is too small", what);
@@ -8592,7 +8543,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return true;
         }
         const auto& pixelPackBufferObject =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
         if (!pixelPackBufferObject && pixels == nullptr) {
             return true;
         }
@@ -8822,7 +8773,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return true;
         }
         const auto& pixelPackBufferObject =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
         if (!pixelPackBufferObject && pixels == nullptr) {
             return true;
         }
@@ -9089,7 +9040,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // and legacy GL_RED reads) goes through the wide-format conversion, which picks a wide type
         // the driver accepts for the current attachment. GL_PACK_SWAP_BYTES has no ES equivalent, so
         // it always takes the conversion path (which swaps on the CPU).
-        const Bool packSwapBytes = MG_State::pGLContext->GetPixelStoreParameters(false).SwapBytes;
+        const Bool packSwapBytes = MGB_CTX->GetPixelStoreParameters(false).SwapBytes;
         // The read buffer is what glReadPixels reads, so the frontend's READ binding is exactly
         // the right thing to ask here.
         const Bool forceOpaqueAlpha = FramebufferImpl::IsAlphaWidenedFallbackReadAttachment();
@@ -9132,7 +9083,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // (the driver-level binding used to stay on the user PBO after this call,
         // capturing subsequent client-memory readbacks into it).
         auto& pixelPackBufferObject =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
         Bool usePBO = false;
         GLuint packBufferId = 0;
         if (pixelPackBufferObject) {
@@ -9242,10 +9193,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
         MGLOG_D("GetTexImage: SyncCurrentFBO()");
         FramebufferImpl::SyncCurrentFBO();
 
-        auto activeTextureUnit = MG_State::pGLContext->GetActiveTextureUnit();
+        auto activeTextureUnit = MGB_CTX->GetActiveTextureUnit();
         MGLOG_D("GetTexImage: active texture unit = %u", activeTextureUnit);
 
-        const auto& textureObject = MG_State::pGLContext->GetTextureUnitObject(activeTextureUnit)
+        const auto& textureObject = MGB_CTX->GetTextureUnitObject(activeTextureUnit)
                                         .GetBindingSlot(MG_Util::ConvertGLEnumToTextureTarget(target))
                                         .GetBoundObject();
 
@@ -9468,7 +9419,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 // Each slice is packed as its own 2D image, so the per-slice call must not apply
                 // GL_PACK_SKIP_IMAGES / GL_PACK_IMAGE_HEIGHT itself - this walks the destination
                 // over them, using the same layout StoreWideRowsToClient computes.
-                const auto packParams = MG_State::pGLContext->GetPixelStoreParameters(false);
+                const auto packParams = MGB_CTX->GetPixelStoreParameters(false);
                 const SizeT dstPixelBytes = GetReadbackDstPixelSize(conversionMapping, type);
                 const SizeT rowPixels =
                     static_cast<SizeT>(packParams.RowLength > 0 ? packParams.RowLength : size.x());
@@ -9558,7 +9509,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // Handle PBO. The pack binding is scoped: it returns to the resting 0 state
         // on every exit path, so a later readback can never land in a stale PBO.
         auto& pixelPackBufferObject =
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+            MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
         Bool usePBO = false;
         GLuint packBufferId = 0;
         if (pixelPackBufferObject) {
@@ -10638,6 +10589,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         BufferImpl::UnpackRingOnPresent();
         BufferImpl::UploadRingOnPresent();
         BufferImpl::TrimBufferPool();
+
+        // THE frame boundary for the MGPipe counters: publish this frame's plots, fold the
+        // frame into the run totals and, every 120th frame, emit the summary line.
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::OnPresent();
+        }
     }
 
     void DestroyEGLContext() {

MobileGL/MG_Backend/DirectGLES/DirectGLES.h

@@ -92,8 +92,6 @@ namespace MobileGL::MG_Backend::DirectGLES {
     void BindImageTexture(GLuint unit, GLuint texture, GLint level, GLboolean layered, GLint layer, GLenum access,
                           GLenum format);
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params);
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding);
     Bool InitWindowSurface(NativeWindowType window);
     Bool InitPbufferSurface(EGLint width, EGLint height);

MobileGL/MG_Backend/DirectGLES/Managers.cpp

@@ -7,6 +7,7 @@
 // End of Source File Header
 
 #include "Managers.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "Utils.h"
 #include "DirectGLES.h"
 #include "BackendObject_DirectGLES.h"
@@ -15,6 +16,7 @@
 #include <MG_Util/ShaderTranspiler/TranslationCache.h>
 
 #include <MG_Util/BackendLoaders/OpenGL/Loader.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/DataTypeConverter.h>
 #include <MG_Util/Converters/MGToGL/BufferEnumConverter.h>
@@ -779,10 +781,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 const void* initialData =
                     (size > 0 && bufferObject.HasDefinedContent()) ? bufferObject.MappedData() : nullptr;
                 g_GLESFuncs.glBufferData(TempBufferTarget, (GLsizeiptr)size, initialData, usage);
+                if (MG_Util::PipeStats::Enabled() && initialData != nullptr) {
+                    // An ORPHANING respecify passes NULL and moves nothing, which is exactly
+                    // why the test is on initialData rather than on size.
+                    MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                                 static_cast<Uint64>(size));
+                }
                 resource.storageSize = size;
                 resource.storageInitialized = true;
                 resource.pendingRespecify = false;
                 resource.pendingRanges.clear();
+                resource.pendingResidentWrites.clear();
                 resource.syncedChangeSerial = bufferObject.GetChangeSerial();
                 // A GROWN store keeps its indexed bindings, and BindBufferBaseCached skips a
                 // rebind whenever the shadow already records this id at that index - so on a
@@ -828,6 +837,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 return RingAvailable(g_uploadRing);
             }
 
+            // A partial range below this goes through the staging ring instead of a
+            // range-invalidating map: the map's page-substitution fast path needs a
+            // sizeable (page-coverable) range to engage, and below it the driver
+            // falls back to waiting out the WAR hazard on the CPU.
+            constexpr SizeT kInvalidateRangeMinBytes = 128u * 1024u;
+
             // Push every queued range of `resource` from the shadow into the backend
             // store, without ever letting a driver resolve the WAR hazard against
             // in-flight frames at the WHOLE BUFFER's expense. Three tiers:
@@ -879,11 +894,34 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     const SizeT start = std::min(range.start, end);
                     const SizeT size = end - start;
                     if (size == 0) continue;
-                    if (mapUsable) {
+                    if (MG_Util::PipeStats::Enabled()) {
+                        // Counted once per queued range, before the three delivery shapes
+                        // below diverge: all three move exactly these bytes, and it is the
+                        // byte count - not the shape - that sizes SEG_STAGE.
+                        MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                                     static_cast<Uint64>(size));
+                    }
+                    // The invalidating map's fast path is SHAPE-dependent on this Mali
+                    // driver: a whole-buffer invalidation renames the store outright,
+                    // and a large range gets fresh pages - but a small unaligned range
+                    // of a busy store makes the map WAIT (osup_sync_object_wait, ~9%
+                    // of a Minecraft 26.3 replay). So: whole buffer -> orphan-map;
+                    // large range -> range-invalidating map; small range -> the staged
+                    // ring copy, whose worst case (a whole-destination ghost) is only
+                    // ever the small destination itself.
+                    //
+                    // The map covers EXACTLY the queued range: only those bytes are the
+                    // shadow's to rewrite. Widening to page bounds looked free and was
+                    // not - the widened bytes clobbered GPU-written data (an SSBO
+                    // counter beside the app's SubData) with the stale shadow.
+                    const Bool wholeBuffer = start == 0 && end == limit && limit == resource.storageSize;
+                    if (mapUsable && (wholeBuffer || size >= kInvalidateRangeMinBytes)) {
                         BindBufferId(TempBufferTarget, resource.id);
+                        const GLbitfield access =
+                            GL_MAP_WRITE_BIT |
+                            (wholeBuffer ? GL_MAP_INVALIDATE_BUFFER_BIT : GL_MAP_INVALIDATE_RANGE_BIT);
                         void* dst = g_GLESFuncs.glMapBufferRange(TempBufferTarget, (GLintptr)start,
-                                                                 (GLsizeiptr)size,
-                                                                 GL_MAP_WRITE_BIT | GL_MAP_INVALIDATE_RANGE_BIT);
+                                                                 (GLsizeiptr)size, access);
                         if (dst) {
                             Memcpy(dst, bufferObject.MappedData() + start, size);
                             g_GLESFuncs.glUnmapBuffer(TempBufferTarget);
@@ -904,6 +942,53 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 }
             }
 
+            // Land the app bytes queued for an ADOPTED store on the GPU timeline: staged
+            // into the upload ring and delivered by glCopyBufferSubData. The destination
+            // is the IMMUTABLE persistent store, which the driver can neither rename nor
+            // ghost, so the copy is plain job ordering - after every in-flight reader,
+            // before the next consumer - which is exactly glBufferSubData's contract.
+            // (The in-place host write these bytes replaced tore the frames still
+            // reading the old vertex data: one-frame wrong geometry during fast camera
+            // movement.) Fallback: direct glBufferSubData - the adopted store carries
+            // DYNAMIC_STORAGE, and immutability again forbids the whole-store ghost.
+            void DrainResidentWritesNow(GLESBufferResource& resource, BufferObject& bufferObject) {
+#ifdef TRACY_ENABLE
+                ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
+#endif
+                Vector<GLESBufferResource::PendingResidentWrite> writes;
+                {
+                    const std::lock_guard<std::mutex> lock(resource.pendingMutex);
+                    if (resource.pendingResidentWrites.empty()) return;
+                    writes = std::move(resource.pendingResidentWrites);
+                    resource.pendingResidentWrites.clear();
+                }
+                const SizeT limit = resource.storageSize;
+                const Bool ringUsable = UploadRingUsableNow();
+                for (const auto& write : writes) {
+                    if (write.offset >= limit) continue;
+                    const SizeT size = std::min(write.bytes.size(), limit - write.offset);
+                    if (size == 0) continue;
+                    if (MG_Util::PipeStats::Enabled()) {
+                        MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                                     static_cast<Uint64>(size));
+                    }
+                    SizeT ringOffset = 0;
+                    if (ringUsable && size <= kUploadRingMaxBytes &&
+                        RingAllocate(g_uploadRing, size, ringOffset)) {
+                        Memcpy(g_uploadRing.store.mappedPtr + ringOffset, write.bytes.data(), size);
+                        BindBufferId(GL_COPY_READ_BUFFER, g_uploadRing.store.id);
+                        BindBufferId(GL_COPY_WRITE_BUFFER, resource.id);
+                        g_GLESFuncs.glCopyBufferSubData(GL_COPY_READ_BUFFER, GL_COPY_WRITE_BUFFER,
+                                                        (GLintptr)ringOffset, (GLintptr)write.offset,
+                                                        (GLsizeiptr)size);
+                    } else {
+                        BindBufferId(TempBufferTarget, resource.id);
+                        g_GLESFuncs.glBufferSubData(TempBufferTarget, (GLintptr)write.offset, (GLsizeiptr)size,
+                                                    write.bytes.data());
+                    }
+                }
+            }
+
             // EXT_buffer_storage bit values (same numeric values as the desktop ARB
             // tokens); defined locally so this compiles regardless of which GLES headers
             // expose the EXT tokens.
@@ -989,6 +1074,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 {
                     const std::lock_guard<std::mutex> lock(resource->pendingMutex);
                     resource->pendingRanges.clear();
+                    resource->pendingResidentWrites.clear();
                 }
                 resource->syncedChangeSerial = bufferObject.GetChangeSerial();
                 return ptr;
@@ -1026,12 +1112,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     resource->storageSize = 0;
                     resource->pendingRespecify = true;
                     resource->pendingRanges.clear();
+                    resource->pendingResidentWrites.clear();
                     return;
                 }
                 if (!CanTouchGLNow() || resource->id == 0 ||
                     resource->contextGeneration != g_bufferContextGeneration) {
                     resource->pendingRespecify = true;
                     resource->pendingRanges.clear();
+                    resource->pendingResidentWrites.clear();
                     return;
                 }
                 if (bufferObject.GetSize() == 0) {
@@ -1039,6 +1127,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     resource->storageSize = 0;
                     resource->pendingRespecify = false;
                     resource->pendingRanges.clear();
+                    resource->pendingResidentWrites.clear();
                     return;
                 }
                 RespecifyStorageNow(*resource, bufferObject);
@@ -1055,17 +1144,22 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     resource->pendingRanges.Add({offset, offset + size});
                     return;
                 }
+                // An adopted zero-copy persistent store already HAS the bytes (the
+                // frontend wrote them through the coherent mapping); a driver upload
+                // here would be a self-copy that re-synchronizes what coherent mapping
+                // made free.
+                if (resource->persistentMapped && resource->persistentPtr) {
+                    resource->syncedChangeSerial = bufferObject.GetChangeSerial();
+                    return;
+                }
                 // An immediate glBufferSubData resolves the WAR hazard against frames
                 // still referencing this store on the CPU on some drivers - Mali parks
                 // the thread in osup_sync_object_wait until every referencing job
                 // retires, which serialized Minecraft 26.3's per-frame UBO/chunk-mesh
                 // update streams into ~1 fps. Queue the range instead (the shadow
                 // already holds the bytes) and let draw-time sync push the merged
-                // ranges through the staging ring. The zero-copy persistent store
-                // keeps the legacy immediate upload: draw-time sync never flushes
-                // ranges for it, and its mapping publishes writes by itself.
-                if ((resource->persistentMapped && resource->persistentPtr) ||
-                    MG_Config::Features.EsprytDisableUploadRing) {
+                // ranges through the staging ring.
+                if (MG_Config::Features.EsprytDisableUploadRing) {
                     UploadRangeNow(*resource, bufferObject, offset, offset + size);
                     resource->syncedChangeSerial = bufferObject.GetChangeSerial();
                     return;
@@ -1074,6 +1168,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 resource->pendingRanges.Add({offset, offset + size});
             }
 
+            // App bytes for an ADOPTED store: queue them untouched-by-the-mapping; the
+            // draw-time sync (or a readback) lands them GPU-ordered through
+            // DrainResidentWritesNow. No GL here, so the op is thread-agnostic.
+            void Ops_ResidentSubData(BufferObject& bufferObject, SizeT offset, DataPtr data) {
+                auto* resource = ResourceOf(bufferObject);
+                if (!resource || data.size == 0) return;
+                const std::lock_guard<std::mutex> lock(resource->pendingMutex);
+                auto& write = resource->pendingResidentWrites.emplace_back();
+                write.offset = offset;
+                const auto* bytes = static_cast<const Uint8*>(data.data);
+                write.bytes.assign(bytes, bytes + data.size);
+            }
+
             void Ops_FlushMappedRange(BufferObject& bufferObject, Range1D range,
                                       Flags<BufferMappingAccessBit> appAccess) {
                 auto* resource = ResourceOf(bufferObject);
@@ -1087,13 +1194,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     return;
                 }
 
-                // Same WAR-hazard rule as Ops_SubData: an immediate upload (mapped or
-                // glBufferSubData) can park the thread on Mali until the frames still
-                // referencing this store retire. Queue the range for the staged-copy
-                // flush at draw-time sync; only the zero-copy persistent store and the
-                // negative-control kill switch keep the immediate paths below.
-                if (!(resource->persistentMapped && resource->persistentPtr) &&
-                    !MG_Config::Features.EsprytDisableUploadRing) {
+                // An adopted zero-copy persistent store already HAS the bytes: the
+                // frontend shadow IS the coherent mapping the app (or UploadSubData)
+                // wrote into, so publishing is free. The self-copy that used to run
+                // here mapped a buffer this backend keeps persistently mapped (an
+                // INVALID_OPERATION whose fallback was a WAR-stalling
+                // glBufferSubData).
+                if (resource->persistentMapped && resource->persistentPtr) {
+                    resource->syncedChangeSerial = bufferObject.GetChangeSerial();
+                    return;
+                }
+
+                // Same WAR-hazard rule as Ops_SubData: an immediate synchronized upload
+                // (mapped or glBufferSubData) can park the thread on Mali until the
+                // frames still referencing this store retire. Queue the range for the
+                // staged flush at draw-time sync; the negative-control kill switch
+                // keeps the immediate paths below.
+                if (!MG_Config::Features.EsprytDisableUploadRing) {
                     const std::lock_guard<std::mutex> lock(resource->pendingMutex);
                     resource->pendingRanges.Add(range);
                     return;
@@ -1137,8 +1254,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 if (!resource || resource->id == 0 || !resource->storageInitialized) return;
                 if (!CanTouchGLNow() || resource->contextGeneration != g_bufferContextGeneration) return;
                 if (resource->persistentMapped) {
-                    // Host writes to a persistent map must not race shader writes already queued
-                    // on this context. There is no backend copy to read back in this case.
+                    // Queued resident SubData bytes land first (GPU-ordered), then the
+                    // finish makes them - and any shader writes already queued on this
+                    // context - visible through the coherent mapping the reads use.
+                    // There is no backend copy to read back in this case.
+                    DrainResidentWritesNow(*resource, bufferObject);
                     if (g_GLESFuncs.glFinish) g_GLESFuncs.glFinish();
                     return;
                 }
@@ -1204,6 +1324,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 Ops_SubData(bufferObject, offset, size);
                 BumpBufferMutationEpoch();
             }
+            void Ops_ResidentSubDataTracked(BufferObject& bufferObject, SizeT offset, DataPtr data) {
+                Ops_ResidentSubData(bufferObject, offset, data);
+                BumpBufferMutationEpoch();
+            }
             void Ops_FlushMappedRangeTracked(BufferObject& bufferObject, Range1D range,
                                              Flags<BufferMappingAccessBit> appAccess) {
                 Ops_FlushMappedRange(bufferObject, range, appAccess);
@@ -1228,6 +1352,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             const BufferBackendOps g_glesBufferBackendOps = {
                 .Respecify = Ops_RespecifyTracked,
                 .SubData = Ops_SubDataTracked,
+                .ResidentSubData = Ops_ResidentSubDataTracked,
                 .FlushMappedRange = Ops_FlushMappedRangeTracked,
                 .OnDestroy = Ops_OnDestroyTracked,
                 .AcquirePersistentMap = Ops_AcquirePersistentMapTracked,
@@ -1329,7 +1454,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
             if (resource->id == 0) return false;
             // Zero-copy coherent persistent store: EnsureBufferResource's own early-out —
             // the app writes straight into the mapped GPU storage, nothing to sync.
-            if (resource->persistentMapped) return resource->persistentPtr != nullptr;
+            // Except queued resident SubData bytes, which land through the sync path
+            // (same unlocked emptiness probe as pendingRanges below).
+            if (resource->persistentMapped) {
+                return resource->persistentPtr != nullptr && resource->pendingResidentWrites.empty();
+            }
             // A live non-zero-copy map may owe a per-draw SyncPersistentMappedRange push
             // (persistent maps mutate the shadow without bumping the change serial).
             if (frontend->IsMapped()) return false;
@@ -1361,6 +1490,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 resource->storageSize = 0;
                 resource->pendingRespecify = true;
                 resource->pendingRanges.clear();
+                    resource->pendingResidentWrites.clear();
                 resource->contextGeneration = g_bufferContextGeneration;
                 // The persistent map (and its pointer) died with the old context; the
                 // frontend re-acquires a fresh one on its next map.
@@ -1390,6 +1520,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // persistently mapped immutable store, so there is nothing to (re)upload at
             // draw time. This is where the per-draw whole-buffer glBufferSubData used to run.
             if (resource->persistentMapped && resource->persistentPtr && resource->id != 0) {
+                DrainResidentWritesNow(*resource, *bufferObject);
                 return resource;
             }
 
@@ -1408,9 +1539,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     BindBufferId(TempBufferTarget, reused);
                     g_GLESFuncs.glBufferSubData(TempBufferTarget, 0, (GLsizeiptr)poolSize,
                                                 bufferObject->MappedData());
+                    if (MG_Util::PipeStats::Enabled()) {
+                        // The pool-recycle reseed is a whole-buffer upload on the hot path,
+                        // not a bookkeeping detail: it moves the same bytes a fresh
+                        // glBufferData would.
+                        MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                                     static_cast<Uint64>(poolSize));
+                    }
                     {
                         const std::lock_guard<std::mutex> lock(resource->pendingMutex);
                         resource->pendingRanges.clear();
+                    resource->pendingResidentWrites.clear();
                     }
                     resource->syncedChangeSerial = bufferObject->GetChangeSerial();
                 } else {
@@ -2432,6 +2571,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     g_GLESFuncs.glBufferData(GL_ARRAY_BUFFER,
                                              static_cast<GLsizeiptr>(converted.size() * sizeof(Float)),
                                              converted.data(), GL_STREAM_DRAW);
+                    if (MG_Util::PipeStats::Enabled()) {
+                        MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageVertexClient,
+                                                     static_cast<Uint64>(converted.size() * sizeof(Float)));
+                    }
                     // GL ignores `normalized` for floating-point array types, so it is not
                     // forwarded here either.
                     g_GLESFuncs.glVertexAttribPointer(attribIndex, attrib.Size, GL_FLOAT, GL_FALSE,
@@ -2462,6 +2605,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 BufferImpl::BindBufferId(GL_ARRAY_BUFFER, bufferId);
                 g_GLESFuncs.glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(uploadSize), clientData,
                                          GL_STREAM_DRAW);
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageVertexClient,
+                                                 static_cast<Uint64>(uploadSize));
+                }
 
                 if (!attrib.IsInteger) {
                     const GLint glSize = attrib.IsBgra ? static_cast<GLint>(GL_BGRA) : attrib.Size;
@@ -2556,6 +2703,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 g_GLESFuncs.glBufferData(GL_ARRAY_BUFFER,
                                          static_cast<GLsizeiptr>(converted.size() * sizeof(Float)),
                                          converted.data(), GL_STREAM_DRAW);
+                if (MG_Util::PipeStats::Enabled()) {
+                    // The VBO-backed half of the 64-bit narrowing. Same population as the
+                    // client-array half above: a stream the backend synthesises per draw.
+                    MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageVertexClient,
+                                                 static_cast<Uint64>(converted.size() * sizeof(Float)));
+                }
                 stream.valid = true;
                 stream.sourceLifetimeId = sourceLifetimeId;
                 stream.sourceChangeSerial = sourceChangeSerial;
@@ -2628,7 +2781,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     }
                 }
             }
-            if (m_contextGeneration == g_backendContextGeneration && g_GLESFuncs.glDeleteTextures) {
+            // TEMP-EXP (leak texture deletes): /sdcard/MG/exp_leak_texture_deletes.
+            // Discriminator for the mali-mem-purge hiccup theory: never hand the
+            // driver a texture free, so the purge daemon has nothing to reclaim.
+            static const Bool s_expLeakTextureDeletes = [] {
+                FILE* f = std::fopen("/sdcard/MG/exp_leak_texture_deletes", "rb");
+                if (!f) return false;
+                std::fclose(f);
+                return true;
+            }();
+            if (m_contextGeneration == g_backendContextGeneration && g_GLESFuncs.glDeleteTextures &&
+                !s_expLeakTextureDeletes) {
                 g_GLESFuncs.glDeleteTextures(1, &m_backendTextureId);
                 if (m_bufferImageSplitViewId != 0) {
                     g_GLESFuncs.glDeleteTextures(1, &m_bufferImageSplitViewId);
@@ -3479,9 +3642,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // that needs no work costs the same nothing per draw that any other synced texture does.
         void BackendTextureObject::StampViewSyncKeys(
             const SharedPtr<MG_State::GLState::ITextureObject>& stateTextureObject) {
-            if (MG_State::pGLContext) {
-                m_syncedShapeContextId = MG_State::pGLContext->GetTextureContextId();
-                m_syncedShapeGeneration = MG_State::pGLContext->GetSamplingResolutionGeneration();
+            if (MGB_CTX_LIVE) {
+                m_syncedShapeContextId = MGB_CTX->GetTextureContextId();
+                m_syncedShapeGeneration = MGB_CTX->GetSamplingResolutionGeneration();
                 m_syncedShapeParamsVersion = stateTextureObject->GetTextureParamsVersion();
             }
             m_syncedContentVersion = stateTextureObject->GetContentVersion();
@@ -3608,9 +3771,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // version - and backend-side storage resets clear m_isInitialized. Restricted to
             // Mipmap storage like the probe fast path: a buffer texture's backing store can move
             // without any of these keys noticing.
-            if (m_isInitialized && m_syncedShapeContextId != 0 && MG_State::pGLContext &&
-                m_syncedShapeContextId == MG_State::pGLContext->GetTextureContextId() &&
-                m_syncedShapeGeneration == MG_State::pGLContext->GetSamplingResolutionGeneration() &&
+            if (m_isInitialized && m_syncedShapeContextId != 0 && MGB_CTX_LIVE &&
+                m_syncedShapeContextId == MGB_CTX->GetTextureContextId() &&
+                m_syncedShapeGeneration == MGB_CTX->GetSamplingResolutionGeneration() &&
                 m_syncedContentVersion == stateTextureObject->GetContentVersion() &&
                 m_syncedShapeParamsVersion == stateTextureObject->GetTextureParamsVersion() &&
                 stateTextureObject->GetStorageType() == TextureStorageType::Mipmap) {
@@ -3679,9 +3842,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     // The probe just proved "fully synced" from the real state, so the cheap
                     // gate may be (re)stamped here: the coarse generation only ever goes stale
                     // from OTHER textures' churn, and this draw re-validated this one.
-                    if (MG_State::pGLContext) {
-                        m_syncedShapeContextId = MG_State::pGLContext->GetTextureContextId();
-                        m_syncedShapeGeneration = MG_State::pGLContext->GetSamplingResolutionGeneration();
+                    if (MGB_CTX_LIVE) {
+                        m_syncedShapeContextId = MGB_CTX->GetTextureContextId();
+                        m_syncedShapeGeneration = MGB_CTX->GetSamplingResolutionGeneration();
                         m_syncedShapeParamsVersion = stateTextureObject->GetTextureParamsVersion();
                     }
                     return;
@@ -4268,6 +4431,42 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             if (ringStaged) {
                                 BufferImpl::BindPixelUnpackBufferId(BufferImpl::UnpackRingBufferId());
                             }
+                            if (MG_Util::PipeStats::Enabled()) {
+                                // One emission per (upload target, level) that ships texels;
+                                // the switch below turns it into either one union-box job or
+                                // dirtyRectCount rect jobs. The box/rect split is counted
+                                // separately from the bytes on purpose: SSIM is blind to it
+                                // and the +6 ms/frame Mali cliff was a shape regression, not
+                                // a byte regression (plan section 7.3).
+                                const Bool rectShape = subRectEligible && dirtyRectCount >= 2;
+                                Uint64 shippedBytes = 0;
+                                if (rectShape) {
+                                    for (SizeT r = 0; r < dirtyRectCount; ++r) {
+                                        const auto& rect = dirtyRects[r];
+                                        shippedBytes += static_cast<Uint64>(rect.hi.x() - rect.lo.x()) *
+                                                        static_cast<Uint64>(rect.hi.y() - rect.lo.y()) *
+                                                        static_cast<Uint64>(std::max(rect.hi.z() - rect.lo.z(), 1)) *
+                                                        static_cast<Uint64>(bpp);
+                                    }
+                                } else if (subRectEligible) {
+                                    shippedBytes = static_cast<Uint64>(regionSize.x()) *
+                                                   static_cast<Uint64>(regionSize.y()) *
+                                                   static_cast<Uint64>(std::max(regionSize.z(), 1)) *
+                                                   static_cast<Uint64>(bpp);
+                                } else {
+                                    shippedBytes = static_cast<Uint64>(byteSize);
+                                }
+                                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageTexture,
+                                                             shippedBytes);
+                                MG_Util::PipeStats::AddCalls(
+                                    MG_Util::PipeStats::CallClass::TextureUploadEmissions, 1);
+                                MG_Util::PipeStats::AddCalls(
+                                    rectShape ? MG_Util::PipeStats::CallClass::TextureUploadRectEmissions
+                                              : MG_Util::PipeStats::CallClass::TextureUploadBoxEmissions,
+                                    1);
+                                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadJobs,
+                                                             rectShape ? static_cast<Uint64>(dirtyRectCount) : 1u);
+                            }
                             switch (MapToBackendTextureTarget(stateTextureObject->GetTarget())) {
                             case TextureTarget::Texture2D:
                             case TextureTarget::TextureCubeMap:
@@ -4534,9 +4733,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // Same instant, so the cheap gate's keys describe exactly this synced state.
             // Only Mipmap storage may arm it - the gate refuses other storage types anyway,
             // but a stale trio must not linger on an object that later switches type.
-            if (MG_State::pGLContext && stateTextureObject->GetStorageType() == TextureStorageType::Mipmap) {
-                m_syncedShapeContextId = MG_State::pGLContext->GetTextureContextId();
-                m_syncedShapeGeneration = MG_State::pGLContext->GetSamplingResolutionGeneration();
+            if (MGB_CTX_LIVE && stateTextureObject->GetStorageType() == TextureStorageType::Mipmap) {
+                m_syncedShapeContextId = MGB_CTX->GetTextureContextId();
+                m_syncedShapeGeneration = MGB_CTX->GetSamplingResolutionGeneration();
                 m_syncedShapeParamsVersion = stateTextureObject->GetTextureParamsVersion();
             } else {
                 m_syncedShapeContextId = 0;
@@ -5154,7 +5353,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // read buffer names no colour attachment at all.
         static const MG_State::GLState::FramebufferAttachmentObject* GetReadColorAttachment() {
             const auto& readFBO =
-                MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject();
+                MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject();
             if (!readFBO) {
                 return nullptr;
             }
@@ -5259,7 +5458,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         Bool IsFixedPointFallbackReadAttachment() {
             const auto& readFBO =
-                MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject();
+                MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject();
             if (!readFBO) {
                 return false;
             }
@@ -6029,7 +6228,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // outside the frontend's array, which cannot be addressed at all.
             Uint BoundImageUnitFormat(Int unit) {
                 if (unit < 0 || unit >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) return 0;
-                return static_cast<Uint>(MG_State::pGLContext->GetImageTextureBinding(unit).Format);
+                return static_cast<Uint>(MGB_CTX->GetImageTextureBinding(unit).Format);
             }
 
             // Combines one (unit, format) pair into a running digest. Commutative, so the order
@@ -6991,19 +7190,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // patch size - so a program built for one value is stale for another. Recorded here
             // and compared on the draw path (SyncCurrentProgram), the same shape as the
             // storage-block and image-format signatures next to it.
-            const Uint patchVertices = MG_State::pGLContext != nullptr
-                                           ? MG_State::pGLContext->GetPatchVertices()
+            const Uint patchVertices = MGB_CTX_LIVE
+                                           ? MGB_CTX->GetPatchVertices()
                                            : 3u;
             m_passthroughTessControlPatchVertices = static_cast<Int>(patchVertices);
             // PATCH_DEFAULT_{OUTER,INNER}_LEVEL are the same kind of dynamic state and are baked
             // into the same stage (ES has no such state and no entry point to forward them to), so
             // they are recorded and compared alongside the patch size - the two move together, as
             // BuildPassthroughTessControlEssl's contract says.
-            m_passthroughTessControlOuterLevel = MG_State::pGLContext != nullptr
-                                                     ? MG_State::pGLContext->GetPatchDefaultOuterLevel()
+            m_passthroughTessControlOuterLevel = MGB_CTX_LIVE
+                                                     ? MGB_CTX->GetPatchDefaultOuterLevel()
                                                      : FloatVec4(1.0f, 1.0f, 1.0f, 1.0f);
-            m_passthroughTessControlInnerLevel = MG_State::pGLContext != nullptr
-                                                     ? MG_State::pGLContext->GetPatchDefaultInnerLevel()
+            m_passthroughTessControlInnerLevel = MGB_CTX_LIVE
+                                                     ? MGB_CTX->GetPatchDefaultInnerLevel()
                                                      : FloatVec2(1.0f, 1.0f);
 
             if (tessEvalShaderIndex < 0 ||
@@ -7219,6 +7418,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 m_backendProgramUsable = false;
                 return;
             }
+            if (stateProgramObject->PointSizeDemoted()) {
+                // THE ARMING SIGNAL, INFO on purpose and latched: the integration lane that
+                // pins MOBILEGL_POINT_SIZE_DEMOTION=1 asserts on exactly this line, because
+                // every rendering assertion stays green on a healthy driver whether the
+                // demotion ran or was silently disarmed. See PointSizeDemotionScenario.
+                MGLOG_I_ONCE("DirectGLES is building programs whose tessellation/geometry gl_PointSize was "
+                             "demoted to an ordinary varying, because this driver cannot host the built-in "
+                             "in those stages.");
+            }
             MGLOG_D("Attaching %zu shaders to program %u", linkedStages.size(), m_backendProgramId);
             for (const auto& ref : stateProgramObject->GetLinkedShaderSnapshot()) {
                 if (!ref.shader) continue;
@@ -7889,6 +8097,22 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 // for; it has the variable that replaced it. Everything else - including a
                 // member of a block that was left alone - keeps the application's spelling.
                 // Storage first, pointers after: xfbNames holds pointers into these strings.
+                //
+                // Same rule for a demoted gl_PointSize: the capture stage's ESSL no longer
+                // spells the built-in at all - the value lives in the carrier the demotion
+                // named - so the driver-side request has to follow it there. Only when the
+                // capture stage IS a demoted one (geometry, else evaluation): a program whose
+                // capture stage is the vertex shader keeps the built-in and its spelling,
+                // whatever happened to a control stage behind it.
+                Bool captureStageDemoted = false;
+                if (stateProgramObject->PointSizeDemoted()) {
+                    for (const ShaderStage linkedStage : linkedStages) {
+                        if (linkedStage == ShaderStage::TessEval || linkedStage == ShaderStage::Geometry) {
+                            captureStageDemoted = true;
+                            break;
+                        }
+                    }
+                }
                 Vector<String> rewrittenXfbNames(xfbVaryings.size());
                 for (SizeT nameIndex = 0; nameIndex < xfbVaryings.size(); ++nameIndex) {
                     String flatName;
@@ -7896,6 +8120,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         MG_Util::ShaderTranspiler::ShaderCompiler::RewriteXfbCaptureNameForFlattenedBlock(
                             xfbVaryings[nameIndex].name, flattenedXfbBlockNames, flatName)) {
                         rewrittenXfbNames[nameIndex] = std::move(flatName);
+                    } else if (captureStageDemoted && xfbVaryings[nameIndex].name == "gl_PointSize") {
+                        rewrittenXfbNames[nameIndex] =
+                            MG_Util::ShaderTranspiler::ShaderCompiler::POINT_SIZE_CAPTURE_CARRIER_NAME;
                     } else {
                         rewrittenXfbNames[nameIndex] = xfbVaryings[nameIndex].name;
                     }
@@ -8521,8 +8748,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 MGLOG_E_ONCE("Renderbuffer %u storage allocation ran out of memory: %dx%d, samples=%d, format=%s",
                              stateRBOObject->GetExternalIndex(), width, height, samples,
                              MG_Util::ConvertGLEnumToString(glInternalFormat).c_str());
-                if (MG_State::pGLContext) {
-                    MG_State::pGLContext->RecordError(
+                if (MGB_CTX_LIVE) {
+                    MGB_CTX->RecordError(
                         ErrorCode::OutOfMemory,
                         MakeUnique<GenericErrorInfo>("DirectGLES", "BackendRenderbufferObject::SyncToBackend",
                                                      "The ES driver could not allocate the renderbuffer storage."));

MobileGL/MG_Backend/DirectGLES/Managers.h

@@ -461,6 +461,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // the owning thread replaying them: guard both fields with pendingMutex.
             Bool pendingRespecify = false;
             VecRange1D pendingRanges;
+            // App bytes for an ADOPTED store, awaiting their GPU-ordered landing (ring
+            // stage + glCopyBufferSubData at the next sync; see
+            // BufferBackendOps::ResidentSubData). The frontend keeps such writes out of
+            // the coherent mapping - an in-place host write tears the in-flight frames
+            // still reading the old bytes. Guarded by pendingMutex like pendingRanges.
+            struct PendingResidentWrite {
+                SizeT offset = 0;
+                Vector<Uint8> bytes;
+            };
+            Vector<PendingResidentWrite> pendingResidentWrites;
             std::mutex pendingMutex;
             // Buffer-mutation epoch (see CurrentBufferMutationEpoch) at which this
             // resource last probed IsBufferDrawClean == true, 0 = never (epochs start

MobileGL/MG_Backend/DirectGLES/MultiDraw.cpp

@@ -9,6 +9,8 @@
 #include "MultiDraw.h"
 #include "Managers.h"
 #include <MG_State/GLState/Core.h>
+#include <MG_Pipe/PipeInputsSwitch.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <cstring>
 #include <limits>
 
@@ -41,14 +43,14 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         // verbatim is already "this batch restarts nowhere".
         Uint32 RestartSentinelFor(GLenum type) {
             if (ResolveRestartSubstitution(type) != RestartSubstitutionKind::None) {
-                return MG_State::pGLContext->GetPrimitiveRestartIndex();
+                return MGB_CTX->GetPrimitiveRestartIndex();
             }
             return MG_Util::FixedRestartIndexForGLType(type);
         }
 
         Bool RestartActive() {
-            return MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::PrimitiveRestart) ||
-                   MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::PrimitiveRestartFixedIndex);
+            return MGB_CTX->IsCapabilityEnabled(CapabilityInput::PrimitiveRestart) ||
+                   MGB_CTX->IsCapabilityEnabled(CapabilityInput::PrimitiveRestartFixedIndex);
         }
 
         // Vertices per primitive for the modes whose sub-draws may be concatenated into a
@@ -83,7 +85,7 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
         Uint BoundDrawIndirectBufferId() {
             const auto& indirect =
-                MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+                MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
             if (!indirect) return 0;
             const auto* resource = BufferImpl::EnsureBufferResource(indirect);
             return resource ? resource->id : 0;
@@ -91,7 +93,7 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
         const SharedPtr<MG_State::GLState::BufferObject>& BoundIndexBuffer() {
             static const SharedPtr<MG_State::GLState::BufferObject> none;
-            const auto& vao = MG_State::pGLContext->GetBoundVertexArray();
+            const auto& vao = MGB_CTX->GetBoundVertexArray();
             if (!vao) return none;
             return vao->GetIndexBufferBindingSlot().GetBoundObject();
         }
@@ -156,7 +158,10 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         // are bound as storage blocks. Respecifies rather than sub-updates: glBufferData
         // orphans the previous store, so the upload never waits on a dispatch still reading
         // the old contents out of the same name.
-        Bool UploadScratch(ScratchBuffer& buffer, SizeT bytes, const void* data) {
+        // statsClass: which MGPipe byte population these bytes belong to. Counted here
+        // rather than at the four call sites so a new tier cannot forget it.
+        Bool UploadScratch(ScratchBuffer& buffer, SizeT bytes, const void* data,
+                           MG_Util::PipeStats::ByteClass statsClass) {
             if (bytes == 0) return true;
             if (!EnsureScratchName(buffer)) return false;
             BufferImpl::BindBufferId(BufferImpl::TempBufferTarget, buffer.id);
@@ -169,6 +174,9 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             buffer.cursor = 0;
             if (data) {
                 g_GLESFuncs.glBufferSubData(BufferImpl::TempBufferTarget, 0, static_cast<GLsizeiptr>(bytes), data);
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::AddBytes(statsClass, static_cast<Uint64>(bytes));
+                }
             }
             return true;
         }
@@ -183,7 +191,8 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         constexpr SizeT kRingAlignment = 16; // >= 4, so both command and uint32-index offsets stay legal
         constexpr SizeT kMinRingBytes = 1u << 16;
 
-        Bool UploadScratchRing(ScratchBuffer& buffer, SizeT bytes, const void* data, SizeT& outOffset) {
+        Bool UploadScratchRing(ScratchBuffer& buffer, SizeT bytes, const void* data,
+                               MG_Util::PipeStats::ByteClass statsClass, SizeT& outOffset) {
             outOffset = 0;
             if (bytes == 0) return true;
             if (!EnsureScratchName(buffer)) return false;
@@ -207,6 +216,9 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             if (data) {
                 g_GLESFuncs.glBufferSubData(BufferImpl::TempBufferTarget, static_cast<GLintptr>(outOffset),
                                             static_cast<GLsizeiptr>(bytes), data);
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::AddBytes(statsClass, static_cast<Uint64>(bytes));
+                }
             }
             buffer.cursor += aligned;
             return true;
@@ -417,7 +429,8 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
             const SizeT commandBytes = g_commandStaging.size() * sizeof(DrawElementsIndirectCommand);
             SizeT commandBase = 0;
-            if (!UploadScratchRing(g_indirectCommands, commandBytes, g_commandStaging.data(), commandBase)) {
+            if (!UploadScratchRing(g_indirectCommands, commandBytes, g_commandStaging.data(),
+                                   MG_Util::PipeStats::ByteClass::StageIndirectCmd, commandBase)) {
                 return false;
             }
 
@@ -532,7 +545,8 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             }
 
             SizeT indexBase = 0;
-            if (!UploadScratchRing(g_rebasedIndices, total * sizeof(Uint32), g_indexStaging.data(), indexBase)) {
+            if (!UploadScratchRing(g_rebasedIndices, total * sizeof(Uint32), g_indexStaging.data(),
+                                   MG_Util::PipeStats::ByteClass::StageIndexClient, indexBase)) {
                 return false;
             }
 
@@ -737,10 +751,16 @@ void main() {
             if (total == 0) return; // nothing to draw; the ordinary tiers no-op just as well
 
             if (!EnsureComputeProgram()) return;
-            if (!UploadScratch(g_drawInfo, g_drawInfoStaging.size() * sizeof(Uint32), g_drawInfoStaging.data())) {
+            if (!UploadScratch(g_drawInfo, g_drawInfoStaging.size() * sizeof(Uint32), g_drawInfoStaging.data(),
+                               MG_Util::PipeStats::ByteClass::StageIndirectCmd)) {
+                return;
+            }
+            // data == nullptr: pure respecify, the compute pass writes the contents, so no
+            // host bytes cross here and nothing is counted.
+            if (!UploadScratch(g_flattenedIndices, total * sizeof(Uint32), nullptr,
+                               MG_Util::PipeStats::ByteClass::StageIndexClient)) {
                 return;
             }
-            if (!UploadScratch(g_flattenedIndices, total * sizeof(Uint32), nullptr)) return;
 
             BufferImpl::BindBufferBaseCached(GL_SHADER_STORAGE_BUFFER, 0, sourceResource->id);
             BufferImpl::BindBufferBaseCached(GL_SHADER_STORAGE_BUFFER, 1, g_drawInfo.id);

MobileGL/MG_Backend/DirectGLES/Utils.cpp

@@ -17,6 +17,7 @@
 #include <Config.h>
 
 #include <MG_State/GLState/Core.h>
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include <MG_Util/BackendLoaders/OpenGL/Loader.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
@@ -2294,11 +2295,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
         static Bool StoreClientRows(SizeT dstPixelBytes, SizeT swapGroupSize, GLsizei width, GLsizei sliceHeight,
                                     GLsizei sliceCount, void* pixels, Bool applyPackImageParams, FillRow&& fillRow) {
             const auto& pixelPackBufferObject =
-                MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+                MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
 
             // Destination layout is computed from the client-side PACK parameters; only the actual pixel
             // rows are written so skip regions of the destination stay untouched.
-            const auto packParams = MG_State::pGLContext->GetPixelStoreParameters(false);
+            const auto packParams = MGB_CTX->GetPixelStoreParameters(false);
             const SizeT rowPixels = static_cast<SizeT>(packParams.RowLength > 0 ? packParams.RowLength : width);
             const SizeT dstRowStride = AlignReadbackRow(rowPixels * dstPixelBytes, packParams.Alignment);
             const SizeT imageRows =

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

@@ -12,6 +12,7 @@
 #include "SubgroupSupportPolicy.h"
 #include "MG_State/GLState/FramebufferState/FramebufferObject.h"
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_State/GLState/TextureState/TextureState.h"
 #include "MG_Util/Classifiers/TextureEnumClassifier.h"
 #include "MG_Util/Converters/MGToGL/TextureEnumConverter.h"
@@ -385,8 +386,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
         UpdateDynamicBackendParameters();
         UpdateAdvertisedExtensions();
-        if (MG_State::pGLContext) {
-            MG_State::pGLContext->InvalidateCompileEnv();
+        if (MGB_CTX_LIVE) {
+            MGB_CTX->InvalidateCompileEnv();
         }
         PopulateFormatCapabilities(physicalDevice.handle, vkGetPhysicalDeviceFormatProperties, m_vulkanCaps,
                                    MutableFormatCapabilities());
@@ -740,8 +741,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             funcsTable.GL.MemoryBarrierByRegion = MemoryBarrierByRegion;
             funcsTable.GL.BindImageTexture = BindImageTexture;
             funcsTable.GL.GetIntegeri_v = GetIntegeri_v;
-            funcsTable.GL.GetInteger64i_v = GetInteger64i_v;
-            funcsTable.GL.GetProgramiv = GetProgramiv;
             funcsTable.GL.ShaderStorageBlockBinding = ShaderStorageBlockBinding;
             funcsTable.GL.FenceSync = FenceSync;
             funcsTable.GL.ClientWaitSync = ClientWaitSync;
@@ -785,8 +784,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_vulkanCaps = capabilities;
         UpdateDynamicBackendParameters();
         UpdateAdvertisedExtensions();
-        if (MG_State::pGLContext) {
-            MG_State::pGLContext->InvalidateCompileEnv();
+        if (MGB_CTX_LIVE) {
+            MGB_CTX->InvalidateCompileEnv();
         }
         MutableFormatCapabilities().Clear();
     }
@@ -939,6 +938,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             clampLimit("GL_MAX_COMPUTE_UNIFORM_BLOCKS", m_vulkanCaps.MaxComputeUniformBlocks,
                        kMaxAdvertisedBufferBlocks);
         m_dynamicParameters.MaxComputeWorkGroupInvocations = m_vulkanCaps.MaxComputeWorkGroupInvocations;
+        // The six per-axis compute limits, from the same VkPhysicalDeviceLimits fields
+        // GLFunctionsTable::GetIntegeri_v (DirectVulkan.cpp) reads live. Carried here so that
+        // MGPCaps has them once the table entry retires (plan B section 4.4.1); GL_Getter floors
+        // them. Not clamped: unlike the block counts these are not amounts an application
+        // allocates, and the frontend already raises them to the GL minimum.
+        for (SizeT axis = 0; axis < 3; ++axis) {
+            m_dynamicParameters.MaxComputeWorkGroupCount[axis] = m_vulkanCaps.MaxComputeWorkGroupCount[axis];
+            m_dynamicParameters.MaxComputeWorkGroupSize[axis] = m_vulkanCaps.MaxComputeWorkGroupSize[axis];
+        }
         m_dynamicParameters.MaxShaderStorageBufferBindings =
             clampLimit("GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS", m_vulkanCaps.MaxShaderStorageBufferBindings,
                        kMaxAdvertisedBufferBlocks);
@@ -1081,6 +1089,31 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // report VK_FALSE, so on every real mobile device this is false and the demotion runs
         // exactly as it always has.
         m_dynamicParameters.SupportsShaderFloat64 = m_vulkanCaps.SupportsShaderFloat64;
+        // shaderTessellationAndGeometryPointSize, both stage families from the one feature.
+        // False arms the shared phase-B point-size demotion, whose modules then carry no
+        // TessellationPointSize/GeometryPointSize capability and build without the feature.
+        // MOBILEGL_POINT_SIZE_DEMOTION=1 pretends it is absent so the demotion can be
+        // exercised on a healthy driver (lavapipe advertises the feature); =0 restores the
+        // detected answer's declines.
+        {
+            Bool supportsStagePointSize = m_vulkanCaps.SupportsTessellationAndGeometryPointSize;
+            switch (MG_Config::Features.PointSizeDemotion) {
+            case MG_Config::QuirkOverride::ForceOn:
+                MGLOG_I("DirectVulkan: MOBILEGL_POINT_SIZE_DEMOTION=1 - treating tessellation/geometry "
+                        "gl_PointSize as unhosted so the demotion runs on this driver");
+                supportsStagePointSize = false;
+                break;
+            case MG_Config::QuirkOverride::ForceOff:
+                MGLOG_I("DirectVulkan: MOBILEGL_POINT_SIZE_DEMOTION=0 - keeping the built-in and the "
+                        "plain declines regardless of the device feature");
+                supportsStagePointSize = true;
+                break;
+            case MG_Config::QuirkOverride::Auto:
+                break;
+            }
+            m_dynamicParameters.SupportsTessellationPointSize = supportsStagePointSize;
+            m_dynamicParameters.SupportsGeometryPointSize = supportsStagePointSize;
+        }
         // Never, on any device, and DELIBERATELY NOT COUPLED to the line above even though it
         // once tracked the same feature. It used to, because a `dvec` input needed Float64 to
         // exist in the module at all; a 64-bit vertex FETCH was already impossible

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.cpp

@@ -10,9 +10,11 @@
 #include "DirectVulkanResourceState.h"
 #include "MG_Backend/BackendObjects.h"
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_State/GLState/ErrorState/ErrorInfo.h"
 #include "MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h"
 #include "MG_Util/Converters/GLToMG/TextureEnumConverter.h"
+#include "MG_Util/Metrics/PipeStats.h"
 #include "MG_Util/Metrics/TextureMetrics.h"
 #include "MG_Util/Miscellany/IndexGenerator.h"
 #include <atomic>
@@ -77,7 +79,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint32 blockBindingVersion = 0;
             Vector<StorageBlockResource> storageBlocks;
             Vector<BufferVariableResource> bufferVariables;
-            GLint computeWorkGroupSize[3] = {1, 1, 1};
         };
 
         struct DrawElementsIndirectCommand {
@@ -208,16 +209,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
 
             for (auto& module : modules) {
-                for (Uint32 entryIndex = 0; entryIndex < module.entry_point_count; ++entryIndex) {
-                    const auto& entryPoint = module.entry_points[entryIndex];
-                    if ((entryPoint.shader_stage & SPV_REFLECT_SHADER_STAGE_COMPUTE_BIT) == 0) {
-                        continue;
-                    }
-                    cache.computeWorkGroupSize[0] = static_cast<GLint>(std::max<Uint32>(entryPoint.local_size.x, 1));
-                    cache.computeWorkGroupSize[1] = static_cast<GLint>(std::max<Uint32>(entryPoint.local_size.y, 1));
-                    cache.computeWorkGroupSize[2] = static_cast<GLint>(std::max<Uint32>(entryPoint.local_size.z, 1));
-                }
-
                 uint32_t bindingCount = 0;
                 SpvReflectResult result = spvReflectEnumerateDescriptorBindings(&module, &bindingCount, nullptr);
                 if (result != SPV_REFLECT_RESULT_SUCCESS || bindingCount == 0) {
@@ -277,15 +268,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         MG_State::GLState::ProgramObject* TryGetDirectVulkanProgram(GLuint program) {
-            if (!MG_State::pGLContext->ValidateProgramName(program)) {
+            if (!MGB_CTX->ValidateProgramName(program)) {
                 return nullptr;
             }
-            auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+            auto& programObject = MGB_CTX->GetProgramObject(program);
             return programObject.get();
         }
 
         const Uint8* ResolveIndirectCommandBytes(const void* indirect, SizeT requiredBytes, const char* label) {
-            auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+            auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
             if (drawBuffer) {
                 drawBuffer->SyncPersistentMappedRange();
                 const SizeT commandOffset = reinterpret_cast<SizeT>(indirect);
@@ -344,64 +335,64 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void ClearBufferfi(GLenum buffer, GLint drawbuffer, GLfloat depth, GLint stencil) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferfi called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferfi called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferfi called with null GL context");
         pVulkanRenderer->ClearBufferfi(buffer, drawbuffer, depth, stencil);
     }
 
     void ClearBufferfv(GLenum buffer, GLint drawbuffer, const GLfloat* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferfv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferfv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferfv called with null GL context");
         pVulkanRenderer->ClearBufferfv(buffer, drawbuffer, value);
     }
 
     void ClearBufferuiv(GLenum buffer, GLint drawbuffer, const GLuint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferuiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferuiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferuiv called with null GL context");
         pVulkanRenderer->ClearBufferuiv(buffer, drawbuffer, value);
     }
 
     void ClearBufferiv(GLenum buffer, GLint drawbuffer, const GLint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferiv called with null GL context");
         pVulkanRenderer->ClearBufferiv(buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferfv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                  GLint drawbuffer, const GLfloat* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferfv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferfv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferfv called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferfv(framebuffer, buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferiv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                  GLint drawbuffer, const GLint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferiv called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferiv(framebuffer, buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferuiv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                   GLint drawbuffer, const GLuint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferuiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferuiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferuiv called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferuiv(framebuffer, buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferfi(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                  GLint drawbuffer, GLfloat depth, GLint stencil) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferfi called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferfi called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferfi called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferfi(framebuffer, buffer, drawbuffer, depth, stencil);
     }
 
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElementsIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElementsIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElementsIndirect called with null GL context");
         pVulkanRenderer->MultiDrawElementsIndirect(mode, type, indirect, drawcount, stride);
     }
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawArraysIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawArraysIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawArraysIndirect called with null GL context");
 
         if (drawcount <= 0) {
             return;
@@ -409,7 +400,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         // With a bound GL_DRAW_INDIRECT_BUFFER the command parameters may be GPU-written
         // (e.g. by a compute shader), so consume them natively on the GPU.
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             pVulkanRenderer->MultiDrawArraysIndirect(mode, indirect, drawcount, stride);
             return;
@@ -452,13 +443,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void MultiDrawElementsIndirectCount(GLenum mode, GLenum type, const void* indirect, GLintptr drawcount,
                                         GLsizei maxdrawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElementsIndirectCount called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElementsIndirectCount called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElementsIndirectCount called with null GL context");
         pVulkanRenderer->MultiDrawElementsIndirectCount(mode, type, indirect, drawcount, maxdrawcount, stride);
     }
     void MultiDrawArraysIndirectCount(GLenum mode, const void* indirect, GLintptr drawcount,
                                       GLsizei maxdrawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawArraysIndirectCount called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawArraysIndirectCount called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawArraysIndirectCount called with null GL context");
 
         if (maxdrawcount <= 0) {
             return;
@@ -472,7 +463,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return;
         }
 
-        auto parameterBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
+        auto parameterBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
         if (!parameterBuffer || drawcount < 0 || static_cast<SizeT>(drawcount) + sizeof(Uint32) > parameterBuffer->GetSize()) {
             MGLOG_E_ONCE("MultiDrawArraysIndirectCount skipped: invalid GL_PARAMETER_BUFFER binding or range");
             return;
@@ -503,7 +494,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void DrawElementsInstancedBaseVertexBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                                      GLsizei instancecount, GLint basevertex, GLuint baseinstance) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElementsInstancedBaseVertexBaseInstance called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElementsInstancedBaseVertexBaseInstance called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElementsInstancedBaseVertexBaseInstance called with null GL context");
 
         DrawIndexedCmd payload{};
         payload.mode = mode;
@@ -530,7 +521,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
     void DrawElementsIndirect(GLenum mode, GLenum type, const void* indirect) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElementsIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElementsIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElementsIndirect called with null GL context");
 
         const SizeT indexSize = MG_Util::GetGLTypeSize(type);
         if (indexSize == 0) {
@@ -540,7 +531,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         // With a bound GL_DRAW_INDIRECT_BUFFER the command parameters may be GPU-written
         // (e.g. by a compute shader), so consume them natively on the GPU.
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             pVulkanRenderer->MultiDrawElementsIndirect(mode, type, indirect, 1, 0);
             return;
@@ -574,7 +565,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void DrawArraysInstancedBaseInstance(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
                                          GLuint baseinstance) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawArraysInstancedBaseInstance called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawArraysInstancedBaseInstance called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawArraysInstancedBaseInstance called with null GL context");
 
         DrawCmd payload{};
         payload.mode = mode;
@@ -589,11 +580,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
     void DrawArraysIndirect(GLenum mode, const void* indirect) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawArraysIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawArraysIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawArraysIndirect called with null GL context");
 
         // With a bound GL_DRAW_INDIRECT_BUFFER the command parameters may be GPU-written
         // (e.g. by a compute shader), so consume them natively on the GPU.
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             pVulkanRenderer->MultiDrawArraysIndirect(mode, indirect, 1, 0);
             return;
@@ -623,13 +614,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void CopyTexImage2D(GLenum target, GLint level, GLenum internalformat, GLint x, GLint y, GLsizei width,
                         GLsizei height, GLint border) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyTexImage2D called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyTexImage2D called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::CopyTexImage2D called with null GL context");
         pVulkanRenderer->CopyTexSubImage2D(target, level, 0, 0, x, y, width, height);
     }
     void CopyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width,
                            GLsizei height) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyTexSubImage2D called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyTexSubImage2D called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::CopyTexSubImage2D called with null GL context");
         pVulkanRenderer->CopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     }
     void CopyImageSubData(const CopyImageEndpoint& src,
@@ -638,32 +629,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                           GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                           GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyImageSubData called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyImageSubData called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::CopyImageSubData called with null GL context");
         pVulkanRenderer->CopyImageSubData(src, srcTarget, srcLevel, srcX, srcY, srcZ,
                                           dst, dstTarget, dstLevel, dstX, dstY, dstZ,
                                           srcWidth, srcHeight, srcDepth);
     }
     void GenerateMipmap(GLenum target) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GenerateMipmap called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::GenerateMipmap called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::GenerateMipmap called with null GL context");
         pVulkanRenderer->GenerateMipmap(target);
     }
 
     void DispatchCompute(GLuint numGroupsX, GLuint numGroupsY, GLuint numGroupsZ) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DispatchCompute called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DispatchCompute called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DispatchCompute called with null GL context");
         pVulkanRenderer->DispatchCompute(numGroupsX, numGroupsY, numGroupsZ);
     }
 
     void DispatchComputeIndirect(GLintptr indirect) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DispatchComputeIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DispatchComputeIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DispatchComputeIndirect called with null GL context");
         pVulkanRenderer->DispatchComputeIndirect(indirect);
     }
 
     void MemoryBarrier(GLbitfield barriers) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MemoryBarrier called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MemoryBarrier called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MemoryBarrier called with null GL context");
         pVulkanRenderer->MemoryBarrier(barriers);
     }
 
@@ -682,130 +673,40 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         (void)format;
     }
 
+    // The two compute limits are the only indexed pnames a backend genuinely owns: they come
+    // from the physical device, and MG_Impl/GLImpl/Getter/GL_Getter.cpp asks for them here so it
+    // can raise the answer to the GL required minimum. The same six numbers are carried in
+    // DynamicBackendParameters::MaxComputeWorkGroupCount/Size (filled at capability init from
+    // the same limits), which is their MGPCaps carrier once this entry retires - the
+    // AdvertisedLimitsScenario pins the two against each other. Every other indexed pname names FRONTEND
+    // state (the indexed buffer bindings, the per-unit texture/sampler bindings, the image-unit
+    // bindings, the viewport rectangles, the indexed capabilities) and is answered there before
+    // the table is consulted, so the arms this function used to carry for
+    // GL_SHADER_STORAGE_BUFFER_* and GL_IMAGE_BINDING_* were unreachable duplicates - and not
+    // even faithful ones: the frontend reports the range glBindBufferRange was ASKED for,
+    // verbatim, while these clamped it to the buffer's current storage.
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data) {
         if (!data) return;
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GetIntegeri_v called with null VulkanRenderer");
+        if (index >= 3) {
+            *data = 0;
+            return;
+        }
         switch (target) {
         case GL_MAX_COMPUTE_WORK_GROUP_COUNT:
-            if (index >= 3) {
-                *data = 0;
-                return;
-            }
             *data = static_cast<GLint>(
                 pVulkanRenderer->GetPhysicalDevice().properties.limits.maxComputeWorkGroupCount[index]);
             return;
         case GL_MAX_COMPUTE_WORK_GROUP_SIZE:
-            if (index >= 3) {
-                *data = 0;
-                return;
-            }
             *data = static_cast<GLint>(
                 pVulkanRenderer->GetPhysicalDevice().properties.limits.maxComputeWorkGroupSize[index]);
             return;
-        case GL_SHADER_STORAGE_BUFFER_BINDING: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            *data = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_START: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            *data = static_cast<GLint>(point.GetRange().start);
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_SIZE: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            if (!obj) {
-                *data = 0;
-                return;
-            }
-            const auto& range = point.GetRange();
-            const auto start = std::min(range.start, obj->GetSize());
-            const auto end = std::min(range.end, obj->GetSize());
-            *data = static_cast<GLint>(end - start);
-            return;
-        }
-        case GL_IMAGE_BINDING_NAME:
-        case GL_IMAGE_BINDING_LEVEL:
-        case GL_IMAGE_BINDING_LAYERED:
-        case GL_IMAGE_BINDING_LAYER:
-        case GL_IMAGE_BINDING_ACCESS:
-        case GL_IMAGE_BINDING_FORMAT: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            if (target == GL_IMAGE_BINDING_NAME) {
-                *data = imageBinding.Texture ? static_cast<GLint>(imageBinding.Texture->GetExternalIndex()) : 0;
-            } else if (target == GL_IMAGE_BINDING_LEVEL) {
-                *data = imageBinding.Level;
-            } else if (target == GL_IMAGE_BINDING_LAYERED) {
-                *data = imageBinding.Layered;
-            } else if (target == GL_IMAGE_BINDING_LAYER) {
-                *data = imageBinding.Layer;
-            } else if (target == GL_IMAGE_BINDING_ACCESS) {
-                *data = static_cast<GLint>(imageBinding.Access);
-            } else {
-                *data = static_cast<GLint>(imageBinding.Format);
-            }
-            return;
-        }
         default:
             *data = 0;
             return;
         }
     }
 
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data) {
-        if (!data) return;
-        switch (target) {
-        case GL_SHADER_STORAGE_BUFFER_START: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            *data = static_cast<GLint64>(point.GetRange().start);
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_SIZE: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            if (!obj) {
-                *data = 0;
-                return;
-            }
-            const auto& range = point.GetRange();
-            const auto start = std::min(range.start, obj->GetSize());
-            const auto end = std::min(range.end, obj->GetSize());
-            *data = static_cast<GLint64>(end - start);
-            return;
-        }
-        default:
-            *data = 0;
-            return;
-        }
-    }
-
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params) {
-        if (!params) return;
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject) {
-            params[0] = 0;
-            return;
-        }
-        switch (pname) {
-        case GL_COMPUTE_WORK_GROUP_SIZE: {
-            auto& cache = GetProgramResourceCache(*programObject);
-            params[0] = cache.computeWorkGroupSize[0];
-            params[1] = cache.computeWorkGroupSize[1];
-            params[2] = cache.computeWorkGroupSize[2];
-            return;
-        }
-        default:
-            params[0] = 0;
-            return;
-        }
-    }
-
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding) {
         auto* programObject = TryGetDirectVulkanProgram(program);
         if (!programObject || storageBlockName == nullptr) return;
@@ -813,7 +714,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             ? pActiveBackendObject->GetDynamicParameters().MaxShaderStorageBufferBindings
             : 0;
         if (storageBlockBinding >= static_cast<GLuint>(maxBindings)) {
-            MG_State::pGLContext->RecordError(
+            MGB_CTX->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("DirectVulkan", __func__, "Shader storage binding is out of range."));
             return;
@@ -838,24 +739,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ReadPixels called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ReadPixels called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ReadPixels called with null GL context");
         pVulkanRenderer->ReadPixels(x, y, width, height, format, type, pixels);
     }
     void GetTexImage(GLenum target, GLint level, GLenum format, GLenum type, GLvoid* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GetTexImage called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::GetTexImage called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::GetTexImage called with null GL context");
         pVulkanRenderer->GetTexImage(target, level, format, type, pixels);
     }
     void GetTextureImage(const SharedPtr<MG_State::GLState::ITextureObject>& texture, TextureUploadTarget uploadTarget,
                          GLint level, GLenum format, GLenum type, GLsizei bufSize, GLvoid* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GetTextureImage called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::GetTextureImage called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::GetTextureImage called with null GL context");
         pVulkanRenderer->GetTextureImage(texture, uploadTarget, level, format, type, bufSize, pixels);
     }
 
     void Clear(GLbitfield mask) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::Clear called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::Clear called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::Clear called with null GL context");
         pVulkanRenderer->Clear(mask);
     }
 
@@ -883,7 +784,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
         const Uint8* indexBytes = nullptr;
-        const auto& vao = *MG_State::pGLContext->GetBoundVertexArray();
+        const auto& vao = *MGB_CTX->GetBoundVertexArray();
         const auto& indexBufferShared = vao.GetIndexBufferBindingSlot().GetBoundObject();
         if (indexBufferShared != nullptr) {
             const SizeT offset = reinterpret_cast<SizeT>(indices);
@@ -914,7 +815,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void DrawArrays(GLenum mode, GLint first, GLsizei count) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawArrays called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawArrays called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawArrays called with null GL context");
 
         if (mode == GL_LINE_LOOP) {
             if (count < 2) {
@@ -939,7 +840,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void DrawElements(GLenum mode, GLsizei count, GLenum type, const void* indices) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElements called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElements called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElements called with null GL context");
 
         if (mode == GL_LINE_LOOP) {
             Vector<Uint32> closedIndices;
@@ -962,7 +863,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void MultiDrawArrays(GLenum mode, const GLint* first, const GLsizei* count, GLsizei drawcount) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawArrays called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawArrays called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawArrays called with null GL context");
         if (drawcount <= 0) {
             return;
         }
@@ -1007,7 +908,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // MultiDrawIndexedCmd left the client-memory shape addressing a view whose byte
         // offset is a hardcoded 0, so UploadAndBindIndexBuffer saw a null client pointer,
         // declined the whole batch and painted nothing.)
-        const auto& vao = *MG_State::pGLContext->GetBoundVertexArray();
+        const auto& vao = *MGB_CTX->GetBoundVertexArray();
         if (vao.GetIndexBufferBindingSlot().GetBoundObject() == nullptr) {
             for (GLsizei i = 0; i < drawcount; ++i) {
                 if (count[i] <= 0) {
@@ -1068,13 +969,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void MultiDrawElements(GLenum mode, const GLsizei* count, GLenum type, const GLvoid* const* indices,
                            GLsizei drawcount) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElements called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElements called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElements called with null GL context");
         MultiDrawElementsImpl(mode, count, type, indices, drawcount, nullptr);
     }
 
     void DrawElementsBaseVertex(GLenum mode, GLsizei count, GLenum type, const GLvoid* indices, GLint basevertex) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElementsBaseVertex called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElementsBaseVertex called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElementsBaseVertex called with null GL context");
         if (mode == GL_LINE_LOOP) {
             Vector<Uint32> closedIndices;
             if (BuildClosedLineLoopIndices(count, type, indices, closedIndices)) {
@@ -1098,14 +999,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void MultiDrawElementsBaseVertex(GLenum mode, const GLsizei* count, GLenum type, const GLvoid* const* indices,
                                      GLsizei drawcount, const GLint* basevertex) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElementsBaseVertex called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElementsBaseVertex called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElementsBaseVertex called with null GL context");
         MultiDrawElementsImpl(mode, count, type, indices, drawcount, basevertex);
     }
 
     void BlitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0, GLint dstX1,
                          GLint dstY1, GLbitfield mask, GLenum filter) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::BlitFramebuffer called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::BlitFramebuffer called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::BlitFramebuffer called with null GL context");
         pVulkanRenderer->BlitFramebuffer(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask, filter);
     }
 
@@ -1206,6 +1107,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             SharedPtr<VkTimerQueryManager::TimestampRecord> end;
             // Kind::Occlusion - pool slots recorded between Begin/End; summed at result time.
             Vector<Uint32> occlusionSlots;
+            // Kind::XfbGenerated - reroute-pool slots for the span's XFB-INACTIVE
+            // draws, where the renderer's reroute is armed (the affected driver's
+            // stream query counts nothing without an open capture; see
+            // VulkanRenderer::BeginXfbQueryForDraw). Summed alongside the stream
+            // slots above, which keep the span's XFB-active draws.
+            Vector<Uint32> rerouteSlots;
             // Renderer generation the records were written under (see
             // g_rendererGeneration). A stale generation resolves as available
             // with a final zero result: the records' pool indices and frame
@@ -1215,11 +1122,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // stale queries are always safe to delete.
             Uint64 rendererGeneration = 0;
             // Kind::XfbGenerated - the frontend's paused-draw primitive counter when the
-            // query began. VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT counts only what the
-            // capture saw, so a draw made while the span was paused is invisible to it -
-            // but GL_PRIMITIVES_GENERATED counts what the last vertex processing stage
-            // emitted regardless. The delta closes that gap at result time.
+            // query began. On the affected drivers VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT
+            // counts only what the capture saw, so a draw made while the span was paused is
+            // invisible to it - but GL_PRIMITIVES_GENERATED counts what the last vertex
+            // processing stage emitted regardless. The delta closes that gap at result time.
             Uint64 pausedPrimitiveSnapshot = 0;
+            // ...unless the GPU already counted those paused draws when the span opened -
+            // through the reroute pool (VulkanRenderer::BeginXfbQueryForDraw reroutes every
+            // draw with no open capture, paused ones included) or, where the probe measured
+            // the stream query as counting capture-less draws, through the stream slot the
+            // paused draw still takes. Adding the CPU delta on top would count them twice,
+            // and the CPU counter is the weaker source anyway: only 3 of the ~15 draw entry
+            // points write it and it answers 0 for GL_PATCHES.
+            Bool pausedPrimitivesCountedByGpu = false;
         };
     } // namespace
 
@@ -1313,13 +1228,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (query->kind == VulkanTimerQuery::Kind::XfbWritten ||
             query->kind == VulkanTimerQuery::Kind::XfbGenerated) {
             Uint64 primitives = 0;
-            if (!pVulkanRenderer->ResolveXfbQueryResult(query->occlusionSlots,
+            if (!pVulkanRenderer->ResolveXfbQueryResult(query->occlusionSlots, query->rerouteSlots,
                                                         query->kind == VulkanTimerQuery::Kind::XfbGenerated,
                                                         primitives)) {
                 return false;
             }
-            if (query->kind == VulkanTimerQuery::Kind::XfbGenerated && MG_State::pGLContext != nullptr) {
-                primitives += MG_State::pGLContext->GetTransformFeedbackPausedPrimitiveCounter() -
+            if (query->kind == VulkanTimerQuery::Kind::XfbGenerated &&
+                !query->pausedPrimitivesCountedByGpu && MGB_CTX_LIVE) {
+                primitives += MGB_CTX->GetTransformFeedbackPausedPrimitiveCounter() -
                               query->pausedPrimitiveSnapshot;
             }
             *outNanoseconds = primitives;
@@ -1366,7 +1282,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         query->kind = generated ? VulkanTimerQuery::Kind::XfbGenerated : VulkanTimerQuery::Kind::XfbWritten;
         query->rendererGeneration = GetRendererGeneration();
         query->pausedPrimitiveSnapshot =
-            MG_State::pGLContext ? MG_State::pGLContext->GetTransformFeedbackPausedPrimitiveCounter() : 0;
+            MGB_CTX_LIVE ? MGB_CTX->GetTransformFeedbackPausedPrimitiveCounter() : 0;
+        // Read AFTER StartXfbQueryCapture, which is where a failed reroute-pool creation
+        // disarms: the answer is then what this span will actually do for every draw.
+        query->pausedPrimitivesCountedByGpu = generated && pVulkanRenderer->ArePausedDrawsGpuCounted();
         return query;
     }
 
@@ -1377,7 +1296,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return;
         }
         pVulkanRenderer->StopXfbQueryCapture(
-            query->kind == VulkanTimerQuery::Kind::XfbGenerated ? 1u : 0u, query->occlusionSlots);
+            query->kind == VulkanTimerQuery::Kind::XfbGenerated ? 1u : 0u, query->occlusionSlots,
+            query->rerouteSlots);
     }
 
     BackendQueryHandle BeginOcclusionQuery() {
@@ -1411,5 +1331,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void Present() {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::Present called with null VulkanRenderer");
         pVulkanRenderer->Present();
+        // THE frame boundary for the MGPipe counters, at the backend entry point rather
+        // than inside VulkanRenderer::Present: that function has an early return for the
+        // no-usable-swapchain case, and a suspended frame is still a frame the counters
+        // must close.
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::OnPresent();
+        }
     }
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.h

@@ -95,8 +95,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void BindImageTexture(GLuint unit, GLuint texture, GLint level, GLboolean layered, GLint layer, GLenum access,
                           GLenum format);
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params);
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding);
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels);
     void GetTexImage(GLenum target, GLint level, GLenum format, GLenum type, GLvoid* pixels);

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.cpp

@@ -1428,6 +1428,22 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         continue;
                     }
                     if (varying.name == "gl_PointSize") {
+                        // A demoted module (ShaderCompiler::
+                        // DemoteTessellationGeometryPointSizeForProgram) no longer ACCESSES the
+                        // built-in member - the value lives in the carrier variable the demotion
+                        // named - so the capture binds to the carrier directly. The mirror below
+                        // must not run for it: reading the now-unwritten member would capture
+                        // garbage, and the read itself is the capability access the demotion
+                        // exists to remove. Detected off the module's own debug names, so a
+                        // composite built from another program's stage answers for the module it
+                        // actually contains.
+                        const auto carrierIt = idsByName.find(
+                            MG_Util::ShaderTranspiler::ShaderCompiler::POINT_SIZE_CAPTURE_CARRIER_NAME);
+                        if (carrierIt != idsByName.end()) {
+                            decorateForXfb(carrierIt->second, varying.bufferIndex, varying.offsetBytes);
+                            modified = true;
+                            continue;
+                        }
                         needsPointSizeMirror = true;
                         pointSizeBufferIndex = varying.bufferIndex;
                         pointSizeOffset = varying.offsetBytes;
@@ -3454,6 +3470,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // `spirv` and `moduleSpirvs` for any program attached to after it linked.
         const Vector<ShaderStage> stages = program.GetLinkedShaderStages();
         auto& spirv = program.GetGeneratedSpirv();
+        if (program.PointSizeDemoted()) {
+            // THE ARMING SIGNAL, INFO on purpose and latched: the integration lane that pins
+            // MOBILEGL_POINT_SIZE_DEMOTION=1 asserts on exactly this line, because every
+            // rendering assertion above it stays green on a healthy driver whether the
+            // demotion ran or was silently disarmed. See PointSizeDemotionScenario.
+            MGLOG_I_ONCE("DirectVulkan is building programs whose tessellation/geometry gl_PointSize was "
+                         "demoted to an ordinary varying, because this device cannot host the built-in "
+                         "in those stages.");
+        }
         Vector<Vector<Uint>> moduleSpirvs(spirv.size());
         const Bool enableSpirvValidation = program.GetSpirvValidationEnabled();
         // Unconditional now: the two ValidateTransformedSpirv calls below run in every build,

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp

@@ -10,6 +10,7 @@
 
 #include "MG_Backend/DirectVulkan/DirectVulkanResourceState.h"
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_State/GLState/ProgramState/ProgramObject.h"
 #include "MG_State/GLState/TextureState/TextureObject1D.h"
 #include "MG_State/GLState/TextureState/TextureObject2D.h"
@@ -20,6 +21,7 @@
 #include "MG_Util/Converters/GLToMG/TextureEnumConverter.h"
 #include "MG_Util/Converters/MGToStr/FramebufferEnumConverter.h"
 #include "MG_Util/Converters/MGToVk/TextureEnumConverter.h"
+#include "MG_Util/Metrics/PipeStats.h"
 #include "MG_Util/Metrics/TextureMetrics.h"
 #include "MG_Util/ShaderTranspiler/Types.h"
 #include <Config.h>
@@ -502,7 +504,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // alive through the draw via GL binding state. Only the fallback path needs a SharedPtr to
         // keep the fallback texture alive for the rest of this call.
         MG_State::GLState::ITextureObject* texture = ResolveSamplerTextureRaw(program, programObj, binding, element);
-        auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+        auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
         const auto& samplerOverride = textureUnit.GetSamplerObject();
         const auto preferredTarget = programObj.samplerTextureTargetByBinding[binding];
         SharedPtr<MG_State::GLState::ITextureObject> fallbackHolder;
@@ -551,7 +553,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
         if (!IsValidSampledImageLayout(resource->layout)) {
-            auto drawFbo = MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
+            auto drawFbo = MGB_CTX->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
             FramebufferAttachmentType attachmentType = FramebufferAttachmentType::None;
             Int attachmentLevel = 0;
             if (drawFbo &&
@@ -778,7 +780,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 // filtering - which a single-level view can still have. Resolve the sampler exactly
                 // the way ResolveSamplerDescriptor does and bail if anisotropy would apply.
                 const Int unit = ResolveSamplerUnitIndex(program, location, binding);
-                const auto& samplerOverride = MG_State::pGLContext->GetTextureUnitObject(unit).GetSamplerObject();
+                const auto& samplerOverride = MGB_CTX->GetTextureUnitObject(unit).GetSamplerObject();
                 const auto* effectiveSampler =
                     samplerOverride ? samplerOverride.get() : texture->GetSamplerObject().get();
                 if (effectiveSampler == nullptr) return false;
@@ -808,7 +810,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                          const ProgramFactory::VkProgramObject& programObj, Uint32 binding,
                                                          SharedPtr<MG_State::GLState::ITextureObject>& outTexture) {
         outTexture.reset();
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveSamplerTexture: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveSamplerTexture: GL context is null");
         MOBILEGL_ASSERT(binding < programObj.samplerUniformLocationByBinding.size(),
                         "ResolveSamplerTexture: sampler location binding %u out of range", binding);
         MOBILEGL_ASSERT(binding < programObj.samplerTextureTargetByBinding.size(),
@@ -817,7 +819,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Int location = programObj.samplerUniformLocationByBinding[binding];
         const Int unit = ResolveSamplerUnitIndex(program, location, binding);
 
-        auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+        auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
         const TextureTarget preferredTarget = programObj.samplerTextureTargetByBinding[binding];
         outTexture = textureUnit.GetBindingSlot(preferredTarget).GetBoundObject();
         // The slot always holds at least the target's default texture (name 0). While that
@@ -833,7 +835,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     MG_State::GLState::ITextureObject* UniformManager::ResolveSamplerTextureRaw(
         const MG_State::GLState::ProgramObject& program, const ProgramFactory::VkProgramObject& programObj,
         Uint32 binding, Uint32 element) {
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveSamplerTextureRaw: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveSamplerTextureRaw: GL context is null");
         MOBILEGL_ASSERT(binding < programObj.samplerUniformLocationByBinding.size(),
                         "ResolveSamplerTextureRaw: sampler location binding %u out of range", binding);
         MOBILEGL_ASSERT(binding < programObj.samplerTextureTargetByBinding.size(),
@@ -843,7 +845,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             ResolveDescriptorElementLocation(program, programObj.samplerUniformLocationByBinding[binding], element);
         const Int unit = ResolveSamplerUnitIndex(program, location, binding);
 
-        auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+        auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
         const TextureTarget preferredTarget = programObj.samplerTextureTargetByBinding[binding];
         // GetBoundObject() returns the SharedPtr by const ref; .get() reads the pointer without
         // touching the refcount (no atomic inc/dec per binding per draw).
@@ -988,7 +990,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                              VkBufferView& outBufferView) {
         outBufferView = VK_NULL_HANDLE;
         MOBILEGL_ASSERT(m_bufferManager != nullptr, "ResolveStorageTexelBufferDescriptor: buffer manager is null");
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveStorageTexelBufferDescriptor: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveStorageTexelBufferDescriptor: GL context is null");
         MOBILEGL_ASSERT(frameIndex < m_frames.size(),
                         "ResolveStorageTexelBufferDescriptor: frame index out of range");
         MOBILEGL_ASSERT(binding < programObj.samplerUniformLocationByBinding.size(),
@@ -1012,7 +1014,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         MOBILEGL_ASSERT(binding < programObj.samplerNumericDomainByBinding.size(),
                         "ResolveStorageTexelBufferDescriptor: numeric domain binding %u out of range", binding);
 
-        auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(imageUnit);
+        auto& imageBinding = MGB_CTX->GetImageTextureBinding(imageUnit);
         const auto& texture = imageBinding.Texture;
         if (texture == nullptr) {
             // An image unit with no texture on it is legal GL (4.6 core 8.26): loads return zero
@@ -1148,7 +1150,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                         VkDescriptorBufferInfo& outBufferInfo) const {
         outBufferInfo = {};
         MOBILEGL_ASSERT(m_bufferManager != nullptr, "ResolveStorageBufferDescriptor: buffer manager is null");
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveStorageBufferDescriptor: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveStorageBufferDescriptor: GL context is null");
         MOBILEGL_ASSERT(binding < programObj.storageBlockIndexByBinding.size(),
                         "ResolveStorageBufferDescriptor: binding %u out of range", binding);
 
@@ -1185,12 +1187,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 ? static_cast<GLuint>(atomicCounterBinding)
                 : GetShaderStorageBlockBinding(program, static_cast<GLuint>(blockIndex)) + element;
         const Uint32 bindingPointCount =
-            static_cast<Uint32>(MG_State::pGLContext->GetBufferBindingPointCount(bufferTarget));
+            static_cast<Uint32>(MGB_CTX->GetBufferBindingPointCount(bufferTarget));
         MOBILEGL_ASSERT(frontendBinding < bindingPointCount,
                         "ResolveStorageBufferDescriptor: frontend binding %u out of range for block '%s'",
                         frontendBinding, blockName.c_str());
 
-        auto& bindingPoint = MG_State::pGLContext->GetBufferBindingPoint(bufferTarget, frontendBinding);
+        auto& bindingPoint = MGB_CTX->GetBufferBindingPoint(bufferTarget, frontendBinding);
         const auto& bufferObject = bindingPoint.GetBoundObject();
         if (bufferObject == nullptr) {
             // NOT an error, and above all not a reason to lose the draw. GL 4.6 core 7.8 lets a
@@ -1262,7 +1264,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                        VkDescriptorImageInfo& outImageInfo) const {
         outImageInfo = {};
         MOBILEGL_ASSERT(m_textureManager != nullptr, "ResolveStorageImageDescriptor: texture manager is null");
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveStorageImageDescriptor: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveStorageImageDescriptor: GL context is null");
         MOBILEGL_ASSERT(binding < programObj.samplerUniformLocationByBinding.size(),
                         "ResolveStorageImageDescriptor: binding %u out of range", binding);
 
@@ -1291,7 +1293,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
 
-        auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(imageUnit);
+        auto& imageBinding = MGB_CTX->GetImageTextureBinding(imageUnit);
         if (imageBinding.Texture == nullptr) {
             // Legal GL: an image unit with no texture bound makes loads return zero and discards
             // stores (4.6 core 8.26). It is not a reason to lose the draw, which is what returning
@@ -1647,7 +1649,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Open-coded ResolveSamplerTextureRaw so the unit is resolved once for both the
         // texture and the sampler override - this runs per binding per full-path draw,
         // and program-alternating draw streams take the full path on every draw.
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveSampledBinding: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveSampledBinding: GL context is null");
         MOBILEGL_ASSERT(binding < programObj.samplerUniformLocationByBinding.size(),
                         "ResolveSampledBinding: sampler location binding %u out of range", binding);
         MOBILEGL_ASSERT(binding < programObj.samplerTextureTargetByBinding.size(),
@@ -1658,7 +1660,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
         const Int unit = ResolveSamplerUnitIndex(program, location, binding);
-        auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+        auto& textureUnit = MGB_CTX->GetTextureUnitObject(unit);
         const TextureTarget preferredTarget = programObj.samplerTextureTargetByBinding[binding];
         MG_State::GLState::ITextureObject* texture =
             textureUnit.GetBindingSlot(preferredTarget).GetBoundObject().get();
@@ -1802,7 +1804,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const ProgramFactory::VkProgramObject& programObj,
         Vector<MG_State::GLState::ITextureObject*>& outTextures) const {
         outTextures.clear();
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr,
+        MOBILEGL_ASSERT(MGB_CTX_LIVE,
                         "CollectStorageImageTextures: GL context is null");
         // Same as the sampled walk: a declined program is refused at bind time, and its declined
         // binding has no uniform location to reach an image unit through.
@@ -1846,7 +1848,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     return false;
                 }
 
-                auto* texture = MG_State::pGLContext->GetImageTextureBinding(imageUnit).Texture.get();
+                auto* texture = MGB_CTX->GetImageTextureBinding(imageUnit).Texture.get();
                 if (texture == nullptr) {
                     // ResolveStorageImageDescriptor will substitute the placeholder image for this
                     // binding; include it here for the same reason the sampled walk includes the
@@ -1884,7 +1886,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const ProgramFactory::VkProgramObject& programObj,
         Vector<SamplerImageFeedbackBinding>& outBindings) const {
         outBindings.clear();
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr,
+        MOBILEGL_ASSERT(MGB_CTX_LIVE,
                         "CollectSamplerImageFeedback: GL context is null");
         if (programObj.declinedDescriptors) return true;
 
@@ -1934,7 +1936,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         if (imageUnit < 0 || imageUnit >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
                             return false;
                         }
-                        const auto& image = MG_State::pGLContext->GetImageTextureBinding(imageUnit);
+                        const auto& image = MGB_CTX->GetImageTextureBinding(imageUnit);
                         // A sampler view exposes all layers of its target; equal texture plus an
                         // overlapping mip therefore aliases the writable image subresource.
                         if (image.Texture.get() == sampledTexture &&
@@ -1964,7 +1966,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const void* outData = nullptr;
         VkDeviceSize outSize = 0;
 
-        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveUniformBufferPayload: GL context is null");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "ResolveUniformBufferPayload: GL context is null");
         MOBILEGL_ASSERT(binding < programObj.bindingKinds.size(),
                         "ResolveUniformBufferPayload: binding %u out of range", binding);
         MOBILEGL_ASSERT(programObj.bindingKinds[binding] == ProgramFactory::DescriptorBindingKind::UniformBufferDynamic,
@@ -2009,12 +2011,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         const Uint32 frontendBinding = program.GetUniformBlockBinding(static_cast<Uint32>(blockIndex));
         const Uint32 uniformBindingPointCount =
-            static_cast<Uint32>(MG_State::pGLContext->GetBufferBindingPointCount(BufferTarget::Uniform));
+            static_cast<Uint32>(MGB_CTX->GetBufferBindingPointCount(BufferTarget::Uniform));
         MOBILEGL_ASSERT(frontendBinding < uniformBindingPointCount,
                         "ResolveUniformBufferPayload: frontend UBO binding %u out of range for block '%s'",
                         frontendBinding, program.GetUniformBlockName(static_cast<Uint32>(blockIndex)).c_str());
 
-        auto& bindingPoint = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::Uniform, frontendBinding);
+        auto& bindingPoint = MGB_CTX->GetBufferBindingPoint(BufferTarget::Uniform, frontendBinding);
         const auto& bufferObject = bindingPoint.GetBoundObject();
         MOBILEGL_ASSERT(bufferObject != nullptr,
                         "ResolveUniformBufferPayload: no UBO bound at frontend binding %u for block '%s'",
@@ -2076,6 +2078,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 out.dynamicOffset = rangeStart;
             }
         }
+        if (MG_Util::PipeStats::Enabled() && !out.directBindable) {
+            // D-B8: the bytes Magma repacks into its own UBO ring, i.e. exactly the host
+            // payload a split build would have to ship with set_shader_buffers. Espryt binds
+            // the frontend buffer to the driver and contributes nothing here, which is why
+            // the class is named for the payload and not for the call. Counted AFTER the
+            // zero-copy direct-bind decision: a direct bind repacks nothing, and counting it
+            // here reported a copy that never happened.
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageUboNamed,
+                                         static_cast<Uint64>(outSize));
+        }
         return true;
     }
 
@@ -2283,6 +2295,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         outBuffer = slice.buffer;
         outRange = ubo.payloadSize;
         outDynamicOffset = static_cast<Uint32>(slice.offset);
+        if (isGlobalUbo && MG_Util::PipeStats::Enabled()) {
+            // Magma's half of stage-ubo-global, so the class means the same on both
+            // backends. The memo hit above returns before this, so a frame that reuses the
+            // slice correctly contributes nothing.
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageUboGlobal,
+                                         static_cast<Uint64>(ubo.payloadSize));
+        }
         if (isGlobalUbo) {
             m_globalUboMemo[m_globalUboMemoNext] =
                 GlobalUboSliceMemo{uboProgramLifetimeId, uboFrameSerial, uboContentVersion,

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.h

@@ -130,7 +130,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // stale memo.
         //
         // Drawn from a process-wide source, never a per-instance counter: the VAO
-        // memos outlive this factory (they live on pGLContext's VAOs, the renderer
+        // memos outlive this factory (they live on the frontend context's VAOs, the renderer
         // is destroyed and recreated on EGL surface release/re-create), so a fresh
         // factory restarting at a dead factory's epoch value would honor its
         // dangling entry pointers. The constructor takes a value strictly greater

MobileGL/MG_Backend/DirectVulkan/Renderer/VkBufferManager.cpp

@@ -10,6 +10,8 @@
 #include "../DirectVulkan.h"
 #include "VulkanRenderer.h"
 
+#include "MG_Util/Metrics/PipeStats.h"
+
 namespace MobileGL::MG_Backend::DirectVulkan {
     namespace {
         constexpr VmaAllocationCreateFlags kResidentBufferAllocationFlags =
@@ -229,8 +231,38 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     Bool VkBufferManager::UploadTransient(BufferKind kind, Uint32 frameIndex, const void* data,
                                           VkDeviceSize size, VkDeviceSize alignment, BufferSlice& outSlice) {
-        (void)kind;
-        return m_transientUploadArena.Upload(frameIndex, data, size, alignment, outSlice);
+        if (!m_transientUploadArena.Upload(frameIndex, data, size, alignment, outSlice)) {
+            return false;
+        }
+        if (MG_Util::PipeStats::Enabled()) {
+            // The single chokepoint for Magma's per-draw staging. Uniform is deliberately
+            // absent: its bytes are counted by the caller, which is the only place that
+            // knows whether the payload is the default block (stage-ubo-global) or a named
+            // one repacked into the ring (stage-ubo-named), and counting here as well would
+            // double every uniform byte.
+            switch (kind) {
+            case BufferKind::Vertex:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageVertexClient,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::Index:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageIndexClient,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::Indirect:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageIndirectCmd,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::TextureBuffer:
+            case BufferKind::ShaderStorage:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::Uniform:
+                break;
+            }
+        }
+        return true;
     }
 
     Bool VkBufferManager::InitializeTransientArenas() {
@@ -339,6 +371,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             resource.pendingFullUpload = true;
             return false;
         }
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
+        }
         resource.pendingFullUpload = false;
         return true;
     }
@@ -353,6 +388,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                            static_cast<VkDeviceSize>(size), 16, staging)) {
             return false;
         }
+        if (MG_Util::PipeStats::Enabled()) {
+            // The staging fill is the host copy; the vkCmdCopyBuffer below is the device
+            // half of the same bytes and is not counted twice.
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
+        }
         VkCommandBuffer commandBuffer = m_copyProvider->AcquireBufferCopyCommandBuffer();
         if (commandBuffer == VK_NULL_HANDLE) {
             return false;
@@ -422,6 +462,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (!resource->buffer.Upload(bufferObject.MappedData(), size, 0)) {
             MGLOG_E_ONCE("VkBufferManager::OnRespecify: in-place upload failed");
             resource->pendingFullUpload = true;
+        } else if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
         }
     }
 
@@ -447,6 +489,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                          static_cast<VkDeviceSize>(size), static_cast<VkDeviceSize>(offset))) {
                 MGLOG_E_ONCE("VkBufferManager::OnSubData: host upload failed");
                 resource->pendingFullUpload = true;
+            } else if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
             }
             return;
         }
@@ -484,6 +529,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                          static_cast<VkDeviceSize>(size), static_cast<VkDeviceSize>(offset))) {
                 MGLOG_E_ONCE("VkBufferManager::OnFlushMappedRange: host upload failed");
                 resource->pendingFullUpload = true;
+            } else if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
             }
             return;
         }
@@ -554,6 +602,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Uint8* seed = bufferObject.MappedData();
         if (seed != nullptr) {
             resource->buffer.Upload(seed, size, 0);
+            if (MG_Util::PipeStats::Enabled()) {
+                // The one-time seed of a persistent map. Everything the app writes AFTER
+                // this goes straight through the mapping and is persistent-map-push
+                // territory (unwired, D4/D-B4), not this class.
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
+            }
         }
         resource->persistentMapped = true;
         resource->pendingFullUpload = false;
@@ -602,6 +657,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 resource->usageFlags = 0;
                 return false;
             }
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
+            }
             resource->pendingFullUpload = false;
         }
 
@@ -681,6 +740,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                            outSlice)) {
             return false;
         }
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
+        }
         resource->transientSlice = outSlice;
         resource->transientFrameSerial = m_frameSerial;
         resource->transientChangeSerial = changeSerial;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkClearManager.cpp

@@ -13,6 +13,7 @@
 #include "VkTextureManager.h"
 
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_Util/Converters/MGToStr/FramebufferEnumConverter.h"
 #include "MG_Util/Converters/MGToStr/TextureEnumConverter.h"
 
@@ -54,7 +55,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (payload.colorEncoding != ClearColorEncoding::Float) return;
         // With GL_FRAMEBUFFER_SRGB enabled GL performs the encoding itself, so the driver doing it
         // is exactly right and there is nothing to undo.
-        if (MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb)) return;
+        if (MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb)) return;
         if (ResolveSrgbAttachmentWriteFormat(destinationFormat, false) == destinationFormat) return;
 
         // sRGB -> linear (GL 4.6 core 8.24), applied to the colour channels only: alpha is stored

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.cpp

@@ -13,6 +13,7 @@
 #include "MG_Util/Converters/MGToStr/FramebufferEnumConverter.h"
 #include "MG_Util/Converters/MGToVk/TextureEnumConverter.h"
 #include "MG_Util/Metrics/TextureMetrics.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 
 namespace MobileGL::MG_Backend::DirectVulkan {
     static Bool TryResolveSampleCountFlagBits(Int requestedSamples, VkSampleCountFlagBits& outSampleCount) {
@@ -610,7 +611,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // sRGB attachments switch between their sRGB and UNORM-twin views with this
         // capability (ResolveSrgbAttachmentWriteFormat), changing the render pass formats.
         const Bool framebufferSrgbEnabled =
-            MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
+            MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
         XXHASH_VERIFY(XXH64_update(m_hashState, &framebufferSrgbEnabled, sizeof(framebufferSrgbEnabled)));
         auto& drawBuffers = fbo.GetDrawBuffers();
         XXHASH_VERIFY(XXH64_update(m_hashState, drawBuffers.data(), drawBuffers.size() * sizeof(drawBuffers[0])));
@@ -962,7 +963,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
                     const VkImageLayout trackedRbLayout = rbResource->layout;
                     const Bool rbFramebufferSrgb =
-                        MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
+                        MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
                     const VkFormat rbAttachmentFormat =
                         ResolveSrgbAttachmentWriteFormat(rbResource->format, rbFramebufferSrgb);
                     rbDesc.flags = 0;
@@ -1108,7 +1109,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         textureResources.emplace_back(textureResource);
                         desc.format = ResolveSrgbAttachmentWriteFormat(
                             textureResource->format,
-                            MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb));
+                            MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb));
                         attachmentSampleCount = textureResource->sampleCount;
                         trackedColorLayout = textureResource->layout;
                         trackedAttachmentLayouts.emplace_back(TrackedAttachmentLayoutInfo {

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp

@@ -11,8 +11,10 @@
 #include "ProgramFactory.h"
 
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_Util/Converters/MGToStr/TextureEnumConverter.h"
 #include "MG_Util/Converters/MGToVk/TextureEnumConverter.h"
+#include "MG_Util/Metrics/PipeStats.h"
 
 #include <Config.h>
 #include <algorithm>
@@ -805,7 +807,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // sampled-texture sync scan the entire alive-texture map per draw.
             if (aliveIt == m_aliveObjects.end()) {
                 WeakPtr<MG_State::GLState::ITextureObject> aliveTexture;
-                const auto& liveTexture = MG_State::pGLContext->GetTextureObject(texture.GetExternalIndex());
+                const auto& liveTexture = MGB_CTX->GetTextureObject(texture.GetExternalIndex());
                 if (liveTexture && liveTexture.get() == &texture) {
                     aliveTexture = liveTexture;
                 } else {
@@ -948,7 +950,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         const Bool framebufferSrgbEnabled =
-            MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
+            MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
         const VkFormat baseAttachmentFormat =
             viewFormatOverride != VK_FORMAT_UNDEFINED ? viewFormatOverride : resource->format;
         const VkFormat attachmentFormat =
@@ -3150,6 +3152,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             packBox(dst, item.regionLo, item.regionSize);
         }
 
+        if (MG_Util::PipeStats::Enabled()) {
+            // Same shape split as Espryt's: one union box per item, or one job per rect of
+            // a refined rect list. The box/rect decision is invisible to SSIM and is what
+            // the +6 ms/frame Mali cliff of section 7.3 was, so it is counted apart from
+            // the bytes.
+            Uint64 boxEmissions = 0;
+            Uint64 rectEmissions = 0;
+            Uint64 jobs = 0;
+            for (const auto& item : uploadItems) {
+                if (item.rects.empty()) {
+                    ++boxEmissions;
+                    jobs += isCombinedDepthStencil ? 2u : 1u;
+                } else {
+                    ++rectEmissions;
+                    jobs += static_cast<Uint64>(item.rects.size());
+                }
+            }
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageTexture,
+                                         static_cast<Uint64>(stagingSize));
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadEmissions,
+                                         static_cast<Uint64>(uploadItems.size()));
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadBoxEmissions, boxEmissions);
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadRectEmissions, rectEmissions);
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadJobs, jobs);
+        }
+
         const VkImageAspectFlags aspectMask = GetAspectMaskForFormat(outResource.format);
         VkPipelineStageFlags uploadSrcStageMask = VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT;
         VkAccessFlags uploadSrcAccessMask = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.h

@@ -24,6 +24,7 @@
 #include "MG_Util/Math/VectorTypes.h"
 #include <Includes.h>
 #include <MG_Backend/BackendObject.h>
+#include <MG_Util/SelfTest/PrimitivesGeneratedNoXfbProbe.h>
 #include <vk_mem_alloc.h>
 
 #include "../VkIncludes.h"
@@ -674,8 +675,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // per object: one group of four slots each, handed out on first use.
         static constexpr SizeT kXfbCounterObjectSlots = 16;
         VkBufferObject m_xfbCounterBuffer;
-        UnorderedMap<Uint, Uint32> m_xfbCounterSlotByObject;
-        Uint32 m_xfbNextCounterSlot = 0;
+        // Which transform feedback object owns each slot group, by the frontend's never-reused
+        // lifetime id (0 = the slot is free). This used to be an UnorderedMap keyed on the GL
+        // NAME, which is recycled by glGenTransformFeedbacks: a deleted-and-recreated object
+        // inherited the dead one's slot, and since nothing ever removed an entry the map also
+        // grew for the life of the context. A fixed table cannot do either: a group is taken over
+        // only from an owner with no OPEN span (see CurrentXfbCounterSlot), so an object whose
+        // counters can still be resumed never loses them, and a dead object's group comes back.
+        Array<Uint64, kXfbCounterObjectSlots> m_xfbCounterSlotOwner{};
+        // Tie-break among reclaimable groups only; never on its own, because the paused span the
+        // groups exist for is by construction the least recently used one.
+        Array<Uint64, kXfbCounterObjectSlots> m_xfbCounterSlotLastUse{};
+        Uint64 m_xfbCounterSlotUseSerial = 0;
         // Set for a slot once a captured draw has been recorded into its span; selects
         // counter-buffer resume on the next captured draw of the same span.
         Array<Bool, kXfbCounterObjectSlots> m_xfbCountersValid{};
@@ -717,15 +728,74 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Vector<Uint32> m_xfbQueryActiveSlots[2];
         Bool m_xfbQuerySlotOpen = false;
         Uint32 m_xfbQueryOpenSlot = 0;
+        // GL_PRIMITIVES_GENERATED reroute for draws made while transform feedback is
+        // INACTIVE. The stream pool's primitivesNeeded is defined to count those draws
+        // too, but a Mali driver (and Mesa lavapipe) answers 0 unless a capture span
+        // is open (the CTS's tessellator-measuring shape). Where the bring-up probe
+        // finds that defect with a working control - or
+        // MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE forces it - such draws accumulate the
+        // GENERATED count through this pool instead, whose type the arming picks:
+        // VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT where the device hosts the dedicated
+        // query with its rasterizer-discard feature (exact semantics by definition -
+        // the extension exists because GL needs this count without a capture), else a
+        // VK_QUERY_TYPE_PIPELINE_STATISTICS pool over clipping-stage invocations (one
+        // per primitive reaching primitive clipping - after every vertex processing
+        // stage, before rasterizer discard - which is the same set).
+        // XFB-ACTIVE draws keep the stream slot (exact today, and WRITTEN needs it);
+        // every draw with no open capture - a PAUSED span's draws included - takes a
+        // reroute slot, and the span then ignores the frontend's CPU paused-primitive
+        // counter rather than adding it on top (see IsPrimGenRerouteArmed): that
+        // counter is written by only 3 of the ~15 draw entry points and answers 0 for
+        // GL_PATCHES, so it cannot price the draws this reroute exists to repair. One
+        // GL query span may therefore hold slots of both pools.
+        Bool m_pipelineStatisticsQueryFeatureEnabled = false;
+        // VK_EXT_primitives_generated_query: base feature, and the
+        // ...WithRasterizerDiscard feature without which a discarding draw inside the
+        // query is invalid usage (so the reroute never picks the dedicated pool on a
+        // base-only device - GL applications toggle discard freely).
+        Bool m_primitivesGeneratedQueryFeatureEnabled = false;
+        Bool m_primitivesGeneratedQueryDiscardFeatureEnabled = false;
+        // tessellationShader was enabled at device creation (it is taken whenever the
+        // device advertises it); gates the probe's PATCHES shape.
+        Bool m_tessellationShaderFeatureEnabled = false;
+        MG_Util::SelfTest::PrimGenRerouteKind m_primGenRerouteKind =
+            MG_Util::SelfTest::PrimGenRerouteKind::None;
+        // The bring-up probe measured this device's stream query as counting draws made
+        // with no capture span open (the StreamCounts verdict) - so it counts the
+        // PAUSED-span ones too, through the stream slot they take when nothing is
+        // rerouted. Only the probe can know this, so it stays false wherever the probe
+        // is not consulted (the forced arms), which keeps those lanes' accounting as it
+        // was.
+        Bool m_primGenStreamCountsXfbInactiveDraws = false;
+        VkQueryPool m_primGenReroutePool = VK_NULL_HANDLE;
+        Uint32 m_primGenRerouteSlotCursor = 0;
+        Vector<Uint32> m_primGenRerouteActiveSlots;
+        Bool m_primGenRerouteSlotOpen = false;
+        Uint32 m_primGenRerouteOpenSlot = 0;
+        // Runs the bring-up probe (memoized per process) and decides
+        // m_primGenRerouteKind. Called at the end of device creation: it records on
+        // m_graphicsQueue, which nothing else is using yet.
+        void ArmPrimGenReroute();
 
     public:
+        // Whether a GENERATED span opened now will have the draws made while the GL
+        // span is PAUSED counted on the GPU - through the reroute pool, which takes
+        // every draw with no open capture, or (where the reroute is not armed because
+        // the stream query was measured to count capture-less draws) through the stream
+        // slot such a draw still takes. The frontend's CPU paused-primitive counter
+        // must not be added on top of either: it would double count, and it cannot
+        // price the draws that matter anyway - only 3 of the ~15 draw entry points
+        // write it and it answers 0 for GL_PATCHES. Read once per span, after
+        // StartXfbQueryCapture (whose pool creation may disarm the reroute).
+        Bool ArePausedDrawsGpuCounted() const;
         // kind: 0 = PRIMITIVES_WRITTEN, 1 = PRIMITIVES_GENERATED.
         Bool StartXfbQueryCapture(Uint32 kind);
-        void StopXfbQueryCapture(Uint32 kind, Vector<Uint32>& outSlots);
-        Bool ResolveXfbQueryResult(const Vector<Uint32>& slots, Bool wantGenerated, Uint64& outPrimitives);
+        void StopXfbQueryCapture(Uint32 kind, Vector<Uint32>& outSlots, Vector<Uint32>& outRerouteSlots);
+        Bool ResolveXfbQueryResult(const Vector<Uint32>& slots, const Vector<Uint32>& rerouteSlots,
+                                   Bool wantGenerated, Uint64& outPrimitives);
 
     private:
-        void BeginXfbQueryForDraw(VkCommandBuffer commandBuffer);
+        void BeginXfbQueryForDraw(VkCommandBuffer commandBuffer, Bool xfbActive);
         void EndXfbQueryForDraw(VkCommandBuffer commandBuffer);
 
         VkCommandPool m_commandPool = VK_NULL_HANDLE;

MobileGL/MG_Backend/MGPipe/PipeInputs.cpp

@@ -0,0 +1,179 @@
+// MobileGL - MobileGL/MG_Backend/MGPipe/PipeInputs.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The backend-side half of the PipeInputs block: the poison Fatal with its verb name, the
+// name lookups the runtime knobs need, and - in a verify build - the per-field equality,
+// the entry comparator and the corruption injector. Compiled only under MOBILEGL_PIPE_PUSH
+// (CMakeLists.txt appends it to SOURCE_FILES there), so the pull build never sees it. Spells
+// no MG_State global: everything that reads the live context lives in MG_Impl/Pipe/PipeFill.cpp.
+#include <MG_Backend/MGPipe/PipeInputs.h>
+
+#include <cstdint>
+#include <cstring>
+
+namespace MobileGL::MG_Pipe {
+    const char* MGPipeVerbName(MGPipeVerb verb) {
+        const auto index = static_cast<SizeT>(verb);
+        return index < kMGPipeVerbCount ? kMGPipeVerbNames[index] : "<none>";
+    }
+
+    [[noreturn]] void MGPipeInputPoisonFatalForVerb(MGPipeInputField field, MGPipeVerb verb) {
+        MGPipeInputPoisonFatal(field, MGPipeVerbName(verb));
+    }
+
+    Optional<MGPipeInputField> MGPipeFindInputField(const char* name) {
+        if (name == nullptr) return std::nullopt;
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            if (std::strcmp(kMGPipeInputFieldNames[i], name) == 0) return static_cast<MGPipeInputField>(i);
+        }
+        return std::nullopt;
+    }
+
+    Optional<MGPipeVerb> MGPipeFindVerb(const char* name) {
+        if (name == nullptr) return std::nullopt;
+        for (SizeT i = 0; i < kMGPipeVerbCount; ++i) {
+            if (std::strcmp(kMGPipeVerbNames[i], name) == 0) return static_cast<MGPipeVerb>(i);
+        }
+        return std::nullopt;
+    }
+
+#if MOBILEGL_PIPE_VERIFY
+    namespace {
+        using CurrentVertexAttributeValue = PipeInputs::CurrentVertexAttributeValue;
+
+        // Every overload is declared up front: the array overloads recurse into their element
+        // type, and a call inside a template only sees what was declared before the template.
+        template <class T>
+        Bool StorageEqual(const T& a, const T& b);
+        template <class T>
+        Bool StorageEqual(T* const& a, T* const& b);
+        template <class T>
+        Bool StorageEqual(const SharedPtr<T>& a, const SharedPtr<T>& b);
+        template <class T, SizeT N>
+        Bool StorageEqual(const T (&a)[N], const T (&b)[N]);
+        Bool StorageEqual(const PipeInputs::IndexedCapabilities& a, const PipeInputs::IndexedCapabilities& b);
+        Bool StorageEqual(const CurrentVertexAttributeValue& a, const CurrentVertexAttributeValue& b);
+        template <class T>
+        void CorruptStorage(T& v);
+        template <class T>
+        void CorruptStorage(T*& p);
+        template <class T>
+        void CorruptStorage(SharedPtr<T>& p);
+        template <class T, SizeT N>
+        void CorruptStorage(T (&a)[N]);
+        void CorruptStorage(PipeInputs::IndexedCapabilities& c);
+        void CorruptStorage(CurrentVertexAttributeValue& v);
+
+        // ---- equality over one field's storage ----
+        // O-class storage compares by identity: a raw pointer into the context, or the object a
+        // SharedPtr owns. Everything else goes through G4's MGPipeFieldEqual, recursing through
+        // C arrays element-wise.
+        template <class T>
+        Bool StorageEqual(T* const& a, T* const& b) {
+            return a == b;
+        }
+        template <class T>
+        Bool StorageEqual(const SharedPtr<T>& a, const SharedPtr<T>& b) {
+            return a.get() == b.get();
+        }
+        template <class T, SizeT N>
+        Bool StorageEqual(const T (&a)[N], const T (&b)[N]) {
+            for (SizeT i = 0; i < N; ++i) {
+                if (!StorageEqual(a[i], b[i])) return false;
+            }
+            return true;
+        }
+        Bool StorageEqual(const PipeInputs::IndexedCapabilities& a, const PipeInputs::IndexedCapabilities& b) {
+            return StorageEqual(a.Blend, b.Blend) && StorageEqual(a.ScissorTest, b.ScissorTest);
+        }
+        // Three scalar arrays and nothing else (Core.h), so a bitwise compare has no padding to
+        // false-differ on and keeps a NaN float attribute equal to itself. The size assertion is
+        // what turns a fourth member into a build break rather than a blind spot.
+        Bool StorageEqual(const CurrentVertexAttributeValue& a, const CurrentVertexAttributeValue& b) {
+            static_assert(sizeof(CurrentVertexAttributeValue) == 3 * 4 * 4,
+                          "CurrentVertexAttributeValue grew a member; update the comparator");
+            return std::memcmp(&a, &b, sizeof(CurrentVertexAttributeValue)) == 0;
+        }
+        template <class T>
+        Bool StorageEqual(const T& a, const T& b) {
+            return MGPipeFieldEqual(a, b);
+        }
+
+        // ---- corruption of one field's storage ----
+        // Every shape is perturbed in a way the comparator above must see: a Bool flips, a
+        // scalar or enum moves by one, a pointer's low bits are flipped (never dereferenced:
+        // the snapshot is only ever compared), a SharedPtr becomes an aliasing pointer to a
+        // flipped address with no control block, an array corrupts its first element, and any
+        // other struct has its first byte XOR'ed with 0x5A.
+        template <class T>
+        T* FlipPointer(T* p) {
+            return reinterpret_cast<T*>(reinterpret_cast<std::uintptr_t>(p) ^ 0x5A);
+        }
+        template <class T>
+        void CorruptStorage(T*& p) {
+            p = FlipPointer(p);
+        }
+        template <class T>
+        void CorruptStorage(SharedPtr<T>& p) {
+            p = SharedPtr<T>(SharedPtr<T>(), FlipPointer(p.get()));
+        }
+        template <class T, SizeT N>
+        void CorruptStorage(T (&a)[N]) {
+            CorruptStorage(a[0]);
+        }
+        void CorruptStorage(PipeInputs::IndexedCapabilities& c) {
+            CorruptStorage(c.Blend);
+        }
+        void CorruptStorage(CurrentVertexAttributeValue& v) {
+            v.floatValue[0] += 1.f;
+        }
+        template <class T>
+        void CorruptStorage(T& v) {
+            if constexpr (std::is_same_v<T, Bool>) {
+                v = !v;
+            } else if constexpr (std::is_enum_v<T>) {
+                v = static_cast<T>(static_cast<std::underlying_type_t<T>>(v) + 1);
+            } else if constexpr (std::is_arithmetic_v<T>) {
+                v = static_cast<T>(v + 1);
+            } else {
+                static_assert(std::is_trivially_copyable_v<T>, "PipeInputs storage must be trivially copyable");
+                unsigned char first = 0;
+                std::memcpy(&first, &v, 1);
+                first ^= 0x5A;
+                std::memcpy(&v, &first, 1);
+            }
+        }
+    } // namespace
+
+    Bool MGPipeInputsFieldEqual(MGPipeInputField field, const PipeInputs& a, const PipeInputs& b) {
+        // A forwarded field has no storage and is equal by definition; VisitStorage answers
+        // false for it, hence the explicit sticky test first.
+        if (kMGPipeInputFieldSticky[static_cast<SizeT>(field)]) return true;
+        return PipeInputs::VisitStorage(field, a, b, [](const auto& x, const auto& y) { return StorageEqual(x, y); });
+    }
+
+    Bool MGPipeVerifyInputs(const PipeInputs& pushed, const PipeInputs& snapshot, const MGPipeFieldMask& mask,
+                            MGPipeInputField* outField) {
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            const auto field = static_cast<MGPipeInputField>(i);
+            if (!MGPipeFieldMaskHas(mask, field)) continue;
+            if (MGPipeInputsFieldEqual(field, pushed, snapshot)) continue;
+            if (outField != nullptr) *outField = field;
+            return false;
+        }
+        return true;
+    }
+
+    Bool MGPipeApplyVerifyCorruption(PipeInputs& snapshot, MGPipeInputField field) {
+        return PipeInputs::VisitStorage(field, snapshot, snapshot, [](auto& x, auto&) {
+            CorruptStorage(x);
+            return true;
+        });
+    }
+#endif // MOBILEGL_PIPE_VERIFY
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Backend/MGPipe/PipeInputs.h

@@ -0,0 +1,714 @@
+// MobileGL - MobileGL/MG_Backend/MGPipe/PipeInputs.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <MG_Pipe/MGPipe.h>
+// The frontend types the accessors return. Allowed here: P13 keeps this include for the
+// verify arm (ARCHITECTURE.md 9.5). This header spells no MG_State global - every read of
+// the live context happens on the client side, in MG_Impl/Pipe/PipeFill.cpp.
+#include <MG_State/GLState/Core.h>
+
+// MOBILEGL_PIPE_POISON: the per-verb generation stamps and the read-side
+// Fatal{UnmigratedPipeInput} check. Derived here, once. The repository's debug gate is
+// MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG (Defines.h); the verify CI build is
+// Release/INFO with MOBILEGL_BUILD_DISAGGREGATED=OFF, so the third arm is what arms the poison
+// there without dragging MG_Remote in.
+#if MOBILEGL_PIPE_PUSH && (MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG || MOBILEGL_BUILD_DISAGGREGATED || \
+                           MOBILEGL_PIPE_VERIFY)
+#define MOBILEGL_PIPE_POISON 1
+#else
+#define MOBILEGL_PIPE_POISON 0
+#endif
+
+namespace MobileGL::MG_Pipe {
+    // PipeInputs.cpp. The poison Fatal with the verb's name ("<none>" before the first
+    // verb): MGLOG_F + std::abort(), live at every log level on purpose - this is not
+    // MOBILEGL_ASSERT, which is inert in INFO builds.
+    [[noreturn]] void MGPipeInputPoisonFatalForVerb(MGPipeInputField field, MGPipeVerb verb);
+    // kMGPipeVerbNames[verb], or "<none>" for kVerbCount (no verb has been filled yet).
+    const char* MGPipeVerbName(MGPipeVerb verb);
+    // Name lookups for the runtime knobs (MOBILEGL_PIPE_VERIFY_CORRUPT names a field,
+    // MOBILEGL_PIPE_POISON_OMIT a Verb:Field pair). Empty on an unknown name.
+    Optional<MGPipeInputField> MGPipeFindInputField(const char* name);
+    Optional<MGPipeVerb> MGPipeFindVerb(const char* name);
+
+    // The read-side poison check, on every non-forwarded accessor. Under MOBILEGL_PIPE_POISON
+    // a read of a field whose stamp is older than the current verb serial is
+    // Fatal{UnmigratedPipeInput, "Field@Verb"}; otherwise the accessor is a plain load.
+#if MOBILEGL_PIPE_POISON
+#define MGP_INPUT_CHECK(Field)                                                                                         \
+    do {                                                                                                               \
+        if (!::MobileGL::MG_Pipe::MGPipeInputFieldIsFresh(m_filled, (Field))) {                                        \
+            ::MobileGL::MG_Pipe::MGPipeInputPoisonFatalForVerb((Field), m_currentVerb);                                \
+        }                                                                                                              \
+    } while (0)
+#else
+#define MGP_INPUT_CHECK(Field) ((void)0)
+#endif
+    // The compare-at-read hook of the MOBILEGL_PIPE_VERIFY comparator (P1 brief D8), defined
+    // in MG_Impl/Pipe/PipeFill.cpp: re-reads the field from the live context and compares it
+    // against the stored value, and reports the FIRST divergence as
+    // Fatal{PipeVerifyDiffer, "Field@Verb", verb=<serial>, where=read} (the indices go in a
+    // preceding MGLOG_E). Only the live block (gPipeInputs) is verified; a snapshot's own
+    // accessors are plain loads. Off in every other build.
+    struct PipeInputs;
+#if MOBILEGL_PIPE_VERIFY
+    void MGPipeVerifyReadHook(const PipeInputs& self, MGPipeInputField field, Uint index0, Uint index1);
+#define MGP_INPUT_VERIFY_READ(Field, Index0, Index1)                                                                   \
+    ::MobileGL::MG_Pipe::MGPipeVerifyReadHook(*this, (Field), static_cast<Uint>(Index0), static_cast<Uint>(Index1))
+#else
+#define MGP_INPUT_VERIFY_READ(Field, Index0, Index1) ((void)0)
+#endif
+
+    // The V/O storage of every field that has storage, by field id. The seven F-class
+    // (forwarded) fields have none. PipeInputs::VisitStorage dispatches on this list, which
+    // is what keeps the comparator and the corruption injector one function each instead of
+    // two sixty-way switches.
+    // clang-format off
+#define MGP_INPUT_STORAGE_LIST(X)                                                    \
+    X(GetActiveTextureUnit,                        m_activeTextureUnit)              \
+    X(GetBlendColor,                               m_blendColor)                     \
+    X(GetBlendEquationIndexed,                     m_blendEquation)                  \
+    X(GetBlendFuncIndexed,                         m_blendFunc)                      \
+    X(GetBoundTransformFeedbackName,               m_boundTransformFeedbackName)     \
+    X(GetBoundVertexArray,                         m_boundVertexArray)               \
+    X(GetBufferBindingSlot,                        m_bufferBindingSlot)              \
+    X(GetBufferBindingPoint,                       m_bufferBindingPointBase)         \
+    X(GetTouchedBufferBindingPointCount,           m_touchedBindingPointCount)       \
+    X(GetClampReadColor,                           m_clampReadColor)                 \
+    X(GetClearColor,                               m_clearColor)                     \
+    X(GetClearDepth,                               m_clearDepth)                     \
+    X(GetClearStencil,                             m_clearStencil)                   \
+    X(GetColorMaskIndexed,                         m_colorMask)                      \
+    X(GetCullFaceMode,                             m_cullFaceMode)                   \
+    X(GetCurrentVertexAttribute,                   m_currentVertexAttribute)         \
+    X(GetDepthFunc,                                m_depthFunc)                      \
+    X(GetDepthMask,                                m_depthMask)                      \
+    X(GetDepthRangeIndexed,                        m_depthRange)                     \
+    X(GetFramebufferBindingSlot,                   m_framebufferBindingSlot)         \
+    X(GetImageTextureBinding,                      m_imageTextureBindingBase)        \
+    X(GetLineWidth,                                m_lineWidth)                      \
+    X(GetLogicOp,                                  m_logicOp)                        \
+    X(GetMaxTouchedTextureUnit,                    m_maxTouchedTextureUnit)          \
+    X(GetMinSampleShadingValue,                    m_minSampleShadingValue)          \
+    X(GetPatchDefaultInnerLevel,                   m_patchDefaultInnerLevel)         \
+    X(GetPatchDefaultOuterLevel,                   m_patchDefaultOuterLevel)         \
+    X(GetPatchVertices,                            m_patchVertices)                  \
+    X(GetPipelineStateVersion,                     m_pipelineStateVersion)           \
+    X(GetPixelStoreParameters,                     m_pixelStore)                     \
+    X(GetPolygonModeFront,                         m_polygonModeFront)               \
+    X(GetPolygonOffsetFactor,                      m_polygonOffsetFactor)            \
+    X(GetPolygonOffsetUnits,                       m_polygonOffsetUnits)             \
+    X(GetPrimitiveRestartIndex,                    m_primitiveRestartIndex)          \
+    X(GetProgramForDispatch,                       m_programForDispatch)             \
+    X(GetProgramForDraw,                           m_programForDraw)                 \
+    X(GetProvokingVertexMode,                      m_provokingVertexMode)            \
+    X(GetRenderStateParameters,                    m_renderState)                    \
+    X(GetRenderStateParametersVersion,             m_renderStateParametersVersion)   \
+    X(GetSamplingResolutionGeneration,             m_samplingResolutionGeneration)   \
+    X(GetScissorBox,                               m_scissorBox)                     \
+    X(GetStencilState,                             m_stencil)                        \
+    X(GetTextureBindGeneration,                    m_textureBindGeneration)          \
+    X(GetTextureContextId,                         m_textureContextId)               \
+    X(GetTextureUnitObject,                        m_textureUnitBase)                \
+    X(GetTransformFeedbackCapturedVertices,        m_transformFeedbackCapturedVertices) \
+    X(GetTransformFeedbackGeneration,              m_transformFeedbackGeneration)    \
+    X(GetTransformFeedbackPausedPrimitiveCounter,  m_transformFeedbackPausedPrimitiveCounter) \
+    X(GetTransformFeedbackProgram,                 m_transformFeedbackProgram)       \
+    X(GetViewport,                                 m_viewport)                       \
+    X(GetViewportIndexed,                          m_viewportIndexed)                \
+    X(IsCapabilityEnabled,                         m_capability)                     \
+    X(IsCapabilityEnabledIndexed,                  m_capabilityIndexed)              \
+    X(IsTransformFeedbackActive,                   m_transformFeedbackActive)        \
+    X(IsTransformFeedbackPaused,                   m_transformFeedbackPaused)        \
+    X(GetBoundTransformFeedbackLifetimeId,         m_boundTransformFeedbackLifetimeId)
+    // clang-format on
+
+    // The seven F-class fields, for the arithmetic below and for the sticky table's proof.
+    // The forwarded set IS the sticky set (PipeFields.def marks the same seven rows F and
+    // sticky), so an eighth sticky row without a forwarder is refused here, not by a test.
+    inline constexpr SizeT kMGPipeForwardedFieldCount = 7;
+    static_assert(kMGPipeForwardedFieldCount == kMGPipeInputStickyFieldCount,
+                  "the forwarded (F-class) fields and the sticky fields of PipeFields.def are the same seven rows");
+
+    // The block the backends read instead of GLContext (ARCHITECTURE.md 9.2 phase A, P1 brief
+    // D4). One struct, three storage classes, and every accessor keeps the NAME, PARAMETERS
+    // and RETURN TYPE of its GLContext counterpart (MG_State/GLState/Core.h) so the strangler
+    // sed is type-neutral:
+    //
+    //   V (value)            copied out of GLContext at fill time by calling the same accessor;
+    //                        no derivation logic is re-implemented here, which is what keeps the
+    //                        copy semantically identical by construction.
+    //   O (object reference) a SharedPtr copy, or a raw pointer to the live GLContext-owned
+    //                        slot/array for the accessors that return a non-const reference into
+    //                        the context. Identity is what phase C turns into a handle.
+    //   F (forwarded)        argument-keyed lookups and reverse-channel calls, defined out of
+    //                        line in MG_Impl/Pipe/PipeFill.cpp (the client side, where the live
+    //                        context may be spelled). Sticky: stamped once by the first fill that
+    //                        sees a live context.
+    //
+    // Every non-forwarded accessor is MGP_INPUT_CHECK (poison) -> MGP_INPUT_VERIFY_READ
+    // (compare-at-read) -> the storage. Both macros expand to nothing when their switch is
+    // off, so a plain MOBILEGL_PIPE_PUSH build's accessor is a load.
+    struct PipeInputs {
+        using GLContext = MG_State::GLState::GLContext;
+        using BufferObject = MG_State::GLState::BufferObject;
+        using BufferTarget = ::MobileGL::BufferTarget;
+        using FramebufferObject = MG_State::GLState::FramebufferObject;
+        using FramebufferTarget = ::MobileGL::FramebufferTarget;
+        using VertexArrayObject = MG_State::GLState::VertexArrayObject;
+        using ProgramObject = MG_State::GLState::ProgramObject;
+        using ITextureObject = MG_State::GLState::ITextureObject;
+        using TextureUnit = MG_State::GLState::TextureUnit;
+        using ImageTextureBinding = MG_State::GLState::ImageTextureBinding;
+        using CurrentVertexAttributeValue = MG_State::GLState::CurrentVertexAttributeValue;
+
+        static constexpr SizeT kBufferTargetCount = static_cast<SizeT>(BufferTarget::BufferTargetCount);
+        static constexpr SizeT kFramebufferTargetCount = static_cast<SizeT>(FramebufferTarget::FramebufferTargetCount);
+        static constexpr SizeT kCapabilityCount = static_cast<SizeT>(CapabilityInput::CapabilityInputCount);
+        static constexpr SizeT kMaxViewports = RenderStateParameters::MAX_VIEWPORTS;
+        static constexpr SizeT kMaxVertexAttribs = VertexArrayObject::MAX_VERTEX_ATTRIBS;
+        static constexpr SizeT kStencilFaceCount = static_cast<SizeT>(StencilFace::StencilFaceCount);
+
+        // IsCapabilityEnabledIndexed's two indexed capabilities, the only ones GLContext keeps
+        // indexed state for (RenderState::IsCapabilityEnabledIndexed).
+        struct IndexedCapabilities {
+            Bool Blend[kMGMaxDrawBuffers];
+            Bool ScissorTest[kMaxViewports];
+        };
+
+        // ---- identity / liveness (not fields) ----
+        // Whether a live GLContext exists. Forwarded (PipeFill.cpp): under push MGB_CTX_LIVE
+        // must be true as soon as a context exists, fill or no fill, which is what today's
+        // null-context guards test.
+        Bool IsLive() const;
+        // The live GLContext's address at the last fill; serves MGB_CTX_IDENTITY.
+        const void* ContextIdentity() const { return m_contextIdentity; }
+        // The verb of the last fill, kVerbCount before the first one.
+        MGPipeVerb CurrentVerb() const { return m_currentVerb; }
+#if MOBILEGL_PIPE_POISON
+        const MGPipeFilledState& FilledState() const { return m_filled; }
+#endif
+
+        // ---- V: values ----
+        Int GetActiveTextureUnit() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetActiveTextureUnit);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetActiveTextureUnit, 0, 0);
+            return m_activeTextureUnit;
+        }
+        const FloatVec4& GetBlendColor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBlendColor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBlendColor, 0, 0);
+            return m_blendColor;
+        }
+        void GetBlendEquationIndexed(Uint index, BlendEquation& color, BlendEquation& alpha) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBlendEquationIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBlendEquationIndexed, index, 0);
+            if (index >= kMGMaxDrawBuffers) {
+                MOBILEGL_ASSERT(false, "Blend equation index out of range: %u", index);
+                return;
+            }
+            color = m_blendEquation[index][0];
+            alpha = m_blendEquation[index][1];
+        }
+        void GetBlendFuncIndexed(Uint index, BlendFactor& srcRGB, BlendFactor& dstRGB, BlendFactor& srcAlpha,
+                                 BlendFactor& dstAlpha) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBlendFuncIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBlendFuncIndexed, index, 0);
+            if (index >= kMGMaxDrawBuffers) {
+                MOBILEGL_ASSERT(false, "Blend func index out of range: %u", index);
+                return;
+            }
+            srcRGB = m_blendFunc[index][0];
+            dstRGB = m_blendFunc[index][1];
+            srcAlpha = m_blendFunc[index][2];
+            dstAlpha = m_blendFunc[index][3];
+        }
+        // Dead field: filled, read by no backend since the D21 XFB counter-slot rekey; kept so
+        // the vendored inventory row keeps its mapping (Coverage.def).
+        Uint GetBoundTransformFeedbackName() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBoundTransformFeedbackName);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBoundTransformFeedbackName, 0, 0);
+            return m_boundTransformFeedbackName;
+        }
+        SizeT GetTouchedBufferBindingPointCount(BufferTarget target) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTouchedBufferBindingPointCount);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTouchedBufferBindingPointCount, static_cast<Uint>(target), 0);
+            return m_touchedBindingPointCount[static_cast<SizeT>(target)];
+        }
+        GLenum GetClampReadColor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClampReadColor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClampReadColor, 0, 0);
+            return m_clampReadColor;
+        }
+        const FloatVec4& GetClearColor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClearColor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClearColor, 0, 0);
+            return m_clearColor;
+        }
+        Float GetClearDepth() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClearDepth);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClearDepth, 0, 0);
+            return m_clearDepth;
+        }
+        Uint32 GetClearStencil() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClearStencil);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClearStencil, 0, 0);
+            return m_clearStencil;
+        }
+        BoolVec4 GetColorMaskIndexed(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetColorMaskIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetColorMaskIndexed, index, 0);
+            return m_colorMask[index];
+        }
+        CullFaceMode GetCullFaceMode() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetCullFaceMode);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetCullFaceMode, 0, 0);
+            return m_cullFaceMode;
+        }
+        const CurrentVertexAttributeValue& GetCurrentVertexAttribute(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetCurrentVertexAttribute);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetCurrentVertexAttribute, index, 0);
+            if (index >= kMaxVertexAttribs) {
+                static const CurrentVertexAttributeValue defaultValue{};
+                MGLOG_E_ONCE("PipeInputs::GetCurrentVertexAttribute: index %u is out of range", index);
+                return defaultValue;
+            }
+            return m_currentVertexAttribute[index];
+        }
+        DepthTestFunc GetDepthFunc() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetDepthFunc);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetDepthFunc, 0, 0);
+            return m_depthFunc;
+        }
+        Bool GetDepthMask() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetDepthMask);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetDepthMask, 0, 0);
+            return m_depthMask;
+        }
+        const FloatVec2& GetDepthRangeIndexed(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetDepthRangeIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetDepthRangeIndexed, index, 0);
+            if (index >= kMaxViewports) {
+                MOBILEGL_ASSERT(false, "Depth range index out of range: %u", index);
+                return m_depthRange[0];
+            }
+            return m_depthRange[index];
+        }
+        Float GetLineWidth() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetLineWidth);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetLineWidth, 0, 0);
+            return m_lineWidth;
+        }
+        LogicOperation GetLogicOp() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetLogicOp);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetLogicOp, 0, 0);
+            return m_logicOp;
+        }
+        Int GetMaxTouchedTextureUnit() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetMaxTouchedTextureUnit);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetMaxTouchedTextureUnit, 0, 0);
+            return m_maxTouchedTextureUnit;
+        }
+        Float GetMinSampleShadingValue() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetMinSampleShadingValue);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetMinSampleShadingValue, 0, 0);
+            return m_minSampleShadingValue;
+        }
+        const FloatVec2& GetPatchDefaultInnerLevel() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPatchDefaultInnerLevel);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPatchDefaultInnerLevel, 0, 0);
+            return m_patchDefaultInnerLevel;
+        }
+        const FloatVec4& GetPatchDefaultOuterLevel() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPatchDefaultOuterLevel);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPatchDefaultOuterLevel, 0, 0);
+            return m_patchDefaultOuterLevel;
+        }
+        Uint GetPatchVertices() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPatchVertices);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPatchVertices, 0, 0);
+            return m_patchVertices;
+        }
+        Uint GetPipelineStateVersion() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPipelineStateVersion);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPipelineStateVersion, 0, 0);
+            return m_pipelineStateVersion;
+        }
+        Uint GetRenderStateParametersVersion() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetRenderStateParametersVersion);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetRenderStateParametersVersion, 0, 0);
+            return m_renderStateParametersVersion;
+        }
+        PixelStoreParameters GetPixelStoreParameters(Bool isUnpack) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPixelStoreParameters);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPixelStoreParameters, isUnpack ? 1u : 0u, 0);
+            return m_pixelStore[isUnpack ? 1 : 0];
+        }
+        GLenum GetPolygonModeFront() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPolygonModeFront);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPolygonModeFront, 0, 0);
+            return m_polygonModeFront;
+        }
+        Float GetPolygonOffsetFactor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPolygonOffsetFactor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPolygonOffsetFactor, 0, 0);
+            return m_polygonOffsetFactor;
+        }
+        Float GetPolygonOffsetUnits() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPolygonOffsetUnits);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPolygonOffsetUnits, 0, 0);
+            return m_polygonOffsetUnits;
+        }
+        Uint32 GetPrimitiveRestartIndex() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPrimitiveRestartIndex);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPrimitiveRestartIndex, 0, 0);
+            return m_primitiveRestartIndex;
+        }
+        ProvokingVertexMode GetProvokingVertexMode() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetProvokingVertexMode);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetProvokingVertexMode, 0, 0);
+            return m_provokingVertexMode;
+        }
+        const RenderStateParameters& GetRenderStateParameters() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetRenderStateParameters);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetRenderStateParameters, 0, 0);
+            return m_renderState;
+        }
+        Uint64 GetSamplingResolutionGeneration() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetSamplingResolutionGeneration);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetSamplingResolutionGeneration, 0, 0);
+            return m_samplingResolutionGeneration;
+        }
+        const IntVec4& GetScissorBox() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetScissorBox);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetScissorBox, 0, 0);
+            return m_scissorBox;
+        }
+        const StencilFaceState& GetStencilState(StencilFace face) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetStencilState);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetStencilState, static_cast<Uint>(face), 0);
+            return m_stencil[face == StencilFace::Back ? 1 : 0];
+        }
+        Uint64 GetTextureBindGeneration() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTextureBindGeneration);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTextureBindGeneration, 0, 0);
+            return m_textureBindGeneration;
+        }
+        Uint64 GetTextureContextId() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTextureContextId);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTextureContextId, 0, 0);
+            return m_textureContextId;
+        }
+        Uint64 GetTransformFeedbackCapturedVertices() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackCapturedVertices);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackCapturedVertices, 0, 0);
+            return m_transformFeedbackCapturedVertices;
+        }
+        Uint64 GetTransformFeedbackGeneration() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackGeneration);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackGeneration, 0, 0);
+            return m_transformFeedbackGeneration;
+        }
+        Uint64 GetTransformFeedbackPausedPrimitiveCounter() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackPausedPrimitiveCounter);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackPausedPrimitiveCounter, 0, 0);
+            return m_transformFeedbackPausedPrimitiveCounter;
+        }
+        Uint64 GetBoundTransformFeedbackLifetimeId() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBoundTransformFeedbackLifetimeId);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBoundTransformFeedbackLifetimeId, 0, 0);
+            return m_boundTransformFeedbackLifetimeId;
+        }
+        IntVec4 GetViewport() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetViewport);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetViewport, 0, 0);
+            return m_viewport;
+        }
+        const FloatVec4& GetViewportIndexed(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetViewportIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetViewportIndexed, index, 0);
+            if (index >= kMaxViewports) {
+                MOBILEGL_ASSERT(false, "Viewport index out of range: %u", index);
+                return m_viewportIndexed[0];
+            }
+            return m_viewportIndexed[index];
+        }
+        Bool IsCapabilityEnabled(CapabilityInput cap) const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsCapabilityEnabled);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsCapabilityEnabled, static_cast<Uint>(cap), 0);
+            const auto index = static_cast<SizeT>(cap);
+            return index < kCapabilityCount ? m_capability[index] : false;
+        }
+        // Blend and ScissorTest are the only indexed capabilities GLContext keeps; no backend
+        // asks for another (VulkanRenderer asks Blend). Any other cap is a read the fill cannot
+        // have served: Fatal{UnmigratedPipeInput} naming the field and the verb, the cap in a
+        // preceding MGLOG_E.
+        Bool IsCapabilityEnabledIndexed(CapabilityInput cap, Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsCapabilityEnabledIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsCapabilityEnabledIndexed, static_cast<Uint>(cap), index);
+            if (cap == CapabilityInput::Blend) {
+                return index < kMGMaxDrawBuffers ? m_capabilityIndexed.Blend[index] : false;
+            }
+            if (cap == CapabilityInput::ScissorTest) {
+                return index < kMaxViewports ? m_capabilityIndexed.ScissorTest[index] : false;
+            }
+            MGLOG_E("PipeInputs::IsCapabilityEnabledIndexed: no indexed storage for cap=%d (index=%u)",
+                    static_cast<int>(cap), index);
+            MGPipeInputPoisonFatalForVerb(MGPipeInputField::IsCapabilityEnabledIndexed, m_currentVerb);
+        }
+        Bool IsTransformFeedbackActive() const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsTransformFeedbackActive);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsTransformFeedbackActive, 0, 0);
+            return m_transformFeedbackActive;
+        }
+        Bool IsTransformFeedbackPaused() const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsTransformFeedbackPaused);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsTransformFeedbackPaused, 0, 0);
+            return m_transformFeedbackPaused;
+        }
+
+        // ---- O: object references ----
+        const SharedPtr<VertexArrayObject>& GetBoundVertexArray() {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBoundVertexArray);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBoundVertexArray, 0, 0);
+            return m_boundVertexArray;
+        }
+        // A target the fill left null (one outside GlobalBufferTargets / BufferBindPointTargets,
+        // or a read before any fill) is a read the fill cannot have served: the poison Fatal,
+        // the target in a preceding MGLOG_E.
+        BindingSlot<BufferObject>& GetBufferBindingSlot(BufferTarget target) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBufferBindingSlot);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBufferBindingSlot, static_cast<Uint>(target), 0);
+            const auto index = static_cast<SizeT>(target);
+            if (index >= kBufferTargetCount || m_bufferBindingSlot[index] == nullptr) {
+                MGLOG_E("PipeInputs::GetBufferBindingSlot: no slot for target=%d", static_cast<int>(target));
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetBufferBindingSlot, m_currentVerb);
+            }
+            return *m_bufferBindingSlot[index];
+        }
+        BindingSlotRange1D<BufferObject>& GetBufferBindingPoint(BufferTarget target, Uint index) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBufferBindingPoint);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBufferBindingPoint, static_cast<Uint>(target), index);
+            const auto targetIndex = static_cast<SizeT>(target);
+            if (targetIndex >= kBufferTargetCount || m_bufferBindingPointBase[targetIndex] == nullptr) {
+                MGLOG_E("PipeInputs::GetBufferBindingPoint: no binding points for target=%d (index=%u)",
+                        static_cast<int>(target), index);
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetBufferBindingPoint, m_currentVerb);
+            }
+            // The live storage is Array<Array<BindingSlotRange1D, BufferBindingPointCount>, N>
+            // (BufferState.h), so base[index] is the live slot GLContext would hand out.
+            return m_bufferBindingPointBase[targetIndex][index];
+        }
+        BindingSlot<FramebufferObject>& GetFramebufferBindingSlot(FramebufferTarget target) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetFramebufferBindingSlot);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetFramebufferBindingSlot, static_cast<Uint>(target), 0);
+            const auto index = static_cast<SizeT>(target);
+            if (index >= kFramebufferTargetCount || m_framebufferBindingSlot[index] == nullptr) {
+                MGLOG_E("PipeInputs::GetFramebufferBindingSlot: no slot for target=%d", static_cast<int>(target));
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetFramebufferBindingSlot, m_currentVerb);
+            }
+            return *m_framebufferBindingSlot[index];
+        }
+        ImageTextureBinding& GetImageTextureBinding(Int unit) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetImageTextureBinding);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetImageTextureBinding, static_cast<Uint>(unit), 0);
+            if (m_imageTextureBindingBase == nullptr) {
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetImageTextureBinding, m_currentVerb);
+            }
+            return m_imageTextureBindingBase[unit];
+        }
+        const ImageTextureBinding& GetImageTextureBinding(Int unit) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetImageTextureBinding);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetImageTextureBinding, static_cast<Uint>(unit), 0);
+            if (m_imageTextureBindingBase == nullptr) {
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetImageTextureBinding, m_currentVerb);
+            }
+            return m_imageTextureBindingBase[unit];
+        }
+        const SharedPtr<ProgramObject>& GetProgramForDispatch() {
+            MGP_INPUT_CHECK(MGPipeInputField::GetProgramForDispatch);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetProgramForDispatch, 0, 0);
+            return m_programForDispatch;
+        }
+        const SharedPtr<ProgramObject>& GetProgramForDraw() {
+            MGP_INPUT_CHECK(MGPipeInputField::GetProgramForDraw);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetProgramForDraw, 0, 0);
+            return m_programForDraw;
+        }
+        const SharedPtr<ProgramObject>& GetTransformFeedbackProgram() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackProgram);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackProgram, 0, 0);
+            return m_transformFeedbackProgram;
+        }
+        TextureUnit& GetTextureUnitObject(Int unit) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTextureUnitObject);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTextureUnitObject, static_cast<Uint>(unit), 0);
+            if (m_textureUnitBase == nullptr) {
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetTextureUnitObject, m_currentVerb);
+            }
+            return m_textureUnitBase[unit];
+        }
+
+        // ---- F: forwarded to the live context (MG_Impl/Pipe/PipeFill.cpp); sticky ----
+        // Each takes an argument that is not verb state - a GL name, a lifetime id, a target -
+        // i.e. it is a lookup or a reverse-channel write, not a state read; there is no value
+        // the filler could copy and no verb whose fill could make it stale. Phase C replaces
+        // them with handle tables and callbacks.
+        // They carry no MGP_INPUT_CHECK / MGP_INPUT_VERIFY_READ (the declared exception to
+        // P1 brief D4's "every accessor body"): a forward is a live call, not a stored value,
+        // and InvalidateCompileEnv is reached from backend initialisation before any verb has
+        // filled, where a check would be Fatal{...@<none>} on every start. Their sticky stamp
+        // is therefore consulted by no accessor; the tests pin it through
+        // MGPipeInputFieldIsFresh directly.
+        SizeT GetBufferBindingPointCount(BufferTarget target) const;
+        const SharedPtr<ProgramObject>& GetProgramObject(Uint index);
+        const SharedPtr<ITextureObject>& GetTextureObject(Uint index);
+        Bool HasOpenTransformFeedbackSpan(Uint64 lifetimeId) const;
+        void InvalidateCompileEnv();
+        Bool ValidateProgramName(Uint index) const;
+        // Dropped with an MGLOG_E_ONCE when no context is live; today's guarded sites never
+        // reach it without one.
+        void RecordError(ErrorCode code, UniquePtr<ErrorInfo> info);
+
+        // ---- the storage visitor ----
+        // Calls fn(a.<member>, b.<member>) for the field's storage and returns its result; returns
+        // false without calling fn for a forwarded field, which has none. The comparator's
+        // per-field equality and the verify corruption injector are both one call of this.
+        template <class Fn>
+        static Bool VisitStorage(MGPipeInputField field, PipeInputs& a, PipeInputs& b, Fn&& fn) {
+            switch (field) {
+#define MGP_INPUT_VISIT(Field, Member)                                                                                 \
+    case MGPipeInputField::Field:                                                                                      \
+        return fn(a.Member, b.Member);
+                MGP_INPUT_STORAGE_LIST(MGP_INPUT_VISIT)
+#undef MGP_INPUT_VISIT
+            default:
+                return false;
+            }
+        }
+        template <class Fn>
+        static Bool VisitStorage(MGPipeInputField field, const PipeInputs& a, const PipeInputs& b, Fn&& fn) {
+            switch (field) {
+#define MGP_INPUT_VISIT(Field, Member)                                                                                 \
+    case MGPipeInputField::Field:                                                                                      \
+        return fn(a.Member, b.Member);
+                MGP_INPUT_STORAGE_LIST(MGP_INPUT_VISIT)
+#undef MGP_INPUT_VISIT
+            default:
+                return false;
+            }
+        }
+
+    private:
+        // The one door into the storage from the client side (MG_Impl/Pipe/PipeFill.cpp):
+        // the filler's per-field copies and stamps, and the verify snapshot.
+        friend struct MGPipeFillAccess;
+
+        // ---- identity ----
+        const void* m_contextIdentity = nullptr;
+        Bool m_live = false;
+        MGPipeVerb m_currentVerb = MGPipeVerb::kVerbCount;
+#if MOBILEGL_PIPE_POISON
+        MGPipeFilledState m_filled{};
+#endif
+
+        // ---- V ----
+        Int m_activeTextureUnit = 0;
+        FloatVec4 m_blendColor{};
+        BlendEquation m_blendEquation[kMGMaxDrawBuffers][2]{};
+        BlendFactor m_blendFunc[kMGMaxDrawBuffers][4]{};
+        Uint m_boundTransformFeedbackName = 0;
+        SizeT m_touchedBindingPointCount[kBufferTargetCount]{};
+        GLenum m_clampReadColor = 0;
+        FloatVec4 m_clearColor{};
+        Float m_clearDepth = 0.f;
+        Uint32 m_clearStencil = 0;
+        BoolVec4 m_colorMask[kMGMaxDrawBuffers]{};
+        CullFaceMode m_cullFaceMode{};
+        CurrentVertexAttributeValue m_currentVertexAttribute[kMaxVertexAttribs]{};
+        DepthTestFunc m_depthFunc{};
+        Bool m_depthMask = false;
+        FloatVec2 m_depthRange[kMaxViewports]{};
+        Float m_lineWidth = 0.f;
+        LogicOperation m_logicOp{};
+        Int m_maxTouchedTextureUnit = -1;
+        Float m_minSampleShadingValue = 0.f;
+        FloatVec2 m_patchDefaultInnerLevel{};
+        FloatVec4 m_patchDefaultOuterLevel{};
+        Uint m_patchVertices = 0;
+        Uint m_pipelineStateVersion = 0;
+        Uint m_renderStateParametersVersion = 0;
+        PixelStoreParameters m_pixelStore[2]{}; // [0] = pack, [1] = unpack
+        GLenum m_polygonModeFront = 0;
+        Float m_polygonOffsetFactor = 0.f;
+        Float m_polygonOffsetUnits = 0.f;
+        Uint32 m_primitiveRestartIndex = 0;
+        ProvokingVertexMode m_provokingVertexMode{};
+        RenderStateParameters m_renderState{};
+        Uint64 m_samplingResolutionGeneration = 0;
+        Uint64 m_textureBindGeneration = 0;
+        Uint64 m_textureContextId = 0;
+        IntVec4 m_scissorBox{};
+        StencilFaceState m_stencil[kStencilFaceCount]{};
+        Uint64 m_transformFeedbackCapturedVertices = 0;
+        Uint64 m_transformFeedbackGeneration = 0;
+        Uint64 m_transformFeedbackPausedPrimitiveCounter = 0;
+        Uint64 m_boundTransformFeedbackLifetimeId = 0;
+        IntVec4 m_viewport{};
+        FloatVec4 m_viewportIndexed[kMaxViewports]{};
+        Bool m_capability[kCapabilityCount]{};
+        IndexedCapabilities m_capabilityIndexed{};
+        Bool m_transformFeedbackActive = false;
+        Bool m_transformFeedbackPaused = false;
+
+        // ---- O ----
+        SharedPtr<VertexArrayObject> m_boundVertexArray;
+        BindingSlot<BufferObject>* m_bufferBindingSlot[kBufferTargetCount]{};
+        BindingSlotRange1D<BufferObject>* m_bufferBindingPointBase[kBufferTargetCount]{};
+        BindingSlot<FramebufferObject>* m_framebufferBindingSlot[kFramebufferTargetCount]{};
+        ImageTextureBinding* m_imageTextureBindingBase = nullptr;
+        SharedPtr<ProgramObject> m_programForDispatch;
+        SharedPtr<ProgramObject> m_programForDraw;
+        SharedPtr<ProgramObject> m_transformFeedbackProgram;
+        TextureUnit* m_textureUnitBase = nullptr;
+    };
+
+    // The single global the backends read through MGB_CTX (ARCHITECTURE.md 9.2). An inline
+    // variable: no .cpp is needed for the definition.
+    inline PipeInputs gPipeInputs{};
+
+    // Every field has storage or is forwarded, and nothing else.
+#define MGP_INPUT_COUNT_ONE(Field, Member) +1
+    static_assert(0 MGP_INPUT_STORAGE_LIST(MGP_INPUT_COUNT_ONE) + kMGPipeForwardedFieldCount == kMGPipeInputFieldCount,
+                  "MGP_INPUT_STORAGE_LIST plus the seven forwarded fields is not the PipeInputs field set");
+#undef MGP_INPUT_COUNT_ONE
+    // The docs budget ~20 KB; the block is a few KB.
+    static_assert(sizeof(PipeInputs) < 20 * 1024, "PipeInputs outgrew its budget");
+
+#if MOBILEGL_PIPE_VERIFY
+    // PipeInputs.cpp. Per-field equality for the entry compare (P1 brief D8): V by value
+    // through G4's MGPipeFieldEqual (bitwise floats, field-wise structs), O by identity, F
+    // always equal (no storage).
+    Bool MGPipeInputsFieldEqual(MGPipeInputField field, const PipeInputs& a, const PipeInputs& b);
+    // PipeInputs.cpp. The entry compare: every field in `mask` of the pushed block against the
+    // snapshot, first differing field out. Exported from the shared library on purpose - the
+    // retrace-verify CI job proves it swapped in a verify build by finding this symbol with
+    // nm -D, so a "green" run against a library without the comparator cannot happen.
+#if defined(__GNUC__) || defined(__clang__)
+    __attribute__((visibility("default")))
+#endif
+    Bool MGPipeVerifyInputs(const PipeInputs& pushed, const PipeInputs& snapshot, const MGPipeFieldMask& mask,
+                            MGPipeInputField* outField);
+    // PipeInputs.cpp. Negative control A: perturbs one field's storage (flip a Bool, +1 a
+    // scalar, ^0x5A the first byte of a struct, flip a pointer's low bits - never
+    // dereferenced, the snapshot is only ever compared). Returns false for a forwarded field,
+    // which has nothing to corrupt.
+    Bool MGPipeApplyVerifyCorruption(PipeInputs& snapshot, MGPipeInputField field);
+#endif
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.cpp

@@ -11,6 +11,7 @@
 #include <MG_State/GLState/Core.h>
 #include <MG_State/EGLState/Core.h>
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 #include "../Getter/GL_Getter.h"
 
 namespace MobileGL::MG_Impl::GLImpl {
@@ -527,6 +528,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(Clear);
         MG_Backend::gBackendFunctionsTable.GL.Clear(mask);
     }
 
@@ -535,6 +537,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElements);
         MG_Backend::gBackendFunctionsTable.GL.DrawElements(mode, count, type, indices);
     }
 
@@ -544,6 +547,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElements);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElements(mode, count, type, indices, drawcount);
     }
 
@@ -553,6 +557,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElementsBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsBaseVertex(mode, count, type, indices, drawcount,
                                                                           basevertex);
     }
@@ -562,6 +567,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArrays);
         MG_Backend::gBackendFunctionsTable.GL.DrawArrays(mode, first, count);
     }
 
@@ -570,6 +576,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawArrays);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArrays(mode, first, count, drawcount);
     }
 
@@ -579,6 +586,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsBaseVertex(mode, count, type, indices, basevertex);
     }
 
@@ -588,6 +596,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElementsIndirect);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirect(mode, type, indirect, drawcount, stride);
     }
 
@@ -596,6 +605,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawArraysIndirect);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirect(mode, indirect, drawcount, stride);
     }
 
@@ -605,6 +615,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElementsIndirectCount);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirectCount(mode, type, indirect, drawcount,
                                                                              maxdrawcount, stride);
     }
@@ -615,6 +626,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawArraysIndirectCount);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirectCount(mode, indirect, drawcount, maxdrawcount,
                                                                            stride);
     }
@@ -625,6 +637,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawRangeElementsBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.DrawRangeElementsBaseVertex(mode, start, end, count, type, indices,
                                                                           basevertex);
     }
@@ -635,6 +648,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawRangeElements);
         MG_Backend::gBackendFunctionsTable.GL.DrawRangeElements(mode, start, end, count, type, indices);
     }
 
@@ -645,6 +659,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsInstancedBaseVertexBaseInstance);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseVertexBaseInstance(
             mode, count, type, indices, instancecount, basevertex, baseinstance);
     }
@@ -655,6 +670,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsInstancedBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseVertex(mode, count, type, indices, instancecount,
                                                                               basevertex);
     }
@@ -665,6 +681,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsInstancedBaseInstance);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseInstance(mode, count, type, indices,
                                                                                 instancecount, baseinstance);
     }
@@ -675,6 +692,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsInstanced);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstanced(mode, count, type, indices, instancecount);
     }
 
@@ -683,6 +701,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsIndirect);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsIndirect(mode, type, indirect);
     }
     void DrawArraysInstancedBaseInstance_Backend(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
@@ -691,6 +710,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArraysInstancedBaseInstance);
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysInstancedBaseInstance(mode, first, count, instancecount,
                                                                               baseinstance);
     }
@@ -700,6 +720,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArraysInstanced);
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysInstanced(mode, first, count, instancecount);
     }
 
@@ -708,6 +729,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArraysIndirect);
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysIndirect(mode, indirect);
     }
 
@@ -739,6 +761,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         // GL 4.3 added both dispatches to the conditional-render set (GL 4.6 core 10.9), which is
         // exactly what KHR-GL43.compute_shader.conditional-dispatching checks.
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DispatchCompute);
         dispatchCompute(numGroupsX, numGroupsY, numGroupsZ);
     }
 
@@ -791,6 +814,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         if (!ValidateCurrentProgramForCompute(__func__)) return;
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DispatchComputeIndirect);
         dispatchComputeIndirect(indirect);
     }
 
@@ -812,6 +836,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->SetPatchVertices(static_cast<Uint>(value));
         if (const auto patchParameteri = MG_Backend::gBackendFunctionsTable.GL.PatchParameteri) {
+            MGP_FILL(PatchParameteri);
             patchParameteri(pname, value);
         }
     }
@@ -882,6 +907,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Backend does not support memory barriers."));
             return;
         }
+        MGP_FILL(MemoryBarrier);
         memoryBarrier(barriers);
     }
 
@@ -903,6 +929,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Backend does not support memory barriers."));
             return;
         }
+        MGP_FILL(MemoryBarrier);
         memoryBarrier(GL_TEXTURE_FETCH_BARRIER_BIT | GL_FRAMEBUFFER_BARRIER_BIT);
     }
 
@@ -916,6 +943,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support regional memory barriers."));
             return;
         }
+        MGP_FILL(MemoryBarrierByRegion);
         memoryBarrierByRegion(barriers);
     }
 
@@ -1238,6 +1266,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->BeginTransformFeedback(primitiveMode, program);
         if (const auto beginXfb = MG_Backend::gBackendFunctionsTable.GL.BeginTransformFeedback) {
+            MGP_FILL(BeginTransformFeedback);
             beginXfb(primitiveMode);
         }
     }
@@ -1320,6 +1349,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         // Closed while the capture state is still active: a backend that captures
         // through its own driver reads the capture program and buffer bindings here.
         if (const auto endXfb = MG_Backend::gBackendFunctionsTable.GL.EndTransformFeedback) {
+            MGP_FILL(EndTransformFeedback);
             endXfb();
         }
         MG_State::pGLContext->EndTransformFeedback();
@@ -1328,9 +1358,12 @@ namespace MobileGL::MG_Impl::GLImpl {
         // the GPU work is all that is required.
         auto& backendGL = MG_Backend::gBackendFunctionsTable.GL;
         if (backendGL.FenceSync && backendGL.ClientWaitSync) {
+            MGP_FILL(FenceSync);
             if (auto sync = backendGL.FenceSync()) {
+                MGP_FILL(ClientWaitSync);
                 backendGL.ClientWaitSync(sync, GL_SYNC_FLUSH_COMMANDS_BIT, ~0ull);
                 if (backendGL.DeleteSync) {
+                    MGP_FILL(DeleteSync);
                     backendGL.DeleteSync(sync);
                 }
             }
@@ -1349,6 +1382,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->SetTransformFeedbackPaused(true);
         if (const auto pauseXfb = MG_Backend::gBackendFunctionsTable.GL.PauseTransformFeedback) {
+            MGP_FILL(PauseTransformFeedback);
             pauseXfb();
         }
     }
@@ -1363,6 +1397,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->SetTransformFeedbackPaused(false);
         if (const auto resumeXfb = MG_Backend::gBackendFunctionsTable.GL.ResumeTransformFeedback) {
+            MGP_FILL(ResumeTransformFeedback);
             resumeXfb();
         }
     }
@@ -1568,6 +1603,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 continue;
             }
             if (const auto deleteXfb = MG_Backend::gBackendFunctionsTable.GL.DeleteTransformFeedback) {
+                MGP_FILL(DeleteTransformFeedback);
                 deleteXfb(id);
             }
             MG_State::pGLContext->MarkTransformFeedbackObjectForDeletion(id);
@@ -1599,6 +1635,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->BindTransformFeedbackObject(id);
         if (const auto bindXfb = MG_Backend::gBackendFunctionsTable.GL.BindTransformFeedback) {
+            MGP_FILL(BindTransformFeedback);
             bindXfb(id);
         }
     }

MobileGL/MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.cpp

@@ -15,6 +15,7 @@
 #include <MG_Impl/GLImpl/Texture/Validators.h>
 #include <MG_Impl/GLImpl/Getter/GL_Getter.h>
 #include <MG_State/GLState/ErrorState/Error.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToMG/TextureEnumConverter.h>
@@ -616,6 +617,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void BlitFramebuffer_Backend(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0,
                                  GLint dstX1, GLint dstY1, GLbitfield mask, GLenum filter) {
+        MGP_FILL(BlitFramebuffer);
         MG_Backend::gBackendFunctionsTable.GL.BlitFramebuffer(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1,
                                                               mask, filter);
     }
@@ -629,6 +631,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glBlitNamedFramebuffer skipped: backend does not implement explicit framebuffer blit.");
             return;
         }
+        MGP_FILL(BlitNamedFramebuffer);
         blitNamedFramebuffer(readFramebuffer, drawFramebuffer, srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1,
                              dstY1, mask, filter);
     }
@@ -640,6 +643,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferfv skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+        MGP_FILL(ClearNamedFramebufferfv);
         clearNamedFramebufferfv(framebuffer, buffer, drawbuffer, value);
     }
 
@@ -650,6 +654,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferfi skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+        MGP_FILL(ClearNamedFramebufferfi);
         clearNamedFramebufferfi(framebuffer, buffer, drawbuffer, depth, stencil);
     }
 
@@ -660,6 +665,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferiv skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+        MGP_FILL(ClearNamedFramebufferiv);
         clearNamedFramebufferiv(framebuffer, buffer, drawbuffer, value);
     }
 
@@ -670,6 +676,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferuiv skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+        MGP_FILL(ClearNamedFramebufferuiv);
         clearNamedFramebufferuiv(framebuffer, buffer, drawbuffer, value);
     }
 
@@ -2729,24 +2736,28 @@ namespace MobileGL::MG_Impl::GLImpl {
     void ClearBufferfi_Backend(GLenum buffer, GLint drawbuffer, GLfloat depth, GLint stencil) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferfi);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferfi(buffer, drawbuffer, depth, stencil);
     }
 
     void ClearBufferfv_Backend(GLenum buffer, GLint drawbuffer, const GLfloat* value) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferfv);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferfv(buffer, drawbuffer, value);
     }
 
     void ClearBufferuiv_Backend(GLenum buffer, GLint drawbuffer, const GLuint* value) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferuiv);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferuiv(buffer, drawbuffer, value);
     }
 
     void ClearBufferiv_Backend(GLenum buffer, GLint drawbuffer, const GLint* value) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferiv);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferiv(buffer, drawbuffer, value);
     }
 
@@ -2994,6 +3005,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void ReadPixels_Backend(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels) {
+        MGP_FILL(ReadPixels);
         MG_Backend::gBackendFunctionsTable.GL.ReadPixels(x, y, width, height, format, type, pixels);
     }
 

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.cpp

@@ -30,6 +30,7 @@
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     // Declared rather than #included from GL_RenderState.h on purpose: that header also declares
@@ -1173,6 +1174,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 : GetMinComputeWorkGroupSize(index);
             GLint backendValue = 0;
             if (getIntegeri) {
+                MGP_FILL(GetIntegeri_v);
                 getIntegeri(target, index, &backendValue);
             }
             *data = std::max(backendValue, minimum);
@@ -1353,6 +1355,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             Int64 timestamp = 0;
             if (!MG_Config::Features.DisableTimerQuery) {
                 if (const auto getGpuTimestampNs = MG_Backend::gBackendFunctionsTable.GL.GetGpuTimestampNs) {
+                    MGP_FILL(GetGpuTimestampNs);
                     timestamp = getGpuTimestampNs();
                 }
             }
@@ -2263,6 +2266,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             Int64 timestamp = 0;
             if (!MG_Config::Features.DisableTimerQuery) {
                 if (const auto getGpuTimestampNs = MG_Backend::gBackendFunctionsTable.GL.GetGpuTimestampNs) {
+                    MGP_FILL(GetGpuTimestampNs);
                     timestamp = getGpuTimestampNs();
                 }
             }

MobileGL/MG_Impl/GLImpl/Program/GL_Program.cpp

@@ -21,6 +21,7 @@
 #include <MG_Util/Converters/SPIRVCrossToGL/SpvcTypeConverter.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     // The flattened uniform type these helpers used to take as a raw glslang::TType*
@@ -3398,6 +3399,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support shader storage block binding."));
             return;
         }
+        MGP_FILL(ShaderStorageBlockBinding);
         shaderStorageBlockBinding(program, blockName.c_str(), storageBlockBinding);
     }
 

MobileGL/MG_Impl/GLImpl/Query/GL_Query.cpp

@@ -12,6 +12,7 @@
 #include <MG_Backend/BackendObjects.h>
 #include <MG_State/GLState/Core.h>
 #include <MG_State/GLState/ErrorState/ErrorInfo.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -164,6 +165,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         void ResetQueryObjectLocked(QueryObject* queryObject) {
             if (queryObject->backendHandle) {
                 if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                    MGP_FILL(DeleteBackendQuery);
                     deleteBackendQuery(queryObject->backendHandle);
                 }
                 queryObject->backendHandle = nullptr;
@@ -178,6 +180,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         void EndTimeElapsedQueryLocked(QueryObject* queryObject) {
             const auto endTimeElapsedQuery = MG_Backend::gBackendFunctionsTable.GL.EndTimeElapsedQuery;
             if (endTimeElapsedQuery && queryObject->backendHandle) {
+                MGP_FILL(EndTimeElapsedQuery);
                 endTimeElapsedQuery(queryObject->backendHandle);
             }
             queryObject->active = false;
@@ -257,6 +260,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 }
                 Uint64 result = 0;
                 const auto getQueryResult64 = MG_Backend::gBackendFunctionsTable.GL.GetQueryResult64;
+                MGP_FILL(GetQueryResult64);
                 if (queryObject->backendHandle && getQueryResult64 &&
                     !getQueryResult64(queryObject->backendHandle, /*wait=*/false, &result)) {
                     // Not ready. The whole point of the no-wait form is that the caller's
@@ -271,6 +275,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 }
                 if (queryObject->backendHandle) {
                     if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        MGP_FILL(DeleteBackendQuery);
                         deleteBackendQuery(queryObject->backendHandle);
                     }
                     queryObject->backendHandle = nullptr;
@@ -286,6 +291,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                     return true;
                 }
                 const auto isQueryResultAvailable = MG_Backend::gBackendFunctionsTable.GL.IsQueryResultAvailable;
+                MGP_FILL(IsQueryResultAvailable);
                 outValue = (!isQueryResultAvailable || isQueryResultAvailable(queryObject->backendHandle)) ? 1 : 0;
                 return true;
             }
@@ -297,6 +303,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 Uint64 result = 0;
                 if (queryObject->backendHandle) {
                     const auto getQueryResult64 = MG_Backend::gBackendFunctionsTable.GL.GetQueryResult64;
+                    MGP_FILL(GetQueryResult64);
                     if (getQueryResult64 &&
                         !getQueryResult64(queryObject->backendHandle, /*wait=*/true, &result)) {
                         // The backend could not produce the result YET (e.g. a
@@ -317,6 +324,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                     // query degrades to a zero result); the backend handle is
                     // consumed and the value cached for later reads.
                     if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        MGP_FILL(DeleteBackendQuery);
                         deleteBackendQuery(queryObject->backendHandle);
                     }
                     queryObject->backendHandle = nullptr;
@@ -422,6 +430,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                     queryObject->target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) {
                     if (const auto endOcclusionQuery = MG_Backend::gBackendFunctionsTable.GL.EndOcclusionQuery;
                         endOcclusionQuery && queryObject->backendHandle) {
+                        MGP_FILL(EndOcclusionQuery);
                         endOcclusionQuery(queryObject->backendHandle);
                     }
                     queryObject->active = false;
@@ -441,6 +450,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             if (queryObject->backendHandle) {
                 if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                    MGP_FILL(DeleteBackendQuery);
                     deleteBackendQuery(queryObject->backendHandle);
                 }
                 queryObject->backendHandle = nullptr;
@@ -519,6 +529,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             // Prefer real GPU transform-feedback queries (exact with geometry shaders);
             // the CPU accounting delta stays as the fallback when the backend lacks them.
             const auto beginXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.BeginXfbPrimitivesQuery;
+            MGP_FILL(BeginXfbPrimitivesQuery);
             queryObject->backendHandle =
                 beginXfbPrimitivesQuery ? beginXfbPrimitivesQuery(target == GL_PRIMITIVES_GENERATED) : nullptr;
             queryObject->counterSnapshot = TransformFeedbackCounterForTarget(target);
@@ -527,9 +538,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             queryObject->geometryCaptureDrawSnapshot =
                 MG_State::pGLContext->GetTransformFeedbackGeometryCaptureDraws();
         } else if (isOcclusionQuery) {
+            MGP_FILL(BeginOcclusionQuery);
             queryObject->backendHandle = MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery();
         } else {
             const auto beginTimeElapsedQuery = MG_Backend::gBackendFunctionsTable.GL.BeginTimeElapsedQuery;
+            MGP_FILL(BeginTimeElapsedQuery);
             queryObject->backendHandle =
                 (!TimerQueryDisabled() && beginTimeElapsedQuery) ? beginTimeElapsedQuery() : nullptr;
         }
@@ -579,6 +592,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (isTransformFeedbackQuery) {
             if (queryObject->backendHandle) {
                 if (const auto endXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.EndXfbPrimitivesQuery) {
+                    MGP_FILL(EndXfbPrimitivesQuery);
                     endXfbPrimitivesQuery(queryObject->backendHandle);
                 }
             }
@@ -588,6 +602,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             if (!queryObject->backendHandle || PrefersCpuTransformFeedbackResult(queryObject)) {
                 if (queryObject->backendHandle) {
                     if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        MGP_FILL(DeleteBackendQuery);
                         deleteBackendQuery(queryObject->backendHandle);
                     }
                     queryObject->backendHandle = nullptr;
@@ -604,6 +619,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (isOcclusionQuery) {
             if (const auto endOcclusionQuery = MG_Backend::gBackendFunctionsTable.GL.EndOcclusionQuery;
                 endOcclusionQuery && queryObject->backendHandle) {
+                MGP_FILL(EndOcclusionQuery);
                 endOcclusionQuery(queryObject->backendHandle);
             }
             queryObject->active = false;
@@ -642,6 +658,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ResetQueryObjectLocked(queryObject); // discard any previous result
         queryObject->target = target;
         const auto queryCounterTimestamp = MG_Backend::gBackendFunctionsTable.GL.QueryCounterTimestamp;
+        MGP_FILL(QueryCounterTimestamp);
         queryObject->backendHandle =
             (!TimerQueryDisabled() && queryCounterTimestamp) ? queryCounterTimestamp() : nullptr;
         queryObject->ended = true;
@@ -771,6 +788,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             const Bool timerTarget = target == GL_TIME_ELAPSED || target == GL_TIMESTAMP;
             const auto isTimerQuerySupported = MG_Backend::gBackendFunctionsTable.GL.IsTimerQuerySupported;
+            MGP_FILL(IsTimerQuerySupported);
             const Bool supported =
                 timerTarget && !TimerQueryDisabled() && isTimerQuerySupported && isTimerQuerySupported();
             *params = supported ? 64 : 0;
@@ -912,6 +930,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery;
         for (const auto& [_, queryObject] : orphans) {
             if (deleteBackendQuery && queryObject->backendHandle) {
+                MGP_FILL(DeleteBackendQuery);
                 deleteBackendQuery(queryObject->backendHandle);
             }
             delete queryObject;

MobileGL/MG_Impl/GLImpl/Sync/GL_Sync.cpp

@@ -9,6 +9,7 @@
 #include "GL_Sync.h"
 #include <MG_Backend/BackendObjects.h>
 #include <MG_State/GLState/Core.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -56,6 +57,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         syncObject->condition = condition;
         syncObject->flags = flags;
         if (const auto backendFenceSync = MG_Backend::gBackendFunctionsTable.GL.FenceSync) {
+            MGP_FILL(FenceSync);
             syncObject->backendHandle = backendFenceSync();
         }
         const GLsync handle = reinterpret_cast<GLsync>(syncObject);
@@ -94,6 +96,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!backendClientWaitSync || !syncObject->backendHandle) {
             return GL_ALREADY_SIGNALED; // legacy always-signaled fallback
         }
+        MGP_FILL(ClientWaitSync);
         return backendClientWaitSync(syncObject->backendHandle, flags, timeout);
     }
 
@@ -119,6 +122,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         const auto backendWaitSync = MG_Backend::gBackendFunctionsTable.GL.WaitSync;
         if (backendWaitSync && syncObject->backendHandle) {
+            MGP_FILL(WaitSync);
             backendWaitSync(syncObject->backendHandle, flags, timeout);
         }
     }
@@ -139,6 +143,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         const auto backendDeleteSync = MG_Backend::gBackendFunctionsTable.GL.DeleteSync;
         if (backendDeleteSync && syncObject->backendHandle) {
+            MGP_FILL(DeleteSync);
             backendDeleteSync(syncObject->backendHandle);
         }
         delete syncObject;
@@ -174,6 +179,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             break;
         case GL_SYNC_STATUS: {
             const auto backendGetSyncStatus = MG_Backend::gBackendFunctionsTable.GL.GetSyncStatus;
+            MGP_FILL(GetSyncStatus);
             const Bool signaled = !backendGetSyncStatus || !syncObject->backendHandle ||
                                   backendGetSyncStatus(syncObject->backendHandle);
             value = signaled ? GL_SIGNALED : GL_UNSIGNALED;
@@ -227,6 +233,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         const auto backendDeleteSync = MG_Backend::gBackendFunctionsTable.GL.DeleteSync;
         for (const auto& [_, syncObject] : orphans) {
             if (backendDeleteSync && syncObject->backendHandle) {
+                MGP_FILL(DeleteSync);
                 backendDeleteSync(syncObject->backendHandle);
             }
             delete syncObject;

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp

@@ -30,6 +30,7 @@
 #include <MG_Impl/GLImpl/Sampler/Validators.h>
 #include <MG_Util/Math/FixedPointConversion.h>
 #include <MG_State/GLState/TextureState/TextureObjectBuffer.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     static SharedPtr<MG_State::GLState::ITextureObject> nullTextureObject;
@@ -1076,6 +1077,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             Vector<Uint8> scratch(static_cast<SizeT>(width) * static_cast<SizeT>(height) * bytesPerTexel);
             {
                 ScopedNeutralPackState neutralPack;
+                MGP_FILL(ReadPixels);
                 MG_Backend::gBackendFunctionsTable.GL.ReadPixels(x, y, width, height, format, type, scratch.data());
             }
 
@@ -1619,6 +1621,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GenerateMipmap_Backend(GLenum target) {
+        MGP_FILL(GenerateMipmap);
         MG_Backend::gBackendFunctionsTable.GL.GenerateMipmap(target);
     }
 
@@ -4024,6 +4027,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void CopyTexSubImage2D_Backend(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y,
                                    GLsizei width, GLsizei height) {
+        MGP_FILL(CopyTexSubImage2D);
         MG_Backend::gBackendFunctionsTable.GL.CopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     }
 
@@ -4040,6 +4044,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support image-to-image copies."));
             return;
         }
+        MGP_FILL(CopyImageSubData);
         copyImageSubData(src, srcTarget, srcLevel, srcX, srcY, srcZ, dst, dstTarget, dstLevel, dstX,
                          dstY, dstZ, srcWidth, srcHeight, srcDepth);
     }
@@ -4461,6 +4466,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void CopyTexImage2D_Backend(GLenum target, GLint level, GLenum internalformat, GLint x, GLint y, GLsizei width,
                                 GLsizei height, GLint border) {
+        MGP_FILL(CopyTexImage2D);
         MG_Backend::gBackendFunctionsTable.GL.CopyTexImage2D(target, level, internalformat, x, y, width, height,
                                                              border);
     }
@@ -5071,6 +5077,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GetTexImage_Backend(GLenum target, GLint level, GLenum format, GLenum type, GLvoid* pixels) {
+        MGP_FILL(GetTexImage);
         MG_Backend::gBackendFunctionsTable.GL.GetTexImage(target, level, format, type, pixels);
     }
 
@@ -6453,6 +6460,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (MG_Backend::pActiveBackendObject != nullptr &&
             MG_Backend::pActiveBackendObject->GetBackendType() == BackendType::DirectVulkan &&
             MG_Backend::gBackendFunctionsTable.GL.GetTextureImage != nullptr) {
+            MGP_FILL(GetTextureImage);
             MG_Backend::gBackendFunctionsTable.GL.GetTextureImage(textureObject, uploadTarget, level, format, type,
                                                                   bufSize, pixels);
             return;
@@ -6657,6 +6665,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(unit))
             .Bind(textureObject, level, layered, layer, access, format);
         MG_State::pGLContext->NoteTextureUnitTouched(static_cast<Int>(unit));
+        MGP_FILL(BindImageTexture);
         bindImageTexture(unit, texture, level, layered, layer, access, format);
     }
 

MobileGL/MG_Impl/Pipe/PipeFill.cpp

@@ -0,0 +1,614 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/PipeFill.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The client side of the PipeInputs block (ARCHITECTURE.md 9.2 phase A): the only place in
+// the push arm that reads MG_State::pGLContext. Holds the per-verb filler, the F-class
+// forwarders, IsLive, the MOBILEGL_PIPE_POISON_OMIT knob and - in a verify build - the
+// second arm (SnapshotFromGLContext), the entry compare, the compare-at-read hook and the
+// MOBILEGL_PIPE_VERIFY_CORRUPT / _FATAL knobs. Compiled only under MOBILEGL_PIPE_PUSH
+// (CMakeLists.txt appends it to SOURCE_FILES there).
+#include <MG_State/GLState/Core.h>
+#include <MG_State/GLState/BufferState/BufferState.h>
+#include <MG_Backend/MGPipe/PipeInputs.h>
+#include <MG_Impl/Pipe/PipeFill.h>
+#include <MG_Pipe/PipeMutation.h>
+#include <Config.h>
+
+#include <atomic>
+#include <cstdlib>
+#include <cstring>
+
+namespace MobileGL::MG_Pipe {
+    using GLContext = MG_State::GLState::GLContext;
+
+    // The one door into PipeInputs' storage on the client side. A struct rather than a
+    // list of friend functions so the header names exactly one friend.
+    struct MGPipeFillAccess {
+        // Copies ONE field's storage out of the live context by calling the GLContext
+        // accessor of the same name (P1 brief D4: no derivation logic is re-implemented
+        // here, which is what keeps the copy semantically identical by construction).
+        // A forwarded field has no storage and copies nothing.
+        static void CopyField(PipeInputs& dst, GLContext& ctx, MGPipeInputField field) {
+            using F = MGPipeInputField;
+            using MG_State::GLState::BufferBindPointTargets;
+            using MG_State::GLState::GlobalBufferTargets;
+            switch (field) {
+            case F::GetActiveTextureUnit:
+                dst.m_activeTextureUnit = ctx.GetActiveTextureUnit();
+                break;
+            case F::GetBlendColor:
+                dst.m_blendColor = ctx.GetBlendColor();
+                break;
+            case F::GetBlendEquationIndexed:
+                for (Uint i = 0; i < kMGMaxDrawBuffers; ++i) {
+                    ctx.GetBlendEquationIndexed(i, dst.m_blendEquation[i][0], dst.m_blendEquation[i][1]);
+                }
+                break;
+            case F::GetBlendFuncIndexed:
+                for (Uint i = 0; i < kMGMaxDrawBuffers; ++i) {
+                    ctx.GetBlendFuncIndexed(i, dst.m_blendFunc[i][0], dst.m_blendFunc[i][1], dst.m_blendFunc[i][2],
+                                            dst.m_blendFunc[i][3]);
+                }
+                break;
+            case F::GetBoundTransformFeedbackName:
+                dst.m_boundTransformFeedbackName = ctx.GetBoundTransformFeedbackName();
+                break;
+            case F::GetBoundVertexArray:
+                dst.m_boundVertexArray = ctx.GetBoundVertexArray();
+                break;
+            case F::GetBufferBindingSlot:
+                // Every global target has a slot; Index stays null - GLContext resolves it
+                // through the bound VAO's element-buffer slot (Core.cpp), a derivation no
+                // FillPoints.def row can copy - and a read of it is the poison Fatal in the
+                // accessor. No backend reads it today (every slot read is DrawIndirect,
+                // DispatchIndirect, Parameter or PixelPack).
+                for (const auto target : GlobalBufferTargets) {
+                    dst.m_bufferBindingSlot[static_cast<SizeT>(target)] = &ctx.GetBufferBindingSlot(target);
+                }
+                break;
+            case F::GetBufferBindingPoint:
+                // The live storage is Array<Array<BindingSlotRange1D, BufferBindingPointCount>, N>
+                // (BufferState.h), so the address of point 0 is the base of that target's row.
+                for (const auto target : BufferBindPointTargets) {
+                    dst.m_bufferBindingPointBase[static_cast<SizeT>(target)] = &ctx.GetBufferBindingPoint(target, 0);
+                }
+                break;
+            case F::GetTouchedBufferBindingPointCount:
+                for (const auto target : BufferBindPointTargets) {
+                    dst.m_touchedBindingPointCount[static_cast<SizeT>(target)] =
+                        ctx.GetTouchedBufferBindingPointCount(target);
+                }
+                break;
+            case F::GetClampReadColor:
+                dst.m_clampReadColor = ctx.GetClampReadColor();
+                break;
+            case F::GetClearColor:
+                dst.m_clearColor = ctx.GetClearColor();
+                break;
+            case F::GetClearDepth:
+                dst.m_clearDepth = ctx.GetClearDepth();
+                break;
+            case F::GetClearStencil:
+                dst.m_clearStencil = ctx.GetClearStencil();
+                break;
+            case F::GetColorMaskIndexed:
+                for (Uint i = 0; i < kMGMaxDrawBuffers; ++i) {
+                    dst.m_colorMask[i] = ctx.GetColorMaskIndexed(i);
+                }
+                break;
+            case F::GetCullFaceMode:
+                dst.m_cullFaceMode = ctx.GetCullFaceMode();
+                break;
+            case F::GetCurrentVertexAttribute:
+                for (Uint i = 0; i < PipeInputs::kMaxVertexAttribs; ++i) {
+                    dst.m_currentVertexAttribute[i] = ctx.GetCurrentVertexAttribute(i);
+                }
+                break;
+            case F::GetDepthFunc:
+                dst.m_depthFunc = ctx.GetDepthFunc();
+                break;
+            case F::GetDepthMask:
+                dst.m_depthMask = ctx.GetDepthMask();
+                break;
+            case F::GetDepthRangeIndexed:
+                for (Uint i = 0; i < PipeInputs::kMaxViewports; ++i) {
+                    dst.m_depthRange[i] = ctx.GetDepthRangeIndexed(i);
+                }
+                break;
+            case F::GetFramebufferBindingSlot:
+                for (SizeT i = 0; i < PipeInputs::kFramebufferTargetCount; ++i) {
+                    dst.m_framebufferBindingSlot[i] =
+                        &ctx.GetFramebufferBindingSlot(static_cast<PipeInputs::FramebufferTarget>(i));
+                }
+                break;
+            case F::GetImageTextureBinding:
+                // Array<ImageTextureBinding, MAX_TEXTURE_IMAGE_UNITS> (TextureState.h): unit 0's
+                // address is the base.
+                dst.m_imageTextureBindingBase = &ctx.GetImageTextureBinding(0);
+                break;
+            case F::GetLineWidth:
+                dst.m_lineWidth = ctx.GetLineWidth();
+                break;
+            case F::GetLogicOp:
+                dst.m_logicOp = ctx.GetLogicOp();
+                break;
+            case F::GetMaxTouchedTextureUnit:
+                dst.m_maxTouchedTextureUnit = ctx.GetMaxTouchedTextureUnit();
+                break;
+            case F::GetMinSampleShadingValue:
+                dst.m_minSampleShadingValue = ctx.GetMinSampleShadingValue();
+                break;
+            case F::GetPatchDefaultInnerLevel:
+                dst.m_patchDefaultInnerLevel = ctx.GetPatchDefaultInnerLevel();
+                break;
+            case F::GetPatchDefaultOuterLevel:
+                dst.m_patchDefaultOuterLevel = ctx.GetPatchDefaultOuterLevel();
+                break;
+            case F::GetPatchVertices:
+                dst.m_patchVertices = ctx.GetPatchVertices();
+                break;
+            case F::GetPipelineStateVersion:
+                dst.m_pipelineStateVersion = ctx.GetPipelineStateVersion();
+                break;
+            case F::GetPixelStoreParameters:
+                dst.m_pixelStore[0] = ctx.GetPixelStoreParameters(false);
+                dst.m_pixelStore[1] = ctx.GetPixelStoreParameters(true);
+                break;
+            case F::GetPolygonModeFront:
+                dst.m_polygonModeFront = ctx.GetPolygonModeFront();
+                break;
+            case F::GetPolygonOffsetFactor:
+                dst.m_polygonOffsetFactor = ctx.GetPolygonOffsetFactor();
+                break;
+            case F::GetPolygonOffsetUnits:
+                dst.m_polygonOffsetUnits = ctx.GetPolygonOffsetUnits();
+                break;
+            case F::GetPrimitiveRestartIndex:
+                dst.m_primitiveRestartIndex = ctx.GetPrimitiveRestartIndex();
+                break;
+            case F::GetProgramForDispatch:
+                dst.m_programForDispatch = ctx.GetProgramForDispatch();
+                break;
+            case F::GetProgramForDraw:
+                dst.m_programForDraw = ctx.GetProgramForDraw();
+                break;
+            case F::GetProvokingVertexMode:
+                dst.m_provokingVertexMode = ctx.GetProvokingVertexMode();
+                break;
+            case F::GetRenderStateParameters:
+                dst.m_renderState = ctx.GetRenderStateParameters();
+                break;
+            case F::GetRenderStateParametersVersion:
+                dst.m_renderStateParametersVersion = ctx.GetRenderStateParametersVersion();
+                break;
+            case F::GetSamplingResolutionGeneration:
+                dst.m_samplingResolutionGeneration = ctx.GetSamplingResolutionGeneration();
+                break;
+            case F::GetScissorBox:
+                dst.m_scissorBox = ctx.GetScissorBox();
+                break;
+            case F::GetStencilState:
+                dst.m_stencil[0] = ctx.GetStencilState(StencilFace::Front);
+                dst.m_stencil[1] = ctx.GetStencilState(StencilFace::Back);
+                break;
+            case F::GetTextureBindGeneration:
+                dst.m_textureBindGeneration = ctx.GetTextureBindGeneration();
+                break;
+            case F::GetTextureContextId:
+                dst.m_textureContextId = ctx.GetTextureContextId();
+                break;
+            case F::GetTextureUnitObject:
+                // Array<TextureUnit, MAX_TEXTURE_IMAGE_UNITS> (TextureState.h): unit 0 is the base.
+                dst.m_textureUnitBase = &ctx.GetTextureUnitObject(0);
+                break;
+            case F::GetTransformFeedbackCapturedVertices:
+                dst.m_transformFeedbackCapturedVertices = ctx.GetTransformFeedbackCapturedVertices();
+                break;
+            case F::GetTransformFeedbackGeneration:
+                dst.m_transformFeedbackGeneration = ctx.GetTransformFeedbackGeneration();
+                break;
+            case F::GetTransformFeedbackPausedPrimitiveCounter:
+                dst.m_transformFeedbackPausedPrimitiveCounter = ctx.GetTransformFeedbackPausedPrimitiveCounter();
+                break;
+            case F::GetTransformFeedbackProgram:
+                dst.m_transformFeedbackProgram = ctx.GetTransformFeedbackProgram();
+                break;
+            case F::GetViewport:
+                dst.m_viewport = ctx.GetViewport();
+                break;
+            case F::GetViewportIndexed:
+                for (Uint i = 0; i < PipeInputs::kMaxViewports; ++i) {
+                    dst.m_viewportIndexed[i] = ctx.GetViewportIndexed(i);
+                }
+                break;
+            case F::IsCapabilityEnabled:
+                // Every capability, FramebufferSrgb included: it copies today's constant false
+                // (MEASUREMENTS.md), so no value changes.
+                for (SizeT i = 0; i < PipeInputs::kCapabilityCount; ++i) {
+                    dst.m_capability[i] = ctx.IsCapabilityEnabled(static_cast<CapabilityInput>(i));
+                }
+                break;
+            case F::IsCapabilityEnabledIndexed:
+                // The only two indexed capabilities GLContext keeps (RenderState).
+                for (Uint i = 0; i < kMGMaxDrawBuffers; ++i) {
+                    dst.m_capabilityIndexed.Blend[i] = ctx.IsCapabilityEnabledIndexed(CapabilityInput::Blend, i);
+                }
+                for (Uint i = 0; i < PipeInputs::kMaxViewports; ++i) {
+                    dst.m_capabilityIndexed.ScissorTest[i] =
+                        ctx.IsCapabilityEnabledIndexed(CapabilityInput::ScissorTest, i);
+                }
+                break;
+            case F::IsTransformFeedbackActive:
+                dst.m_transformFeedbackActive = ctx.IsTransformFeedbackActive();
+                break;
+            case F::IsTransformFeedbackPaused:
+                dst.m_transformFeedbackPaused = ctx.IsTransformFeedbackPaused();
+                break;
+            case F::GetBoundTransformFeedbackLifetimeId:
+                dst.m_boundTransformFeedbackLifetimeId = ctx.GetBoundTransformFeedbackLifetimeId();
+                break;
+            // The seven forwarded fields: nothing to copy.
+            case F::GetBufferBindingPointCount:
+            case F::GetProgramObject:
+            case F::GetTextureObject:
+            case F::HasOpenTransformFeedbackSpan:
+            case F::InvalidateCompileEnv:
+            case F::ValidateProgramName:
+            case F::RecordError:
+            case F::kFieldCount:
+                break;
+            }
+        }
+
+        static void SetIdentity(PipeInputs& inputs, GLContext* ctx) {
+            inputs.m_live = ctx != nullptr;
+            inputs.m_contextIdentity = ctx;
+        }
+        static void SetVerb(PipeInputs& inputs, MGPipeVerb verb) { inputs.m_currentVerb = verb; }
+#if MOBILEGL_PIPE_POISON
+        static MGPipeFilledState& Filled(PipeInputs& inputs) { return inputs.m_filled; }
+#endif
+    };
+
+    namespace {
+        GLContext* LiveContext() { return MG_State::pGLContext.get(); }
+
+        template <class T>
+        const SharedPtr<T>& NullShared() {
+            static const SharedPtr<T> null;
+            return null;
+        }
+
+        [[noreturn]] void BadKnob(const char* knob, const char* value, const char* why) {
+            MGLOG_F("MGPipe: Fatal{PipeVerifyBadKnob, \"%s=%s\": %s}", knob, value, why);
+            std::abort();
+        }
+
+        // ---- MOBILEGL_PIPE_POISON_OMIT (negative control B, P1 brief D6) ----
+        // The filler skips the STAMP (never the value) of one (verb, field) pair: an omission
+        // indistinguishable from a forgotten FillPoints.def row, so that verb's read of the
+        // field is Fatal{UnmigratedPipeInput, "Field@Verb"} and no other verb is affected.
+        struct PoisonOmission {
+            Bool Armed = false;
+            MGPipeVerb Verb = MGPipeVerb::kVerbCount;
+            MGPipeInputField Field = MGPipeInputField::kFieldCount;
+        };
+        PoisonOmission g_omission;
+        Bool g_omissionKnobParsed = false;
+        String g_omissionKnobValue; // the value the last parse saw
+
+        // Parsed on the first fill and again only when the value changes. A lane loads
+        // Features once, before any fill, so that is one parse per process there; a forked
+        // test child that sets Features after its parent already filled gets its own parse,
+        // which is what puts the parser and its Fatal{PipeVerifyBadKnob} under a unit test.
+        // An empty value never clears an omission a test armed through MGPipeSetPoisonOmission.
+        void ParsePoisonOmissionKnob() {
+            const String& knob = MG_Config::Features.PipePoisonOmit;
+            if (g_omissionKnobParsed && knob == g_omissionKnobValue) return;
+            g_omissionKnobParsed = true;
+            g_omissionKnobValue = knob;
+            if (knob.empty()) return;
+            const auto colon = knob.find(':');
+            if (colon == String::npos || colon == 0 || colon + 1 >= knob.size()) {
+                BadKnob("MOBILEGL_PIPE_POISON_OMIT", knob.c_str(), "expected <Verb>:<FieldName>");
+            }
+            const String verbName = knob.substr(0, colon);
+            const String fieldName = knob.substr(colon + 1);
+            const auto verb = MGPipeFindVerb(verbName.c_str());
+            if (!verb) BadKnob("MOBILEGL_PIPE_POISON_OMIT", knob.c_str(), "no such verb in kMGPipeVerbNames");
+            const auto field = MGPipeFindInputField(fieldName.c_str());
+            if (!field) BadKnob("MOBILEGL_PIPE_POISON_OMIT", knob.c_str(), "no such field in kMGPipeInputFieldNames");
+            MGPipeSetPoisonOmission(verbName.c_str(), fieldName.c_str());
+        }
+
+        [[maybe_unused]] Bool IsOmitted(MGPipeVerb verb, MGPipeInputField field) {
+            return g_omission.Armed && g_omission.Verb == verb && g_omission.Field == field;
+        }
+
+#if MOBILEGL_PIPE_VERIFY
+        // ---- the MOBILEGL_PIPE_VERIFY comparator (P1 brief D8) ----
+        // Two mechanisms, both active only when Features.PipeVerify is set: the ENTRY compare
+        // once per verb (the pushed block against a second snapshot of the live context,
+        // taken at the same instant - tautological until P2 gives the first arm a real
+        // filler, and kept falsifiable by MOBILEGL_PIPE_VERIFY_CORRUPT), and the
+        // COMPARE-AT-READ in every accessor (the stored value against a fresh read of the
+        // live context at the moment the backend reads it - the arm that is real in P1: it
+        // catches a value that changed between the verb boundary and the read).
+        PipeInputs g_snapshot{};    // the second arm
+        PipeInputs g_readScratch{}; // where the compare-at-read re-read lands
+
+        // The read hook arms at the first fill (ArmVerify below), so it cannot see a read
+        // made before that. That window is covered by the poison instead: MGP_INPUT_CHECK
+        // precedes MGP_INPUT_VERIFY_READ in every accessor and a stamp of 0 is never fresh,
+        // so such a read is Fatal{UnmigratedPipeInput, "<Field>@<none>"} before the hook
+        // could matter - which holds only while a verify build always carries the poison.
+        static_assert(MOBILEGL_PIPE_POISON, "the compare-at-read hook relies on the poison for reads before the first fill");
+
+        struct VerifyState {
+            Bool Parsed = false;
+            Bool Enabled = false;
+            Bool Fatal = true;
+            Bool InHook = false; // a re-read that re-enters an accessor is not re-verified
+            Optional<MGPipeInputField> Corrupt;
+            String CorruptKnob; // the MOBILEGL_PIPE_VERIFY_CORRUPT value the last arm saw
+            std::atomic<Uint64> Divergences{0};
+            ~VerifyState() {
+                const Uint64 count = Divergences.load(std::memory_order_relaxed);
+                if (count != 0) {
+                    MGLOG_E("MGPipe: verify summary - %llu divergence(s) survived MOBILEGL_PIPE_VERIFY_FATAL=0",
+                            static_cast<unsigned long long>(count));
+                }
+            }
+        };
+        VerifyState g_verify;
+
+        // Armed on the first fill and re-armed when any of the three verify knobs'
+        // Features value (PipeVerify, PipeVerifyFatal, PipeVerifyCorrupt) differs from what
+        // the last arm latched (the same reason as ParsePoisonOmissionKnob: one arm per lane
+        // process, a fresh arm for a forked test child that turns a knob after its parent
+        // filled). Cost: two Bool compares and one String compare per fill, verify builds only.
+        void ArmVerify() {
+            const auto& features = MG_Config::Features;
+            if (g_verify.Parsed && g_verify.Enabled == features.PipeVerify && g_verify.Fatal == features.PipeVerifyFatal &&
+                g_verify.CorruptKnob == features.PipeVerifyCorrupt) {
+                return;
+            }
+            g_verify.Parsed = true;
+            g_verify.Enabled = features.PipeVerify;
+            g_verify.Fatal = features.PipeVerifyFatal;
+            g_verify.CorruptKnob = features.PipeVerifyCorrupt;
+            g_verify.Corrupt = Optional<MGPipeInputField>{};
+            if (!g_verify.Enabled) return;
+            const String& corrupt = g_verify.CorruptKnob;
+            if (!corrupt.empty()) {
+                const auto field = MGPipeFindInputField(corrupt.c_str());
+                if (!field) {
+                    BadKnob("MOBILEGL_PIPE_VERIFY_CORRUPT", corrupt.c_str(), "no such field in kMGPipeInputFieldNames");
+                }
+                g_verify.Corrupt = field;
+            }
+            // The lanes grep for this line: a verify run whose log lacks it never armed.
+            MGLOG_I("MGPipe: verify armed - %u fields, %u verbs, fatal=%d", static_cast<unsigned>(kMGPipeInputFieldCount),
+                    static_cast<unsigned>(kMGPipeVerbCount), g_verify.Fatal ? 1 : 0);
+            if (g_verify.Corrupt) {
+                MGLOG_I("MGPipe: verify corruption armed - %s", kMGPipeInputFieldNames[static_cast<SizeT>(*g_verify.Corrupt)]);
+            }
+        }
+
+        void ReportDivergence(MGPipeInputField field, const char* where) {
+            const Uint64 serial = MGPipeFillAccess::Filled(gPipeInputs).CurrentVerbSerial;
+            MGLOG_F("MGPipe: Fatal{PipeVerifyDiffer, \"%s@%s\", verb=%llu, where=%s}",
+                    kMGPipeInputFieldNames[static_cast<SizeT>(field)], MGPipeVerbName(gPipeInputs.CurrentVerb()),
+                    static_cast<unsigned long long>(serial), where);
+            if (g_verify.Fatal) std::abort();
+            g_verify.Divergences.fetch_add(1, std::memory_order_relaxed);
+        }
+
+        void EntryCompare(PipeInputs& inputs, const MGPipeFieldMask& mask) {
+            if (!g_verify.Enabled) return;
+            SnapshotFromGLContext(g_snapshot, mask);
+            // Negative control A: perturb the SNAPSHOT arm, so a green run goes red naming the
+            // field. A field outside this verb's mask is not compared and stays untouched.
+            if (g_verify.Corrupt && MGPipeFieldMaskHas(mask, *g_verify.Corrupt)) {
+                MGPipeApplyVerifyCorruption(g_snapshot, *g_verify.Corrupt);
+            }
+            MGPipeInputField differing = MGPipeInputField::kFieldCount;
+            if (!MGPipeVerifyInputs(inputs, g_snapshot, mask, &differing)) ReportDivergence(differing, "entry");
+        }
+#endif // MOBILEGL_PIPE_VERIFY
+    } // namespace
+
+#if MOBILEGL_PIPE_VERIFY
+    void SnapshotFromGLContext(PipeInputs& snapshot, const MGPipeFieldMask& mask) {
+        auto* ctx = LiveContext();
+        MGPipeFillAccess::SetIdentity(snapshot, ctx);
+        MGPipeFillAccess::SetVerb(snapshot, gPipeInputs.CurrentVerb());
+        if (ctx == nullptr) return;
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            const auto field = static_cast<MGPipeInputField>(i);
+            if (!MGPipeFieldMaskHas(mask, field) || kMGPipeInputFieldSticky[i]) continue;
+            MGPipeFillAccess::CopyField(snapshot, *ctx, field);
+        }
+    }
+
+    void MGPipeVerifyReadHook(const PipeInputs& self, MGPipeInputField field, Uint index0, Uint index1) {
+        if (&self != &gPipeInputs || !g_verify.Enabled || g_verify.InHook) return;
+        const auto index = static_cast<SizeT>(field);
+        if (kMGPipeInputFieldSticky[index]) return;
+        auto* ctx = LiveContext();
+        if (ctx == nullptr) return;
+        // The whole field is re-read and compared - a superset of "the same indices", so a
+        // divergence in an index the backend did not ask for is still a divergence between
+        // the boundary value and the live value. The indices only decorate the report. The
+        // cost is per backend read (GetRenderStateParameters re-copies and compares the whole
+        // struct; GetProgramForDraw re-joins the pending link), inside the verify budget and
+        // to be kept in mind when reading the verify lane's wall time.
+        // InHook: the re-read calls the same GLContext accessor the filler calls, and
+        // GetProgramForDraw's join can re-enter a backend and with it another gPipeInputs
+        // accessor; that inner read is a plain load rather than a second hook, so the hook
+        // never recurses (and never reports the inner read against a half-copied scratch).
+        g_verify.InHook = true;
+        MGPipeFillAccess::CopyField(g_readScratch, *ctx, field);
+        const Bool equal = MGPipeInputsFieldEqual(field, self, g_readScratch);
+        g_verify.InHook = false;
+        if (equal) return;
+        MGLOG_E("MGPipe: verify read of %s (index %u, %u) differs from the live context", kMGPipeInputFieldNames[index],
+                index0, index1);
+        ReportDivergence(field, "read");
+    }
+#endif // MOBILEGL_PIPE_VERIFY
+
+    // ---- push on mutation (P1 lane finding F2) ----
+    // A backend that writes a frontend object inside its own verb moves a value the verb
+    // boundary already copied: Magma's ResolveSamplerDescriptor synthesises a fallback
+    // texture for an unbound sampler and its AllocateStorage/SetInternalFormat bump the
+    // context's sampling-resolution generation, so every read of that field after the
+    // fallback differs from the live context (the two SampledSetStaleness / six
+    // UnboundImageDescriptor entries the verify lane aborted on). The frontend mutator
+    // spells MGP_NOTE_MUTATION(Field) at the point of the move and lands here.
+    //
+    // Only the value is refreshed. The stamp is deliberately left alone: a field whose stamp
+    // this verb withheld (negative control B) must stay stale, and a field the verb never
+    // filled must stay Fatal{UnmigratedPipeInput} on the next read rather than be healed by
+    // an unrelated frontend write.
+    void MGPipeNoteFrontendMutation(MGPipeInputField field) {
+        PipeInputs& inputs = gPipeInputs;
+        auto* ctx = LiveContext();
+        if (ctx == nullptr) return;
+        const auto verb = inputs.CurrentVerb();
+        if (verb == MGPipeVerb::kVerbCount) return; // nothing has filled the block yet
+        const auto index = static_cast<SizeT>(field);
+        if (kMGPipeInputFieldSticky[index]) return; // forwarded: no storage to refresh
+        const MGPipeFieldMask& mask =
+            kMGPipeClassFieldMask[static_cast<SizeT>(kMGPipeVerbClass[static_cast<SizeT>(verb)])];
+        if (!MGPipeFieldMaskHas(mask, field)) return; // this verb never pushed it
+        MGPipeFillAccess::CopyField(inputs, *ctx, field);
+    }
+
+    void MGPipeSetPoisonOmission(const char* verb, const char* field) {
+        if (verb == nullptr || field == nullptr) {
+            g_omission = PoisonOmission{};
+            return;
+        }
+        const auto v = MGPipeFindVerb(verb);
+        const auto f = MGPipeFindInputField(field);
+        if (!v || !f) BadKnob("MOBILEGL_PIPE_POISON_OMIT", verb, "unknown verb or field");
+        g_omission.Armed = true;
+        g_omission.Verb = *v;
+        g_omission.Field = *f;
+#if MOBILEGL_PIPE_POISON
+        MGLOG_I("MGPipe: poison omission armed - %s@%s", field, verb);
+#else
+        MGLOG_W_ONCE("MGPipe: poison omission %s@%s requested but the poison is not compiled in "
+                     "(MOBILEGL_PIPE_POISON=0): no stamp exists to omit",
+                     field, verb);
+#endif
+    }
+
+    // ---- liveness ----
+    Bool PipeInputs::IsLive() const { return LiveContext() != nullptr; }
+
+    // ---- the seven F-class forwarders ----
+    SizeT PipeInputs::GetBufferBindingPointCount(BufferTarget target) const {
+        const auto* ctx = LiveContext();
+        return ctx != nullptr ? ctx->GetBufferBindingPointCount(target) : 0;
+    }
+
+    const SharedPtr<PipeInputs::ProgramObject>& PipeInputs::GetProgramObject(Uint index) {
+        auto* ctx = LiveContext();
+        return ctx != nullptr ? ctx->GetProgramObject(index) : NullShared<ProgramObject>();
+    }
+
+    const SharedPtr<PipeInputs::ITextureObject>& PipeInputs::GetTextureObject(Uint index) {
+        auto* ctx = LiveContext();
+        return ctx != nullptr ? ctx->GetTextureObject(index) : NullShared<ITextureObject>();
+    }
+
+    Bool PipeInputs::HasOpenTransformFeedbackSpan(Uint64 lifetimeId) const {
+        const auto* ctx = LiveContext();
+        return ctx != nullptr && ctx->HasOpenTransformFeedbackSpan(lifetimeId);
+    }
+
+    void PipeInputs::InvalidateCompileEnv() {
+        if (auto* ctx = LiveContext()) ctx->InvalidateCompileEnv();
+    }
+
+    Bool PipeInputs::ValidateProgramName(Uint index) const {
+        const auto* ctx = LiveContext();
+        return ctx != nullptr && ctx->ValidateProgramName(index);
+    }
+
+    void PipeInputs::RecordError(ErrorCode code, UniquePtr<ErrorInfo> info) {
+        auto* ctx = LiveContext();
+        if (ctx == nullptr) {
+            MGLOG_E_ONCE("PipeInputs::RecordError: no live context, dropping error %d", static_cast<int>(code));
+            return;
+        }
+        ctx->RecordError(code, Move(info));
+    }
+
+    void MGPipeLeaveVerb() {
+        PipeInputs& inputs = gPipeInputs;
+#if MOBILEGL_PIPE_POISON
+        // Same bump the next fill would make, without a verb to fill from: no field is
+        // stamped, so every stamp this verb made falls behind the serial.
+        ++MGPipeFillAccess::Filled(inputs).CurrentVerbSerial;
+#endif
+        MGPipeFillAccess::SetVerb(inputs, MGPipeVerb::kVerbCount);
+    }
+
+    // ---- the filler ----
+    void MGPipeFillForVerb(MGPipeVerb verb) {
+        PipeInputs& inputs = gPipeInputs;
+        ParsePoisonOmissionKnob();
+#if MOBILEGL_PIPE_VERIFY
+        ArmVerify();
+#else
+        // The runtime knob without the compiled comparator is a no-op that would look green;
+        // this warning is what a lane's arming assertion turns into red.
+        if (MG_Config::Features.PipeVerify) {
+            MGLOG_W_ONCE("MGPipe: MOBILEGL_PIPE_VERIFY=1 requested but the comparator is not compiled in "
+                         "(configure with -DMOBILEGL_PIPE_VERIFY=ON)");
+        }
+#endif
+#if MOBILEGL_PIPE_POISON
+        MGPipeFilledState& filled = MGPipeFillAccess::Filled(inputs);
+        // Starts at 1: FilledGen == 0 is "never filled", and MGPipeInputFieldIsFresh refuses
+        // it on both branches, so a read before this first bump is
+        // Fatal{UnmigratedPipeInput, "<Field>@<none>"} rather than default storage.
+        ++filled.CurrentVerbSerial;
+#endif
+        MGPipeFillAccess::SetVerb(inputs, verb);
+        auto* ctx = LiveContext();
+        MGPipeFillAccess::SetIdentity(inputs, ctx);
+        if (ctx == nullptr) return;
+        const MGPipeFieldMask& mask = kMGPipeClassFieldMask[static_cast<SizeT>(kMGPipeVerbClass[static_cast<SizeT>(verb)])];
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            const auto field = static_cast<MGPipeInputField>(i);
+            if (!MGPipeFieldMaskHas(mask, field)) continue;
+#if MOBILEGL_PIPE_POISON
+            if (kMGPipeInputFieldSticky[i]) {
+                // Stamped once by the first fill that sees a live context; fresh through the
+                // Sticky -> FilledGen != 0 branch of MGPipeInputFieldIsFresh from then on.
+                if (filled.FilledGen[i] == 0) filled.FilledGen[i] = 1;
+                continue;
+            }
+#else
+            if (kMGPipeInputFieldSticky[i]) continue;
+#endif
+            MGPipeFillAccess::CopyField(inputs, *ctx, field);
+#if MOBILEGL_PIPE_POISON
+            // The value is copied either way; only the stamp is withheld for the omitted pair.
+            if (!IsOmitted(verb, field)) filled.FilledGen[i] = filled.CurrentVerbSerial;
+#endif
+        }
+#if MOBILEGL_PIPE_VERIFY
+        EntryCompare(inputs, mask);
+#endif
+    }
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Impl/Pipe/PipeFill.h

@@ -0,0 +1,55 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/PipeFill.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+// The fill point (ARCHITECTURE.md 9.2, P1 brief D7). MG_Impl spells MGP_FILL(Verb); as the
+// statement immediately before every call through gBackendFunctionsTable.GL - after every
+// early return the call is behind, inside the loop body for a call made in a loop - so the
+// frontend fills the PipeInputs block for exactly the verbs that reach a backend. In the
+// pull build the macro is ((void)0) and the pull build is byte-identical to a tree without
+// it.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/MGPipe.h>
+namespace MobileGL::MG_Pipe {
+    struct PipeInputs;
+
+    // PipeFill.cpp. Bumps the per-verb serial, records the verb and the context identity,
+    // and copies every field in the verb class's may-read mask (kMGPipeClassFieldMask) out
+    // of the live GLContext, stamping each with the new serial. In a verify build it then
+    // runs the entry compare against a second snapshot (P1 brief D8).
+    void MGPipeFillForVerb(MGPipeVerb verb);
+
+    // Ends the verb in flight without starting another: bumps the serial, so every field the
+    // verb stamped goes stale, and puts the current verb back to "none", so a read made after
+    // it aborts as Fatal{UnmigratedPipeInput, "<Field>@<none>"} - which is what such a read
+    // is - instead of naming whichever verb happened to be filled last. Nothing in the GL
+    // entry points calls this: a real verb is always followed by the next verb's fill. It
+    // exists for a caller that drives a backend helper directly and wants its declaration to
+    // stop where it says it stops (MG_Test/ScopedPipeVerb.h).
+    void MGPipeLeaveVerb();
+
+    // PipeFill.cpp. Negative control B (P1 brief D6): the filler withholds the STAMP - never
+    // the value - of `field` at `verb`, so that verb's read of it is
+    // Fatal{UnmigratedPipeInput, "Field@Verb"} while every other verb is unaffected. The
+    // MOBILEGL_PIPE_POISON_OMIT knob ("<Verb>:<FieldName>") calls this once, on the first
+    // fill; tests call it directly. Both null clears the omission. An unknown name is
+    // Fatal{PipeVerifyBadKnob}.
+    void MGPipeSetPoisonOmission(const char* verb, const char* field);
+
+#if MOBILEGL_PIPE_VERIFY
+    // PipeFill.cpp. The second arm of the comparator (P1 brief D8, ARCHITECTURE.md 13.2-2):
+    // fills `snapshot` from the live GLContext the old way, for every field in `mask`. This
+    // is the branch that survives P13, which is why it is its own function rather than the
+    // filler's loop.
+    void SnapshotFromGLContext(PipeInputs& snapshot, const MGPipeFieldMask& mask);
+#endif
+} // namespace MobileGL::MG_Pipe
+#define MGP_FILL(Verb) ::MobileGL::MG_Pipe::MGPipeFillForVerb(::MobileGL::MG_Pipe::MGPipeVerb::Verb)
+#else
+#define MGP_FILL(Verb) ((void)0)
+#endif

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -51,6 +51,7 @@ endif()
 add_executable(MobileGLIntegrationTest
     Main.cpp
     Harness/HeadlessGL.cpp
+    Harness/BackendCapsPeek.cpp
     Scenarios/OrientationScenario.cpp
     Scenarios/CrossFrameBufferScenario.cpp
     Scenarios/ResidentIndexScenario.cpp
@@ -101,8 +102,10 @@ add_executable(MobileGLIntegrationTest
     Scenarios/VertexAttribBindingScenario.cpp
     Scenarios/XfbCaptureBufferReuseScenario.cpp
     Scenarios/XfbPrimitiveQueryScenario.cpp
+    Scenarios/PrimitivesGeneratedNoXfbScenario.cpp
     Scenarios/XfbRepeatedCaptureScenario.cpp
     Scenarios/TessellationXfbCaptureScenario.cpp
+    Scenarios/PointSizeDemotionScenario.cpp
     Scenarios/VertexArrayEnableDisableScenario.cpp
     Scenarios/CopyImageLevelRangeScenario.cpp
     Scenarios/CopyImageLayeredScenario.cpp
@@ -113,6 +116,7 @@ add_executable(MobileGLIntegrationTest
     Scenarios/LayeredAttachmentShapeScenario.cpp
     Scenarios/LayeredTextureReadbackScenario.cpp
     Scenarios/AtomicCounterScenario.cpp
+    Scenarios/LargeArenaAdoptionScenario.cpp
     Scenarios/SsboArrayDynamicIndexScenario.cpp
     Scenarios/StorageBufferRegrowScenario.cpp
     Scenarios/SpirvShaderBinaryScenario.cpp
@@ -123,6 +127,8 @@ add_executable(MobileGLIntegrationTest
     Scenarios/ClearTexImageUndefinedLevelZeroScenario.cpp
     Scenarios/RenderbufferBlendFormatScenario.cpp
     Scenarios/DualSourceBlendScenario.cpp
+    Scenarios/PipeVerifyArmingScenario.cpp
+    Scenarios/PoisonOmissionScenario.cpp
 )
 
 target_include_directories(MobileGLIntegrationTest PRIVATE
@@ -365,6 +371,25 @@ mgl_itest_join_environment(MGL_ITEST_GLES_UNLOCATED_IO_BLOCKS_ENVIRONMENT
     ${MGL_ITEST_COMMON_ENV})
 mgl_itest_join_environment(MGL_ITEST_GLES_WIDENED_PACKED16_ENVIRONMENT
     "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE=1" ${MGL_ITEST_COMMON_ENV})
+# Same shape as the UnlocatedIoBlocks entry: the log path is where the reroute's latched
+# MGLOG_I lands, and the arming case only trusts the bytes written after it started.
+mgl_itest_join_environment(MGL_ITEST_VULKAN_PRIMGEN_REROUTE_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/primgen-query-reroute.log"
+    ${MGL_ITEST_VULKAN_ENV})
+# The point-size demotion pinned on, per backend, with a per-lane log file for the arming
+# assertion - the same MOBILEGL_LOG_FILE_PATH reasoning as the UnlocatedIoBlocks lane above.
+# Two lanes because the demotion runs in the SHARED phase-B chain and each backend then
+# consumes it differently (Espryt respells the driver-side capture request, Magma binds the
+# SPIR-V Xfb decorations to the carrier).
+mgl_itest_join_environment(MGL_ITEST_GLES_POINT_SIZE_DEMOTION_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_POINT_SIZE_DEMOTION=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/point-size-demotion-gles.log"
+    ${MGL_ITEST_COMMON_ENV})
+mgl_itest_join_environment(MGL_ITEST_VULKAN_POINT_SIZE_DEMOTION_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_POINT_SIZE_DEMOTION=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/point-size-demotion-vulkan.log"
+    ${MGL_ITEST_VULKAN_ENV})
 
 # TIMEOUT on every entry: a GPU test that wedges must fail the run, not hang it.
 set(MGL_ITEST_TIMEOUT 120)
@@ -545,6 +570,25 @@ gtest_discover_tests(MobileGLIntegrationTest
         ENVIRONMENT "${MGL_ITEST_GLES_NO_VIEWPORT_EMULATION_ENVIRONMENT}"
 )
 
+# PrimitivesGeneratedNoXfbScenario again, with the GL_PRIMITIVES_GENERATED statistics
+# reroute PINNED ON. The ambient DirectVulkan registration runs the same cases under the
+# bring-up probe's Auto verdict, so between the two entries both accounting paths answer
+# the same GL questions and must produce the same numbers - the "two pools must agree"
+# gate this machine can hold that the affected device cannot. The pinned entry is also
+# the only one whose arming case runs: it asserts the renderer's latched MGLOG_I, so a
+# silently-disarmed reroute (an inverted override mapping, a lost gate) fails here
+# instead of leaving every equality case vacuously green. DirectVulkan only - the flag
+# steers nothing on DirectGLES.
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectVulkan.PrimGenReroute."
+    TEST_FILTER "PrimitivesGeneratedNoXfbScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_VULKAN_PRIMGEN_REROUTE_ENVIRONMENT}"
+)
+
 # The packed16 copy scenarios again, with the 8-bit storage widening PINNED ON. The ambient
 # registrations above cover the narrow storage - on every CI driver the widening's POST
 # probe finds no field-order mirror, so Auto keeps the native 16-bit path - which means the
@@ -562,3 +606,208 @@ gtest_discover_tests(MobileGLIntegrationTest
         TIMEOUT ${MGL_ITEST_TIMEOUT}
         ENVIRONMENT "${MGL_ITEST_GLES_WIDENED_PACKED16_ENVIRONMENT}"
 )
+
+# PointSizeDemotionScenario with the demotion PINNED ON, per backend, for the reason every
+# pinned lane above exists: llvmpipe and lavapipe both HOST gl_PointSize in tessellation and
+# geometry stages, so the ambient registrations run these captures through the built-in and
+# the demotion - the path every affected Mali device actually takes - would execute nowhere.
+# The ambient runs stay the negative control: same scenario, same CPU-computed bytes, native
+# path. Both backends, because the demotion is shared phase-B work with two different
+# consumers (the ESSL capture respelling vs the SPIR-V Xfb carrier binding).
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectGLES.PointSizeDemotion."
+    TEST_FILTER "PointSizeDemotionScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_GLES_POINT_SIZE_DEMOTION_ENVIRONMENT}"
+)
+
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectVulkan.PointSizeDemotion."
+    TEST_FILTER "PointSizeDemotionScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_VULKAN_POINT_SIZE_DEMOTION_ENVIRONMENT}"
+)
+
+# --- the third CI mode: MOBILEGL_PIPE_VERIFY -----------------------------------
+#
+# ARCHITECTURE.md 13.2-(2) asks for a THIRD build mode next to pull and push: two state models in
+# one address space, compared field by field at every verb boundary and again at every accessor
+# read, 5-10x slower and never shipped. These entries are that mode's lane. They exist only when
+# the library was configured with -DMOBILEGL_PIPE_VERIFY=ON, which is deliberate and is half of
+# what makes the lane falsifiable: `ctest -L integration-verify --no-tests=error` in a build that
+# forgot the option matches NO tests and fails, instead of reporting a green run of nothing.
+#
+# The other half is PipeVerifyArmingScenario.Armed, which asserts the library's own arming line -
+# because MOBILEGL_PIPE_VERIFY=1 in the environment of a library that never compiled the
+# comparator in is a silent no-op that looks exactly like a clean pass.
+#
+# Three things about the ENVIRONMENT properties below, each of which has already gone wrong once
+# in this file:
+#   * every list APPENDS ${MGL_ITEST_COMMON_ENV} / ${MGL_ITEST_VULKAN_ENV}. A ctest ENVIRONMENT
+#     entry overrides the job environment for the names it lists, so an entry that named only its
+#     own knobs would lose the EGL vendor and Vulkan ICD pinning and run against whichever driver
+#     the loader found first.
+#   * the ambient Verify. entries name NEITHER MOBILEGL_PIPE_VERIFY_CORRUPT NOR
+#     MOBILEGL_PIPE_POISON_OMIT. That is what lets CI's two always-on negative-control steps
+#     export those knobs in the JOB environment and have them reach the test processes; a
+#     property entry of the same name would silently win and the controls would prove nothing.
+#   * MOBILEGL_LOG_FILE_PATH is per lane, and "per lane" is the exact limit of what it proves. It
+#     is the only channel a test process has for reading the library's own report (MG_Config is not
+#     reachable from this module), but the log is opened fopen(path, "w"), so every process in a
+#     lane TRUNCATES it: after an ambient lane of 400-odd entries the file holds the LAST process
+#     and nothing else. Reading it is therefore only sound in a filtered, one-entry lane - which is
+#     why the arming case has a lane and a log of its own below, and why neither this file nor CI
+#     may read the ambient logs as evidence about the entries that ran before the last one. The
+#     ambient path is kept for post-mortems (and to keep library chatter out of ctest's capture).
+if (MOBILEGL_PIPE_VERIFY)
+    # 900s, not the ambient 120: the comparator re-reads every field of the fill mask at the verb
+    # boundary and again at every accessor read, which the design budgets at 5-10x.
+    set(MGL_ITEST_VERIFY_TIMEOUT 900)
+
+    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-DirectGLES.log"
+        ${MGL_ITEST_COMMON_ENV})
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-DirectVulkan.log"
+        ${MGL_ITEST_VULKAN_ENV})
+
+    # The arming assertion's own lane, one case per backend, with a log path nothing else writes to.
+    #
+    # PipeVerifyArmingScenario.Armed reads the library's log, and the log is a per-LANE resource: it
+    # is opened fopen(path, "w"), so every process in a lane truncates it. In the ambient Verify.
+    # lane that is 400-odd processes on one path, run `-j 4` in CI, and a whole-file read there
+    # races a neighbour's bring-up. Every other log-reading scenario in this file (UnlocatedIoBlocks,
+    # the primgen reroute, the point-size demotion) is registered exactly like this for the same
+    # reason. MGITEST_PIPE_ARMING_LANE is a harness marker - the library never reads it - and it is
+    # what makes the case skip in the ambient lane instead of racing there.
+    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_ARMING_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1" "MGITEST_PIPE_ARMING_LANE=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-arming-DirectGLES.log"
+        ${MGL_ITEST_COMMON_ENV})
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_ARMING_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1" "MGITEST_PIPE_ARMING_LANE=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-arming-DirectVulkan.log"
+        ${MGL_ITEST_VULKAN_ENV})
+
+    # Negative control A (G4). MOBILEGL_PIPE_VERIFY_FATAL=0 so the process SURVIVES its own
+    # divergence and the case can read the report back out of the log; the CI step that exports
+    # the same corruption against the ambient lane, where FATAL keeps its default of 1, asserts
+    # the other half - that a divergence aborts and reds the entry.
+    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_CORRUPT_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters" "MOBILEGL_PIPE_VERIFY_FATAL=0"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-corrupt-DirectGLES.log"
+        ${MGL_ITEST_COMMON_ENV})
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_CORRUPT_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters" "MOBILEGL_PIPE_VERIFY_FATAL=0"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-corrupt-DirectVulkan.log"
+        ${MGL_ITEST_VULKAN_ENV})
+
+    # Negative control B (G5). The omission skips the STAMP of one field for one verb while still
+    # copying its value, which is indistinguishable from a fill row nobody wrote; the scenario
+    # forks, so the resulting std::abort() is a datum in waitpid() rather than a dead lane.
+    mgl_itest_join_environment(MGL_ITEST_GLES_POISON_OMIT_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_PIPE_POISON_OMIT=GenerateMipmap:GetActiveTextureUnit"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-DirectGLES.log"
+        ${MGL_ITEST_COMMON_ENV})
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_POISON_OMIT_ENVIRONMENT
+        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_PIPE_POISON_OMIT=GenerateMipmap:GetActiveTextureUnit"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-DirectVulkan.log"
+        ${MGL_ITEST_VULKAN_ENV})
+
+    # The whole suite again, per backend, with the comparator armed. Same scenarios, same
+    # assertions, but every backend read of frontend state is now checked against a snapshot taken
+    # from the live context at the verb boundary - which is what "the 742 integration entries
+    # prove push equals pull" means. Labelled integration-gpu as well so a verify build's
+    # `ctest -L integration-gpu` still describes the whole registration set.
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectGLES.Verify."
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_GLES_VERIFY_ENVIRONMENT}"
+    )
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectVulkan.Verify."
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_VULKAN_VERIFY_ENVIRONMENT}"
+    )
+
+    # The arming assertion, one entry per backend. This is the entry that fails a lane whose library
+    # never armed: it runs the same library and the same MOBILEGL_PIPE_VERIFY=1 as the ambient
+    # entries above, but unlike them it cannot be green against a library with no comparator
+    # compiled in. Its log is its own, so `-j 4` cannot make it flake.
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectGLES.VerifyArming."
+        TEST_FILTER "PipeVerifyArmingScenario.Armed"
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_GLES_VERIFY_ARMING_ENVIRONMENT}"
+    )
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectVulkan.VerifyArming."
+        TEST_FILTER "PipeVerifyArmingScenario.Armed"
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_VULKAN_VERIFY_ARMING_ENVIRONMENT}"
+    )
+
+    # One case each: the knobs are process-wide, so a corrupted or poisoned process cannot also be
+    # running the ambient assertions. These four entries are the ones that assert the RED - they
+    # pass when the comparator and the poison report, and go red when either stops.
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectGLES.VerifyCorrupted."
+        TEST_FILTER "PipeVerifyArmingScenario.CorruptedFieldIsReported"
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_GLES_VERIFY_CORRUPT_ENVIRONMENT}"
+    )
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectVulkan.VerifyCorrupted."
+        TEST_FILTER "PipeVerifyArmingScenario.CorruptedFieldIsReported"
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_VULKAN_VERIFY_CORRUPT_ENVIRONMENT}"
+    )
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectGLES.PoisonOmitted."
+        TEST_FILTER "PoisonOmissionScenario.OmittedFieldAbortsOnThatVerb"
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_GLES_POISON_OMIT_ENVIRONMENT}"
+    )
+    gtest_discover_tests(MobileGLIntegrationTest
+        TEST_PREFIX "DirectVulkan.PoisonOmitted."
+        TEST_FILTER "PoisonOmissionScenario.OmittedFieldAbortsOnThatVerb"
+        DISCOVERY_TIMEOUT 30
+        PROPERTIES
+            LABELS "integration-gpu\;integration-verify"
+            TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT}
+            ENVIRONMENT "${MGL_ITEST_VULKAN_POISON_OMIT_ENVIRONMENT}"
+    )
+endif()

MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.cpp

@@ -0,0 +1,42 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "BackendCapsPeek.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Backend/BackendObject.h>
+
+namespace MobileGL::MG_Backend {
+    // Declared in MG_Backend/BackendObjects.h, which also pulls in both backends' headers
+    // and, through them, their loaders; the reference alone is all that is needed here.
+    extern UniquePtr<BackendObject>& pActiveBackendObject;
+} // namespace MobileGL::MG_Backend
+#endif
+
+namespace MGITest {
+
+    bool PeekComputeWorkGroupCaps(int outCount[3], int outSize[3]) {
+#if defined(__ANDROID__)
+        (void)outCount;
+        (void)outSize;
+        return false;
+#else
+        const auto& backend = MobileGL::MG_Backend::pActiveBackendObject;
+        if (!backend) {
+            return false;
+        }
+        const MobileGL::MG_Backend::DynamicBackendParameters& caps = backend->GetDynamicParameters();
+        for (int axis = 0; axis < 3; ++axis) {
+            outCount[axis] = caps.MaxComputeWorkGroupCount[axis];
+            outSize[axis] = caps.MaxComputeWorkGroupSize[axis];
+        }
+        return true;
+#endif
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.h

@@ -0,0 +1,29 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// The one place this module looks past the GL API into the active backend's caps block.
+//
+// It exists for exactly one assertion: that the six per-axis compute limits the MGPipe
+// caps block carries (DynamicBackendParameters::MaxComputeWorkGroupCount/Size, plan B
+// section 4.4.1) are the same numbers glGetIntegeri_v answers today, since P0.5 retires
+// the getter in favour of the caps. A separate translation unit, because the scenario
+// sources include the GL headers with prototypes and MobileGL's umbrella header is not
+// meant to meet them in one file.
+
+#pragma once
+
+namespace MGITest {
+
+    // Copies the active backend's MaxComputeWorkGroupCount / MaxComputeWorkGroupSize into the
+    // two arrays and returns true. Returns false, touching nothing, where the caps block is
+    // out of reach: on Android this module links the SHIPPING libMobileGL.so, built
+    // -fvisibility=hidden, so no internal symbol resolves; on desktop it links MobileGL_s and
+    // the read is direct.
+    bool PeekComputeWorkGroupCaps(int outCount[3], int outSize[3]);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/AdvertisedLimitsScenario.cpp

@@ -26,9 +26,11 @@
 // quantities, so an entry that only fails on DirectVulkan is a translation bug and one that
 // fails on both is a table bug.
 
+#include <algorithm>
 #include <string>
 #include <vector>
 
+#include "../Harness/BackendCapsPeek.h"
 #include "../Harness/HeadlessGL.h"
 #include "../Harness/ScenarioFixture.h"
 
@@ -378,5 +380,250 @@ namespace MGITest {
             EXPECT_GE(viewportDims[1], maxRenderbufferSize);
         }
 
+
+        // THE INDEXED AND PER-PROGRAM QUERIES THAT NAME FRONTEND STATE, pinned on both lanes.
+        //
+        // Both backends used to carry their own arms for GL_SHADER_STORAGE_BUFFER_* and
+        // GL_IMAGE_BINDING_* inside GLFunctionsTable::GetIntegeri_v, and their own
+        // GetInteger64i_v / GetProgramiv table entries. None of it was reachable: GL_Getter and
+        // GL_Program answer every one of these pnames from the frontend's own state and return
+        // before the table is consulted. The duplicates did not even agree - the backend arms
+        // clamped a bound range to the buffer's current storage, which GL 4.6 core tables
+        // 23.4/23.5 do not permit - so the code was one refactor away from becoming the answer.
+        // These cases pin what the frontend actually reports, so a future move of any of it back
+        // behind the interface has to keep saying the same thing.
+        TEST_F(AdvertisedLimitsScenario, IndexedBufferBindingsAreReportedVerbatimOnBothWidths) {
+            GLuint buffer = 0;
+            glGenBuffers(1, &buffer);
+            glBindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+            glBufferData(GL_SHADER_STORAGE_BUFFER, 1024, nullptr, GL_DYNAMIC_DRAW);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+
+            // A range that is NOT the whole buffer, so a clamp to the store would be visible.
+            glBindBufferRange(GL_SHADER_STORAGE_BUFFER, 1, buffer, 256, 512);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+
+            GLint binding32 = -1;
+            GLint start32 = -1;
+            GLint size32 = -1;
+            glGetIntegeri_v(GL_SHADER_STORAGE_BUFFER_BINDING, 1, &binding32);
+            glGetIntegeri_v(GL_SHADER_STORAGE_BUFFER_START, 1, &start32);
+            glGetIntegeri_v(GL_SHADER_STORAGE_BUFFER_SIZE, 1, &size32);
+            EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            EXPECT_EQ(binding32, static_cast<GLint>(buffer));
+            EXPECT_EQ(start32, 256);
+            EXPECT_EQ(size32, 512);
+
+            // The 64-bit width has to agree pname for pname. It has no backend entry of its own
+            // and derives everything from the 32-bit answer above plus its own buffer arm.
+            GLint64 binding64 = -1;
+            GLint64 start64 = -1;
+            GLint64 size64 = -1;
+            glGetInteger64i_v(GL_SHADER_STORAGE_BUFFER_BINDING, 1, &binding64);
+            glGetInteger64i_v(GL_SHADER_STORAGE_BUFFER_START, 1, &start64);
+            glGetInteger64i_v(GL_SHADER_STORAGE_BUFFER_SIZE, 1, &size64);
+            EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            EXPECT_EQ(binding64, static_cast<GLint64>(buffer));
+            EXPECT_EQ(start64, static_cast<GLint64>(256));
+            EXPECT_EQ(size64, static_cast<GLint64>(512));
+
+            // An unbound index answers zero rather than erroring or leaking the driver's answer.
+            GLint unbound = -1;
+            glGetIntegeri_v(GL_SHADER_STORAGE_BUFFER_BINDING, 0, &unbound);
+            EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            EXPECT_EQ(unbound, 0);
+
+            // THE ARM THAT SEPARATES VERBATIM FROM CLAMPED. GL 4.6 core tables 23.4/23.5 report
+            // the size glBindBufferRange was ASKED for; it does not follow the buffer, so
+            // shrinking the store underneath the binding must not move it. A clamp to the
+            // current storage - which is exactly what both backends' deleted arms did - answers
+            // 128 here, and answers 0 for the bind-then-allocate shape
+            // KHR-GL43.shader_storage_buffer_object.basic-binding uses.
+            glBufferData(GL_SHADER_STORAGE_BUFFER, 128, nullptr, GL_DYNAMIC_DRAW);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            GLint startAfterShrink = -1;
+            GLint sizeAfterShrink = -1;
+            GLint64 sizeAfterShrink64 = -1;
+            glGetIntegeri_v(GL_SHADER_STORAGE_BUFFER_START, 1, &startAfterShrink);
+            glGetIntegeri_v(GL_SHADER_STORAGE_BUFFER_SIZE, 1, &sizeAfterShrink);
+            glGetInteger64i_v(GL_SHADER_STORAGE_BUFFER_SIZE, 1, &sizeAfterShrink64);
+            EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            EXPECT_EQ(startAfterShrink, 256)
+                << "the bound range's start followed the buffer through a re-specification";
+            EXPECT_EQ(sizeAfterShrink, 512)
+                << "the bound range's size was clamped to the buffer's current 128-byte storage; the range is "
+                   "state of the BINDING POINT and is reported verbatim";
+            EXPECT_EQ(sizeAfterShrink64, static_cast<GLint64>(512))
+                << "the 64-bit width disagreed with the 32-bit one about the same pname";
+
+            glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 1, 0);
+            glDeleteBuffers(1, &buffer);
+            (void)FirstGLError();
+        }
+
+        TEST_F(AdvertisedLimitsScenario, ImageUnitBindingsAreReportedFromTheFrontendState) {
+            GLint maxImageUnits = 0;
+            glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+            (void)FirstGLError();
+            if (maxImageUnits < 2) GTEST_SKIP() << "no image units to bind on this lane";
+
+            GLuint texture = 0;
+            glGenTextures(1, &texture);
+            glBindTexture(GL_TEXTURE_2D, texture);
+            glTexStorage2D(GL_TEXTURE_2D, 2, GL_RGBA8, 8, 8);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+
+            glBindImageTexture(1, texture, 1, GL_FALSE, 0, GL_READ_ONLY, GL_RGBA8);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+
+            struct Expectation {
+                GLenum pname;
+                const char* name;
+                GLint expected;
+            };
+            const Expectation expectations[] = {
+                {GL_IMAGE_BINDING_NAME, "GL_IMAGE_BINDING_NAME", static_cast<GLint>(texture)},
+                {GL_IMAGE_BINDING_LEVEL, "GL_IMAGE_BINDING_LEVEL", 1},
+                {GL_IMAGE_BINDING_LAYERED, "GL_IMAGE_BINDING_LAYERED", GL_FALSE},
+                {GL_IMAGE_BINDING_LAYER, "GL_IMAGE_BINDING_LAYER", 0},
+                {GL_IMAGE_BINDING_ACCESS, "GL_IMAGE_BINDING_ACCESS", GL_READ_ONLY},
+                {GL_IMAGE_BINDING_FORMAT, "GL_IMAGE_BINDING_FORMAT", GL_RGBA8},
+            };
+            for (const Expectation& expectation : expectations) {
+                GLint value = -424242;
+                glGetIntegeri_v(expectation.pname, 1, &value);
+                EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << expectation.name;
+                EXPECT_EQ(value, expectation.expected) << expectation.name;
+
+                // Same pname through the wide width - it must not fall through to a driver that
+                // knows nothing about MobileGL's image-unit state.
+                GLint64 wide = -424242;
+                glGetInteger64i_v(expectation.pname, 1, &wide);
+                EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << expectation.name << " (64-bit)";
+                EXPECT_EQ(wide, static_cast<GLint64>(expectation.expected)) << expectation.name << " (64-bit)";
+            }
+
+            glBindImageTexture(1, 0, 0, GL_FALSE, 0, GL_READ_ONLY, GL_RGBA8);
+            glDeleteTextures(1, &texture);
+            (void)FirstGLError();
+        }
+
+        // glGetProgramiv(GL_COMPUTE_WORK_GROUP_SIZE) is a LINK ARTIFACT of the program the
+        // application wrote. DirectVulkan used to answer it from its own spirv-reflect cache and
+        // DirectGLES by forwarding to the driver's ESSL program - neither of which the
+        // application ever named - while GL_Program.cpp has always answered it from
+        // ProgramObject::GetComputeLocalSize. This pins the declared local size on both lanes.
+        TEST_F(AdvertisedLimitsScenario, ComputeLocalSizeComesFromTheLinkedProgram) {
+            static const char* kSource = R"(#version 430 core
+layout(local_size_x = 4, local_size_y = 3, local_size_z = 2) in;
+layout(std430, binding = 0) buffer Output { uint g_data[]; };
+void main() { g_data[gl_LocalInvocationIndex] = 1u; }
+)";
+            const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+            glShaderSource(shader, 1, &kSource, nullptr);
+            glCompileShader(shader);
+            GLint compiled = 0;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+            if (compiled == GL_FALSE) {
+                char log[2048] = {};
+                glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                glDeleteShader(shader);
+                (void)FirstGLError();
+                GTEST_SKIP() << "no compute shader support on this lane: " << log;
+            }
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, shader);
+            glLinkProgram(program);
+            glDeleteShader(shader);
+            GLint linked = 0;
+            glGetProgramiv(program, GL_LINK_STATUS, &linked);
+            if (linked == GL_FALSE) {
+                char log[2048] = {};
+                glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                glDeleteProgram(program);
+                (void)FirstGLError();
+                GTEST_SKIP() << "the compute program did not link on this lane: " << log;
+            }
+
+            GLint localSize[3] = {-1, -1, -1};
+            glGetProgramiv(program, GL_COMPUTE_WORK_GROUP_SIZE, localSize);
+            EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            EXPECT_EQ(localSize[0], 4);
+            EXPECT_EQ(localSize[1], 3);
+            EXPECT_EQ(localSize[2], 2);
+
+            // A program with no compute stage must answer INVALID_OPERATION, not a stale or
+            // defaulted (1, 1, 1) - the frontend's rule, and the one a backend that answers from
+            // its own reflection cache cannot express.
+            const GLuint empty = glCreateProgram();
+            GLint ignored[3] = {0, 0, 0};
+            glGetProgramiv(empty, GL_COMPUTE_WORK_GROUP_SIZE, ignored);
+            EXPECT_EQ(FirstGLError(), GLenum(GL_INVALID_OPERATION))
+                << "GL 4.6 core 7.13: the query is only defined for a linked program with a compute shader";
+
+            glDeleteProgram(empty);
+            glDeleteProgram(program);
+            (void)FirstGLError();
+        }
+
+        // THE SIX COMPUTE LIMITS THAT OUTLIVE THE GETTER. GL_MAX_COMPUTE_WORK_GROUP_COUNT and
+        // GL_MAX_COMPUTE_WORK_GROUP_SIZE, three axes each, are the only indexed pnames the
+        // DEVICE answers rather than the frontend (glGetIntegeri_v on Espryt, VkPhysicalDevice-
+        // Limits on Magma), and therefore the only ones that have to cross the MGPipe boundary
+        // once GetIntegeri_v is retired (plan B section 4.4.6 / P0.5). They ride in MGPCaps by
+        // inclusion, as DynamicBackendParameters::MaxComputeWorkGroupCount/Size, filled by both
+        // backends at capability init. This case pins that the caps copy and the live getter
+        // answer are one number - the getter floors the backend's raw answer at the GL 4.3
+        // minimum, so the comparison is against the floored caps value - and pins the
+        // GL-visible half on every lane: answerability, the floors, vector/indexed agreement
+        // and the index bound. On a lane where the caps block is out of reach (Android links
+        // the shipping .so) only the GL-visible half runs.
+        TEST_F(AdvertisedLimitsScenario, ComputeWorkGroupLimitsAreTheCapsBlocksAnswer) {
+            struct Axis {
+                GLenum pname;
+                const char* name;
+                GLint minimum[3]; // GL 4.3 core table 23.60
+            };
+            const Axis axes[] = {
+                {GL_MAX_COMPUTE_WORK_GROUP_COUNT, "GL_MAX_COMPUTE_WORK_GROUP_COUNT", {65535, 65535, 65535}},
+                {GL_MAX_COMPUTE_WORK_GROUP_SIZE, "GL_MAX_COMPUTE_WORK_GROUP_SIZE", {1024, 1024, 64}},
+            };
+            int capsCount[3] = {0, 0, 0};
+            int capsSize[3] = {0, 0, 0};
+            const bool capsVisible = PeekComputeWorkGroupCaps(capsCount, capsSize);
+
+            for (const Axis& axis : axes) {
+                GLint indexed[3] = {-1, -1, -1};
+                for (GLuint i = 0; i < 3; ++i) {
+                    glGetIntegeri_v(axis.pname, i, &indexed[i]);
+                    ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << axis.name << "[" << i << "]";
+                    EXPECT_GE(indexed[i], axis.minimum[i])
+                        << axis.name << "[" << i << "] = " << indexed[i]
+                        << " is below the GL 4.3 core table 23.60 minimum " << axis.minimum[i];
+                }
+                GLint vector[3] = {-1, -1, -1};
+                glGetIntegerv(axis.pname, vector);
+                ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << axis.name;
+                for (int i = 0; i < 3; ++i) {
+                    EXPECT_EQ(vector[i], indexed[i])
+                        << axis.name << "[" << i << "]: the vector query and the indexed query disagree";
+                }
+                GLint outOfRange = -424242;
+                glGetIntegeri_v(axis.pname, 3, &outOfRange);
+                EXPECT_EQ(FirstGLError(), GLenum(GL_INVALID_VALUE))
+                    << axis.name << "[3]: an index past the three axes is INVALID_VALUE (GL 4.6 core 22.1)";
+
+                if (!capsVisible) continue;
+                const int* capsAxis = axis.pname == GL_MAX_COMPUTE_WORK_GROUP_COUNT ? capsCount : capsSize;
+                for (int i = 0; i < 3; ++i) {
+                    EXPECT_EQ(std::max(capsAxis[i], axis.minimum[i]), indexed[i])
+                        << axis.name << "[" << i << "]: MGPCaps carries " << capsAxis[i]
+                        << " but glGetIntegeri_v answers " << indexed[i]
+                        << " - the caps block and the getter path must be one number, because P0.5 retires "
+                           "the getter in favour of the caps";
+                }
+            }
+        }
+
     } // namespace
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/AtomicCounterScenario.cpp

@@ -226,25 +226,21 @@ void main() {
     }
 
     // A CPU glBufferSubData issued AFTER a dispatch, read back with NO further GPU work in
-    // between. The DirectGLES backend queues app SubData ranges for the draw-time staged-copy
-    // flush (the upload ring) instead of uploading in place, and readback of a GPU-written
-    // buffer overwrites the frontend shadow with the driver copy - so if the readback path
-    // forgets to flush the queued range first, the newer CPU write is REVERTED by the readback
-    // and offset 0 reads the dispatch's value instead of the reseed. Offset 4 pins the other
-    // direction: the flush must not clobber GPU results outside the written range.
+    // between. Each backend has its own way to invert this pair, and both are pinned here.
+    // DirectGLES queues app SubData ranges for the draw-time staged-copy flush (the upload
+    // ring) instead of uploading in place, and readback of a GPU-written buffer overwrites
+    // the frontend shadow with the driver copy - so if the readback path forgets to flush the
+    // queued range first, the newer CPU write is REVERTED by the readback and offset 0 reads
+    // the dispatch's value instead of the reseed. DirectVulkan adopts the buffer into
+    // coherent GPU memory the moment the dispatch resolves its descriptor, so the SubData
+    // write lands in the very bytes the GPU reads - while the dispatch still sits recorded in
+    // the deferred frame command buffer. Unless the frontend retires that pending work before
+    // writing the adopted store (BufferObject::UploadSubData), the dispatch executes ON TOP
+    // of the reseed and offset 0 reads reseed + increments instead of the reseed. Offset 4
+    // pins the other direction for both: the upload must leave bytes outside its range - the
+    // dispatch's results - untouched.
     TEST_F(AtomicCounterScenario, SubDataAfterDispatchSurvivesAnImmediateReadback) {
         if (!Ready() || IsSkipped()) return;
-        // DirectGLES-only for now. DirectVulkan fails this case with or without the upload
-        // ring, on revisions that predate it: its buffer uploads submit immediately while the
-        // dispatch sits in the deferred frame command buffer, so the GPU increments the
-        // RESEEDED value (reads 4242 + increments instead of 4242) - a pre-existing
-        // upload-vs-recorded-work ordering gap in that backend, kept visible here rather than
-        // silently absorbed. Un-skip once DirectVulkan orders app uploads against already
-        // recorded GPU work.
-        if (Gl().BackendName() != std::string("DirectGLES")) {
-            GTEST_SKIP() << "SubData-after-dispatch ordering is a known DirectVulkan gap; this case pins the "
-                            "DirectGLES readback pre-flush only";
-        }
 
         const GLuint zero = MakeCounterBuffer(0, {0u, 0u});
         MakeCounterBuffer(1, {0u});

MobileGL/MG_IntegrationTest/Scenarios/LargeArenaAdoptionScenario.cpp

@@ -0,0 +1,278 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/LargeArenaAdoptionScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - MESH-ARENA-SIZED BUFFERS, END TO END.
+//
+// A buffer store of at least 16MiB is adopted into the backend's persistently and
+// coherently mapped GPU storage the moment it is defined (BufferObject::
+// TryAdoptLargeStorage): the CPU shadow is dropped and every later write lands
+// directly in GPU-visible memory with no per-write driver call. Minecraft 26.3
+// streams chunk meshes into 128MB vertex arenas with plain glNamedBufferSubData -
+// on Mali, every driver-mediated route for that write into a busy mutable store
+// either parks the calling thread or ghost-copies the whole arena on a driver
+// worker (~167ms per touched arena: the recurring in-world hiccup this adoption
+// removed). Every existing buffer scenario uses stores far below the threshold,
+// so without this file the adopted path would have zero coverage.
+//
+// What is pinned, deliberately through the same API mix Minecraft uses:
+//   * a glBufferSubData written AFTER the arena was drawn (in flight) reaches the
+//     next draw - the write-visibility contract adoption must not weaken;
+//   * GetBufferSubData reads back the latest CPU write - the shadow IS the map;
+//   * a compute-shader write through an SSBO binding of the same arena is read
+//     back - the GPU-written path for adopted stores (glFinish + direct read).
+
+#include <array>
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // Comfortably past the 16MiB adoption threshold, and the vertex payload sits
+        // deep inside the store so an implementation that quietly clamped or aliased
+        // the adopted range would miss it.
+        constexpr GLsizeiptr kArenaBytes = GLsizeiptr(24) * 1024 * 1024;
+        constexpr GLintptr kVertexOffset = GLintptr(20) * 1024 * 1024;
+
+        constexpr const char* kVertexSource = R"(#version 430 core
+layout(location = 0) in vec2 a_pos;
+layout(location = 1) in vec3 a_color;
+out vec3 v_color;
+void main() {
+    v_color = a_color;
+    gl_Position = vec4(a_pos, 0.0, 1.0);
+}
+)";
+
+        constexpr const char* kFragmentSource = R"(#version 430 core
+in vec3 v_color;
+out vec4 o_color;
+void main() { o_color = vec4(v_color, 1.0); }
+)";
+
+        constexpr const char* kMarkerComputeSource = R"(#version 430 core
+layout(local_size_x = 1) in;
+layout(std430, binding = 0) buffer Arena { uint word; };
+void main() { word = 0xC0FFEEu; }
+)";
+
+        struct Vertex {
+            float x, y;
+            float r, g, b;
+        };
+
+        // A full-viewport quad, colored uniformly so one center readback speaks for
+        // the whole draw.
+        std::vector<Vertex> QuadVertices(float r, float g, float b) {
+            return {
+                {-1.f, -1.f, r, g, b}, {1.f, -1.f, r, g, b}, {1.f, 1.f, r, g, b},
+                {-1.f, -1.f, r, g, b}, {1.f, 1.f, r, g, b},  {-1.f, 1.f, r, g, b},
+            };
+        }
+
+        class LargeArenaAdoptionScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                m_program = LinkProgram(kVertexSource, kFragmentSource);
+                ASSERT_NE(m_program, 0u) << m_buildLog;
+
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_arena);
+                glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+                // The NULL-data definition is the adoption point (and Minecraft's
+                // arena-creation idiom).
+                glBufferData(GL_ARRAY_BUFFER, kArenaBytes, nullptr, GL_DYNAMIC_DRAW);
+                glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, sizeof(Vertex),
+                                      reinterpret_cast<void*>(kVertexOffset));
+                glVertexAttribPointer(1, 3, GL_FLOAT, GL_FALSE, sizeof(Vertex),
+                                      reinterpret_cast<void*>(kVertexOffset + 2 * sizeof(float)));
+                glEnableVertexAttribArray(0);
+                glEnableVertexAttribArray(1);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_arena != 0) glDeleteBuffers(1, &m_arena);
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_compute != 0) glDeleteProgram(m_compute);
+                m_vao = 0;
+                m_arena = 0;
+                m_program = 0;
+                m_compute = 0;
+            }
+
+            unsigned int CompileStage(GLenum stage, const char* source) {
+                const GLuint shader = glCreateShader(stage);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                return shader;
+            }
+
+            unsigned int LinkProgram(const char* vs, const char* fs) {
+                const GLuint v = CompileStage(GL_VERTEX_SHADER, vs);
+                if (v == 0) return 0;
+                const GLuint f = CompileStage(GL_FRAGMENT_SHADER, fs);
+                if (f == 0) {
+                    glDeleteShader(v);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, v);
+                glAttachShader(program, f);
+                glLinkProgram(program);
+                glDeleteShader(v);
+                glDeleteShader(f);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            void UploadQuad(float r, float g, float b) {
+                const auto vertices = QuadVertices(r, g, b);
+                glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+                glBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                                GLsizeiptr(vertices.size() * sizeof(Vertex)), vertices.data());
+            }
+
+            void DrawQuad() {
+                glViewport(0, 0, Gl().Width(), Gl().Height());
+                glClearColor(0.f, 0.f, 0.f, 1.f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glUseProgram(m_program);
+                glBindVertexArray(m_vao);
+                glDrawArrays(GL_TRIANGLES, 0, 6);
+            }
+
+            std::array<unsigned char, 4> CenterPixel() {
+                std::array<unsigned char, 4> px = {0, 0, 0, 0};
+                glReadPixels(Gl().Width() / 2, Gl().Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE,
+                             px.data());
+                return px;
+            }
+
+            unsigned int m_program = 0;
+            unsigned int m_compute = 0;
+            unsigned int m_vao = 0;
+            unsigned int m_arena = 0;
+            std::string m_buildLog;
+        };
+
+    } // namespace
+
+    // The Minecraft shape: the arena is drawn, the frame retires, and a
+    // glBufferSubData rewrites the SAME vertex bytes while the previous frame's
+    // draw may still be in flight. The next draw must show the NEW bytes.
+    TEST_F(LargeArenaAdoptionScenario, SubDataAfterAnInFlightDrawReachesTheNextDraw) {
+        if (!Ready() || IsSkipped()) return;
+
+        UploadQuad(1.f, 0.f, 0.f);
+        DrawQuad();
+        auto px = CenterPixel();
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_GT(px[0], 200) << "the first draw from the adopted arena never landed";
+        EXPECT_LT(px[1], 50);
+
+        Gl().EndFrame();
+
+        UploadQuad(0.f, 1.f, 0.f);
+        DrawQuad();
+        px = CenterPixel();
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_GT(px[1], 200) << "the cross-frame rewrite of the adopted arena did not reach the draw; "
+                                 "the old color means the write went to bytes the draw no longer reads";
+        EXPECT_LT(px[0], 50) << "the draw still shows the previous frame's bytes";
+    }
+
+    // The shadow IS the mapping: a readback straight after a CPU write must hand
+    // back exactly those bytes.
+    TEST_F(LargeArenaAdoptionScenario, ReadbackSeesTheLatestCpuWrite) {
+        if (!Ready() || IsSkipped()) return;
+
+        const auto vertices = QuadVertices(0.25f, 0.5f, 0.75f);
+        glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+        glBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                        GLsizeiptr(vertices.size() * sizeof(Vertex)), vertices.data());
+        std::vector<Vertex> read(vertices.size());
+        glGetBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                           GLsizeiptr(read.size() * sizeof(Vertex)), read.data());
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(0, std::memcmp(read.data(), vertices.data(), read.size() * sizeof(Vertex)))
+            << "GetBufferSubData of the adopted arena returned different bytes than the SubData wrote";
+    }
+
+    // A GPU write through an SSBO binding of the adopted arena must be visible to
+    // a CPU readback - the path that waits out the GPU and reads the coherent
+    // mapping directly.
+    TEST_F(LargeArenaAdoptionScenario, GpuWriteIntoTheArenaIsReadBack) {
+        if (!Ready() || IsSkipped()) return;
+
+        GLint maxComputeStorageBlocks = 0;
+        glGetIntegerv(GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS, &maxComputeStorageBlocks);
+        if (maxComputeStorageBlocks < 1) {
+            GTEST_SKIP() << "no compute shader storage blocks on this driver";
+        }
+        const GLuint compute = CompileStage(GL_COMPUTE_SHADER, kMarkerComputeSource);
+        ASSERT_NE(compute, 0u) << m_buildLog;
+        m_compute = glCreateProgram();
+        glAttachShader(m_compute, compute);
+        glLinkProgram(m_compute);
+        glDeleteShader(compute);
+        GLint linked = 0;
+        glGetProgramiv(m_compute, GL_LINK_STATUS, &linked);
+        ASSERT_EQ(linked, GL_TRUE);
+
+        const unsigned int seed = 0u;
+        glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+        glBufferSubData(GL_ARRAY_BUFFER, 0, sizeof(seed), &seed);
+        glBindBufferRange(GL_SHADER_STORAGE_BUFFER, 0, m_arena, 0, sizeof(unsigned int));
+        glUseProgram(m_compute);
+        glDispatchCompute(1, 1, 1);
+        glMemoryBarrier(GL_SHADER_STORAGE_BARRIER_BIT | GL_BUFFER_UPDATE_BARRIER_BIT);
+
+        unsigned int marker = 0;
+        glGetBufferSubData(GL_ARRAY_BUFFER, 0, sizeof(marker), &marker);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(marker, 0xC0FFEEu)
+            << "the compute write into the adopted arena did not reach the CPU readback";
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PipeVerifyArmingScenario.cpp

@@ -0,0 +1,269 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PipeVerifyArmingScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - THE MOBILEGL_PIPE_VERIFY COMPARATOR IS ARMED, AND SAYS SO, AND CAN GO RED.
+//
+// The third CI mode (ARCHITECTURE.md 13.2-(2)) runs the whole integration suite with two state
+// models in one address space: the PipeInputs block the frontend fills at every verb boundary,
+// and a SnapshotFromGLContext() taken from the live GLContext. A green run of that mode is only
+// worth something if the comparator was actually RUNNING - and "MOBILEGL_PIPE_VERIFY=1 against a
+// library that was not built with -DMOBILEGL_PIPE_VERIFY=ON" is a no-op that looks exactly like a
+// clean pass. That is the failure mode this scenario exists to make impossible:
+//
+//   Armed                    - the environment says the comparator is on for this process, so the
+//                              library must SAY it armed. It asserts a library observable against
+//                              the environment, the same shape UnlocatedIoBlockScenario's arming
+//                              case and AsyncCompileScenario::ExtensionStringMatchesTheConfiguration
+//                              use. A lane whose library never armed FAILS here; it never passes.
+//   CorruptedFieldIsReported - the negative control for the comparator itself (gate G4). With
+//                              MOBILEGL_PIPE_VERIFY_CORRUPT naming a field, the snapshot arm is
+//                              perturbed before the entry compare, so a comparator that works must
+//                              report Fatal{PipeVerifyDiffer, "<Field>@<Verb>"}. A comparator that
+//                              compares nothing stays quiet and this case goes red.
+//
+// The observable is the library's own log, because MG_Config is not reachable from this module
+// (on Android it links the SHIPPING libMobileGL.so, built -fvisibility=hidden) and the arming
+// signal is a latched MGLOG_I. The ctest entry sets MOBILEGL_LOG_FILE_PATH; this only reads it.
+//
+// Note on scope, and why Armed runs in a lane of its own. The log file is opened with
+// fopen(path, "w") at the first log write of a process (MG_Util/Debug/Log.cpp, InitFile), so each
+// process TRUNCATES it. That is fine for one process and false for many: in the ambient Verify.
+// lane, 400-odd sibling entries share the one MOBILEGL_LOG_FILE_PATH, and CI runs that lane with
+// `ctest -j 4`, so a neighbour's bring-up can truncate the file between this case's draw and its
+// read. Every existing scenario in this suite that reads the library log (UnlocatedIoBlockScenario,
+// the primgen reroute, the point-size demotion) is registered in a FILTERED lane with a log path of
+// its own for exactly that reason, and this case now follows them: it runs in the VerifyArming.
+// entries, which set MGITEST_PIPE_ARMING_LANE=1 and their own log, and skips everywhere else.
+//
+// What that proves, stated honestly: the arming line is a property of (this library, this
+// environment), not of an individual test body, and the VerifyArming. entry runs the same library
+// with the same MOBILEGL_PIPE_VERIFY=1 as its ~400 ambient siblings. One process per backend is
+// therefore the whole of the evidence available for "the lane armed" - the per-process claim the
+// shared log CANNOT support, because it only ever holds the last writer.
+//
+// Within the process: the arming line is latched at the FIRST fill, which may be the harness
+// bring-up rather than this test's draw, so the arming search is whole-file on purpose; the
+// divergence search is restricted to the bytes this case appended, which is where a differ belongs.
+
+#include <cstdint>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <string>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // The three strings the comparator contracts to print (the brief's D8 reporting shape).
+        // They are spelled here once so a rename of either half is one compile-visible edit.
+        constexpr const char* kArmedLine = "MGPipe: verify armed";
+        constexpr const char* kDifferPrefix = "Fatal{PipeVerifyDiffer";
+        constexpr const char* kUnmigratedPrefix = "Fatal{UnmigratedPipeInput";
+
+        // Set by the VerifyArming. ctest entries and by nothing else. It is a HARNESS variable, not
+        // a library knob (hence the MGITEST_ prefix): the library never reads it. It exists because
+        // this case reads a log file, and a log file is a per-LANE resource - see the note at the
+        // top of the file.
+        constexpr const char* kArmingLaneMarker = "MGITEST_PIPE_ARMING_LANE";
+
+        constexpr const char* kVS = R"(#version 330 core
+in vec2 aPos;
+void main() { gl_Position = vec4(aPos, 0.0, 1.0); }
+)";
+
+        constexpr const char* kFS = R"(#version 330 core
+out vec4 o_color;
+void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
+)";
+
+        // Reads the environment the way MG_ConfigLoader does (ScenarioFixture.h documents the
+        // rule); a string knob is "set" when it is present and non-empty, which is exactly what
+        // MG_ConfigLoader's QueryEnvVariable turns into a non-empty Features member.
+        bool StringKnobIsSet(const char* name) {
+            const char* value = std::getenv(name);
+            return value != nullptr && *value != '\0';
+        }
+
+        class PipeVerifyArmingScenario : public ScenarioTest {
+        protected:
+            // The library log this process is writing, or an empty path when none was configured.
+            static std::filesystem::path LibraryLogPath() {
+                const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+                return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                          : std::filesystem::path();
+            }
+
+            static std::uintmax_t LibraryLogSize() {
+                std::error_code ec;
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return 0;
+                const std::uintmax_t size = std::filesystem::file_size(path, ec);
+                return ec ? 0 : size;
+            }
+
+            static std::string LibraryLogSince(std::uintmax_t offset) {
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return {};
+                std::ifstream file(path, std::ios::binary);
+                if (!file.good()) return {};
+                file.seekg(static_cast<std::streamoff>(offset));
+                return std::string((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+            }
+
+            static std::string LibraryLog() { return LibraryLogSince(0); }
+
+            // One frame that crosses several verb boundaries: a clear (kClear), a draw (kDraw) and
+            // a readback (kReadback). Three of the nine fill classes, so an entry compare that only
+            // ran for one of them still has something to say.
+            void DrawOneFrame() {
+                HeadlessGL& gl = Gl();
+                std::string error;
+                const unsigned int program = CompileProgram(kVS, kFS, &error);
+                ASSERT_NE(program, 0u) << error;
+
+                static const float kQuad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+                GLuint vao = 0;
+                GLuint vbo = 0;
+                glGenVertexArrays(1, &vao);
+                glBindVertexArray(vao);
+                glGenBuffers(1, &vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, vbo);
+                glBufferData(GL_ARRAY_BUFFER, sizeof(kQuad), kQuad, GL_STATIC_DRAW);
+                glEnableVertexAttribArray(0);
+                glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+
+                BindDefaultFramebuffer();
+                glViewport(0, 0, gl.Width(), gl.Height());
+                ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+                glUseProgram(program);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+
+                Rgba8 pixel{};
+                glReadPixels(gl.Width() / 2, gl.Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, &pixel);
+
+                glBindVertexArray(0);
+                glDeleteBuffers(1, &vbo);
+                glDeleteVertexArrays(1, &vao);
+                m_centre = pixel;
+            }
+
+            Rgba8 m_centre{};
+        };
+
+        // THE CASE THAT FAILS A LANE WHOSE LIBRARY NEVER ARMED.
+        //
+        // Every other entry in the integration-verify lane renders the same frames it renders in the
+        // ambient lane and would be just as green against a library with no comparator compiled in -
+        // which is precisely how a verify lane goes green having verified nothing. This case is the
+        // one that cannot: the environment pins MOBILEGL_PIPE_VERIFY=1, therefore the library must
+        // have said "MGPipe: verify armed" in its own log, and if it did not, the mode is not running.
+        TEST_F(PipeVerifyArmingScenario, Armed) {
+            if (!Ready()) return;
+
+            if (!StringKnobIsSet(kArmingLaneMarker)) {
+                GTEST_SKIP() << "this case reads the library's log file, so it runs in the VerifyArming. "
+                                "lane, which owns a log path no other entry writes to. In the ambient "
+                                "Verify. lane 400-odd entries share one path and each truncates it "
+                                "(Log.cpp opens it \"w\"), so a whole-file read here would race a "
+                                "neighbour under ctest -j 4. Set by the ctest entry, never by hand.";
+            }
+            if (AmbientQuirkFromEnvironment("MOBILEGL_PIPE_VERIFY") != AmbientQuirk::On) {
+                GTEST_SKIP() << "this case needs MOBILEGL_PIPE_VERIFY=1 for the whole process, which is "
+                                "what the Verify. ctest entries set; with the variable unset the "
+                                "comparator is dormant even in a build that compiled it in";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_PIPE_VERIFY is pinned on but MOBILEGL_LOG_FILE_PATH is not "
+                                "set, so the library has nowhere to record that it armed; the Verify. "
+                                "ctest entries set both";
+            }
+            if (StringKnobIsSet("MOBILEGL_PIPE_VERIFY_CORRUPT")) {
+                GTEST_SKIP() << "MOBILEGL_PIPE_VERIFY_CORRUPT is armed in this process, so a divergence "
+                                "is the EXPECTED outcome and asserting on its absence here would be "
+                                "backwards; the VerifyCorrupted. lane owns that half";
+            }
+
+            const std::uintmax_t before = LibraryLogSize();
+            ASSERT_NO_FATAL_FAILURE(DrawOneFrame());
+            EXPECT_EQ(FirstGLError(), 0u);
+
+            // Whole file, not just the appended bytes: the arming line is latched at the FIRST fill
+            // of the process, which may already have happened during the harness bring-up. The file
+            // is truncated at this process's first log write, so it still carries nothing else.
+            const std::string whole = LibraryLog();
+            EXPECT_NE(whole.find(kArmedLine), std::string::npos)
+                << "MOBILEGL_PIPE_VERIFY=1 is set for this process and a frame was cleared, drawn and "
+                   "read back, and the library never reported arming the comparator. Either this "
+                   "library was not built with -DMOBILEGL_PIPE_VERIFY=ON (in which case the whole lane "
+                   "is verifying nothing), or the arming MGLOG_I is gone. Log:\n"
+                << whole;
+
+            const std::string appended = LibraryLogSince(before);
+            EXPECT_EQ(appended.find(kDifferPrefix), std::string::npos)
+                << "the comparator reported a push/pull divergence on an ordinary frame:\n"
+                << appended;
+            EXPECT_EQ(appended.find(kUnmigratedPrefix), std::string::npos)
+                << "a backend read a field the verb's fill table does not list (add the row to "
+                   "MG_Pipe/FillPoints.def, never mark the field sticky):\n"
+                << appended;
+        }
+
+        // NEGATIVE CONTROL A (gate G4): a deliberately corrupted snapshot field must turn a green
+        // verify run red, naming that field and the verb it diverged on.
+        //
+        // It runs in its own lane (VerifyCorrupted.) because the knob is process-wide, and with
+        // MOBILEGL_PIPE_VERIFY_FATAL=0 so the process survives its own divergence and this case can
+        // read the report back out of the log. The CI step that runs the SAME knob against the
+        // ambient lane - where FATAL keeps its default - asserts the other half: there, the
+        // divergence must abort and ctest must go red.
+        TEST_F(PipeVerifyArmingScenario, CorruptedFieldIsReported) {
+            if (!Ready()) return;
+
+            if (!StringKnobIsSet("MOBILEGL_PIPE_VERIFY_CORRUPT")) {
+                GTEST_SKIP() << "this case is the comparator's negative control and needs "
+                                "MOBILEGL_PIPE_VERIFY_CORRUPT=<FieldName> for the whole process, which "
+                                "is what the VerifyCorrupted. ctest entries set";
+            }
+            if (AmbientQuirkFromEnvironment("MOBILEGL_PIPE_VERIFY") != AmbientQuirk::On) {
+                GTEST_SKIP() << "MOBILEGL_PIPE_VERIFY_CORRUPT is set but MOBILEGL_PIPE_VERIFY is not, so "
+                                "the comparator is dormant and there is nothing to corrupt";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_LOG_FILE_PATH is not set, so the library has nowhere to report "
+                                "the divergence; the VerifyCorrupted. ctest entries set both";
+            }
+
+            const std::string knob = std::getenv("MOBILEGL_PIPE_VERIFY_CORRUPT");
+            const std::uintmax_t before = LibraryLogSize();
+            ASSERT_NO_FATAL_FAILURE(DrawOneFrame());
+
+            const std::string appended = LibraryLogSince(before);
+            const std::string expected = std::string(kDifferPrefix) + ", \"" + knob + "@";
+            EXPECT_NE(appended.find(expected), std::string::npos)
+                << "MOBILEGL_PIPE_VERIFY_CORRUPT=" << knob
+                << " perturbs that field in the snapshot arm before every entry compare, so a working "
+                   "comparator must have reported " << expected << "...\". It reported nothing, which "
+                   "means the comparator is not comparing - and every green entry in this lane is "
+                   "green for no reason. Log appended by this case:\n"
+                << appended;
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PointSizeDemotionScenario.cpp

@@ -0,0 +1,522 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PointSizeDemotionScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - THE gl_PointSize DEMOTION IS CLIENT-INVISIBLE, AND IT ACTUALLY ARMS.
+//
+// On a device that hosts the built-in in tessellation/geometry stages (llvmpipe and
+// lavapipe both do), gl_PointSize travels as itself; on one that does not (the Mali
+// devices this exists for), phase B demotes it to an ordinary varying
+// (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram) and the capture
+// machinery follows it there. This scenario runs in BOTH configurations and must hand
+// back identical bytes: the ambient registrations take the native path, and the
+// PointSizeDemotion. registrations pin MOBILEGL_POINT_SIZE_DEMOTION=1 so the demotion
+// runs on the same healthy drivers - CopyImagePacked16Scenario's dual-configuration
+// contract, applied to a value chain instead of a storage format.
+//
+// The VALUE is the whole contract: every case writes gl_PointSize in one stage, reads it
+// back out of gl_in[] in the next, and captures it by name under rasterizer discard, so
+// one wrong link anywhere in VS -> TCS -> TES -> GS -> capture lands in the readback.
+// The RASTERIZED size is deliberately not asserted anywhere: with the built-in unhosted
+// it falls back to 1.0 by spec on both targets, which is exactly the honest residue the
+// demotion documents (point_rendering-style bodies keep failing truthfully).
+//
+// The assertions are on the captured BYTES against a CPU-computed reference, never on
+// the absence of a GL error: every failure this guards against is silent.
+
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr float kPoison = -987654.0f;
+
+        const char* const kFragmentSource = R"(#version 460 core
+layout(location = 0) out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(1.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        // The full chain, with per-vertex VARIATION seeded in the vertex stage so a control
+        // invocation that read or wrote the wrong slot changes the sum: 2,3,4 arrive, 3,4,5
+        // leave, the evaluation stage sums its patch to 12, the geometry stage doubles what
+        // it read to 24.
+        const char* const kChainVertexSource = R"(#version 460 core
+void main()
+{
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = 2.0 + float(gl_VertexID);
+}
+)";
+
+        const char* const kChainTessControlSource = R"(#version 460 core
+layout(vertices = 3) out;
+void main()
+{
+    gl_out[gl_InvocationID].gl_Position  = gl_in[gl_InvocationID].gl_Position;
+    gl_out[gl_InvocationID].gl_PointSize = gl_in[gl_InvocationID].gl_PointSize + 1.0;
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+}
+)";
+
+        const char* const kChainTessEvalSource = R"(#version 460 core
+layout(triangles, equal_spacing, cw, point_mode) in;
+void main()
+{
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = gl_in[0].gl_PointSize + gl_in[1].gl_PointSize + gl_in[2].gl_PointSize;
+}
+)";
+
+        const char* const kChainGeometrySource = R"(#version 460 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+void main()
+{
+    gl_Position  = gl_in[0].gl_Position;
+    gl_PointSize = gl_in[0].gl_PointSize * 2.0;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        // The geometry-only chain: no tessellation required of the stack at all.
+        const char* const kPointVertexSource = R"(#version 460 core
+void main()
+{
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = 7.0;
+}
+)";
+
+        const char* const kPointGeometrySource = R"(#version 460 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+void main()
+{
+    gl_Position  = gl_in[0].gl_Position;
+    gl_PointSize = gl_in[0].gl_PointSize + 1.0;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        // A capture stage that only READS the incoming point size and never writes its own.
+        // Legal GL, and the shape that separates "the demotion arms" from "the demotion knows
+        // a capture is coming": with the built-in gone, only the capture request can put a
+        // carrier back for a by-name capture to bind to.
+        const char* const kReadOnlyGeometrySource = R"(#version 460 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+out float g_echo;
+void main()
+{
+    gl_Position = gl_in[0].gl_Position;
+    g_echo      = gl_in[0].gl_PointSize;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        const char* const kEchoFragmentSource = R"(#version 460 core
+in float g_echo;
+layout(location = 0) out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(g_echo, 0.0, 0.0, 1.0);
+}
+)";
+
+        class PointSizeDemotionScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (Ready()) {
+                    glUseProgram(0);
+                    for (const GLuint program : m_programs) {
+                        glDeleteProgram(program);
+                    }
+                    m_programs.clear();
+                    glBindVertexArray(0);
+                    if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                    m_vao = 0;
+                }
+                ScenarioTest::TearDown();
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            static bool BackendHostsTessellation() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                DrainErrors();
+                return maxTessGenLevel >= 1;
+            }
+
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, length + 1, nullptr, buffer.data());
+                } else {
+                    glGetProgramInfoLog(object, length + 1, nullptr, buffer.data());
+                }
+                return buffer.data();
+            }
+
+            GLuint BuildCaptureProgram(const std::vector<std::pair<GLenum, const char*>>& stages,
+                                       const std::vector<const char*>& varyings) {
+                m_buildLog.clear();
+                std::vector<GLuint> shaders;
+                bool ok = true;
+                for (const auto& [stage, source] : stages) {
+                    const GLuint shader = glCreateShader(stage);
+                    glShaderSource(shader, 1, &source, nullptr);
+                    glCompileShader(shader);
+                    GLint compiled = 0;
+                    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                    shaders.push_back(shader);
+                    if (compiled == GL_FALSE) {
+                        m_buildLog = InfoLog(shader, true) + "\n--- source ---\n" + source;
+                        ok = false;
+                        break;
+                    }
+                }
+                GLuint program = 0;
+                if (ok) {
+                    program = glCreateProgram();
+                    for (const GLuint shader : shaders) {
+                        glAttachShader(program, shader);
+                    }
+                    glTransformFeedbackVaryings(program, static_cast<GLsizei>(varyings.size()),
+                                                varyings.data(), GL_INTERLEAVED_ATTRIBS);
+                    glLinkProgram(program);
+                    GLint linked = GL_FALSE;
+                    glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                    if (linked == GL_FALSE) {
+                        m_buildLog = InfoLog(program, false);
+                        glDeleteProgram(program);
+                        program = 0;
+                    }
+                }
+                for (const GLuint shader : shaders) {
+                    glDeleteShader(shader);
+                }
+                if (program != 0) m_programs.push_back(program);
+                return program;
+            }
+
+            // One capture span over `vertexCount` vertices of `drawMode`, recorded as
+            // GL_POINTS. The buffer is poison-filled first so bytes the capture never wrote
+            // name themselves.
+            std::vector<float> RunCaptureSpan(GLuint program, GLenum drawMode, GLsizei vertexCount,
+                                              std::size_t capturedFloats) {
+                const std::vector<float> poison(capturedFloats, kPoison);
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBuffer(GL_ARRAY_BUFFER, xfbBuffer);
+                glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(capturedFloats * sizeof(float)),
+                             poison.data(), GL_STATIC_COPY);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+                glBindVertexArray(m_vao);
+                glUseProgram(program);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(drawMode, 0, vertexCount);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+
+                std::vector<float> readback(capturedFloats, kPoison);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(capturedFloats * sizeof(float)),
+                                   readback.data());
+                glUseProgram(0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                glDeleteBuffers(1, &xfbBuffer);
+                return readback;
+            }
+
+            static ::testing::AssertionResult ComponentIs(const std::vector<float>& data,
+                                                          std::size_t index, float expected,
+                                                          float epsilon = 1e-4f) {
+                if (index >= data.size()) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " is past the capture buffer";
+                }
+                const float actual = data[index];
+                if (actual == kPoison) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " still holds the poison value - the capture "
+                           << "never reached these bytes (expected " << expected << ")";
+                }
+                if (std::isnan(actual) || std::abs(actual - expected) > epsilon) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " is " << actual << ", expected " << expected;
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            // The library log, for the arming case. Same machinery and same reasoning as
+            // UnlocatedIoBlockScenario: MOBILEGL_LOG_FILE_PATH is read at log-init, the file
+            // is appended to by every process in the lane, and only bytes appended after the
+            // snapshot may satisfy an assertion.
+            static std::filesystem::path LibraryLogPath() {
+                const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+                return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                          : std::filesystem::path();
+            }
+
+            static std::uintmax_t LibraryLogSize() {
+                std::error_code ec;
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return 0;
+                const std::uintmax_t size = std::filesystem::file_size(path, ec);
+                return ec ? 0 : size;
+            }
+
+            static std::string LibraryLogSince(std::uintmax_t offset) {
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return {};
+                std::ifstream file(path, std::ios::binary);
+                if (!file.good()) return {};
+                file.seekg(static_cast<std::streamoff>(offset));
+                return std::string((std::istreambuf_iterator<char>(file)),
+                                   std::istreambuf_iterator<char>());
+            }
+
+            std::string m_buildLog;
+
+        private:
+            GLuint m_vao = 0;
+            std::vector<GLuint> m_programs;
+        };
+
+        // The five-stage chain. 24.0 can only arrive if the vertex mirror, both control-stage
+        // redirects (read AND write), the evaluation stage's three gl_in reads and the
+        // geometry stage's read all carried the right value - one wrong link and the sum
+        // moves. point_mode with every level at 1 emits three points; the first record proves
+        // the mechanism, exactly as TessellationXfbCaptureScenario reasons.
+        TEST_F(PointSizeDemotionScenario, TheValueSurvivesTheFiveStageChainIntoTheCapture) {
+            if (!Ready()) return;
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " ("
+                             << Gl().RendererString() << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 3);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kChainVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kChainTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kChainTessEvalSource},
+                                                        {GL_GEOMETRY_SHADER, kChainGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_PATCHES, 3, 3);
+            EXPECT_TRUE(ComponentIs(captured, 0, 24.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The same chain without a geometry stage: the capture then binds to the evaluation
+        // stage's value (the sum, 12.0) - which is also the boundary where a demoted program
+        // switches its capture carrier from the Io chain to the capture name.
+        TEST_F(PointSizeDemotionScenario, TheEvaluationStageOwnsTheCaptureWithoutAGeometryStage) {
+            if (!Ready()) return;
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " ("
+                             << Gl().RendererString() << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 3);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kChainVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kChainTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kChainTessEvalSource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_PATCHES, 3, 3);
+            EXPECT_TRUE(ComponentIs(captured, 0, 12.0f));
+
+            // The GL query surface keeps the truthful spelling whatever the backends renamed
+            // underneath: reflection is a phase-A product and the demotion happens after it.
+            char varyingName[64] = {};
+            GLsizei nameLength = 0;
+            GLsizei varyingSize = 0;
+            GLenum varyingType = 0;
+            glGetTransformFeedbackVarying(program, 0, sizeof(varyingName), &nameLength, &varyingSize,
+                                          &varyingType, varyingName);
+            EXPECT_STREQ(varyingName, "gl_PointSize");
+            EXPECT_EQ(varyingType, static_cast<GLenum>(GL_FLOAT));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The geometry-only chain: gl_in[0].gl_PointSize read straight off the vertex stage,
+        // no tessellation involved - the VS -> GS boundary of the demotion on its own.
+        TEST_F(PointSizeDemotionScenario, AGeometryOnlyChainCarriesTheVertexValue) {
+            if (!Ready()) return;
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPointVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_POINTS, 1, 1);
+            EXPECT_TRUE(ComponentIs(captured, 0, 8.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // THE CAPTURE-REQUEST PATH, END TO END - the half no unit test can reach, because the
+        // request travels from glTransformFeedbackVaryings through phase A's resolved capture
+        // set and the phase-B handoff before it reaches the demotion.
+        //
+        // The geometry stage READS gl_in[0].gl_PointSize and never writes gl_PointSize, which
+        // is enough to arm the demotion (glslang declares GeometryPointSize on a read) but not
+        // enough to create an output carrier on its own. Only the capture request can, and if
+        // that request never arrives the program does not merely lose the point-size column:
+        // DirectGLES respells the driver-side capture to a name no stage declares and the
+        // WHOLE capture set fails to link, while DirectVulkan mirrors a built-in the demotion
+        // just removed and can unwind far enough to drop the Xfb execution mode. Either way
+        // g_echo - an ordinary varying with nothing to do with point size - comes back poison,
+        // which is what this asserts. gl_PointSize itself is captured but never asserted: no
+        // stage writes it, so GL leaves its value undefined.
+        TEST_F(PointSizeDemotionScenario, ACaptureSurvivesAStageThatOnlyReadsThePointSize) {
+            if (!Ready()) return;
+            // The NATIVE Espryt path cannot do this at all, and never could: with the built-in
+            // hosted, the geometry stage's ESSL simply does not declare gl_PointSize unless it
+            // writes it, so the driver rejects the capture request with "varying undeclared"
+            // and the program becomes unusable. That is a pre-existing ES limitation the
+            // demotion happens to REPAIR - the carrier is a real, seeded, declared varying -
+            // so this case has something to assert only where the demotion is armed. Magma
+            // consumes SPIR-V and answers on both paths, which keeps the negative control.
+            if (Gl().BackendName() == "DirectGLES" &&
+                AmbientQuirkFromEnvironment("MOBILEGL_POINT_SIZE_DEMOTION") != AmbientQuirk::On) {
+                GTEST_SKIP() << "Espryt cannot capture a gl_PointSize its capture stage never "
+                                "writes without the demotion; the PointSizeDemotion. ctest entry "
+                                "runs this same case with MOBILEGL_POINT_SIZE_DEMOTION=1";
+            }
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPointVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kReadOnlyGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kEchoFragmentSource}},
+                                                       {"g_echo", "gl_PointSize"});
+            ASSERT_NE(program, 0u)
+                << "the capture set failed to link. On a demoting configuration this is the "
+                   "capture request never reaching the demotion, so the point-size capture was "
+                   "respelled to a carrier no stage declares. Build log: "
+                << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_POINTS, 1, 2);
+            EXPECT_TRUE(ComponentIs(captured, 0, 7.0f))
+                << "the unrelated varying captured alongside gl_PointSize did not survive; the "
+                   "point-size capture took the whole set with it";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // THE ONE CASE THAT CAN FAIL WHEN THE DEMOTION SILENTLY STOPS BEING ARMED.
+        //
+        // Everything above captures the right bytes on llvmpipe and lavapipe whether the
+        // demotion ran or not - these machines host the built-in - so those cases pin that
+        // the demotion does no HARM and can say nothing about whether it happened. The
+        // arming is where the cheap mistake lives: MOBILEGL_POINT_SIZE_DEMOTION maps onto
+        // the two Supports*PointSize capability bits INVERTED (forcing the demotion on
+        // means declaring the built-in UNHOSTED), and a swap of those arms - or a dropped
+        // env bit anywhere between ConfigLoader, the backend init, CompileEnv and the L1
+        // key - would disable the device repair with every rendering case still green.
+        //
+        // Same machinery as UnlocatedIoBlockScenario's arming case: the environment says
+        // the demotion is pinned on, therefore the library must SAY it demoted something.
+        // The observable is the latched MGLOG_I each backend emits when it first builds a
+        // demoted program; both spell "demoted to an ordinary varying", so this one case
+        // covers both pinned lanes without a backend gate.
+        TEST_F(PointSizeDemotionScenario, TheDemotionIsActuallyArmedWhenTheEnvironmentPinsItOn) {
+            if (!Ready()) return;
+            if (AmbientQuirkFromEnvironment("MOBILEGL_POINT_SIZE_DEMOTION") != AmbientQuirk::On) {
+                GTEST_SKIP() << "this case needs the demotion pinned ON for the whole process, which "
+                                "is what the PointSizeDemotion. ctest entries do with "
+                                "MOBILEGL_POINT_SIZE_DEMOTION=1; with the variable unset the detected "
+                                "capabilities decide, and on this machine the built-in is hosted - so "
+                                "there would be nothing to observe";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_POINT_SIZE_DEMOTION is pinned on but MOBILEGL_LOG_FILE_PATH "
+                                "is not set, so the library has nowhere to record that it demoted "
+                                "anything; the PointSizeDemotion. ctest entries set both";
+            }
+
+            // Taken BEFORE the program is built, so the line this looks for can only be one
+            // this process wrote.
+            const std::uintmax_t before = LibraryLogSize();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPointVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+            // Drawn as well as built, so a stack that defers its backend program to first
+            // use still reaches the build the latched line fires in - and the capture must
+            // STILL be right through the carrier.
+            const std::vector<float> captured = RunCaptureSpan(program, GL_POINTS, 1, 1);
+            EXPECT_TRUE(ComponentIs(captured, 0, 8.0f))
+                << "the pinned-on lane did not even capture correctly";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+
+            const std::string appended = LibraryLogSince(before);
+            EXPECT_NE(appended.find("demoted to an ordinary varying"), std::string::npos)
+                << "MOBILEGL_POINT_SIZE_DEMOTION is pinned ON, a geometry program reading and "
+                   "writing gl_PointSize was built and captured, and no backend ever reported "
+                   "demoting it. The demotion is not armed - check the override mapping in the "
+                   "backend inits (it is inverted on purpose), the CompileEnv accessors, and "
+                   "ProgramSpirvTask's verdict plumbing. Log appended by this test:\n"
+                << appended;
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PoisonOmissionScenario.cpp

@@ -0,0 +1,413 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PoisonOmissionScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - NEGATIVE CONTROL B (gate G5): AN OMITTED FILL POINT ABORTS ON THAT VERB, AND ONLY THERE.
+//
+// The per-verb poison is the half of P1 that makes a forgotten fill row loud instead of silent: the
+// filler stamps a generation on every field it copies for a verb, and an accessor whose stamp is not
+// this verb's aborts with Fatal{UnmigratedPipeInput, "<Field>@<Verb>"}. A mechanism that can only be
+// observed when someone forgets a row is a mechanism nobody can trust, so MOBILEGL_PIPE_POISON_OMIT
+// forges the mistake on purpose: it names one (verb, field) pair whose STAMP the filler skips while
+// still copying the value, which is indistinguishable from a row that was never written.
+//
+// The scenario asserts both halves of "on THAT verb, and only there":
+//
+//   OmittedFieldAbortsOnThatVerb - with MOBILEGL_PIPE_POISON_OMIT=GenerateMipmap:GetActiveTextureUnit,
+//                                  a draw must still complete (GetActiveTextureUnit is not in kDraw's
+//                                  mask, and the draw's own fields are stamped normally) and the
+//                                  following glGenerateMipmap must abort naming exactly that pair.
+//   WithoutOmissionCompletes     - the identical sequence with the knob unset runs to completion with
+//                                  no Fatal at all. Without this half, "it aborted" would say nothing
+//                                  about WHY: a poison that fired on every verb would look just as red.
+//
+// The knob is process-wide, so the two cases cannot share a lane: the first runs in the PoisonOmitted.
+// entries, the second in the ambient Verify. entries (it skips when the knob IS set).
+//
+// WHY THE SEQUENCE RUNS IN A SEPARATE PROCESS, AND WHY THAT PROCESS IS fork()+execve() AND NOT fork()
+// ALONE. The poison reports with MGLOG_F and then std::abort(), in the middle of a GL command - so the
+// sequence cannot run in the test process, and the harness's own bring-up pre-flight
+// (Harness/HeadlessGL.cpp) already establishes the shape: run it where a SIGABRT is a datum in
+// waitpid() instead of a dead lane. But that pre-flight forks BEFORE any context exists, and this case
+// cannot: the fixture has already brought one up. A bare fork() of a process holding a live Vulkan
+// device inherits the driver's mutexes with no threads to release them, and the child wedges on its
+// first submit - measured here as a 120s timeout on DirectVulkan and a clean pass on DirectGLES, which
+// is exactly the kind of backend-shaped flake a control must not have. So the child immediately
+// execve()s a fresh copy of this same test binary, filtered to the worker case below, which brings up
+// its own context from scratch and knows nothing about the parent's.
+//
+// The child gets its OWN MOBILEGL_LOG_FILE_PATH for the same reason: the library opens its log with
+// fopen(path, "w"), so a child sharing the parent's path would truncate the file the parent is about
+// to read.
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#if !defined(_WIN32) && !defined(__APPLE__) && !defined(__ANDROID__) && __has_include(<sys/wait.h>)
+#define MGITEST_POISON_HAVE_FORK 1
+#include <csignal>
+#include <ctime>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+extern char** environ;
+#else
+#define MGITEST_POISON_HAVE_FORK 0
+#endif
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // What the PoisonOmitted. ctest entry and the CI negative-control step name. The pair is
+        // spelled here so the assertion below is about the exact string the poison contracts to
+        // print (ARCHITECTURE.md 9.2: Fatal{UnmigratedPipeInput, "<Field>@<Verb>"}).
+        constexpr const char* kOmittedVerb = "GenerateMipmap";
+        constexpr const char* kOmittedField = "GetActiveTextureUnit";
+        constexpr const char* kFatalPrefix = "Fatal{UnmigratedPipeInput";
+
+        // Set only in the re-executed child, so the worker case below runs in that process and skips
+        // everywhere else (including in the ambient lanes, where it is registered like any other case).
+        constexpr const char* kChildMarker = "MGITEST_POISON_OMISSION_CHILD";
+        constexpr const char* kWorkerFilter =
+            "--gtest_filter=PoisonOmissionScenario.TheSequenceThePoisonControlsRun";
+
+        constexpr const char* kVS = R"(#version 330 core
+in vec2 aPos;
+void main() { gl_Position = vec4(aPos, 0.0, 1.0); }
+)";
+
+        constexpr const char* kFS = R"(#version 330 core
+out vec4 o_color;
+void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
+)";
+
+        bool StringKnobIsSet(const char* name) {
+            const char* value = std::getenv(name);
+            return value != nullptr && *value != '\0';
+        }
+
+        std::filesystem::path LibraryLogPath() {
+            const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+            return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                      : std::filesystem::path();
+        }
+
+        // Where the child is told to write ITS log. Empty when the lane configured no log path at
+        // all, in which case the signal is the only evidence and the text assertions are skipped.
+        std::string ChildLogPath() {
+            const std::filesystem::path parent = LibraryLogPath();
+            if (parent.empty()) return {};
+            return (parent.string() + ".poison-child");
+        }
+
+        std::string ReadWholeFile(const std::string& path) {
+            if (path.empty()) return {};
+            std::ifstream file(path, std::ios::binary);
+            if (!file.good()) return {};
+            return std::string((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+        }
+
+        class PoisonOmissionScenario : public ScenarioTest {
+        protected:
+            // The sequence under test. Deliberately in this order: the DRAW comes first and must
+            // survive - if the poison fired there, the "only that verb" half would be false and the
+            // SIGABRT the parent waits for would prove nothing.
+            void RunSequence() {
+                HeadlessGL& gl = Gl();
+
+                std::string error;
+                const unsigned int program = CompileProgram(kVS, kFS, &error);
+                ASSERT_NE(program, 0u) << error;
+
+                // A two-level texture, so glGenerateMipmap has real work to do and cannot be
+                // short-circuited into a no-op by a backend that inspects the level count first.
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                glActiveTexture(GL_TEXTURE0);
+                glBindTexture(GL_TEXTURE_2D, texture);
+                unsigned char pixels[8 * 8 * 4];
+                for (std::size_t i = 0; i < sizeof(pixels); ++i) {
+                    pixels[i] = static_cast<unsigned char>(i);
+                }
+                glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 8, 8, 0, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+                glTexImage2D(GL_TEXTURE_2D, 1, GL_RGBA8, 4, 4, 0, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_BASE_LEVEL, 0);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, 3);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR_MIPMAP_LINEAR);
+
+                static const float kQuad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+                GLuint vao = 0;
+                GLuint vbo = 0;
+                glGenVertexArrays(1, &vao);
+                glBindVertexArray(vao);
+                glGenBuffers(1, &vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, vbo);
+                glBufferData(GL_ARRAY_BUFFER, sizeof(kQuad), kQuad, GL_STATIC_DRAW);
+                glEnableVertexAttribArray(0);
+                glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+
+                BindDefaultFramebuffer();
+                glViewport(0, 0, gl.Width(), gl.Height());
+                ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+                glUseProgram(program);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glFinish();
+                std::fprintf(stderr, "[itest] poison worker: the draw completed\n");
+
+                // The verb the omission names. Under MOBILEGL_PIPE_POISON_OMIT this must abort.
+                glBindTexture(GL_TEXTURE_2D, texture);
+                glGenerateMipmap(GL_TEXTURE_2D);
+                glFinish();
+                std::fprintf(stderr, "[itest] poison worker: glGenerateMipmap returned\n");
+
+                // The sequence is the WHOLE datum this child reports, so a GL error in it must be
+                // part of the answer rather than something only a human reading stderr would see.
+                // WithoutOmissionCompletes reads the child's exit status, and the status is built
+                // from HasFailure() below - so this EXPECT is what turns "the mipmap was rejected"
+                // into a red parent instead of a vacuous "it exited 0, the poison did not fire".
+                EXPECT_EQ(FirstGLError(), 0u)
+                    << "the draw + glGenerateMipmap sequence the poison controls are about raised a "
+                       "GL error, so neither control is measuring what it claims to measure";
+
+                glBindVertexArray(0);
+                glDeleteBuffers(1, &vbo);
+                glDeleteVertexArrays(1, &vao);
+                glDeleteTextures(1, &texture);
+            }
+
+#if MGITEST_POISON_HAVE_FORK
+            // fork() + execve() of this same binary, filtered to the worker case, with the marker and
+            // the child's own log path added to the environment. Everything that allocates happens
+            // BEFORE the fork; between fork and execve only async-signal-safe work is done.
+            static bool RunSequenceInAChildProcess(int& outStatus, std::string& outReason) {
+                std::vector<std::string> env;
+                for (char** entry = environ; entry != nullptr && *entry != nullptr; ++entry) {
+                    const std::string text(*entry);
+                    if (text.rfind("MOBILEGL_LOG_FILE_PATH=", 0) == 0) continue;
+                    if (text.rfind(std::string(kChildMarker) + "=", 0) == 0) continue;
+                    env.push_back(text);
+                }
+                env.push_back(std::string(kChildMarker) + "=1");
+                const std::string childLog = ChildLogPath();
+                if (!childLog.empty()) {
+                    std::error_code ec;
+                    std::filesystem::remove(childLog, ec);
+                    env.push_back("MOBILEGL_LOG_FILE_PATH=" + childLog);
+                }
+
+                std::vector<char*> envp;
+                envp.reserve(env.size() + 1);
+                for (std::string& entry : env) envp.push_back(entry.data());
+                envp.push_back(nullptr);
+
+                std::string exe = "/proc/self/exe";
+                std::string arg0 = "MobileGLIntegrationTest";
+                std::string filter = kWorkerFilter;
+                char* argv[] = {arg0.data(), filter.data(), nullptr};
+
+                std::fflush(nullptr);
+                const pid_t child = fork();
+                if (child < 0) {
+                    outReason = "fork() failed";
+                    return false;
+                }
+                if (child == 0) {
+                    execve(exe.c_str(), argv, envp.data());
+                    // execve only returns on failure; _exit, never exit(), because every atexit
+                    // handler in this address space belongs to the parent's copy of the world.
+                    std::fprintf(stderr, "[itest] poison child: execve(/proc/self/exe) failed\n");
+                    _exit(127);
+                }
+
+                constexpr int kTimeoutMs = 120000;
+                int waitedMs = 0;
+                for (;;) {
+                    const pid_t reaped = waitpid(child, &outStatus, WNOHANG);
+                    if (reaped == child) return true;
+                    if (reaped < 0) {
+                        outReason = "waitpid on the poison worker failed";
+                        return false;
+                    }
+                    if (waitedMs >= kTimeoutMs) {
+                        kill(child, SIGKILL);
+                        (void)waitpid(child, &outStatus, 0);
+                        outReason = "the poison worker made no progress in 120s and was killed";
+                        return false;
+                    }
+                    timespec nap{0, 10 * 1000 * 1000};
+                    nanosleep(&nap, nullptr);
+                    waitedMs += 10;
+                }
+            }
+
+            static std::string DescribeStatus(int status) {
+                if (WIFEXITED(status)) return "exited with status " + std::to_string(WEXITSTATUS(status));
+                if (WIFSIGNALED(status)) return "died on signal " + std::to_string(WTERMSIG(status));
+                return "ended in an unrecognised way";
+            }
+#endif
+        };
+
+        // The worker. It is a normal registered case so that the re-executed child can be selected
+        // with nothing but --gtest_filter, and it skips in every process that is not that child.
+        TEST_F(PoisonOmissionScenario, TheSequenceThePoisonControlsRun) {
+            if (std::getenv(kChildMarker) == nullptr) {
+                GTEST_SKIP() << "this case is the body the two poison controls run in a child process; "
+                                "it does nothing unless " << kChildMarker << " is set, which only the "
+                                "re-exec below does";
+            }
+            if (!Ready()) return;
+
+            RunSequence();
+
+#if MGITEST_POISON_HAVE_FORK
+            // _exit, and not a return into gtest's teardown: this process exists to reach the verb
+            // above and its exit status is the datum the parent reads. A normal teardown of a live
+            // context could add signals of its own to that answer.
+            //
+            // HasFailure(), not 0: RunSequence() is full of ASSERT_/EXPECT_ macros, and a fatal one
+            // (the shader failing to compile, say) RETURNS from RunSequence before the draw and the
+            // glGenerateMipmap ever happen. Exiting 0 there would have WithoutOmissionCompletes pass
+            // on a child that ran none of the sequence it is the control for - green because nothing
+            // happened. The child's assertion text is on its stderr, which ctest captures.
+            std::fflush(nullptr);
+            _exit(::testing::Test::HasFailure() ? 1 : 0);
+#endif
+        }
+
+#if MGITEST_POISON_HAVE_FORK
+
+        TEST_F(PoisonOmissionScenario, OmittedFieldAbortsOnThatVerb) {
+            if (!Ready()) return;
+
+            if (!StringKnobIsSet("MOBILEGL_PIPE_POISON_OMIT")) {
+                GTEST_SKIP() << "this case is the poison's negative control and needs "
+                                "MOBILEGL_PIPE_POISON_OMIT=<Verb>:<Field> for the whole process, which "
+                                "is what the PoisonOmitted. ctest entries set";
+            }
+            const std::string knob = std::getenv("MOBILEGL_PIPE_POISON_OMIT");
+            const std::string expectedPair = std::string(kOmittedField) + "@" + kOmittedVerb;
+            if (knob != std::string(kOmittedVerb) + ":" + kOmittedField) {
+                GTEST_SKIP() << "MOBILEGL_PIPE_POISON_OMIT is " << knob << ", but this case only knows "
+                             << "how to provoke " << kOmittedVerb << ":" << kOmittedField;
+            }
+
+            int status = 0;
+            std::string reason;
+            ASSERT_TRUE(RunSequenceInAChildProcess(status, reason)) << reason;
+
+            const std::string childLog = ReadWholeFile(ChildLogPath());
+            ASSERT_TRUE(WIFSIGNALED(status))
+                << "with the stamp of " << expectedPair << " omitted, the glGenerateMipmap in the child "
+                << "had to read a field its verb never filled and abort. It " << DescribeStatus(status)
+                << " instead - the poison is not armed (a build without MOBILEGL_PIPE_POISON, a filler "
+                   "that stamps what it was told to skip, or a backend that no longer reads the field "
+                   "through the accessor). Child log:\n"
+                << childLog;
+            EXPECT_EQ(WTERMSIG(status), SIGABRT)
+                << "the child died on signal " << WTERMSIG(status) << " rather than SIGABRT; the poison "
+                   "reports through MGLOG_F + std::abort(), so any other signal is a different crash. "
+                   "Child log:\n"
+                << childLog;
+
+            if (ChildLogPath().empty()) {
+                GTEST_SKIP() << "the abort happened, but the lane set no MOBILEGL_LOG_FILE_PATH, so the "
+                                "Fatal's text cannot be read back; the PoisonOmitted. ctest entries set it";
+            }
+            EXPECT_NE(childLog.find(std::string(kFatalPrefix) + ", \"" + expectedPair + "\""),
+                      std::string::npos)
+                << "the child aborted, but not with Fatal{UnmigratedPipeInput, \"" << expectedPair
+                << "\"} - that message is the whole diagnostic value of the poison. Child log:\n"
+                << childLog;
+            EXPECT_EQ(childLog.find("@DrawArrays"), std::string::npos)
+                << "the draw that ran BEFORE the omitted verb also tripped the poison, so the omission "
+                   "is not scoped to its verb: the fill classes are wrong, or the stamps are global. "
+                   "Child log:\n"
+                << childLog;
+        }
+
+        // The sibling control, in the ambient Verify. lanes: the same sequence with the knob UNSET
+        // must run to completion and log no Fatal at all.
+        //
+        // It deliberately does NOT skip when MOBILEGL_PIPE_POISON_OMIT is set. This is the entry
+        // CI's always-on negative control B exports the knob at: a green entry that the omission
+        // turns red is the whole proof that the poison is armed, and an entry that politely skipped
+        // itself would report that green either way. Nothing else in the integration suite calls
+        // glGenerateMipmap, so this case is also the only possible target for that control.
+        TEST_F(PoisonOmissionScenario, WithoutOmissionCompletes) {
+            if (!Ready()) return;
+
+            if (AmbientQuirkFromEnvironment("MOBILEGL_PIPE_VERIFY") != AmbientQuirk::On) {
+                GTEST_SKIP() << "the poison is only compiled into the push/verify builds; in an ordinary "
+                                "build there is nothing for this control to be a control OF";
+            }
+            const bool omissionArmed = StringKnobIsSet("MOBILEGL_PIPE_POISON_OMIT");
+
+            int status = 0;
+            std::string reason;
+            ASSERT_TRUE(RunSequenceInAChildProcess(status, reason)) << reason;
+
+            const std::string childLog = ReadWholeFile(ChildLogPath());
+            const std::string note =
+                omissionArmed
+                    ? std::string(
+                          " NOTE: MOBILEGL_PIPE_POISON_OMIT is set in this process, so this failure is "
+                          "what CI's negative control B is asking for - the poison IS armed, and this "
+                          "entry going red is the proof.")
+                    : std::string();
+            ASSERT_TRUE(WIFEXITED(status))
+                << "with no omission armed, a draw followed by glGenerateMipmap must complete; the child "
+                << DescribeStatus(status)
+                << ". If it aborted, the poison is firing on a field the verb's fill table SHOULD list - "
+                   "add the row to MG_Pipe/FillPoints.def, never mark the field sticky."
+                << note << " Child log:\n"
+                << childLog;
+            EXPECT_EQ(WEXITSTATUS(status), 0)
+                << "the child " << DescribeStatus(status)
+                << ". Status 1 is the child's OWN assertion failing inside the sequence (it exits "
+                   "HasFailure() ? 1 : 0), so its gtest output on this job's stderr names the line; "
+                   "anything else came from the harness. Child log:\n"
+                << childLog;
+            EXPECT_EQ(childLog.find("Fatal{"), std::string::npos)
+                << "an unpoisoned run logged a Fatal:\n"
+                << childLog;
+        }
+
+#else
+
+        TEST_F(PoisonOmissionScenario, OmittedFieldAbortsOnThatVerb) {
+            GTEST_SKIP() << "the poison control needs fork()/execve()/waitpid() to observe a SIGABRT as "
+                            "a datum; this platform has none of them";
+        }
+
+        TEST_F(PoisonOmissionScenario, WithoutOmissionCompletes) {
+            GTEST_SKIP() << "the poison control needs fork()/execve()/waitpid() to observe a SIGABRT as "
+                            "a datum; this platform has none of them";
+        }
+
+#endif
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PrimitivesGeneratedNoXfbScenario.cpp

@@ -0,0 +1,554 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PrimitivesGeneratedNoXfbScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - GL_PRIMITIVES_GENERATED COUNTS DRAWS MADE WITH TRANSFORM FEEDBACK
+// INACTIVE.
+//
+// GL 4.6 core 13.4: the query counts what the last vertex processing stage emits,
+// capture or no capture. The CTS leans its whole tessellation suite on that - the
+// tessellator's output is MEASURED by an XFB-inactive PATCHES draw under
+// rasterizer discard inside a GENERATED query, and the capture buffers of ~29
+// tessellation tests are sized from the answer - so a backend that answers 0
+// hands them a zero-byte buffer and an INVALID_OPERATION off its zero-length map.
+//
+// DirectVulkan serves the query from the transform-feedback stream query's
+// primitivesNeeded, which VK_EXT_transform_feedback defines to count whether or
+// not a capture span is open. Both the Mali-G1-Ultra driver AND Mesa lavapipe
+// disagree with that definition: with no vkCmdBeginTransformFeedbackEXT recorded,
+// the pair reads back 0. Where the bring-up probe measures that defect with a
+// working control - or MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE=1 pins it on - the
+// renderer accumulates XFB-inactive draws through the best proven substitute
+// pool: VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT (which lavapipe hosts and passes,
+// rasterizer discard included), else pipeline statistics over clipping-stage
+// invocations (GL's CLIPPING_INPUT_PRIMITIVES). These cases assert the GL-visible
+// answer, so on this machine they hold the reroute to the same numbers the
+// healthy stream path must produce - the "two pools must agree" assertion - and
+// on a healthy driver they pin the stream path itself.
+//
+// DirectVulkan only: DirectGLES has no GPU counter for an XFB-inactive draw at
+// all (ES has no PRIMITIVES_GENERATED without a capture), and its CPU accounting
+// is a different mechanism with its own tests.
+
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <functional>
+#include <initializer_list>
+#include <iterator>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        GLuint CompileShaderStage(GLenum type, const char* source, std::string* log) {
+            const GLuint shader = glCreateShader(type);
+            glShaderSource(shader, 1, &source, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        // A capture-capable vertex-only program: the varying gives glBeginTransformFeedback
+        // something to capture for the mixed-span case; the XFB-inactive cases draw with the
+        // same program and simply never begin a span.
+        const char* const kVertexSource = R"(#version 430 core
+out vec4 vs_out_value;
+void main() {
+  const vec2 corners[3] = vec2[3](vec2(-1.0, -1.0), vec2(3.0, -1.0), vec2(-1.0, 3.0));
+  vs_out_value = vec4(1.0);
+  gl_Position = vec4(corners[gl_VertexID % 3], 0.0, 1.0);
+}
+)";
+
+        // A passthrough tessellation pipeline whose all-1 levels emit exactly one
+        // triangle per patch - the count the tessellation cases assert.
+        const char* const kTessVertexSource = R"(#version 430 core
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+        const char* const kTessControlSource = R"(#version 430 core
+layout(vertices = 1) out;
+void main() {
+  gl_TessLevelOuter[0] = 1.0;
+  gl_TessLevelOuter[1] = 1.0;
+  gl_TessLevelOuter[2] = 1.0;
+  gl_TessLevelOuter[3] = 1.0;
+  gl_TessLevelInner[0] = 1.0;
+  gl_TessLevelInner[1] = 1.0;
+}
+)";
+        const char* const kTessEvalSource = R"(#version 430 core
+layout(triangles, equal_spacing, cw) in;
+void main() {
+  gl_Position = vec4(gl_TessCoord.xy * 2.0 - 1.0, 0.0, 1.0);
+}
+)";
+
+        // The same tessellation pipeline with something to capture, so that
+        // glBeginTransformFeedback accepts it: the paused-span PATCHES case needs an
+        // open (but paused) capture span AND a tessellator in one program.
+        const char* const kTessEvalCaptureSource = R"(#version 430 core
+layout(triangles, equal_spacing, cw) in;
+out vec4 te_out_value;
+void main() {
+  te_out_value = vec4(1.0);
+  gl_Position = vec4(gl_TessCoord.xy * 2.0 - 1.0, 0.0, 1.0);
+}
+)";
+
+        class PrimitivesGeneratedNoXfbScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                if (Gl().BackendName() != std::string("DirectVulkan")) {
+                    GTEST_SKIP() << "the stream-query defect and its reroute are DirectVulkan's; "
+                                 << Gl().BackendName()
+                                 << " answers this query from a different mechanism";
+                }
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenQueries(2, m_queries);
+                ASSERT_NE(m_queries[0], 0u);
+                ASSERT_NE(m_queries[1], 0u);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                if (m_queries[0] != 0 || m_queries[1] != 0) glDeleteQueries(2, m_queries);
+                m_queries[0] = m_queries[1] = 0;
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vao = 0;
+                ScenarioTest::TearDown();
+            }
+
+            // captureVarying: the name to record with glTransformFeedbackVaryings, or
+            // nullptr for a program that can never open a capture span.
+            GLuint BuildProgram(std::initializer_list<std::pair<GLenum, const char*>> stages,
+                                const char* captureVarying) {
+                std::vector<GLuint> shaders;
+                for (const auto& [type, source] : stages) {
+                    const GLuint shader = CompileShaderStage(type, source, &m_buildLog);
+                    if (shader == 0) {
+                        for (const GLuint built : shaders) glDeleteShader(built);
+                        return 0;
+                    }
+                    shaders.push_back(shader);
+                }
+                const GLuint program = glCreateProgram();
+                for (const GLuint shader : shaders) glAttachShader(program, shader);
+                if (captureVarying != nullptr) {
+                    glTransformFeedbackVaryings(program, 1, &captureVarying, GL_INTERLEAVED_ATTRIBS);
+                }
+                glLinkProgram(program);
+                for (const GLuint shader : shaders) glDeleteShader(shader);
+                GLint status = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &status);
+                if (status == GL_FALSE) {
+                    GLint length = 0;
+                    glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                    std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                    glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                    m_buildLog = buffer.data();
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                m_programs.push_back(program);
+                return program;
+            }
+
+            GLuint BuildCaptureProgram() {
+                return BuildProgram({{GL_VERTEX_SHADER, kVertexSource}}, "vs_out_value");
+            }
+
+            GLuint BuildTessellationProgram(bool withCaptureVarying = false) {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                if (maxTessGenLevel < 1) return 0;
+                return BuildProgram(
+                    {{GL_VERTEX_SHADER, kTessVertexSource},
+                     {GL_TESS_CONTROL_SHADER, kTessControlSource},
+                     {GL_TESS_EVALUATION_SHADER,
+                      withCaptureVarying ? kTessEvalCaptureSource : kTessEvalSource}},
+                    withCaptureVarying ? "te_out_value" : nullptr);
+            }
+
+            // A capture span that is open but PAUSED. The pause closes the capture, so
+            // every draw inside it is XFB-inactive at the backend - the stream query's
+            // silent case - while the GL span stays active. `program` must be the one
+            // that is bound: GL requires the same program at resume.
+            void BeginPausedSpan() {
+                glGenBuffers(1, &m_captureBuffer);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, m_captureBuffer);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 64 * sizeof(float), nullptr, GL_DYNAMIC_DRAW);
+                glBeginTransformFeedback(GL_TRIANGLES);
+                glPauseTransformFeedback();
+            }
+
+            void EndPausedSpan() {
+                glResumeTransformFeedback();
+                glEndTransformFeedback();
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                if (m_captureBuffer != 0) glDeleteBuffers(1, &m_captureBuffer);
+                m_captureBuffer = 0;
+            }
+
+            // GENERATED query around `record()`, answered with GL_QUERY_RESULT.
+            GLuint QueryGenerated(const std::function<void()>& record) {
+                glBeginQuery(GL_PRIMITIVES_GENERATED, m_queries[1]);
+                record();
+                glEndQuery(GL_PRIMITIVES_GENERATED);
+                GLuint generated = 0xFFFFFFFFu;
+                glGetQueryObjectuiv(m_queries[1], GL_QUERY_RESULT, &generated);
+                return generated;
+            }
+
+            static GLenum DrainGLErrors() {
+                const GLenum first = glGetError();
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return first;
+            }
+
+            const std::string& BuildLog() const { return m_buildLog; }
+
+            static std::filesystem::path LibraryLogPath() {
+                const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+                return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                          : std::filesystem::path();
+            }
+
+            static std::uintmax_t LibraryLogSize() {
+                std::error_code ec;
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return 0;
+                const std::uintmax_t size = std::filesystem::file_size(path, ec);
+                return ec ? 0 : size;
+            }
+
+            static std::string LibraryLogSince(std::uintmax_t offset) {
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return {};
+                std::ifstream file(path, std::ios::binary);
+                if (!file.good()) return {};
+                file.seekg(static_cast<std::streamoff>(offset));
+                return std::string((std::istreambuf_iterator<char>(file)),
+                                   std::istreambuf_iterator<char>());
+            }
+
+            GLuint m_vao = 0;
+            GLuint m_queries[2] = {0, 0}; // [0]=written, [1]=generated
+            GLuint m_captureBuffer = 0;
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+        };
+
+        // The plain shape: no capture object was ever bound, no span begun, no
+        // rasterizer discard - just a GENERATED query around two triangles. On a
+        // healthy driver the stream query answers it; on an affected one the armed
+        // reroute must produce the same 2.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, CountsADrawMadeWithNoCaptureSpan) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 6); });
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 2u)
+                << "GL_PRIMITIVES_GENERATED must count a draw made while transform feedback is "
+                   "inactive (GL 4.6 core 13.4)";
+        }
+
+        // THE CTS SHAPE (esextcTessellationShaderUtils.cpp, captureTessellationData):
+        // rasterizer discard ON, transform feedback INACTIVE, the draw inside a
+        // GENERATED query. This is the exact query whose 0 sizes ~29 tessellation
+        // tests' capture buffers on the affected device.
+        //
+        // On lavapipe this case holds through the dedicated
+        // VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT reroute (its discard feature is
+        // what makes a discarded draw countable there - llvmpipe's clipping
+        // statistics AND stream query both read 0 under discard).
+        //
+        // The value-conditioned skip below is deliberate and narrow, for a stack
+        // with NO counter that survives discard: there this case is unfalsifiable,
+        // and a red would indict MobileGL for a hole the bring-up probe already
+        // measures and reports (StatisticsSubstitutePlainOnly / Unfixable). The
+        // exact-zero answer IS the capability signal - any wrong nonzero count
+        // still fails - and on every driver that counts discarded draws at all the
+        // full assertion runs. The device probe list holds this shape on the Mali.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, CountsUnderRasterizerDiscardWithNoCaptureSpan) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            glEnable(GL_RASTERIZER_DISCARD);
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 6); });
+            glDisable(GL_RASTERIZER_DISCARD);
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (generated == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach (stream query, dedicated "
+                                "primitives-generated query, clipping statistics) survives "
+                                "rasterizer discard for an XFB-inactive draw on this stack - the "
+                                "shape is unfalsifiable here; the bring-up probe measures the same "
+                                "hole and the POST row reports it";
+            }
+            EXPECT_EQ(generated, 2u)
+                << "rasterizer discard drops primitives after clipping and must not hide them from "
+                   "GL_PRIMITIVES_GENERATED - this is the exact shape the CTS measures the "
+                   "tessellator with";
+        }
+
+        // The tessellation flavour: a PATCHES draw whose all-1 levels emit exactly
+        // one triangle - the count the CTS's getAmountOfVerticesGeneratedByTessellator
+        // protocol derives everything from. Undiscarded, so that the answer is
+        // holdable on this machine through whichever accounting path is armed (the
+        // discard interaction is the case above's business, measured separately).
+        TEST_F(PrimitivesGeneratedNoXfbScenario, CountsATessellatedPatchWithNoCaptureSpan) {
+            if (!Ready()) return;
+            const GLuint program = BuildTessellationProgram();
+            if (program == 0) {
+                GTEST_SKIP() << "no tessellation stages on this stack: " << BuildLog();
+            }
+            glUseProgram(program);
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_PATCHES, 0, 1); });
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 1u)
+                << "a triangles-domain patch with every level 1 tessellates to exactly one "
+                   "triangle, and GL_PRIMITIVES_GENERATED must say so with no capture active";
+        }
+
+        // One query span holding BOTH kinds of draw: an XFB-inactive draw, then a
+        // captured one, then another XFB-inactive one. The GENERATED answer must
+        // accumulate across the two accounting paths the armed reroute splits them
+        // into (stream slots for the captured draw, statistics slots for the
+        // others), and WRITTEN must stay exactly the captured draw's count - the
+        // pairing the stream path exists to keep exact. Undiscarded, so the
+        // accumulation invariant is holdable on this machine (see the discard
+        // case's comment); the triangles rasterize into the harness framebuffer,
+        // which nothing here reads.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, ASpanMixingActiveAndInactiveDrawsAccumulatesBoth) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            GLuint captureBuffer = 0;
+            glGenBuffers(1, &captureBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, captureBuffer);
+            glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 3 * 4 * sizeof(float), nullptr, GL_DYNAMIC_DRAW);
+
+            glBeginQuery(GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN, m_queries[0]);
+            const GLuint generated = QueryGenerated([]() {
+                glDrawArrays(GL_TRIANGLES, 0, 3); // XFB inactive
+                glBeginTransformFeedback(GL_TRIANGLES);
+                glDrawArrays(GL_TRIANGLES, 0, 3); // captured
+                glEndTransformFeedback();
+                glDrawArrays(GL_TRIANGLES, 0, 3); // XFB inactive again
+            });
+            glEndQuery(GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN);
+
+            GLuint written = 0xFFFFFFFFu;
+            glGetQueryObjectuiv(m_queries[0], GL_QUERY_RESULT, &written);
+            glDeleteBuffers(1, &captureBuffer);
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 3u) << "one triangle before the span, one inside it, one after";
+            EXPECT_EQ(written, 1u) << "only the draw inside the span writes anything";
+        }
+
+        // ===================== DRAWS INSIDE A PAUSED SPAN =====================
+        //
+        // glPauseTransformFeedback closes the capture without closing the span, so a
+        // draw made while paused is XFB-INACTIVE at the backend - the stream query is
+        // exactly as silent for it as for a draw with no span at all - while
+        // GL_PRIMITIVES_GENERATED must still count what the last vertex processing
+        // stage emitted (GL 4.6 core 13.4; the WRITTEN query is the one the pause
+        // silences). The frontend does keep a CPU counter for paused draws, but it can
+        // price only 3 of the ~15 draw entry points and answers 0 for GL_PATCHES, so
+        // these draws are the reroute's business like any other - and the trap on the
+        // other side is counting them TWICE, once in each accounting.
+        //
+        // Each case measures the SAME draw twice: once with no span open at all (the
+        // capability control - what this stack can count) and once inside the paused
+        // span, and requires the two to agree. That differential is what makes these
+        // cases falsifying rather than vacuous: a stack where no counter reaches a
+        // capture-less draw fails the control and skips, while a stack that counts the
+        // unpaused draw and answers 0 for the paused one - which is what excluding
+        // paused draws from the reroute produced - fails, instead of skipping into
+        // green.
+
+        // The draw the CPU counter CAN price: if the span both reroutes it and adds the
+        // CPU delta, this reads 2.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, APausedSpanCountsACpuPricedDrawExactlyOnce) {
+            if (!Ready()) return;
+            if (AmbientQuirkFromEnvironment("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE") == AmbientQuirk::Off) {
+                GTEST_SKIP() << "the negative control replays the pre-probe accounting, whose paused "
+                                "draws are CPU-counted on top of whatever the stream query says";
+            }
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            const GLuint unpaused = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 3); });
+            BeginPausedSpan();
+            const GLuint paused = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 3); });
+            EndPausedSpan();
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (unpaused == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach answers a capture-less draw on this "
+                                "stack, so the paused half of the comparison proves nothing; the "
+                                "bring-up probe measures the same hole and the POST row reports it";
+            }
+            EXPECT_EQ(unpaused, 1u) << "the control itself: one triangle is one primitive";
+            EXPECT_EQ(paused, unpaused)
+                << "one triangle drawn while the capture span is paused is still one primitive "
+                   "generated - counted once, by whichever accounting owns it, never by two of them "
+                   "(a reroute slot AND the frontend's CPU paused counter reads 2)";
+        }
+
+        // The draw the CPU counter CANNOT price: GL_PATCHES, whose amplification is not
+        // knowable on the CPU (CountPrimitivesForDraw answers 0 for it by design) - and
+        // the CTS's tessellator-measuring shape. Excluding paused draws from the
+        // reroute left this counted by nothing at all on the affected device.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, APausedSpanCountsATessellatedPatchExactlyOnce) {
+            if (!Ready()) return;
+            const GLuint program = BuildTessellationProgram(/*withCaptureVarying=*/true);
+            if (program == 0) {
+                GTEST_SKIP() << "no tessellation stages on this stack: " << BuildLog();
+            }
+            glUseProgram(program);
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+
+            const GLuint unpaused = QueryGenerated([]() { glDrawArrays(GL_PATCHES, 0, 1); });
+            BeginPausedSpan();
+            const GLuint paused = QueryGenerated([]() { glDrawArrays(GL_PATCHES, 0, 1); });
+            EndPausedSpan();
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (unpaused == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach answers a capture-less patch draw "
+                                "on this stack, so the paused half proves nothing; the bring-up probe "
+                                "measures the same hole and the POST row reports it";
+            }
+            EXPECT_EQ(unpaused, 1u)
+                << "the control itself: a triangles-domain patch with every level 1 tessellates to "
+                   "exactly one triangle";
+            EXPECT_EQ(paused, unpaused)
+                << "pausing the capture does not stop the tessellator from generating that triangle, "
+                   "and the frontend's CPU paused counter answers 0 for GL_PATCHES - so a paused "
+                   "patch draw left out of the reroute is counted by nothing at all";
+        }
+
+        // The other half of the same hole: the instanced entry points never reach the
+        // frontend's paused accounting either, so a paused instanced draw excluded from
+        // the reroute is likewise counted by nothing.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, APausedSpanCountsAnInstancedDrawExactlyOnce) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            const GLuint unpaused =
+                QueryGenerated([]() { glDrawArraysInstanced(GL_TRIANGLES, 0, 3, 4); });
+            BeginPausedSpan();
+            const GLuint paused = QueryGenerated([]() { glDrawArraysInstanced(GL_TRIANGLES, 0, 3, 4); });
+            EndPausedSpan();
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (unpaused == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach answers a capture-less draw on this "
+                                "stack, so the paused half proves nothing";
+            }
+            EXPECT_EQ(unpaused, 4u) << "the control itself: four instances of one triangle";
+            EXPECT_EQ(paused, unpaused)
+                << "four instances generate four primitives whether or not the capture span is "
+                   "paused, and no instanced entry point reaches the frontend's paused accounting";
+        }
+
+        // THE ONE CASE THAT CAN FAIL WHEN THE REROUTE SILENTLY STOPS BEING ARMED -
+        // the UnlocatedIoBlockScenario shape, for the same reason: every case above
+        // is green here whether the reroute ran or not (that is the "two pools
+        // agree" point), so none of them can say the pinned lane actually exercised
+        // a reroute pool. This one asserts a LIBRARY OBSERVABLE against the
+        // environment: with MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE pinned on, an
+        // XFB-inactive draw inside a GENERATED span must make the renderer say -
+        // through its latched MGLOG_I - that it engaged the reroute. It reads
+        // MG_Config not at all (on Android this module links the shipping library)
+        // and trusts only the log bytes appended after it started.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, TheRerouteIsActuallyArmedWhenTheEnvironmentPinsItOn) {
+            if (!Ready()) return;
+            if (AmbientQuirkFromEnvironment("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE") != AmbientQuirk::On) {
+                GTEST_SKIP() << "this case needs the reroute pinned ON for the whole process, which "
+                                "is what the PrimGenReroute. ctest entry does with "
+                                "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE=1; unset, the bring-up probe "
+                                "decides and this machine's verdict is its own business";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE is pinned on but "
+                                "MOBILEGL_LOG_FILE_PATH is not set, so the library has nowhere to "
+                                "record that it rerouted anything; the PrimGenReroute. ctest "
+                                "entry sets both";
+            }
+
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            // Taken BEFORE the draw, so the line this looks for can only be one this
+            // process wrote for this span. The latch fires on the FIRST rerouted
+            // draw, which is inside the query below.
+            const std::uintmax_t before = LibraryLogSize();
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 3); });
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 1u) << "the pinned-on lane did not even count correctly";
+
+            const std::string appended = LibraryLogSince(before);
+            EXPECT_NE(appended.find("PRIMITIVES_GENERATED reroute engaged"), std::string::npos)
+                << "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE is pinned ON, an XFB-inactive draw ran inside "
+                   "a GENERATED query, and the renderer never reported engaging the reroute. The "
+                   "quirk is not armed - check the override mapping "
+                   "(ChoosePrimitivesGeneratedReroute) and the arming gate in "
+                   "VulkanRenderer::BeginXfbQueryForDraw. Log appended by this test:\n"
+                << appended;
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_Pipe/Coverage.def

@@ -0,0 +1,131 @@
+// MobileGL - MobileGL/MG_Pipe/Coverage.def
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The hand-maintained half of G6 (plan B section 4.7, gate 10.3-5): which MGPipe call
+// answers each backend read point in scripts/data/backend_read_inventory.md (477 rows, 57
+// files, generated from the backends by MobileGL-CS's extract_backend_read_inventory.py).
+//
+// gen_pipe.py joins the inventory's `member` column against MGP_COVERAGE_ACCESSOR_LIST and
+// its `delta` column against MGP_COVERAGE_DELTA_LIST, then writes generated/PipeCoverage.inc
+// with the per-accessor table and prints the coverage summary. Rows matching neither are
+// UNMAPPED: allowed in P0 and merely counted, ZERO from P5 onward, when the gate becomes
+// "regenerate and git diff --exit-code with 0 UNMAPPED".
+//
+// Three pseudo-calls stand for read points that do NOT become a forward call:
+//   kClientResolved   - the frontend answers it itself; the server is never asked
+//                       (section 4.4.6: "the server answers nothing the client can answer").
+//   kReverseChannel   - it becomes one of the ten MGPipeCallbacks (section 7.1).
+//   kStructuralHandle - the row is a SIGNATURE carrying SharedPtr<MG_State...>, which
+//                       becomes an MGPipeHandle parameter; there is no single call to name.
+//
+// clang-format off
+
+// X(Accessor, PipeCall)
+#define MGP_COVERAGE_ACCESSOR_LIST(X)                                    \
+    X(GetActiveTextureUnit,                     SetSamplerViews)         \
+    X(GetBlendColor,                            SetDynamicState)         \
+    X(GetBlendEquationIndexed,                  CreateRenderState)       \
+    X(GetBlendFuncIndexed,                      CreateRenderState)       \
+    /* dead: no backend reads it since D21; kept for inventory row 594 */  \
+    X(GetBoundTransformFeedbackName,            SetStreamOutputTargets)  \
+    X(GetBoundVertexArray,                      BindVertexElements)      \
+    /* Polymorphic over BufferTarget: its rows split across set_vertex_buffers,     */  \
+    /* set_index_buffer, set_indirect_buffers and set_shader_buffers when the       */  \
+    /* inventory is re-vendored carrying the target argument (deferred out of P1:   */  \
+    /* the extractor lives in MobileGL-CS). Named for the plan's explicit           */  \
+    /* replacement of the DrawIndirect/Parameter pair.                              */  \
+    X(GetBufferBindingSlot,                     SetIndirectBuffers)      \
+    X(GetBufferBindingPoint,                    SetShaderBuffers)        \
+    X(GetBufferBindingPointCount,               SetShaderBuffers)        \
+    X(GetTouchedBufferBindingPointCount,        SetShaderBuffers)        \
+    X(GetClampReadColor,                        SetDynamicState)         \
+    X(GetClearColor,                            SetDynamicState)         \
+    X(GetClearDepth,                            SetDynamicState)         \
+    X(GetClearStencil,                          SetDynamicState)         \
+    X(GetColorMaskIndexed,                      CreateRenderState)       \
+    X(GetCullFaceMode,                          CreateRenderState)       \
+    X(GetCurrentVertexAttribute,                SetVertexAttribDefaults) \
+    X(GetDepthFunc,                             CreateRenderState)       \
+    X(GetDepthMask,                             CreateRenderState)       \
+    X(GetDepthRangeIndexed,                     SetDynamicState)         \
+    X(GetFramebufferBindingSlot,                SetFramebufferState)     \
+    X(GetImageTextureBinding,                   SetShaderImages)         \
+    X(GetLineWidth,                             SetDynamicState)         \
+    X(GetLogicOp,                               CreateRenderState)       \
+    X(GetMaxTouchedTextureUnit,                 SetSamplerViews)         \
+    X(GetMinSampleShadingValue,                 CreateRenderState)       \
+    X(GetPatchDefaultInnerLevel,                SetPatchState)           \
+    X(GetPatchDefaultOuterLevel,                SetPatchState)           \
+    X(GetPatchVertices,                         SetPatchState)           \
+    X(GetPipelineStateVersion,                  BindRenderState)         \
+    X(GetPixelStoreParameters,                  SetPixelPackState)       \
+    X(GetPolygonModeFront,                      CreateRenderState)       \
+    X(GetPolygonOffsetFactor,                   SetDynamicState)         \
+    X(GetPolygonOffsetUnits,                    SetDynamicState)         \
+    X(GetPrimitiveRestartIndex,                 DrawVbo)                 \
+    X(GetProgramForDispatch,                    SetDispatchProgram)      \
+    X(GetProgramForDraw,                        SetDrawProgram)          \
+    X(GetProgramObject,                         CreateShaderState)       \
+    /* Not in ComputePipelineStateHash today even though Vulkan makes it pipeline   */  \
+    /* state; recorded here so the G7 chunk table has to answer for it before it    */  \
+    /* freezes (section 10.3-5).                                                    */  \
+    X(GetProvokingVertexMode,                   CreateRenderState)       \
+    X(GetRenderStateParameters,                 CreateRenderState)       \
+    X(GetRenderStateParametersVersion,          BindRenderState)         \
+    X(GetSamplingResolutionGeneration,          SetSamplerViews)         \
+    X(GetScissorBox,                            SetDynamicState)         \
+    X(GetStencilState,                          CreateRenderState)       \
+    X(GetTextureBindGeneration,                 SetSamplerViews)         \
+    X(GetTextureContextId,                      SetSamplerViews)         \
+    X(GetTextureObject,                         SetSamplerViews)         \
+    X(GetTextureUnitObject,                     SetSamplerViews)         \
+    X(GetTransformFeedbackCapturedVertices,     DrawVbo)                 \
+    X(GetTransformFeedbackGeneration,           SetStreamOutputTargets)  \
+    X(GetTransformFeedbackPausedPrimitiveCounter, EndStreamOutput)       \
+    X(GetTransformFeedbackProgram,              SetStreamOutputTargets)  \
+    X(GetViewport,                              SetDynamicState)         \
+    X(GetViewportIndexed,                       SetDynamicState)         \
+    X(IsCapabilityEnabled,                      CreateRenderState)       \
+    X(IsCapabilityEnabledIndexed,               CreateRenderState)       \
+    X(IsTransformFeedbackActive,                BeginStreamOutput)       \
+    X(IsTransformFeedbackPaused,                PauseStreamOutput)       \
+    X(InvalidateCompileEnv,                     kClientResolved)         \
+    X(ValidateProgramName,                      kClientResolved)         \
+    X(RecordError,                              kReverseChannel)         \
+    /* The D21 XFB counter-slot rekey's reads (VulkanRenderer.cpp); the calls they   */  \
+    /* map to are GetTransformFeedbackGeneration's.                                 */  \
+    X(GetBoundTransformFeedbackLifetimeId,      SetStreamOutputTargets)  \
+    X(HasOpenTransformFeedbackSpan,             SetStreamOutputTargets)
+
+// X(Accessor, Reason) - the STICKY fields (P1 brief D6): the only PipeInputs fields whose
+// value is valid across verbs, so the poison's per-verb generation does not apply to them.
+// Exactly the seven F-class (forwarded) accessors, and the argument for each is the same:
+// it takes an argument that is not verb state - a GL name, a lifetime id, a target - i.e.
+// it is a lookup or a reverse-channel write, not a state read; there is no value the
+// filler could copy and no verb whose fill could make it stale; phase C replaces them
+// with handle tables and callbacks. None of the version/generation accessors is sticky:
+// those change under verbs and are precisely what the poison must protect. The verify
+// lane's Fatal{UnmigratedPipeInput} is fixed by a FillPoints.def row, never by a row here.
+// gen_pipe.py refuses a name that is not an accessor above.
+#define MGP_COVERAGE_STICKY_LIST(X)                                                                        \
+    X(GetBufferBindingPointCount, "keyed by target: a constexpr capacity table, not verb state")           \
+    X(GetProgramObject,           "keyed by GL name: an object lookup, not verb state")                    \
+    X(GetTextureObject,           "keyed by GL name: an object lookup, not verb state")                    \
+    X(HasOpenTransformFeedbackSpan, "keyed by lifetime id: an object lookup, not verb state")              \
+    X(ValidateProgramName,        "keyed by GL name: a name-table lookup, not verb state")                 \
+    X(InvalidateCompileEnv,       "reverse channel: a write into the frontend, not a state read")          \
+    X(RecordError,                "reverse channel: a write into the frontend, not a state read")
+
+// X(DeltaKind, PipeCall) - for inventory rows with no accessor in the member column.
+// Read by gen_pipe.py ONLY, never by the C++ preprocessor: the delta kinds are the
+// inventory's own free-text labels, not C tokens.
+#define MGP_COVERAGE_DELTA_LIST(X)                                       \
+    X(handle-ify (wire handle),                 kStructuralHandle)       \
+    X(Buffer ops delta,                         ResourceRespecify)
+
+// clang-format on

MobileGL/MG_Pipe/FillPoints.def

@@ -0,0 +1,296 @@
+// MobileGL - MobileGL/MG_Pipe/FillPoints.def
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The per-verb fill points of the PipeInputs strangler (ARCHITECTURE.md 9.2, phase A; the
+// P1 brief D7). Three hand-maintained lists, read by scripts/gen_pipe.py (G5b) into
+// generated/PipeFillPoints.inc:
+//
+//   MGP_FILL_VERB_LIST   every verb the frontend calls through GLFunctionsTable, with its class
+//   MGP_FILL_CLASS_LIST  the verb classes
+//   MGP_FILL_FIELD_LIST  the may-read table: which PipeInputs fields a class of verb may read
+//
+// The verb set IS the function-pointer member set of MG_Backend::GLFunctionsTable
+// (MG_Backend/BackendObject.h), in declaration order: gen_pipe.py parses that struct and
+// refuses a row set that is not exactly its member set in that order, so the MGPipeVerb enum
+// and the table cannot drift apart. MG_Impl spells MGP_FILL(Verb) immediately before every
+// call through the table (83 statements over these 69 verbs); Present and SetSwapInterval go
+// through BackendObject virtuals and read no frontend state, so they are not verbs here.
+//
+// The seven sticky fields (Coverage.def, MGP_COVERAGE_STICKY_LIST) are implicit in every
+// class and are not listed. The verify lane is the oracle for this table: a
+// Fatal{UnmigratedPipeInput, "Field@Verb"} found there is fixed by adding the (class, field)
+// row, never by marking the field sticky.
+//
+// gen_pipe.py's block regexes end at a blank line: keep the empty line after each macro.
+//
+// clang-format off
+
+// X(Verb, Class) - one row per function-pointer member of MG_Backend::GLFunctionsTable (BackendObject.h),
+// in declaration order. gen_pipe.py parses that struct and refuses a row set that is not exactly its member set.
+#define MGP_FILL_VERB_LIST(X)                                          \
+    X(DrawArrays,                                     kDraw)           \
+    X(DrawElements,                                   kDraw)           \
+    X(DrawElementsBaseVertex,                         kDraw)           \
+    X(MultiDrawArrays,                                kDraw)           \
+    X(MultiDrawElements,                              kDraw)           \
+    X(MultiDrawElementsBaseVertex,                    kDraw)           \
+    X(MultiDrawElementsIndirect,                      kDraw)           \
+    X(MultiDrawArraysIndirect,                        kDraw)           \
+    X(MultiDrawElementsIndirectCount,                 kDraw)           \
+    X(MultiDrawArraysIndirectCount,                   kDraw)           \
+    X(DrawRangeElementsBaseVertex,                    kDraw)           \
+    X(DrawRangeElements,                              kDraw)           \
+    X(DrawElementsInstancedBaseVertexBaseInstance,    kDraw)           \
+    X(DrawElementsInstancedBaseVertex,                kDraw)           \
+    X(DrawElementsInstancedBaseInstance,              kDraw)           \
+    X(DrawElementsInstanced,                          kDraw)           \
+    X(DrawArraysInstancedBaseInstance,                kDraw)           \
+    X(DrawArraysInstanced,                            kDraw)           \
+    X(DrawElementsIndirect,                           kDraw)           \
+    X(DrawArraysIndirect,                             kDraw)           \
+    X(Clear,                                          kClear)          \
+    X(ClearBufferfi,                                  kClear)          \
+    X(ClearBufferfv,                                  kClear)          \
+    X(ClearBufferuiv,                                 kClear)          \
+    X(ClearBufferiv,                                  kClear)          \
+    X(ClearNamedFramebufferfv,                        kClear)          \
+    X(ClearNamedFramebufferfi,                        kClear)          \
+    X(ClearNamedFramebufferiv,                        kClear)          \
+    X(ClearNamedFramebufferuiv,                       kClear)          \
+    X(BlitFramebuffer,                                kBlitOrCopy)     \
+    X(BlitNamedFramebuffer,                           kBlitOrCopy)     \
+    X(CopyTexImage2D,                                 kBlitOrCopy)     \
+    X(CopyTexSubImage2D,                              kBlitOrCopy)     \
+    X(CopyImageSubData,                               kBlitOrCopy)     \
+    X(GenerateMipmap,                                 kTextureOp)      \
+    X(ReadPixels,                                     kReadback)       \
+    X(GetTexImage,                                    kReadback)       \
+    X(GetTextureImage,                                kReadback)       \
+    X(DispatchCompute,                                kDispatch)       \
+    X(DispatchComputeIndirect,                        kDispatch)       \
+    X(MemoryBarrier,                                  kQuery)          \
+    X(MemoryBarrierByRegion,                          kQuery)          \
+    X(BindImageTexture,                               kTextureOp)      \
+    X(GetIntegeri_v,                                  kQuery)          \
+    X(ShaderStorageBlockBinding,                      kProgramOp)      \
+    X(FenceSync,                                      kQuery)          \
+    X(ClientWaitSync,                                 kQuery)          \
+    X(WaitSync,                                       kQuery)          \
+    X(DeleteSync,                                     kQuery)          \
+    X(GetSyncStatus,                                  kQuery)          \
+    X(IsTimerQuerySupported,                          kQuery)          \
+    X(BeginTimeElapsedQuery,                          kQuery)          \
+    X(EndTimeElapsedQuery,                            kQuery)          \
+    X(QueryCounterTimestamp,                          kQuery)          \
+    X(IsQueryResultAvailable,                         kQuery)          \
+    X(GetQueryResult64,                               kQuery)          \
+    X(DeleteBackendQuery,                             kQuery)          \
+    X(BeginOcclusionQuery,                            kQuery)          \
+    X(EndOcclusionQuery,                              kQuery)          \
+    X(BeginXfbPrimitivesQuery,                        kQuery)          \
+    X(EndXfbPrimitivesQuery,                          kQuery)          \
+    X(PatchParameteri,                                kQuery)          \
+    X(BeginTransformFeedback,                         kXfbSpan)        \
+    X(EndTransformFeedback,                           kXfbSpan)        \
+    X(PauseTransformFeedback,                         kXfbSpan)        \
+    X(ResumeTransformFeedback,                        kXfbSpan)        \
+    X(BindTransformFeedback,                          kXfbSpan)        \
+    X(DeleteTransformFeedback,                        kXfbSpan)        \
+    X(GetGpuTimestampNs,                              kQuery)
+
+// X(Class) - the nine verb classes (ARCHITECTURE.md:153 names eight; kProgramOp is split out because
+// ShaderStorageBlockBinding is the one non-draw verb that syncs Espryt's render state and textures).
+#define MGP_FILL_CLASS_LIST(X) \
+    X(kDraw) X(kDispatch) X(kClear) X(kBlitOrCopy) X(kTextureOp) X(kReadback) X(kXfbSpan) X(kProgramOp) X(kQuery)
+
+// X(Class, Field) - the may-read table. A field named here is filled and stamped at every verb of the class;
+// a read of a field NOT named here is Fatal{UnmigratedPipeInput, "Field@Verb"} in a poison build.
+// Derived from the verified reachability of every backend read (both backends, union), P1 brief D7.
+#define MGP_FILL_FIELD_LIST(X)                                         \
+    /* kDraw: every draw entry of both backends */                     \
+    X(kDraw,        GetBoundVertexArray)                               \
+    X(kDraw,        GetProgramForDraw)                                 \
+    X(kDraw,        GetBufferBindingSlot)                              \
+    X(kDraw,        GetBufferBindingPoint)                             \
+    X(kDraw,        GetTouchedBufferBindingPointCount)                 \
+    X(kDraw,        GetTextureUnitObject)                              \
+    X(kDraw,        GetTextureContextId)                               \
+    X(kDraw,        GetTextureBindGeneration)                          \
+    X(kDraw,        GetMaxTouchedTextureUnit)                          \
+    X(kDraw,        GetSamplingResolutionGeneration)                   \
+    X(kDraw,        GetImageTextureBinding)                            \
+    X(kDraw,        GetCurrentVertexAttribute)                         \
+    X(kDraw,        GetRenderStateParameters)                          \
+    X(kDraw,        GetRenderStateParametersVersion)                   \
+    X(kDraw,        GetPipelineStateVersion)                           \
+    X(kDraw,        GetViewport)                                       \
+    X(kDraw,        GetViewportIndexed)                                \
+    X(kDraw,        GetDepthRangeIndexed)                              \
+    X(kDraw,        GetScissorBox)                                     \
+    X(kDraw,        IsCapabilityEnabled)                               \
+    X(kDraw,        IsCapabilityEnabledIndexed)                        \
+    X(kDraw,        GetBlendColor)                                     \
+    X(kDraw,        GetBlendFuncIndexed)                               \
+    X(kDraw,        GetBlendEquationIndexed)                           \
+    X(kDraw,        GetColorMaskIndexed)                               \
+    X(kDraw,        GetLogicOp)                                        \
+    X(kDraw,        GetDepthFunc)                                      \
+    X(kDraw,        GetDepthMask)                                      \
+    X(kDraw,        GetStencilState)                                   \
+    X(kDraw,        GetCullFaceMode)                                   \
+    X(kDraw,        GetPolygonModeFront)                               \
+    X(kDraw,        GetPolygonOffsetFactor)                            \
+    X(kDraw,        GetPolygonOffsetUnits)                             \
+    X(kDraw,        GetLineWidth)                                      \
+    X(kDraw,        GetMinSampleShadingValue)                          \
+    X(kDraw,        GetProvokingVertexMode)                            \
+    X(kDraw,        GetPatchVertices)                                  \
+    X(kDraw,        GetPatchDefaultOuterLevel)                         \
+    X(kDraw,        GetPatchDefaultInnerLevel)                         \
+    X(kDraw,        GetPrimitiveRestartIndex)                          \
+    X(kDraw,        GetFramebufferBindingSlot)                         \
+    X(kDraw,        IsTransformFeedbackActive)                         \
+    X(kDraw,        IsTransformFeedbackPaused)                         \
+    X(kDraw,        GetTransformFeedbackProgram)                       \
+    X(kDraw,        GetTransformFeedbackGeneration)                    \
+    X(kDraw,        GetBoundTransformFeedbackLifetimeId)               \
+    X(kDraw,        GetTransformFeedbackCapturedVertices)              \
+    /* kDispatch: the patch fields are Espryt's SyncCurrentProgram ->  */ \
+    /* AttachPassthroughTessControlStage (Managers.cpp)                */ \
+    X(kDispatch,    GetProgramForDispatch)                             \
+    X(kDispatch,    GetBufferBindingSlot)                              \
+    X(kDispatch,    GetBufferBindingPoint)                             \
+    X(kDispatch,    GetTouchedBufferBindingPointCount)                 \
+    X(kDispatch,    GetTextureUnitObject)                              \
+    X(kDispatch,    GetTextureContextId)                               \
+    X(kDispatch,    GetTextureBindGeneration)                          \
+    X(kDispatch,    GetMaxTouchedTextureUnit)                          \
+    X(kDispatch,    GetSamplingResolutionGeneration)                   \
+    X(kDispatch,    GetImageTextureBinding)                            \
+    X(kDispatch,    GetFramebufferBindingSlot)                         \
+    /* Magma's PrepareStorageImageTextures materialises a queued clear for every  */ \
+    /* storage image the dispatch writes, and the clear pre-compensates its colour */ \
+    /* against GL_FRAMEBUFFER_SRGB (VkClearManager::PreCompensateSrgbClearColor).  */ \
+    X(kDispatch,    IsCapabilityEnabled)                               \
+    X(kDispatch,    GetPatchVertices)                                  \
+    X(kDispatch,    GetPatchDefaultOuterLevel)                         \
+    X(kDispatch,    GetPatchDefaultInnerLevel)                         \
+    /* kClear */                                                       \
+    X(kClear,       GetRenderStateParameters)                          \
+    X(kClear,       GetRenderStateParametersVersion)                   \
+    X(kClear,       GetViewport)                                       \
+    X(kClear,       IsCapabilityEnabled)                               \
+    X(kClear,       GetFramebufferBindingSlot)                         \
+    X(kClear,       GetClearColor)                                     \
+    X(kClear,       GetClearDepth)                                     \
+    X(kClear,       GetClearStencil)                                   \
+    X(kClear,       GetScissorBox)                                     \
+    X(kClear,       GetColorMaskIndexed)                               \
+    X(kClear,       GetDepthMask)                                      \
+    X(kClear,       GetStencilState)                                   \
+    X(kClear,       GetTextureUnitObject)                              \
+    X(kClear,       GetTextureContextId)                               \
+    X(kClear,       GetSamplingResolutionGeneration)                   \
+    X(kClear,       GetTextureBindGeneration)                          \
+    X(kClear,       GetMaxTouchedTextureUnit)                          \
+    X(kClear,       GetImageTextureBinding)                            \
+    /* kBlitOrCopy */                                                  \
+    X(kBlitOrCopy,  GetFramebufferBindingSlot)                         \
+    X(kBlitOrCopy,  IsCapabilityEnabled)                               \
+    X(kBlitOrCopy,  GetScissorBox)                                     \
+    X(kBlitOrCopy,  IsTransformFeedbackActive)                         \
+    X(kBlitOrCopy,  IsTransformFeedbackPaused)                         \
+    X(kBlitOrCopy,  GetRenderStateParameters)                          \
+    X(kBlitOrCopy,  GetRenderStateParametersVersion)                   \
+    X(kBlitOrCopy,  GetViewport)                                       \
+    X(kBlitOrCopy,  GetActiveTextureUnit)                              \
+    X(kBlitOrCopy,  GetTextureUnitObject)                              \
+    X(kBlitOrCopy,  GetTextureContextId)                               \
+    X(kBlitOrCopy,  GetSamplingResolutionGeneration)                   \
+    X(kBlitOrCopy,  GetTextureBindGeneration)                          \
+    X(kBlitOrCopy,  GetMaxTouchedTextureUnit)                          \
+    X(kBlitOrCopy,  GetImageTextureBinding)                            \
+    X(kBlitOrCopy,  GetColorMaskIndexed)                               \
+    X(kBlitOrCopy,  GetDepthMask)                                      \
+    X(kBlitOrCopy,  GetStencilState)                                   \
+    /* Magma's shader blit to the default framebuffer                            */ \
+    /* (TryBlitToDefaultFramebufferWithShader) is a real draw of a backend-owned  */ \
+    /* helper program: it sets the dynamic viewport through ApplyGLViewportState  */ \
+    /* -> ComputeGLViewport (viewport 0 and its depth range), picks the pipeline's */ \
+    /* provoking vertex through GetOrCreateBlitPipeline -> SelectProvokingVertexMode, */ \
+    /* and binds the helper's descriptors through BindProgramUniformBuffers, whose  */ \
+    /* buffer-block resolvers read the frontend binding points.                    */ \
+    X(kBlitOrCopy,  GetViewportIndexed)                                \
+    X(kBlitOrCopy,  GetDepthRangeIndexed)                              \
+    X(kBlitOrCopy,  GetProvokingVertexMode)                            \
+    X(kBlitOrCopy,  GetBufferBindingPoint)                             \
+    /* kTextureOp */                                                   \
+    X(kTextureOp,   GetActiveTextureUnit)                              \
+    X(kTextureOp,   GetTextureUnitObject)                              \
+    X(kTextureOp,   GetImageTextureBinding)                            \
+    X(kTextureOp,   GetTextureContextId)                               \
+    X(kTextureOp,   GetSamplingResolutionGeneration)                   \
+    X(kTextureOp,   GetTextureBindGeneration)                          \
+    X(kTextureOp,   GetMaxTouchedTextureUnit)                          \
+    /* Magma's GenerateMipmap materialises the texture's queued clear before it    */ \
+    /* blits (MaterializePendingClearForTexture -> PreCompensateSrgbClearColor,    */ \
+    /* which reads GL_FRAMEBUFFER_SRGB), and a depth texture takes the shader path */ \
+    /* (GenerateDepthMipmapWithShader -> BindProgramUniformBuffers), whose sampler */ \
+    /* resolver reads the draw framebuffer for the feedback-loop check and whose   */ \
+    /* buffer-block resolvers read the frontend binding points.                    */ \
+    X(kTextureOp,   IsCapabilityEnabled)                               \
+    X(kTextureOp,   GetFramebufferBindingSlot)                         \
+    X(kTextureOp,   GetBufferBindingPoint)                             \
+    /* kReadback */                                                    \
+    X(kReadback,    GetPixelStoreParameters)                           \
+    X(kReadback,    GetBufferBindingSlot)                              \
+    X(kReadback,    GetFramebufferBindingSlot)                         \
+    X(kReadback,    GetActiveTextureUnit)                              \
+    X(kReadback,    GetTextureUnitObject)                              \
+    X(kReadback,    GetClampReadColor)                                 \
+    X(kReadback,    IsCapabilityEnabled)                               \
+    X(kReadback,    GetRenderStateParameters)                          \
+    X(kReadback,    GetRenderStateParametersVersion)                   \
+    X(kReadback,    GetViewport)                                       \
+    X(kReadback,    GetTextureContextId)                               \
+    X(kReadback,    GetSamplingResolutionGeneration)                   \
+    X(kReadback,    GetTextureBindGeneration)                          \
+    X(kReadback,    GetMaxTouchedTextureUnit)                          \
+    X(kReadback,    GetImageTextureBinding)                            \
+    /* The depth/stencil read emulation draws (ScopedEmulationDrawState,          */ \
+    /* DirectGLES.cpp) and pauses an active capture around its own draw, so a      */ \
+    /* readback reads the transform-feedback state exactly as a draw does.         */ \
+    X(kReadback,    IsTransformFeedbackActive)                         \
+    X(kReadback,    IsTransformFeedbackPaused)                         \
+    /* kXfbSpan */                                                     \
+    X(kXfbSpan,     GetTransformFeedbackProgram)                       \
+    X(kXfbSpan,     GetBufferBindingPoint)                             \
+    X(kXfbSpan,     GetTouchedBufferBindingPointCount)                 \
+    X(kXfbSpan,     GetTransformFeedbackCapturedVertices)              \
+    X(kXfbSpan,     IsTransformFeedbackActive)                         \
+    X(kXfbSpan,     IsTransformFeedbackPaused)                         \
+    X(kXfbSpan,     GetTransformFeedbackGeneration)                    \
+    X(kXfbSpan,     GetBoundTransformFeedbackLifetimeId)               \
+    /* kProgramOp: ShaderStorageBlockBinding syncs Espryt's render state and textures */ \
+    X(kProgramOp,   GetRenderStateParameters)                          \
+    X(kProgramOp,   GetRenderStateParametersVersion)                   \
+    X(kProgramOp,   GetViewport)                                       \
+    X(kProgramOp,   IsCapabilityEnabled)                               \
+    X(kProgramOp,   GetFramebufferBindingSlot)                         \
+    X(kProgramOp,   GetTextureUnitObject)                              \
+    X(kProgramOp,   GetTextureContextId)                               \
+    X(kProgramOp,   GetSamplingResolutionGeneration)                   \
+    X(kProgramOp,   GetTextureBindGeneration)                          \
+    X(kProgramOp,   GetMaxTouchedTextureUnit)                          \
+    X(kProgramOp,   GetImageTextureBinding)                            \
+    /* kQuery: Magma's transform feedback query end reads the paused counter */ \
+    /* (DirectVulkan.cpp); every other verb in the class reads nothing and */   \
+    /* its fill is a serial bump                                          */   \
+    X(kQuery,       GetTransformFeedbackPausedPrimitiveCounter)
+
+// clang-format on

MobileGL/MG_Pipe/MGPipe.h

@@ -0,0 +1,98 @@
+// MobileGL - MobileGL/MG_Pipe/MGPipe.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+#include "MGPipeCallbacks.h"
+#include "MGPipeHandles.h"
+#include "MGPipeHostSpan.h"
+#include "MGPipeTypes.h"
+
+// The MGPipe boundary (plan B section 4).
+//
+// The two interface tables are FUNCTION-POINTER STRUCTS, not virtual bases. Three reasons
+// out of this repository rather than out of gallium: the boundary already is a
+// function-pointer struct sitting on one hook point in MG_Backend/Init.cpp; a nullptr entry
+// already means "not implemented, frontend falls back", which is exactly what a
+// not-yet-migrated subsystem needs to say while it keeps pulling; and MG_Test already
+// substitutes this table to mock a backend. The rare EGL and caps surface stays on
+// pActiveBackendObject's virtual functions.
+namespace MobileGL::MG_Pipe {
+    // Unscoped on purpose: PipeCalls.def spells these as bare tokens so the same file can
+    // be read by the C++ preprocessor and by scripts/gen_pipe.py.
+    enum MGPipeCallClass : Uint8 {
+        kScreen,
+        kCtxCso,
+        kCtxState,
+        kCtxObject,
+        kCtxVerb,
+        kCtxQuery,
+        kCallClassCount,
+    };
+
+    enum MGPipeCallFlags : Uint32 {
+        kNone = 0,
+        // The caller must not proceed until the server has acknowledged. Rare by design.
+        kNeedsAck = 1u << 0,
+        // Carries an MGPBlobRef.
+        kHasBlob = 1u << 1,
+        // Carries a variable-length array after the fixed payload.
+        kVarTail = 1u << 2,
+        // Carries an MGHostSpan - the one shape that changes with the transport.
+        kHostSpan = 1u << 3,
+        // Answers into an MGPReplySlot; never blocks.
+        kReplySlot = 1u << 4,
+        // May be null in a backend's table. A null entry is a real answer ("this backend
+        // does not implement it"), not an error: DirectVulkan deliberately leaves
+        // buffer_subdata_resident unregistered, and SetSwapInterval likewise.
+        kOptional = 1u << 5,
+    };
+
+    // The pipeline/dynamic split of RenderStateParameters, defined exactly once (section
+    // 4.5.2). Generated by G7 from the field list ComputePipelineStateHash already hashes;
+    // MGPipeRenderStateSpans.cpp and the setter-consistency test land with P2, which is
+    // when the chunk table can be filled with real offsets.
+    struct MGPipeRenderStateSpans;
+
+    // The catalogue itself. Only macros, so it is safe to expand inside the namespace, and
+    // consumers (the unit test, later the transport) get MGP_CALL_LIST from this header.
+#include "PipeCalls.def"
+
+    // G1: the two interface tables. A null entry means "not implemented" (section 4.1).
+#include "generated/PipeTables.inc"
+
+    // The installed tables. Zero-initialized, so an un-installed MGPipe is every entry
+    // null - which is precisely the pre-migration state.
+    inline MGPipeScreen gMGPipeScreen{};
+    inline MGPipeContext gMGPipeContext{};
+
+    // G2: monolith thunks. These are what MG_Impl call sites move onto, replacing
+    // gBackendFunctionsTable.GL.* one name at a time.
+#include "generated/PipeThunks.inc"
+
+    // G3: wire records, their size assertions, and the applier's bounds precondition.
+#include "generated/PipeWire.inc"
+
+    // G4: the MOBILEGL_PIPE_VERIFY field-wise comparators.
+#include "generated/PipeVerify.inc"
+
+    // G5: PipeInputs field ids and the per-verb poison generations.
+#include "generated/PipeFilled.inc"
+
+    // G5b: the verb enum (one per GLFunctionsTable entry), the verb classes and their
+    // may-read field masks - what MGPipeFillForVerb fills and what a poison build lets a
+    // verb read (FillPoints.def).
+#include "generated/PipeFillPoints.inc"
+
+    // G6: the backend read inventory's coverage table.
+#include "generated/PipeCoverage.inc"
+
+    // G7: the render-state pipeline subset, by member name.
+#include "generated/PipeSpanTable.inc"
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Pipe/MGPipeCallbacks.h

@@ -0,0 +1,61 @@
+// MobileGL - MobileGL/MG_Pipe/MGPipeCallbacks.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+#include "MGPipeHandles.h"
+#include "MGPipeTypes.h"
+
+// The backend -> frontend reverse channel, named (plan B section 7.1).
+//
+// Today this traffic is 95 call sites across 17 methods poked directly into frontend
+// objects. gallium has no vocabulary for shadow writeback, GPU-write notification, texture
+// re-send requests or default-framebuffer geometry, because in Mesa the state tracker and
+// the driver share an address space. Naming them as ten callbacks plus one forward
+// terminator (MGPipeContext::ResourceSubDataComplete) is the deliberate deviation (D8).
+//
+// Installed at context creation. In a monolith these are direct calls; under split they are
+// records on the reverse channel, and their ORDER is a correctness requirement rather than
+// an optimization (section 7.4).
+namespace MobileGL::MG_Pipe {
+    struct MGPipeCallbacks {
+        // A driver-detected GL error that only the server could have seen.
+        void (*OnGlError)(Uint32 code);
+        // Ranges of a resource the GPU wrote; retires MarkGpuWritten.
+        void (*OnGpuWritten)(MGPipeHandle res, Uint rangeCount, const MGPRange* ranges);
+        void (*OnBufferWriteback)(MGPipeHandle res, Uint64 offset, MGPBlobRef bytes);
+        void (*OnTextureWriteback)(MGPipeHandle res, const MGPBox* box, MGPBlobRef bytes);
+        // The one new stall class in this design (D-B6): the server recast a texture and
+        // needs its texels back. The client answers with zero or more ResourceSubData
+        // records terminated by ResourceSubDataComplete carrying the same pullSerial.
+        void (*OnTexturePullRequest)(MGPipeHandle res, Uint16 target, Uint16 firstLevel, Uint16 levelCount,
+                                     Uint64 pullSerial);
+        // SHAPE ONLY, never bytes: the client owns the CPU shadow and allocates the levels
+        // itself.
+        void (*OnMipLevelsGenerated)(MGPipeHandle res, Uint16 base, Uint16 count);
+        // Retires the layering inversion where the swapchain writes into MG_Impl's
+        // pDefaultFramebufferInfo.
+        void (*OnSurfaceChanged)(const MGPSurfaceInfo* info);
+        void (*OnCapsInvalidated)();
+        // <= WARN is lossy, >= ERROR is lossless and rate limited.
+        void (*OnLog)(Uint8 level, const char* text);
+        // The XFB scatter is a read-modify-write of the CLIENT's shadow, so the server
+        // hands back the packed scratch and the client scatters (section 7.2.1).
+        void (*OnXfbScatterReady)(MGPipeHandle scratch, Uint64 packedStride, Uint64 vertices);
+    };
+
+    // Ten, and the count is asserted so an eleventh cannot be added without touching the
+    // transport's reverse-channel record table.
+    inline constexpr SizeT kMGPipeCallbackCount = 10;
+    static_assert(sizeof(MGPipeCallbacks) == kMGPipeCallbackCount * sizeof(void (*)()),
+                  "MGPipeCallbacks gained or lost a callback");
+
+    // Null-initialized: a backend that installs nothing sends nothing.
+    inline MGPipeCallbacks gMGPipeCallbacks{};
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Pipe/MGPipeHandles.h

@@ -0,0 +1,98 @@
+// MobileGL - MobileGL/MG_Pipe/MGPipeHandles.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// MGPipe object identity (plan B section 4.2).
+//
+// A handle is a {slot, gen} pair minted by the CLIENT and never by the server: no create_*
+// call in the catalogue returns a server-cast handle, which is the deliberate deviation
+// from gallium (D1) that lets the whole catalogue be remoted with ZERO creation round
+// trips.
+//
+// Slots are dense and allocated PER KIND, so the server's object table is an array rather
+// than a hash map. The allocator is a free list plus a high-water mark and has nothing to
+// do with MG_State's IndexGenerator - that container's LIFO name reuse is the very problem
+// {slot, gen} exists to close.
+namespace MobileGL::MG_Pipe {
+    enum class MGPipeKind : Uint8 {
+        None = 0,
+        Buffer = 1,
+        Texture,
+        Renderbuffer,
+        Framebuffer,
+        Xfb,
+        RenderStateCso,
+        VertexElementsCso,
+        SamplerCso,
+        SamplerViewCso,
+        ShaderCso,
+        Fence,
+        Query,
+        Context,
+        KindCount,
+    };
+
+    // 8 bytes, POD, passed by value in a register pair.
+    //
+    // Gen increments only when a SLOT IS REUSED - never on a respecify - so {slot, gen} is
+    // unique until the same slot has been recycled 2^32 times. That bound is documented
+    // rather than defended at runtime in release builds: at one recycle per frame at
+    // 1000 fps a single slot would take ~50 days of continuous churn to wrap, and the
+    // debug allocator asserts on the wrap.
+    //
+    // Two generations exist in this design and they are strictly separate (section 4.2.2):
+    // this one is the CLIENT's answer to "is this still the same GL object", while MGGen is
+    // the SERVER's own epoch for "did I recast my driver object". Interface rule: no MGPipe
+    // call may require the client to supply or know MGGen.
+    struct MGPipeHandle {
+        Uint32 Slot;
+        Uint32 Gen;
+
+        friend constexpr Bool operator==(const MGPipeHandle& a, const MGPipeHandle& b) {
+            return a.Slot == b.Slot && a.Gen == b.Gen;
+        }
+    };
+
+    static_assert(sizeof(MGPipeHandle) == 8, "MGPipeHandle is the 8-byte {slot, gen} pair");
+    static_assert(alignof(MGPipeHandle) == 4, "MGPipeHandle must not gain padding on the wire");
+    static_assert(std::is_trivially_copyable_v<MGPipeHandle>);
+
+    // Reserved handles (section 4.2.1).
+    //   {0, 0} is null for every kind.
+    //   {0, 1} of kind Framebuffer is the DEFAULT framebuffer. It exists so the four
+    //   pDefaultFramebufferInfo->defaultFBO identity comparisons in DirectGLES retire into
+    //   an ordinary handle compare.
+    inline constexpr MGPipeHandle kMGPipeNullHandle{0, 0};
+    inline constexpr MGPipeHandle kMGPipeDefaultFramebuffer{0, 1};
+
+    inline constexpr Bool MGPipeHandleIsNull(const MGPipeHandle& handle) {
+        return handle.Slot == 0 && handle.Gen == 0;
+    }
+
+    // Slot 0 of every kind is reserved (null, and the default framebuffer for kind
+    // Framebuffer), so a real allocation starts at 1.
+    inline constexpr Uint32 kMGPipeFirstAllocatableSlot = 1;
+
+    // ShaderCso slot space. The top 1/16 of it is reserved for PROGRAM PIPELINE COMPOSITES
+    // (section 5.6.3): a composite is minted client-side out of the stage programs bound to
+    // a pipeline object, and the server never learns it is a composite - it is just another
+    // ShaderCso. Reserving a band rather than a flag keeps the composite resolver's
+    // lifetime bookkeeping out of the ordinary program slot allocator.
+    inline constexpr Uint32 kMGPipeShaderCsoSlotLimit = 1u << 20;
+    inline constexpr Uint32 kMGPipeShaderCsoCompositeSlotBase =
+        kMGPipeShaderCsoSlotLimit - (kMGPipeShaderCsoSlotLimit >> 4);
+
+    inline constexpr Bool MGPipeIsCompositeShaderSlot(Uint32 slot) {
+        return slot >= kMGPipeShaderCsoCompositeSlotBase && slot < kMGPipeShaderCsoSlotLimit;
+    }
+
+    static_assert(kMGPipeShaderCsoCompositeSlotBase > kMGPipeFirstAllocatableSlot,
+                  "the composite band must not swallow the ordinary program slots");
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Pipe/MGPipeHostSpan.h

@@ -0,0 +1,57 @@
+// MobileGL - MobileGL/MG_Pipe/MGPipeHostSpan.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The ONE thing in MGPipe whose shape changes with the transport (plan B section 4.5.7).
+//
+// Monolith: Ptr addresses the frontend shadow or the application's own memory and the
+// accessor is one predictable branch. Split: Ptr is null and the bytes live in a staging
+// segment named by Seg/Offset, or - for the index bytes a server-side primitive-restart
+// rewrite or multi-draw flattening consumes - in the server's own index host mirror, which
+// costs no wire traffic at all (D-B7).
+namespace MobileGL::MG_Pipe {
+    // Seg sentinels. Anything else is a real SEG_STAGE id assigned by the transport.
+    inline constexpr Uint32 kMGHostSpanSegNone = 0;
+    // "The bytes are already on your side": the server reads them out of the index host
+    // mirror it maintains for every resource created with the ELEMENT_ARRAY bind bit while
+    // kCapNeedsHostIndexBytes is set. When the mirror is over budget the tracker degrades
+    // to per-draw staging and counts the bytes in index-bytes-shipped.
+    inline constexpr Uint32 kMGHostSpanSegFromServerIndexMirror = 0xFFFFFFFFu;
+
+    struct MGHostSpan {
+        // Field order is chosen so the struct is 32 bytes with natural alignment on both a
+        // 64-bit and a 32-bit host: the pointer and the two 32-bit words fill the first
+        // 16-byte block either way.
+        const void* Ptr;
+        Uint32 Seg;
+        Uint32 Pad0;
+        Uint64 Size;
+        Uint64 Offset;
+    };
+
+    static_assert(sizeof(MGHostSpan) == 32, "MGHostSpan is the 32-byte host-bytes descriptor");
+    static_assert(std::is_trivially_copyable_v<MGHostSpan>);
+
+    // Split-mode resolution needs the transport's segment table, which does not exist in a
+    // monolith build; the hook is a weak-ish indirection installed by MG_Remote when it is
+    // compiled in. In P0 there is no transport, so a span that names a segment resolves to
+    // null and every caller is still on the monolith branch.
+    using MGPipeSegmentResolver = const void* (*)(Uint32 seg, Uint64 offset, Uint64 size);
+    inline MGPipeSegmentResolver gMGPipeSegmentResolver = nullptr;
+
+    // One predictable branch on the hot path.
+    inline const void* MGPipeHostBytes(const MGHostSpan& span) {
+        if (span.Ptr != nullptr) {
+            return static_cast<const Uint8*>(span.Ptr) + span.Offset;
+        }
+        if (gMGPipeSegmentResolver == nullptr) return nullptr;
+        return gMGPipeSegmentResolver(span.Seg, span.Offset, span.Size);
+    }
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Pipe/MGPipeTypes.h

@@ -0,0 +1,807 @@
+// MobileGL - MobileGL/MG_Pipe/MGPipeTypes.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+#include "MGPipeHandles.h"
+#include "MGPipeHostSpan.h"
+
+// Every MGPipe payload (plan B section 4.5). Each one is a flat POD with explicit padding,
+// carries a static_assert on trivial copyability and one on its exact size, and never
+// contains a pointer: MGHostSpan, the one shape that changes with the transport, only ever
+// rides in a variable tail (draw_vbo's user indices, set_shader_buffers' named-UBO bytes),
+// never inline in a fixed payload.
+//
+// Sizes are asserted rather than merely documented because the wire records generated from
+// these structs (generated/PipeWire.inc) are memcpy'd; a field silently changing width is a
+// protocol break that no test would otherwise see.
+//
+// P0.5 DEBT, half repaid. The MG_State half is gone: ResidualValueBlock's
+// RenderStateParameters and PixelStoreParameters now come from MGPipeValueTypes.h, so
+// this header no longer reaches RenderState.h (its closure still touches TextureEnum.h,
+// through BackendObject.h, for the reason in the next sentence). What remains is MGPCaps embedding
+// MG_Backend's DynamicBackendParameters - deliberate, the caps block IS that struct
+// (section 4.4.1) - and that one include is what still keeps purity gate A (section
+// 10.3) off this header; the gate asserts MGPipeValueTypes.h instead. The caps block
+// needs fixed-width members before it can move (a type change, not a move): P1/P7.
+#include <MG_Backend/BackendObject.h>
+#include "MGPipeValueTypes.h"
+
+namespace MobileGL::MG_Pipe {
+    using MG_Backend::DynamicBackendParameters;
+    // Both live directly in namespace MobileGL and, since P0.5, are declared in
+    // MG_Pipe/MGPipeValueTypes.h.
+    using MobileGL::PixelStoreParameters;
+    using MobileGL::RenderStateParameters;
+
+    // A payload must be memcpy-able and its size must be an exact, stated number.
+#define MGP_ASSERT_POD(T, Size)                                                                                        \
+    static_assert(std::is_trivially_copyable_v<T>, #T " must be trivially copyable");                                  \
+    static_assert(sizeof(T) == (Size), #T " changed size; update the wire format and this assertion")
+
+    // ---------------------------------------------------------------------------------
+    // Shared primitives
+    // ---------------------------------------------------------------------------------
+
+    // A run of bytes in the command stream's blob area. Monolith: Seg is
+    // kMGHostSpanSegNone and Offset is an address into the caller's staging arena. Split:
+    // Seg names a transport segment.
+    struct MGPBlobRef {
+        Uint64 Offset;
+        Uint64 Size;
+        Uint32 Seg;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPBlobRef, 24);
+
+    struct MGPRange {
+        Uint64 Offset;
+        Uint64 Size;
+    };
+    MGP_ASSERT_POD(MGPRange, 16);
+
+    // Destination box in the level's own coordinate system (section 4.5.6).
+    struct MGPBox {
+        Int32 X, Y, Z;
+        Uint32 W, H, D;
+    };
+    MGP_ASSERT_POD(MGPBox, 24);
+
+    // Where an asynchronous answer lands. Every server query in this catalogue is
+    // async-with-handle; none of them blocks (section 4.4.6, "the total rule").
+    struct MGPReplySlot {
+        Uint64 Id;
+    };
+    MGP_ASSERT_POD(MGPReplySlot, 8);
+
+    // One contiguous run of RenderStateParameters bytes. The pipeline/dynamic split is
+    // defined exactly once, in MGPipeRenderStateSpans, and generated by G7 from the field
+    // list VulkanRenderer::ComputePipelineStateHash already hashes (section 4.5.2).
+    struct MGPStateChunk {
+        Uint16 Offset;
+        Uint16 Length;
+    };
+    MGP_ASSERT_POD(MGPStateChunk, 4);
+
+    // The payload of every call that carries nothing but an object identity.
+    struct MGPHandleOnly {
+        MGPipeHandle Handle;
+        Uint32 Kind; // MGPipeKind, widened for a stable wire size
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPHandleOnly, 16);
+
+    // ---------------------------------------------------------------------------------
+    // Screen: caps, resources, fences
+    // ---------------------------------------------------------------------------------
+
+    // Capability bits that replace "is this table slot null" as an implicit feature probe
+    // (section 4.4.1). The five ownership-switch bits of v1 are deliberately absent: what
+    // they tried to express - who performs primitive-restart rewriting and multi-draw
+    // flattening - is not expressible as a capability (D-B7).
+    enum MGPCapBit : Uint64 {
+        kCapNone = 0,
+        kCapViewportArray = 1ull << 0,
+        kCapFloat64VertexAttrib = 1ull << 1,
+        kCapResidentSubData = 1ull << 2,
+        kCapCpuXfbPrimitiveAccounting = 1ull << 3,
+        kCapTimerQuery = 1ull << 4,
+        kCapOcclusionQuery = 1ull << 5,
+        kCapXfbPrimitivesQuery = 1ull << 6,
+        // The server rewrites restart indices / flattens multi-draws itself and therefore
+        // needs the index bytes on its side: under split this arms the index host mirror
+        // (D-B7).
+        kCapNeedsHostIndexBytes = 1ull << 7,
+        // The server packs named uniform blocks into its own ring and therefore needs the
+        // host bytes of a set_shader_buffers(Uniform) range (D-B8).
+        kCapNeedsHostUboBytes = 1ull << 8,
+    };
+
+    struct MGPCaps {
+        // The ~90 flat scalars the backends already publish, by inclusion rather than by
+        // restatement: a caps field added there must not need a second edit here. This is
+        // also where the six per-axis compute limits (MaxComputeWorkGroupCount/Size) ride -
+        // the only indexed answers the device owns, and therefore the only ones that outlive
+        // the GetIntegeri_v table entry (see the PipeCalls.def footer).
+        DynamicBackendParameters Dynamic;
+        Uint64 CallMask; // MGPCapBit
+        // The two halves that are not flat PODs travel as blobs: the format capability
+        // cache holds Vector<Int> sample-count lists, and the renderer strings are
+        // Strings. Their serializers land with the transport (P5).
+        MGPBlobRef FormatCapabilities;
+        MGPBlobRef RendererInfo;
+    };
+    static_assert(std::is_trivially_copyable_v<MGPCaps>, "MGPCaps must be trivially copyable");
+    // Stated as a COMPOSITION rather than a literal: DynamicBackendParameters still carries
+    // SizeT fields, so its literal size is ABI-dependent until P0.5 moves the caps block
+    // into MGPipeValueTypes.h with fixed-width members. The assertion still fires on any
+    // padding introduced between the members below.
+    static_assert(sizeof(MGPCaps) == sizeof(DynamicBackendParameters) + 8 + 24 + 24,
+                  "MGPCaps gained padding or a member; update the wire format");
+
+    // Discriminated resource descriptor: buffers, every texture target and renderbuffers
+    // share one create/respecify shape (section 4.5.1).
+    struct MGPResourceDesc {
+        MGPipeHandle Resource;
+        Uint8 Target;      // Buffer | Tex1D..TexCubeArray | Tex2DMS.. | Renderbuffer | TexBuffer
+        Uint8 StorageKind; // == TextureStorageType (Mipmap | Buffer)
+        // VERTEX|INDEX|CONSTANT|SHADER_BUFFER|INDIRECT|SAMPLER|SHADER_IMAGE|RENDER_TARGET|
+        // DEPTH_STENCIL|STREAM_OUTPUT|ATOMIC|ELEMENT_ARRAY. The ELEMENT_ARRAY bit is the
+        // D-B7 switch: with kCapNeedsHostIndexBytes set the server mirrors this resource.
+        Uint16 BindMask;
+        Uint32 InternalFormat; // already resolved to an uncompressed fallback by the client
+        Uint32 Width, Height, Depth;
+        Uint16 ArrayLayers, Levels, Samples;
+        Uint8 FixedSampleLocations, Immutable;
+        Uint32 Usage;        // BufferUsage
+        Uint32 StorageFlags; // glBufferStorage flags
+        Uint8 HasDefinedContent;  // false after a NULL-data respecify
+        Uint8 ImageBindableHint;  // client-side everImageBound; pre-emptive allocation
+        Uint16 Pad0;
+        // Diagnostics only. A GL name is NEVER an identity, never a memo key and never part
+        // of a content hash (section 4.2.1). Widened from the plan's two bytes, which
+        // cannot hold one.
+        Uint32 GlNameForDiag;
+        Uint32 Pad1;
+        MGPipeHandle ViewOf;             // storage owner for a texture view
+        MGPipeHandle BufferForTexBuffer; // texture-buffer backing store
+        Uint64 BufOffset, BufSize;       // kWholeBuffer == ~0, resolved live
+    };
+    MGP_ASSERT_POD(MGPResourceDesc, 88);
+    inline constexpr Uint64 kMGPipeWholeBuffer = ~0ull;
+
+    struct MGPFenceWait {
+        MGPipeHandle Fence;
+        Uint64 TimeoutNs;
+    };
+    MGP_ASSERT_POD(MGPFenceWait, 16);
+
+    struct MGPQueryDesc {
+        MGPipeHandle Query;
+        Uint32 Kind;   // GL query target
+        Uint32 Stream; // indexed query stream, 0 otherwise
+    };
+    MGP_ASSERT_POD(MGPQueryDesc, 16);
+
+    struct MGPQueryResultRequest {
+        MGPipeHandle Query;
+        Uint8 Wait; // the two-value contract of GetSyncStatus is preserved verbatim
+        Uint8 Pad0[3];
+        Uint32 Pad1;
+    };
+    MGP_ASSERT_POD(MGPQueryResultRequest, 16);
+
+    // query_timestamp: glGetInteger64v(GL_TIMESTAMP), the synchronous "what time is it on the
+    // GPU" GLFunctionsTable::GetGpuTimestampNs answers today. The request names nothing; the
+    // Int64 nanosecond stamp comes back through the reply slot.
+    struct MGPTimestampRequest {
+        Uint32 Reserved;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPTimestampRequest, 8);
+
+    // ---------------------------------------------------------------------------------
+    // CSOs
+    // ---------------------------------------------------------------------------------
+
+    // create_render_state carries ONLY the pipeline subset's chunk bytes. chunkMask lets an
+    // incremental create send just the chunks that moved, against baseCso (section 4.5.2).
+    struct MGPRenderStateDesc {
+        MGPipeHandle Cso;
+        MGPipeHandle BaseCso;
+        Uint32 ChunkMask; // all ones for a brand new CSO
+        Uint32 Pad0;
+        MGPBlobRef Blob;
+    };
+    MGP_ASSERT_POD(MGPRenderStateDesc, 48);
+
+    // Steady state: 12 bytes on the wire, no hashing, no blob.
+    struct MGPBindRenderState {
+        MGPipeHandle Cso;
+        Uint16 Version;
+        Uint16 PipelineVersion;
+    };
+    MGP_ASSERT_POD(MGPBindRenderState, 12);
+
+    // The half of the render state that must NOT mint a CSO: viewport, scissor, depth
+    // range, blend colour, line width, polygon offset, stencil ref/write mask, clear
+    // values, sample coverage, hints and the point-size family. This is what keeps
+    // glViewport from evicting Magma's pipeline memo (D-B1).
+    struct MGPDynamicState {
+        Uint32 ChunkMask;
+        Uint16 Version;
+        Uint16 Pad0;
+        MGPBlobRef Blob;
+    };
+    MGP_ASSERT_POD(MGPDynamicState, 32);
+
+    // Both views travel, and neither is derivable from the other: the resolved
+    // VertexAttribute[32] AND the binding points, because a pointer-call stride of 0 means
+    // "element size" while a binding-model stride of 0 means "every vertex reads the same
+    // element" (section 4.5.3). IsLong and Type == Float64 are carried separately.
+    struct MGPVertexElements {
+        MGPipeHandle Cso;
+        Uint32 AttributeCount;
+        Uint32 BindingPointCount;
+        MGPBlobRef Blob; // VertexAttribute[] followed by VertexBufferBindingPoint[]
+    };
+    MGP_ASSERT_POD(MGPVertexElements, 40);
+
+    // SamplerParameters crosses byte for byte INCLUDING borderColorForm: without it the
+    // backend cannot choose between glSamplerParameterIiv and fv, or between the
+    // VkBorderColor families, because all three representations are always numerically
+    // populated (section 4.5.4). Carried as a blob until P0.5 gives it a value header.
+    struct MGPSamplerDesc {
+        MGPipeHandle Cso;
+        MGPBlobRef Parameters;
+    };
+    MGP_ASSERT_POD(MGPSamplerDesc, 32);
+
+    // = pipe_sampler_view, and ONLY the view restrictions. Everything a glTexParameter
+    // writes lives on set_texture_params instead, because a texture that is only an FBO
+    // attachment, only an image binding or only a glCopyImageSubData endpoint has no
+    // sampler view to hang it on (section 4.4.3).
+    struct MGPSamplerView {
+        MGPipeHandle Cso;
+        MGPipeHandle Texture;
+        Uint32 InternalFormat; // aliasing format for glTextureView
+        Uint8 Target;
+        Uint8 Pad0[3];
+        Uint16 MinLevel, NumLevels, MinLayer, NumLayers;
+        Uint16 Samples;
+        Uint8 FixedSampleLocations;
+        Uint8 Pad1;
+    };
+    MGP_ASSERT_POD(MGPSamplerView, 36);
+
+    // Per texture OBJECT, independent of any view.
+    struct MGPTextureParams {
+        MGPipeHandle Res;
+        Uint16 BaseLevel, MaxLevel;
+        Uint8 Swizzle[4];
+        Uint8 DepthStencilMode;
+        // Mirrors m_forceTextureParamsResync: the widened-channel carrier needs a swizzle
+        // override that the frontend params version does not move for.
+        Uint8 ForceResync;
+        Uint8 Pad0[2];
+        Float MinLod, MaxLod, LodBias;
+    };
+    MGP_ASSERT_POD(MGPTextureParams, 32);
+
+    // create_shader_state. The reflection blob is the whole LinkArtifacts + SpirvArtifacts
+    // archive; P0.5 extracts those types out of ProgramObject.h so a server can
+    // deserialize into them without dragging in glslang (section 4.5.5).
+    struct MGPProgramDesc {
+        MGPipeHandle Cso;
+        Uint32 StageMask; // == GetLinkedShaderStages()
+        Uint32 GlobalUboSize;
+        Uint32 ReservedNumSamplesOffset;
+        Uint8 SpirvStatus;
+        Uint8 NativeFloat64;
+        Uint8 PointSizeDemoted;
+        Uint8 EnableSpirvValidation;
+        MGPBlobRef Spirv[6]; // per stage
+        MGPBlobRef Reflection;
+    };
+    MGP_ASSERT_POD(MGPProgramDesc, 192);
+
+    // ---------------------------------------------------------------------------------
+    // set_*
+    // ---------------------------------------------------------------------------------
+
+    // = pipe_surface. internalFormat is INLINE so the four cross-object masks fall out at
+    // push time with no lookup (section 4.5.6).
+    struct MGPSurface {
+        MGPipeHandle Res;
+        Uint32 InternalFormat;
+        Uint8 Kind; // Texture | Renderbuffer | None
+        Uint8 Layered;
+        Uint16 Level;
+        Uint32 Layer;
+        Uint16 UploadTarget;
+        Uint16 Pad0;
+    };
+    MGP_ASSERT_POD(MGPSurface, 24);
+
+    struct MGPFramebufferState {
+        MGPipeHandle Fbo; // kMGPipeDefaultFramebuffer for the default framebuffer
+        MGPSurface Color[8];
+        MGPSurface Depth, Stencil;
+        // The RESOLVED read surface, not an index. This is what structurally closes the
+        // read-buffer-shared-FBO defect class.
+        MGPSurface ReadSurface;
+        Int8 DrawBuffers[8]; // attachment index, -1 = NONE
+        Uint16 Width, Height, Layers, Samples;
+        Uint8 FixedSampleLocations, IsDefault, Complete, Pad0;
+        Uint32 Pad1;
+        // Two jobs (section 4.5.6): the server's render-pass memo key, and the CLIENT's
+        // emission suppressor - an unchanged hash means this record is not sent at all.
+        // The same pattern is mandatory for every kVarTail set_* below, or 26.2's
+        // redundant glBindSampler traffic reappears as a variable-length record per batch.
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPFramebufferState, 304);
+
+    struct MGPVertexBuffer {
+        MGPipeHandle Res;
+        Uint64 Offset;
+        Uint32 Stride;
+        Uint32 Divisor;
+        Uint32 BindingIndex;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPVertexBuffer, 32);
+
+    // Var-tail header: MGPVertexBuffer[Count] follows.
+    struct MGPVertexBuffers {
+        Uint32 Start, Count;
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPVertexBuffers, 16);
+
+    // An independent call, NOT a subset of the VAO configuration version (D5).
+    struct MGPIndexBuffer {
+        MGPipeHandle Res;
+        Uint64 Offset;
+        Uint32 IndexSize;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPIndexBuffer, 24);
+
+    struct MGPIndirectBuffers {
+        MGPipeHandle DrawIndirect;
+        MGPipeHandle Parameter;
+    };
+    MGP_ASSERT_POD(MGPIndirectBuffers, 16);
+
+    // One entry of set_sampler_views. No stage dimension: MobileGL's texture unit space is
+    // MERGED (TextureState::m_textureUnits is one Array of MAX_TEXTURE_IMAGE_UNITS = 192),
+    // and the same unit may be sampled from two stages (section 4.4.3).
+    struct MGPBoundView {
+        MGPipeHandle View;
+        MGPipeHandle Texture;
+        Uint32 Unit;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPBoundView, 24);
+
+    struct MGPSamplerViews {
+        Uint32 Start, Count;
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPSamplerViews, 16);
+
+    // Var-tail header: MGPipeHandle[Count] of sampler CSOs follows.
+    struct MGPSamplerStates {
+        Uint32 Start, Count;
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPSamplerStates, 16);
+
+    struct MGPImageView {
+        MGPipeHandle Res;
+        Uint32 Unit;
+        Uint32 InternalFormat;
+        Uint32 Layer;
+        Uint16 Level;
+        Uint8 Layered;
+        Uint8 Access;
+    };
+    MGP_ASSERT_POD(MGPImageView, 24);
+
+    struct MGPShaderImages {
+        Uint32 Start, Count;
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPShaderImages, 16);
+
+    // One bound buffer range: 24 bytes, no inline host span. The named-UBO host bytes a
+    // backend needs under kCapNeedsHostUboBytes (D-B8) travel as an OPTIONAL second var-tail,
+    // MGHostSpan[HostSpanCount] behind the ranges, announced by MGPShaderBuffers below. An
+    // inline span would have cost every SSBO, atomic-counter and XFB range 32 dead bytes, and
+    // D-B8 says not to freeze that payload's shape before the stage-ubo-named counter has
+    // produced numbers.
+    struct MGPBufferRange {
+        MGPipeHandle Res;
+        Uint64 Offset;
+        Uint64 Size;
+    };
+    MGP_ASSERT_POD(MGPBufferRange, 24);
+
+    // Var-tail header: MGPBufferRange[Count], then MGHostSpan[HostSpanCount]. HostSpanCount is
+    // 0, or Count for the Uniform class under kCapNeedsHostUboBytes (a range with nothing to
+    // ship carries an empty span, so the two arrays stay index-aligned).
+    struct MGPShaderBuffers {
+        Uint32 Class; // Uniform | ShaderStorage | AtomicCounter
+        Uint32 Start;
+        Uint32 Count;
+        Uint32 WritableMask;
+        Uint32 HostSpanCount; // 0, or Count when the kHostSpan tail is present (D-B8)
+        Uint32 Pad0;
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPShaderBuffers, 32);
+
+    // Var-tail header: MGPBufferRange[Count] then Uint32 offsets[Count].
+    struct MGPStreamOutputTargets {
+        Uint32 Count;
+        Uint32 Pad0;
+        Uint64 Generation;
+        Uint64 ContentHash;
+    };
+    MGP_ASSERT_POD(MGPStreamOutputTargets, 24);
+
+    // Covers the DEFAULT UNIFORM BLOCK only (D6).
+    struct MGPGlobalConstants {
+        MGPipeHandle ShaderCso;
+        Uint32 Version;
+        Uint32 Pad0;
+        MGPBlobRef Blob;
+    };
+    MGP_ASSERT_POD(MGPGlobalConstants, 40);
+
+    // The float/int/uint view is resolved on the CLIENT by ClassifyVertexAttribType.
+    struct MGPAttribValue {
+        Uint32 Location;
+        Uint8 ValueClass; // Float | Int | Uint | Double
+        Uint8 Pad0[3];
+        Uint32 Data[4];
+    };
+    MGP_ASSERT_POD(MGPAttribValue, 24);
+
+    // Var-tail header: MGPAttribValue[popcount(Mask)] follows.
+    struct MGPVertexAttribDefaults {
+        Uint32 Mask;
+        Uint32 Count;
+    };
+    MGP_ASSERT_POD(MGPVertexAttribDefaults, 8);
+
+    // PACK only. There is deliberately no unpack counterpart: nothing on the far side of
+    // the boundary reads unpack state (section 4.6 D5), and the staged-repack upload path
+    // does not even issue glPixelStorei.
+    struct MGPPixelPackState {
+        PixelStoreParameters Pack;
+    };
+    static_assert(std::is_trivially_copyable_v<MGPPixelPackState>);
+    // 28 is what PixelStoreParameters measures: two Bools, two bytes of padding, six Ints.
+    // Asserting against sizeof(PixelStoreParameters) itself was a tautology that could not
+    // notice the value struct changing width under the wire format.
+    static_assert(sizeof(MGPPixelPackState) == 28,
+                  "MGPPixelPackState changed size; update the wire format and this assertion");
+
+    // Also a shader-variant input: both backends bake these into the synthesized
+    // pass-through control stage.
+    struct MGPPatchState {
+        Uint32 Vertices;
+        Uint32 Pad0;
+        Float Outer[4];
+        Float Inner[2];
+        Uint32 Pad1[2];
+    };
+    MGP_ASSERT_POD(MGPPatchState, 40);
+
+    // Migration-only (section 6.3). Every stage removes fields and lowers
+    // MGL_RESIDUAL_BLOCK_SIZE; P13 asserts it is zero, which is the retirement trip wire.
+    //
+    // Layout must be asserted MEMBER BY MEMBER, not only by sizeof: a heterogeneous POD
+    // union is where padding differs across ABIs, and the monolith verify harness is blind
+    // to it because both sides are the same translation unit. G3 emits the offsetof
+    // assertions; under split the block is serialized field-wise rather than memcpy'd.
+    struct ResidualValueBlock {
+        RenderStateParameters RenderState; // until create/bind_render_state + set_dynamic_state land
+        PixelStoreParameters Pack;         // until set_pixel_pack_state lands
+        Uint64 CapabilityBits;
+        Uint32 PatchVertices;
+        Uint32 Pad0;
+        Float PatchOuter[4];
+        Float PatchInner[2];
+        Uint32 Pad1[2];
+    };
+    static_assert(std::is_trivially_copyable_v<ResidualValueBlock>);
+// The retirement ratchet. This number only ever goes DOWN: every stage that lands a real
+// set_* call deletes fields here and lowers it, and P13 replaces it with
+// static_assert(sizeof(ResidualValueBlock) == 0), which stays red until the last field is
+// gone. Shrinking the block without lowering the number, or growing it at all, is a build
+// break - which is the point.
+//
+// Stable across the ABIs MobileGL ships on: every member of RenderStateParameters and
+// PixelStoreParameters is a fixed-width scalar or an array of one, with no pointer and no
+// SizeT.
+#define MGL_RESIDUAL_BLOCK_SIZE 1248
+    static_assert(sizeof(ResidualValueBlock) == MGL_RESIDUAL_BLOCK_SIZE,
+                  "the residual value block changed size; lower MGL_RESIDUAL_BLOCK_SIZE if a field "
+                  "retired, and do not raise it");
+
+    struct MGPResidualValueState {
+        Uint32 Version;
+        Uint32 Pad0;
+        MGPBlobRef Blob;
+    };
+    MGP_ASSERT_POD(MGPResidualValueState, 32);
+
+    // ---------------------------------------------------------------------------------
+    // Transfer
+    // ---------------------------------------------------------------------------------
+
+    // Shape copied from the unpack ring's existing UnpackStagingBlock. The source strides
+    // are CARRIED, not inferred from a pointer comparison: the old
+    // `uploadData == mipData` test cannot survive a split, where the client neither ships
+    // the whole level nor keeps a server-side mirror of it (section 4.5.6).
+    struct MGPSubRegion {
+        Int32 X, Y, Z;
+        Uint32 W, H, D;
+        Uint64 SrcOffset;      // into the blob
+        Uint32 SrcRowStride;   // bytes; 0 = tightly packed (w * bpp)
+        Uint32 SrcSliceStride; // bytes; 0 = tightly packed
+    };
+    MGP_ASSERT_POD(MGPSubRegion, 40);
+
+    // Carries the union box AND the region list so the SERVER picks the upload shape - the
+    // decision belongs on the side that pays the GPU cost. Mali prices texture upload by
+    // JOB COUNT: ~100 sprite rects against one union box measured +6 ms/frame.
+    //
+    // THE BUFFER HALF. With Target == Buffer there is no level and no box, so the destination
+    // byte range rides in the box's first coordinate and first extent: UnionBox.X is the byte
+    // offset, UnionBox.W the byte size, Y = Z = 0, H = D = 1, Level = 0, RegionCount = 0, and
+    // Blob holds exactly Size source bytes. That caps ONE record at a 2^31-1 offset and a
+    // 2^32-1 size; a range beyond either is split by the emitter - the same rule, and at
+    // SEG_STAGE's 32 MiB the far tighter one, that the ring's half-capacity bound already
+    // imposes on it. MGPipeSetSubDataBufferRange / MGPipeSubDataBufferOffset / Size below are
+    // the only spelling of this convention; nothing else reads the box for a buffer.
+    struct MGPSubData {
+        MGPipeHandle Res;
+        Uint16 Target, Level;
+        // Replaces the backend's `uploadData == mipData` pointer comparison: are these
+        // bytes an untransformed level shadow?
+        Uint8 SourceIsVerbatimLevelShadow;
+        Uint8 Pad0[3];
+        MGPBox UnionBox;
+        Uint32 RegionCount; // MGPSubRegion[] in the variable tail
+        Uint32 Pad1;
+        MGPBlobRef Blob;
+    };
+    MGP_ASSERT_POD(MGPSubData, 72);
+
+    // Encodes a buffer byte range into the record's box. False, with the record untouched,
+    // when the range does not fit one record: the emitter has to split it.
+    inline Bool MGPipeSetSubDataBufferRange(MGPSubData& record, Uint64 offset, Uint64 size) {
+        if (offset > 0x7FFFFFFFull || size > 0xFFFFFFFFull) {
+            return false;
+        }
+        record.UnionBox = MGPBox{static_cast<Int32>(offset), 0, 0, static_cast<Uint32>(size), 1, 1};
+        record.Level = 0;
+        record.RegionCount = 0;
+        return true;
+    }
+    inline Uint64 MGPipeSubDataBufferOffset(const MGPSubData& record) {
+        // A negative X is a corrupt record (the encoder never writes one); read as unsigned
+        // it lands above the encodable bound, which the applier's bounds gate refuses.
+        return static_cast<Uint64>(static_cast<Uint32>(record.UnionBox.X));
+    }
+    inline Uint64 MGPipeSubDataBufferSize(const MGPSubData& record) { return record.UnionBox.W; }
+
+    // The forward terminator for a server-initiated texture pull (section 7.1). May carry
+    // zero regions - that is how a pull that needs nothing is answered.
+    struct MGPSubDataComplete {
+        MGPipeHandle Res;
+        Uint16 Target, FirstLevel, LevelCount, Pad0;
+        Uint64 PullSerial;
+    };
+    MGP_ASSERT_POD(MGPSubDataComplete, 24);
+
+    // Carries the application's REAL access flags, not a normalized subset.
+    struct MGPFlushRange {
+        MGPipeHandle Res;
+        Uint64 Offset, Size;
+        Uint32 AccessFlags; // Flags<BufferMappingAccessBit>
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPFlushRange, 32);
+
+    struct MGPReadback {
+        MGPipeHandle Res;
+        Uint64 Offset, Size;
+    };
+    MGP_ASSERT_POD(MGPReadback, 24);
+
+    struct MGPCopyRegion {
+        MGPipeHandle Src, Dst;
+        MGPBox SrcBox;
+        Int32 DstX, DstY, DstZ;
+        Uint16 SrcTarget, DstTarget;
+        Uint16 SrcLevel, DstLevel;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPCopyRegion, 64);
+
+    struct MGPBlit {
+        MGPipeHandle ReadFbo, DrawFbo;
+        Int32 SrcX0, SrcY0, SrcX1, SrcY1;
+        Int32 DstX0, DstY0, DstX1, DstY1;
+        Uint32 Mask;
+        Uint32 Filter;
+    };
+    MGP_ASSERT_POD(MGPBlit, 56);
+
+    // One discriminated record replacing glClear, the four glClearBuffer* and the four
+    // glClearNamedFramebuffer* entry points (section 4.4.4).
+    struct MGPClear {
+        MGPipeHandle Fbo;
+        Uint32 Kind;   // Whole | Color | Depth | Stencil | DepthStencil
+        Int32 DrawBufferIndex;
+        Uint32 BufferMask; // GL_COLOR_BUFFER_BIT etc. for the whole-framebuffer form
+        Uint32 ValueClass; // Float | Int | Uint
+        Uint32 ColorValue[4];
+        Float DepthValue;
+        Int32 StencilValue;
+    };
+    MGP_ASSERT_POD(MGPClear, 48);
+
+    struct MGPMipPlan {
+        MGPipeHandle Res;
+        Uint16 Target, BaseLevel, LevelCount, Pad0;
+    };
+    MGP_ASSERT_POD(MGPMipPlan, 16);
+
+    // read_pixels and get_texture_image share one shape; both answer into a reply slot.
+    struct MGPReadbackInfo {
+        MGPipeHandle Res; // null for read_pixels: the bound read surface answers
+        MGPBox Box;
+        Uint32 Format, Type;
+        Uint16 Target, Level;
+        Uint32 Pad0;
+        Uint64 DstOffset, DstSize;
+    };
+    MGP_ASSERT_POD(MGPReadbackInfo, 64);
+
+    // ---------------------------------------------------------------------------------
+    // Commands
+    // ---------------------------------------------------------------------------------
+
+    enum MGPDrawFlagBit : Uint8 {
+        kDrawHasUserIndices = 1u << 0,
+        kDrawPrimitiveRestart = 1u << 1,
+        kDrawIndicesAreClient = 1u << 2,
+        kDrawHasIndexRange = 1u << 3,
+        kDrawHasXfbCount = 1u << 4,
+    };
+
+    // = pipe_draw_info. Today's twenty draw entry points collapse onto this one call, with
+    // MGPDrawRange[] holding exactly the shape the glMultiDraw* family already has.
+    //
+    // minIndex/maxIndex are computed only on the client-memory array path today, and
+    // xfbCpuCapturedVertices only on the XFB scatter path, so Flags gates the WORK. They
+    // stay in the fixed head; moving them into the variable tail is a wire-format decision
+    // that belongs with the transport (P5), where per-draw byte histograms exist to size
+    // it. userIndices is in the variable tail already, so the VBO path - every Minecraft
+    // and Sodium draw - never pays the 32 bytes of an MGHostSpan.
+    struct MGPDrawInfo {
+        Uint32 Mode;
+        Uint8 IndexSize; // 0 = arrays, else 1 / 2 / 4
+        Uint8 Flags;     // MGPDrawFlagBit
+        Uint16 Pad0;
+        Uint32 InstanceCount, StartInstance;
+        Uint32 RestartIndex;
+        Uint32 DrawIdOffset;
+        MGPipeHandle IndexResource;
+        Uint32 MinIndex, MaxIndex; // ~0 = unknown
+        Uint64 XfbCpuCapturedVertices;
+        Uint32 NumDraws; // MGPDrawRange[] in the variable tail
+        Uint32 Pad1;
+    };
+    MGP_ASSERT_POD(MGPDrawInfo, 56);
+
+    // = pipe_draw_start_count_bias.
+    struct MGPDrawRange {
+        Uint32 Start, Count;
+        Int32 IndexBias;
+    };
+    MGP_ASSERT_POD(MGPDrawRange, 12);
+
+    // Present when the draw is indirect. The client resolves the COUNT itself, so the
+    // server never reads an indirect command block to learn how many draws there are.
+    struct MGPDrawIndirect {
+        MGPipeHandle Buffer;
+        MGPipeHandle ParameterBuffer;
+        Uint64 Offset, ParameterOffset;
+        Uint32 Stride, DrawCount;
+    };
+    MGP_ASSERT_POD(MGPDrawIndirect, 40);
+
+    struct MGPGridInfo {
+        Uint32 GridX, GridY, GridZ;
+        Uint32 BlockX, BlockY, BlockZ;
+        MGPipeHandle IndirectBuffer;
+        Uint64 IndirectOffset;
+        Uint8 IsIndirect;
+        Uint8 Pad0[7];
+    };
+    MGP_ASSERT_POD(MGPGridInfo, 48);
+
+    struct MGPMemoryBarrier {
+        Uint32 Bits; // GLbitfield
+        Uint8 ByRegion;
+        Uint8 Pad0[3];
+    };
+    MGP_ASSERT_POD(MGPMemoryBarrier, 8);
+
+    struct MGPStreamOutputBegin {
+        Uint32 PrimitiveMode;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPStreamOutputBegin, 8);
+
+    // end_stream_output carries the accounting the client owns; the scatter itself is a
+    // read-modify-write of the client's shadow and lives there (section 7.2.1).
+    struct MGPXfbAccounting {
+        Uint64 CapturedVertices;
+        Uint64 PrimitivesWritten;
+        Uint32 PrimitiveMode;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPXfbAccounting, 24);
+
+    struct MGPStreamOutputControl {
+        Uint32 Reserved;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPStreamOutputControl, 8);
+
+    struct MGPFlush {
+        Uint32 Flags;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPFlush, 8);
+
+    struct MGPPresent {
+        Uint64 FrameSerial;
+    };
+    MGP_ASSERT_POD(MGPPresent, 8);
+
+    struct MGPSwapInterval {
+        Int32 Interval;
+        Uint32 Pad0;
+    };
+    MGP_ASSERT_POD(MGPSwapInterval, 8);
+
+    // ---------------------------------------------------------------------------------
+    // Reverse channel payloads (section 7.1)
+    // ---------------------------------------------------------------------------------
+
+    struct MGPSurfaceInfo {
+        Uint32 Width, Height;
+        Uint32 InternalFormat;
+        Uint16 Samples, Layers;
+        Uint8 IsDefault;
+        Uint8 Pad0[7];
+    };
+    MGP_ASSERT_POD(MGPSurfaceInfo, 24);
+
+#undef MGP_ASSERT_POD
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Pipe/MGPipeValueTypes.h

@@ -0,0 +1,549 @@
+// MobileGL - MobileGL/MG_Pipe/MGPipeValueTypes.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#ifndef MOBILEGL_MG_PIPE_VALUE_TYPES_H // belt and braces: this file is reachable both as
+#define MOBILEGL_MG_PIPE_VALUE_TYPES_H // <MG_Pipe/...> and <...> (CMakeLists.txt:531,535)
+#include <Includes.h>
+#include <MG_Util/Math/VectorTypes.h> // includes only <Includes.h> + <cstring>
+#include <cstddef>                    // offsetof
+#include <type_traits>
+
+// The value types MG_Pipe payloads embed (plan B section 6.3; ARCHITECTURE.md section on
+// the value header): the render-state, pixel-store, sampler and vertex-attribute value
+// structs and the enums they are made of. They lived in MG_State::GLState until P0.5;
+// the MG_State headers that used to define them now include this file, so every existing
+// spelling (namespace and name) compiles unchanged.
+//
+// PURITY: nothing from MG_State, MG_Impl, MG_Backend or MG_Remote -
+// scripts/check_include_closure.py probe "value-header" (ROADMAP P0.5; ARCHITECTURE.md
+// section 10.3 gate A). Adding one turns CI red. MG_Pipe never includes MG_State back.
+
+namespace MobileGL {
+    // GL_MAX_DRAW_BUFFERS as MobileGL advertises it. FramebufferObject::MAX_DRAW_BUFFERS is
+    // defined from this constant, so the two cannot drift.
+    inline constexpr Uint kMGMaxDrawBuffers = 8;
+
+    enum class BlendFactor {
+        Zero,
+        One,
+        SrcColor,
+        OneMinusSrcColor,
+        DstColor,
+        OneMinusDstColor,
+        SrcAlpha,
+        OneMinusSrcAlpha,
+        DstAlpha,
+        OneMinusDstAlpha,
+        ConstantColor,
+        OneMinusConstantColor,
+        ConstantAlpha,
+        OneMinusConstantAlpha,
+        // Dual-source blend factors (GL_SRC1_*, glBindFragDataLocationIndexed); require the
+        // dualSrcBlend device feature.
+        Src1Color,
+        OneMinusSrc1Color,
+        Src1Alpha,
+        OneMinusSrc1Alpha,
+        BlendFactorCount,
+        Unknown = -1
+    };
+
+    enum class BlendEquation {
+        Add,
+        Subtract,
+        ReverseSubtract,
+        Min,
+        Max,
+        BlendEquationCount,
+        Unknown = -1
+    };
+
+    enum class LogicOperation {
+        Clear,
+        And,
+        AndReverse,
+        Copy,
+        AndInverted,
+        Noop,
+        Xor,
+        Or,
+        Nor,
+        Equiv,
+        Invert,
+        OrReverse,
+        CopyInverted,
+        OrInverted,
+        Nand,
+        Set,
+        LogicOperationCount,
+        Unknown = -1
+    };
+
+    enum class DepthTestFunc {
+        Never,
+        Less,
+        Equal,
+        LessEqual,
+        Greater,
+        NotEqual,
+        GreaterEqual,
+        Always,
+        DepthTestFuncCount,
+        Unknown = -1
+    };
+
+    enum class StencilOperation {
+        Keep,
+        Zero,
+        Replace,
+        IncrementClamp,
+        DecrementClamp,
+        Invert,
+        IncrementWrap,
+        DecrementWrap,
+        StencilOperationCount,
+        Unknown = -1
+    };
+
+    enum class StencilFace {
+        Front,
+        Back,
+        StencilFaceCount,
+        Unknown = -1
+    };
+
+    enum class PixelStoreParam {
+        // Pack Parameters
+        PackAlignment,
+        PackRowLength,
+        PackImageHeight,
+        PackSkipRows,
+        PackSkipPixels,
+        PackSkipImages,
+        PackSwapBytes,
+        PackLSBFirst,
+
+        // Unpack Parameters
+        UnpackAlignment,
+        UnpackRowLength,
+        UnpackImageHeight,
+        UnpackSkipRows,
+        UnpackSkipPixels,
+        UnpackSkipImages,
+        UnpackSwapBytes,
+        UnpackLSBFirst,
+
+        PixelStoreParamCount,
+        Unknown = -1
+    };
+
+    enum class CullFaceMode {
+        Front,
+        Back,
+        FrontAndBack,
+        CullFaceModeCount,
+        Unknown = -1
+    };
+
+    enum class FrontFaceMode {
+        CounterClockwise,
+        Clockwise,
+        FrontFaceModeCount,
+        Unknown = -1
+    };
+
+    enum class ProvokingVertexMode {
+        FirstVertex,
+        LastVertex,
+        ProvokingVertexModeCount,
+        Unknown = -1
+    };
+
+    enum class CapabilityInput {
+        Blend,
+        ClipDistance0,
+        ClipDistance1,
+        ClipDistance2,
+        ClipDistance3,
+        ClipDistance4,
+        ClipDistance5,
+        ClipDistance6,
+        ClipDistance7,
+        ColorLogicOp,
+        CullFace,
+        DebugOutput,
+        DebugOutputSynchronous,
+        DepthClamp,
+        DepthTest,
+        Dither,
+        FramebufferSrgb,
+        LineSmooth,
+        Multisample,
+        PolygonOffsetFill,
+        PolygonOffsetLine,
+        PolygonOffsetPoint,
+        PolygonSmooth,
+        PrimitiveRestart,
+        PrimitiveRestartFixedIndex,
+        RasterizerDiscard,
+        SampleAlphaToCoverage,
+        SampleAlphaToOne,
+        SampleCoverage,
+        SampleShading,
+        SampleMask,
+        ScissorTest,
+        StencilTest,
+        TextureCubeMapSeamless,
+        ProgramPointSize,
+        CapabilityInputCount,
+        Unknown = -1
+    };
+
+    struct PixelStoreParameters {
+        Bool SwapBytes = false;
+        Bool LSBFirst = false;
+        Int RowLength = 0;
+        Int ImageHeight = 0;
+        Int SkipPixels = 0;
+        Int SkipRows = 0;
+        Int SkipImages = 0;
+        Int Alignment = 4;
+    };
+
+    struct PerBufferBlendState {
+        Bool Enabled = false;
+        BlendFactor SrcFactorRGB = BlendFactor::One;
+        BlendFactor DstFactorRGB = BlendFactor::Zero;
+        BlendFactor SrcFactorAlpha = BlendFactor::One;
+        BlendFactor DstFactorAlpha = BlendFactor::Zero;
+        BlendEquation ColorEquation = BlendEquation::Add;
+        BlendEquation AlphaEquation = BlendEquation::Add;
+    };
+
+    struct StencilFaceState {
+        DepthTestFunc Func = DepthTestFunc::Always;
+        Int Ref = 0;
+        Uint32 ValueMask = 0xffffffffu;
+        Uint32 WriteMask = 0xffffffffu;
+        StencilOperation FailOp = StencilOperation::Keep;
+        StencilOperation PassDepthFailOp = StencilOperation::Keep;
+        StencilOperation PassDepthPassOp = StencilOperation::Keep;
+    };
+
+    struct RenderStateParameters {
+        // ARB_viewport_array / GL 4.6 core 13.6.1: the viewport, the scissor rectangle, the depth
+        // range and the scissor-test enable are all arrays indexed by gl_ViewportIndex, and the
+        // spec floor for MAX_VIEWPORTS is 16. MobileGL advertises exactly 16 on both backends, so
+        // this is also what GL_MAX_VIEWPORTS reports (see the backend loaders' caps.MaxViewports).
+        static constexpr Uint MAX_VIEWPORTS = 16;
+
+        // Rasterization
+        // The viewport rectangle is FLOAT state as of GL 4.1 - ViewportIndexedf writes fractional
+        // values and GetFloati_v(GL_VIEWPORT) must hand them back bit-exact
+        // (KHR-GL43.viewport_array.viewport_api compares with ==, no tolerance). glViewport's
+        // integers are simply one way to write it. Index 0 is what a program that never assigns
+        // gl_ViewportIndex rasterizes against, and what the classic glViewport /
+        // glGetIntegerv(GL_VIEWPORT) pair addresses. Both backends rasterize the rectangle
+        // rounded back to integers; the STATE stays exact, which is the half the conformance
+        // suite checks (see the KNOWN INFIDELITY note in AdvertisedLimitsScenario.cpp).
+        Array<FloatVec4, MAX_VIEWPORTS> Viewports{}; // x, y, width, height
+        Float LineWidth = 1.0f;
+        Float PointSize = 1.0f;
+        // GL_PATCH_VERTICES: how many vertices one tessellation patch consumes.
+        Uint PatchVertices = 3;
+        // GL_PATCH_DEFAULT_OUTER_LEVEL / GL_PATCH_DEFAULT_INNER_LEVEL (glPatchParameterfv). The
+        // tessellation levels used when a program has an evaluation stage and NO control stage -
+        // GL's fixed-function pass-through (4.6 core 11.2.2). Both backends have to synthesize
+        // that stage, and they bake these numbers into it, so a change here makes an already-built
+        // one stale exactly as PATCH_VERTICES does. Default 1.0, per table 23.44.
+        FloatVec4 PatchDefaultOuterLevel = FloatVec4(1.0f, 1.0f, 1.0f, 1.0f);
+        FloatVec2 PatchDefaultInnerLevel = FloatVec2(1.0f, 1.0f);
+        Float PolygonOffsetFactor = 0.0f;
+        Float PolygonOffsetUnits = 0.0f;
+        // GL_POLYGON_OFFSET_CLAMP (GL 4.6 core 14.6.5 / GL_EXT_polygon_offset_clamp): the maximum
+        // magnitude of the offset glPolygonOffsetClamp's third argument allows. Zero - the default
+        // - means "no clamp", which is exactly the behaviour glPolygonOffset leaves behind.
+        Float PolygonOffsetClamp = 0.0f;
+
+        // glClipControl (GL 4.5 core 13.5). Defaults per table 23.7 are the pre-4.5 fixed
+        // behaviour: origin at the lower left, depth mapped from -1..1.
+        GLenum ClipOrigin = GL_LOWER_LEFT;
+        GLenum ClipDepthMode = GL_NEGATIVE_ONE_TO_ONE;
+
+        // Blending
+        Array<PerBufferBlendState, kMGMaxDrawBuffers> BlendStates;
+        LogicOperation LogicOp = LogicOperation::Copy;
+
+        // Depth
+        Bool DepthTestEnabled = false;
+        DepthTestFunc DepthFunc = DepthTestFunc::Less;
+        Bool DepthMask = true;
+
+        // Color Mask. Per-draw-buffer state (glColorMaski); glColorMask broadcasts to all buffers.
+        // Every entry is initialized to all-true in RenderState's constructor.
+        Array<BoolVec4, kMGMaxDrawBuffers> ColorMasks;
+
+        // Clear State
+        FloatVec4 ClearColor = FloatVec4(0.0f, 0.0f, 0.0f, 1.0f);
+        Float ClearDepth = 1.0f;
+        Uint32 ClearStencil = 0;
+        FloatVec4 BlendColor = FloatVec4(0.0f, 0.0f, 0.0f, 0.0f);
+        // Per-viewport depth range (glDepthRangeIndexed / glDepthRangeArrayv). Every entry is
+        // initialized to (0, 1) in RenderState's constructor - a default member initializer would
+        // not survive the Array<> aggregate. Kept float rather than double: DepthRangeArrayv takes
+        // GLdouble, but the value reaches the hardware as VkViewport::minDepth/maxDepth (float) on
+        // Magma and glDepthRangef on Espryt, so a double store would only widen the readback and
+        // then lose it again at the same place.
+        Array<FloatVec2, MAX_VIEWPORTS> DepthRanges{};
+        Float SampleCoverageValue = 1.0f;
+        Bool SampleCoverageInvert = false;
+        Uint32 SampleMaskValue = 0xffffffffu;
+        // glMinSampleShading (ARB_sample_shading / GL 4.0 core 14.3.1). The fraction of samples
+        // that get their own independent shading when GL_SAMPLE_SHADING is enabled; the initial
+        // value is 0, and the value is clamped to [0, 1] on the way in.
+        Float MinSampleShadingValue = 0.0f;
+        Array<StencilFaceState, 2> StencilStates{};
+
+        // Cull Face
+        Bool CullFaceEnabled = false;
+        CullFaceMode CullFaceModeSetting = CullFaceMode::Back;
+        FrontFaceMode FrontFaceModeSetting = FrontFaceMode::CounterClockwise;
+        ProvokingVertexMode ProvokingVertexModeSetting = ProvokingVertexMode::LastVertex;
+
+        // Hints (glHint). All GL 3.3 core hint targets default to GL_DONT_CARE.
+        GLenum LineSmoothHint = GL_DONT_CARE;
+        GLenum PolygonSmoothHint = GL_DONT_CARE;
+        GLenum TextureCompressionHint = GL_DONT_CARE;
+        GLenum FragmentShaderDerivativeHint = GL_DONT_CARE;
+
+        // Point parameters (glPointParameter). Only the two GL 3.3 core pnames.
+        Float PointFadeThresholdSize = 1.0f;
+        GLenum PointSpriteCoordOrigin = GL_UPPER_LEFT;
+
+        // Color clamping (glClampColor). Core profile exposes only GL_CLAMP_READ_COLOR.
+        GLenum ClampReadColor = GL_FIXED_ONLY;
+
+        // Polygon rasterization mode (glPolygonMode). Core profile sets front and back together,
+        // but GL_POLYGON_MODE still reports both slots, so keep them separate for a faithful query.
+        GLenum PolygonModeFront = GL_FILL;
+        GLenum PolygonModeBack = GL_FILL;
+
+        // Primitive restart index (glPrimitiveRestartIndex); consumed when GL_PRIMITIVE_RESTART is
+        // enabled during an indexed draw. Default 0.
+        Uint32 PrimitiveRestartIndex = 0;
+
+        // Scissor
+        Bool ColorLogicOpEnabled = false;
+        Bool DebugOutputEnabled = false;
+        Bool DebugOutputSynchronousEnabled = false;
+        Bool DitherEnabled = true;
+        Bool LineSmoothEnabled = false;
+        Bool MultisampleEnabled = true;
+        Bool PolygonOffsetFillEnabled = false;
+        Bool PolygonOffsetLineEnabled = false;
+        Bool PolygonOffsetPointEnabled = false;
+        Bool PolygonSmoothEnabled = false;
+        Bool PrimitiveRestartEnabled = false;
+        Bool PrimitiveRestartFixedIndexEnabled = false;
+        Bool RasterizerDiscardEnabled = false;
+        Bool SampleAlphaToCoverageEnabled = false;
+        Bool SampleAlphaToOneEnabled = false;
+        Bool SampleCoverageEnabled = false;
+        Bool SampleMaskEnabled = false;
+        Bool SampleShadingEnabled = false;
+        Bool StencilTestEnabled = false;
+        Bool ProgramPointSizeEnabled = false;
+        // glEnable(GL_SCISSOR_TEST) enables the test for EVERY viewport, glEnablei for one
+        // (GL 4.6 core 17.3.2), so this is 16 bits and not a bool. Bit 0 is what the classic
+        // glIsEnabled(GL_SCISSOR_TEST) reports and what both backends currently consume. Unlike
+        // ClipDistanceEnabledMask below it DOES bump the pipeline version, because DirectGLES
+        // turns it into a real glEnable/glDisable.
+        Uint32 ScissorTestEnabledMask = 0;
+        Array<IntVec4, MAX_VIEWPORTS> ScissorBoxes{}; // x, y, width, height
+        // One bit per viewport, set the first time the application writes that index's scissor
+        // rectangle - glScissor broadcasts and sets all 16, glScissorIndexed/glScissorArrayv set
+        // the indices they name. It exists because the RECTANGLE cannot answer "has the
+        // application spoken?": ScissorBoxes starts all-zero (its spec initial value is the size
+        // of a window the frontend does not know yet, see the RenderState constructor), and
+        // glScissor(0, 0, 0, 0) is a legal GL state meaning "the scissor test rejects every
+        // fragment". A backend that reads an empty rectangle as the never-written sentinel
+        // therefore INVERTS that request into "accept every fragment"; DirectGLES did exactly
+        // that and KHR-GL43.viewport_array.scissor_zero_dimension caught it. Deliberately beside
+        // ScissorBoxes so it shares their tail span (after LogicOp) and DirectGLES' span memcmp
+        // picks a transition up like any other state.
+        Uint32 ScissorBoxWrittenMask = 0;
+        // glEnable(GL_CLIP_DISTANCE0 + i) for i in [0, 8), one bit each. A bitmask rather than
+        // eight bools because every consumer wants the set, not an individual flag, and because
+        // the SYNC_CAPABILITY/SET_CAPABILITY macros key off a "<Name>Enabled" field name that
+        // eight numbered capabilities cannot share. Lives in the tail span (after LogicOp), so
+        // DirectGLES' span memcmp picks a change up like any other capability.
+        Uint32 ClipDistanceEnabledMask = 0;
+    };
+
+    enum class SamplerFilterMode {
+        Nearest,
+        Linear,
+        SamplerFilterCount,
+        Unknown = -1
+    };
+
+    enum class SamplerMipmapMode {
+        None,
+        Nearest,
+        Linear,
+        SamplerMipmapModeCount,
+        Unknown = -1
+    };
+
+    enum class SamplerWrapMode {
+        ClampToEdge,
+        MirroredRepeat,
+        Repeat,
+        ClampToBorder,
+        MirrorClampToEdge,
+        SamplerWrapModeCount,
+        Unknown = -1
+    };
+
+    enum class SamplerCompareMode {
+        None,
+        CompareToTexture,
+        SamplerCompareModeCount,
+        Unknown = -1
+    };
+
+    enum class SamplerCompareFunc {
+        Never,
+        Less,
+        Equal,
+        LessEqual,
+        Greater,
+        NotEqual,
+        GreaterEqual,
+        Always,
+        SamplerCompareFuncCount,
+        Unknown = -1
+    };
+
+    // Which of the three GL_TEXTURE_BORDER_COLOR entry-point families last wrote the border colour,
+    // and therefore which of the three stored representations is AUTHORITATIVE. GL 4.6 core 8.10:
+    // TexParameterIiv/Iuiv store an integer border colour "unmodified, with an internal data type of
+    // integer", TexParameterfv stores a floating-point one, and the derived forms are only a
+    // convenience for a getter of the other spelling. A backend cannot pick the right driver entry
+    // point (glSamplerParameterIiv vs fv) or the right VkBorderColor family without this: numerically
+    // the three representations are always populated, so the value alone says nothing about the form.
+    enum class BorderColorForm : Uint8 {
+        Float,
+        Int,
+        Uint
+    };
+
+    struct SamplerParameters {
+        SamplerWrapMode wrapS = SamplerWrapMode::Repeat;
+        SamplerWrapMode wrapT = SamplerWrapMode::Repeat;
+        SamplerWrapMode wrapR = SamplerWrapMode::Repeat;
+        SamplerFilterMode minFilter = SamplerFilterMode::Nearest;
+        SamplerFilterMode magFilter = SamplerFilterMode::Linear;
+        SamplerMipmapMode mipmapMode = SamplerMipmapMode::Linear;
+        Float minLod = -1000.0f;
+        Float maxLod = 1000.0f;
+        Float lodBias = 0.0f;
+        Float maxAnisotropy = 1.0f;
+        // GL 4.6 core table 23.18 / GLES 3.2 table 21.16: TEXTURE_COMPARE_FUNC starts at LEQUAL,
+        // for both sampler objects and the sampler state a texture object carries.
+        SamplerCompareFunc compareFunc = SamplerCompareFunc::LessEqual;
+        SamplerCompareMode compareMode = SamplerCompareMode::None;
+        // TEXTURE_BORDER_COLOR is sampler state (GL 4.6 core table 23.18), so it belongs here and
+        // not on the texture - a texture object reaches it through the sampler object it owns. The
+        // three representations are the float, integer and unsigned-integer forms glSamplerParameterfv,
+        // glSamplerParameterIiv and glSamplerParameterIuiv set; whichever is written last defines
+        // the colour and the other two follow it, so a getter always has an answer.
+        FloatVec4 borderColor = {0.0f, 0.0f, 0.0f, 0.0f};
+        IntVec4 borderColorI = {0, 0, 0, 0};
+        UintVec4 borderColorUI = {0, 0, 0, 0};
+        BorderColorForm borderColorForm = BorderColorForm::Float;
+    };
+
+    namespace MG_State::GLState {
+        class BufferObject;
+
+        struct VertexAttribute {
+            Bool Enabled = false;
+            int Size = 4;
+            DataType Type = DataType::Float32;
+            Bool Normalized = false;
+            // The RESOLVED byte distance between consecutive elements, never the raw
+            // glVertexAttrib*Pointer argument: a pointer call's stride 0 means "tightly
+            // packed" and is resolved to the element size here, so a zero that survives
+            // into this field can only have come from the binding model, where a zero
+            // VERTEX_BINDING_STRIDE means the opposite - every vertex reads the SAME
+            // element and the fetch address never advances (GL 4.6 core 10.3.1). Backends
+            // consume this verbatim; collapsing 0 back into the element size is what made
+            // KHR-GL43.vertex_attrib_binding.basic-input-case7/8 read past the buffer.
+            int Stride = 0;
+            SizeT Offset = 0;
+            Bool IsInteger = false;
+            // GL_BGRA vertex size: four components in reversed (B,G,R,A) memory order. Size stays 4.
+            // Set only by the long (L) format entry points. It is NOT implied by
+            // Type == Float64: VertexAttribFormat(GL_DOUBLE) also reads doubles from memory but
+            // asks for them *converted to float*, while VertexAttribLFormat keeps all 64 bits
+            // (GL 4.6 core 10.3.2). Backends have to tell the two apart, and it is what
+            // GL_VERTEX_ATTRIB_ARRAY_LONG reports.
+            Bool IsLong = false;
+            Bool IsBgra = false;
+            Uint Divisor = 0;
+            SharedPtr<BufferObject> Buffer;
+
+            // GL 4.6 core table 23.3: VERTEX_ATTRIB_ARRAY_STRIDE and _POINTER are the
+            // arguments of the last glVertexAttrib*Pointer call on this attribute,
+            // reported verbatim, and NOTHING else writes them - not glVertexAttribFormat,
+            // not glBindVertexBuffer. Stride/Offset above are the *resolved* draw inputs
+            // and the binding model does overwrite those, so the two views have to be
+            // stored apart or the binding-model sequence reports a legacy state it never
+            // set (KHR-GL4x.vertex_attrib_binding.basic-state3).
+            int LegacyStride = 0;
+            SizeT LegacyPointer = 0;
+        };
+
+        // ARB_vertex_attrib_binding separate binding point. Attributes configured through the
+        // binding-point API are resolved eagerly into the flat VertexAttribute view above, so
+        // backends keep consuming resolved attributes and never see binding points.
+        struct VertexBufferBindingPoint {
+            SharedPtr<BufferObject> Buffer;
+            SizeT Offset = 0;
+            // GL 4.6 core table 23.4: the initial VERTEX_BINDING_STRIDE is 16, not 0.
+            int Stride = 16;
+            Uint Divisor = 0;
+        };
+
+        struct VertexAttributeVersion {
+            Uint16 FormatVersion = 0;
+            Uint16 BufferVersion = 0;
+            Uint16 SwitchVersion = 0;
+        };
+    } // namespace MG_State::GLState
+
+    // ---- trip wires (P0.5). Sizes are what every ABI MobileGL ships on produces: every
+    // member is a fixed-width scalar, an enum of one, or an array of those - no pointer, no
+    // SizeT - except the vertex types, which carry SharedPtr<BufferObject> by design and are
+    // therefore not trivially copyable (MGPipeTypes.h carries them as a blob).
+    static_assert(std::is_trivially_copyable_v<PixelStoreParameters> && sizeof(PixelStoreParameters) == 28);
+    static_assert(std::is_trivially_copyable_v<PerBufferBlendState> && sizeof(PerBufferBlendState) == 28);
+    static_assert(std::is_trivially_copyable_v<StencilFaceState> && sizeof(StencilFaceState) == 28);
+    static_assert(std::is_trivially_copyable_v<RenderStateParameters>);
+    static_assert(std::is_standard_layout_v<RenderStateParameters>); // offsetof legality
+    static_assert(sizeof(RenderStateParameters) == 1168,
+                  "RenderStateParameters changed size; MGL_RESIDUAL_BLOCK_SIZE and the Espryt spans depend on it");
+    static_assert(offsetof(RenderStateParameters, BlendStates) < offsetof(RenderStateParameters, LogicOp));
+    static_assert(std::tuple_size_v<decltype(RenderStateParameters::BlendStates)> == kMGMaxDrawBuffers);
+    static_assert(std::is_trivially_copyable_v<SamplerParameters> && sizeof(SamplerParameters) == 100);
+    static_assert(std::is_trivially_copyable_v<MG_State::GLState::VertexAttributeVersion> &&
+                  sizeof(MG_State::GLState::VertexAttributeVersion) == 6);
+} // namespace MobileGL
+#endif // MOBILEGL_MG_PIPE_VALUE_TYPES_H

MobileGL/MG_Pipe/PipeCalls.def

@@ -0,0 +1,177 @@
+// MobileGL - MobileGL/MG_Pipe/PipeCalls.def
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The single source of truth for the MGPipe call catalogue (plan B section 4.1 / 4.4 /
+// appendix A). One line per call; seven generators consume this file
+// (scripts/gen_pipe.py -> MG_Pipe/generated/*.inc) and one unit test
+// (MG_Test/Pipe/PipeCatalogueTest.cpp) pins the arithmetic.
+//
+//   X(Name, PayloadStruct, Class, Flags)
+//     Class : kScreen | kCtxCso | kCtxState | kCtxObject | kCtxVerb | kCtxQuery
+//             kScreen lands in struct MGPipeScreen, every other class in struct
+//             MGPipeContext (plan section 4.3).
+//     Flags : kNone | kNeedsAck | kHasBlob | kVarTail | kHostSpan | kReplySlot | kOptional
+//
+// RECORD NUMBERING NEVER CHURNS. Entries that are not implemented yet still occupy their
+// line (plan section 11, P0: "the complete call catalogue, placeholders included"). A new
+// call is APPENDED to its group; a retired call keeps its slot with a comment. The wire
+// opcode is the 1-based position in this list, so reordering is a protocol break.
+//
+// ---------------------------------------------------------------------------------------
+// COUNTS. MGP_CALL_LIST_DOCUMENTED_COUNT below is the authority; PipeCatalogueTest asserts
+// that the expansion, the two generated tables and this number agree.
+//
+//   class       entries   group (as the plan tabulates it)
+//   kScreen        11     screen: caps 1 + resource 3 + persistent map 2 + fence 4, plus the
+//                         appended server-side fence wait 1
+//   kCtxQuery       8     query object namespace 6, plus the appended timestamp pair 2
+//   kCtxCso        13     CSO create/bind/delete
+//   kCtxState      17     16 of the 17 set_* calls + the temporary set_residual_value_state
+//   kCtxObject      9     set_texture_params (the 17th set_*) + 8 object-scoped transfers
+//   kCtxVerb       13     3 context-reading transfer calls + the 10 commands
+//   total          71
+//
+// Reconciliation with the plan's headline numbers (section 4.4 / appendix A), because they
+// do not add up to a set of UNIQUE records and this file has to hold unique records:
+//   - "screen 14" tabulates the fence and query families together with the screen block.
+//     Section 4.3 assigns the query NAMESPACE to the context ("VAO / FBO / XFB object /
+//     query namespaces, the command stream, present"), so the six query calls carry
+//     kCtxQuery and live in MGPipeContext. Screen keeps 10 of the plan's (11 with the appended
+//     FenceWaitServer, below). The eight EGL lifecycle entry points stay virtual functions on
+//     pActiveBackendObject and are deliberately NOT calls here (section 4.4.1, last row).
+//   - "CSO 15" is create/bind/delete x 5 kinds. Two of those binds are ALSO named in the
+//     set_* catalogue as their array forms - bind_sampler_states and set_sampler_views
+//     (section 4.4.3) - and a call may only exist once, so they are emitted under
+//     kCtxState and the CSO group holds 13: create/delete x 5 plus the three remaining
+//     binds (render state, vertex elements, shader).
+//   - "transfer 12" enumerates 11 calls in section 4.4.4 plus appendix A
+//     (resource_subdata, buffer_subdata_resident, resource_flush_range, resource_readback,
+//     resource_copy_region, blit, clear, generate_mipmap, read_pixels, get_texture_image,
+//     resource_subdata_complete). Eleven is what is emitted; the twelfth is not named
+//     anywhere in the plan.
+//   - "about 74 items" in section 4.1 is the sum of those headline numbers, so it inherits
+//     the same double counting. 68 unique records was the honest total of the plan's own
+//     catalogue.
+//   - Three LIVE GLFunctionsTable entries had no carrier in it at all: GetGpuTimestampNs
+//     (glGetInteger64v(GL_TIMESTAMP), a synchronous server answer), QueryCounterTimestamp
+//     (glQueryCounter, a one-shot stamp rather than a begin/end pair) and WaitSync (the
+//     GPU-side wait, which FenceWait's client-side wait does not express). They are
+//     QueryTimestamp, QueryCounter and FenceWaitServer, APPENDED at the end of the list -
+//     not slotted into their groups - because the wire opcode is the position, so a record
+//     that arrives late goes last. 71 unique records.
+// ---------------------------------------------------------------------------------------
+
+#define MGP_CALL_LIST_DOCUMENTED_COUNT 71
+
+// clang-format off
+#define MGP_CALL_LIST(X)                                                                            \
+    /* ---- screen: caps, resources, persistent map, fences (plan 4.4.1) ---- */                    \
+    X(GetCaps,                  MGPCaps,                    kScreen,    kReplySlot)                 \
+    X(ResourceCreate,           MGPResourceDesc,            kScreen,    kNone)                      \
+    X(ResourceRespecify,        MGPResourceDesc,            kScreen,    kNone)                      \
+    X(ResourceDestroy,          MGPHandleOnly,              kScreen,    kNone)                      \
+    X(MapPersistent,            MGPHandleOnly,              kScreen,    kReplySlot|kOptional)       \
+    X(UnmapPersistent,          MGPHandleOnly,              kScreen,    kOptional)                  \
+    X(FenceCreate,              MGPHandleOnly,              kScreen,    kNone)                      \
+    X(FenceStatus,              MGPHandleOnly,              kScreen,    kReplySlot)                 \
+    X(FenceWait,                MGPFenceWait,               kScreen,    kReplySlot)                 \
+    X(FenceDestroy,             MGPHandleOnly,              kScreen,    kNone)                      \
+    /* ---- context: query objects (plan 4.3 gives the namespace to the context) ---- */            \
+    X(QueryCreate,              MGPQueryDesc,               kCtxQuery,  kNone)                      \
+    X(QueryBegin,               MGPQueryDesc,               kCtxQuery,  kNone)                      \
+    X(QueryEnd,                 MGPQueryDesc,               kCtxQuery,  kNone)                      \
+    X(QueryAvailable,           MGPHandleOnly,              kCtxQuery,  kReplySlot)                 \
+    X(QueryResult,              MGPQueryResultRequest,      kCtxQuery,  kReplySlot)                 \
+    X(QueryDestroy,             MGPHandleOnly,              kCtxQuery,  kNone)                      \
+    /* ---- context: CSO create/bind/delete (plan 4.4.2, 4.5.2-4.5.5) ---- */                       \
+    X(CreateRenderState,        MGPRenderStateDesc,         kCtxCso,    kHasBlob)                   \
+    X(BindRenderState,          MGPBindRenderState,         kCtxCso,    kNone)                      \
+    X(DeleteRenderState,        MGPHandleOnly,              kCtxCso,    kNone)                      \
+    X(CreateVertexElements,     MGPVertexElements,          kCtxCso,    kHasBlob)                   \
+    X(BindVertexElements,       MGPHandleOnly,              kCtxCso,    kNone)                      \
+    X(DeleteVertexElements,     MGPHandleOnly,              kCtxCso,    kNone)                      \
+    X(CreateSamplerState,       MGPSamplerDesc,             kCtxCso,    kNone)                      \
+    X(DeleteSamplerState,       MGPHandleOnly,              kCtxCso,    kNone)                      \
+    X(CreateSamplerView,        MGPSamplerView,             kCtxCso,    kNone)                      \
+    X(DeleteSamplerView,        MGPHandleOnly,              kCtxCso,    kNone)                      \
+    X(CreateShaderState,        MGPProgramDesc,             kCtxCso,    kHasBlob)                   \
+    X(BindShaderState,          MGPHandleOnly,              kCtxCso,    kNone)                      \
+    X(DeleteShaderState,        MGPHandleOnly,              kCtxCso,    kNone)                      \
+    /* ---- context: set_* (plan 4.4.3) ---- */                                                     \
+    X(SetDynamicState,          MGPDynamicState,            kCtxState,  kHasBlob)                   \
+    X(SetFramebufferState,      MGPFramebufferState,        kCtxState,  kNone)                      \
+    X(SetVertexBuffers,         MGPVertexBuffers,           kCtxState,  kVarTail)                   \
+    X(SetIndexBuffer,           MGPIndexBuffer,             kCtxState,  kNone)                      \
+    X(SetIndirectBuffers,       MGPIndirectBuffers,         kCtxState,  kNone)                      \
+    X(SetSamplerViews,          MGPSamplerViews,            kCtxState,  kVarTail)                   \
+    X(BindSamplerStates,        MGPSamplerStates,           kCtxState,  kVarTail)                   \
+    X(SetShaderImages,          MGPShaderImages,            kCtxState,  kVarTail)                   \
+    X(SetShaderBuffers,         MGPShaderBuffers,           kCtxState,  kVarTail|kHostSpan)         \
+    X(SetStreamOutputTargets,   MGPStreamOutputTargets,     kCtxState,  kVarTail)                   \
+    X(SetGlobalConstants,       MGPGlobalConstants,         kCtxState,  kHasBlob)                   \
+    X(SetVertexAttribDefaults,  MGPVertexAttribDefaults,    kCtxState,  kVarTail)                   \
+    X(SetPixelPackState,        MGPPixelPackState,          kCtxState,  kNone)                      \
+    X(SetPatchState,            MGPPatchState,              kCtxState,  kNone)                      \
+    X(SetDrawProgram,           MGPHandleOnly,              kCtxState,  kNone)                      \
+    X(SetDispatchProgram,       MGPHandleOnly,              kCtxState,  kNone)                      \
+    /* Migration-only carrier for Track V, retired field by field across P2..P13. Its       */      \
+    /* retirement is a compile error: MGL_RESIDUAL_BLOCK_SIZE only ever goes DOWN and the   */      \
+    /* final step asserts sizeof(ResidualValueBlock) == 0 (plan 6.3).                       */      \
+    X(SetResidualValueState,    MGPResidualValueState,      kCtxState,  kHasBlob)                   \
+    /* ---- context: per-object state and transfer (plan 4.4.3 set_texture_params, 4.4.4) ---- */   \
+    X(SetTextureParams,         MGPTextureParams,           kCtxObject, kNone)                      \
+    X(ResourceSubData,          MGPSubData,                 kCtxObject, kHasBlob|kVarTail)          \
+    X(BufferSubDataResident,    MGPSubData,                 kCtxObject, kHasBlob|kOptional)         \
+    X(ResourceSubDataComplete,  MGPSubDataComplete,         kCtxObject, kNone)                      \
+    X(ResourceFlushRange,       MGPFlushRange,              kCtxObject, kNone)                      \
+    X(ResourceReadback,         MGPReadback,                kCtxObject, kReplySlot)                 \
+    X(ResourceCopyRegion,       MGPCopyRegion,              kCtxObject, kNone)                      \
+    X(GenerateMipmap,           MGPMipPlan,                 kCtxObject, kNone)                      \
+    X(GetTextureImage,          MGPReadbackInfo,            kCtxObject, kReplySlot)                 \
+    /* ---- context: transfer calls that read whole-context state, and the commands ---- */         \
+    X(Blit,                     MGPBlit,                    kCtxVerb,   kNone)                      \
+    X(Clear,                    MGPClear,                   kCtxVerb,   kNone)                      \
+    X(ReadPixels,               MGPReadbackInfo,            kCtxVerb,   kReplySlot)                 \
+    X(DrawVbo,                  MGPDrawInfo,                kCtxVerb,   kHostSpan|kVarTail)         \
+    X(LaunchGrid,               MGPGridInfo,                kCtxVerb,   kNone)                      \
+    X(MemoryBarrier,            MGPMemoryBarrier,           kCtxVerb,   kNone)                      \
+    X(BeginStreamOutput,        MGPStreamOutputBegin,       kCtxVerb,   kNone)                      \
+    X(EndStreamOutput,          MGPXfbAccounting,           kCtxVerb,   kNone)                      \
+    X(PauseStreamOutput,        MGPStreamOutputControl,     kCtxVerb,   kNone)                      \
+    X(ResumeStreamOutput,       MGPStreamOutputControl,     kCtxVerb,   kNone)                      \
+    X(Flush,                    MGPFlush,                   kCtxVerb,   kNone)                      \
+    X(Present,                  MGPPresent,                 kCtxVerb,   kNone)                      \
+    X(SetSwapInterval,          MGPSwapInterval,            kCtxVerb,   kOptional)                  \
+    /* ---- APPENDED. Opcodes are positional, so a late arrival goes at the END, never into ---- */ \
+    /* ---- its group: three live GLFunctionsTable entries the catalogue had no carrier for. ---- */ \
+    /* glGetInteger64v(GL_TIMESTAMP) - GetGpuTimestampNs, a synchronous server answer, which  */    \
+    /* the reply slot carries. The query namespace is the context's (plan 4.3).                */    \
+    X(QueryTimestamp,           MGPTimestampRequest,        kCtxQuery,  kReplySlot)                 \
+    /* glQueryCounter(GL_TIMESTAMP) - QueryCounterTimestamp, a one-shot stamp into a query    */    \
+    /* object, NOT a begin/end pair. Kind carries GL_TIMESTAMP.                                */    \
+    X(QueryCounter,             MGPQueryDesc,               kCtxQuery,  kNone)                      \
+    /* glWaitSync - WaitSync, the GPU-side wait, distinct from FenceWait's client-side one.   */    \
+    /* TimeoutNs is GL_TIMEOUT_IGNORED by contract.                                            */    \
+    X(FenceWaitServer,          MGPFenceWait,               kScreen,    kNone)
+// clang-format on
+
+// Explicitly NOT migrated (plan 4.4.6 / appendix A "explicit deletions"):
+//   - GetIntegeri_v / GetInteger64i_v. The six backend-owned answers they carry -
+//     GL_MAX_COMPUTE_WORK_GROUP_COUNT and GL_MAX_COMPUTE_WORK_GROUP_SIZE, three axes each,
+//     the only indexed pnames the device rather than the frontend answers - live in MGPCaps
+//     as DynamicBackendParameters::MaxComputeWorkGroupCount / MaxComputeWorkGroupSize, filled
+//     by both backends at capability init (DirectGLES from glGetIntegeri_v, DirectVulkan from
+//     VkPhysicalDeviceLimits) and floored by the frontend. Every other indexed pname names
+//     frontend state and is answered before any table is consulted.
+//   - GetProgramiv. GL_COMPUTE_WORK_GROUP_SIZE is a FRONTEND link artifact
+//     (ProgramObject::GetComputeLocalSize, what GL_Program.cpp has always answered from), not
+//     a backend answer at all; nothing a backend knows about a program crosses this way.
+//   - ShaderStorageBlockBinding (folded into MGPProgramDesc's reflection archive),
+//     set_pixel_unpack_state (no such state crosses the line - plan 4.6 D5), a
+//     compressed-format concept, pipe_transfer, and the stage dimension of set_sampler_views
+//     (MobileGL's texture unit space is merged, not per stage - plan 4.4.3).

MobileGL/MG_Pipe/PipeFields.def

@@ -0,0 +1,313 @@
+// MobileGL - MobileGL/MG_Pipe/PipeFields.def
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// Field lists for the G4 shadow comparator (plan B section 10.3-2). One macro per payload
+// in MGPipeTypes.h, listing the fields that carry MEANING - padding is deliberately absent,
+// because MOBILEGL_PIPE_VERIFY has to have ZERO false positives and a padding byte is
+// exactly what makes a memcmp of RenderStateParameters false-DIFFER
+// (DirectGLES.cpp documents that behaviour where it does the same comparison itself).
+//
+// Hand maintained alongside MGPipeTypes.h, MGPipeValueTypes.h, MGPipeHostSpan.h and
+// MG_Backend/BackendObject.h. Adding a member to one of these structs without adding it here
+// would make the comparator blind to it, so gen_pipe.py asserts - in both modes, hence in
+// pipe-gates - that every list below names exactly the direct data members of its struct
+// (P1 brief D8; a member named Pad<n> is padding and is not listed).
+//
+// clang-format off
+
+#define MGP_FIELDS_MGPBlobRef(F) \
+    F(Offset) F(Size) F(Seg)
+
+#define MGP_FIELDS_MGPRange(F) \
+    F(Offset) F(Size)
+
+#define MGP_FIELDS_MGPBox(F) \
+    F(X) F(Y) F(Z) F(W) F(H) F(D)
+
+#define MGP_FIELDS_MGPReplySlot(F) \
+    F(Id)
+
+#define MGP_FIELDS_MGPStateChunk(F) \
+    F(Offset) F(Length)
+
+#define MGP_FIELDS_MGPHandleOnly(F) \
+    F(Handle) F(Kind)
+
+#define MGP_FIELDS_MGPCaps(F) \
+    F(Dynamic) F(CallMask) F(FormatCapabilities) F(RendererInfo)
+
+#define MGP_FIELDS_MGPResourceDesc(F) \
+    F(Resource) F(Target) F(StorageKind) F(BindMask) F(InternalFormat) F(Width) F(Height) F(Depth) \
+    F(ArrayLayers) F(Levels) F(Samples) F(FixedSampleLocations) F(Immutable) F(Usage) F(StorageFlags) \
+    F(HasDefinedContent) F(ImageBindableHint) F(GlNameForDiag) F(ViewOf) F(BufferForTexBuffer) \
+    F(BufOffset) F(BufSize)
+
+#define MGP_FIELDS_MGPFenceWait(F) \
+    F(Fence) F(TimeoutNs)
+
+#define MGP_FIELDS_MGPQueryDesc(F) \
+    F(Query) F(Kind) F(Stream)
+
+#define MGP_FIELDS_MGPQueryResultRequest(F) \
+    F(Query) F(Wait)
+
+#define MGP_FIELDS_MGPTimestampRequest(F) \
+    F(Reserved)
+
+#define MGP_FIELDS_MGPRenderStateDesc(F) \
+    F(Cso) F(BaseCso) F(ChunkMask) F(Blob)
+
+#define MGP_FIELDS_MGPBindRenderState(F) \
+    F(Cso) F(Version) F(PipelineVersion)
+
+#define MGP_FIELDS_MGPDynamicState(F) \
+    F(ChunkMask) F(Version) F(Blob)
+
+#define MGP_FIELDS_MGPVertexElements(F) \
+    F(Cso) F(AttributeCount) F(BindingPointCount) F(Blob)
+
+#define MGP_FIELDS_MGPSamplerDesc(F) \
+    F(Cso) F(Parameters)
+
+#define MGP_FIELDS_MGPSamplerView(F) \
+    F(Cso) F(Texture) F(InternalFormat) F(Target) F(MinLevel) F(NumLevels) F(MinLayer) F(NumLayers) \
+    F(Samples) F(FixedSampleLocations)
+
+#define MGP_FIELDS_MGPTextureParams(F) \
+    F(Res) F(BaseLevel) F(MaxLevel) F(Swizzle) F(DepthStencilMode) F(ForceResync) F(MinLod) F(MaxLod) \
+    F(LodBias)
+
+#define MGP_FIELDS_MGPProgramDesc(F) \
+    F(Cso) F(StageMask) F(GlobalUboSize) F(ReservedNumSamplesOffset) F(SpirvStatus) F(NativeFloat64) \
+    F(PointSizeDemoted) F(EnableSpirvValidation) F(Spirv) F(Reflection)
+
+#define MGP_FIELDS_MGPSurface(F) \
+    F(Res) F(InternalFormat) F(Kind) F(Layered) F(Level) F(Layer) F(UploadTarget)
+
+#define MGP_FIELDS_MGPFramebufferState(F) \
+    F(Fbo) F(Color) F(Depth) F(Stencil) F(ReadSurface) F(DrawBuffers) F(Width) F(Height) F(Layers) \
+    F(Samples) F(FixedSampleLocations) F(IsDefault) F(Complete) F(ContentHash)
+
+#define MGP_FIELDS_MGPVertexBuffer(F) \
+    F(Res) F(Offset) F(Stride) F(Divisor) F(BindingIndex)
+
+#define MGP_FIELDS_MGPVertexBuffers(F) \
+    F(Start) F(Count) F(ContentHash)
+
+#define MGP_FIELDS_MGPIndexBuffer(F) \
+    F(Res) F(Offset) F(IndexSize)
+
+#define MGP_FIELDS_MGPIndirectBuffers(F) \
+    F(DrawIndirect) F(Parameter)
+
+#define MGP_FIELDS_MGPBoundView(F) \
+    F(View) F(Texture) F(Unit)
+
+#define MGP_FIELDS_MGPSamplerViews(F) \
+    F(Start) F(Count) F(ContentHash)
+
+#define MGP_FIELDS_MGPSamplerStates(F) \
+    F(Start) F(Count) F(ContentHash)
+
+#define MGP_FIELDS_MGPImageView(F) \
+    F(Res) F(Unit) F(InternalFormat) F(Layer) F(Level) F(Layered) F(Access)
+
+#define MGP_FIELDS_MGPShaderImages(F) \
+    F(Start) F(Count) F(ContentHash)
+
+#define MGP_FIELDS_MGPBufferRange(F) \
+    F(Res) F(Offset) F(Size)
+
+#define MGP_FIELDS_MGPShaderBuffers(F) \
+    F(Class) F(Start) F(Count) F(WritableMask) F(HostSpanCount) F(ContentHash)
+
+#define MGP_FIELDS_MGPStreamOutputTargets(F) \
+    F(Count) F(Generation) F(ContentHash)
+
+#define MGP_FIELDS_MGPGlobalConstants(F) \
+    F(ShaderCso) F(Version) F(Blob)
+
+#define MGP_FIELDS_MGPAttribValue(F) \
+    F(Location) F(ValueClass) F(Data)
+
+#define MGP_FIELDS_MGPVertexAttribDefaults(F) \
+    F(Mask) F(Count)
+
+#define MGP_FIELDS_MGPPixelPackState(F) \
+    F(Pack)
+
+#define MGP_FIELDS_MGPPatchState(F) \
+    F(Vertices) F(Outer) F(Inner)
+
+#define MGP_FIELDS_ResidualValueBlock(F) \
+    F(RenderState) F(Pack) F(CapabilityBits) F(PatchVertices) F(PatchOuter) F(PatchInner)
+
+#define MGP_FIELDS_MGPResidualValueState(F) \
+    F(Version) F(Blob)
+
+#define MGP_FIELDS_MGPSubRegion(F) \
+    F(X) F(Y) F(Z) F(W) F(H) F(D) F(SrcOffset) F(SrcRowStride) F(SrcSliceStride)
+
+#define MGP_FIELDS_MGPSubData(F) \
+    F(Res) F(Target) F(Level) F(SourceIsVerbatimLevelShadow) F(UnionBox) F(RegionCount) F(Blob)
+
+#define MGP_FIELDS_MGPSubDataComplete(F) \
+    F(Res) F(Target) F(FirstLevel) F(LevelCount) F(PullSerial)
+
+#define MGP_FIELDS_MGPFlushRange(F) \
+    F(Res) F(Offset) F(Size) F(AccessFlags)
+
+#define MGP_FIELDS_MGPReadback(F) \
+    F(Res) F(Offset) F(Size)
+
+#define MGP_FIELDS_MGPCopyRegion(F) \
+    F(Src) F(Dst) F(SrcBox) F(DstX) F(DstY) F(DstZ) F(SrcTarget) F(DstTarget) F(SrcLevel) F(DstLevel)
+
+#define MGP_FIELDS_MGPBlit(F) \
+    F(ReadFbo) F(DrawFbo) F(SrcX0) F(SrcY0) F(SrcX1) F(SrcY1) F(DstX0) F(DstY0) F(DstX1) F(DstY1) \
+    F(Mask) F(Filter)
+
+#define MGP_FIELDS_MGPClear(F) \
+    F(Fbo) F(Kind) F(DrawBufferIndex) F(BufferMask) F(ValueClass) F(ColorValue) F(DepthValue) \
+    F(StencilValue)
+
+#define MGP_FIELDS_MGPMipPlan(F) \
+    F(Res) F(Target) F(BaseLevel) F(LevelCount)
+
+#define MGP_FIELDS_MGPReadbackInfo(F) \
+    F(Res) F(Box) F(Format) F(Type) F(Target) F(Level) F(DstOffset) F(DstSize)
+
+#define MGP_FIELDS_MGPDrawInfo(F) \
+    F(Mode) F(IndexSize) F(Flags) F(InstanceCount) F(StartInstance) F(RestartIndex) F(DrawIdOffset) \
+    F(IndexResource) F(MinIndex) F(MaxIndex) F(XfbCpuCapturedVertices) F(NumDraws)
+
+#define MGP_FIELDS_MGPDrawRange(F) \
+    F(Start) F(Count) F(IndexBias)
+
+#define MGP_FIELDS_MGPDrawIndirect(F) \
+    F(Buffer) F(ParameterBuffer) F(Offset) F(ParameterOffset) F(Stride) F(DrawCount)
+
+#define MGP_FIELDS_MGPGridInfo(F) \
+    F(GridX) F(GridY) F(GridZ) F(BlockX) F(BlockY) F(BlockZ) F(IndirectBuffer) F(IndirectOffset) \
+    F(IsIndirect)
+
+#define MGP_FIELDS_MGPMemoryBarrier(F) \
+    F(Bits) F(ByRegion)
+
+#define MGP_FIELDS_MGPStreamOutputBegin(F) \
+    F(PrimitiveMode)
+
+#define MGP_FIELDS_MGPXfbAccounting(F) \
+    F(CapturedVertices) F(PrimitivesWritten) F(PrimitiveMode)
+
+#define MGP_FIELDS_MGPStreamOutputControl(F) \
+    F(Reserved)
+
+#define MGP_FIELDS_MGPFlush(F) \
+    F(Flags)
+
+#define MGP_FIELDS_MGPPresent(F) \
+    F(FrameSerial)
+
+#define MGP_FIELDS_MGPSwapInterval(F) \
+    F(Interval)
+
+#define MGP_FIELDS_MGPSurfaceInfo(F) \
+    F(Width) F(Height) F(InternalFormat) F(Samples) F(Layers) F(IsDefault)
+
+// ---- the value structs and the host span (P1 brief D8). Not call payloads themselves, but
+// members of ones (ResidualValueBlock, MGPPixelPackState, MGPCaps) and of PipeInputs, so the
+// comparator has to see INTO them: with these lists the memcmp fallback of MGPipeFieldEqual is
+// gone (a struct without a list is a compile error), and gen_pipe.py asserts every list names
+// every direct data member of its struct - Pad-named members are padding and excluded - so a
+// member added to RenderStateParameters without a row here fails pipe-gates.
+
+#define MGP_FIELDS_RenderStateParameters(F) \
+    F(Viewports) F(LineWidth) F(PointSize) F(PatchVertices) F(PatchDefaultOuterLevel) \
+    F(PatchDefaultInnerLevel) F(PolygonOffsetFactor) F(PolygonOffsetUnits) F(PolygonOffsetClamp) \
+    F(ClipOrigin) F(ClipDepthMode) F(BlendStates) F(LogicOp) F(DepthTestEnabled) F(DepthFunc) \
+    F(DepthMask) F(ColorMasks) F(ClearColor) F(ClearDepth) F(ClearStencil) F(BlendColor) \
+    F(DepthRanges) F(SampleCoverageValue) F(SampleCoverageInvert) F(SampleMaskValue) \
+    F(MinSampleShadingValue) F(StencilStates) F(CullFaceEnabled) F(CullFaceModeSetting) \
+    F(FrontFaceModeSetting) F(ProvokingVertexModeSetting) F(LineSmoothHint) F(PolygonSmoothHint) \
+    F(TextureCompressionHint) F(FragmentShaderDerivativeHint) F(PointFadeThresholdSize) \
+    F(PointSpriteCoordOrigin) F(ClampReadColor) F(PolygonModeFront) F(PolygonModeBack) \
+    F(PrimitiveRestartIndex) F(ColorLogicOpEnabled) F(DebugOutputEnabled) \
+    F(DebugOutputSynchronousEnabled) F(DitherEnabled) F(LineSmoothEnabled) F(MultisampleEnabled) \
+    F(PolygonOffsetFillEnabled) F(PolygonOffsetLineEnabled) F(PolygonOffsetPointEnabled) \
+    F(PolygonSmoothEnabled) F(PrimitiveRestartEnabled) F(PrimitiveRestartFixedIndexEnabled) \
+    F(RasterizerDiscardEnabled) F(SampleAlphaToCoverageEnabled) F(SampleAlphaToOneEnabled) \
+    F(SampleCoverageEnabled) F(SampleMaskEnabled) F(SampleShadingEnabled) F(StencilTestEnabled) \
+    F(ProgramPointSizeEnabled) F(ScissorTestEnabledMask) F(ScissorBoxes) F(ScissorBoxWrittenMask) \
+    F(ClipDistanceEnabledMask)
+
+#define MGP_FIELDS_PixelStoreParameters(F) \
+    F(SwapBytes) F(LSBFirst) F(RowLength) F(ImageHeight) F(SkipPixels) F(SkipRows) F(SkipImages) \
+    F(Alignment)
+
+#define MGP_FIELDS_PerBufferBlendState(F) \
+    F(Enabled) F(SrcFactorRGB) F(DstFactorRGB) F(SrcFactorAlpha) F(DstFactorAlpha) F(ColorEquation) \
+    F(AlphaEquation)
+
+#define MGP_FIELDS_StencilFaceState(F) \
+    F(Func) F(Ref) F(ValueMask) F(WriteMask) F(FailOp) F(PassDepthFailOp) F(PassDepthPassOp)
+
+#define MGP_FIELDS_DynamicBackendParameters(F) \
+    F(UniformBufferOffsetAlignment) F(ShaderStorageBufferOffsetAlignment) F(MaxTextureMaxAnisotropy) \
+    F(AliasedLineWidthRangeMin) F(AliasedLineWidthRangeMax) F(SmoothLineWidthRangeMin) \
+    F(SmoothLineWidthRangeMax) F(SmoothLineWidthGranularity) F(PointSizeRangeMin) \
+    F(PointSizeRangeMax) F(PointSizeGranularity) F(Max3DTextureSize) F(MaxArrayTextureLayers) \
+    F(MaxCubeMapTextureSize) F(MaxFramebufferWidth) F(MaxFramebufferHeight) F(MaxFramebufferLayers) \
+    F(MaxRenderbufferSize) F(MaxTextureSize) F(MaxColorTextureSamples) F(MaxDepthTextureSamples) \
+    F(MaxFramebufferSamples) F(MaxIntegerSamples) F(MaxSamples) F(MaxSampleMaskWords) \
+    F(MaxPatchVertices) F(MaxTessGenLevel) F(MinProgramTextureGatherOffset) \
+    F(MaxProgramTextureGatherOffset) F(MaxTextureImageUnits) F(MaxVertexTextureImageUnits) \
+    F(MaxComputeTextureImageUnits) F(MaxCombinedTextureImageUnits) F(MaxVertexAttribs) \
+    F(MaxComputeShaderStorageBlocks) F(MaxCombinedShaderStorageBlocks) \
+    F(MaxVertexShaderStorageBlocks) F(MaxTessControlShaderStorageBlocks) \
+    F(MaxTessEvaluationShaderStorageBlocks) F(MaxGeometryShaderStorageBlocks) \
+    F(MaxFragmentShaderStorageBlocks) F(MaxComputeUniformBlocks) F(MaxComputeWorkGroupInvocations) \
+    F(MaxComputeWorkGroupCount) F(MaxComputeWorkGroupSize) F(MaxShaderStorageBufferBindings) \
+    F(MaxTextureBufferSize) F(TextureBufferOffsetAlignment) F(MaxUniformBufferBindings) \
+    F(MaxUniformBlockSize) F(MaxImageUnits) F(MaxCombinedImageUniforms) F(MaxVertexImageUniforms) \
+    F(MaxGeometryImageUniforms) F(MaxFragmentImageUniforms) F(MaxComputeImageUniforms) \
+    F(MaxDrawBuffers) F(MaxColorAttachments) F(MaxClipDistances) F(MaxCullDistances) \
+    F(MaxCombinedClipAndCullDistances) F(MaxViewports) F(LayerProvokingVertex) \
+    F(ViewportIndexProvokingVertex) F(MaxViewportWidth) F(MaxViewportHeight) \
+    F(ViewportBoundsRangeMin) F(ViewportBoundsRangeMax) F(ViewportSubpixelBits) \
+    F(MinFragmentInterpolationOffset) F(MaxFragmentInterpolationOffset) \
+    F(FragmentInterpolationOffsetBits) F(SupportsWideLines) \
+    F(SupportsDistinctDepthStencilAttachments) F(PerLayerFramebufferAttachmentTargets) \
+    F(SupportsShaderFloat64) F(SupportsFloat64VertexAttributes) F(SupportsTessellationPointSize) \
+    F(SupportsGeometryPointSize) F(MaxShaderStorageBlockSize) F(SubgroupSize) \
+    F(SubgroupSupportedStages) F(SubgroupSupportedFeatures) F(SubgroupQuadOperationsInAllStages) \
+    F(GpuVendor)
+
+#define MGP_FIELDS_MGHostSpan(F) \
+    F(Ptr) F(Seg) F(Size) F(Offset)
+
+// Every payload above, in the order the comparator is generated. Keep in sync with the
+// macros; gen_pipe.py reads THIS list to know what to emit.
+#define MGP_VERIFY_PAYLOAD_LIST(P) \
+    P(MGPBlobRef) P(MGPRange) P(MGPBox) P(MGPReplySlot) P(MGPStateChunk) P(MGPHandleOnly) P(MGPCaps) \
+    P(MGPResourceDesc) P(MGPFenceWait) P(MGPQueryDesc) P(MGPQueryResultRequest) P(MGPTimestampRequest) P(MGPRenderStateDesc) \
+    P(MGPBindRenderState) P(MGPDynamicState) P(MGPVertexElements) P(MGPSamplerDesc) P(MGPSamplerView) \
+    P(MGPTextureParams) P(MGPProgramDesc) P(MGPSurface) P(MGPFramebufferState) P(MGPVertexBuffer) \
+    P(MGPVertexBuffers) P(MGPIndexBuffer) P(MGPIndirectBuffers) P(MGPBoundView) P(MGPSamplerViews) \
+    P(MGPSamplerStates) P(MGPImageView) P(MGPShaderImages) P(MGPBufferRange) P(MGPShaderBuffers) \
+    P(MGPStreamOutputTargets) P(MGPGlobalConstants) P(MGPAttribValue) P(MGPVertexAttribDefaults) \
+    P(MGPPixelPackState) P(MGPPatchState) P(ResidualValueBlock) P(MGPResidualValueState) \
+    P(MGPSubRegion) P(MGPSubData) P(MGPSubDataComplete) P(MGPFlushRange) P(MGPReadback) \
+    P(MGPCopyRegion) P(MGPBlit) P(MGPClear) P(MGPMipPlan) P(MGPReadbackInfo) P(MGPDrawInfo) \
+    P(MGPDrawRange) P(MGPDrawIndirect) P(MGPGridInfo) P(MGPMemoryBarrier) P(MGPStreamOutputBegin) \
+    P(MGPXfbAccounting) P(MGPStreamOutputControl) P(MGPFlush) P(MGPPresent) P(MGPSwapInterval) \
+    P(MGPSurfaceInfo) \
+    P(RenderStateParameters) P(PixelStoreParameters) P(PerBufferBlendState) P(StencilFaceState) \
+    P(DynamicBackendParameters) P(MGHostSpan)
+
+// clang-format on

MobileGL/MG_Pipe/PipeInputsSwitch.h

@@ -0,0 +1,28 @@
+// MobileGL - MobileGL/MG_Pipe/PipeInputsSwitch.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#ifndef MOBILEGL_MG_PIPE_INPUTS_SWITCH_H   // belt and braces: reachable as <MG_Pipe/..> and <..> (CMakeLists.txt:531,535)
+#define MOBILEGL_MG_PIPE_INPUTS_SWITCH_H
+// The strangler switch (ARCHITECTURE.md 9.2). Every backend read of frontend state is spelled
+// MGB_CTX->Accessor(...). Pull arm: the live GLContext, so the pull build is the tree before P1
+// token for token. Push arm: the PipeInputs block the frontend fills at every verb boundary.
+// The pull arm is the ONLY place under MobileGL/ outside MG_State and MG_Impl that may spell
+// pGLContext; purity gate C greps MG_Backend/ for that token.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Backend/MGPipe/PipeInputs.h>
+#define MGB_CTX (&::MobileGL::MG_Pipe::gPipeInputs)
+#define MGB_CTX_LIVE (::MobileGL::MG_Pipe::gPipeInputs.IsLive())
+#define MGB_CTX_IDENTITY (::MobileGL::MG_Pipe::gPipeInputs.ContextIdentity())
+#else
+#include <MG_State/GLState/Core.h>
+#define MGB_CTX (::MobileGL::MG_State::pGLContext)
+#define MGB_CTX_LIVE (::MobileGL::MG_State::pGLContext != nullptr)
+#define MGB_CTX_IDENTITY (static_cast<const void*>(::MobileGL::MG_State::pGLContext.get()))
+#endif
+#endif

MobileGL/MG_Pipe/PipeMutation.h

@@ -0,0 +1,42 @@
+// MobileGL - MobileGL/MG_Pipe/PipeMutation.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#ifndef MOBILEGL_MG_PIPE_MUTATION_H // belt and braces: reachable as <MG_Pipe/..> and <..>
+#define MOBILEGL_MG_PIPE_MUTATION_H
+// Push-on-mutation (P1 lane finding F2). MGP_FILL copies a verb's may-read set out of the
+// live GLContext at the verb boundary; the backend then reads that copy for the whole verb.
+// A backend that WRITES a frontend object inside its own verb - Magma synthesising a
+// fallback texture for an unbound sampler, materialising a queued clear, or overriding a
+// sampler's filter - moves a value the boundary already copied, and every read after that
+// point sees a block that no longer equals the live context. That is a real divergence, not
+// a harness artefact: the pull build reads the moved value and the push build does not.
+//
+// The frontend mutator that moves such a value spells MGP_NOTE_MUTATION(Field) right where
+// it moves it. The notice refreshes that ONE field in the pushed block when the field
+// belongs to the verb currently in flight, so "the pushed block equals the live context at
+// every read" stays literally true and the push build keeps pull semantics. It refreshes
+// the value only and never the poison stamp, so a withheld stamp (MOBILEGL_PIPE_POISON_OMIT,
+// negative control B) stays withheld.
+//
+// In the pull build the macro is ((void)0) and this header includes nothing, so the pull
+// build is byte-identical to a tree without it.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/MGPipe.h>
+namespace MobileGL::MG_Pipe {
+    // MG_Impl/Pipe/PipeFill.cpp (the client side, the only place that may spell pGLContext).
+    // A no-op unless a context is live, a verb has been filled, and `field` is in that verb
+    // class's may-read mask; a forwarded (sticky) field has no storage and is never copied.
+    void MGPipeNoteFrontendMutation(MGPipeInputField field);
+} // namespace MobileGL::MG_Pipe
+#define MGP_NOTE_MUTATION(Field)                                                                                       \
+    ::MobileGL::MG_Pipe::MGPipeNoteFrontendMutation(::MobileGL::MG_Pipe::MGPipeInputField::Field)
+#else
+#define MGP_NOTE_MUTATION(Field) ((void)0)
+#endif
+#endif

MobileGL/MG_Pipe/generated/PipeCoverage.inc

@@ -0,0 +1,108 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeCoverage.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G6: backend read inventory -> MGPipe call coverage.
+//
+// GENERATED by scripts/gen_pipe.py from Coverage.def and scripts/data/backend_read_inventory.md - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// The acceptance rule (plan B section 10.3-5): regenerate, `git diff --exit-code`, and
+// ZERO unmapped rows. P0 permits unmapped rows and only counts them; the count below is
+// the number the later gate has to drive to zero.
+//
+// Three pseudo-calls stand for read points that never become a forward record:
+// kClientResolved (the frontend answers it), kReverseChannel (it becomes one of the ten
+// MGPipeCallbacks) and kStructuralHandle (the row is a signature carrying a
+// SharedPtr<MG_State...> that becomes an MGPipeHandle parameter).
+
+struct MGPipeCoverageEntry {
+    const char* Accessor;
+    const char* Call;
+    Uint32 ReadPoints;
+};
+
+inline constexpr MGPipeCoverageEntry kMGPipeCoverage[] = {
+    {"Buffer ops delta", "ResourceRespecify", 17},
+    {"GetActiveTextureUnit", "SetSamplerViews", 8},
+    {"GetBlendColor", "SetDynamicState", 1},
+    {"GetBlendEquationIndexed", "CreateRenderState", 1},
+    {"GetBlendFuncIndexed", "CreateRenderState", 1},
+    {"GetBoundTransformFeedbackName", "SetStreamOutputTargets", 1},
+    {"GetBoundVertexArray", "BindVertexElements", 12},
+    {"GetBufferBindingPoint", "SetShaderBuffers", 19},
+    {"GetBufferBindingPointCount", "SetShaderBuffers", 3},
+    {"GetBufferBindingSlot", "SetIndirectBuffers", 29},
+    {"GetClampReadColor", "SetDynamicState", 1},
+    {"GetClearColor", "SetDynamicState", 1},
+    {"GetClearDepth", "SetDynamicState", 1},
+    {"GetClearStencil", "SetDynamicState", 1},
+    {"GetColorMaskIndexed", "CreateRenderState", 6},
+    {"GetCullFaceMode", "CreateRenderState", 1},
+    {"GetCurrentVertexAttribute", "SetVertexAttribDefaults", 2},
+    {"GetDepthFunc", "CreateRenderState", 1},
+    {"GetDepthMask", "CreateRenderState", 5},
+    {"GetDepthRangeIndexed", "SetDynamicState", 1},
+    {"GetFramebufferBindingSlot", "SetFramebufferState", 19},
+    {"GetImageTextureBinding", "SetShaderImages", 14},
+    {"GetLineWidth", "SetDynamicState", 1},
+    {"GetLogicOp", "CreateRenderState", 1},
+    {"GetMaxTouchedTextureUnit", "SetSamplerViews", 1},
+    {"GetMinSampleShadingValue", "CreateRenderState", 1},
+    {"GetPatchDefaultInnerLevel", "SetPatchState", 3},
+    {"GetPatchDefaultOuterLevel", "SetPatchState", 3},
+    {"GetPatchVertices", "SetPatchState", 3},
+    {"GetPipelineStateVersion", "BindRenderState", 3},
+    {"GetPixelStoreParameters", "SetPixelPackState", 6},
+    {"GetPolygonModeFront", "CreateRenderState", 1},
+    {"GetPolygonOffsetFactor", "SetDynamicState", 1},
+    {"GetPolygonOffsetUnits", "SetDynamicState", 1},
+    {"GetPrimitiveRestartIndex", "DrawVbo", 3},
+    {"GetProgramForDispatch", "SetDispatchProgram", 3},
+    {"GetProgramForDraw", "SetDrawProgram", 7},
+    {"GetProgramObject", "CreateShaderState", 3},
+    {"GetProvokingVertexMode", "CreateRenderState", 1},
+    {"GetRenderStateParameters", "CreateRenderState", 11},
+    {"GetRenderStateParametersVersion", "BindRenderState", 2},
+    {"GetSamplingResolutionGeneration", "SetSamplerViews", 9},
+    {"GetScissorBox", "SetDynamicState", 3},
+    {"GetStencilState", "CreateRenderState", 8},
+    {"GetTextureBindGeneration", "SetSamplerViews", 5},
+    {"GetTextureContextId", "SetSamplerViews", 6},
+    {"GetTextureObject", "SetSamplerViews", 1},
+    {"GetTextureUnitObject", "SetSamplerViews", 19},
+    {"GetTouchedBufferBindingPointCount", "SetShaderBuffers", 2},
+    {"GetTransformFeedbackCapturedVertices", "DrawVbo", 1},
+    {"GetTransformFeedbackGeneration", "SetStreamOutputTargets", 1},
+    {"GetTransformFeedbackPausedPrimitiveCounter", "EndStreamOutput", 2},
+    {"GetTransformFeedbackProgram", "SetStreamOutputTargets", 3},
+    {"GetViewport", "SetDynamicState", 1},
+    {"GetViewportIndexed", "SetDynamicState", 1},
+    {"InvalidateCompileEnv", "kClientResolved", 2},
+    {"IsCapabilityEnabled", "CreateRenderState", 29},
+    {"IsCapabilityEnabledIndexed", "CreateRenderState", 1},
+    {"IsTransformFeedbackActive", "BeginStreamOutput", 5},
+    {"IsTransformFeedbackPaused", "PauseStreamOutput", 2},
+    {"RecordError", "kReverseChannel", 6},
+    {"ValidateProgramName", "kClientResolved", 3},
+    {"handle-ify (wire handle)", "kStructuralHandle", 167},
+};
+
+inline constexpr SizeT kMGPipeCoverageEntryCount = 63;
+inline constexpr Uint32 kMGPipeInventoryReadPoints = 477;
+inline constexpr Uint32 kMGPipeInventoryMappedToCall = 299;
+inline constexpr Uint32 kMGPipeInventoryClientResolved = 5;
+inline constexpr Uint32 kMGPipeInventoryReverseChannel = 6;
+inline constexpr Uint32 kMGPipeInventoryStructuralHandle = 167;
+inline constexpr Uint32 kMGPipeInventoryUnmapped = 0;
+static_assert(kMGPipeCoverageEntryCount == sizeof(kMGPipeCoverage) / sizeof(kMGPipeCoverage[0]));
+static_assert(kMGPipeInventoryMappedToCall + kMGPipeInventoryClientResolved +
+                  kMGPipeInventoryReverseChannel + kMGPipeInventoryStructuralHandle +
+                  kMGPipeInventoryUnmapped ==
+              kMGPipeInventoryReadPoints,
+              "every inventory row must land in exactly one bucket");

MobileGL/MG_Pipe/generated/PipeFillPoints.inc

@@ -0,0 +1,300 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeFillPoints.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G5b: the verb enum, the verb classes and their may-read field masks.
+//
+// GENERATED by scripts/gen_pipe.py from FillPoints.def, Coverage.def and MG_Backend/BackendObject.h - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// One verb per function-pointer member of MG_Backend::GLFunctionsTable, in declaration
+// order, so the enum IS the table's member list. MG_Impl spells MGP_FILL(Verb) before every
+// call through the table; MGPipeFillForVerb fills exactly the fields of the verb's class
+// (plus the sticky fields, OR'ed into every mask) and stamps them with the new serial. A
+// read of any other field is Fatal{UnmigratedPipeInput, "Field@Verb"} in a poison build.
+
+enum class MGPipeVerb : Uint8 {
+    DrawArrays,
+    DrawElements,
+    DrawElementsBaseVertex,
+    MultiDrawArrays,
+    MultiDrawElements,
+    MultiDrawElementsBaseVertex,
+    MultiDrawElementsIndirect,
+    MultiDrawArraysIndirect,
+    MultiDrawElementsIndirectCount,
+    MultiDrawArraysIndirectCount,
+    DrawRangeElementsBaseVertex,
+    DrawRangeElements,
+    DrawElementsInstancedBaseVertexBaseInstance,
+    DrawElementsInstancedBaseVertex,
+    DrawElementsInstancedBaseInstance,
+    DrawElementsInstanced,
+    DrawArraysInstancedBaseInstance,
+    DrawArraysInstanced,
+    DrawElementsIndirect,
+    DrawArraysIndirect,
+    Clear,
+    ClearBufferfi,
+    ClearBufferfv,
+    ClearBufferuiv,
+    ClearBufferiv,
+    ClearNamedFramebufferfv,
+    ClearNamedFramebufferfi,
+    ClearNamedFramebufferiv,
+    ClearNamedFramebufferuiv,
+    BlitFramebuffer,
+    BlitNamedFramebuffer,
+    CopyTexImage2D,
+    CopyTexSubImage2D,
+    CopyImageSubData,
+    GenerateMipmap,
+    ReadPixels,
+    GetTexImage,
+    GetTextureImage,
+    DispatchCompute,
+    DispatchComputeIndirect,
+    MemoryBarrier,
+    MemoryBarrierByRegion,
+    BindImageTexture,
+    GetIntegeri_v,
+    ShaderStorageBlockBinding,
+    FenceSync,
+    ClientWaitSync,
+    WaitSync,
+    DeleteSync,
+    GetSyncStatus,
+    IsTimerQuerySupported,
+    BeginTimeElapsedQuery,
+    EndTimeElapsedQuery,
+    QueryCounterTimestamp,
+    IsQueryResultAvailable,
+    GetQueryResult64,
+    DeleteBackendQuery,
+    BeginOcclusionQuery,
+    EndOcclusionQuery,
+    BeginXfbPrimitivesQuery,
+    EndXfbPrimitivesQuery,
+    PatchParameteri,
+    BeginTransformFeedback,
+    EndTransformFeedback,
+    PauseTransformFeedback,
+    ResumeTransformFeedback,
+    BindTransformFeedback,
+    DeleteTransformFeedback,
+    GetGpuTimestampNs,
+    kVerbCount,
+};
+
+inline constexpr SizeT kMGPipeVerbCount = static_cast<SizeT>(MGPipeVerb::kVerbCount);
+static_assert(kMGPipeVerbCount == 69, "the GLFunctionsTable verb set moved");
+
+inline constexpr const char* kMGPipeVerbNames[kMGPipeVerbCount] = {
+    "DrawArrays",
+    "DrawElements",
+    "DrawElementsBaseVertex",
+    "MultiDrawArrays",
+    "MultiDrawElements",
+    "MultiDrawElementsBaseVertex",
+    "MultiDrawElementsIndirect",
+    "MultiDrawArraysIndirect",
+    "MultiDrawElementsIndirectCount",
+    "MultiDrawArraysIndirectCount",
+    "DrawRangeElementsBaseVertex",
+    "DrawRangeElements",
+    "DrawElementsInstancedBaseVertexBaseInstance",
+    "DrawElementsInstancedBaseVertex",
+    "DrawElementsInstancedBaseInstance",
+    "DrawElementsInstanced",
+    "DrawArraysInstancedBaseInstance",
+    "DrawArraysInstanced",
+    "DrawElementsIndirect",
+    "DrawArraysIndirect",
+    "Clear",
+    "ClearBufferfi",
+    "ClearBufferfv",
+    "ClearBufferuiv",
+    "ClearBufferiv",
+    "ClearNamedFramebufferfv",
+    "ClearNamedFramebufferfi",
+    "ClearNamedFramebufferiv",
+    "ClearNamedFramebufferuiv",
+    "BlitFramebuffer",
+    "BlitNamedFramebuffer",
+    "CopyTexImage2D",
+    "CopyTexSubImage2D",
+    "CopyImageSubData",
+    "GenerateMipmap",
+    "ReadPixels",
+    "GetTexImage",
+    "GetTextureImage",
+    "DispatchCompute",
+    "DispatchComputeIndirect",
+    "MemoryBarrier",
+    "MemoryBarrierByRegion",
+    "BindImageTexture",
+    "GetIntegeri_v",
+    "ShaderStorageBlockBinding",
+    "FenceSync",
+    "ClientWaitSync",
+    "WaitSync",
+    "DeleteSync",
+    "GetSyncStatus",
+    "IsTimerQuerySupported",
+    "BeginTimeElapsedQuery",
+    "EndTimeElapsedQuery",
+    "QueryCounterTimestamp",
+    "IsQueryResultAvailable",
+    "GetQueryResult64",
+    "DeleteBackendQuery",
+    "BeginOcclusionQuery",
+    "EndOcclusionQuery",
+    "BeginXfbPrimitivesQuery",
+    "EndXfbPrimitivesQuery",
+    "PatchParameteri",
+    "BeginTransformFeedback",
+    "EndTransformFeedback",
+    "PauseTransformFeedback",
+    "ResumeTransformFeedback",
+    "BindTransformFeedback",
+    "DeleteTransformFeedback",
+    "GetGpuTimestampNs",
+};
+
+enum class MGPipeVerbClass : Uint8 {
+    kDraw,
+    kDispatch,
+    kClear,
+    kBlitOrCopy,
+    kTextureOp,
+    kReadback,
+    kXfbSpan,
+    kProgramOp,
+    kQuery,
+    kClassCount,
+};
+
+inline constexpr SizeT kMGPipeVerbClassCount = static_cast<SizeT>(MGPipeVerbClass::kClassCount);
+static_assert(kMGPipeVerbClassCount == 9, "the verb class set moved");
+
+inline constexpr const char* kMGPipeVerbClassNames[kMGPipeVerbClassCount] = {
+    "kDraw",
+    "kDispatch",
+    "kClear",
+    "kBlitOrCopy",
+    "kTextureOp",
+    "kReadback",
+    "kXfbSpan",
+    "kProgramOp",
+    "kQuery",
+};
+
+inline constexpr MGPipeVerbClass kMGPipeVerbClass[kMGPipeVerbCount] = {
+    MGPipeVerbClass::kDraw, // DrawArrays
+    MGPipeVerbClass::kDraw, // DrawElements
+    MGPipeVerbClass::kDraw, // DrawElementsBaseVertex
+    MGPipeVerbClass::kDraw, // MultiDrawArrays
+    MGPipeVerbClass::kDraw, // MultiDrawElements
+    MGPipeVerbClass::kDraw, // MultiDrawElementsBaseVertex
+    MGPipeVerbClass::kDraw, // MultiDrawElementsIndirect
+    MGPipeVerbClass::kDraw, // MultiDrawArraysIndirect
+    MGPipeVerbClass::kDraw, // MultiDrawElementsIndirectCount
+    MGPipeVerbClass::kDraw, // MultiDrawArraysIndirectCount
+    MGPipeVerbClass::kDraw, // DrawRangeElementsBaseVertex
+    MGPipeVerbClass::kDraw, // DrawRangeElements
+    MGPipeVerbClass::kDraw, // DrawElementsInstancedBaseVertexBaseInstance
+    MGPipeVerbClass::kDraw, // DrawElementsInstancedBaseVertex
+    MGPipeVerbClass::kDraw, // DrawElementsInstancedBaseInstance
+    MGPipeVerbClass::kDraw, // DrawElementsInstanced
+    MGPipeVerbClass::kDraw, // DrawArraysInstancedBaseInstance
+    MGPipeVerbClass::kDraw, // DrawArraysInstanced
+    MGPipeVerbClass::kDraw, // DrawElementsIndirect
+    MGPipeVerbClass::kDraw, // DrawArraysIndirect
+    MGPipeVerbClass::kClear, // Clear
+    MGPipeVerbClass::kClear, // ClearBufferfi
+    MGPipeVerbClass::kClear, // ClearBufferfv
+    MGPipeVerbClass::kClear, // ClearBufferuiv
+    MGPipeVerbClass::kClear, // ClearBufferiv
+    MGPipeVerbClass::kClear, // ClearNamedFramebufferfv
+    MGPipeVerbClass::kClear, // ClearNamedFramebufferfi
+    MGPipeVerbClass::kClear, // ClearNamedFramebufferiv
+    MGPipeVerbClass::kClear, // ClearNamedFramebufferuiv
+    MGPipeVerbClass::kBlitOrCopy, // BlitFramebuffer
+    MGPipeVerbClass::kBlitOrCopy, // BlitNamedFramebuffer
+    MGPipeVerbClass::kBlitOrCopy, // CopyTexImage2D
+    MGPipeVerbClass::kBlitOrCopy, // CopyTexSubImage2D
+    MGPipeVerbClass::kBlitOrCopy, // CopyImageSubData
+    MGPipeVerbClass::kTextureOp, // GenerateMipmap
+    MGPipeVerbClass::kReadback, // ReadPixels
+    MGPipeVerbClass::kReadback, // GetTexImage
+    MGPipeVerbClass::kReadback, // GetTextureImage
+    MGPipeVerbClass::kDispatch, // DispatchCompute
+    MGPipeVerbClass::kDispatch, // DispatchComputeIndirect
+    MGPipeVerbClass::kQuery, // MemoryBarrier
+    MGPipeVerbClass::kQuery, // MemoryBarrierByRegion
+    MGPipeVerbClass::kTextureOp, // BindImageTexture
+    MGPipeVerbClass::kQuery, // GetIntegeri_v
+    MGPipeVerbClass::kProgramOp, // ShaderStorageBlockBinding
+    MGPipeVerbClass::kQuery, // FenceSync
+    MGPipeVerbClass::kQuery, // ClientWaitSync
+    MGPipeVerbClass::kQuery, // WaitSync
+    MGPipeVerbClass::kQuery, // DeleteSync
+    MGPipeVerbClass::kQuery, // GetSyncStatus
+    MGPipeVerbClass::kQuery, // IsTimerQuerySupported
+    MGPipeVerbClass::kQuery, // BeginTimeElapsedQuery
+    MGPipeVerbClass::kQuery, // EndTimeElapsedQuery
+    MGPipeVerbClass::kQuery, // QueryCounterTimestamp
+    MGPipeVerbClass::kQuery, // IsQueryResultAvailable
+    MGPipeVerbClass::kQuery, // GetQueryResult64
+    MGPipeVerbClass::kQuery, // DeleteBackendQuery
+    MGPipeVerbClass::kQuery, // BeginOcclusionQuery
+    MGPipeVerbClass::kQuery, // EndOcclusionQuery
+    MGPipeVerbClass::kQuery, // BeginXfbPrimitivesQuery
+    MGPipeVerbClass::kQuery, // EndXfbPrimitivesQuery
+    MGPipeVerbClass::kQuery, // PatchParameteri
+    MGPipeVerbClass::kXfbSpan, // BeginTransformFeedback
+    MGPipeVerbClass::kXfbSpan, // EndTransformFeedback
+    MGPipeVerbClass::kXfbSpan, // PauseTransformFeedback
+    MGPipeVerbClass::kXfbSpan, // ResumeTransformFeedback
+    MGPipeVerbClass::kXfbSpan, // BindTransformFeedback
+    MGPipeVerbClass::kXfbSpan, // DeleteTransformFeedback
+    MGPipeVerbClass::kQuery, // GetGpuTimestampNs
+};
+
+// One bit per MGPipeInputField. The 7 sticky fields are OR'ed into every class.
+struct MGPipeFieldMask {
+    Uint64 Words[2];
+};
+
+inline constexpr Bool MGPipeFieldMaskHas(const MGPipeFieldMask& mask, MGPipeInputField field) {
+    const SizeT index = static_cast<SizeT>(field);
+    return (mask.Words[index / 64] >> (index % 64)) & 1u;
+}
+
+inline constexpr MGPipeFieldMask kMGPipeClassFieldMask[kMGPipeVerbClassCount] = {
+    // kDraw: 54 fields (47 own + 7 sticky)
+    {{0x7ffbfff7bfffc3eeull, 0x0000000000000000ull}},
+    // kDispatch: 22 fields (15 own + 7 sticky)
+    {{0x5c40f2281d3003c0ull, 0x0000000000000000ull}},
+    // kClear: 25 fields (18 own + 7 sticky)
+    {{0x5c50ffa001347900ull, 0x0000000000000000ull}},
+    // kBlitOrCopy: 29 fields (22 own + 7 sticky)
+    {{0x5f70ffe0013c4181ull, 0x0000000000000000ull}},
+    // kTextureOp: 17 fields (10 own + 7 sticky)
+    {{0x5c40f22001300181ull, 0x0000000000000000ull}},
+    // kReadback: 24 fields (17 own + 7 sticky)
+    {{0x5f50f3a041300541ull, 0x0000000000000000ull}},
+    // kXfbSpan: 15 fields (8 own + 7 sticky)
+    {{0x7f0b402000000380ull, 0x0000000000000000ull}},
+    // kProgramOp: 18 fields (11 own + 7 sticky)
+    {{0x5c50f3a001300100ull, 0x0000000000000000ull}},
+    // kQuery: 8 fields (1 own + 7 sticky)
+    {{0x5c04402000000100ull, 0x0000000000000000ull}},
+};
+
+static_assert(kMGPipeInputFieldCount <= 2 * 64, "MGPipeFieldMask needs another word");

MobileGL/MG_Pipe/generated/PipeFilled.inc

@@ -0,0 +1,321 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeFilled.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G5: PipeInputs field ids and the per-verb poison generations.
+//
+// GENERATED by scripts/gen_pipe.py from Coverage.def and PipeCalls.def - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// One field id per GLContext accessor the backends actually read (plan B section 6.2:
+// PipeInputs is organized by MEMO KEY, not by read point, which is why the field set is
+// small and stable across the whole migration).
+//
+// The poison is a per-verb GENERATION, not a bit. A bitmap cannot see the dangerous case:
+// a field filled by the previous DRAW and then read by the glTexSubImage that follows is
+// stale, and its bit is already set. So every verb bumps CurrentVerbSerial, filling a
+// field stamps it with that serial, and reading a non-sticky field whose stamp is older is
+// Fatal{UnmigratedPipeInput} (section 6.2.2).
+//
+// PipeInputs itself is MG_Backend/MGPipe/PipeInputs.h (P1); the verb enum and the
+// per-class fill masks are G5b, generated/PipeFillPoints.inc.
+
+enum class MGPipeInputField : Uint16 {
+    GetActiveTextureUnit,
+    GetBlendColor,
+    GetBlendEquationIndexed,
+    GetBlendFuncIndexed,
+    GetBoundTransformFeedbackName,
+    GetBoundVertexArray,
+    GetBufferBindingSlot,
+    GetBufferBindingPoint,
+    GetBufferBindingPointCount,
+    GetTouchedBufferBindingPointCount,
+    GetClampReadColor,
+    GetClearColor,
+    GetClearDepth,
+    GetClearStencil,
+    GetColorMaskIndexed,
+    GetCullFaceMode,
+    GetCurrentVertexAttribute,
+    GetDepthFunc,
+    GetDepthMask,
+    GetDepthRangeIndexed,
+    GetFramebufferBindingSlot,
+    GetImageTextureBinding,
+    GetLineWidth,
+    GetLogicOp,
+    GetMaxTouchedTextureUnit,
+    GetMinSampleShadingValue,
+    GetPatchDefaultInnerLevel,
+    GetPatchDefaultOuterLevel,
+    GetPatchVertices,
+    GetPipelineStateVersion,
+    GetPixelStoreParameters,
+    GetPolygonModeFront,
+    GetPolygonOffsetFactor,
+    GetPolygonOffsetUnits,
+    GetPrimitiveRestartIndex,
+    GetProgramForDispatch,
+    GetProgramForDraw,
+    GetProgramObject,
+    GetProvokingVertexMode,
+    GetRenderStateParameters,
+    GetRenderStateParametersVersion,
+    GetSamplingResolutionGeneration,
+    GetScissorBox,
+    GetStencilState,
+    GetTextureBindGeneration,
+    GetTextureContextId,
+    GetTextureObject,
+    GetTextureUnitObject,
+    GetTransformFeedbackCapturedVertices,
+    GetTransformFeedbackGeneration,
+    GetTransformFeedbackPausedPrimitiveCounter,
+    GetTransformFeedbackProgram,
+    GetViewport,
+    GetViewportIndexed,
+    IsCapabilityEnabled,
+    IsCapabilityEnabledIndexed,
+    IsTransformFeedbackActive,
+    IsTransformFeedbackPaused,
+    InvalidateCompileEnv,
+    ValidateProgramName,
+    RecordError,
+    GetBoundTransformFeedbackLifetimeId,
+    HasOpenTransformFeedbackSpan,
+    kFieldCount,
+};
+
+inline constexpr SizeT kMGPipeInputFieldCount = static_cast<SizeT>(MGPipeInputField::kFieldCount);
+static_assert(kMGPipeInputFieldCount == 63, "the PipeInputs field set moved");
+
+inline constexpr const char* kMGPipeInputFieldNames[kMGPipeInputFieldCount] = {
+    "GetActiveTextureUnit",
+    "GetBlendColor",
+    "GetBlendEquationIndexed",
+    "GetBlendFuncIndexed",
+    "GetBoundTransformFeedbackName",
+    "GetBoundVertexArray",
+    "GetBufferBindingSlot",
+    "GetBufferBindingPoint",
+    "GetBufferBindingPointCount",
+    "GetTouchedBufferBindingPointCount",
+    "GetClampReadColor",
+    "GetClearColor",
+    "GetClearDepth",
+    "GetClearStencil",
+    "GetColorMaskIndexed",
+    "GetCullFaceMode",
+    "GetCurrentVertexAttribute",
+    "GetDepthFunc",
+    "GetDepthMask",
+    "GetDepthRangeIndexed",
+    "GetFramebufferBindingSlot",
+    "GetImageTextureBinding",
+    "GetLineWidth",
+    "GetLogicOp",
+    "GetMaxTouchedTextureUnit",
+    "GetMinSampleShadingValue",
+    "GetPatchDefaultInnerLevel",
+    "GetPatchDefaultOuterLevel",
+    "GetPatchVertices",
+    "GetPipelineStateVersion",
+    "GetPixelStoreParameters",
+    "GetPolygonModeFront",
+    "GetPolygonOffsetFactor",
+    "GetPolygonOffsetUnits",
+    "GetPrimitiveRestartIndex",
+    "GetProgramForDispatch",
+    "GetProgramForDraw",
+    "GetProgramObject",
+    "GetProvokingVertexMode",
+    "GetRenderStateParameters",
+    "GetRenderStateParametersVersion",
+    "GetSamplingResolutionGeneration",
+    "GetScissorBox",
+    "GetStencilState",
+    "GetTextureBindGeneration",
+    "GetTextureContextId",
+    "GetTextureObject",
+    "GetTextureUnitObject",
+    "GetTransformFeedbackCapturedVertices",
+    "GetTransformFeedbackGeneration",
+    "GetTransformFeedbackPausedPrimitiveCounter",
+    "GetTransformFeedbackProgram",
+    "GetViewport",
+    "GetViewportIndexed",
+    "IsCapabilityEnabled",
+    "IsCapabilityEnabledIndexed",
+    "IsTransformFeedbackActive",
+    "IsTransformFeedbackPaused",
+    "InvalidateCompileEnv",
+    "ValidateProgramName",
+    "RecordError",
+    "GetBoundTransformFeedbackLifetimeId",
+    "HasOpenTransformFeedbackSpan",
+};
+
+// Fields whose value is valid ACROSS verbs: a sticky field is a field the poison
+// cannot protect, so every true is argued for in Coverage.def's
+// MGP_COVERAGE_STICKY_LIST (the seven forwarded, argument-keyed accessors).
+inline constexpr Bool kMGPipeInputFieldSticky[kMGPipeInputFieldCount] = {
+    false, // GetActiveTextureUnit
+    false, // GetBlendColor
+    false, // GetBlendEquationIndexed
+    false, // GetBlendFuncIndexed
+    false, // GetBoundTransformFeedbackName
+    false, // GetBoundVertexArray
+    false, // GetBufferBindingSlot
+    false, // GetBufferBindingPoint
+    true,  // GetBufferBindingPointCount: keyed by target: a constexpr capacity table, not verb state
+    false, // GetTouchedBufferBindingPointCount
+    false, // GetClampReadColor
+    false, // GetClearColor
+    false, // GetClearDepth
+    false, // GetClearStencil
+    false, // GetColorMaskIndexed
+    false, // GetCullFaceMode
+    false, // GetCurrentVertexAttribute
+    false, // GetDepthFunc
+    false, // GetDepthMask
+    false, // GetDepthRangeIndexed
+    false, // GetFramebufferBindingSlot
+    false, // GetImageTextureBinding
+    false, // GetLineWidth
+    false, // GetLogicOp
+    false, // GetMaxTouchedTextureUnit
+    false, // GetMinSampleShadingValue
+    false, // GetPatchDefaultInnerLevel
+    false, // GetPatchDefaultOuterLevel
+    false, // GetPatchVertices
+    false, // GetPipelineStateVersion
+    false, // GetPixelStoreParameters
+    false, // GetPolygonModeFront
+    false, // GetPolygonOffsetFactor
+    false, // GetPolygonOffsetUnits
+    false, // GetPrimitiveRestartIndex
+    false, // GetProgramForDispatch
+    false, // GetProgramForDraw
+    true,  // GetProgramObject: keyed by GL name: an object lookup, not verb state
+    false, // GetProvokingVertexMode
+    false, // GetRenderStateParameters
+    false, // GetRenderStateParametersVersion
+    false, // GetSamplingResolutionGeneration
+    false, // GetScissorBox
+    false, // GetStencilState
+    false, // GetTextureBindGeneration
+    false, // GetTextureContextId
+    true,  // GetTextureObject: keyed by GL name: an object lookup, not verb state
+    false, // GetTextureUnitObject
+    false, // GetTransformFeedbackCapturedVertices
+    false, // GetTransformFeedbackGeneration
+    false, // GetTransformFeedbackPausedPrimitiveCounter
+    false, // GetTransformFeedbackProgram
+    false, // GetViewport
+    false, // GetViewportIndexed
+    false, // IsCapabilityEnabled
+    false, // IsCapabilityEnabledIndexed
+    false, // IsTransformFeedbackActive
+    false, // IsTransformFeedbackPaused
+    true,  // InvalidateCompileEnv: reverse channel: a write into the frontend, not a state read
+    true,  // ValidateProgramName: keyed by GL name: a name-table lookup, not verb state
+    true,  // RecordError: reverse channel: a write into the frontend, not a state read
+    false, // GetBoundTransformFeedbackLifetimeId
+    true,  // HasOpenTransformFeedbackSpan: keyed by lifetime id: an object lookup, not verb state
+};
+inline constexpr SizeT kMGPipeInputStickyFieldCount = 7;
+
+// Which call is expected to have filled a field by the time a verb reads it. Names
+// come from Coverage.def, so this table and the coverage table cannot disagree.
+inline constexpr const char* kMGPipeInputFieldFilledBy[kMGPipeInputFieldCount] = {
+    "SetSamplerViews",
+    "SetDynamicState",
+    "CreateRenderState",
+    "CreateRenderState",
+    "SetStreamOutputTargets",
+    "BindVertexElements",
+    "SetIndirectBuffers",
+    "SetShaderBuffers",
+    "SetShaderBuffers",
+    "SetShaderBuffers",
+    "SetDynamicState",
+    "SetDynamicState",
+    "SetDynamicState",
+    "SetDynamicState",
+    "CreateRenderState",
+    "CreateRenderState",
+    "SetVertexAttribDefaults",
+    "CreateRenderState",
+    "CreateRenderState",
+    "SetDynamicState",
+    "SetFramebufferState",
+    "SetShaderImages",
+    "SetDynamicState",
+    "CreateRenderState",
+    "SetSamplerViews",
+    "CreateRenderState",
+    "SetPatchState",
+    "SetPatchState",
+    "SetPatchState",
+    "BindRenderState",
+    "SetPixelPackState",
+    "CreateRenderState",
+    "SetDynamicState",
+    "SetDynamicState",
+    "DrawVbo",
+    "SetDispatchProgram",
+    "SetDrawProgram",
+    "CreateShaderState",
+    "CreateRenderState",
+    "CreateRenderState",
+    "BindRenderState",
+    "SetSamplerViews",
+    "SetDynamicState",
+    "CreateRenderState",
+    "SetSamplerViews",
+    "SetSamplerViews",
+    "SetSamplerViews",
+    "SetSamplerViews",
+    "DrawVbo",
+    "SetStreamOutputTargets",
+    "EndStreamOutput",
+    "SetStreamOutputTargets",
+    "SetDynamicState",
+    "SetDynamicState",
+    "CreateRenderState",
+    "CreateRenderState",
+    "BeginStreamOutput",
+    "PauseStreamOutput",
+    "kClientResolved", // pseudo-call: not filled by a forward record
+    "kClientResolved", // pseudo-call: not filled by a forward record
+    "kReverseChannel", // pseudo-call: not filled by a forward record
+    "SetStreamOutputTargets",
+    "SetStreamOutputTargets",
+};
+
+struct MGPipeFilledState {
+    Uint64 CurrentVerbSerial;
+    Uint64 FilledGen[kMGPipeInputFieldCount];
+};
+
+[[noreturn]] inline void MGPipeInputPoisonFatal(MGPipeInputField field, const char* verb) {
+    MGLOG_F("MGPipe: Fatal{UnmigratedPipeInput, \"%s@%s\"}",
+            kMGPipeInputFieldNames[static_cast<SizeT>(field)], verb);
+    std::abort();
+}
+
+// FilledGen == 0 is "never filled" on BOTH branches: before the first MGPipeFillForVerb the
+// serial is 0 as well, and a read in that window is the poison's "<Field>@<none>" case
+// (P1 brief D6), never a fresh read of default-constructed storage.
+inline Bool MGPipeInputFieldIsFresh(const MGPipeFilledState& state, MGPipeInputField field) {
+    const SizeT index = static_cast<SizeT>(field);
+    const Uint64 gen = state.FilledGen[index];
+    if (gen == 0) return false;
+    return kMGPipeInputFieldSticky[index] || gen == state.CurrentVerbSerial;
+}

MobileGL/MG_Pipe/generated/PipeSpanTable.inc

@@ -0,0 +1,67 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeSpanTable.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G7: the render-state pipeline subset, by member name.
+//
+// GENERATED by scripts/gen_pipe.py from the field list in scripts/gen_pipe.py - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// D-B1 rejected three CSOs and demanded this table instead, so the table needs its own
+// completeness trip wire: MG_Test walks every public RenderState setter and asserts that
+// the pipeline-subset hash moves IF AND ONLY IF m_pipelineStateVersion moves. That test
+// and MGPipeRenderStateSpans.cpp land with P2; what P0 pins is the MEMBER LIST, taken from
+// what VulkanRenderer::ComputePipelineStateHash hashes today, so the later offsets are
+// derived from a list that was reviewed rather than invented.
+//
+// Deliberately absent, and each absence is a question P2 has to answer before the chunk
+// table freezes:
+//   - FramebufferSrgb and DepthClamp have NO STORAGE at all (RenderState.cpp's SetCapability
+//     falls to "not supported currently" and IsCapabilityEnabled returns false), so six
+//     backend read points are constant false today. Pipeline state or dead capability?
+//   - ProvokingVertexModeSetting is Vulkan pipeline state but is not hashed today.
+//   - FrontFaceModeSetting, ClipOrigin and ClipDepthMode are pipeline state on Vulkan and
+//     are handled elsewhere in the payload path rather than in the memo word.
+//
+// The complement of this list is the DYNAMIC subset - the half whose whole purpose is that
+// glViewport must not mint a new CSO.
+
+inline constexpr const char* const kMGPipePipelineStateMembers[] = {
+    "CullFaceEnabled",
+    "DepthTestEnabled",
+    "PolygonOffsetFillEnabled",
+    "RasterizerDiscardEnabled",
+    "ColorLogicOpEnabled",
+    "StencilTestEnabled",
+    "PrimitiveRestartEnabled",
+    "PrimitiveRestartFixedIndexEnabled",
+    "DepthMask",
+    "SampleShadingEnabled",
+    "MultisampleEnabled",
+    "SampleMaskEnabled",
+    "SampleMaskValue",
+    "MinSampleShadingValue",
+    "PatchVertices",
+    "PatchDefaultOuterLevel",
+    "PatchDefaultInnerLevel",
+    "PolygonModeFront",
+    "CullFaceModeSetting",
+    "DepthFunc",
+    "LogicOp",
+    "StencilStates",
+    "BlendStates",
+    "ColorMasks",
+};
+inline constexpr SizeT kMGPipePipelineStateMemberCount = 24;
+static_assert(kMGPipePipelineStateMemberCount ==
+                  sizeof(kMGPipePipelineStateMembers) / sizeof(kMGPipePipelineStateMembers[0]));
+
+// Filled in by MG_Pipe/MGPipeRenderStateSpans.cpp (P2), which computes the offsets
+// in C++ with offsetof rather than guessing them in python.
+extern const MGPStateChunk kMGPipePipelineChunks[];
+extern const MGPStateChunk kMGPipeDynamicChunks[];

MobileGL/MG_Pipe/generated/PipeTables.inc

@@ -0,0 +1,108 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeTables.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G1: the two MGPipe interface tables.
+//
+// GENERATED by scripts/gen_pipe.py from PipeCalls.def - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// share group: 11 calls. A null entry means the backend does not implement this
+// call and the frontend keeps its own path (plan B section 4.1).
+struct MGPipeScreen {
+    void (*GetCaps)(const MGPCaps* payload, MGPReplySlot* reply);
+    void (*ResourceCreate)(const MGPResourceDesc* payload);
+    void (*ResourceRespecify)(const MGPResourceDesc* payload);
+    void (*ResourceDestroy)(const MGPHandleOnly* payload);
+    void (*MapPersistent)(const MGPHandleOnly* payload, MGPReplySlot* reply);
+    void (*UnmapPersistent)(const MGPHandleOnly* payload);
+    void (*FenceCreate)(const MGPHandleOnly* payload);
+    void (*FenceStatus)(const MGPHandleOnly* payload, MGPReplySlot* reply);
+    void (*FenceWait)(const MGPFenceWait* payload, MGPReplySlot* reply);
+    void (*FenceDestroy)(const MGPHandleOnly* payload);
+    void (*FenceWaitServer)(const MGPFenceWait* payload);
+};
+
+// context: 60 calls. A null entry means the backend does not implement this
+// call and the frontend keeps its own path (plan B section 4.1).
+struct MGPipeContext {
+    void (*QueryCreate)(const MGPQueryDesc* payload);
+    void (*QueryBegin)(const MGPQueryDesc* payload);
+    void (*QueryEnd)(const MGPQueryDesc* payload);
+    void (*QueryAvailable)(const MGPHandleOnly* payload, MGPReplySlot* reply);
+    void (*QueryResult)(const MGPQueryResultRequest* payload, MGPReplySlot* reply);
+    void (*QueryDestroy)(const MGPHandleOnly* payload);
+    void (*CreateRenderState)(const MGPRenderStateDesc* payload);
+    void (*BindRenderState)(const MGPBindRenderState* payload);
+    void (*DeleteRenderState)(const MGPHandleOnly* payload);
+    void (*CreateVertexElements)(const MGPVertexElements* payload);
+    void (*BindVertexElements)(const MGPHandleOnly* payload);
+    void (*DeleteVertexElements)(const MGPHandleOnly* payload);
+    void (*CreateSamplerState)(const MGPSamplerDesc* payload);
+    void (*DeleteSamplerState)(const MGPHandleOnly* payload);
+    void (*CreateSamplerView)(const MGPSamplerView* payload);
+    void (*DeleteSamplerView)(const MGPHandleOnly* payload);
+    void (*CreateShaderState)(const MGPProgramDesc* payload);
+    void (*BindShaderState)(const MGPHandleOnly* payload);
+    void (*DeleteShaderState)(const MGPHandleOnly* payload);
+    void (*SetDynamicState)(const MGPDynamicState* payload);
+    void (*SetFramebufferState)(const MGPFramebufferState* payload);
+    void (*SetVertexBuffers)(const MGPVertexBuffers* payload, const void* varTail, Uint32 varTailCount);
+    void (*SetIndexBuffer)(const MGPIndexBuffer* payload);
+    void (*SetIndirectBuffers)(const MGPIndirectBuffers* payload);
+    void (*SetSamplerViews)(const MGPSamplerViews* payload, const void* varTail, Uint32 varTailCount);
+    void (*BindSamplerStates)(const MGPSamplerStates* payload, const void* varTail, Uint32 varTailCount);
+    void (*SetShaderImages)(const MGPShaderImages* payload, const void* varTail, Uint32 varTailCount);
+    void (*SetShaderBuffers)(const MGPShaderBuffers* payload, const void* varTail, Uint32 varTailCount);
+    void (*SetStreamOutputTargets)(const MGPStreamOutputTargets* payload, const void* varTail, Uint32 varTailCount);
+    void (*SetGlobalConstants)(const MGPGlobalConstants* payload);
+    void (*SetVertexAttribDefaults)(const MGPVertexAttribDefaults* payload, const void* varTail, Uint32 varTailCount);
+    void (*SetPixelPackState)(const MGPPixelPackState* payload);
+    void (*SetPatchState)(const MGPPatchState* payload);
+    void (*SetDrawProgram)(const MGPHandleOnly* payload);
+    void (*SetDispatchProgram)(const MGPHandleOnly* payload);
+    void (*SetResidualValueState)(const MGPResidualValueState* payload);
+    void (*SetTextureParams)(const MGPTextureParams* payload);
+    void (*ResourceSubData)(const MGPSubData* payload, const void* varTail, Uint32 varTailCount);
+    void (*BufferSubDataResident)(const MGPSubData* payload);
+    void (*ResourceSubDataComplete)(const MGPSubDataComplete* payload);
+    void (*ResourceFlushRange)(const MGPFlushRange* payload);
+    void (*ResourceReadback)(const MGPReadback* payload, MGPReplySlot* reply);
+    void (*ResourceCopyRegion)(const MGPCopyRegion* payload);
+    void (*GenerateMipmap)(const MGPMipPlan* payload);
+    void (*GetTextureImage)(const MGPReadbackInfo* payload, MGPReplySlot* reply);
+    void (*Blit)(const MGPBlit* payload);
+    void (*Clear)(const MGPClear* payload);
+    void (*ReadPixels)(const MGPReadbackInfo* payload, MGPReplySlot* reply);
+    void (*DrawVbo)(const MGPDrawInfo* payload, const void* varTail, Uint32 varTailCount);
+    void (*LaunchGrid)(const MGPGridInfo* payload);
+    void (*MemoryBarrier)(const MGPMemoryBarrier* payload);
+    void (*BeginStreamOutput)(const MGPStreamOutputBegin* payload);
+    void (*EndStreamOutput)(const MGPXfbAccounting* payload);
+    void (*PauseStreamOutput)(const MGPStreamOutputControl* payload);
+    void (*ResumeStreamOutput)(const MGPStreamOutputControl* payload);
+    void (*Flush)(const MGPFlush* payload);
+    void (*Present)(const MGPPresent* payload);
+    void (*SetSwapInterval)(const MGPSwapInterval* payload);
+    void (*QueryTimestamp)(const MGPTimestampRequest* payload, MGPReplySlot* reply);
+    void (*QueryCounter)(const MGPQueryDesc* payload);
+};
+
+inline constexpr SizeT kMGPipeScreenCallCount = 11;
+inline constexpr SizeT kMGPipeContextCallCount = 60;
+inline constexpr SizeT kMGPipeCallCount = 71;
+
+// A table that is not exactly its call count of function pointers has grown a
+// member that no generator knows about.
+static_assert(sizeof(MGPipeScreen) == kMGPipeScreenCallCount * sizeof(void (*)()),
+              "MGPipeScreen is not exactly its catalogue's function pointers");
+static_assert(sizeof(MGPipeContext) == kMGPipeContextCallCount * sizeof(void (*)()),
+              "MGPipeContext is not exactly its catalogue's function pointers");
+static_assert(kMGPipeScreenCallCount + kMGPipeContextCallCount == kMGPipeCallCount);
+static_assert(kMGPipeCallCount == MGP_CALL_LIST_DOCUMENTED_COUNT,
+              "the catalogue and its documented count disagree");

MobileGL/MG_Pipe/generated/PipeThunks.inc

@@ -0,0 +1,302 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeThunks.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G2: monolith thunks over the two tables.
+//
+// GENERATED by scripts/gen_pipe.py from PipeCalls.def - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// One inline call through the installed table. These are the names MG_Impl call
+// sites move onto, replacing gBackendFunctionsTable.GL.* one at a time. An
+// unimplemented (null) entry is the caller's business to check, exactly as it is
+// with the table this replaces.
+
+inline void MGP_GetCaps(const MGPCaps* payload, MGPReplySlot* reply) {
+    gMGPipeScreen.GetCaps(payload, reply);
+}
+
+inline void MGP_ResourceCreate(const MGPResourceDesc* payload) {
+    gMGPipeScreen.ResourceCreate(payload);
+}
+
+inline void MGP_ResourceRespecify(const MGPResourceDesc* payload) {
+    gMGPipeScreen.ResourceRespecify(payload);
+}
+
+inline void MGP_ResourceDestroy(const MGPHandleOnly* payload) {
+    gMGPipeScreen.ResourceDestroy(payload);
+}
+
+inline void MGP_MapPersistent(const MGPHandleOnly* payload, MGPReplySlot* reply) {
+    gMGPipeScreen.MapPersistent(payload, reply);
+}
+
+inline void MGP_UnmapPersistent(const MGPHandleOnly* payload) {
+    gMGPipeScreen.UnmapPersistent(payload);
+}
+
+inline void MGP_FenceCreate(const MGPHandleOnly* payload) {
+    gMGPipeScreen.FenceCreate(payload);
+}
+
+inline void MGP_FenceStatus(const MGPHandleOnly* payload, MGPReplySlot* reply) {
+    gMGPipeScreen.FenceStatus(payload, reply);
+}
+
+inline void MGP_FenceWait(const MGPFenceWait* payload, MGPReplySlot* reply) {
+    gMGPipeScreen.FenceWait(payload, reply);
+}
+
+inline void MGP_FenceDestroy(const MGPHandleOnly* payload) {
+    gMGPipeScreen.FenceDestroy(payload);
+}
+
+inline void MGP_QueryCreate(const MGPQueryDesc* payload) {
+    gMGPipeContext.QueryCreate(payload);
+}
+
+inline void MGP_QueryBegin(const MGPQueryDesc* payload) {
+    gMGPipeContext.QueryBegin(payload);
+}
+
+inline void MGP_QueryEnd(const MGPQueryDesc* payload) {
+    gMGPipeContext.QueryEnd(payload);
+}
+
+inline void MGP_QueryAvailable(const MGPHandleOnly* payload, MGPReplySlot* reply) {
+    gMGPipeContext.QueryAvailable(payload, reply);
+}
+
+inline void MGP_QueryResult(const MGPQueryResultRequest* payload, MGPReplySlot* reply) {
+    gMGPipeContext.QueryResult(payload, reply);
+}
+
+inline void MGP_QueryDestroy(const MGPHandleOnly* payload) {
+    gMGPipeContext.QueryDestroy(payload);
+}
+
+inline void MGP_CreateRenderState(const MGPRenderStateDesc* payload) {
+    gMGPipeContext.CreateRenderState(payload);
+}
+
+inline void MGP_BindRenderState(const MGPBindRenderState* payload) {
+    gMGPipeContext.BindRenderState(payload);
+}
+
+inline void MGP_DeleteRenderState(const MGPHandleOnly* payload) {
+    gMGPipeContext.DeleteRenderState(payload);
+}
+
+inline void MGP_CreateVertexElements(const MGPVertexElements* payload) {
+    gMGPipeContext.CreateVertexElements(payload);
+}
+
+inline void MGP_BindVertexElements(const MGPHandleOnly* payload) {
+    gMGPipeContext.BindVertexElements(payload);
+}
+
+inline void MGP_DeleteVertexElements(const MGPHandleOnly* payload) {
+    gMGPipeContext.DeleteVertexElements(payload);
+}
+
+inline void MGP_CreateSamplerState(const MGPSamplerDesc* payload) {
+    gMGPipeContext.CreateSamplerState(payload);
+}
+
+inline void MGP_DeleteSamplerState(const MGPHandleOnly* payload) {
+    gMGPipeContext.DeleteSamplerState(payload);
+}
+
+inline void MGP_CreateSamplerView(const MGPSamplerView* payload) {
+    gMGPipeContext.CreateSamplerView(payload);
+}
+
+inline void MGP_DeleteSamplerView(const MGPHandleOnly* payload) {
+    gMGPipeContext.DeleteSamplerView(payload);
+}
+
+inline void MGP_CreateShaderState(const MGPProgramDesc* payload) {
+    gMGPipeContext.CreateShaderState(payload);
+}
+
+inline void MGP_BindShaderState(const MGPHandleOnly* payload) {
+    gMGPipeContext.BindShaderState(payload);
+}
+
+inline void MGP_DeleteShaderState(const MGPHandleOnly* payload) {
+    gMGPipeContext.DeleteShaderState(payload);
+}
+
+inline void MGP_SetDynamicState(const MGPDynamicState* payload) {
+    gMGPipeContext.SetDynamicState(payload);
+}
+
+inline void MGP_SetFramebufferState(const MGPFramebufferState* payload) {
+    gMGPipeContext.SetFramebufferState(payload);
+}
+
+inline void MGP_SetVertexBuffers(const MGPVertexBuffers* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.SetVertexBuffers(payload, varTail, varTailCount);
+}
+
+inline void MGP_SetIndexBuffer(const MGPIndexBuffer* payload) {
+    gMGPipeContext.SetIndexBuffer(payload);
+}
+
+inline void MGP_SetIndirectBuffers(const MGPIndirectBuffers* payload) {
+    gMGPipeContext.SetIndirectBuffers(payload);
+}
+
+inline void MGP_SetSamplerViews(const MGPSamplerViews* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.SetSamplerViews(payload, varTail, varTailCount);
+}
+
+inline void MGP_BindSamplerStates(const MGPSamplerStates* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.BindSamplerStates(payload, varTail, varTailCount);
+}
+
+inline void MGP_SetShaderImages(const MGPShaderImages* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.SetShaderImages(payload, varTail, varTailCount);
+}
+
+inline void MGP_SetShaderBuffers(const MGPShaderBuffers* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.SetShaderBuffers(payload, varTail, varTailCount);
+}
+
+inline void MGP_SetStreamOutputTargets(const MGPStreamOutputTargets* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.SetStreamOutputTargets(payload, varTail, varTailCount);
+}
+
+inline void MGP_SetGlobalConstants(const MGPGlobalConstants* payload) {
+    gMGPipeContext.SetGlobalConstants(payload);
+}
+
+inline void MGP_SetVertexAttribDefaults(const MGPVertexAttribDefaults* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.SetVertexAttribDefaults(payload, varTail, varTailCount);
+}
+
+inline void MGP_SetPixelPackState(const MGPPixelPackState* payload) {
+    gMGPipeContext.SetPixelPackState(payload);
+}
+
+inline void MGP_SetPatchState(const MGPPatchState* payload) {
+    gMGPipeContext.SetPatchState(payload);
+}
+
+inline void MGP_SetDrawProgram(const MGPHandleOnly* payload) {
+    gMGPipeContext.SetDrawProgram(payload);
+}
+
+inline void MGP_SetDispatchProgram(const MGPHandleOnly* payload) {
+    gMGPipeContext.SetDispatchProgram(payload);
+}
+
+inline void MGP_SetResidualValueState(const MGPResidualValueState* payload) {
+    gMGPipeContext.SetResidualValueState(payload);
+}
+
+inline void MGP_SetTextureParams(const MGPTextureParams* payload) {
+    gMGPipeContext.SetTextureParams(payload);
+}
+
+inline void MGP_ResourceSubData(const MGPSubData* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.ResourceSubData(payload, varTail, varTailCount);
+}
+
+inline void MGP_BufferSubDataResident(const MGPSubData* payload) {
+    gMGPipeContext.BufferSubDataResident(payload);
+}
+
+inline void MGP_ResourceSubDataComplete(const MGPSubDataComplete* payload) {
+    gMGPipeContext.ResourceSubDataComplete(payload);
+}
+
+inline void MGP_ResourceFlushRange(const MGPFlushRange* payload) {
+    gMGPipeContext.ResourceFlushRange(payload);
+}
+
+inline void MGP_ResourceReadback(const MGPReadback* payload, MGPReplySlot* reply) {
+    gMGPipeContext.ResourceReadback(payload, reply);
+}
+
+inline void MGP_ResourceCopyRegion(const MGPCopyRegion* payload) {
+    gMGPipeContext.ResourceCopyRegion(payload);
+}
+
+inline void MGP_GenerateMipmap(const MGPMipPlan* payload) {
+    gMGPipeContext.GenerateMipmap(payload);
+}
+
+inline void MGP_GetTextureImage(const MGPReadbackInfo* payload, MGPReplySlot* reply) {
+    gMGPipeContext.GetTextureImage(payload, reply);
+}
+
+inline void MGP_Blit(const MGPBlit* payload) {
+    gMGPipeContext.Blit(payload);
+}
+
+inline void MGP_Clear(const MGPClear* payload) {
+    gMGPipeContext.Clear(payload);
+}
+
+inline void MGP_ReadPixels(const MGPReadbackInfo* payload, MGPReplySlot* reply) {
+    gMGPipeContext.ReadPixels(payload, reply);
+}
+
+inline void MGP_DrawVbo(const MGPDrawInfo* payload, const void* varTail, Uint32 varTailCount) {
+    gMGPipeContext.DrawVbo(payload, varTail, varTailCount);
+}
+
+inline void MGP_LaunchGrid(const MGPGridInfo* payload) {
+    gMGPipeContext.LaunchGrid(payload);
+}
+
+inline void MGP_MemoryBarrier(const MGPMemoryBarrier* payload) {
+    gMGPipeContext.MemoryBarrier(payload);
+}
+
+inline void MGP_BeginStreamOutput(const MGPStreamOutputBegin* payload) {
+    gMGPipeContext.BeginStreamOutput(payload);
+}
+
+inline void MGP_EndStreamOutput(const MGPXfbAccounting* payload) {
+    gMGPipeContext.EndStreamOutput(payload);
+}
+
+inline void MGP_PauseStreamOutput(const MGPStreamOutputControl* payload) {
+    gMGPipeContext.PauseStreamOutput(payload);
+}
+
+inline void MGP_ResumeStreamOutput(const MGPStreamOutputControl* payload) {
+    gMGPipeContext.ResumeStreamOutput(payload);
+}
+
+inline void MGP_Flush(const MGPFlush* payload) {
+    gMGPipeContext.Flush(payload);
+}
+
+inline void MGP_Present(const MGPPresent* payload) {
+    gMGPipeContext.Present(payload);
+}
+
+inline void MGP_SetSwapInterval(const MGPSwapInterval* payload) {
+    gMGPipeContext.SetSwapInterval(payload);
+}
+
+inline void MGP_QueryTimestamp(const MGPTimestampRequest* payload, MGPReplySlot* reply) {
+    gMGPipeContext.QueryTimestamp(payload, reply);
+}
+
+inline void MGP_QueryCounter(const MGPQueryDesc* payload) {
+    gMGPipeContext.QueryCounter(payload);
+}
+
+inline void MGP_FenceWaitServer(const MGPFenceWait* payload) {
+    gMGPipeScreen.FenceWaitServer(payload);
+}

MobileGL/MG_Pipe/generated/PipeVerify.inc

@@ -0,0 +1,648 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeVerify.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G4: the MOBILEGL_PIPE_VERIFY field-wise comparators.
+//
+// GENERATED by scripts/gen_pipe.py from PipeFields.def - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// Field by field, never memcmp over a whole payload: RenderStateParameters is documented
+// in DirectGLES.cpp to false-DIFFER on padding under memcmp (harmlessly there, fatally
+// here - a comparator with false positives is a comparator nobody reads). Each function
+// reports the FIRST differing field by name, which with the draw serial is what the verify
+// harness prints.
+//
+// Floating-point fields are compared by BITS, so a NaN patch level - which
+// glPatchParameterfv accepts and ComputePipelineStateHash already hashes bitwise - equals
+// itself instead of tripping every draw.
+
+#include "../PipeFields.def"
+
+template <class T>
+struct MGPipeHasFieldVerifier : std::false_type {};
+
+// A vector type (FloatVec4, IntVec4, BoolVec4...) is detected through its VecBase and
+// compared BITWISE over its data: VecBase::operator== is IEEE ==, under which a NaN patch
+// level would differ from itself. The probe rather than an overload because a
+// derived-to-base conversion loses overload resolution to the exact-match generic template.
+template <class Derived, class T, SizeT N>
+std::true_type MGPipeVecBaseProbe(const VecBase<Derived, T, N>*);
+std::false_type MGPipeVecBaseProbe(const void*);
+template <class T>
+inline constexpr Bool kMGPipeIsVecBase = decltype(MGPipeVecBaseProbe(static_cast<const T*>(nullptr)))::value;
+
+template <class T>
+inline Bool MGPipeFieldEqual(const T& a, const T& b);
+template <class T, SizeT N>
+inline Bool MGPipeFieldEqual(const Array<T, N>& a, const Array<T, N>& b);
+template <class T, SizeT N>
+inline Bool MGPipeFieldEqual(const T (&a)[N], const T (&b)[N]);
+
+inline Bool MGPipeVerify(const MGPBlobRef& a, const MGPBlobRef& b, const char** outField);
+inline Bool MGPipeVerify(const MGPRange& a, const MGPRange& b, const char** outField);
+inline Bool MGPipeVerify(const MGPBox& a, const MGPBox& b, const char** outField);
+inline Bool MGPipeVerify(const MGPReplySlot& a, const MGPReplySlot& b, const char** outField);
+inline Bool MGPipeVerify(const MGPStateChunk& a, const MGPStateChunk& b, const char** outField);
+inline Bool MGPipeVerify(const MGPHandleOnly& a, const MGPHandleOnly& b, const char** outField);
+inline Bool MGPipeVerify(const MGPCaps& a, const MGPCaps& b, const char** outField);
+inline Bool MGPipeVerify(const MGPResourceDesc& a, const MGPResourceDesc& b, const char** outField);
+inline Bool MGPipeVerify(const MGPFenceWait& a, const MGPFenceWait& b, const char** outField);
+inline Bool MGPipeVerify(const MGPQueryDesc& a, const MGPQueryDesc& b, const char** outField);
+inline Bool MGPipeVerify(const MGPQueryResultRequest& a, const MGPQueryResultRequest& b, const char** outField);
+inline Bool MGPipeVerify(const MGPTimestampRequest& a, const MGPTimestampRequest& b, const char** outField);
+inline Bool MGPipeVerify(const MGPRenderStateDesc& a, const MGPRenderStateDesc& b, const char** outField);
+inline Bool MGPipeVerify(const MGPBindRenderState& a, const MGPBindRenderState& b, const char** outField);
+inline Bool MGPipeVerify(const MGPDynamicState& a, const MGPDynamicState& b, const char** outField);
+inline Bool MGPipeVerify(const MGPVertexElements& a, const MGPVertexElements& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSamplerDesc& a, const MGPSamplerDesc& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSamplerView& a, const MGPSamplerView& b, const char** outField);
+inline Bool MGPipeVerify(const MGPTextureParams& a, const MGPTextureParams& b, const char** outField);
+inline Bool MGPipeVerify(const MGPProgramDesc& a, const MGPProgramDesc& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSurface& a, const MGPSurface& b, const char** outField);
+inline Bool MGPipeVerify(const MGPFramebufferState& a, const MGPFramebufferState& b, const char** outField);
+inline Bool MGPipeVerify(const MGPVertexBuffer& a, const MGPVertexBuffer& b, const char** outField);
+inline Bool MGPipeVerify(const MGPVertexBuffers& a, const MGPVertexBuffers& b, const char** outField);
+inline Bool MGPipeVerify(const MGPIndexBuffer& a, const MGPIndexBuffer& b, const char** outField);
+inline Bool MGPipeVerify(const MGPIndirectBuffers& a, const MGPIndirectBuffers& b, const char** outField);
+inline Bool MGPipeVerify(const MGPBoundView& a, const MGPBoundView& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSamplerViews& a, const MGPSamplerViews& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSamplerStates& a, const MGPSamplerStates& b, const char** outField);
+inline Bool MGPipeVerify(const MGPImageView& a, const MGPImageView& b, const char** outField);
+inline Bool MGPipeVerify(const MGPShaderImages& a, const MGPShaderImages& b, const char** outField);
+inline Bool MGPipeVerify(const MGPBufferRange& a, const MGPBufferRange& b, const char** outField);
+inline Bool MGPipeVerify(const MGPShaderBuffers& a, const MGPShaderBuffers& b, const char** outField);
+inline Bool MGPipeVerify(const MGPStreamOutputTargets& a, const MGPStreamOutputTargets& b, const char** outField);
+inline Bool MGPipeVerify(const MGPGlobalConstants& a, const MGPGlobalConstants& b, const char** outField);
+inline Bool MGPipeVerify(const MGPAttribValue& a, const MGPAttribValue& b, const char** outField);
+inline Bool MGPipeVerify(const MGPVertexAttribDefaults& a, const MGPVertexAttribDefaults& b, const char** outField);
+inline Bool MGPipeVerify(const MGPPixelPackState& a, const MGPPixelPackState& b, const char** outField);
+inline Bool MGPipeVerify(const MGPPatchState& a, const MGPPatchState& b, const char** outField);
+inline Bool MGPipeVerify(const ResidualValueBlock& a, const ResidualValueBlock& b, const char** outField);
+inline Bool MGPipeVerify(const MGPResidualValueState& a, const MGPResidualValueState& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSubRegion& a, const MGPSubRegion& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSubData& a, const MGPSubData& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSubDataComplete& a, const MGPSubDataComplete& b, const char** outField);
+inline Bool MGPipeVerify(const MGPFlushRange& a, const MGPFlushRange& b, const char** outField);
+inline Bool MGPipeVerify(const MGPReadback& a, const MGPReadback& b, const char** outField);
+inline Bool MGPipeVerify(const MGPCopyRegion& a, const MGPCopyRegion& b, const char** outField);
+inline Bool MGPipeVerify(const MGPBlit& a, const MGPBlit& b, const char** outField);
+inline Bool MGPipeVerify(const MGPClear& a, const MGPClear& b, const char** outField);
+inline Bool MGPipeVerify(const MGPMipPlan& a, const MGPMipPlan& b, const char** outField);
+inline Bool MGPipeVerify(const MGPReadbackInfo& a, const MGPReadbackInfo& b, const char** outField);
+inline Bool MGPipeVerify(const MGPDrawInfo& a, const MGPDrawInfo& b, const char** outField);
+inline Bool MGPipeVerify(const MGPDrawRange& a, const MGPDrawRange& b, const char** outField);
+inline Bool MGPipeVerify(const MGPDrawIndirect& a, const MGPDrawIndirect& b, const char** outField);
+inline Bool MGPipeVerify(const MGPGridInfo& a, const MGPGridInfo& b, const char** outField);
+inline Bool MGPipeVerify(const MGPMemoryBarrier& a, const MGPMemoryBarrier& b, const char** outField);
+inline Bool MGPipeVerify(const MGPStreamOutputBegin& a, const MGPStreamOutputBegin& b, const char** outField);
+inline Bool MGPipeVerify(const MGPXfbAccounting& a, const MGPXfbAccounting& b, const char** outField);
+inline Bool MGPipeVerify(const MGPStreamOutputControl& a, const MGPStreamOutputControl& b, const char** outField);
+inline Bool MGPipeVerify(const MGPFlush& a, const MGPFlush& b, const char** outField);
+inline Bool MGPipeVerify(const MGPPresent& a, const MGPPresent& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSwapInterval& a, const MGPSwapInterval& b, const char** outField);
+inline Bool MGPipeVerify(const MGPSurfaceInfo& a, const MGPSurfaceInfo& b, const char** outField);
+inline Bool MGPipeVerify(const RenderStateParameters& a, const RenderStateParameters& b, const char** outField);
+inline Bool MGPipeVerify(const PixelStoreParameters& a, const PixelStoreParameters& b, const char** outField);
+inline Bool MGPipeVerify(const PerBufferBlendState& a, const PerBufferBlendState& b, const char** outField);
+inline Bool MGPipeVerify(const StencilFaceState& a, const StencilFaceState& b, const char** outField);
+inline Bool MGPipeVerify(const DynamicBackendParameters& a, const DynamicBackendParameters& b, const char** outField);
+inline Bool MGPipeVerify(const MGHostSpan& a, const MGHostSpan& b, const char** outField);
+
+template <>
+struct MGPipeHasFieldVerifier<MGPBlobRef> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPRange> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPBox> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPReplySlot> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPStateChunk> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPHandleOnly> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPCaps> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPResourceDesc> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPFenceWait> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPQueryDesc> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPQueryResultRequest> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPTimestampRequest> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPRenderStateDesc> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPBindRenderState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPDynamicState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPVertexElements> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSamplerDesc> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSamplerView> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPTextureParams> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPProgramDesc> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSurface> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPFramebufferState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPVertexBuffer> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPVertexBuffers> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPIndexBuffer> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPIndirectBuffers> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPBoundView> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSamplerViews> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSamplerStates> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPImageView> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPShaderImages> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPBufferRange> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPShaderBuffers> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPStreamOutputTargets> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPGlobalConstants> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPAttribValue> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPVertexAttribDefaults> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPPixelPackState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPPatchState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<ResidualValueBlock> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPResidualValueState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSubRegion> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSubData> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSubDataComplete> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPFlushRange> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPReadback> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPCopyRegion> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPBlit> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPClear> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPMipPlan> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPReadbackInfo> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPDrawInfo> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPDrawRange> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPDrawIndirect> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPGridInfo> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPMemoryBarrier> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPStreamOutputBegin> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPXfbAccounting> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPStreamOutputControl> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPFlush> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPPresent> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSwapInterval> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGPSurfaceInfo> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<RenderStateParameters> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<PixelStoreParameters> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<PerBufferBlendState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<StencilFaceState> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<DynamicBackendParameters> : std::true_type {};
+template <>
+struct MGPipeHasFieldVerifier<MGHostSpan> : std::true_type {};
+
+template <class T>
+inline Bool MGPipeFieldEqual(const T& a, const T& b) {
+    if constexpr (MGPipeHasFieldVerifier<T>::value) {
+        const char* unusedField = nullptr;
+        return MGPipeVerify(a, b, &unusedField);
+    } else if constexpr (kMGPipeIsVecBase<T>) {
+        return std::memcmp(a.data.data(), b.data.data(), sizeof(a.data)) == 0;
+    } else if constexpr (std::is_floating_point_v<T>) {
+        return std::memcmp(&a, &b, sizeof(T)) == 0;
+    } else if constexpr (std::is_scalar_v<T> || std::is_enum_v<T>) {
+        return a == b;
+    } else if constexpr (requires(const T& x, const T& y) { x == y; }) {
+        return a == b;
+    } else {
+        // NO MEMCMP FALLBACK. Every value struct has a field list in PipeFields.def since P1
+        // (and gen_pipe.py asserts each list covers its struct's members); a type reaching
+        // this branch is one nobody gave a field list, and a memcmp would false-differ on
+        // its padding. A compile error is the honest answer.
+        static_assert(sizeof(T) == 0, "no field list in PipeFields.def for this type");
+        return false;
+    }
+}
+
+template <class T, SizeT N>
+inline Bool MGPipeFieldEqual(const Array<T, N>& a, const Array<T, N>& b) {
+    for (SizeT i = 0; i < N; ++i) {
+        if (!MGPipeFieldEqual(a[i], b[i])) return false;
+    }
+    return true;
+}
+
+template <class T, SizeT N>
+inline Bool MGPipeFieldEqual(const T (&a)[N], const T (&b)[N]) {
+    for (SizeT i = 0; i < N; ++i) {
+        if (!MGPipeFieldEqual(a[i], b[i])) return false;
+    }
+    return true;
+}
+
+#define MGP_VERIFY_FIELD(FieldName)                                                                                    \
+    if (!MGPipeFieldEqual(a.FieldName, b.FieldName)) {                                                                 \
+        if (outField != nullptr) *outField = #FieldName;                                                               \
+        return false;                                                                                                  \
+    }
+
+inline Bool MGPipeVerify(const MGPBlobRef& a, const MGPBlobRef& b, const char** outField) {
+    MGP_FIELDS_MGPBlobRef(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPRange& a, const MGPRange& b, const char** outField) {
+    MGP_FIELDS_MGPRange(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPBox& a, const MGPBox& b, const char** outField) {
+    MGP_FIELDS_MGPBox(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPReplySlot& a, const MGPReplySlot& b, const char** outField) {
+    MGP_FIELDS_MGPReplySlot(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPStateChunk& a, const MGPStateChunk& b, const char** outField) {
+    MGP_FIELDS_MGPStateChunk(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPHandleOnly& a, const MGPHandleOnly& b, const char** outField) {
+    MGP_FIELDS_MGPHandleOnly(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPCaps& a, const MGPCaps& b, const char** outField) {
+    MGP_FIELDS_MGPCaps(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPResourceDesc& a, const MGPResourceDesc& b, const char** outField) {
+    MGP_FIELDS_MGPResourceDesc(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPFenceWait& a, const MGPFenceWait& b, const char** outField) {
+    MGP_FIELDS_MGPFenceWait(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPQueryDesc& a, const MGPQueryDesc& b, const char** outField) {
+    MGP_FIELDS_MGPQueryDesc(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPQueryResultRequest& a, const MGPQueryResultRequest& b, const char** outField) {
+    MGP_FIELDS_MGPQueryResultRequest(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPTimestampRequest& a, const MGPTimestampRequest& b, const char** outField) {
+    MGP_FIELDS_MGPTimestampRequest(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPRenderStateDesc& a, const MGPRenderStateDesc& b, const char** outField) {
+    MGP_FIELDS_MGPRenderStateDesc(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPBindRenderState& a, const MGPBindRenderState& b, const char** outField) {
+    MGP_FIELDS_MGPBindRenderState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPDynamicState& a, const MGPDynamicState& b, const char** outField) {
+    MGP_FIELDS_MGPDynamicState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPVertexElements& a, const MGPVertexElements& b, const char** outField) {
+    MGP_FIELDS_MGPVertexElements(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSamplerDesc& a, const MGPSamplerDesc& b, const char** outField) {
+    MGP_FIELDS_MGPSamplerDesc(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSamplerView& a, const MGPSamplerView& b, const char** outField) {
+    MGP_FIELDS_MGPSamplerView(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPTextureParams& a, const MGPTextureParams& b, const char** outField) {
+    MGP_FIELDS_MGPTextureParams(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPProgramDesc& a, const MGPProgramDesc& b, const char** outField) {
+    MGP_FIELDS_MGPProgramDesc(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSurface& a, const MGPSurface& b, const char** outField) {
+    MGP_FIELDS_MGPSurface(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPFramebufferState& a, const MGPFramebufferState& b, const char** outField) {
+    MGP_FIELDS_MGPFramebufferState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPVertexBuffer& a, const MGPVertexBuffer& b, const char** outField) {
+    MGP_FIELDS_MGPVertexBuffer(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPVertexBuffers& a, const MGPVertexBuffers& b, const char** outField) {
+    MGP_FIELDS_MGPVertexBuffers(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPIndexBuffer& a, const MGPIndexBuffer& b, const char** outField) {
+    MGP_FIELDS_MGPIndexBuffer(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPIndirectBuffers& a, const MGPIndirectBuffers& b, const char** outField) {
+    MGP_FIELDS_MGPIndirectBuffers(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPBoundView& a, const MGPBoundView& b, const char** outField) {
+    MGP_FIELDS_MGPBoundView(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSamplerViews& a, const MGPSamplerViews& b, const char** outField) {
+    MGP_FIELDS_MGPSamplerViews(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSamplerStates& a, const MGPSamplerStates& b, const char** outField) {
+    MGP_FIELDS_MGPSamplerStates(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPImageView& a, const MGPImageView& b, const char** outField) {
+    MGP_FIELDS_MGPImageView(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPShaderImages& a, const MGPShaderImages& b, const char** outField) {
+    MGP_FIELDS_MGPShaderImages(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPBufferRange& a, const MGPBufferRange& b, const char** outField) {
+    MGP_FIELDS_MGPBufferRange(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPShaderBuffers& a, const MGPShaderBuffers& b, const char** outField) {
+    MGP_FIELDS_MGPShaderBuffers(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPStreamOutputTargets& a, const MGPStreamOutputTargets& b, const char** outField) {
+    MGP_FIELDS_MGPStreamOutputTargets(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPGlobalConstants& a, const MGPGlobalConstants& b, const char** outField) {
+    MGP_FIELDS_MGPGlobalConstants(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPAttribValue& a, const MGPAttribValue& b, const char** outField) {
+    MGP_FIELDS_MGPAttribValue(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPVertexAttribDefaults& a, const MGPVertexAttribDefaults& b, const char** outField) {
+    MGP_FIELDS_MGPVertexAttribDefaults(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPPixelPackState& a, const MGPPixelPackState& b, const char** outField) {
+    MGP_FIELDS_MGPPixelPackState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPPatchState& a, const MGPPatchState& b, const char** outField) {
+    MGP_FIELDS_MGPPatchState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const ResidualValueBlock& a, const ResidualValueBlock& b, const char** outField) {
+    MGP_FIELDS_ResidualValueBlock(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPResidualValueState& a, const MGPResidualValueState& b, const char** outField) {
+    MGP_FIELDS_MGPResidualValueState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSubRegion& a, const MGPSubRegion& b, const char** outField) {
+    MGP_FIELDS_MGPSubRegion(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSubData& a, const MGPSubData& b, const char** outField) {
+    MGP_FIELDS_MGPSubData(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSubDataComplete& a, const MGPSubDataComplete& b, const char** outField) {
+    MGP_FIELDS_MGPSubDataComplete(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPFlushRange& a, const MGPFlushRange& b, const char** outField) {
+    MGP_FIELDS_MGPFlushRange(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPReadback& a, const MGPReadback& b, const char** outField) {
+    MGP_FIELDS_MGPReadback(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPCopyRegion& a, const MGPCopyRegion& b, const char** outField) {
+    MGP_FIELDS_MGPCopyRegion(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPBlit& a, const MGPBlit& b, const char** outField) {
+    MGP_FIELDS_MGPBlit(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPClear& a, const MGPClear& b, const char** outField) {
+    MGP_FIELDS_MGPClear(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPMipPlan& a, const MGPMipPlan& b, const char** outField) {
+    MGP_FIELDS_MGPMipPlan(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPReadbackInfo& a, const MGPReadbackInfo& b, const char** outField) {
+    MGP_FIELDS_MGPReadbackInfo(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPDrawInfo& a, const MGPDrawInfo& b, const char** outField) {
+    MGP_FIELDS_MGPDrawInfo(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPDrawRange& a, const MGPDrawRange& b, const char** outField) {
+    MGP_FIELDS_MGPDrawRange(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPDrawIndirect& a, const MGPDrawIndirect& b, const char** outField) {
+    MGP_FIELDS_MGPDrawIndirect(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPGridInfo& a, const MGPGridInfo& b, const char** outField) {
+    MGP_FIELDS_MGPGridInfo(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPMemoryBarrier& a, const MGPMemoryBarrier& b, const char** outField) {
+    MGP_FIELDS_MGPMemoryBarrier(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPStreamOutputBegin& a, const MGPStreamOutputBegin& b, const char** outField) {
+    MGP_FIELDS_MGPStreamOutputBegin(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPXfbAccounting& a, const MGPXfbAccounting& b, const char** outField) {
+    MGP_FIELDS_MGPXfbAccounting(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPStreamOutputControl& a, const MGPStreamOutputControl& b, const char** outField) {
+    MGP_FIELDS_MGPStreamOutputControl(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPFlush& a, const MGPFlush& b, const char** outField) {
+    MGP_FIELDS_MGPFlush(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPPresent& a, const MGPPresent& b, const char** outField) {
+    MGP_FIELDS_MGPPresent(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSwapInterval& a, const MGPSwapInterval& b, const char** outField) {
+    MGP_FIELDS_MGPSwapInterval(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGPSurfaceInfo& a, const MGPSurfaceInfo& b, const char** outField) {
+    MGP_FIELDS_MGPSurfaceInfo(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const RenderStateParameters& a, const RenderStateParameters& b, const char** outField) {
+    MGP_FIELDS_RenderStateParameters(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const PixelStoreParameters& a, const PixelStoreParameters& b, const char** outField) {
+    MGP_FIELDS_PixelStoreParameters(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const PerBufferBlendState& a, const PerBufferBlendState& b, const char** outField) {
+    MGP_FIELDS_PerBufferBlendState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const StencilFaceState& a, const StencilFaceState& b, const char** outField) {
+    MGP_FIELDS_StencilFaceState(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const DynamicBackendParameters& a, const DynamicBackendParameters& b, const char** outField) {
+    MGP_FIELDS_DynamicBackendParameters(MGP_VERIFY_FIELD)
+    return true;
+}
+
+inline Bool MGPipeVerify(const MGHostSpan& a, const MGHostSpan& b, const char** outField) {
+    MGP_FIELDS_MGHostSpan(MGP_VERIFY_FIELD)
+    return true;
+}
+
+#undef MGP_VERIFY_FIELD
+
+inline constexpr SizeT kMGPipeVerifiedPayloadCount = 69;

MobileGL/MG_Pipe/generated/PipeWire.inc

@@ -0,0 +1,931 @@
+// MobileGL - MobileGL/MG_Pipe/generated/PipeWire.inc
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// G3: wire records, size assertions and the applier's bounds gate.
+//
+// GENERATED by scripts/gen_pipe.py from PipeCalls.def - DO NOT EDIT.
+// Regenerate with `python3 scripts/gen_pipe.py`; CI runs it and diffs the result.
+// This file is included from MG_Pipe/MGPipe.h inside namespace MobileGL::MG_Pipe.
+
+// Every record is a fixed header plus its payload, padded to the stream's 8-byte
+// granularity. The size assertion is stated as a COMPOSITION so it fires on any padding
+// the compiler inserts between the header and the payload while staying honest about the
+// tail padding the alignment requires.
+//
+// The applier's precondition is checked BEFORE dispatch, on every record, in every build:
+// a record that is shorter than its own type, longer than what is left in the buffer, or
+// not a multiple of 8 is protocol corruption and is fatal. There is no recovery path -
+// silently applying a truncated record is how a corrupt stream becomes a wrong picture.
+//
+// OVERSIZED PAYLOADS ARE CHUNKED, NEVER EMITTED WHOLE (plan section 8.2: G3 has to define
+// the path for a record larger than the segment). The bound is the ring's,
+// RingProducer::MaxRecordBytes() == Capacity()/2, and it is exact rather than
+// conservative: a record has to be placeable at every head offset of an empty ring, the
+// wrap pad in front of it costs up to total-8 bytes, and only a record of at most half the
+// ring survives that at every offset. An emitter holding more than Capacity()/2 bytes of
+// record (a large resource_subdata, a create_shader_state archive) splits it into several
+// records of at most that size; the transport refuses a bigger one outright - nullptr plus
+// an MGLOG_E - rather than let the producer wait on free bytes that can never suffice.
+
+struct MGPWireRecHeader {
+    Uint16 Op;    // MGPWireOp
+    Uint16 Flags; // MGPipeCallFlags of the call, for asserts and tracing
+    Uint32 Size;  // bytes of this record including the header and the variable tail
+};
+static_assert(sizeof(MGPWireRecHeader) == 8, "the wire header is 8 bytes");
+static_assert(std::is_trivially_copyable_v<MGPWireRecHeader>);
+
+// The opcode is the call's position in PipeCalls.def. Reordering that file is a protocol
+// break; appending to it is not.
+enum class MGPWireOp : Uint16 {
+    kInvalid = 0,
+    GetCaps = 1,
+    ResourceCreate = 2,
+    ResourceRespecify = 3,
+    ResourceDestroy = 4,
+    MapPersistent = 5,
+    UnmapPersistent = 6,
+    FenceCreate = 7,
+    FenceStatus = 8,
+    FenceWait = 9,
+    FenceDestroy = 10,
+    QueryCreate = 11,
+    QueryBegin = 12,
+    QueryEnd = 13,
+    QueryAvailable = 14,
+    QueryResult = 15,
+    QueryDestroy = 16,
+    CreateRenderState = 17,
+    BindRenderState = 18,
+    DeleteRenderState = 19,
+    CreateVertexElements = 20,
+    BindVertexElements = 21,
+    DeleteVertexElements = 22,
+    CreateSamplerState = 23,
+    DeleteSamplerState = 24,
+    CreateSamplerView = 25,
+    DeleteSamplerView = 26,
+    CreateShaderState = 27,
+    BindShaderState = 28,
+    DeleteShaderState = 29,
+    SetDynamicState = 30,
+    SetFramebufferState = 31,
+    SetVertexBuffers = 32,
+    SetIndexBuffer = 33,
+    SetIndirectBuffers = 34,
+    SetSamplerViews = 35,
+    BindSamplerStates = 36,
+    SetShaderImages = 37,
+    SetShaderBuffers = 38,
+    SetStreamOutputTargets = 39,
+    SetGlobalConstants = 40,
+    SetVertexAttribDefaults = 41,
+    SetPixelPackState = 42,
+    SetPatchState = 43,
+    SetDrawProgram = 44,
+    SetDispatchProgram = 45,
+    SetResidualValueState = 46,
+    SetTextureParams = 47,
+    ResourceSubData = 48,
+    BufferSubDataResident = 49,
+    ResourceSubDataComplete = 50,
+    ResourceFlushRange = 51,
+    ResourceReadback = 52,
+    ResourceCopyRegion = 53,
+    GenerateMipmap = 54,
+    GetTextureImage = 55,
+    Blit = 56,
+    Clear = 57,
+    ReadPixels = 58,
+    DrawVbo = 59,
+    LaunchGrid = 60,
+    MemoryBarrier = 61,
+    BeginStreamOutput = 62,
+    EndStreamOutput = 63,
+    PauseStreamOutput = 64,
+    ResumeStreamOutput = 65,
+    Flush = 66,
+    Present = 67,
+    SetSwapInterval = 68,
+    QueryTimestamp = 69,
+    QueryCounter = 70,
+    FenceWaitServer = 71,
+    kOpCount = 72,
+};
+
+struct alignas(8) MGPWireRec_GetCaps {
+    MGPWireRecHeader Header;
+    MGPCaps Payload;
+};
+static_assert(sizeof(MGPWireRec_GetCaps) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPCaps) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_GetCaps gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceCreate {
+    MGPWireRecHeader Header;
+    MGPResourceDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceCreate) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPResourceDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceCreate gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceRespecify {
+    MGPWireRecHeader Header;
+    MGPResourceDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceRespecify) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPResourceDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceRespecify gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceDestroy {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceDestroy) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceDestroy gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_MapPersistent {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_MapPersistent) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_MapPersistent gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_UnmapPersistent {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_UnmapPersistent) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_UnmapPersistent gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_FenceCreate {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_FenceCreate) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_FenceCreate gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_FenceStatus {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_FenceStatus) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_FenceStatus gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_FenceWait {
+    MGPWireRecHeader Header;
+    MGPFenceWait Payload;
+};
+static_assert(sizeof(MGPWireRec_FenceWait) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPFenceWait) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_FenceWait gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_FenceDestroy {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_FenceDestroy) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_FenceDestroy gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryCreate {
+    MGPWireRecHeader Header;
+    MGPQueryDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryCreate) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPQueryDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryCreate gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryBegin {
+    MGPWireRecHeader Header;
+    MGPQueryDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryBegin) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPQueryDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryBegin gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryEnd {
+    MGPWireRecHeader Header;
+    MGPQueryDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryEnd) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPQueryDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryEnd gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryAvailable {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryAvailable) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryAvailable gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryResult {
+    MGPWireRecHeader Header;
+    MGPQueryResultRequest Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryResult) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPQueryResultRequest) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryResult gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryDestroy {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryDestroy) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryDestroy gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_CreateRenderState {
+    MGPWireRecHeader Header;
+    MGPRenderStateDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_CreateRenderState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPRenderStateDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_CreateRenderState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_BindRenderState {
+    MGPWireRecHeader Header;
+    MGPBindRenderState Payload;
+};
+static_assert(sizeof(MGPWireRec_BindRenderState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPBindRenderState) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_BindRenderState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_DeleteRenderState {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_DeleteRenderState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_DeleteRenderState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_CreateVertexElements {
+    MGPWireRecHeader Header;
+    MGPVertexElements Payload;
+};
+static_assert(sizeof(MGPWireRec_CreateVertexElements) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPVertexElements) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_CreateVertexElements gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_BindVertexElements {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_BindVertexElements) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_BindVertexElements gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_DeleteVertexElements {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_DeleteVertexElements) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_DeleteVertexElements gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_CreateSamplerState {
+    MGPWireRecHeader Header;
+    MGPSamplerDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_CreateSamplerState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSamplerDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_CreateSamplerState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_DeleteSamplerState {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_DeleteSamplerState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_DeleteSamplerState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_CreateSamplerView {
+    MGPWireRecHeader Header;
+    MGPSamplerView Payload;
+};
+static_assert(sizeof(MGPWireRec_CreateSamplerView) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSamplerView) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_CreateSamplerView gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_DeleteSamplerView {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_DeleteSamplerView) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_DeleteSamplerView gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_CreateShaderState {
+    MGPWireRecHeader Header;
+    MGPProgramDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_CreateShaderState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPProgramDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_CreateShaderState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_BindShaderState {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_BindShaderState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_BindShaderState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_DeleteShaderState {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_DeleteShaderState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_DeleteShaderState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetDynamicState {
+    MGPWireRecHeader Header;
+    MGPDynamicState Payload;
+};
+static_assert(sizeof(MGPWireRec_SetDynamicState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPDynamicState) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetDynamicState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetFramebufferState {
+    MGPWireRecHeader Header;
+    MGPFramebufferState Payload;
+};
+static_assert(sizeof(MGPWireRec_SetFramebufferState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPFramebufferState) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetFramebufferState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetVertexBuffers {
+    MGPWireRecHeader Header;
+    MGPVertexBuffers Payload;
+};
+static_assert(sizeof(MGPWireRec_SetVertexBuffers) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPVertexBuffers) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetVertexBuffers gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetIndexBuffer {
+    MGPWireRecHeader Header;
+    MGPIndexBuffer Payload;
+};
+static_assert(sizeof(MGPWireRec_SetIndexBuffer) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPIndexBuffer) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetIndexBuffer gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetIndirectBuffers {
+    MGPWireRecHeader Header;
+    MGPIndirectBuffers Payload;
+};
+static_assert(sizeof(MGPWireRec_SetIndirectBuffers) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPIndirectBuffers) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetIndirectBuffers gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetSamplerViews {
+    MGPWireRecHeader Header;
+    MGPSamplerViews Payload;
+};
+static_assert(sizeof(MGPWireRec_SetSamplerViews) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSamplerViews) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetSamplerViews gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_BindSamplerStates {
+    MGPWireRecHeader Header;
+    MGPSamplerStates Payload;
+};
+static_assert(sizeof(MGPWireRec_BindSamplerStates) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSamplerStates) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_BindSamplerStates gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetShaderImages {
+    MGPWireRecHeader Header;
+    MGPShaderImages Payload;
+};
+static_assert(sizeof(MGPWireRec_SetShaderImages) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPShaderImages) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetShaderImages gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetShaderBuffers {
+    MGPWireRecHeader Header;
+    MGPShaderBuffers Payload;
+};
+static_assert(sizeof(MGPWireRec_SetShaderBuffers) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPShaderBuffers) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetShaderBuffers gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetStreamOutputTargets {
+    MGPWireRecHeader Header;
+    MGPStreamOutputTargets Payload;
+};
+static_assert(sizeof(MGPWireRec_SetStreamOutputTargets) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPStreamOutputTargets) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetStreamOutputTargets gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetGlobalConstants {
+    MGPWireRecHeader Header;
+    MGPGlobalConstants Payload;
+};
+static_assert(sizeof(MGPWireRec_SetGlobalConstants) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPGlobalConstants) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetGlobalConstants gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetVertexAttribDefaults {
+    MGPWireRecHeader Header;
+    MGPVertexAttribDefaults Payload;
+};
+static_assert(sizeof(MGPWireRec_SetVertexAttribDefaults) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPVertexAttribDefaults) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetVertexAttribDefaults gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetPixelPackState {
+    MGPWireRecHeader Header;
+    MGPPixelPackState Payload;
+};
+static_assert(sizeof(MGPWireRec_SetPixelPackState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPPixelPackState) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetPixelPackState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetPatchState {
+    MGPWireRecHeader Header;
+    MGPPatchState Payload;
+};
+static_assert(sizeof(MGPWireRec_SetPatchState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPPatchState) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetPatchState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetDrawProgram {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_SetDrawProgram) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetDrawProgram gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetDispatchProgram {
+    MGPWireRecHeader Header;
+    MGPHandleOnly Payload;
+};
+static_assert(sizeof(MGPWireRec_SetDispatchProgram) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPHandleOnly) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetDispatchProgram gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetResidualValueState {
+    MGPWireRecHeader Header;
+    MGPResidualValueState Payload;
+};
+static_assert(sizeof(MGPWireRec_SetResidualValueState) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPResidualValueState) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetResidualValueState gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetTextureParams {
+    MGPWireRecHeader Header;
+    MGPTextureParams Payload;
+};
+static_assert(sizeof(MGPWireRec_SetTextureParams) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPTextureParams) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetTextureParams gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceSubData {
+    MGPWireRecHeader Header;
+    MGPSubData Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceSubData) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSubData) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceSubData gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_BufferSubDataResident {
+    MGPWireRecHeader Header;
+    MGPSubData Payload;
+};
+static_assert(sizeof(MGPWireRec_BufferSubDataResident) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSubData) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_BufferSubDataResident gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceSubDataComplete {
+    MGPWireRecHeader Header;
+    MGPSubDataComplete Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceSubDataComplete) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSubDataComplete) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceSubDataComplete gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceFlushRange {
+    MGPWireRecHeader Header;
+    MGPFlushRange Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceFlushRange) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPFlushRange) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceFlushRange gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceReadback {
+    MGPWireRecHeader Header;
+    MGPReadback Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceReadback) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPReadback) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceReadback gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResourceCopyRegion {
+    MGPWireRecHeader Header;
+    MGPCopyRegion Payload;
+};
+static_assert(sizeof(MGPWireRec_ResourceCopyRegion) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPCopyRegion) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResourceCopyRegion gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_GenerateMipmap {
+    MGPWireRecHeader Header;
+    MGPMipPlan Payload;
+};
+static_assert(sizeof(MGPWireRec_GenerateMipmap) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPMipPlan) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_GenerateMipmap gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_GetTextureImage {
+    MGPWireRecHeader Header;
+    MGPReadbackInfo Payload;
+};
+static_assert(sizeof(MGPWireRec_GetTextureImage) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPReadbackInfo) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_GetTextureImage gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_Blit {
+    MGPWireRecHeader Header;
+    MGPBlit Payload;
+};
+static_assert(sizeof(MGPWireRec_Blit) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPBlit) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_Blit gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_Clear {
+    MGPWireRecHeader Header;
+    MGPClear Payload;
+};
+static_assert(sizeof(MGPWireRec_Clear) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPClear) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_Clear gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ReadPixels {
+    MGPWireRecHeader Header;
+    MGPReadbackInfo Payload;
+};
+static_assert(sizeof(MGPWireRec_ReadPixels) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPReadbackInfo) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ReadPixels gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_DrawVbo {
+    MGPWireRecHeader Header;
+    MGPDrawInfo Payload;
+};
+static_assert(sizeof(MGPWireRec_DrawVbo) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPDrawInfo) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_DrawVbo gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_LaunchGrid {
+    MGPWireRecHeader Header;
+    MGPGridInfo Payload;
+};
+static_assert(sizeof(MGPWireRec_LaunchGrid) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPGridInfo) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_LaunchGrid gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_MemoryBarrier {
+    MGPWireRecHeader Header;
+    MGPMemoryBarrier Payload;
+};
+static_assert(sizeof(MGPWireRec_MemoryBarrier) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPMemoryBarrier) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_MemoryBarrier gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_BeginStreamOutput {
+    MGPWireRecHeader Header;
+    MGPStreamOutputBegin Payload;
+};
+static_assert(sizeof(MGPWireRec_BeginStreamOutput) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPStreamOutputBegin) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_BeginStreamOutput gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_EndStreamOutput {
+    MGPWireRecHeader Header;
+    MGPXfbAccounting Payload;
+};
+static_assert(sizeof(MGPWireRec_EndStreamOutput) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPXfbAccounting) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_EndStreamOutput gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_PauseStreamOutput {
+    MGPWireRecHeader Header;
+    MGPStreamOutputControl Payload;
+};
+static_assert(sizeof(MGPWireRec_PauseStreamOutput) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPStreamOutputControl) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_PauseStreamOutput gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_ResumeStreamOutput {
+    MGPWireRecHeader Header;
+    MGPStreamOutputControl Payload;
+};
+static_assert(sizeof(MGPWireRec_ResumeStreamOutput) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPStreamOutputControl) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_ResumeStreamOutput gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_Flush {
+    MGPWireRecHeader Header;
+    MGPFlush Payload;
+};
+static_assert(sizeof(MGPWireRec_Flush) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPFlush) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_Flush gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_Present {
+    MGPWireRecHeader Header;
+    MGPPresent Payload;
+};
+static_assert(sizeof(MGPWireRec_Present) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPPresent) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_Present gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_SetSwapInterval {
+    MGPWireRecHeader Header;
+    MGPSwapInterval Payload;
+};
+static_assert(sizeof(MGPWireRec_SetSwapInterval) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPSwapInterval) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_SetSwapInterval gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryTimestamp {
+    MGPWireRecHeader Header;
+    MGPTimestampRequest Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryTimestamp) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPTimestampRequest) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryTimestamp gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_QueryCounter {
+    MGPWireRecHeader Header;
+    MGPQueryDesc Payload;
+};
+static_assert(sizeof(MGPWireRec_QueryCounter) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPQueryDesc) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_QueryCounter gained padding; the wire format moved");
+
+struct alignas(8) MGPWireRec_FenceWaitServer {
+    MGPWireRecHeader Header;
+    MGPFenceWait Payload;
+};
+static_assert(sizeof(MGPWireRec_FenceWaitServer) ==
+                  ((sizeof(MGPWireRecHeader) + sizeof(MGPFenceWait) + 7u) & ~SizeT(7u)),
+              "MGPWireRec_FenceWaitServer gained padding; the wire format moved");
+
+[[noreturn]] inline void MGPipeWireProtocolFatal(const char* call, Uint64 size, Uint64 remaining) {
+    MGLOG_F("MGPipe: protocol corruption applying %s: size=%llu remaining=%llu", call,
+            static_cast<unsigned long long>(size), static_cast<unsigned long long>(remaining));
+    std::abort();
+}
+
+#define MGP_WIRE_CHECK_BOUNDS(RecType, CallName)                                                                       \
+    do {                                                                                                               \
+        if (!(size >= sizeof(RecType) && size <= remaining && (size % 8) == 0)) {                                       \
+            MGPipeWireProtocolFatal(CallName, size, remaining);                                                         \
+        }                                                                                                              \
+    } while (0)
+
+// Returns whether the record was applied. P0 is a SKELETON: every case validates its
+// bounds and then reports "not applied", because no applier exists until P5 wires
+// MG_Remote/Server/PipeApplier.cpp to the real backend tables. The switch and the opcode
+// enum come from the same list, so a call added to the catalogue cannot be forgotten here;
+// the default arm is for the opcode that never came from this catalogue at all - a byte
+// off a corrupt stream - and it is fatal for the same reason the bounds check is.
+inline Bool MGPipeApplyWireRecord(MGPWireOp op, const void* record, Uint64 size, Uint64 remaining) {
+    (void)record;
+    switch (op) {
+    case MGPWireOp::GetCaps:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_GetCaps, "GetCaps");
+        return false;
+    case MGPWireOp::ResourceCreate:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceCreate, "ResourceCreate");
+        return false;
+    case MGPWireOp::ResourceRespecify:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceRespecify, "ResourceRespecify");
+        return false;
+    case MGPWireOp::ResourceDestroy:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceDestroy, "ResourceDestroy");
+        return false;
+    case MGPWireOp::MapPersistent:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_MapPersistent, "MapPersistent");
+        return false;
+    case MGPWireOp::UnmapPersistent:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_UnmapPersistent, "UnmapPersistent");
+        return false;
+    case MGPWireOp::FenceCreate:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_FenceCreate, "FenceCreate");
+        return false;
+    case MGPWireOp::FenceStatus:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_FenceStatus, "FenceStatus");
+        return false;
+    case MGPWireOp::FenceWait:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_FenceWait, "FenceWait");
+        return false;
+    case MGPWireOp::FenceDestroy:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_FenceDestroy, "FenceDestroy");
+        return false;
+    case MGPWireOp::QueryCreate:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryCreate, "QueryCreate");
+        return false;
+    case MGPWireOp::QueryBegin:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryBegin, "QueryBegin");
+        return false;
+    case MGPWireOp::QueryEnd:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryEnd, "QueryEnd");
+        return false;
+    case MGPWireOp::QueryAvailable:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryAvailable, "QueryAvailable");
+        return false;
+    case MGPWireOp::QueryResult:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryResult, "QueryResult");
+        return false;
+    case MGPWireOp::QueryDestroy:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryDestroy, "QueryDestroy");
+        return false;
+    case MGPWireOp::CreateRenderState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_CreateRenderState, "CreateRenderState");
+        return false;
+    case MGPWireOp::BindRenderState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_BindRenderState, "BindRenderState");
+        return false;
+    case MGPWireOp::DeleteRenderState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_DeleteRenderState, "DeleteRenderState");
+        return false;
+    case MGPWireOp::CreateVertexElements:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_CreateVertexElements, "CreateVertexElements");
+        return false;
+    case MGPWireOp::BindVertexElements:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_BindVertexElements, "BindVertexElements");
+        return false;
+    case MGPWireOp::DeleteVertexElements:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_DeleteVertexElements, "DeleteVertexElements");
+        return false;
+    case MGPWireOp::CreateSamplerState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_CreateSamplerState, "CreateSamplerState");
+        return false;
+    case MGPWireOp::DeleteSamplerState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_DeleteSamplerState, "DeleteSamplerState");
+        return false;
+    case MGPWireOp::CreateSamplerView:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_CreateSamplerView, "CreateSamplerView");
+        return false;
+    case MGPWireOp::DeleteSamplerView:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_DeleteSamplerView, "DeleteSamplerView");
+        return false;
+    case MGPWireOp::CreateShaderState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_CreateShaderState, "CreateShaderState");
+        return false;
+    case MGPWireOp::BindShaderState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_BindShaderState, "BindShaderState");
+        return false;
+    case MGPWireOp::DeleteShaderState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_DeleteShaderState, "DeleteShaderState");
+        return false;
+    case MGPWireOp::SetDynamicState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetDynamicState, "SetDynamicState");
+        return false;
+    case MGPWireOp::SetFramebufferState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetFramebufferState, "SetFramebufferState");
+        return false;
+    case MGPWireOp::SetVertexBuffers:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetVertexBuffers, "SetVertexBuffers");
+        return false;
+    case MGPWireOp::SetIndexBuffer:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetIndexBuffer, "SetIndexBuffer");
+        return false;
+    case MGPWireOp::SetIndirectBuffers:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetIndirectBuffers, "SetIndirectBuffers");
+        return false;
+    case MGPWireOp::SetSamplerViews:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetSamplerViews, "SetSamplerViews");
+        return false;
+    case MGPWireOp::BindSamplerStates:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_BindSamplerStates, "BindSamplerStates");
+        return false;
+    case MGPWireOp::SetShaderImages:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetShaderImages, "SetShaderImages");
+        return false;
+    case MGPWireOp::SetShaderBuffers:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetShaderBuffers, "SetShaderBuffers");
+        return false;
+    case MGPWireOp::SetStreamOutputTargets:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetStreamOutputTargets, "SetStreamOutputTargets");
+        return false;
+    case MGPWireOp::SetGlobalConstants:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetGlobalConstants, "SetGlobalConstants");
+        return false;
+    case MGPWireOp::SetVertexAttribDefaults:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetVertexAttribDefaults, "SetVertexAttribDefaults");
+        return false;
+    case MGPWireOp::SetPixelPackState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetPixelPackState, "SetPixelPackState");
+        return false;
+    case MGPWireOp::SetPatchState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetPatchState, "SetPatchState");
+        return false;
+    case MGPWireOp::SetDrawProgram:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetDrawProgram, "SetDrawProgram");
+        return false;
+    case MGPWireOp::SetDispatchProgram:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetDispatchProgram, "SetDispatchProgram");
+        return false;
+    case MGPWireOp::SetResidualValueState:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetResidualValueState, "SetResidualValueState");
+        return false;
+    case MGPWireOp::SetTextureParams:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetTextureParams, "SetTextureParams");
+        return false;
+    case MGPWireOp::ResourceSubData:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceSubData, "ResourceSubData");
+        return false;
+    case MGPWireOp::BufferSubDataResident:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_BufferSubDataResident, "BufferSubDataResident");
+        return false;
+    case MGPWireOp::ResourceSubDataComplete:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceSubDataComplete, "ResourceSubDataComplete");
+        return false;
+    case MGPWireOp::ResourceFlushRange:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceFlushRange, "ResourceFlushRange");
+        return false;
+    case MGPWireOp::ResourceReadback:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceReadback, "ResourceReadback");
+        return false;
+    case MGPWireOp::ResourceCopyRegion:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResourceCopyRegion, "ResourceCopyRegion");
+        return false;
+    case MGPWireOp::GenerateMipmap:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_GenerateMipmap, "GenerateMipmap");
+        return false;
+    case MGPWireOp::GetTextureImage:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_GetTextureImage, "GetTextureImage");
+        return false;
+    case MGPWireOp::Blit:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_Blit, "Blit");
+        return false;
+    case MGPWireOp::Clear:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_Clear, "Clear");
+        return false;
+    case MGPWireOp::ReadPixels:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ReadPixels, "ReadPixels");
+        return false;
+    case MGPWireOp::DrawVbo:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_DrawVbo, "DrawVbo");
+        return false;
+    case MGPWireOp::LaunchGrid:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_LaunchGrid, "LaunchGrid");
+        return false;
+    case MGPWireOp::MemoryBarrier:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_MemoryBarrier, "MemoryBarrier");
+        return false;
+    case MGPWireOp::BeginStreamOutput:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_BeginStreamOutput, "BeginStreamOutput");
+        return false;
+    case MGPWireOp::EndStreamOutput:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_EndStreamOutput, "EndStreamOutput");
+        return false;
+    case MGPWireOp::PauseStreamOutput:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_PauseStreamOutput, "PauseStreamOutput");
+        return false;
+    case MGPWireOp::ResumeStreamOutput:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_ResumeStreamOutput, "ResumeStreamOutput");
+        return false;
+    case MGPWireOp::Flush:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_Flush, "Flush");
+        return false;
+    case MGPWireOp::Present:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_Present, "Present");
+        return false;
+    case MGPWireOp::SetSwapInterval:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_SetSwapInterval, "SetSwapInterval");
+        return false;
+    case MGPWireOp::QueryTimestamp:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryTimestamp, "QueryTimestamp");
+        return false;
+    case MGPWireOp::QueryCounter:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_QueryCounter, "QueryCounter");
+        return false;
+    case MGPWireOp::FenceWaitServer:
+        MGP_WIRE_CHECK_BOUNDS(MGPWireRec_FenceWaitServer, "FenceWaitServer");
+        return false;
+    case MGPWireOp::kInvalid:
+    case MGPWireOp::kOpCount:
+    default:
+        MGPipeWireProtocolFatal("<unknown opcode>", size, remaining);
+    }
+}
+
+#undef MGP_WIRE_CHECK_BOUNDS

MobileGL/MG_Remote/Protocol/mg_protocol_base.h

@@ -0,0 +1,120 @@
+// MobileGL - MobileGL/MG_Remote/Protocol/mg_protocol_base.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// Shared vocabulary of the MG_Remote wire contracts (transport, framing, ring,
+// shm). Inherited from the earlier `Feat/CS-Delta-IPC` branch
+// (MobileGL/Protocol/mg_protocol_base.h) and cut down to what plan B's
+// transport actually needs: result codes, byte spans, a shm region reference
+// and the id typedefs.
+//
+// Deliberately NOT inherited: MobileGLObjectKind / MobileGLObjectScope /
+// MobileGLObjectHandle. Plan B does not put GL object identity on the wire at
+// all - the frontend allocates {slot, generation} handles in MG_Pipe
+// (PLAN-B.md section 4.2.1) and those are the only identity the backend ever
+// sees, so a second object-identity vocabulary here would be a drift surface
+// with no reader.
+//
+// This header must stay:
+//   - pure C (compilable from C and C++, no MG C++ types, no exceptions/RTTI),
+//   - dependency-free (only <stdbool.h>/<stddef.h>/<stdint.h>),
+//   - append-only within an ABI major (see versioning rules below).
+//
+// Versioning rules (contract-wide):
+//   - Every versioned struct starts with uint32_t structSize.
+//   - Appending fields at the tail is a MINOR bump; receivers must ignore
+//     bytes beyond the structSize they know.
+//   - Changing/removing/reordering existing fields is a MAJOR bump.
+//   - A major mismatch is a hard, structured failure, never an exception.
+// (Plan B keeps the structSize-first discipline as the answer to risk B-R10,
+// PLAN-B.md section 14.2.)
+
+#ifndef MOBILEGL_REMOTE_PROTOCOL_BASE_H
+#define MOBILEGL_REMOTE_PROTOCOL_BASE_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// ---------------------------------------------------------------------------
+// ABI versions
+// ---------------------------------------------------------------------------
+
+#define MOBILEGL_PROTOCOL_ABI_MAJOR 1
+#define MOBILEGL_PROTOCOL_ABI_MINOR 0
+
+#define MOBILEGL_ABI_VERSION(major, minor) (((uint32_t)(major) << 16) | (uint32_t)(minor))
+#define MOBILEGL_ABI_MAJOR_OF(version) ((uint32_t)(version) >> 16)
+#define MOBILEGL_ABI_MINOR_OF(version) ((uint32_t)(version) & 0xFFFFu)
+
+// ---------------------------------------------------------------------------
+// Ids
+// ---------------------------------------------------------------------------
+
+typedef uint64_t MobileGLSessionId;  // one client GL context flow
+typedef uint64_t MobileGLRequestSeq; // matches a request to its reply
+typedef uint32_t MobileGLSegmentId;  // shm segment id within a connection
+
+// ---------------------------------------------------------------------------
+// Spans / regions
+// ---------------------------------------------------------------------------
+
+// Borrowed, read-only byte span. The pointee is owned by the producing side
+// and is only valid for the duration documented at the consuming call site.
+typedef struct MobileGLByteSpan {
+    const void* data;
+    uint64_t size;
+} MobileGLByteSpan;
+
+typedef struct MobileGLMutableByteSpan {
+    void* data;
+    uint64_t size;
+} MobileGLMutableByteSpan;
+
+// A byte range inside an already-established shm segment. Segments are
+// announced out of band (the SegmentRef table on the control channel, with the
+// fd itself passed by SCM_RIGHTS) and stay stable for their declared lifetime;
+// offsets are segment-relative.
+typedef struct MobileGLShmRegion {
+    MobileGLSegmentId segmentId;
+    uint32_t reserved;
+    uint64_t offset;
+    uint64_t size;
+} MobileGLShmRegion;
+
+// ---------------------------------------------------------------------------
+// Result codes (structured errors across every contract boundary)
+// ---------------------------------------------------------------------------
+
+typedef enum MobileGLResult {
+    MOBILEGL_OK = 0,
+    MOBILEGL_ERR_NOT_INITIALIZED = 1,
+    MOBILEGL_ERR_INVALID_ARGUMENT = 2,
+    MOBILEGL_ERR_UNSUPPORTED = 3,
+    MOBILEGL_ERR_OUT_OF_MEMORY = 4,
+    MOBILEGL_ERR_PROTOCOL_MISMATCH = 5, // ABI/wire major mismatch, bad framing
+    MOBILEGL_ERR_TRANSPORT_CLOSED = 6,  // peer gone / EOF
+    MOBILEGL_ERR_TIMEOUT = 7,           // nothing arrived within the deadline
+    MOBILEGL_ERR_SHM_EXHAUSTED = 8,
+    MOBILEGL_ERR_SESSION_UNKNOWN = 9,
+    MOBILEGL_ERR_HANDLE_UNKNOWN = 10,
+    // The caller's buffer is smaller than the pending message. The message is
+    // NOT consumed and the required size is reported back; see
+    // ITransport::ReceiveFrame.
+    MOBILEGL_ERR_BUFFER_TOO_SMALL = 11,
+    MOBILEGL_ERR_FORCE_U32 = 0x7FFFFFFF
+} MobileGLResult;
+
+#ifdef __cplusplus
+} // extern "C"
+#endif
+
+#endif // MOBILEGL_REMOTE_PROTOCOL_BASE_H

MobileGL/MG_Remote/Protocol/protocol.fbs

@@ -0,0 +1,235 @@
+// MobileGL - MobileGL/MG_Remote/Protocol/protocol.fbs
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// MobileGL disaggregated wire protocol - CONTROL PLANE ONLY.
+//
+// Plan B (docs plan "MGPipe") section 8.1 inherits the transport design of the
+// earlier plan verbatim, and its section 7.1 splits the schema in two:
+//
+//   - rare / variable-length / must-evolve messages -> FlatBuffers *tables*,
+//     carried as complete framed messages over the control channel. That is
+//     everything in this file.
+//   - the hot path -> FlatBuffers *structs* (fixed layout, no vtable, no
+//     offset indirection) written straight into the SEG_CMD ring. Those
+//     records are generated from MG_Pipe/PipeCalls.def and are deliberately
+//     NOT in this schema yet: the call catalogue is a separate P0 deliverable
+//     and record numbering must never churn.
+//
+// Regeneration: scripts/gen_protocol.py (flatc is NOT part of the default
+// build graph). generated/protocol_generated.h is committed and CI's
+// flatc-check regenerates it and runs `git diff --exit-code`.
+
+namespace MobileGL.Wire;
+
+// ---------------------------------------------------------------------------
+// Segments
+// ---------------------------------------------------------------------------
+
+// Segment layout is inherited unchanged (earlier plan section 6.1):
+// SEG_CMD 8MiB / SEG_STAGE 32MiB+ / SEG_REPLY 8MiB / SEG_EVENT 256KiB /
+// SEG_SHADOW[n] / SEG_ADOPT[n].
+enum SegmentKind : ubyte {
+  None = 0,
+  Cmd = 1,     // client-owned command ring (RingControl + records)
+  Stage = 2,   // client-owned bulk staging
+  Reply = 3,   // server-owned reply pool
+  Event = 4,   // server-owned event ring
+  Shadow = 5,  // client-owned per-object shadow (P4.5+)
+  Adopt = 6,   // server-owned adopted store, client RW (>= 16MiB)
+}
+
+// The fd itself never travels in a message: POSIX passes it with SCM_RIGHTS on
+// the aux socket (ITransport::ShareFd), Windows resolves `name`.
+table SegmentRef {
+  id: uint;
+  kind: SegmentKind;
+  sizeBytes: ulong;
+  name: string;
+}
+
+// ---------------------------------------------------------------------------
+// Handshake
+// ---------------------------------------------------------------------------
+
+table Hello {
+  abiMajor: uint;
+  abiMinor: uint;
+  buildFingerprint: string;
+  backendType: uint;
+  pid: uint;
+  configBlob: [ubyte];
+}
+
+table Welcome {
+  abiMajor: uint;
+  abiMinor: uint;
+  serverPid: uint;
+  cmdRing: SegmentRef;
+  stageRing: SegmentRef;
+  replyPool: SegmentRef;
+  eventRing: SegmentRef;
+}
+
+// ---------------------------------------------------------------------------
+// Capabilities
+// ---------------------------------------------------------------------------
+
+// Replaces the 40 `pActiveBackendObject->` reads plus the 89 caps read sites
+// (plan B appendix A, `get_caps`). The three blobs are byte-for-byte images of
+// the corresponding POD structs; they are versioned by structSize-first
+// discipline, not by this schema.
+table CapsSnapshot {
+  dynamicParameters: [ubyte];
+  rendererInfo: [ubyte];
+  formatCaps: [ubyte];
+  extensions: [string];
+  apiVersion: string;
+  maxComputeWorkGroupCount: [int];  // 3 entries
+  maxComputeWorkGroupSize: [int];   // 3 entries
+  tableSlotMask: ulong;             // which GLFunctionsTable slots the peer registered
+  prefersCpuXfbPrimitiveAccounting: bool;
+}
+
+table DefaultFramebufferInfo {
+  width: int;
+  height: int;
+  colorFormat: uint;
+  depthFormat: uint;
+  stencilFormat: uint;
+}
+
+// ---------------------------------------------------------------------------
+// Surface / EGL lifecycle
+// ---------------------------------------------------------------------------
+
+enum SurfaceOpKind : ubyte {
+  None = 0,
+  InitializeDisplay = 1,
+  CreateWindowSurface = 2,
+  CreatePbufferSurface = 3,
+  ResizeWindowSurface = 4,
+  ReleaseSurface = 5,
+  MakeCurrent = 6,
+  ReleaseCurrent = 7,
+}
+
+enum WindowKind : ubyte {
+  None = 0,
+  AndroidNativeWindow = 1,
+  X11 = 2,
+  Win32Hwnd = 3,
+  Surfaceless = 4,
+  Pbuffer = 5,
+}
+
+table SurfaceOp {
+  seq: ulong;
+  kind: SurfaceOpKind;
+  display: ulong;
+  surface: ulong;
+  windowKind: WindowKind;
+  nativeToken: ulong;   // X11 XID / HWND; Android transfers the window out of band
+  width: int;
+  height: int;
+  swapInterval: int;
+}
+
+table SurfaceReply {
+  seq: ulong;
+  ok: bool;
+  eglMajor: int;
+  eglMinor: int;
+  defaultFb: DefaultFramebufferInfo;
+}
+
+// ---------------------------------------------------------------------------
+// Resync / aux / diagnostics
+// ---------------------------------------------------------------------------
+
+// Sent by the client after it observes a serverEpoch bump (context lost or
+// server restart): every cached ring offset and every server-side object is
+// gone and the whole pushed state has to be replayed.
+table ResyncRequest {
+  serverEpoch: uint;
+}
+
+table ResyncDone {}
+
+enum AuxRequestKind : ubyte {
+  None = 0,
+  FenceClientWait = 1,
+  QueryResult = 2,
+  ScalarGet = 3,
+}
+
+// Requests issued from a thread that is not the ring producer (foreign-thread
+// sync / query polling), so they cannot take the SPSC ring.
+table AuxRequest {
+  seq: ulong;
+  kind: AuxRequestKind;
+  payload: [ubyte];
+}
+
+enum FatalCode : uint {
+  None = 0,
+  ProtocolCorruption = 1,  // record bounds / self-describing length violated
+  RingOverrun = 2,
+  SegmentMismatch = 3,
+  DeviceLost = 4,
+  ServerCrashed = 5,
+  AbiMismatch = 6,
+}
+
+table Fatal {
+  code: FatalCode;
+  message: string;
+}
+
+// Severity-graded per plan B section 8.2: <= Warn is lossy, >= Error is
+// lossless and rate limited.
+enum LogLevel : ubyte {
+  Debug = 0,
+  Info = 1,
+  Warn = 2,
+  Error = 3,
+  Fatal = 4,
+}
+
+table LogLine {
+  level: LogLevel;
+  text: string;
+}
+
+// ---------------------------------------------------------------------------
+// Envelope
+// ---------------------------------------------------------------------------
+
+// Union tags are wire values: only ever APPEND to this list.
+// ProgramReflection from the earlier plan's section 7.1 is intentionally
+// absent - plan B ships program artifacts inside the create_shader_state CSO
+// blob, so if a control-plane reflection message is ever needed it appends
+// here rather than reserving a tag today.
+union CtrlMsg {
+  Hello,
+  Welcome,
+  CapsSnapshot,
+  SurfaceOp,
+  SurfaceReply,
+  ResyncRequest,
+  ResyncDone,
+  AuxRequest,
+  Fatal,
+  LogLine,
+}
+
+table CtrlEnvelope {
+  msg: CtrlMsg;
+}
+
+root_type CtrlEnvelope;
+file_identifier "MGLC";

MobileGL/MG_Remote/Transport/Doorbell.cpp

@@ -0,0 +1,259 @@
+// MobileGL - MobileGL/MG_Remote/Transport/Doorbell.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "Doorbell.h"
+
+#include <MG_Util/Debug/Log.h>
+
+#include <condition_variable>
+#include <mutex>
+
+#if !defined(_WIN32)
+#include <cerrno>
+#include <poll.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#endif
+
+// Same fallback as FdPassing.cpp: on macOS / BSD the protection is SO_NOSIGPIPE on the
+// socket, set in SocketDoorbell's constructor, not a per-send flag.
+#if !defined(_WIN32) && !defined(MSG_NOSIGNAL)
+#define MSG_NOSIGNAL 0
+#endif
+
+namespace MobileGL::MG_Remote::Transport {
+
+    // -----------------------------------------------------------------------
+    // CondVarDoorbell
+    // -----------------------------------------------------------------------
+
+    struct CondVarDoorbell::Impl {
+        std::mutex mutex;
+        std::condition_variable cv;
+        // Counted, not a flag: a wakeup that arrives while nobody is parked
+        // must still be observed by the next Park.
+        std::uint32_t signals = 0;
+    };
+
+    CondVarDoorbell::CondVarDoorbell() : m_impl(new Impl()) {}
+
+    CondVarDoorbell::~CondVarDoorbell() { delete m_impl; }
+
+    void CondVarDoorbell::Notify() {
+        {
+            std::lock_guard<std::mutex> lock(m_impl->mutex);
+            ++m_impl->signals;
+        }
+        m_impl->cv.notify_one();
+    }
+
+    bool CondVarDoorbell::Park(std::uint32_t timeoutMs) {
+        std::unique_lock<std::mutex> lock(m_impl->mutex);
+        // The death latch is tested under the same mutex Kill sets it under, so
+        // a Kill cannot slip between this test and the wait below: it either
+        // returns here or wakes the predicate.
+        if (m_dead.load(std::memory_order_relaxed)) {
+            return false;
+        }
+        if (m_impl->signals != 0) {
+            --m_impl->signals;
+            return true;
+        }
+        if (timeoutMs == 0) {
+            return false;
+        }
+        const auto woken = [this] {
+            return m_impl->signals != 0 || m_dead.load(std::memory_order_relaxed);
+        };
+        if (timeoutMs == kWaitForever) {
+            m_impl->cv.wait(lock, woken);
+        } else if (!m_impl->cv.wait_for(lock, std::chrono::milliseconds(timeoutMs), woken)) {
+            return false;
+        }
+        if (m_dead.load(std::memory_order_relaxed)) {
+            // Woken by Kill, not by an event. The caller re-tests its condition
+            // regardless (Doorbell::Wait always does) and then sees Dead().
+            return false;
+        }
+        --m_impl->signals;
+        return true;
+    }
+
+    void CondVarDoorbell::Kill() {
+        {
+            std::lock_guard<std::mutex> lock(m_impl->mutex);
+            m_dead.store(true, std::memory_order_release);
+        }
+        // notify_all, not notify_one: both a raw Park and a Doorbell::Wait may
+        // be parked here, and after this nobody will ring again.
+        m_impl->cv.notify_all();
+    }
+
+    void CondVarDoorbell::Reset() {
+        std::lock_guard<std::mutex> lock(m_impl->mutex);
+        m_impl->signals = 0;
+    }
+
+#if !defined(_WIN32)
+
+    // -----------------------------------------------------------------------
+    // SocketDoorbell
+    // -----------------------------------------------------------------------
+
+    SocketDoorbell::SocketDoorbell(int fd, std::uint8_t code, bool ownsFd)
+        : m_fd(fd), m_code(code), m_ownsFd(ownsFd) {
+#if defined(SO_NOSIGPIPE)
+        // The per-socket form of MSG_NOSIGNAL, on the platforms that lack the per-call one:
+        // a Notify to a hung-up peer must come back as EPIPE, not as a fatal signal.
+        if (m_fd >= 0) {
+            const int one = 1;
+            (void)::setsockopt(m_fd, SOL_SOCKET, SO_NOSIGPIPE, &one, sizeof(one));
+        }
+#endif
+    }
+
+    SocketDoorbell::~SocketDoorbell() {
+        if (m_ownsFd && m_fd >= 0) {
+            ::close(m_fd);
+        }
+    }
+
+    void SocketDoorbell::Notify() {
+        if (m_fd < 0) {
+            return;
+        }
+        const std::uint8_t byte = m_code;
+        for (;;) {
+            const ssize_t written = ::send(m_fd, &byte, 1, MSG_DONTWAIT | MSG_NOSIGNAL);
+            if (written == 1) {
+                return;
+            }
+            if (written < 0 && errno == EINTR) {
+                continue;
+            }
+            if (written < 0 && (errno == EAGAIN || errno == EWOULDBLOCK)) {
+                // The socket buffer already holds unread wakeups: the peer has
+                // one pending, which is all a doorbell promises.
+                return;
+            }
+            if (written < 0 && (errno == EPIPE || errno == ECONNRESET)) {
+                // The peer is gone: it can never ring back either, so latch it
+                // here too rather than waiting for a Park to discover it.
+                m_dead = true;
+                return;
+            }
+            MGLOG_D("MG_Remote doorbell: send failed (errno=%d)", errno);
+            return;
+        }
+    }
+
+    bool SocketDoorbell::Park(std::uint32_t timeoutMs) {
+        if (m_fd < 0 || m_dead) {
+            return false;
+        }
+        const auto start = std::chrono::steady_clock::now();
+        for (;;) {
+            int pollTimeout = -1;
+            if (timeoutMs != kWaitForever) {
+                const auto elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(
+                                         std::chrono::steady_clock::now() - start)
+                                         .count();
+                const long long remaining = static_cast<long long>(timeoutMs) - elapsed;
+                pollTimeout = remaining <= 0 ? 0 : static_cast<int>(remaining);
+            }
+            struct pollfd pfd{};
+            pfd.fd = m_fd;
+            pfd.events = POLLIN;
+            const int ready = ::poll(&pfd, 1, pollTimeout);
+            if (ready < 0) {
+                if (errno == EINTR) {
+                    continue; // a signal is not a wakeup; keep the deadline
+                }
+                MGLOG_D("MG_Remote doorbell: poll failed (errno=%d)", errno);
+                return false;
+            }
+            if (ready == 0) {
+                return false; // timed out
+            }
+            // revents has to be inspected, not just `ready > 0`. Once the peer
+            // closes its end the descriptor is permanently poll-ready with
+            // nothing to read (measured on Linux: revents=POLLIN|POLLHUP,
+            // recv()==0), so treating any readiness as a wakeup turns every
+            // park on a dead peer into a 100% CPU spin - unbounded, because
+            // Doorbell::Wait re-parks until its deadline and kWaitForever has
+            // none.
+            if ((pfd.revents & (POLLERR | POLLNVAL)) != 0) {
+                MGLOG_D("MG_Remote doorbell: fd %d unusable (revents=0x%X)", m_fd,
+                        static_cast<unsigned>(pfd.revents));
+                m_dead = true;
+                return false;
+            }
+            if ((pfd.revents & POLLIN) != 0) {
+                if (Drain() != 0) {
+                    return true; // a real wakeup byte
+                }
+                if (m_dead) {
+                    return false; // EOF, not an event
+                }
+                // Ready but empty and still alive: someone else drained it.
+                // Report the wakeup and let the caller re-test its condition.
+                return true;
+            }
+            if ((pfd.revents & POLLHUP) != 0) {
+                m_dead = true;
+                return false;
+            }
+            // Readiness with no bit we requested or recognise: there is
+            // nothing to consume and no way to make progress, so refuse to
+            // poll this descriptor again.
+            MGLOG_D("MG_Remote doorbell: fd %d ready with revents=0x%X", m_fd,
+                    static_cast<unsigned>(pfd.revents));
+            m_dead = true;
+            return false;
+        }
+    }
+
+    std::uint64_t SocketDoorbell::Drain() {
+        // Level-triggered to edge-triggered: swallow every queued byte so one
+        // stale wakeup cannot make later Parks return without an event.
+        std::uint64_t consumed = 0;
+        std::uint8_t scratch[64];
+        for (;;) {
+            const ssize_t got = ::recv(m_fd, scratch, sizeof(scratch), MSG_DONTWAIT);
+            if (got > 0) {
+                consumed += static_cast<std::uint64_t>(got);
+                continue;
+            }
+            if (got == 0) {
+                // Orderly shutdown on a stream socket: the peer is gone and
+                // will never ring again.
+                m_dead = true;
+                return consumed;
+            }
+            if (errno == EINTR) {
+                continue;
+            }
+            if (errno == EAGAIN || errno == EWOULDBLOCK) {
+                return consumed; // drained
+            }
+            MGLOG_D("MG_Remote doorbell: recv failed (errno=%d)", errno);
+            m_dead = true;
+            return consumed;
+        }
+    }
+
+    void SocketDoorbell::Reset() {
+        if (m_fd < 0 || m_dead) {
+            return;
+        }
+        (void)Drain();
+    }
+
+#endif // !_WIN32
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/Doorbell.h

@@ -0,0 +1,268 @@
+// MobileGL - MobileGL/MG_Remote/Transport/Doorbell.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The bidirectional doorbell: spin briefly, then park.
+//
+// Both directions exist, and that is the point (inherited design, earlier plan
+// section 6.2a):
+//   - client -> server: the consumer spins, sets consumerParked, then blocks;
+//     the producer rings only when consumerParked is set.
+//   - server -> client: the client spins MOBILEGL_IPC_SPIN_US (default 50us),
+//     sets producerParked, then blocks; the server rings after advancing any
+//     watermark, only when producerParked is set.
+// Without the second direction every client wait - present credit, a blocking
+// kNeedsAck request, a full ring - degenerates into a cross-process spin on
+// one shared cache line: up to a whole frame of a big core at full clock on a
+// phone, fighting the GPU and the game's JVM for it. MobileGL has no affinity
+// control anywhere in the tree, so it cannot even be pushed to a little core.
+//
+// Two implementations, no platform-specific wakeup primitive (no futex, no
+// eventfd, no named event):
+//   - CondVarDoorbell for `inproc` (one process, two threads),
+//   - SocketDoorbell for `spawn` (one byte on a socket; POSIX only).
+//
+// The lost-wakeup window is closed by two seq_cst FENCES, not by the ordering
+// of the park flag's own load and store:
+//   - the waiter sets the flag, executes std::atomic_thread_fence(seq_cst),
+//     and THEN re-tests the condition (Doorbell::Wait);
+//   - the notifier publishes its watermark, executes the same fence, and THEN
+//     reads the flag (NotifyIfParked).
+// Both fences sit in the single seq_cst total order, so one precedes the
+// other, and [atomics.order] then forces at least one side to observe the
+// other's store. The flag's own accesses may be relaxed: they are not what
+// closes the window.
+//
+// A seq_cst store paired with a seq_cst load would NOT be enough, which is
+// why the fences are here and why neither may be removed. That Dekker
+// argument needs all FOUR accesses in the total order, and the other two are
+// not: the watermark publish is a release store (RingProducer::Publish) and
+// the condition re-test is an acquire load. On x86 the gap is concrete rather
+// than theoretical - a release store is a plain MOV that can still sit in the
+// store buffer while the load of the park flag, also a plain MOV, reads 0, so
+// the notifier skips the ring and the waiter parks on a stale watermark
+// forever. (ARMv8 survives it only because STLR->LDAR is RCsc, i.e. by luck.)
+//
+// The other half of the contract is ordering between the caller and the
+// fence: NotifyIfParked must be called AFTER the watermark is published. A
+// fence only orders what precedes it.
+
+#pragma once
+
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+
+#if defined(__x86_64__) || defined(__i386__)
+#include <immintrin.h>
+#endif
+
+namespace MobileGL::MG_Remote::Transport {
+
+    // MOBILEGL_IPC_SPIN_US default.
+    inline constexpr std::uint32_t kDefaultSpinUs = 50;
+
+    // Park with no deadline.
+    inline constexpr std::uint32_t kWaitForever = 0xFFFFFFFFu;
+
+    // Wire codes, so a shared socket can carry both directions distinguishably.
+    inline constexpr std::uint8_t kDoorbellRingAdvanced = 0x01;      // client -> server
+    inline constexpr std::uint8_t kDoorbellWatermarkAdvanced = 0x02; // server -> client
+
+    inline void CpuRelax() {
+#if defined(__x86_64__) || defined(__i386__)
+        _mm_pause();
+#elif defined(__aarch64__) || defined(__arm__)
+        __asm__ __volatile__("yield" ::: "memory");
+#else
+        std::atomic_signal_fence(std::memory_order_seq_cst);
+#endif
+    }
+
+    class Doorbell {
+    public:
+        virtual ~Doorbell() = default;
+
+        Doorbell(const Doorbell&) = delete;
+        Doorbell& operator=(const Doorbell&) = delete;
+
+        // Wakes a parked peer. Cheap and idempotent: a wakeup that arrives when
+        // nobody is parked is remembered, so the next Park returns immediately
+        // rather than sleeping through an event that already happened.
+        virtual void Notify() = 0;
+
+        // Blocks until notified or the deadline passes. Returns true when a
+        // wakeup was consumed. timeoutMs == 0 polls; kWaitForever never times
+        // out.
+        virtual bool Park(std::uint32_t timeoutMs) = 0;
+
+        // Drops pending wakeups. Used when a waiter gives up, so a stale byte
+        // does not make the next Park return spuriously forever.
+        virtual void Reset() = 0;
+
+        // True once the wakeup channel is permanently unusable: the peer closed
+        // its end of the socket, or the inproc channel was shut down. A dead
+        // doorbell can never deliver another wakeup, and Wait must stop
+        // re-parking on it - for the socket because its descriptor is
+        // permanently poll-ready and a waiter with no deadline would burn a
+        // big core at full clock, for the condvar because Park would otherwise
+        // block forever and Shutdown could never join the waiter. Every
+        // implementation has a death state; the base default is only for a
+        // bell that cannot die.
+        virtual bool Dead() const { return false; }
+
+        // Spin `spinUs`, then park until `ready()` or the deadline.
+        // `parked` is the RingControl flag the peer tests before ringing.
+        template <class Ready>
+        bool Wait(std::atomic<std::uint32_t>& parked, Ready&& ready, std::uint32_t spinUs,
+                  std::uint32_t timeoutMs) {
+            if (ready()) {
+                return true;
+            }
+            const auto start = std::chrono::steady_clock::now();
+            const auto deadline = timeoutMs == kWaitForever
+                                      ? std::chrono::steady_clock::time_point::max()
+                                      : start + std::chrono::milliseconds(timeoutMs);
+
+            const auto spinEnd = start + std::chrono::microseconds(spinUs);
+            while (std::chrono::steady_clock::now() < spinEnd) {
+                if (ready()) {
+                    return true;
+                }
+                CpuRelax();
+            }
+
+            for (;;) {
+                // Announce, FENCE, then re-test. The fence is the mechanism -
+                // see the file header - so setting the flag itself is relaxed.
+                parked.store(1, std::memory_order_relaxed);
+                std::atomic_thread_fence(std::memory_order_seq_cst);
+                if (ready()) {
+                    parked.store(0, std::memory_order_relaxed);
+                    return true;
+                }
+                const auto now = std::chrono::steady_clock::now();
+                if (now >= deadline) {
+                    parked.store(0, std::memory_order_relaxed);
+                    return ready();
+                }
+                std::uint32_t chunkMs = kWaitForever;
+                if (timeoutMs != kWaitForever) {
+                    const auto remaining =
+                        std::chrono::duration_cast<std::chrono::milliseconds>(deadline - now).count();
+                    chunkMs = remaining <= 0 ? 0 : static_cast<std::uint32_t>(remaining);
+                }
+                Park(chunkMs);
+                // Clearing is relaxed on purpose: a notifier that reads a
+                // stale 1 only rings a bell nobody is waiting on, which the
+                // doorbell remembers and the next Park consumes. The dangerous
+                // direction - a notifier reading 0 while the waiter is really
+                // parked - is the one the fence above rules out.
+                parked.store(0, std::memory_order_relaxed);
+                if (ready()) {
+                    return true;
+                }
+                if (Dead()) {
+                    // Nothing can ring this bell again and parking on it no
+                    // longer blocks, so looping here would spin at full clock
+                    // for as long as the caller is willing to wait - which,
+                    // with kWaitForever, is forever.
+                    return false;
+                }
+                if (timeoutMs != kWaitForever && std::chrono::steady_clock::now() >= deadline) {
+                    return false;
+                }
+            }
+        }
+
+    protected:
+        Doorbell() = default;
+    };
+
+    // Rings `bell` only when the peer said it is parked.
+    //
+    // PRECONDITION: whatever the waiter's condition reads - the ring head, a
+    // sequence watermark, a queue push - is ALREADY published when this is
+    // called. The fence only orders what precedes it, so ringing before
+    // publishing reopens the window this closes. The fence pairs with the one
+    // in Doorbell::Wait; see the file header for why the flag's own memory
+    // order is not what makes this sound.
+    inline void NotifyIfParked(Doorbell& bell, std::atomic<std::uint32_t>& parked) {
+        std::atomic_thread_fence(std::memory_order_seq_cst);
+        if (parked.load(std::memory_order_relaxed) != 0) {
+            bell.Notify();
+        }
+    }
+
+    // `inproc`: one process, two threads.
+    class CondVarDoorbell final : public Doorbell {
+    public:
+        CondVarDoorbell();
+        ~CondVarDoorbell() override;
+
+        void Notify() override;
+        bool Park(std::uint32_t timeoutMs) override;
+        void Reset() override;
+        bool Dead() const override { return m_dead.load(std::memory_order_acquire); }
+
+        // Hangs the bell up for good: every parked waiter returns false now and
+        // every later Park returns false at once. The inproc twin of the socket
+        // peer closing its end (SocketDoorbell latches m_dead on EOF), and what
+        // InProcessChannel::Close rings instead of Notify. A Notify is consumed
+        // by ONE Park; Doorbell::Wait then re-tests its condition, finds
+        // nothing published, finds the bell alive, and with kWaitForever parks
+        // again - so a Shutdown that only rang could never join a server thread
+        // sitting in the design's own steady state (spun, set consumerParked,
+        // blocked). Irreversible by design, like the socket's.
+        void Kill();
+
+    private:
+        struct Impl;
+        Impl* m_impl;
+        std::atomic<bool> m_dead{false};
+    };
+
+#if !defined(_WIN32)
+    // `spawn`: one byte on a socket (one direction of a socketpair, or the aux
+    // socket). POSIX only; the Windows path will use an overlapped named pipe
+    // and is not part of this skeleton.
+    class SocketDoorbell final : public Doorbell {
+    public:
+        // `fd` must be one end of an AF_UNIX socket pair, not a pipe: Notify
+        // uses send() with MSG_DONTWAIT|MSG_NOSIGNAL and Park uses
+        // poll()+recv(), which a pipe end refuses with ENOTSOCK. Prefer
+        // SOCK_STREAM for the spawn transport - measured on Linux, a closed
+        // peer makes a stream end report POLLIN|POLLHUP with recv()==0, which
+        // is how death is detected, while a SOCK_DGRAM end reports no
+        // readiness at all and a waiter with no deadline would simply hang.
+        // When `ownsFd` the descriptor is closed with this object. `code` is
+        // the byte written by Notify.
+        SocketDoorbell(int fd, std::uint8_t code, bool ownsFd);
+        ~SocketDoorbell() override;
+
+        void Notify() override;
+        bool Park(std::uint32_t timeoutMs) override;
+        void Reset() override;
+        bool Dead() const override { return m_dead; }
+
+        int Fd() const { return m_fd; }
+
+    private:
+        // Consumes every queued wakeup byte and returns how many. Latches
+        // m_dead on EOF: recv returning 0 on a stream socket is the peer's
+        // hangup, not a wakeup, and the descriptor stays poll-ready forever
+        // afterwards.
+        std::uint64_t Drain();
+
+        int m_fd;
+        std::uint8_t m_code;
+        bool m_ownsFd;
+        bool m_dead = false;
+    };
+#endif
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/FdPassing.cpp

@@ -0,0 +1,323 @@
+// MobileGL - MobileGL/MG_Remote/Transport/FdPassing.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "FdPassing.h"
+
+#include <MG_Util/Debug/Log.h>
+
+#include <chrono>
+#include <cstring>
+
+#if !defined(_WIN32)
+#include <cerrno>
+#include <fcntl.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <unistd.h>
+#endif
+
+// MSG_NOSIGNAL is Linux (and Android). macOS and the BSDs spell the same protection as the
+// SO_NOSIGPIPE socket option, set once per socket at creation (CreateSocketPair below, and
+// SocketDoorbell's constructor). With neither, a write to a hung-up peer raises SIGPIPE and
+// kills the process instead of returning EPIPE.
+#if !defined(_WIN32) && !defined(MSG_NOSIGNAL)
+#define MSG_NOSIGNAL 0
+#endif
+
+namespace MobileGL::MG_Remote::Transport::FdPassing {
+
+#if defined(_WIN32)
+
+    bool Supported() { return false; }
+
+    MobileGLResult CreateSocketPair(int[2]) { return MOBILEGL_ERR_UNSUPPORTED; }
+
+    MobileGLResult SendFd(int, int, MobileGLByteSpan) { return MOBILEGL_ERR_UNSUPPORTED; }
+
+    MobileGLResult ReceiveFd(int, int*, MobileGLMutableByteSpan, std::uint64_t*, std::uint32_t) {
+        return MOBILEGL_ERR_UNSUPPORTED;
+    }
+
+#else
+
+    namespace {
+        // Every datagram starts with this, so the sideband length is explicit
+        // and a stray datagram is recognisable.
+        struct SidebandHeader {
+            std::uint32_t magic;
+            std::uint32_t sidebandSize;
+        };
+        constexpr std::uint32_t kSidebandMagic = 0x4446474Du; // 'MGFD' on the wire
+
+        int WaitReadable(int socket, std::uint32_t timeoutMs) {
+            const auto start = std::chrono::steady_clock::now();
+            for (;;) {
+                int pollTimeout = -1;
+                if (timeoutMs != 0xFFFFFFFFu) {
+                    const auto elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(
+                                             std::chrono::steady_clock::now() - start)
+                                             .count();
+                    const long long remaining = static_cast<long long>(timeoutMs) - elapsed;
+                    pollTimeout = remaining <= 0 ? 0 : static_cast<int>(remaining);
+                }
+                struct pollfd pfd{};
+                pfd.fd = socket;
+                pfd.events = POLLIN;
+                const int ready = ::poll(&pfd, 1, pollTimeout);
+                if (ready < 0 && errno == EINTR) {
+                    continue;
+                }
+                return ready;
+            }
+        }
+    } // namespace
+
+    bool Supported() { return true; }
+
+    MobileGLResult CreateSocketPair(int outFds[2]) {
+        if (outFds == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        int fds[2] = {-1, -1};
+        int type = SOCK_DGRAM;
+#if defined(SOCK_CLOEXEC)
+        type |= SOCK_CLOEXEC;
+#endif
+        if (::socketpair(AF_UNIX, type, 0, fds) != 0) {
+            MGLOG_E("MG_Remote fd passing: socketpair failed (errno=%d)", errno);
+            return MOBILEGL_ERR_TRANSPORT_CLOSED;
+        }
+#if defined(SO_NOSIGPIPE)
+        // The per-socket form of MSG_NOSIGNAL, on the platforms that lack the per-call one.
+        for (int fd : fds) {
+            const int one = 1;
+            (void)::setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, &one, sizeof(one));
+        }
+#endif
+        outFds[0] = fds[0];
+        outFds[1] = fds[1];
+        return MOBILEGL_OK;
+    }
+
+    MobileGLResult SendFd(int socket, int fd, MobileGLByteSpan sideband) {
+        if (socket < 0 || fd < 0) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        if (sideband.size > kMaxSidebandBytes || (sideband.size != 0 && sideband.data == nullptr)) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+
+        std::uint8_t payload[sizeof(SidebandHeader) + kMaxSidebandBytes];
+        SidebandHeader header{};
+        header.magic = kSidebandMagic;
+        header.sidebandSize = static_cast<std::uint32_t>(sideband.size);
+        std::memcpy(payload, &header, sizeof(header));
+        if (sideband.size != 0) {
+            std::memcpy(payload + sizeof(header), sideband.data,
+                        static_cast<std::size_t>(sideband.size));
+        }
+        const std::size_t payloadSize = sizeof(header) + static_cast<std::size_t>(sideband.size);
+
+        struct iovec iov{};
+        iov.iov_base = payload;
+        iov.iov_len = payloadSize;
+
+        // CMSG_SPACE, not sizeof: the control buffer has to hold the aligned
+        // cmsghdr as well as the descriptor.
+        union {
+            struct cmsghdr align;
+            char bytes[CMSG_SPACE(sizeof(int))];
+        } control{};
+        std::memset(&control, 0, sizeof(control));
+
+        struct msghdr msg{};
+        msg.msg_iov = &iov;
+        msg.msg_iovlen = 1;
+        msg.msg_control = control.bytes;
+        msg.msg_controllen = sizeof(control.bytes);
+
+        struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg);
+        cmsg->cmsg_level = SOL_SOCKET;
+        cmsg->cmsg_type = SCM_RIGHTS;
+        cmsg->cmsg_len = CMSG_LEN(sizeof(int));
+        std::memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd));
+
+        for (;;) {
+            const ssize_t sent = ::sendmsg(socket, &msg, MSG_NOSIGNAL);
+            if (sent >= 0) {
+                if (static_cast<std::size_t>(sent) != payloadSize) {
+                    // A datagram socket sends all or nothing.
+                    MGLOG_E("MG_Remote fd passing: short datagram (%zd of %zu bytes)", sent,
+                            payloadSize);
+                    return MOBILEGL_ERR_TRANSPORT_CLOSED;
+                }
+                return MOBILEGL_OK;
+            }
+            if (errno == EINTR) {
+                continue;
+            }
+            if (errno == EPIPE || errno == ECONNRESET) {
+                return MOBILEGL_ERR_TRANSPORT_CLOSED;
+            }
+            MGLOG_E("MG_Remote fd passing: sendmsg failed (errno=%d)", errno);
+            return MOBILEGL_ERR_TRANSPORT_CLOSED;
+        }
+    }
+
+    MobileGLResult ReceiveFd(int socket, int* outFd, MobileGLMutableByteSpan sideband,
+                             std::uint64_t* outSidebandSize, std::uint32_t timeoutMs) {
+        if (socket < 0 || outFd == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        *outFd = -1;
+        if (outSidebandSize != nullptr) {
+            *outSidebandSize = 0;
+        }
+        // Checked before the recvmsg: a datagram cannot be partially consumed,
+        // so a too-small destination must never cost us the descriptor.
+        if (sideband.size < kMaxSidebandBytes) {
+            if (outSidebandSize != nullptr) {
+                *outSidebandSize = kMaxSidebandBytes;
+            }
+            return MOBILEGL_ERR_BUFFER_TOO_SMALL;
+        }
+        if (sideband.data == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+
+        const int ready = WaitReadable(socket, timeoutMs);
+        if (ready < 0) {
+            MGLOG_E("MG_Remote fd passing: poll failed (errno=%d)", errno);
+            return MOBILEGL_ERR_TRANSPORT_CLOSED;
+        }
+        if (ready == 0) {
+            return MOBILEGL_ERR_TIMEOUT;
+        }
+
+        std::uint8_t payload[sizeof(SidebandHeader) + kMaxSidebandBytes];
+        struct iovec iov{};
+        iov.iov_base = payload;
+        iov.iov_len = sizeof(payload);
+
+        union {
+            struct cmsghdr align;
+            char bytes[CMSG_SPACE(sizeof(int) * 4)];
+        } control{};
+        std::memset(&control, 0, sizeof(control));
+
+        struct msghdr msg{};
+        msg.msg_iov = &iov;
+        msg.msg_iovlen = 1;
+        msg.msg_control = control.bytes;
+        msg.msg_controllen = sizeof(control.bytes);
+
+        ssize_t got = 0;
+        for (;;) {
+            int flags = 0;
+#if defined(MSG_CMSG_CLOEXEC)
+            flags |= MSG_CMSG_CLOEXEC;
+#endif
+            got = ::recvmsg(socket, &msg, flags);
+            if (got >= 0) {
+                break;
+            }
+            if (errno == EINTR) {
+                continue;
+            }
+            if (errno == ECONNRESET) {
+                return MOBILEGL_ERR_TRANSPORT_CLOSED;
+            }
+            MGLOG_E("MG_Remote fd passing: recvmsg failed (errno=%d)", errno);
+            return MOBILEGL_ERR_TRANSPORT_CLOSED;
+        }
+        if (got == 0) {
+            return MOBILEGL_ERR_TRANSPORT_CLOSED;
+        }
+
+        // Collect every descriptor first, so an unexpected extra one is closed
+        // rather than leaked, whatever else is wrong with the message.
+        int received[4];
+        int receivedCount = 0;
+        for (struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg); cmsg != nullptr;
+             cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+            if (cmsg->cmsg_level != SOL_SOCKET || cmsg->cmsg_type != SCM_RIGHTS) {
+                continue;
+            }
+            const std::size_t bytes = cmsg->cmsg_len - CMSG_LEN(0);
+            const int count = static_cast<int>(bytes / sizeof(int));
+            for (int i = 0; i < count && receivedCount < 4; ++i) {
+                int fd = -1;
+                std::memcpy(&fd, CMSG_DATA(cmsg) + i * sizeof(int), sizeof(fd));
+                received[receivedCount++] = fd;
+            }
+        }
+#if !defined(MSG_CMSG_CLOEXEC)
+        // No atomic close-on-exec on receive here (macOS, the BSDs): set it by hand on every
+        // descriptor that arrived, before anything else can fork. The window between the
+        // recvmsg and this loop is the platform's, not ours; leaving the flag off altogether
+        // would hand every shared segment to every child the process ever spawns.
+        for (int i = 0; i < receivedCount; ++i) {
+            if (received[i] >= 0) {
+                (void)::fcntl(received[i], F_SETFD, FD_CLOEXEC);
+            }
+        }
+#endif
+        const auto closeAll = [&](int keepIndex) {
+            for (int i = 0; i < receivedCount; ++i) {
+                if (i != keepIndex && received[i] >= 0) {
+                    ::close(received[i]);
+                }
+            }
+        };
+
+        if ((msg.msg_flags & MSG_CTRUNC) != 0) {
+            // The kernel dropped ancillary data: whatever arrived is not a
+            // complete offer, and silently continuing would hand the caller a
+            // half-transferred segment.
+            MGLOG_E("MG_Remote fd passing: ancillary data truncated; the descriptor did not "
+                    "arrive intact");
+            closeAll(-1);
+            return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+        }
+        if (receivedCount != 1) {
+            MGLOG_E("MG_Remote fd passing: expected exactly one descriptor, got %d", receivedCount);
+            closeAll(-1);
+            return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+        }
+        if (static_cast<std::size_t>(got) < sizeof(SidebandHeader)) {
+            MGLOG_E("MG_Remote fd passing: %zd byte datagram is shorter than the header", got);
+            closeAll(-1);
+            return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+        }
+
+        SidebandHeader header{};
+        std::memcpy(&header, payload, sizeof(header));
+        if (header.magic != kSidebandMagic ||
+            header.sidebandSize > kMaxSidebandBytes ||
+            sizeof(SidebandHeader) + header.sidebandSize != static_cast<std::size_t>(got)) {
+            MGLOG_E("MG_Remote fd passing: bad sideband header (magic=0x%08X size=%u datagram=%zd)",
+                    header.magic, header.sidebandSize, got);
+            closeAll(-1);
+            return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+        }
+
+        if (header.sidebandSize != 0) {
+            std::memcpy(sideband.data, payload + sizeof(SidebandHeader), header.sidebandSize);
+        }
+        if (outSidebandSize != nullptr) {
+            *outSidebandSize = header.sidebandSize;
+        }
+        *outFd = received[0];
+        closeAll(0);
+        return MOBILEGL_OK;
+    }
+
+#endif // _WIN32
+
+} // namespace MobileGL::MG_Remote::Transport::FdPassing

MobileGL/MG_Remote/Transport/FdPassing.h

@@ -0,0 +1,67 @@
+// MobileGL - MobileGL/MG_Remote/Transport/FdPassing.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// SCM_RIGHTS descriptor passing over an AF_UNIX socket pair. POSIX only.
+//
+// This is the FIRST transport commit, deliberately (inherited design, plan
+// section 8.1, "SCM_RIGHTS must be implemented in the first transport
+// commit"). The earlier branch pushed it to a later phase and hardcoded
+// `out->fd = -1` in its offer poll, so on the only platform that matters its
+// data plane could never move a byte: every segment announcement resolved to
+// "no descriptor". A transport whose shm cannot cross the process boundary is
+// not a transport.
+//
+// Channel shape: a dedicated AF_UNIX SOCK_DGRAM socketpair, NOT the control
+// byte stream. Two reasons:
+//   - SOCK_DGRAM preserves message boundaries on every POSIX (SOCK_SEQPACKET
+//     does not exist on macOS), so one sendmsg is exactly one recvmsg and the
+//     ancillary data can never be split away from its payload;
+//   - ancillary data attached to a byte stream binds to whichever ordinary
+//     byte happens to be at the front of the reader's buffer, which is
+//     unmanageable once frames are being reassembled.
+
+#pragma once
+
+#include "../Protocol/mg_protocol_base.h"
+
+#include <cstdint>
+
+namespace MobileGL::MG_Remote::Transport::FdPassing {
+
+    // Upper bound for the bytes that travel with a descriptor (a SegmentRef
+    // sized announcement, not payload).
+    inline constexpr std::uint64_t kMaxSidebandBytes = 256;
+
+    // False on platforms without SCM_RIGHTS (Windows).
+    bool Supported();
+
+    // Creates the aux socket pair. Both descriptors are CLOEXEC and owned by
+    // the caller. outFds[0] is conventionally the client end, [1] the server's
+    // (the one that is inherited or passed to the spawned process).
+    MobileGLResult CreateSocketPair(int outFds[2]);
+
+    // Sends `fd` with `sideband` attached. The caller keeps ownership of `fd`
+    // (the peer gets its own descriptor for the same open file description).
+    // sideband.size must be <= kMaxSidebandBytes.
+    MobileGLResult SendFd(int socket, int fd, MobileGLByteSpan sideband);
+
+    // Receives one descriptor and its sideband bytes.
+    //
+    // `sideband` must be at least kMaxSidebandBytes: a datagram cannot be
+    // partially consumed, so the capacity is checked BEFORE anything is read.
+    // A short buffer returns MOBILEGL_ERR_BUFFER_TOO_SMALL with
+    // *outSidebandSize = kMaxSidebandBytes and consumes nothing, so no
+    // descriptor is ever dropped on the floor.
+    //
+    // On success *outFd owns a descriptor this process must close.
+    // MOBILEGL_ERR_TIMEOUT when nothing arrived (timeoutMs 0 = poll),
+    // MOBILEGL_ERR_TRANSPORT_CLOSED on peer close.
+    MobileGLResult ReceiveFd(int socket, int* outFd, MobileGLMutableByteSpan sideband,
+                             std::uint64_t* outSidebandSize, std::uint32_t timeoutMs);
+
+} // namespace MobileGL::MG_Remote::Transport::FdPassing

MobileGL/MG_Remote/Transport/Framing.h

@@ -0,0 +1,208 @@
+// MobileGL - MobileGL/MG_Remote/Transport/Framing.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// Control-channel wire framing: [u32 magic 'MGLF'][u32 payloadLength][payload].
+// Length excludes the 8-byte header and is capped at 64 MiB.
+//
+// Two defects of the earlier branch's codec are fixed here, and both are the
+// reason this file is not a copy of it:
+//
+//  1. Its Feed() unconditionally returned OK and its header peek merely
+//     returned false on a bad magic or an oversized length. A corrupt or
+//     desynchronized stream therefore turned into a silent, permanent hang -
+//     the reader kept waiting for a message that could never be parsed, with
+//     no error anywhere. Here a violation latches a failed state, is logged at
+//     ERROR, and every later call returns MOBILEGL_ERR_PROTOCOL_MISMATCH.
+//
+//  2. Its receive path failed the call and consumed the message when the
+//     caller's buffer was too small, wedging the stream. Here
+//     MOBILEGL_ERR_BUFFER_TOO_SMALL reports the required size and KEEPS the
+//     message queued.
+//
+// The reader is a plain byte-stream reassembler: it never assumes a read()
+// returned a whole frame.
+
+#pragma once
+
+#include "../Protocol/mg_protocol_base.h"
+
+// NOT <MG_Util/Debug/Log.h>: that header pulls the GL frontend's umbrella into
+// every translation unit that reassembles a frame. See WireLog.h.
+#include "WireLog.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <vector>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    // 'MGLF', little-endian on the wire (both ends are the same machine).
+    inline constexpr std::uint32_t kFrameMagic = 0x464C474Du;
+    inline constexpr std::uint64_t kFrameHeaderSize = 8;
+    inline constexpr std::uint64_t kMaxFramePayloadSize = 64ull * 1024 * 1024;
+
+    // Compaction threshold: consumed bytes are dropped from the front once
+    // enough of them accumulate, so a long-lived reader neither memmoves per
+    // message nor grows without bound.
+    inline constexpr std::uint64_t kFrameReaderCompactThreshold = 64ull * 1024;
+
+    // Appends one framed message to `out`.
+    inline MobileGLResult AppendFrame(std::vector<std::uint8_t>& out, const void* payload,
+                                      std::uint64_t size) {
+        if (size > kMaxFramePayloadSize) {
+            WireLogError("MG_Remote framing: refusing to send a %llu byte payload (cap %llu); "
+                         "bulk bytes belong in shm",
+                    static_cast<unsigned long long>(size),
+                    static_cast<unsigned long long>(kMaxFramePayloadSize));
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        if (size != 0 && payload == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        std::uint8_t header[kFrameHeaderSize];
+        const std::uint32_t magic = kFrameMagic;
+        const std::uint32_t length = static_cast<std::uint32_t>(size);
+        std::memcpy(header + 0, &magic, sizeof(magic));
+        std::memcpy(header + 4, &length, sizeof(length));
+        out.insert(out.end(), header, header + kFrameHeaderSize);
+        const auto* bytes = static_cast<const std::uint8_t*>(payload);
+        out.insert(out.end(), bytes, bytes + size);
+        return MOBILEGL_OK;
+    }
+
+    // Incremental frame extractor over a raw byte stream.
+    class FrameReader {
+    public:
+        // Feeds raw stream bytes. Validates the frame header the moment enough
+        // bytes for one exist - a bad magic or an oversized length is reported
+        // here, not swallowed.
+        MobileGLResult Feed(const void* data, std::uint64_t size) {
+            if (m_failed) {
+                return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+            }
+            if (size != 0) {
+                if (data == nullptr) {
+                    return MOBILEGL_ERR_INVALID_ARGUMENT;
+                }
+                const auto* bytes = static_cast<const std::uint8_t*>(data);
+                m_buffer.insert(m_buffer.end(), bytes, bytes + size);
+            }
+            return ParseHeader();
+        }
+
+        bool Failed() const { return m_failed; }
+
+        bool HasMessage() const {
+            return !m_failed && m_haveHeader && Available() >= kFrameHeaderSize + m_pendingSize;
+        }
+
+        // Size of the next complete message, or 0 when none is complete yet.
+        std::uint64_t PendingMessageSize() const { return HasMessage() ? m_pendingSize : 0; }
+
+        std::uint64_t BufferedBytes() const { return Available(); }
+
+        // Copies the next complete message out.
+        //   MOBILEGL_OK                   - copied, *outSize set, message consumed
+        //   MOBILEGL_ERR_BUFFER_TOO_SMALL - *outSize = required size, message KEPT
+        //   MOBILEGL_ERR_TIMEOUT          - no complete message buffered
+        //   MOBILEGL_ERR_PROTOCOL_MISMATCH- the stream is latched failed
+        MobileGLResult TakeMessage(MobileGLMutableByteSpan buffer, std::uint64_t* outSize) {
+            if (m_failed) {
+                return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+            }
+            if (!HasMessage()) {
+                return MOBILEGL_ERR_TIMEOUT;
+            }
+            if (outSize != nullptr) {
+                *outSize = m_pendingSize;
+            }
+            if (buffer.size < m_pendingSize) {
+                // The message stays queued; the caller retries with a big
+                // enough buffer.
+                return MOBILEGL_ERR_BUFFER_TOO_SMALL;
+            }
+            if (m_pendingSize != 0) {
+                if (buffer.data == nullptr) {
+                    return MOBILEGL_ERR_INVALID_ARGUMENT;
+                }
+                std::memcpy(buffer.data, m_buffer.data() + m_readPos + kFrameHeaderSize,
+                            static_cast<std::size_t>(m_pendingSize));
+            }
+            Consume();
+            return MOBILEGL_OK;
+        }
+
+        // Convenience overload that sizes the destination itself.
+        MobileGLResult TakeMessage(std::vector<std::uint8_t>& out) {
+            if (m_failed) {
+                return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+            }
+            if (!HasMessage()) {
+                return MOBILEGL_ERR_TIMEOUT;
+            }
+            const auto* first = m_buffer.data() + m_readPos + kFrameHeaderSize;
+            out.assign(first, first + m_pendingSize);
+            Consume();
+            return MOBILEGL_OK;
+        }
+
+    private:
+        std::uint64_t Available() const { return m_buffer.size() - m_readPos; }
+
+        MobileGLResult ParseHeader() {
+            if (m_haveHeader || Available() < kFrameHeaderSize) {
+                return MOBILEGL_OK;
+            }
+            std::uint32_t magic = 0;
+            std::uint32_t length = 0;
+            std::memcpy(&magic, m_buffer.data() + m_readPos, sizeof(magic));
+            std::memcpy(&length, m_buffer.data() + m_readPos + 4, sizeof(length));
+            if (magic != kFrameMagic) {
+                m_failed = true;
+                WireLogError("MG_Remote framing: bad frame magic 0x%08X (expected 0x%08X); the "
+                             "control stream is desynchronized and this transport is now dead",
+                             magic, kFrameMagic);
+                return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+            }
+            if (length > kMaxFramePayloadSize) {
+                m_failed = true;
+                WireLogError("MG_Remote framing: frame length %u exceeds the %llu byte cap; "
+                             "refusing to allocate on a peer-supplied length",
+                             length, static_cast<unsigned long long>(kMaxFramePayloadSize));
+                return MOBILEGL_ERR_PROTOCOL_MISMATCH;
+            }
+            m_pendingSize = length;
+            m_haveHeader = true;
+            return MOBILEGL_OK;
+        }
+
+        void Consume() {
+            m_readPos += kFrameHeaderSize + m_pendingSize;
+            m_pendingSize = 0;
+            m_haveHeader = false;
+            if (m_readPos == m_buffer.size()) {
+                m_buffer.clear();
+                m_readPos = 0;
+            } else if (m_readPos >= kFrameReaderCompactThreshold) {
+                m_buffer.erase(m_buffer.begin(),
+                               m_buffer.begin() + static_cast<std::ptrdiff_t>(m_readPos));
+                m_readPos = 0;
+            }
+            // Header of the next message may already be buffered.
+            (void)ParseHeader();
+        }
+
+        std::vector<std::uint8_t> m_buffer;
+        std::uint64_t m_readPos = 0;
+        std::uint64_t m_pendingSize = 0;
+        bool m_haveHeader = false;
+        bool m_failed = false;
+    };
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/ITransport.h

@@ -0,0 +1,130 @@
+// MobileGL - MobileGL/MG_Remote/Transport/ITransport.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The control-plane transport interface.
+//
+// It is deliberately dumb: complete messages in, complete messages out, plus
+// the one thing shared memory cannot do without help - handing a file
+// descriptor to the peer. No session routing, no seq accounting, no
+// serialization; those live above, in the protocol layer.
+//
+// Everything on the hot path bypasses this interface entirely: records go into
+// the SEG_CMD ring (Ring.h) and the peer is woken through a Doorbell
+// (Doorbell.h). ITransport carries the handshake, surface ops, resync, aux
+// requests and fatals - the rare, variable-length, must-evolve traffic that
+// plan section 7.1 assigns to FlatBuffers tables.
+//
+// This header stays dependency-light on purpose (mg_protocol_base.h plus the
+// standard library): it is included by both roles and by the eventual
+// server-side binary, and nothing about a byte pipe needs the GL frontend's
+// umbrella header.
+//
+// Threading: one instance is not internally synchronized for send; callers
+// serialize sends. ReceiveFrame/ReceiveFd may be called from one dedicated
+// reader thread concurrently with sends from another.
+
+#pragma once
+
+#include "../Protocol/mg_protocol_base.h"
+
+#include <cstdint>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    // Which end of the connection this instance is.
+    enum class TransportRole : std::uint32_t {
+        Server = 1,    // accepts the client connection
+        Client = 2,    // connects to the server endpoint
+        InProcess = 3, // same-process hand-off (CI / inproc delivery mode)
+    };
+
+    class ITransport {
+    public:
+        virtual ~ITransport() = default;
+
+        ITransport(const ITransport&) = delete;
+        ITransport& operator=(const ITransport&) = delete;
+
+        // ---- control plane -------------------------------------------------
+
+        // Sends one complete message. `bytes` is borrowed: the implementation
+        // either copies it or completes the underlying write before returning.
+        // A payload larger than Framing::kMaxFramePayloadSize is rejected with
+        // MOBILEGL_ERR_INVALID_ARGUMENT - bulk bytes belong in shm, never here.
+        virtual MobileGLResult SendFrame(MobileGLByteSpan bytes) = 0;
+
+        // Receives the next complete message.
+        //
+        //   MOBILEGL_OK                   - copied into `buffer`, *outSize is
+        //                                   the message size, message consumed.
+        //   MOBILEGL_ERR_BUFFER_TOO_SMALL - `buffer` is too small. *outSize is
+        //                                   the size required and THE MESSAGE
+        //                                   STAYS QUEUED: call again with a
+        //                                   buffer of at least that size and it
+        //                                   is still there.
+        //   MOBILEGL_ERR_TIMEOUT          - nothing arrived within timeoutMs
+        //                                   (0 = non-blocking poll).
+        //   MOBILEGL_ERR_TRANSPORT_CLOSED - peer gone, nothing left buffered.
+        //   MOBILEGL_ERR_PROTOCOL_MISMATCH- framing violated; the transport is
+        //                                   latched failed and never recovers.
+        //
+        // The buffer-too-small half of that contract is the whole point of
+        // having one: the earlier branch's transport failed the call AND
+        // dropped the message, which wedges the stream permanently the first
+        // time a message is bigger than the reader's guess.
+        virtual MobileGLResult ReceiveFrame(MobileGLMutableByteSpan buffer, std::uint64_t* outSize,
+                                            std::uint32_t timeoutMs) = 0;
+
+        // Size of the next pending message, or 0 when none is buffered. Lets a
+        // caller size its buffer without a failed receive first.
+        virtual std::uint64_t PeekFrameSize() = 0;
+
+        // ---- descriptor passing --------------------------------------------
+
+        // Hands `fd` to the peer. POSIX: SCM_RIGHTS over the aux socket (see
+        // FdPassing.h). Windows: not applicable, returns
+        // MOBILEGL_ERR_UNSUPPORTED - the section name travels inside SegmentRef
+        // instead. The caller keeps ownership of `fd` and closes it itself.
+        //
+        // This is a first-class member of the interface, not a later phase: the
+        // earlier branch deferred it and hardcoded `out->fd = -1` in its offer
+        // poll, so its data plane could not move a single byte on the only
+        // platform that matters.
+        virtual MobileGLResult ShareFd(int fd, MobileGLByteSpan sideband) = 0;
+
+        // Receives one fd previously shared by the peer. On success *outFd owns
+        // a descriptor this process must close. `sideband` receives the bytes
+        // that travelled with it (may be empty) and must be at least
+        // FdPassing::kMaxSidebandBytes: an fd offer is one datagram and cannot
+        // be half-consumed, so the capacity is checked BEFORE anything is read
+        // and a short buffer returns MOBILEGL_ERR_BUFFER_TOO_SMALL with the
+        // required size, having consumed nothing and dropped no descriptor.
+        virtual MobileGLResult ReceiveFd(int* outFd, MobileGLMutableByteSpan sideband,
+                                         std::uint64_t* outSidebandSize, std::uint32_t timeoutMs) = 0;
+
+        // ---- lifecycle ------------------------------------------------------
+
+        // Idempotent. Tears down the WHOLE connection, not just this end:
+        // both directions are half-closed, so after either endpoint calls it
+        // neither side can send any more (SendFrame returns
+        // MOBILEGL_ERR_TRANSPORT_CLOSED) and every waiter on either side is
+        // unblocked. That is what closing a socket does, and the spawn
+        // transport behaves the same way, so a one-sided contract here would
+        // be a promise only the in-process implementation could keep.
+        //
+        // Messages already queued stay readable until drained: a peer that
+        // shuts down right after sending does not lose its last message.
+        virtual void Shutdown() = 0;
+
+        virtual TransportRole Role() const = 0;
+
+    protected:
+        ITransport() = default;
+    };
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/InProcessTransport.cpp

@@ -0,0 +1,293 @@
+// MobileGL - MobileGL/MG_Remote/Transport/InProcessTransport.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "InProcessTransport.h"
+
+#include "FdPassing.h"
+#include "Framing.h"
+
+#include <MG_Util/Debug/Log.h>
+
+#include <cerrno>
+#include <chrono>
+#include <condition_variable>
+#include <cstring>
+#include <deque>
+#include <mutex>
+#include <vector>
+
+#if !defined(_WIN32)
+#include <unistd.h>
+#endif
+
+namespace MobileGL::MG_Remote::Transport {
+
+    namespace {
+        struct FdOffer {
+            int fd = -1;
+            std::vector<std::uint8_t> sideband;
+        };
+    } // namespace
+
+    // One direction of the channel: everything queued FOR one endpoint.
+    class InProcessChannel {
+    public:
+        struct Direction {
+            std::mutex mutex;
+            // One variable per predicate. A single cv signalled with
+            // notify_one would let a SendFrame's wakeup land on a thread
+            // blocked in ReceiveFd, which re-tests its own predicate and goes
+            // straight back to sleep - leaving a queued message undelivered
+            // until some unrelated later event. ITransport narrows the
+            // contract to one dedicated reader thread, but a comment is not a
+            // reason to ship a primitive that breaks the moment someone
+            // splits the reader.
+            std::condition_variable cv;   // messages
+            std::condition_variable fdCv; // fdOffers
+            std::deque<std::vector<std::uint8_t>> messages;
+            std::deque<FdOffer> fdOffers;
+            bool closed = false;
+        };
+
+        ~InProcessChannel() {
+            for (Direction& dir : m_directions) {
+                for (FdOffer& offer : dir.fdOffers) {
+#if !defined(_WIN32)
+                    if (offer.fd >= 0) {
+                        ::close(offer.fd);
+                    }
+#endif
+                }
+                dir.fdOffers.clear();
+            }
+        }
+
+        Direction& Inbox(int endpoint) { return m_directions[endpoint]; }
+        Direction& Outbox(int endpoint) { return m_directions[1 - endpoint]; }
+        CondVarDoorbell& Bell(int endpoint) { return m_bells[endpoint]; }
+
+        void Close() {
+            for (Direction& dir : m_directions) {
+                {
+                    std::lock_guard<std::mutex> lock(dir.mutex);
+                    dir.closed = true;
+                }
+                dir.cv.notify_all();
+                dir.fdCv.notify_all();
+            }
+            // Anything parked on a ring doorbell has to come back too, or a
+            // shutdown mid-frame hangs the peer forever. Kill, not Notify: a
+            // ring is consumed by one Park, after which Doorbell::Wait re-tests
+            // a condition nothing published and - the bell still reporting
+            // alive - parks again, with no deadline forever. Only Dead() ends
+            // that loop.
+            for (CondVarDoorbell& bell : m_bells) {
+                bell.Kill();
+            }
+        }
+
+    private:
+        Direction m_directions[2];
+        CondVarDoorbell m_bells[2];
+    };
+
+    InProcessTransport::InProcessTransport(std::shared_ptr<InProcessChannel> channel, int endpoint)
+        : m_channel(std::move(channel)), m_endpoint(endpoint) {}
+
+    InProcessTransport::~InProcessTransport() = default;
+
+    void InProcessTransport::CreatePair(std::unique_ptr<InProcessTransport>& outClient,
+                                        std::unique_ptr<InProcessTransport>& outServer) {
+        auto channel = std::make_shared<InProcessChannel>();
+        outClient.reset(new InProcessTransport(channel, 0));
+        outServer.reset(new InProcessTransport(channel, 1));
+    }
+
+    MobileGLResult InProcessTransport::SendFrame(MobileGLByteSpan bytes) {
+        if (bytes.size != 0 && bytes.data == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        // Same cap as the byte-stream transports, so nothing legal here becomes
+        // illegal the day the delivery mode changes to `spawn`.
+        if (bytes.size > kMaxFramePayloadSize) {
+            MGLOG_E("MG_Remote inproc: refusing a %llu byte message (cap %llu)",
+                    static_cast<unsigned long long>(bytes.size),
+                    static_cast<unsigned long long>(kMaxFramePayloadSize));
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+
+        InProcessChannel::Direction& dir = m_channel->Outbox(m_endpoint);
+        {
+            std::lock_guard<std::mutex> lock(dir.mutex);
+            if (dir.closed) {
+                return MOBILEGL_ERR_TRANSPORT_CLOSED;
+            }
+            const auto* first = static_cast<const std::uint8_t*>(bytes.data);
+            dir.messages.emplace_back(first, first + bytes.size);
+        }
+        dir.cv.notify_one();
+        return MOBILEGL_OK;
+    }
+
+    MobileGLResult InProcessTransport::ReceiveFrame(MobileGLMutableByteSpan buffer,
+                                                    std::uint64_t* outSize,
+                                                    std::uint32_t timeoutMs) {
+        if (outSize != nullptr) {
+            *outSize = 0;
+        }
+        InProcessChannel::Direction& dir = m_channel->Inbox(m_endpoint);
+        std::unique_lock<std::mutex> lock(dir.mutex);
+        if (dir.messages.empty() && !dir.closed && timeoutMs != 0) {
+            const auto ready = [&dir] { return !dir.messages.empty() || dir.closed; };
+            if (timeoutMs == kWaitForever) {
+                dir.cv.wait(lock, ready);
+            } else {
+                dir.cv.wait_for(lock, std::chrono::milliseconds(timeoutMs), ready);
+            }
+        }
+        if (dir.messages.empty()) {
+            // Queued messages outlive the peer's Shutdown; only an empty inbox
+            // is a closed one.
+            return dir.closed ? MOBILEGL_ERR_TRANSPORT_CLOSED : MOBILEGL_ERR_TIMEOUT;
+        }
+
+        const std::vector<std::uint8_t>& front = dir.messages.front();
+        const std::uint64_t size = front.size();
+        if (outSize != nullptr) {
+            *outSize = size;
+        }
+        if (buffer.size < size) {
+            // Contract: the message STAYS QUEUED. The earlier branch's
+            // transport failed the call and popped the message anyway, which
+            // wedges the stream permanently the first time a reader guesses the
+            // size wrong.
+            return MOBILEGL_ERR_BUFFER_TOO_SMALL;
+        }
+        if (size != 0) {
+            if (buffer.data == nullptr) {
+                return MOBILEGL_ERR_INVALID_ARGUMENT;
+            }
+            std::memcpy(buffer.data, front.data(), static_cast<std::size_t>(size));
+        }
+        dir.messages.pop_front();
+        return MOBILEGL_OK;
+    }
+
+    std::uint64_t InProcessTransport::PeekFrameSize() {
+        InProcessChannel::Direction& dir = m_channel->Inbox(m_endpoint);
+        std::lock_guard<std::mutex> lock(dir.mutex);
+        return dir.messages.empty() ? 0 : dir.messages.front().size();
+    }
+
+    MobileGLResult InProcessTransport::ShareFd(int fd, MobileGLByteSpan sideband) {
+#if defined(_WIN32)
+        (void)fd;
+        (void)sideband;
+        return MOBILEGL_ERR_UNSUPPORTED;
+#else
+        if (fd < 0) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        if (sideband.size > FdPassing::kMaxSidebandBytes ||
+            (sideband.size != 0 && sideband.data == nullptr)) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        // Same ownership rule as SCM_RIGHTS: the peer gets its own descriptor
+        // for the same open file description and the caller keeps its own.
+        const int duplicate = ::dup(fd);
+        if (duplicate < 0) {
+            MGLOG_E("MG_Remote inproc: dup failed (errno=%d)", errno);
+            return MOBILEGL_ERR_TRANSPORT_CLOSED;
+        }
+
+        FdOffer offer;
+        offer.fd = duplicate;
+        if (sideband.size != 0) {
+            const auto* first = static_cast<const std::uint8_t*>(sideband.data);
+            offer.sideband.assign(first, first + sideband.size);
+        }
+
+        InProcessChannel::Direction& dir = m_channel->Outbox(m_endpoint);
+        {
+            std::lock_guard<std::mutex> lock(dir.mutex);
+            if (dir.closed) {
+                ::close(duplicate);
+                return MOBILEGL_ERR_TRANSPORT_CLOSED;
+            }
+            dir.fdOffers.push_back(std::move(offer));
+        }
+        dir.fdCv.notify_one();
+        return MOBILEGL_OK;
+#endif
+    }
+
+    MobileGLResult InProcessTransport::ReceiveFd(int* outFd, MobileGLMutableByteSpan sideband,
+                                                 std::uint64_t* outSidebandSize,
+                                                 std::uint32_t timeoutMs) {
+        if (outFd == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        *outFd = -1;
+        if (outSidebandSize != nullptr) {
+            *outSidebandSize = 0;
+        }
+#if defined(_WIN32)
+        (void)sideband;
+        (void)timeoutMs;
+        return MOBILEGL_ERR_UNSUPPORTED;
+#else
+        // Symmetric with FdPassing::ReceiveFd so callers behave identically in
+        // both delivery modes.
+        if (sideband.size < FdPassing::kMaxSidebandBytes) {
+            if (outSidebandSize != nullptr) {
+                *outSidebandSize = FdPassing::kMaxSidebandBytes;
+            }
+            return MOBILEGL_ERR_BUFFER_TOO_SMALL;
+        }
+        if (sideband.data == nullptr) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+
+        InProcessChannel::Direction& dir = m_channel->Inbox(m_endpoint);
+        std::unique_lock<std::mutex> lock(dir.mutex);
+        if (dir.fdOffers.empty() && !dir.closed && timeoutMs != 0) {
+            const auto ready = [&dir] { return !dir.fdOffers.empty() || dir.closed; };
+            if (timeoutMs == kWaitForever) {
+                dir.fdCv.wait(lock, ready);
+            } else {
+                dir.fdCv.wait_for(lock, std::chrono::milliseconds(timeoutMs), ready);
+            }
+        }
+        if (dir.fdOffers.empty()) {
+            return dir.closed ? MOBILEGL_ERR_TRANSPORT_CLOSED : MOBILEGL_ERR_TIMEOUT;
+        }
+
+        FdOffer offer = std::move(dir.fdOffers.front());
+        dir.fdOffers.pop_front();
+        if (!offer.sideband.empty()) {
+            std::memcpy(sideband.data, offer.sideband.data(), offer.sideband.size());
+        }
+        if (outSidebandSize != nullptr) {
+            *outSidebandSize = offer.sideband.size();
+        }
+        *outFd = offer.fd;
+        return MOBILEGL_OK;
+#endif
+    }
+
+    // Whole-connection teardown, as ITransport::Shutdown documents: both
+    // directions are half-closed and both ring doorbells are KILLED, because a
+    // peer parked on a ring doorbell mid-frame would otherwise never come back
+    // (a mere ring is consumed once and the waiter parks again).
+    void InProcessTransport::Shutdown() { m_channel->Close(); }
+
+    Doorbell& InProcessTransport::PeerDoorbell() { return m_channel->Bell(1 - m_endpoint); }
+
+    Doorbell& InProcessTransport::SelfDoorbell() { return m_channel->Bell(m_endpoint); }
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/InProcessTransport.h

@@ -0,0 +1,77 @@
+// MobileGL - MobileGL/MG_Remote/Transport/InProcessTransport.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The `inproc` transport: two in-memory message queues and a pair of condvar
+// doorbells, one connected endpoint at each end.
+//
+// It is not a test double. `inproc` is a delivery mode of its own - the server
+// side is the monolith's own render thread, which is the single largest CPU
+// lever this project has, and it is also the CI form of the split build. What
+// it does NOT exercise is serialization of the byte stream, so the framing
+// codec is covered separately by FramingTest.
+//
+// It is built by MOBILEGL_BUILD_DISAGGREGATED, the one option this skeleton
+// adds, and selected at RUNTIME (plan appendix B: MOBILEGL_TRANSPORT =
+// monolith / inproc / spawn / ...). The plan also reserves a separate
+// MOBILEGL_BUILD_DISAGGREGATED_INPROC option for the role-isolation shim that
+// a single-process CI build will need; that option does not exist yet, and
+// nothing here depends on it.
+//
+// Messages are queued whole, so no framing bytes are involved; the size cap is
+// still enforced so that a payload which would be illegal on a socket is
+// illegal here too and does not pass CI only to fail after the switch to
+// `spawn`.
+//
+// Descriptor passing is a plain dup(): both ends are the same process, so
+// there is nothing to transfer, but the API stays identical so callers can be
+// written once.
+
+#pragma once
+
+#include "Doorbell.h"
+#include "ITransport.h"
+
+#include <memory>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    class InProcessChannel;
+
+    class InProcessTransport final : public ITransport {
+    public:
+        ~InProcessTransport() override;
+
+        // Creates one connected pair. Endpoint 0 is the client, endpoint 1 the
+        // server; both share one channel and either may be destroyed first.
+        static void CreatePair(std::unique_ptr<InProcessTransport>& outClient,
+                               std::unique_ptr<InProcessTransport>& outServer);
+
+        MobileGLResult SendFrame(MobileGLByteSpan bytes) override;
+        MobileGLResult ReceiveFrame(MobileGLMutableByteSpan buffer, std::uint64_t* outSize,
+                                    std::uint32_t timeoutMs) override;
+        std::uint64_t PeekFrameSize() override;
+        MobileGLResult ShareFd(int fd, MobileGLByteSpan sideband) override;
+        MobileGLResult ReceiveFd(int* outFd, MobileGLMutableByteSpan sideband,
+                                 std::uint64_t* outSidebandSize, std::uint32_t timeoutMs) override;
+        void Shutdown() override;
+        TransportRole Role() const override { return TransportRole::InProcess; }
+
+        // The wake channel for the SEG_CMD/SEG_STAGE rings living beside this
+        // transport: ring the peer's bell after publishing a watermark (only
+        // when its park flag is set - see NotifyIfParked), park on your own.
+        Doorbell& PeerDoorbell();
+        Doorbell& SelfDoorbell();
+
+    private:
+        InProcessTransport(std::shared_ptr<InProcessChannel> channel, int endpoint);
+
+        std::shared_ptr<InProcessChannel> m_channel;
+        int m_endpoint = 0;
+    };
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/Ring.cpp

@@ -0,0 +1,306 @@
+// MobileGL - MobileGL/MG_Remote/Transport/Ring.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "Ring.h"
+
+#include <MG_Util/Debug/Log.h>
+
+#include <cstring>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    namespace {
+        constexpr std::uint64_t Align8(std::uint64_t value) {
+            return (value + (kRingRecordAlignment - 1)) & ~(kRingRecordAlignment - 1);
+        }
+
+        bool IsPowerOfTwo(std::uint64_t value) { return value != 0 && (value & (value - 1)) == 0; }
+
+        std::atomic<std::uint64_t>& Head(RingControl& c, RingCursorSet which) {
+            return which == RingCursorSet::Cmd ? c.cmdHead : c.stageHead;
+        }
+        const std::atomic<std::uint64_t>& Head(const RingControl& c, RingCursorSet which) {
+            return which == RingCursorSet::Cmd ? c.cmdHead : c.stageHead;
+        }
+        std::atomic<std::uint64_t>& AppliedTail(RingControl& c, RingCursorSet which) {
+            return which == RingCursorSet::Cmd ? c.cmdAppliedTail : c.stageAppliedTail;
+        }
+        const std::atomic<std::uint64_t>& AppliedTail(const RingControl& c, RingCursorSet which) {
+            return which == RingCursorSet::Cmd ? c.cmdAppliedTail : c.stageAppliedTail;
+        }
+        std::atomic<std::uint64_t>& RetiredTail(RingControl& c, RingCursorSet which) {
+            return which == RingCursorSet::Cmd ? c.cmdRetiredTail : c.stageRetiredTail;
+        }
+        const std::atomic<std::uint64_t>& RetiredTail(const RingControl& c, RingCursorSet which) {
+            return which == RingCursorSet::Cmd ? c.cmdRetiredTail : c.stageRetiredTail;
+        }
+    } // namespace
+
+    void InitRingControl(RingControl& control) {
+        std::memset(static_cast<void*>(&control), 0, sizeof(RingControl));
+        // 0 means "uninitialized" for both generations, so a peer that reads a
+        // zero page can tell it from a legal generation.
+        control.serverEpoch.store(1, std::memory_order_relaxed);
+        control.ringGeneration.store(1, std::memory_order_relaxed);
+    }
+
+    bool RingCursorsValid(const RingControl& control, RingCursorSet cursors,
+                          std::uint64_t capacityBytes) {
+        const std::uint64_t head = Head(control, cursors).load(std::memory_order_acquire);
+        const std::uint64_t applied = AppliedTail(control, cursors).load(std::memory_order_acquire);
+        const std::uint64_t retired = RetiredTail(control, cursors).load(std::memory_order_acquire);
+        if (applied > head || retired > applied) {
+            return false;
+        }
+        return head - retired <= capacityBytes;
+    }
+
+    MobileGLResult HardDrainRing(RingControl& control, RingCursorSet cursors) {
+        const std::uint64_t head = Head(control, cursors).load(std::memory_order_acquire);
+        const std::uint64_t applied = AppliedTail(control, cursors).load(std::memory_order_acquire);
+        const std::uint64_t retired = RetiredTail(control, cursors).load(std::memory_order_acquire);
+        if (head != applied || applied != retired) {
+            MGLOG_E("MG_Remote ring: hard drain refused, ring is not quiesced "
+                    "(head=%llu applied=%llu retired=%llu)",
+                    static_cast<unsigned long long>(head),
+                    static_cast<unsigned long long>(applied),
+                    static_cast<unsigned long long>(retired));
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        // Cursors stay monotonic across the drain - only the generation moves,
+        // so any offset either side cached is now recognisably stale.
+        control.ringGeneration.fetch_add(1, std::memory_order_acq_rel);
+        return MOBILEGL_OK;
+    }
+
+    // -----------------------------------------------------------------------
+    // Producer
+    // -----------------------------------------------------------------------
+
+    RingProducer::RingProducer(RingControl* control, void* base, std::uint64_t capacityBytes,
+                               RingCursorSet cursors)
+        : m_control(control), m_base(static_cast<std::uint8_t*>(base)), m_capacity(capacityBytes),
+          m_mask(capacityBytes - 1), m_cursors(cursors) {
+        if (control == nullptr || base == nullptr || !IsPowerOfTwo(capacityBytes) ||
+            capacityBytes < kMinRingCapacity || capacityBytes > kMaxRingCapacity) {
+            MGLOG_E("MG_Remote ring: producer rejected, capacity %llu must be a power of two "
+                    "between %llu and %llu bytes over a non-null mapping (a record may be at most "
+                    "half the ring, and the record header's size field is 32-bit, so a bigger ring "
+                    "would truncate it)",
+                    static_cast<unsigned long long>(capacityBytes),
+                    static_cast<unsigned long long>(kMinRingCapacity),
+                    static_cast<unsigned long long>(kMaxRingCapacity));
+            m_control = nullptr;
+            m_base = nullptr;
+            m_capacity = 0;
+            m_mask = 0;
+            return;
+        }
+        m_localHead = Head(*control, cursors).load(std::memory_order_acquire);
+    }
+
+    std::uint64_t RingProducer::TailForReclaim() const {
+        // The conservative watermark: a slot borrowed into the GPU timeline is
+        // only free after retiredTail passes it. A consumer that never borrows
+        // publishes retired together with applied, so this costs nothing there.
+        return RetiredTail(*m_control, m_cursors).load(std::memory_order_acquire);
+    }
+
+    std::uint64_t RingProducer::FreeBytes() const {
+        if (m_control == nullptr) {
+            return 0;
+        }
+        const std::uint64_t inFlight = m_localHead - TailForReclaim();
+        return inFlight >= m_capacity ? 0 : m_capacity - inFlight;
+    }
+
+    void* RingProducer::Reserve(std::uint16_t kind, std::uint16_t flags,
+                                std::uint64_t payloadBytes) {
+        if (m_control == nullptr) {
+            return nullptr;
+        }
+        const std::uint64_t total = Align8(sizeof(RingRecordHeader) + payloadBytes);
+        if (total > MaxRecordBytes()) {
+            // A single record larger than HALF the ring is a caller bug: the
+            // record catalogue has to chunk oversized payloads (large subdata
+            // becomes several records) rather than emit one giant record.
+            //
+            // Half, not the whole ring, because a record has to be placeable at
+            // EVERY head offset of an empty ring. Straddling the wrap boundary
+            // costs a pad of spaceToEnd bytes on top of the record, and with
+            // spaceToEnd < total that is at most 2*total-8, which stays within
+            // the capacity exactly up to capacity/2. Above it the record is
+            // placeable at some offsets and not at others: at head offset 16 of
+            // an empty 256-byte ring a 248-byte record needs 240+248 bytes while
+            // FreeBytes() reports 256, so a producer that waits for FreeBytes()
+            // >= total stalls forever, and nothing is ever logged. Refusing here
+            // makes that impossible - a nullptr with FreeBytes() >= total can no
+            // longer mean "wait".
+            MGLOG_E("MG_Remote ring: record kind %u of %llu bytes exceeds half of a %llu byte ring; "
+                    "the emitter must chunk it",
+                    static_cast<unsigned>(kind), static_cast<unsigned long long>(total),
+                    static_cast<unsigned long long>(m_capacity));
+            return nullptr;
+        }
+
+        const std::uint64_t offset = m_localHead & m_mask;
+        const std::uint64_t spaceToEnd = m_capacity - offset;
+        // Every record is a multiple of 8, so the distance to the wrap boundary
+        // is too, and a pad header always fits.
+        const bool needsPad = spaceToEnd < total;
+        const std::uint64_t needed = needsPad ? spaceToEnd + total : total;
+        if (FreeBytes() < needed) {
+            MGLOG_D("MG_Remote ring: full, %llu bytes free, %llu needed",
+                    static_cast<unsigned long long>(FreeBytes()),
+                    static_cast<unsigned long long>(needed));
+            return nullptr;
+        }
+
+        if (needsPad) {
+            RingRecordHeader pad{};
+            pad.kind = kRingPadRecordKind;
+            pad.flags = kRecPad;
+            pad.size = static_cast<std::uint32_t>(spaceToEnd);
+            std::memcpy(SlotAt(m_localHead), &pad, sizeof(pad));
+            m_localHead += spaceToEnd;
+        }
+
+        RingRecordHeader header{};
+        header.kind = kind;
+        header.flags = static_cast<std::uint16_t>(flags & ~static_cast<std::uint16_t>(kRecPad));
+        header.size = static_cast<std::uint32_t>(total);
+        std::uint8_t* slot = SlotAt(m_localHead);
+        std::memcpy(slot, &header, sizeof(header));
+        m_localHead += total;
+        return slot + sizeof(RingRecordHeader);
+    }
+
+    void RingProducer::Publish() {
+        if (m_control == nullptr) {
+            return;
+        }
+        // Release: everything written into the slots happens-before the peer's
+        // acquire load of the head.
+        Head(*m_control, m_cursors).store(m_localHead, std::memory_order_release);
+    }
+
+    // -----------------------------------------------------------------------
+    // Consumer
+    // -----------------------------------------------------------------------
+
+    RingConsumer::RingConsumer(RingControl* control, void* base, std::uint64_t capacityBytes,
+                               RingCursorSet cursors)
+        : m_control(control), m_base(static_cast<const std::uint8_t*>(base)),
+          m_capacity(capacityBytes), m_mask(capacityBytes - 1), m_cursors(cursors) {
+        if (control == nullptr || base == nullptr || !IsPowerOfTwo(capacityBytes) ||
+            capacityBytes < kMinRingCapacity || capacityBytes > kMaxRingCapacity) {
+            MGLOG_E("MG_Remote ring: consumer rejected, capacity %llu must be a power of two "
+                    "between %llu and %llu bytes over a non-null mapping (a record may be at most "
+                    "half the ring, and the record header's size field is 32-bit, so a bigger ring "
+                    "would truncate it)",
+                    static_cast<unsigned long long>(capacityBytes),
+                    static_cast<unsigned long long>(kMinRingCapacity),
+                    static_cast<unsigned long long>(kMaxRingCapacity));
+            m_control = nullptr;
+            m_base = nullptr;
+            m_capacity = 0;
+            m_mask = 0;
+            return;
+        }
+        m_localTail = AppliedTail(*control, cursors).load(std::memory_order_acquire);
+    }
+
+    bool RingConsumer::Pop(RingRecordView& out, bool* outCorrupt) {
+        if (outCorrupt != nullptr) {
+            *outCorrupt = false;
+        }
+        if (m_control == nullptr) {
+            return false;
+        }
+        const std::uint64_t head = Head(*m_control, m_cursors).load(std::memory_order_acquire);
+        while (m_localTail != head) {
+            const std::uint64_t available = head - m_localTail;
+            if (available < sizeof(RingRecordHeader) || available > m_capacity) {
+                MGLOG_E("MG_Remote ring: %llu bytes between tail and head is impossible for a %llu "
+                        "byte ring",
+                        static_cast<unsigned long long>(available),
+                        static_cast<unsigned long long>(m_capacity));
+                if (outCorrupt != nullptr) {
+                    *outCorrupt = true;
+                }
+                return false;
+            }
+            const std::uint64_t offset = m_localTail & m_mask;
+            RingRecordHeader header{};
+            std::memcpy(&header, m_base + offset, sizeof(header));
+
+            // SEG_CMD is written by the peer process: compile-time asserts on
+            // record sizes cannot see runtime corruption, so every dispatch is
+            // preceded by these bounds checks and a violation is fatal, never a
+            // retry (plan section 6.3, runtime bounds discipline).
+            const std::uint64_t size = header.size;
+            if (size < sizeof(RingRecordHeader) || (size % kRingRecordAlignment) != 0 ||
+                size > available || offset + size > m_capacity) {
+                MGLOG_E("MG_Remote ring: corrupt record header at cursor %llu "
+                        "(kind=%u flags=0x%04X size=%u available=%llu)",
+                        static_cast<unsigned long long>(m_localTail),
+                        static_cast<unsigned>(header.kind), static_cast<unsigned>(header.flags),
+                        header.size, static_cast<unsigned long long>(available));
+                if (outCorrupt != nullptr) {
+                    *outCorrupt = true;
+                }
+                return false;
+            }
+
+            if ((header.flags & kRecPad) != 0) {
+                m_localTail += size;
+                continue;
+            }
+
+            out.kind = header.kind;
+            out.flags = header.flags;
+            out.payload = m_base + offset + sizeof(RingRecordHeader);
+            // Includes the alignment tail; the record catalogue knows the real
+            // payload length.
+            out.payloadSize = size - sizeof(RingRecordHeader);
+            out.cursor = m_localTail;
+            m_localTail += size;
+            return true;
+        }
+        return false;
+    }
+
+    void RingConsumer::PublishApplied() {
+        if (m_control == nullptr) {
+            return;
+        }
+        AppliedTail(*m_control, m_cursors).store(m_localTail, std::memory_order_release);
+    }
+
+    void RingConsumer::PublishRetired() {
+        if (m_control == nullptr) {
+            return;
+        }
+        // retiredTail must never overtake appliedTail, so publish both.
+        AppliedTail(*m_control, m_cursors).store(m_localTail, std::memory_order_release);
+        RetiredTail(*m_control, m_cursors).store(m_localTail, std::memory_order_release);
+    }
+
+    void RingConsumer::PublishRetiredUpTo(std::uint64_t cursor) {
+        if (m_control == nullptr) {
+            return;
+        }
+        const std::uint64_t applied = AppliedTail(*m_control, m_cursors).load(std::memory_order_acquire);
+        const std::uint64_t clamped = cursor > applied ? applied : cursor;
+        const std::uint64_t current = RetiredTail(*m_control, m_cursors).load(std::memory_order_relaxed);
+        if (clamped > current) {
+            RetiredTail(*m_control, m_cursors).store(clamped, std::memory_order_release);
+        }
+    }
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/Ring.h

@@ -0,0 +1,256 @@
+// MobileGL - MobileGL/MG_Remote/Transport/Ring.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// SEG_CMD / SEG_STAGE ring control and the SPSC producer/consumer over it.
+//
+// RingControl is the shared page at the head of SEG_CMD, laid out exactly as
+// the inherited transport design (plan section 8.1, referring the earlier
+// plan's section 6.2) specifies:
+//
+//   - TWO independent cursor triples, one for SEG_CMD and one for SEG_STAGE.
+//     The stage ring needs its own because "SEG_STAGE has less than a quarter
+//     left" is a publish trigger and that occupancy cannot be derived from the
+//     command ring's cursors, and because a stage slot retires on a different
+//     event than a command record does.
+//   - THREE separate sequence watermarks. Conflating them is the classic bug:
+//     appliedSeq releases *AppliedTail, submittedSeq releases staging,
+//     retiredSeq / completedFrameSerial release *RetiredTail and adopted
+//     stores.
+//   - TWO tails per ring, not one. Once the server borrows a ring slot into
+//     the GPU timeline instead of copying it out again, that slot can only be
+//     recycled after completedFrameSerial; a single tail would silently
+//     degrade to conservative reclaim the day borrowing lands.
+//   - Both park flags, because the doorbell is bidirectional: without the
+//     server->client direction every client wait degenerates into a
+//     cross-process spin on one shared cache line (a whole 16.6ms frame of a
+//     big core, on a phone, competing with the GPU and the game's JVM).
+//
+// Cursors are monotonically increasing byte counts; the ring is indexed with a
+// power-of-two mask. They are never reset, so a torn read can never look like
+// a valid earlier position. ringGeneration is bumped after a hard drain to
+// invalidate every cached offset.
+//
+// Record framing inside the ring is the 8-byte header below, which is the
+// layout the plan's RecHeader already fixes ({u16 kind, u16 flags, u32 size},
+// size including the header and a multiple of 8). The record CATALOGUE
+// (Records.def / PipeCalls.def) is a separate deliverable; the ring itself
+// only needs kind/flags/size, so it can carry the real records the day they
+// land without changing shape.
+
+#pragma once
+
+#include "../Protocol/mg_protocol_base.h"
+
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    // The shared control page. One 4 KiB page so it can be mapped alone, with
+    // each contended group on its own cache line.
+    struct alignas(4096) RingControl {
+        // ---- SEG_CMD cursors ------------------------------------------------
+        alignas(64) std::atomic<std::uint64_t> cmdHead;        // producer: bytes written
+        alignas(64) std::atomic<std::uint64_t> cmdAppliedTail; // consumer: bytes decoded/copied out
+        std::atomic<std::uint64_t> cmdRetiredTail;             // consumer: borrowed slots released
+
+        // ---- SEG_STAGE cursors ----------------------------------------------
+        alignas(64) std::atomic<std::uint64_t> stageHead;
+        alignas(64) std::atomic<std::uint64_t> stageAppliedTail;
+        std::atomic<std::uint64_t> stageRetiredTail;
+
+        // ---- sequence / frame watermarks -------------------------------------
+        alignas(64) std::atomic<std::uint64_t> appliedSeq; // records applied
+        std::atomic<std::uint64_t> submittedSeq;           // handed to the driver
+        std::atomic<std::uint64_t> retiredSeq;             // GPU finished
+        std::atomic<std::uint64_t> completedFrameSerial;
+        std::atomic<std::uint64_t> presentAckSerial;
+
+        // ---- doorbell / generation -------------------------------------------
+        alignas(64) std::atomic<std::uint32_t> serverEpoch;    // ++ on context loss / server restart
+        std::atomic<std::uint32_t> ringGeneration;             // ++ after a hard drain
+        std::atomic<std::uint32_t> consumerParked;             // server asleep, producer must ring
+        std::atomic<std::uint32_t> producerParked;             // client asleep, server must ring
+        std::atomic<std::uint32_t> eventRingFull;              // SEG_EVENT full, server stopped applying
+        std::atomic<std::uint32_t> eventDropped;               // dropped lossy events
+    };
+
+    static_assert(sizeof(RingControl) == 4096, "RingControl must be exactly one page");
+    static_assert(alignof(RingControl) == 4096, "RingControl must be page aligned");
+    static_assert(std::atomic<std::uint64_t>::is_always_lock_free,
+                  "the ring cursors are shared across processes: they must be lock-free");
+    static_assert(std::atomic<std::uint32_t>::is_always_lock_free,
+                  "the doorbell flags are shared across processes: they must be lock-free");
+
+    // Per-record header. Prefix-identical to the plan's RecHeader so the
+    // generated record catalogue drops straight in.
+    struct RingRecordHeader {
+        std::uint16_t kind;
+        std::uint16_t flags;
+        std::uint32_t size; // header + payload + alignment padding, multiple of 8
+    };
+    static_assert(sizeof(RingRecordHeader) == 8, "RecHeader is 8 bytes on the wire");
+
+    enum RingRecordFlags : std::uint16_t {
+        kRecNone = 0,
+        kRecNeedsAck = 1u << 0,
+        kRecHasBlob = 1u << 1,
+        kRecPad = 1u << 2,       // filler to the wrap boundary, no payload meaning
+        kRecBorrowSlot = 1u << 3, // slot is borrowed into the GPU timeline; retires late
+        kRecVarTail = 1u << 4,
+    };
+
+    // Reserved kind for the wrap filler. The catalogue starts at 1.
+    inline constexpr std::uint16_t kRingPadRecordKind = 0;
+
+    inline constexpr std::uint64_t kRingRecordAlignment = 8;
+
+    // Largest ring the 8-byte header can describe. Both a record's size and a
+    // wrap filler's size are bounded only by the capacity and are stored in
+    // RingRecordHeader::size, which is 32 bits by wire contract: a ring of
+    // 4 GiB or more would silently truncate them, and the consumer would then
+    // bounds-check the truncated value against the real one. SEG_CMD is 8 MiB
+    // and SEG_STAGE 32 MiB today, so this is unreachable - it is the same
+    // class of construction-time guard as the power-of-two check beside it.
+    inline constexpr std::uint64_t kMaxRingCapacity = 0xFFFFFFFFull;
+
+    // Smallest ring: two record headers. A record may be at most HALF the ring
+    // (see RingProducer::Reserve), so a ring of one header could carry nothing
+    // at all - not even the smallest record, a bare header.
+    inline constexpr std::uint64_t kMinRingCapacity = 2 * sizeof(RingRecordHeader);
+
+    // Which cursor triple a producer/consumer pair drives.
+    enum class RingCursorSet : std::uint32_t {
+        Cmd = 0,
+        Stage = 1,
+    };
+
+    // Zeroes every cursor and starts serverEpoch / ringGeneration at 1, so that
+    // a zero read is always "uninitialized", never a legal generation.
+    void InitRingControl(RingControl& control);
+
+    // head >= appliedTail >= retiredTail, and the ring never holds more than
+    // its capacity. False means the shared page is corrupt (or a peer is
+    // misbehaving), which is a Fatal{ProtocolCorruption}, never a retry.
+    bool RingCursorsValid(const RingControl& control, RingCursorSet cursors,
+                          std::uint64_t capacityBytes);
+
+    // Bumps ringGeneration, invalidating every offset either side has cached.
+    // Both sides must be quiesced and the ring fully drained
+    // (head == appliedTail == retiredTail); otherwise this returns
+    // MOBILEGL_ERR_INVALID_ARGUMENT and changes nothing.
+    MobileGLResult HardDrainRing(RingControl& control, RingCursorSet cursors);
+
+    // A record as seen by the consumer.
+    struct RingRecordView {
+        std::uint16_t kind = 0;
+        std::uint16_t flags = 0;
+        const void* payload = nullptr;
+        std::uint64_t payloadSize = 0;
+        std::uint64_t cursor = 0; // producer cursor at the START of this record
+    };
+
+    // Single producer. Not thread-safe: one writer thread, by construction.
+    class RingProducer {
+    public:
+        RingProducer() = default;
+        // `base` is the ring's byte area (NOT the control page) and
+        // `capacityBytes` must be a power of two between kMinRingCapacity and
+        // kMaxRingCapacity. Anything else leaves Valid() false.
+        RingProducer(RingControl* control, void* base, std::uint64_t capacityBytes,
+                     RingCursorSet cursors);
+
+        bool Valid() const { return m_control != nullptr; }
+
+        // Bytes still writable before the consumer has to catch up.
+        std::uint64_t FreeBytes() const;
+
+        // Reserves room for one record and returns a pointer to its payload,
+        // or nullptr when the ring is full. The payload is uninitialized;
+        // alignment padding at its tail is NOT zeroed. Emits a pad record
+        // automatically when the record would straddle the wrap boundary, so
+        // every record is contiguous.
+        //
+        // A record whose total (header + payload, rounded up to 8) exceeds
+        // MaxRecordBytes() == Capacity()/2 is refused outright, with an error
+        // log and however empty the ring is: chunking it is the emitter's job
+        // (plan section 8.2, the G3 chunking rule). Half is exact, not
+        // conservative - it is the largest record EVERY head offset can place,
+        // because a wrap pad costs at most total-8 bytes on top of the record
+        // and 2*total-8 <= capacity-8 holds exactly up to capacity/2. Above it
+        // a record is placeable at some offsets and not at others, and a
+        // producer waiting for FreeBytes() >= total stalls forever on an empty
+        // ring. So: nullptr with FreeBytes() >= total never means "wait"; it
+        // can only mean "too big, chunk".
+        void* Reserve(std::uint16_t kind, std::uint16_t flags, std::uint64_t payloadBytes);
+
+        // The largest header+payload total Reserve accepts: Capacity()/2. This
+        // is the number the emitter chunks against.
+        std::uint64_t MaxRecordBytes() const { return m_capacity / 2; }
+
+        // Makes every reserved record visible to the consumer (release store on
+        // the head cursor). Cheap: publishing per record is fine, batching 8-16
+        // only amortizes the doorbell store.
+        void Publish();
+
+        // Producer-local cursor including records not yet published.
+        std::uint64_t LocalHead() const { return m_localHead; }
+        std::uint64_t Capacity() const { return m_capacity; }
+
+    private:
+        std::uint64_t TailForReclaim() const;
+        std::uint8_t* SlotAt(std::uint64_t cursor) const {
+            return m_base + static_cast<std::size_t>(cursor & m_mask);
+        }
+
+        RingControl* m_control = nullptr;
+        std::uint8_t* m_base = nullptr;
+        std::uint64_t m_capacity = 0;
+        std::uint64_t m_mask = 0;
+        std::uint64_t m_localHead = 0;
+        RingCursorSet m_cursors = RingCursorSet::Cmd;
+    };
+
+    // Single consumer. Not thread-safe: one reader thread, by construction.
+    class RingConsumer {
+    public:
+        RingConsumer() = default;
+        RingConsumer(RingControl* control, void* base, std::uint64_t capacityBytes,
+                     RingCursorSet cursors);
+
+        bool Valid() const { return m_control != nullptr; }
+
+        // Pops the next record, skipping wrap fillers. Returns false when the
+        // ring is empty at this moment. A record whose header is impossible
+        // (size not 8-aligned, smaller than a header, or larger than what the
+        // producer has published) is refused: *outCorrupt is set, which the
+        // caller must escalate to Fatal{ProtocolCorruption} rather than retry.
+        bool Pop(RingRecordView& out, bool* outCorrupt = nullptr);
+
+        // Publishes the applied cursor, releasing those bytes to the producer.
+        void PublishApplied();
+        // Publishes the retired cursor. Records without kRecBorrowSlot retire
+        // as soon as they are applied; borrowed slots retire on
+        // completedFrameSerial, which is why this is a separate call.
+        void PublishRetired();
+        void PublishRetiredUpTo(std::uint64_t cursor);
+
+        std::uint64_t LocalTail() const { return m_localTail; }
+        std::uint64_t Capacity() const { return m_capacity; }
+
+    private:
+        RingControl* m_control = nullptr;
+        const std::uint8_t* m_base = nullptr;
+        std::uint64_t m_capacity = 0;
+        std::uint64_t m_mask = 0;
+        std::uint64_t m_localTail = 0;
+        RingCursorSet m_cursors = RingCursorSet::Cmd;
+    };
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/ShmSegment.cpp

@@ -0,0 +1,49 @@
+// MobileGL - MobileGL/MG_Remote/Transport/ShmSegment.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// Platform-independent half of ShmSegment. The create/map/close bodies live in
+// ShmSegmentPosix.cpp and ShmSegmentWin32.cpp.
+
+#include "ShmSegment.h"
+
+#include <cstring>
+#include <utility>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    ShmSegment::~ShmSegment() { Close(); }
+
+    ShmSegment::ShmSegment(ShmSegment&& other) noexcept { Steal(std::move(other)); }
+
+    ShmSegment& ShmSegment::operator=(ShmSegment&& other) noexcept {
+        if (this != &other) {
+            Close();
+            Steal(std::move(other));
+        }
+        return *this;
+    }
+
+    void ShmSegment::Steal(ShmSegment&& other) noexcept {
+        std::memcpy(m_name, other.m_name, sizeof(m_name));
+        m_mapping = other.m_mapping;
+        m_nativeHandle = other.m_nativeHandle;
+        m_size = other.m_size;
+        m_fd = other.m_fd;
+        m_readOnly = other.m_readOnly;
+
+        std::memset(other.m_name, 0, sizeof(other.m_name));
+        other.m_mapping = nullptr;
+        other.m_nativeHandle = nullptr;
+        other.m_size = 0;
+        other.m_fd = -1;
+        other.m_readOnly = false;
+    }
+
+    bool ShmSegment::Valid() const { return m_size != 0 && (m_fd >= 0 || m_nativeHandle != nullptr); }
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/ShmSegment.h

@@ -0,0 +1,87 @@
+// MobileGL - MobileGL/MG_Remote/Transport/ShmSegment.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// One shared-memory segment: SEG_CMD, SEG_STAGE, SEG_REPLY, SEG_EVENT, a
+// per-object SEG_SHADOW or a SEG_ADOPT store (inherited segment layout, plan
+// section 8.1).
+//
+// Creation matrix (earlier plan section 6.1):
+//   - Android:      ASharedMemory_create (API 26; libc's memfd_create wrapper
+//                   only appears at API 30, which is above our floor)
+//   - desktop Linux: syscall(SYS_memfd_create, ...) directly, for the same
+//                   reason - the glibc wrapper is recent and this file has to
+//                   build against old sysroots
+//   - other POSIX:  shm_open + immediate shm_unlink, the fd keeps it alive
+//   - Windows:      CreateFileMappingW in the Local\ namespace
+//
+// Transfer is NOT done here. On POSIX the fd travels by SCM_RIGHTS
+// (FdPassing.h / ITransport::ShareFd) and the name is only a debugging label;
+// on Windows the section name travels inside the SegmentRef table.
+//
+// The Windows implementation is compile-guarded and untested at the time it
+// was written: no Windows machine is a correctness gate for this project.
+
+#pragma once
+
+#include "../Protocol/mg_protocol_base.h"
+
+#include <cstddef>
+#include <cstdint>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    inline constexpr std::size_t kShmNameMax = 128;
+
+    class ShmSegment {
+    public:
+        ShmSegment() = default;
+        ~ShmSegment();
+
+        ShmSegment(const ShmSegment&) = delete;
+        ShmSegment& operator=(const ShmSegment&) = delete;
+        ShmSegment(ShmSegment&& other) noexcept;
+        ShmSegment& operator=(ShmSegment&& other) noexcept;
+
+        // Creates a segment of `size` bytes owned by this process. `nameHint`
+        // is a short debug label (Windows: part of the section name peers
+        // resolve). The segment is NOT mapped yet.
+        static MobileGLResult Create(const char* nameHint, std::uint64_t size, ShmSegment& out);
+
+        // POSIX only: adopts a descriptor received over SCM_RIGHTS. Takes
+        // ownership of `fd` on success; on failure the caller still owns it.
+        static MobileGLResult Adopt(int fd, std::uint64_t size, ShmSegment& out);
+
+        // Windows only: opens a section the peer published by name.
+        static MobileGLResult OpenNamed(const char* name, std::uint64_t size, ShmSegment& out);
+
+        // Maps the whole segment. Read-only mappings are what the peer gets for
+        // a segment it does not own (SEG_CMD/SEG_STAGE on the server side).
+        MobileGLResult Map(bool readOnly);
+        void Unmap();
+        void Close(); // unmaps and releases the descriptor/handle
+
+        bool Valid() const;
+        void* Data() const { return m_mapping; }
+        std::uint64_t Size() const { return m_size; }
+        bool MappedReadOnly() const { return m_readOnly; }
+        const char* Name() const { return m_name; }
+        // POSIX: the descriptor to hand to ShareFd. -1 on Windows.
+        int Fd() const { return m_fd; }
+
+    private:
+        void Steal(ShmSegment&& other) noexcept;
+
+        char m_name[kShmNameMax] = {};
+        void* m_mapping = nullptr;
+        void* m_nativeHandle = nullptr; // Windows HANDLE; unused on POSIX
+        std::uint64_t m_size = 0;
+        int m_fd = -1;
+        bool m_readOnly = false;
+    };
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/ShmSegmentPosix.cpp

@@ -0,0 +1,191 @@
+// MobileGL - MobileGL/MG_Remote/Transport/ShmSegmentPosix.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "ShmSegment.h"
+
+#if !defined(_WIN32)
+
+#include <MG_Util/Debug/Log.h>
+
+#include <atomic>
+#include <cerrno>
+#include <cstdio>
+#include <cstring>
+#include <fcntl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#if defined(__ANDROID__)
+#include <android/sharedmem.h>
+#elif defined(__linux__)
+#include <sys/syscall.h>
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
+#endif
+#endif
+
+namespace MobileGL::MG_Remote::Transport {
+
+    namespace {
+        void CopyName(char (&dst)[kShmNameMax], const char* src) {
+            if (src == nullptr) {
+                dst[0] = '\0';
+                return;
+            }
+            std::snprintf(dst, kShmNameMax, "%s", src);
+        }
+
+#if !defined(__ANDROID__)
+        // Unique per process; only used by the shm_open fallback, whose name
+        // must not collide with a concurrent creator's.
+        std::atomic<std::uint32_t> g_shmCounter{0};
+#endif
+    } // namespace
+
+    MobileGLResult ShmSegment::Create(const char* nameHint, std::uint64_t size, ShmSegment& out) {
+        if (size == 0) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        out.Close();
+
+        char label[kShmNameMax];
+        std::snprintf(label, sizeof(label), "mgl-%s", nameHint != nullptr ? nameHint : "seg");
+
+        int fd = -1;
+#if defined(__ANDROID__)
+        // API 26. libc's memfd_create wrapper is API 30, above MobileGL's floor.
+        fd = ASharedMemory_create(label, static_cast<size_t>(size));
+        if (fd < 0) {
+            MGLOG_W("MG_Remote shm: ASharedMemory_create(%s, %llu) failed (errno=%d)", label,
+                    static_cast<unsigned long long>(size), errno);
+        }
+#elif defined(__linux__)
+        // Raw syscall, not the glibc wrapper: the wrapper is too recent to rely
+        // on across the sysroots this builds against.
+        fd = static_cast<int>(::syscall(SYS_memfd_create, label, MFD_CLOEXEC));
+        if (fd >= 0 && ::ftruncate(fd, static_cast<off_t>(size)) != 0) {
+            MGLOG_E("MG_Remote shm: ftruncate(%llu) failed (errno=%d)",
+                    static_cast<unsigned long long>(size), errno);
+            ::close(fd);
+            fd = -1;
+        }
+#endif
+
+#if !defined(__ANDROID__)
+        if (fd < 0) {
+            // Fallback: shm_open + immediate unlink. The name disappears at
+            // once; the descriptor is what keeps the object alive and what
+            // travels by SCM_RIGHTS.
+            char shmName[kShmNameMax];
+            std::snprintf(shmName, sizeof(shmName), "/mgl-%d-%u-%s", static_cast<int>(::getpid()),
+                          g_shmCounter.fetch_add(1, std::memory_order_relaxed),
+                          nameHint != nullptr ? nameHint : "seg");
+            fd = ::shm_open(shmName, O_RDWR | O_CREAT | O_EXCL, 0600);
+            if (fd < 0) {
+                MGLOG_E("MG_Remote shm: shm_open(%s) failed (errno=%d)", shmName, errno);
+                return MOBILEGL_ERR_SHM_EXHAUSTED;
+            }
+            ::shm_unlink(shmName);
+            if (::ftruncate(fd, static_cast<off_t>(size)) != 0) {
+                MGLOG_E("MG_Remote shm: ftruncate(%llu) failed (errno=%d)",
+                        static_cast<unsigned long long>(size), errno);
+                ::close(fd);
+                return MOBILEGL_ERR_SHM_EXHAUSTED;
+            }
+            CopyName(out.m_name, shmName);
+        } else {
+            CopyName(out.m_name, label);
+        }
+#else
+        if (fd < 0) {
+            return MOBILEGL_ERR_SHM_EXHAUSTED;
+        }
+        CopyName(out.m_name, label);
+#endif
+
+        out.m_fd = fd;
+        out.m_size = size;
+        out.m_nativeHandle = nullptr;
+        out.m_mapping = nullptr;
+        out.m_readOnly = false;
+        return MOBILEGL_OK;
+    }
+
+    MobileGLResult ShmSegment::Adopt(int fd, std::uint64_t size, ShmSegment& out) {
+        if (fd < 0 || size == 0) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        // The peer's declared size is not trusted: a segment smaller than what
+        // the announcement claims would turn every later offset into an
+        // out-of-bounds map.
+        struct stat st{};
+        if (::fstat(fd, &st) == 0 && st.st_size > 0 &&
+            static_cast<std::uint64_t>(st.st_size) < size) {
+            MGLOG_E("MG_Remote shm: peer announced %llu bytes but the descriptor is %lld",
+                    static_cast<unsigned long long>(size), static_cast<long long>(st.st_size));
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        out.Close();
+        out.m_fd = fd; // ownership transferred
+        out.m_size = size;
+        out.m_nativeHandle = nullptr;
+        out.m_mapping = nullptr;
+        out.m_readOnly = false;
+        CopyName(out.m_name, "adopted");
+        return MOBILEGL_OK;
+    }
+
+    MobileGLResult ShmSegment::OpenNamed(const char*, std::uint64_t, ShmSegment&) {
+        // POSIX shares descriptors, not names.
+        return MOBILEGL_ERR_UNSUPPORTED;
+    }
+
+    MobileGLResult ShmSegment::Map(bool readOnly) {
+        if (m_fd < 0 || m_size == 0) {
+            return MOBILEGL_ERR_NOT_INITIALIZED;
+        }
+        if (m_mapping != nullptr) {
+            if (m_readOnly == readOnly) {
+                return MOBILEGL_OK;
+            }
+            Unmap();
+        }
+        const int prot = readOnly ? PROT_READ : (PROT_READ | PROT_WRITE);
+        void* addr = ::mmap(nullptr, static_cast<size_t>(m_size), prot, MAP_SHARED, m_fd, 0);
+        if (addr == MAP_FAILED) {
+            MGLOG_E("MG_Remote shm: mmap of %llu bytes failed (errno=%d)",
+                    static_cast<unsigned long long>(m_size), errno);
+            return MOBILEGL_ERR_OUT_OF_MEMORY;
+        }
+        m_mapping = addr;
+        m_readOnly = readOnly;
+        return MOBILEGL_OK;
+    }
+
+    void ShmSegment::Unmap() {
+        if (m_mapping != nullptr) {
+            ::munmap(m_mapping, static_cast<size_t>(m_size));
+            m_mapping = nullptr;
+        }
+    }
+
+    void ShmSegment::Close() {
+        Unmap();
+        if (m_fd >= 0) {
+            ::close(m_fd);
+            m_fd = -1;
+        }
+        m_size = 0;
+        m_readOnly = false;
+        m_name[0] = '\0';
+    }
+
+} // namespace MobileGL::MG_Remote::Transport
+
+#endif // !_WIN32

MobileGL/MG_Remote/Transport/ShmSegmentWin32.cpp

@@ -0,0 +1,162 @@
+// MobileGL - MobileGL/MG_Remote/Transport/ShmSegmentWin32.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// Windows half of ShmSegment: a named file-mapping section in the Local\
+// namespace, which the peer opens by the name carried in SegmentRef.
+//
+// UNTESTED. This project's Windows machine is not a correctness gate (its
+// Vulkan lacks vkCreateHeadlessSurfaceEXT and accounts for most of its
+// baseline integration failures), and the whole disaggregated build is gated
+// behind MOBILEGL_BUILD_DISAGGREGATED, which is OFF by default. It is written
+// now so the abstraction is shaped by two real platforms rather than one.
+
+#include "ShmSegment.h"
+
+#if defined(_WIN32)
+
+#include <MG_Util/Debug/Log.h>
+
+#include <atomic>
+#include <cstdio>
+#include <cstring>
+
+#ifndef WIN32_LEAN_AND_MEAN
+#define WIN32_LEAN_AND_MEAN
+#endif
+#include <windows.h>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    namespace {
+        std::atomic<std::uint32_t> g_sectionCounter{0};
+
+        bool ToWide(const char* utf8, wchar_t* out, int outChars) {
+            if (utf8 == nullptr || out == nullptr || outChars <= 0) {
+                return false;
+            }
+            const int written = ::MultiByteToWideChar(CP_UTF8, 0, utf8, -1, out, outChars);
+            return written > 0;
+        }
+    } // namespace
+
+    MobileGLResult ShmSegment::Create(const char* nameHint, std::uint64_t size, ShmSegment& out) {
+        if (size == 0) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        out.Close();
+
+        char name[kShmNameMax];
+        std::snprintf(name, sizeof(name), "Local\\mgl-%lu-%u-%s",
+                      static_cast<unsigned long>(::GetCurrentProcessId()),
+                      g_sectionCounter.fetch_add(1, std::memory_order_relaxed),
+                      nameHint != nullptr ? nameHint : "seg");
+
+        wchar_t wide[kShmNameMax];
+        if (!ToWide(name, wide, static_cast<int>(kShmNameMax))) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+
+        HANDLE section = ::CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE,
+                                              static_cast<DWORD>(size >> 32),
+                                              static_cast<DWORD>(size & 0xFFFFFFFFull), wide);
+        if (section == nullptr) {
+            MGLOG_E("MG_Remote shm: CreateFileMappingW(%s, %llu) failed (GetLastError=%lu)", name,
+                    static_cast<unsigned long long>(size),
+                    static_cast<unsigned long>(::GetLastError()));
+            return MOBILEGL_ERR_SHM_EXHAUSTED;
+        }
+        if (::GetLastError() == ERROR_ALREADY_EXISTS) {
+            ::CloseHandle(section);
+            MGLOG_E("MG_Remote shm: section name %s already exists", name);
+            return MOBILEGL_ERR_SHM_EXHAUSTED;
+        }
+
+        std::snprintf(out.m_name, kShmNameMax, "%s", name);
+        out.m_nativeHandle = section;
+        out.m_size = size;
+        out.m_fd = -1;
+        out.m_mapping = nullptr;
+        out.m_readOnly = false;
+        return MOBILEGL_OK;
+    }
+
+    MobileGLResult ShmSegment::Adopt(int, std::uint64_t, ShmSegment&) {
+        // No SCM_RIGHTS here: Windows peers resolve the section by name.
+        return MOBILEGL_ERR_UNSUPPORTED;
+    }
+
+    MobileGLResult ShmSegment::OpenNamed(const char* name, std::uint64_t size, ShmSegment& out) {
+        if (name == nullptr || name[0] == '\0' || size == 0) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        out.Close();
+
+        wchar_t wide[kShmNameMax];
+        if (!ToWide(name, wide, static_cast<int>(kShmNameMax))) {
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        HANDLE section = ::OpenFileMappingW(FILE_MAP_ALL_ACCESS, FALSE, wide);
+        if (section == nullptr) {
+            MGLOG_E("MG_Remote shm: OpenFileMappingW(%s) failed (GetLastError=%lu)", name,
+                    static_cast<unsigned long>(::GetLastError()));
+            return MOBILEGL_ERR_INVALID_ARGUMENT;
+        }
+        std::snprintf(out.m_name, kShmNameMax, "%s", name);
+        out.m_nativeHandle = section;
+        out.m_size = size;
+        out.m_fd = -1;
+        out.m_mapping = nullptr;
+        out.m_readOnly = false;
+        return MOBILEGL_OK;
+    }
+
+    MobileGLResult ShmSegment::Map(bool readOnly) {
+        if (m_nativeHandle == nullptr || m_size == 0) {
+            return MOBILEGL_ERR_NOT_INITIALIZED;
+        }
+        if (m_mapping != nullptr) {
+            if (m_readOnly == readOnly) {
+                return MOBILEGL_OK;
+            }
+            Unmap();
+        }
+        void* view = ::MapViewOfFile(static_cast<HANDLE>(m_nativeHandle),
+                                     readOnly ? FILE_MAP_READ : FILE_MAP_ALL_ACCESS, 0, 0,
+                                     static_cast<SIZE_T>(m_size));
+        if (view == nullptr) {
+            MGLOG_E("MG_Remote shm: MapViewOfFile of %llu bytes failed (GetLastError=%lu)",
+                    static_cast<unsigned long long>(m_size),
+                    static_cast<unsigned long>(::GetLastError()));
+            return MOBILEGL_ERR_OUT_OF_MEMORY;
+        }
+        m_mapping = view;
+        m_readOnly = readOnly;
+        return MOBILEGL_OK;
+    }
+
+    void ShmSegment::Unmap() {
+        if (m_mapping != nullptr) {
+            ::UnmapViewOfFile(m_mapping);
+            m_mapping = nullptr;
+        }
+    }
+
+    void ShmSegment::Close() {
+        Unmap();
+        if (m_nativeHandle != nullptr) {
+            ::CloseHandle(static_cast<HANDLE>(m_nativeHandle));
+            m_nativeHandle = nullptr;
+        }
+        m_size = 0;
+        m_readOnly = false;
+        m_name[0] = '\0';
+    }
+
+} // namespace MobileGL::MG_Remote::Transport
+
+#endif // _WIN32

MobileGL/MG_Remote/Transport/WireLog.cpp

@@ -0,0 +1,33 @@
+// MobileGL - MobileGL/MG_Remote/Transport/WireLog.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "WireLog.h"
+
+#include <MG_Util/Debug/Log.h>
+
+#include <cstdarg>
+#include <cstdio>
+
+namespace MobileGL::MG_Remote::Transport {
+
+    void WireLogError(const char* format, ...) {
+        // One stack line, no allocation: this runs on paths that have just
+        // decided the connection is unusable.
+        char line[512];
+        va_list args;
+        va_start(args, format);
+        const int written = std::vsnprintf(line, sizeof(line), format, args);
+        va_end(args);
+        if (written < 0) {
+            MGLOG_E("MG_Remote wire: unformattable diagnostic (format=%s)", format);
+            return;
+        }
+        MGLOG_E("%s", line);
+    }
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_Remote/Transport/WireLog.h

@@ -0,0 +1,38 @@
+// MobileGL - MobileGL/MG_Remote/Transport/WireLog.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// A one-function logging shim for the wire layer's header-only code.
+//
+// MG_Util/Debug/Log.h includes <Includes.h>, the GL frontend's umbrella
+// header - 661 headers, measured with `clang++ -H`. That is fine inside a
+// .cpp, and Ring.cpp / Doorbell.cpp / the transports all do it. It is not fine
+// in a header of this layer: ITransport.h states the rule ("nothing about a
+// byte pipe needs the GL frontend's umbrella header") because these headers
+// are included by both roles and by the eventual server-side binary, and
+// because the disaggregated build's include-graph purity gate (plan section
+// 10.3, gate A) asserts on `-H` output rather than on symbols. Framing.h was
+// the one header under Transport/ that broke the rule; it now calls this
+// instead, and the umbrella stays inside WireLog.cpp.
+//
+// ERROR only, deliberately. Everything routed here is a latched protocol
+// violation, never per-frame noise; non-critical wire lines use MGLOG_D from a
+// .cpp, where the INFO build compiles them out entirely.
+
+#pragma once
+
+namespace MobileGL::MG_Remote::Transport {
+
+    // Formats one line and emits it at ERROR level (MGLOG_E). printf-style,
+    // with the format checked against the arguments at compile time.
+#if defined(__GNUC__) || defined(__clang__)
+    __attribute__((format(printf, 1, 2)))
+#endif
+    void
+    WireLogError(const char* format, ...);
+
+} // namespace MobileGL::MG_Remote::Transport

MobileGL/MG_State/GLState/BufferState/BufferObject.cpp

@@ -8,6 +8,8 @@
 
 #include "BufferObject.h"
 
+#include <Config.h>
+
 #include <atomic>
 
 namespace MobileGL::MG_State::GLState {
@@ -65,6 +67,14 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::NotifyContentWrite(SizeT offset, SizeT size) {
+        if (size == 0) {
+            // An empty write moves the serial and nothing else, exactly as NotifySubData
+            // and NotifyFlushMappedRange do: it wrote no byte, so it must not promote an
+            // undefined store to "has content" - that would cost the next orphaning
+            // respecification a full-size upload of bytes the application never wrote.
+            ++m_changeSerial;
+            return;
+        }
         m_hasDefinedContent = true;
         if (m_resource.IsGpuResident()) {
             // The write already landed in coherent GPU memory; the backend has no separate
@@ -109,7 +119,10 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::Respecify(SizeT size, const void* data) {
-        ReleaseMemory();
+        // The store a live mapping wrote into is about to be replaced, so landing those
+        // bytes into it would copy a whole mapped range (an adopted arena's map is the
+        // arena) into storage the next line hands back.
+        ReleaseMemory(false);
         RedefineStorage(size);
         if (data && size > 0) {
             Memcpy(m_resource.Bytes(), data, size);
@@ -126,6 +139,7 @@ namespace MobileGL::MG_State::GLState {
         // distinguishes the two cases, and it is cleared just above.
         m_storageFlags = GL_DYNAMIC_STORAGE_BIT | GL_MAP_READ_BIT | GL_MAP_WRITE_BIT;
         NotifyRespecify();
+        TryAdoptLargeStorage();
     }
 
     void BufferObject::Resize(SizeT size) {
@@ -133,7 +147,9 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::AllocateImmutableStorage(SizeT size, const void* data, GLbitfield storageFlags) {
-        ReleaseMemory();
+        // Same as Respecify: the bytes a live mapping staged have nowhere to land, the
+        // store they belong to is being replaced.
+        ReleaseMemory(false);
         RedefineStorage(size);
         if (data) {
             Memcpy(m_resource.Bytes(), data, size);
@@ -144,6 +160,33 @@ namespace MobileGL::MG_State::GLState {
         m_isImmutableStorage = true;
         m_storageFlags = storageFlags;
         NotifyRespecify();
+        TryAdoptLargeStorage();
+    }
+
+    // Back a LARGE store with the backend's persistently+coherently mapped GPU
+    // storage the moment it is (re)defined, without waiting for the app to map it.
+    // Minecraft 26.3 streams chunk meshes into 128MB vertex arenas with plain
+    // glNamedBufferSubData - the one write API that carries no synchronization
+    // hint - and on Mali every route that hands the driver a write into a busy
+    // MUTABLE store either parks the calling thread (glBufferSubData, and
+    // glMapBufferRange even with GL_MAP_UNSYNCHRONIZED_BIT) or ghost-copies the
+    // whole destination on a driver worker (staged glCopyBufferSubData, and a
+    // range-invalidating map: ~167ms per touched arena, the recurring in-world
+    // hiccup). An adopted coherent map is the one shape with NO per-write driver
+    // call at all: every SubData lands as a plain memcpy into GPU-visible memory,
+    // and the shadow copy is dropped (a 128MB arena stops costing 128MB of RAM).
+    // Only attempted for stores the size of mesh arenas: small buffers keep the
+    // shadow model whose draw-time flush already prices them correctly.
+    void BufferObject::TryAdoptLargeStorage() {
+        constexpr SizeT kLargeBufferAdoptBytes = 16u * 1024u * 1024u;
+        if (MG_Config::Features.DisableLargeBufferAdoption) return;
+        if (m_size < kLargeBufferAdoptBytes) return;
+        if (m_resource.IsGpuResident()) return;
+        if (m_isMapped) return;
+        if (g_bufferBackendOps == nullptr || g_bufferBackendOps->AcquirePersistentMap == nullptr) return;
+        if (void* base = g_bufferBackendOps->AcquirePersistentMap(*this)) {
+            m_resource.AdoptPersistentMap(base);
+        }
     }
 
     void BufferObject::UploadData(DataPtr data, SizeT atOffset) {
@@ -160,24 +203,45 @@ namespace MobileGL::MG_State::GLState {
         m_usage = usage;
     }
 
-    void BufferObject::ReleaseMemory() {
+    void BufferObject::ReleaseMemory(Bool landStagedWrites) {
         if (!m_isMapped) return;
 
-        if (m_mappingAccess & BufferMappingAccessBit::Write) { // if we wrote to the buffer
-            // A persistent GPU-resident map wrote straight into coherent GPU memory, so
-            // there is nothing to copy back and no range to push down on unmap.
-            if (!m_resource.IsGpuResident() &&
-                !(m_mappingAccess & BufferMappingAccessBit::FlushExplicit)) { // if we didn't flush explicitly
-                if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
-                    Memcpy(m_resource.Bytes() + m_mappedRange.start, m_stagingData.data() + m_stagingBias,
-                           m_mappedRange.end - m_mappedRange.start);
+        if (landStagedWrites &&
+            (m_mappingAccess & BufferMappingAccessBit::Write)) { // if we wrote to the buffer
+            if (!(m_mappingAccess & BufferMappingAccessBit::FlushExplicit)) { // if we didn't flush explicitly
+                const SizeT mappedLength = m_mappedRange.end - m_mappedRange.start;
+                if (m_resource.IsGpuResident()) {
+                    // A persistent map of an adopted store wrote straight into coherent
+                    // GPU memory: nothing to copy back, no range to push down. A
+                    // NON-persistent write map is a different thing: the application
+                    // wrote a staging copy (glMapBuffer and glMapBufferRange hand one out
+                    // regardless of where the store lives), and GL requires those bytes
+                    // to be visible to every later command the moment glUnmapBuffer
+                    // returns. Residency used to come only from a coherent persistent
+                    // map, which never has a staging copy, so the copy-back was simply
+                    // skipped for a resident store; residency now also comes from a
+                    // shader storage binding (EnsureGpuResidentStorage at draw time) and
+                    // from large-store adoption (TryAdoptLargeStorage), both of which an
+                    // application then re-initialises through an ordinary map/write/unmap.
+                    // Skipping the copy-back dropped every one of those writes. Land the
+                    // staged bytes through the same route glBufferSubData takes into an
+                    // adopted store - the backend's flush op is for stores it keeps a
+                    // separate copy of and must not run here.
+                    if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
+                        LandBytesIntoResidentStore(m_mappedRange.start,
+                                                   {m_stagingData.data() + m_stagingBias, mappedLength});
+                    }
+                } else {
+                    if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
+                        Memcpy(m_resource.Bytes() + m_mappedRange.start, m_stagingData.data() + m_stagingBias,
+                               mappedLength);
+                    }
+                    NotifyFlushMappedRange(m_mappedRange, m_mappingAccess);
                 }
-                NotifyFlushMappedRange(m_mappedRange, m_mappingAccess);
             }
-
-            m_stagingData.clear();
         }
 
+        m_stagingData.clear();
         m_isMapped = false;
         m_mappingAccess = BufferMappingAccessBit::Null;
         m_mappedRange = {0, 0};
@@ -197,8 +261,21 @@ namespace MobileGL::MG_State::GLState {
         MOBILEGL_ASSERT(end <= m_mappedRange.end, "Flush range out of bounds: mappedRange.end (%zu) < end (%zu)",
                         m_mappedRange.end, end);
 
-        // FLUSH_EXPLICIT maps are never GPU-resident (only coherent maps are adopted), so
-        // the staged bytes must be copied into the shadow before the backend reads them.
+        // A FLUSH_EXPLICIT map can sit on an adopted store: the map itself never adopts
+        // (only a coherent persistent one does), but a shader storage binding or
+        // large-store adoption may have made the buffer resident before the map. The
+        // flushed bytes then take the same landing as any other CPU write into an
+        // adopted store - a persistent map already wrote them in place and only has
+        // to publish the change, a non-persistent map staged them and has to land
+        // them. The backend's flush op is for stores it keeps a separate copy of.
+        if (m_resource.IsGpuResident()) {
+            if (m_mappingAccess & BufferMappingAccessBit::Persistent) {
+                NotifyContentWrite(start, length);
+            } else {
+                LandBytesIntoResidentStore(start, {m_stagingData.data() + m_stagingBias + offset, length});
+            }
+            return;
+        }
         if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
             Memcpy(m_resource.Bytes() + start, m_stagingData.data() + m_stagingBias + offset, length);
         }
@@ -253,10 +330,51 @@ namespace MobileGL::MG_State::GLState {
                         "UploadSubData out of bounds: atOffset (%zu) + data.size (%zu) > m_size (%zu)", atOffset,
                         data.size, m_size);
 
+        // An adopted store's Bytes() IS the memory in-flight frames are reading, and
+        // GL orders a glBufferSubData after those already-submitted reads: the write
+        // has to take the resident landing, never a plain host write into the mapping.
+        // Shadow-backed stores need none of this: the Memcpy below touches only the
+        // shadow, and the backend's SubData op does its own ordering against in-flight
+        // work.
+        if (m_resource.IsGpuResident()) {
+            LandBytesIntoResidentStore(atOffset, data);
+            return;
+        }
+
         Memcpy(m_resource.Bytes() + atOffset, data.data, data.size);
         NotifyContentWrite(atOffset, data.size);
     }
 
+    // A backend that can land the bytes on the GPU timeline takes them here, untouched
+    // by the mapping - an in-place host write into coherent memory tore the frames
+    // still reading the old bytes (Minecraft patches LIVE chunk sections this way).
+    // The bytes are then not current in the mapping until the backend's ordered copy
+    // executes, so reads reconcile through the same gate GPU-written buffers use.
+    //
+    // Without that op the write lands in place, after retiring the GPU writes this store
+    // is known to be waiting on: a backend that defers work (DirectVulkan's frame command
+    // buffer) may still be holding a recorded-but-unsubmitted dispatch that GL orders this
+    // write AFTER, and writing the mapping now would land the bytes underneath that
+    // dispatch - its increments then execute on top of the newer data and invert the call
+    // order. That gate only knows about work that WROTE the store (MarkGpuWritten); work
+    // that merely READS it - a draw sourcing an adopted vertex arena - is not tracked here,
+    // so a backend without the op still owes the ordering against its own recorded reads.
+    // NotifyContentWrite on a resident store only bumps the serial: the backend has no
+    // separate copy to sync, so no transfer op runs.
+    void BufferObject::LandBytesIntoResidentStore(SizeT offset, DataPtr bytes) {
+        if (bytes.size > 0 && g_bufferBackendOps && g_bufferBackendOps->ResidentSubData) {
+            g_bufferBackendOps->ResidentSubData(*this, offset, bytes);
+            m_hasDefinedContent = true;
+            ++m_changeSerial;
+            m_gpuWritePending = true;
+            return;
+        }
+
+        SyncGpuWrites();
+        Memcpy(m_resource.Bytes() + offset, bytes.data, bytes.size);
+        NotifyContentWrite(offset, bytes.size);
+    }
+
     void BufferObject::FillSubData(DataPtr pattern, SizeT atOffset, SizeT size) {
         MOBILEGL_ASSERT(pattern.data != nullptr && pattern.size > 0,
                         "FillSubData requires a non-empty pattern.");
@@ -269,9 +387,29 @@ namespace MobileGL::MG_State::GLState {
                         "Cannot fill data while buffer is non-persistently mapped.");
         if (size == 0) return;
 
-        // A clear is ordered after all earlier GPU writes. Partial clears additionally need the
-        // retained shadow bytes; whole-store clears need the same synchronization before writing
-        // an adopted persistent mapping that the GPU may still be accessing.
+        // An adopted store takes the same landing as UploadSubData: the in-place write
+        // below would tear in-flight readers of the mapping. The pattern is expanded
+        // first because the landing takes the final bytes, not a repeat rule - which is
+        // why only a backend that actually takes them comes through here. Without that
+        // op the landing would memcpy the expansion into the mapping the loop below
+        // fills in place anyway, so a whole-arena clear would allocate a whole arena
+        // for nothing.
+        if (m_resource.IsGpuResident() && g_bufferBackendOps && g_bufferBackendOps->ResidentSubData) {
+            Vector<Uint8> expanded(size);
+            if (pattern.size == 1) {
+                Memset(expanded.data(), *static_cast<const Uint8*>(pattern.data), size);
+            } else {
+                for (SizeT at = 0; at < size; at += pattern.size) {
+                    Memcpy(expanded.data() + at, pattern.data, pattern.size);
+                }
+            }
+            LandBytesIntoResidentStore(atOffset, {expanded.data(), size});
+            return;
+        }
+
+        // A clear is ordered after all earlier GPU writes; partial clears additionally need
+        // the retained shadow bytes, and a resident store the backend cannot take the bytes
+        // for is written in place, which needs the same synchronization the landing does.
         SyncGpuWrites();
 
         Uint8* dst = m_resource.Bytes() + atOffset;
@@ -305,6 +443,14 @@ namespace MobileGL::MG_State::GLState {
                         size, m_size);
 
         src->SyncGpuWrites();
+        // An adopted DESTINATION takes the same landing as UploadSubData: the in-place
+        // write below would tear in-flight readers of the mapping, and pending recorded
+        // GPU writes to it must retire before the copy lands or they would execute on
+        // top of it.
+        if (m_resource.IsGpuResident()) {
+            LandBytesIntoResidentStore(dstOffset, {src->m_resource.Bytes() + srcOffset, size});
+            return;
+        }
         Memcpy(m_resource.Bytes() + dstOffset, src->m_resource.Bytes() + srcOffset, size);
         NotifyContentWrite(dstOffset, size);
     }
@@ -340,6 +486,16 @@ namespace MobileGL::MG_State::GLState {
         if (m_resource.IsGpuResident()) {
             return true;
         }
+        // Adoption releases the CPU shadow, and a live mapping may BE that shadow: a
+        // persistent map that did not itself adopt (a FLUSH_EXPLICIT one, or a read map)
+        // handed the application shadow + offset, and GL keeps that pointer valid while
+        // the buffer is drawn with - which is exactly when this runs, on the storage
+        // binding walk. Freeing it under the application is a use-after-free, so a mapped
+        // buffer keeps the shadow model until it is unmapped; the binding that follows
+        // adopts then. Same rule as TryAdoptLargeStorage.
+        if (m_isMapped) {
+            return false;
+        }
         if (m_size == 0 || g_bufferBackendOps == nullptr || g_bufferBackendOps->AcquirePersistentMap == nullptr) {
             return false;
         }
@@ -358,7 +514,20 @@ namespace MobileGL::MG_State::GLState {
         // The app is about to look at the bytes; a shader may have rewritten them since
         // the shadow was last authoritative. Also needed for a write map without an
         // invalidate bit, whose staging copy is seeded from the shadow.
-        SyncGpuWrites();
+        //
+        // One map shape looks at nothing: a non-persistent write map that discards the
+        // range it maps gets a staging copy the seeding below skips, so no reader of the
+        // store exists between here and the unmap. Reconciling an ADOPTED store would
+        // still cost the backend's full drain-and-wait (its queued landings are made
+        // visible to the CPU by finishing the pipeline), once per map, on exactly the
+        // streaming arena the adoption exists to keep cheap. The outstanding-write flag
+        // stays set, so the first read that DOES look at the bytes still pays for it.
+        const Bool discardsWhatItMaps =
+            (access & BufferMappingAccessBit::Write) && !(access & BufferMappingAccessBit::Persistent) &&
+            (access & (BufferMappingAccessBit::InvalidateRange | BufferMappingAccessBit::InvalidateBuffer));
+        if (!(m_resource.IsGpuResident() && discardsWhatItMaps)) {
+            SyncGpuWrites();
+        }
         m_isMapped = true;
         m_mappingAccess = access;
         m_mappedRange = range;

MobileGL/MG_State/GLState/BufferState/BufferObject.h

@@ -80,6 +80,19 @@ namespace MobileGL {
             void (*Respecify)(BufferObject& bufferObject) = nullptr;
             // Contents update of [offset, offset + size) from the shadow.
             void (*SubData)(BufferObject& bufferObject, SizeT offset, SizeT size) = nullptr;
+            // Contents update of an ADOPTED (GPU-resident) store. `data` holds the app's
+            // bytes, valid for the duration of the call only (a write map's staging
+            // store is freed the moment the unmap that lands it returns); the frontend
+            // has NOT touched the resident mapping. GL orders a
+            // glBufferSubData after already-submitted GPU reads of the store, and an
+            // in-place host write into the coherent mapping tears the frames still
+            // reading the old bytes (Minecraft patches LIVE chunk sections this way -
+            // the tear shows as one-frame wrong geometry/UVs during fast movement). The
+            // backend lands the bytes on the GPU timeline instead: after in-flight
+            // readers, before the next consumer. The frontend marks the buffer
+            // gpu-write-pending so reads reconcile through ReadbackFromGpu. Backends
+            // without this op keep the legacy ordered in-place host write.
+            void (*ResidentSubData)(BufferObject& bufferObject, SizeT offset, DataPtr data) = nullptr;
             // Write-map flush (glUnmapBuffer / glFlushMappedBufferRange). Carries the
             // app's real mapping flags so the backend can honour INVALIDATE_* /
             // UNSYNCHRONIZED semantics per call instead of merging them.
@@ -146,9 +159,14 @@ namespace MobileGL {
             // Adopt backend host-visible coherent GPU storage as the source of truth
             // (used for GPU-written targets like transform feedback capture, so
             // MapBuffer/GetBufferSubData read real GPU results). No-op when already
-            // resident or when the backend declines.
+            // resident, while the buffer is mapped (adoption releases the shadow a
+            // mapping may have handed the application), or when the backend declines.
             Bool EnsureGpuResidentStorage();
-            void ReleaseMemory();
+            // Unmap. A write map's staged bytes land in the store on the way out, unless
+            // the caller is about to replace that store (a respecification) and passes
+            // false - landing them there would copy a whole mapped range into storage
+            // being handed back on the next line.
+            void ReleaseMemory(Bool landStagedWrites = true);
             void FlushMemoryRange(SizeT offset, SizeT length);
 
             // Pushes the persistently-mapped write range to the backend; called by
@@ -211,6 +229,10 @@ namespace MobileGL {
             // Sizes the store for a (re)definition, renewing an adopted GPU-resident
             // mapping across it. See the definition for why the renewal is not optional.
             void RedefineStorage(SizeT size);
+            // Backend-initiated coherent adoption for mesh-arena-sized stores; see the
+            // definition for the driver behavior that makes every other write route to
+            // a busy large mutable store a frame-scale stall.
+            void TryAdoptLargeStorage();
             void NotifyRespecify();
             void NotifySubData(SizeT offset, SizeT size);
             void NotifyFlushMappedRange(Range1D range, Flags<BufferMappingAccessBit> appAccess);
@@ -219,6 +241,12 @@ namespace MobileGL {
             // so this only bumps the change serial; otherwise it dispatches a backend
             // SubData transfer to sync the backend's separate GPU copy.
             void NotifyContentWrite(SizeT offset, SizeT size);
+            // The one route CPU-sourced bytes take into an ADOPTED (GPU-resident) store:
+            // glBufferSubData, a buffer clear, a buffer copy, and the landing of a
+            // non-persistent write map at unmap / explicit flush all go through it, so
+            // the routes cannot drift apart again. Carries no mapping asserts on
+            // purpose - the unmap landing runs while the buffer is still mapped.
+            void LandBytesIntoResidentStore(SizeT offset, DataPtr bytes);
 
             static Uint64 AllocateLifetimeId();
 

MobileGL/MG_State/GLState/Core.cpp

@@ -14,6 +14,8 @@
 #include <MG_Util/ShaderTranspiler/CompileEnv.h>
 #include <Config.h>
 
+#include <atomic>
+
 namespace MobileGL::MG_State {
     void Init() {
         MGLOG_D("Initializing MobileGL State...");
@@ -1259,6 +1261,33 @@ namespace MobileGL::MG_State {
             return m_renderbufferState.ValidateRenderbufferObject(index);
         }
 
+        Uint64 GLContext::AllocateTransformFeedbackLifetimeId() {
+            // Starts at 1 so a zero-initialised backend slot can never carry a live object's id.
+            static std::atomic<Uint64> nextId{1};
+            return nextId.fetch_add(1, std::memory_order_relaxed);
+        }
+
+        GLContext::GLContext() {
+            // The default transform feedback object (name 0) exists from the start of the context
+            // (GL 4.6 core 13.2.1), but nothing binds it, so nothing else would materialise it.
+            // Materialising it here is what lets GetBoundTransformFeedbackLifetimeId() be a plain
+            // const read instead of an operator[] insert on the draw path.
+            m_boundTransformFeedbackLifetimeId = m_transformFeedbackObjects[0].lifetimeId;
+        }
+
+        Bool GLContext::HasOpenTransformFeedbackSpan(Uint64 lifetimeId) const {
+            if (lifetimeId == 0) return false;
+            for (const auto& [name, object] : m_transformFeedbackObjects) {
+                if (object.lifetimeId != lifetimeId) continue;
+                // The bound object's span state is live in the context; its saved copy is only
+                // written when a bind swaps it out.
+                return name == m_boundTransformFeedback ? m_transformFeedbackActive : object.active;
+            }
+            // No object carries this identity any more: it was deleted, and a deleted object can
+            // never resume.
+            return false;
+        }
+
         void GLContext::SaveBoundTransformFeedbackState() {
             auto& object = m_transformFeedbackObjects[m_boundTransformFeedback];
             for (Uint i = 0; i < MAX_TRANSFORM_FEEDBACK_BUFFERS; ++i) {
@@ -1295,6 +1324,9 @@ namespace MobileGL::MG_State {
             m_transformFeedbackGeneration = object.generation;
             m_transformFeedbackCapturedVertices = object.capturedVertices;
             m_transformFeedbackInputPrimitives = object.inputPrimitives;
+            // Every route that changes which object is bound - BindTransformFeedbackObject and the
+            // revert a delete of the bound object performs - comes through here.
+            m_boundTransformFeedbackLifetimeId = object.lifetimeId;
         }
 
         void GLContext::GenTransformFeedbackNames(Uint number, Vector<Uint>& ids) {

MobileGL/MG_State/GLState/Core.h

@@ -60,7 +60,7 @@ namespace MobileGL {
 
             class GLContext {
             public:
-                GLContext() = default;
+                GLContext();
 
                 // Error
                 void RecordError(ErrorCode code, UniquePtr<ErrorInfo> info);
@@ -427,6 +427,27 @@ namespace MobileGL {
                 void BindTransformFeedbackObject(Uint index);
                 void MarkTransformFeedbackObjectForDeletion(Uint index);
                 Uint GetBoundTransformFeedbackName() const { return m_boundTransformFeedback; }
+                // The bound object's never-reused identity, for a backend that keys a per-object
+                // resource on it. The NAME is not an identity: glGenTransformFeedbacks recycles a
+                // deleted one (LIFO), so a memo keyed on the name hands a brand-new object the dead
+                // one's slot. Cached rather than looked up on demand: the backend asks twice per
+                // captured draw, and an operator[] on m_transformFeedbackObjects would be an
+                // INSERT on the draw path - ska::flat_hash_map invalidates every reference into
+                // itself when it rehashes. The cache is refreshed by
+                // RestoreBoundTransformFeedbackState, which every bind (and the revert a delete
+                // performs) goes through, and seeded for the default object by the constructor.
+                // Never returns 0 - the counter starts at 1 so a zero-initialised memo slot cannot
+                // be mistaken for a live object.
+                Uint64 GetBoundTransformFeedbackLifetimeId() const { return m_boundTransformFeedbackLifetimeId; }
+                // Whether the object carrying this identity still has an OPEN capture span - one
+                // that glBeginTransformFeedback started and glEndTransformFeedback has not closed,
+                // paused or not. A backend that hands out a bounded set of per-object slots must
+                // never take one of these over: a paused span's counters are precisely what its
+                // resume reads, and GL only lets other objects capture WHILE it is paused, so the
+                // paused object is also the one that looks idle. An identity no live object
+                // carries any more (its object was deleted) answers false, which is what makes
+                // such a slot reclaimable.
+                Bool HasOpenTransformFeedbackSpan(Uint64 lifetimeId) const;
                 // Vertices the object captured in its last completed span; the vertex count
                 // glDrawTransformFeedback replays.
                 Uint64 GetTransformFeedbackRecordedVertices(Uint index) const;
@@ -514,6 +535,9 @@ namespace MobileGL {
                 GLuint m_conditionalRenderQuery = 0;
                 GLenum m_conditionalRenderMode = GL_NONE;
 
+                // Process-wide, never-reused. See GetBoundTransformFeedbackLifetimeId(); same
+                // contract as BufferObject::AllocateLifetimeId().
+                static Uint64 AllocateTransformFeedbackLifetimeId();
                 // Everything a transform feedback object owns while it is NOT the bound one.
                 struct TransformFeedbackObjectState {
                     struct SavedBufferBinding {
@@ -532,6 +556,10 @@ namespace MobileGL {
                     Uint64 recordedVertices = 0;
                     Bool hasCompletedSpan = false;
                     Bool everBound = false;
+                    // Assigned by the default member initialiser, so every way an object comes into
+                    // being - operator[] materialisation, `= {}` in Gen/Create - gets a fresh one,
+                    // and a recycled NAME never brings the dead object's id back with it.
+                    Uint64 lifetimeId = AllocateTransformFeedbackLifetimeId();
                 };
                 void SaveBoundTransformFeedbackState();
                 void RestoreBoundTransformFeedbackState();
@@ -540,6 +568,10 @@ namespace MobileGL {
                 UnorderedMap<Uint, TransformFeedbackObjectState> m_transformFeedbackObjects;
                 IndexGenerator<Uint> m_transformFeedbackNames;
                 Uint m_boundTransformFeedback = 0;
+                // Mirror of m_transformFeedbackObjects[m_boundTransformFeedback].lifetimeId, so
+                // the per-draw read is a load rather than a hash lookup that could insert.
+                // Seeded by the constructor and rewritten by RestoreBoundTransformFeedbackState.
+                Uint64 m_boundTransformFeedbackLifetimeId = 0;
                 // Map membership is object EXISTENCE, which is not the same as the answer
                 // glIsProgramPipeline gives: any command that needs somewhere to put state
                 // materializes a reserved name, so the object can exist well before it is

MobileGL/MG_State/GLState/FramebufferState/FramebufferObject.h

@@ -11,6 +11,7 @@
 #include <Includes.h>
 #include <MG_State/GLState/TextureState/TextureObject.h>
 #include <MG_State/GLState/RenderbufferState/RenderbufferObject.h>
+#include <MG_Pipe/MGPipeValueTypes.h>
 
 namespace MobileGL {
     enum class FramebufferTarget {
@@ -103,7 +104,7 @@ namespace MobileGL {
 
         class FramebufferObject {
         public:
-            static constexpr Uint MAX_DRAW_BUFFERS = 8;
+            static constexpr Uint MAX_DRAW_BUFFERS = MobileGL::kMGMaxDrawBuffers;
 
             using TargetEnum = FramebufferTarget;
             using FramebufferAttachmentObjectArray =

MobileGL/MG_State/GLState/ProgramState/ProgramArtifacts.h

@@ -0,0 +1,576 @@
+// MobileGL - MobileGL/MG_State/GLState/ProgramState/ProgramArtifacts.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h> // String/Vector/Array/UnorderedMap/SharedPtr + GL enums. DEBT NOTE (MGPipeTypes.h:24-31 style):
+                      // Includes.h:80-84 still pulls glslang and :59 spirv_cross_c.h; this header is glslang-free BY
+                      // SYMBOL (what P7's `nm -D | grep glslang` measures), not by preprocessed text. A textually
+                      // glslang-free closure needs MG_Util/Types.h split off Includes.h (Types.h:11 includes it
+                      // back) - out of scope for P0.5.
+#include <set>        // std::set<String> (LinkArtifacts); NOT provided by Includes.h on its own terms
+// PURITY: no ShaderObject.h, no SpvcSession.h, nothing under MG_Util/ShaderTranspiler/, no Config.h,
+// no MG_Backend/, no BufferState/. scripts/check_include_closure.py probe "artifacts-header" (ROADMAP P0.5;
+// ARCHITECTURE.md:260) asserts that closure. The glslang scope token appears exactly twice below (B.0 D5: the two
+// glslang-typed LinkArtifacts members moved verbatim) and the gate pins that count.
+
+namespace MobileGL::MG_State::GLState {
+    // Sentinel for a uniform location without global-UBO backing storage (should not
+    // survive linking: GenerateBinary falls back to tail-allocated scratch storage).
+    // Namespace scope so SpirvArtifacts::reservedNumSamplesOffset can default to it;
+    // ProgramObject::kInvalidUniformOffset is defined from this one.
+    inline constexpr Uint kInvalidUniformOffset = ~0u;
+
+    // Everything the query surface ever asked a glslang TType, flattened. Twenty
+    // predicates, no recursion: nothing post-link ever walks a struct, a type name or the
+    // AST, so a POD covers the whole surface exactly.
+    struct TypeFacts {
+        Bool isArray = false;
+        // A runtime-sized array (a storage block's unsized trailing member) is an array
+        // that is NOT sized; GL_ARRAY_SIZE reports 0 for it.
+        Bool isSizedArray = false;
+        Bool isMatrix = false;
+        Bool isVector = false;
+        Bool isOpaque = false;
+        Bool isTexture = false;
+        Bool isImage = false;
+        Bool isDouble = false;   // getBasicType() == EbtDouble
+        Bool isVoid = false;     // getBasicType() == EbtVoid (hidden block members)
+        Bool isBuffer = false;   // getQualifier().storage == EvqBuffer
+        Bool isPatch = false;    // getQualifier().patch
+        Bool hasIndex = false;   // getQualifier().hasIndex()
+        Bool hasFormat = false;  // getQualifier().hasFormat()
+        Int vectorSize = 0;
+        Int matrixCols = 0;
+        Int matrixRows = 0;
+        Int layoutIndex = 0;     // getQualifier().layoutIndex
+        Uint layoutFormat = 0;   // getQualifier().getFormat()
+        // glslang TLayoutMatrix, widened. For a uniform this is already RESOLVED against
+        // the owning block's qualifier, so the getUniformBlock() fallback the old
+        // accessors carried is gone.
+        Int layoutMatrix = 0;
+        // glslang TBasicType, widened - ApplyUniformInitialValues and the typed
+        // glGetUniform* paths compare against a handful of enumerators.
+        Int basicType = 0;
+    };
+
+    // One glslang TObjectReflection, flattened. Used for uniforms, blocks, pipe inputs
+    // and pipe outputs alike, because glslang reflects all four as TObjectReflection.
+    struct ResourceReflection {
+        String name;
+        GLenum glDefineType = 0;
+        Int offset = -1;
+        // TObjectReflection::size, RAW. For a uniform prefer `arraySize` below, which is
+        // the resolved GL_UNIFORM_SIZE answer.
+        Int size = 0;
+        // TObjectReflection::index - for a uniform, the TPROGRAM block index owning it
+        // (-1 for a default-block one; translate with GlBlockIndexFromTProgram).
+        Int index = -1;
+        Int counterIndex = -1;
+        Int arrayStride = 0;
+        Int topLevelArraySize = 0;
+        Int topLevelArrayStride = 0;
+        Int binding = -1;
+        Int location = -1; // layoutLocation()
+        // EShLanguageMask of the stages that reference it; 0 means "declared but read by
+        // nobody", which is what the dead-default-block-uniform filter tests.
+        Uint32 stages = 0;
+        // GL_UNIFORM_SIZE / GL_ARRAY_SIZE, already resolved through the
+        // isSizedArray()/getOuterArraySize()/size fallback.
+        GLint arraySize = 1;
+        TypeFacts type;
+    };
+
+    using UniformReflection = ResourceReflection;
+    using BlockReflection = ResourceReflection;
+    using PipeInputReflection = ResourceReflection;
+    using PipeOutputReflection = ResourceReflection;
+
+    // Transform feedback (GL 3.0 core: glTransformFeedbackVaryings applies on
+    // the NEXT link; the linked snapshot below is what draws and queries see).
+    struct XfbVarying {
+        String name;
+        GLenum type = GL_FLOAT;
+        GLint size = 1;           // array element count
+        Uint32 bufferIndex = 0;   // capture buffer slot
+        Uint32 offsetBytes = 0;   // offset within the capture buffer
+        Uint32 byteSize = 0;      // bytes captured per vertex for this varying
+        // Offset within the gap-free record a backend that cannot express the GL
+        // layout captures into; see NeedsScatteredTransformFeedbackCapture.
+        Uint32 packedOffsetBytes = 0;
+
+        // GL 4.6 core 11.1.2.1 / 7.3.1.1: a member of an output interface block is
+        // captured under "<block name>.<member>". `name` keeps that GL spelling (it is
+        // what the interface queries and the ESSL backend's driver-side capture list
+        // need, since SPIRV-Cross re-emits the block under its own type name), while
+        // the three fields below carry what a SPIR-V backend needs instead: the
+        // decoration target is the block's *instance* variable and the member index
+        // inside it. blockMemberIndex < 0 means "not a block member".
+        String blockInstanceName;
+        String blockName;
+        Int blockMemberIndex = -1;
+        // Which element of an arrayed block member this capture names, -1 for "the
+        // member as a whole". SPIR-V cannot decorate a single array element, so a
+        // backend needs the element index to tell a full run from a partial one.
+        Int blockMemberElement = -1;
+    };
+
+    // ---- P1: everything a link PRODUCES, in one movable block ----
+    //
+    // The membership rule is mechanical, not editorial: this is exactly the field list
+    // ResetLinkArtifacts() clears (plus the four it forgot to - infoLog,
+    // linkedFragDataLocation/Index and the geometry strip-capture pair - which are just
+    // as much link output). Nothing else belongs here.
+    //
+    // Why a struct: once glLinkProgram runs on a worker (P1 stage 4) the worker writes
+    // its OWN LinkArtifacts and the GL thread publishes it with a single move, instead
+    // of thirty cross-thread field assignments. Until then this is a pure refactor.
+    //
+    // Access rule (invariant I5): the member below is private and reachable ONLY
+    // through ProgramObject::Artifacts(), which calls EnsureLinkJoined() first. That is
+    // what makes "every read of link output joins the pending link" a property the
+    // compiler checks rather than a review item - a new reader cannot spell the field
+    // without going through the gate. m_artifacts lives in ProgramObject and is private
+    // there; the type being namespace-scope changes nothing about that gate.
+    // ---- the owned mirror of glslang's reflection ----
+    //
+    // WHY THIS EXISTS. Every GL query about a linked program used to be answered by
+    // asking the live glslang TProgram - program->getUniform(i).getType()->isMatrix()
+    // and friends. That made the TProgram part of the program's PERMANENT state, which
+    // in turn made the whole front end (parse + link) unskippable: the L1 shader
+    // translation memo could hand back the SPIR-V but the reflection still had to be
+    // rebuilt from a freshly parsed AST.
+    //
+    // These three tables are a snapshot of everything the query surface ever reads off
+    // the TProgram, in PLAIN OWNED VALUES - no TType*, no TString, nothing pointing into
+    // a glslang pool. Taken once at the tail of DoReflection (SnapshotGlslangReflection),
+    // they are copyable, immutable after the link, and safe to memoize and share between
+    // ProgramObjects and threads. Once they are filled, `program` is dead weight to
+    // everything except DoReflection itself.
+    //
+    // INDEXED BY TPROGRAM INDEX, deliberately: that is the space uniformIndexInTProgram,
+    // glUniformIndexToTProgram and tProgramUniformIndexToGl already speak, so every
+    // accessor that used to call program->getUniform(i) indexes uniformReflection[i]
+    // instead, unchanged in every other respect.
+
+    struct LinkArtifacts {
+        // Live only between LinkProgram() and the end of DoReflection. Everything after
+        // that reads the owned mirror below; a link served from the L1 memo never
+        // constructs one at all, so this is null for such a program and MUST NOT be
+        // dereferenced outside DoReflection.
+        SharedPtr<glslang::TProgram> program;
+
+        // The owned reflection snapshot. Indexed by TProgram index; see the structs above.
+        Vector<UniformReflection> uniformReflection;
+        Vector<BlockReflection> blockReflection;
+        Vector<PipeInputReflection> pipeInputReflection;
+        Vector<PipeOutputReflection> pipeOutputReflection;
+        // Program-level scalars glslang answers off the linked intermediates.
+        // Whether the program's LAST stage is the fragment stage. A color number - and so a
+        // color index - exists only there; a separable tess/geometry/vertex program's
+        // outputs are varyings and must report -1 (KHR-GL43.program_interface_query.
+        // separate-programs-tess-control).
+        Bool lastStageIsFragment = false;
+        Array<GLuint, 3> computeLocalSize{};
+        // Replaces program->getUniformIndex(name). Maps the reflected name to its
+        // TProgram uniform index.
+        UnorderedMap<String, Int> uniformIndexByName;
+
+        // Attributes (Vertex in)
+        Vector<String> attribs;
+        Vector<GLenum> attribTypes;
+
+        // FragData (Frag out): the per-link snapshot of the explicit request maps.
+        UnorderedMap<String, Uint> linkedFragDataLocation;
+        UnorderedMap<String, Uint> linkedFragDataIndex;
+
+        // GL-facing index spaces (see the translation helpers above): GL active-uniform
+        // index <-> glslang TProgram uniform index, GL uniform-block index <-> TProgram
+        // block index. -1 marks a TProgram entry GL does not expose (dead default-block
+        // uniforms swept into MGL_GLOBAL_UBO by the relaxed parse, and that block itself).
+        Vector<Int> glUniformIndexToTProgram;
+        Vector<Int> tProgramUniformIndexToGl;
+        Vector<Int> glBlockIndexToTProgram;
+        Vector<Int> tProgramBlockIndexToGl;
+        // GL_UNIFORM_BLOCK index space: ACTUAL uniform blocks only, a strict subsequence of
+        // glBlockIndexToTProgram above.
+        //
+        // That list is the BLOCK space - everything the relaxed parse produced except
+        // MGL_GLOBAL_UBO - and it is what the backends walk and what every block-keyed table
+        // here (uniformBlockBinding, uniformBlockIndexByName, blockReflection ordering) is
+        // indexed by. It is NOT the GL uniform-block list: MobileGL does not pass
+        // EShReflectionSeparateBuffers to buildReflection, so glslang routes BUFFER blocks
+        // through indexToUniformBlock too, and the list therefore also carries every shader
+        // storage block and every synthesized gl_AtomicCounterBlock_N. GL 4.6 core 7.6 gives
+        // those their own enumerations (GL_SHADER_STORAGE_BLOCK and
+        // GL_ACTIVE_ATOMIC_COUNTER_BUFFERS respectively), and GL_ACTIVE_UNIFORM_BLOCKS /
+        // glGetActiveUniformBlock*/glGetUniformBlockIndex must not see either.
+        //
+        // Kept as a SECOND space rather than filtering the first in place: DirectGLES assigns
+        // one ESSL uniform-buffer binding point per entry of the block list as it walks it
+        // (Managers.cpp CacheResourceLocations and the matching per-draw loop in
+        // DirectGLES.cpp), so compacting that list would renumber every backend binding
+        // point, and tProgramBlockIndexToGl[i] < 0 is what DoReflection and
+        // BuildGlobalUboRouting read as "member of the synthesized global UBO".
+        Vector<Int> glUniformBlockIndexToBlock; // GL uniform-block index -> block index
+        Vector<Int> blockIndexToGlUniformBlock; // block index -> GL uniform-block index (-1)
+        // Per-link merged snapshot of the layout(location = N) qualifiers the attached
+        // shaders' default-block uniforms declared, as glslang recorded them at the point
+        // its relaxed remap dropped them (the relaxed parse drops them from reflection; the
+        // DoReflection assigner restores them from here).
+        UnorderedMap<String, Int> linkedExplicitUniformLocations;
+        // Per-link snapshot of the default-block uniform INITIALIZERS the attached shaders
+        // declared ("uniform int i = 1;"). Desktop GLSL says that value is what the uniform
+        // reads until the application overwrites it, and relinking restores it - but the
+        // relaxed parse turns those uniforms into members of MGL_GLOBAL_UBO, where SPIR-V
+        // cannot carry an initializer, so the value only survives as this side-channel.
+        // Applied into the uniform shadow at the phase-B publish (ApplyUniformInitialValues).
+        Vector<glslang::TIntermediate::TUniformInitializer> uniformInitialValues;
+        UnorderedMap<String, Uint> uniformLocations;
+        // ---- "written since link" (see MarkUniformWrittenAtLocation) ----
+        // In LinkArtifacts deliberately: a link is exactly the event that retracts every
+        // write (GL resets uniforms to their initial values), so living here means the set
+        // is cleared by the same three paths that clear the rest of a link's output -
+        // Link()'s whole-struct reset, ResetLinkArtifacts, and the publish's move - and no
+        // fourth reset site can be forgotten. Empty (and never allocated) for a program
+        // that never asked to be separable.
+        Vector<Uint64> writtenUniformLocationBits;
+        Vector<Uint64> writtenUniformIndexBits;
+        Vector<Uint> writtenUniformIndices;
+        // Ordered by location,
+        // aka. uniformIndexInTProgram[loc] == "uniform index of TProgram at location `loc`"
+        Vector<Int> uniformIndexInTProgram;
+        // ditto. Will be set at glUniform1i
+        Vector<Int> uniformSamplerOrImageUnitIndex;
+        // Sampler/image layout(binding = N) initial texture/image units, captured by
+        // TMglGlslIoResolver at mapIO's collect callback - the last point at which the
+        // qualifier still says what the shader declared. An OUTPUT of the link, not an
+        // input to it: nothing supplies this map, the resolver fills it.
+        UnorderedMap<String, Uint> explicitOpaqueUniformBindings;
+
+        // Ordered by uniform block index
+        // index is DIFFERENT from binding!!!
+        //
+        // Let's define UniformBlockIndex == the order at glslang getUniformBlock()
+        // aka `i = glGetUniformBlockIndex(prog, "BlockName")` implies:
+        // `prog->getUniformBlock(i) == "BlockName"`
+        // These stuff are present for GL semantics, not for backend inspection
+        // These may change after-link (because GL spec decided to have `glUniformBlockBinding`)
+        UnorderedMap<String, Uint> uniformBlockIndexByName;
+        Vector<Int> uniformBlockBinding;
+        // glShaderStorageBlockBinding overrides, keyed by GL block name. See
+        // SetShaderStorageBlockBinding for why this one is by name and not by index.
+        //
+        // ALSO SEEDED AT LINK, by ProgramLinkTask::SeedDefaultStorageBlockBindings, with the
+        // GL-mandated binding 0 for every storage block whose shader declared no
+        // layout(binding = N). Those blocks have no other way to be told apart from a block
+        // that declared one: glslang's IO mapper invents a binding and writes it into the
+        // qualifier, so the reflection reports the invention. A seed is therefore "GL's
+        // default binding for this block", and a later glShaderStorageBlockBinding simply
+        // overwrites it - default and rebind travel one path.
+        UnorderedMap<String, Int> shaderStorageBlockBinding;
+        // Block type names of the storage blocks the program's shaders declared with NO
+        // layout(binding = N). Input to the seeding above; filled during mapIO by
+        // TMglGlslIoResolver, which is the last observer that can still tell a declared
+        // binding from an invented one - and, unlike the per-shader lexer this replaced,
+        // sees the declaration with its macros expanded.
+        std::set<String> storageBlocksWithoutBinding;
+        // The same list for UNIFORM blocks, and it is needed for the same reason: glslang's
+        // auto-mapper assigns every uniform block a binding whether or not the shader asked
+        // for one, so uniformBlockBinding below cannot tell "declared 1" from "invented 1".
+        // GL 4.6 core 7.6.2 requires an unqualified block to report ZERO.
+        std::set<String> uniformBlocksWithoutBinding;
+
+        Uint activeUniformCount = 0;
+        // This program's fragment stage read gl_NumSamples, so the source pipeline lowered it
+        // onto the reserved default-block uniform (ShaderTranspiler::NUM_SAMPLES_UNIFORM_NAME)
+        // and the draw path owes it the draw framebuffer's sample count before every draw.
+        //
+        // PHASE A on purpose, even though the byte offset it needs is phase-B output: the
+        // gate has to be answerable without joining the SPIR-V job, or every draw of every
+        // program would pay a join to discover it has nothing to write.
+        Bool usesReservedNumSamples = false;
+        Uint maxUniformLocation = 0;
+        Int uniformNameMaxLength = 0;
+        Int attribInNameMaxLength = 0;
+        Int uniformBlockNameMaxLength = 0;
+
+        String infoLog;
+        Bool linkStatus = false;
+
+        // Transform feedback: the linked snapshot (the request lives outside, on the
+        // GL-thread-owned side).
+        Vector<XfbVarying> xfbVaryings;
+        // The glTransformFeedbackVaryings request list exactly as this link consumed it,
+        // INCLUDING the gl_NextBuffer / gl_SkipComponentsN pseudo-varyings that
+        // xfbVaryings deliberately drops (they steer the capture layout and must never
+        // reach a backend's varying list). GL_TRANSFORM_FEEDBACK_VARYING enumerates the
+        // full request, pseudo-varyings and all, so the interface query needs its own copy.
+        Vector<String> xfbInterfaceNames;
+        Vector<Uint32> xfbStrides;
+        Vector<Uint32> gsStripTriangles;
+        Bool gsStripCaptureFixup = false;
+        GLenum gsInputPrimitive = GL_NONE;
+        // GL_TESS_CONTROL_OUTPUT_VERTICES: the `layout(vertices = N) out` of the linked
+        // tessellation control stage, or 0 when the program has none. Checked against
+        // GL_MAX_PATCH_VERTICES at link (GL 4.6 core 11.2.1.1).
+        Int tcsOutputVertices = 0;
+        // The rest of the geometry stage's link properties, and the tessellation evaluation
+        // stage's. Every one of these is a glGetProgramiv answer that had no source at all:
+        // the query surface listed the geometry pnames only to fall through to
+        // GL_INVALID_ENUM, and the GL_TESS_GEN_* pnames were not mentioned anywhere. They
+        // come from the linked intermediates for the same reason gsInputPrimitive and
+        // tcsOutputVertices do - glslang has already merged the compilation units' layout
+        // qualifiers and diagnosed contradictions, so the linked program is the thing that
+        // knows.
+        GLenum gsOutputPrimitive = GL_NONE;
+        Int gsMaxVertices = 0;
+        Int gsInvocations = 0;
+        // The tessellation evaluation stage's layout: GL_QUADS / GL_TRIANGLES / GL_ISOLINES,
+        // GL_EQUAL / GL_FRACTIONAL_EVEN / GL_FRACTIONAL_ODD, GL_CW / GL_CCW, and point mode.
+        GLenum tessGenMode = GL_NONE;
+        GLenum tessGenSpacing = GL_NONE;
+        GLenum tessGenVertexOrder = GL_NONE;
+        Bool tessGenPointMode = false;
+        GLenum xfbBufferMode = GL_INTERLEAVED_ATTRIBS;
+        Int xfbVaryingNameMaxLength = 0;
+        Bool xfbNeedsScatteredCapture = false;
+        Uint32 xfbPackedStride = 0;
+    };
+
+    // ---- everything phase B of a link produces, in one movable block ----
+    //
+    // The membership rule is the same mechanical one LinkArtifacts uses: this is exactly
+    // what ProgramSpirvTask writes, which is what makes moving it THE publish. It is
+    // deliberately NOT part of LinkArtifacts, and that separation is what routes the five
+    // readers of SPIR-V-derived data through their own join gate by compiler rather than
+    // by review - m_spirv is private and Spirv() is the only spelling that reaches it.
+    //
+    // Why these three and nothing else: `generatedSpirv` has no GL-thread reader at all
+    // (every consumer is a backend draw/prepare path), and `uniformOffsets` +
+    // `globalUboScratch` are the ONLY things glUniform*/glGetUniform* need that are
+    // derived from the OPTIMIZED SPIR-V rather than from glslang reflection - spirv-opt
+    // runs in place and can delete a uniform, or the whole global UBO, so the offsets
+    // cannot be lifted out of glslang's reflection instead.
+    struct SpirvArtifacts {
+        Vector<Vector<unsigned>> generatedSpirv;
+        Bool enableSpirvValidation = false;
+        // Byte offset of each uniform location inside globalUboScratch, or
+        // kInvalidUniformOffset. Sized maxUniformLocation + 1 by the routing pass.
+        Vector<Uint> uniformOffsets;
+        Vector<Uint8> globalUboScratch;
+        // Byte offset of the reserved gl_NumSamples stand-in inside globalUboScratch, or
+        // kInvalidUniformOffset. Taken by NAME from the SPIR-V metadata rather than through
+        // uniformOffsets, because the member has no GL location at all: the link task keeps
+        // it out of the GL-visible uniform index space so no application can see or write it.
+        Uint reservedNumSamplesOffset = kInvalidUniformOffset;
+        // False for a program whose SPIR-V was never produced (phase B cancelled at
+        // teardown or by a relink) or whose optimizer run failed. GL has no way to
+        // retract a LINK_STATUS it already reported true, so such a program stays
+        // "linked" and every reflection answer it has given stays correct - it is simply
+        // not drawable, which the backends already express through their link-status
+        // gates.
+        Bool spirvStatus = false;
+        // Whether these modules KEPT their 64-bit floats instead of being narrowed to 32
+        // (ShaderTranspiler::DemoteFloat64Pass). Decided per PROGRAM, never per module - the
+        // global UBO is one buffer all stages read, so two stages disagreeing about whether a
+        // `uniform double` occupies 4 or 8 bytes would put every uniform after it at a
+        // different offset in each. Recorded here rather than re-derived from the backend
+        // because it is the layout THESE modules were built with: it is what the routing
+        // table's offsets mean, and glUniform*d / glGetUniform*v have to write and read the
+        // width the shader actually declares.
+        Bool nativeFloat64 = false;
+        // Whether gl_PointSize was demoted out of THESE modules' tessellation/geometry
+        // stages into an ordinary varying (ShaderCompiler::
+        // DemoteTessellationGeometryPointSizeForProgram) because the backend cannot host
+        // the built-in there. Per PROGRAM by construction - a consumer whose producer
+        // kept the built-in would read garbage - and recorded here rather than
+        // re-derived because it cannot be: the rewrite's whole point is that the final
+        // bytes no longer declare the capability that armed it. The backends read it to
+        // respell a "gl_PointSize" transform-feedback capture as the carrier
+        // (ShaderCompiler::POINT_SIZE_CAPTURE_CARRIER_NAME). The GL reflection surface
+        // deliberately keeps answering "gl_PointSize": demotion happens after phase A,
+        // so every query keeps the truthful GL spelling.
+        Bool pointSizeDemoted = false;
+    };
+
+    // ---- the archive field tables (ARCHITECTURE.md:259): ONE table per type, serving both directions ----
+    //
+    // Visitor contract: v(const char* name, Field&) - Field is const when Self is const, so a
+    // single table serves the serializer (const) and the deserializer (non-const); `Self`
+    // deduces either. A visitor recurses into TypeFacts / ResourceReflection / XfbVarying by
+    // calling VisitFields on the element it was handed; the tables never recurse themselves.
+    //
+    // Free constrained templates rather than members so the struct bodies above stay a verbatim
+    // move. The sizeof trip wires below are what keep these tables honest: a member added to a
+    // struct changes its size, trips the assertion, and the message sends the author here.
+    template <class Self, class V>
+        requires std::same_as<std::remove_const_t<Self>, TypeFacts>
+    void VisitFields(Self& a, V&& v) {
+        v("isArray", a.isArray);
+        v("isSizedArray", a.isSizedArray);
+        v("isMatrix", a.isMatrix);
+        v("isVector", a.isVector);
+        v("isOpaque", a.isOpaque);
+        v("isTexture", a.isTexture);
+        v("isImage", a.isImage);
+        v("isDouble", a.isDouble);
+        v("isVoid", a.isVoid);
+        v("isBuffer", a.isBuffer);
+        v("isPatch", a.isPatch);
+        v("hasIndex", a.hasIndex);
+        v("hasFormat", a.hasFormat);
+        v("vectorSize", a.vectorSize);
+        v("matrixCols", a.matrixCols);
+        v("matrixRows", a.matrixRows);
+        v("layoutIndex", a.layoutIndex);
+        v("layoutFormat", a.layoutFormat);
+        v("layoutMatrix", a.layoutMatrix);
+        v("basicType", a.basicType);
+    } // 20 fields
+
+    template <class Self, class V>
+        requires std::same_as<std::remove_const_t<Self>, ResourceReflection>
+    void VisitFields(Self& a, V&& v) {
+        v("name", a.name);
+        v("glDefineType", a.glDefineType);
+        v("offset", a.offset);
+        v("size", a.size);
+        v("index", a.index);
+        v("counterIndex", a.counterIndex);
+        v("arrayStride", a.arrayStride);
+        v("topLevelArraySize", a.topLevelArraySize);
+        v("topLevelArrayStride", a.topLevelArrayStride);
+        v("binding", a.binding);
+        v("location", a.location);
+        v("stages", a.stages);
+        v("arraySize", a.arraySize);
+        v("type", a.type); // visited as a value; the visitor recurses with VisitFields(a.type, v) if it wants to
+    } // 14 fields
+
+    template <class Self, class V>
+        requires std::same_as<std::remove_const_t<Self>, XfbVarying>
+    void VisitFields(Self& a, V&& v) {
+        v("name", a.name);
+        v("type", a.type);
+        v("size", a.size);
+        v("bufferIndex", a.bufferIndex);
+        v("offsetBytes", a.offsetBytes);
+        v("byteSize", a.byteSize);
+        v("packedOffsetBytes", a.packedOffsetBytes);
+        v("blockInstanceName", a.blockInstanceName);
+        v("blockName", a.blockName);
+        v("blockMemberIndex", a.blockMemberIndex);
+        v("blockMemberElement", a.blockMemberElement);
+    } // 11 fields
+
+    // Every member EXCEPT `program`: it is null for every archived instance by construction
+    // (ProgramTranslationCache.h asserts that at insert) and must never be serialized - it is
+    // the live glslang TProgram that only DoReflection may touch. 57 of the 58 members.
+    template <class Self, class V>
+        requires std::same_as<std::remove_const_t<Self>, LinkArtifacts>
+    void VisitFields(Self& a, V&& v) {
+        v("uniformReflection", a.uniformReflection);
+        v("blockReflection", a.blockReflection);
+        v("pipeInputReflection", a.pipeInputReflection);
+        v("pipeOutputReflection", a.pipeOutputReflection);
+        v("lastStageIsFragment", a.lastStageIsFragment);
+        v("computeLocalSize", a.computeLocalSize);
+        v("uniformIndexByName", a.uniformIndexByName);
+        v("attribs", a.attribs);
+        v("attribTypes", a.attribTypes);
+        v("linkedFragDataLocation", a.linkedFragDataLocation);
+        v("linkedFragDataIndex", a.linkedFragDataIndex);
+        v("glUniformIndexToTProgram", a.glUniformIndexToTProgram);
+        v("tProgramUniformIndexToGl", a.tProgramUniformIndexToGl);
+        v("glBlockIndexToTProgram", a.glBlockIndexToTProgram);
+        v("tProgramBlockIndexToGl", a.tProgramBlockIndexToGl);
+        v("glUniformBlockIndexToBlock", a.glUniformBlockIndexToBlock);
+        v("blockIndexToGlUniformBlock", a.blockIndexToGlUniformBlock);
+        v("linkedExplicitUniformLocations", a.linkedExplicitUniformLocations);
+        v("uniformInitialValues", a.uniformInitialValues);
+        v("uniformLocations", a.uniformLocations);
+        v("writtenUniformLocationBits", a.writtenUniformLocationBits);
+        v("writtenUniformIndexBits", a.writtenUniformIndexBits);
+        v("writtenUniformIndices", a.writtenUniformIndices);
+        v("uniformIndexInTProgram", a.uniformIndexInTProgram);
+        v("uniformSamplerOrImageUnitIndex", a.uniformSamplerOrImageUnitIndex);
+        v("explicitOpaqueUniformBindings", a.explicitOpaqueUniformBindings);
+        v("uniformBlockIndexByName", a.uniformBlockIndexByName);
+        v("uniformBlockBinding", a.uniformBlockBinding);
+        v("shaderStorageBlockBinding", a.shaderStorageBlockBinding);
+        v("storageBlocksWithoutBinding", a.storageBlocksWithoutBinding);
+        v("uniformBlocksWithoutBinding", a.uniformBlocksWithoutBinding);
+        v("activeUniformCount", a.activeUniformCount);
+        v("usesReservedNumSamples", a.usesReservedNumSamples);
+        v("maxUniformLocation", a.maxUniformLocation);
+        v("uniformNameMaxLength", a.uniformNameMaxLength);
+        v("attribInNameMaxLength", a.attribInNameMaxLength);
+        v("uniformBlockNameMaxLength", a.uniformBlockNameMaxLength);
+        v("infoLog", a.infoLog);
+        v("linkStatus", a.linkStatus);
+        v("xfbVaryings", a.xfbVaryings);
+        v("xfbInterfaceNames", a.xfbInterfaceNames);
+        v("xfbStrides", a.xfbStrides);
+        v("gsStripTriangles", a.gsStripTriangles);
+        v("gsStripCaptureFixup", a.gsStripCaptureFixup);
+        v("gsInputPrimitive", a.gsInputPrimitive);
+        v("tcsOutputVertices", a.tcsOutputVertices);
+        v("gsOutputPrimitive", a.gsOutputPrimitive);
+        v("gsMaxVertices", a.gsMaxVertices);
+        v("gsInvocations", a.gsInvocations);
+        v("tessGenMode", a.tessGenMode);
+        v("tessGenSpacing", a.tessGenSpacing);
+        v("tessGenVertexOrder", a.tessGenVertexOrder);
+        v("tessGenPointMode", a.tessGenPointMode);
+        v("xfbBufferMode", a.xfbBufferMode);
+        v("xfbVaryingNameMaxLength", a.xfbVaryingNameMaxLength);
+        v("xfbNeedsScatteredCapture", a.xfbNeedsScatteredCapture);
+        v("xfbPackedStride", a.xfbPackedStride);
+    } // 57 fields (58 members minus `program`)
+
+    template <class Self, class V>
+        requires std::same_as<std::remove_const_t<Self>, SpirvArtifacts>
+    void VisitFields(Self& a, V&& v) {
+        v("generatedSpirv", a.generatedSpirv);
+        v("enableSpirvValidation", a.enableSpirvValidation);
+        v("uniformOffsets", a.uniformOffsets);
+        v("globalUboScratch", a.globalUboScratch);
+        v("reservedNumSamplesOffset", a.reservedNumSamplesOffset);
+        v("spirvStatus", a.spirvStatus);
+        v("nativeFloat64", a.nativeFloat64);
+        v("pointSizeDemoted", a.pointSizeDemoted);
+    } // 8 fields
+
+    // ---- trip wires ----
+    // TypeFacts is a POD on every ABI: 13 Bool + 3 bytes of padding + 7 x 4-byte scalars.
+    static_assert(std::is_trivially_copyable_v<TypeFacts> && sizeof(TypeFacts) == 44,
+                  "TypeFacts changed: add the field to VisitFields(TypeFacts) (and its serializer when one exists), then update this number");
+    // The container-bearing structs have one size per standard library (std::string and
+    // std::set differ between libstdc++ and libc++), so their numbers are pinned PER STL:
+    // libstdc++ (the Linux CI toolchain) here, libc++ (the NDK) by the integrator, MSVC
+    // unasserted. ProgramArtifactsTest records every sizeof as a ctest property on every
+    // platform, which is where a new toolchain's numbers are read from.
+#if defined(__GLIBCXX__) && !defined(_GLIBCXX_DEBUG) && (SIZE_MAX == UINT64_MAX)
+#define MGL_RESOURCEREFLECTION_SIZE 128
+#define MGL_XFBVARYING_SIZE 128
+#define MGL_LINKARTIFACTS_SIZE 1056
+#define MGL_SPIRVARTIFACTS_SIZE 88
+#elif defined(_LIBCPP_VERSION) && (SIZE_MAX == UINT64_MAX) && defined(MGL_ARTIFACT_SIZES_LIBCXX_PINNED)
+    // The integrator pins these from the NDK build (brief C.4); until then this branch is inert.
+#endif
+#ifdef MGL_LINKARTIFACTS_SIZE
+    static_assert(sizeof(ResourceReflection) == MGL_RESOURCEREFLECTION_SIZE,
+                  "ResourceReflection changed size: add the field to VisitFields(ResourceReflection) (and its serializer when one exists), then update this number");
+    static_assert(sizeof(XfbVarying) == MGL_XFBVARYING_SIZE,
+                  "XfbVarying changed size: add the field to VisitFields(XfbVarying) (and its serializer when one exists), then update this number");
+    static_assert(sizeof(LinkArtifacts) == MGL_LINKARTIFACTS_SIZE,
+                  "LinkArtifacts changed size: add the field to VisitFields(LinkArtifacts) (and its serializer when one exists), then update this number");
+    static_assert(sizeof(SpirvArtifacts) == MGL_SPIRVARTIFACTS_SIZE,
+                  "SpirvArtifacts changed size: add the field to VisitFields(SpirvArtifacts) (and its serializer when one exists), then update this number");
+#endif
+} // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.cpp

@@ -517,7 +517,9 @@ namespace MobileGL::MG_State::GLState {
         };
     } // namespace
 
-    void ProgramLinkTask::DeferLog(String line) { diagnostics.logLines.push_back(Move(line)); }
+    void ProgramLinkTask::DeferLog(String line, const Int level) {
+        diagnostics.logLines.push_back({level, Move(line)});
+    }
 
     void ProgramLinkTask::SubmitAfter(const Vector<SharedPtr<ShaderCompileTask>>& deps) {
         // +1 for the guard this function releases itself. Without it, a dependency that
@@ -855,6 +857,18 @@ namespace MobileGL::MG_State::GLState {
         spirvHandoff.reflection.uniformReflection = artifacts.uniformReflection;
         spirvHandoff.reflection.blockReflection = artifacts.blockReflection;
         spirvHandoff.reflection.tProgramBlockIndexToGl = artifacts.tProgramBlockIndexToGl;
+        // The capture set is NOT part of that slice (see the handoff's own comment), and the
+        // point-size demotion needs exactly one bit out of it: whether anything asked to
+        // capture gl_PointSize. Derived here, where ResolveTransformFeedbackVaryings has
+        // just filled artifacts.xfbVaryings and before the join moves them away, because a
+        // capture stage that only READS the built-in still has to declare the carrier the
+        // capture binds to - and phase B has no other way to learn that.
+        for (const ProgramObject::XfbVarying& varying : artifacts.xfbVaryings) {
+            if (varying.name == "gl_PointSize") {
+                spirvHandoff.captureRequestsPointSize = true;
+                break;
+            }
+        }
         // Phase B pairs this with its own SpirvArtifacts to insert the completed front end.
         // A COPY, because the GL-thread join moves `artifacts` out of this node before phase B
         // runs - and with the TProgram dropped, because a memo must never hold a glslang arena.
@@ -896,6 +910,11 @@ namespace MobileGL::MG_State::GLState {
         // env snapshot ProgramSpirvTask hands the chain, so the key and the bytes can never
         // disagree.
         keyInputs.nativeFloat64 = env.ConsumesFloat64Natively();
+        // The second and third capability bits, under exactly the same rule: each arms a
+        // phase-B rewrite of the cached modules (the point-size demotion), read from the
+        // same env snapshot that phase B will consult, so key and bytes cannot disagree.
+        keyInputs.demoteTessellationPointSize = env.DemotesTessellationPointSize();
+        keyInputs.demoteGeometryPointSize = env.DemotesGeometryPointSize();
         keyInputs.stages.reserve(in.shaders.size());
         for (const LinkShaderInput& shader : in.shaders) {
             const ShaderCompileArtifacts& compiled = CompiledArtifacts(shader.compiled);

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.h

@@ -117,6 +117,19 @@ namespace MobileGL::MG_State::GLState {
             // for phase B after the join has moved `artifacts` away.
             ProgramObject::LinkArtifacts reflection;
 
+            // Whether the RESOLVED transform-feedback capture set names gl_PointSize - the
+            // one fact about `artifacts.xfbVaryings` phase B needs, carried as a derived
+            // bool rather than by widening the slice above, which is deliberately the five
+            // (now eight) fields BuildGlobalUboRouting consumes and nothing else.
+            //
+            // It has to be here and cannot be re-derived: the point-size demotion forces the
+            // capture-capable stage to declare its carrier even when that stage never WRITES
+            // the built-in (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram's
+            // `captureRequestsPointSize`), and by phase B the only record of the request is
+            // this bit. No new L1 key material: the key already covers
+            // `requestedXfbVaryings`, of which this is a function.
+            Bool captureRequestsPointSize = false;
+
             // L1 shader-translation memo key for this program's SPIR-V (see
             // MG_Util/ShaderTranspiler/TranslationCache.h). Built HERE, at the tail of phase
             // A, and not by phase B - two reasons, both structural:
@@ -201,8 +214,10 @@ namespace MobileGL::MG_State::GLState {
         // Worker-side MGLOG replacement: appended to diagnostics.logLines and replayed by the
         // join, on the GL thread, where a serial implementation would have printed it.
         // Logging straight from a worker interleaves mid-line with the GL thread's output and
-        // lands out of order relative to the glLinkProgram that caused it.
-        void DeferLog(String line);
+        // lands out of order relative to the glLinkProgram that caused it. `level` is the
+        // severity the replay uses; DEBUG (the default) is compiled out of every shipped
+        // build, so a line that has to survive one names its own.
+        void DeferLog(String line, Int level = MOBILEGL_LOG_LEVEL_DEBUG);
 
         // Counts down to zero exactly once. Starts at deps + 1: the extra guard is released
         // by SubmitAfter itself, so a dependency that settles while the edges are still being

MobileGL/MG_State/GLState/ProgramState/ProgramObject.h

@@ -9,9 +9,9 @@
 #pragma once
 #include <Includes.h>
 #include "ShaderObject.h"
+#include "ProgramArtifacts.h"
 
 #include <MG_Util/Metrics/BufferMetrics.h>
-#include <MG_Util/ShaderTranspiler/SpvcSession.h>
 
 namespace MobileGL::MG_State::GLState {
     // The link job. Only ever held by SharedPtr here, so a forward declaration is enough -
@@ -38,70 +38,19 @@ namespace MobileGL::MG_State::GLState {
         // 1024 GL 4.3 requires.
         static constexpr Int MAX_UNIFORM_LOCATIONS = static_cast<Int>(glslang::TQualifier::layoutLocationEnd);
 
-        // Everything the query surface ever asked a glslang::TType, flattened. Twenty
-        // predicates, no recursion: nothing post-link ever walks a struct, a type name or the
-        // AST, so a POD covers the whole surface exactly.
-        struct TypeFacts {
-            Bool isArray = false;
-            // A runtime-sized array (a storage block's unsized trailing member) is an array
-            // that is NOT sized; GL_ARRAY_SIZE reports 0 for it.
-            Bool isSizedArray = false;
-            Bool isMatrix = false;
-            Bool isVector = false;
-            Bool isOpaque = false;
-            Bool isTexture = false;
-            Bool isImage = false;
-            Bool isDouble = false;   // getBasicType() == EbtDouble
-            Bool isVoid = false;     // getBasicType() == EbtVoid (hidden block members)
-            Bool isBuffer = false;   // getQualifier().storage == EvqBuffer
-            Bool isPatch = false;    // getQualifier().patch
-            Bool hasIndex = false;   // getQualifier().hasIndex()
-            Bool hasFormat = false;  // getQualifier().hasFormat()
-            Int vectorSize = 0;
-            Int matrixCols = 0;
-            Int matrixRows = 0;
-            Int layoutIndex = 0;     // getQualifier().layoutIndex
-            Uint layoutFormat = 0;   // getQualifier().getFormat()
-            // glslang::TLayoutMatrix, widened. For a uniform this is already RESOLVED against
-            // the owning block's qualifier, so the getUniformBlock() fallback the old
-            // accessors carried is gone.
-            Int layoutMatrix = 0;
-            // glslang::TBasicType, widened - ApplyUniformInitialValues and the typed
-            // glGetUniform* paths compare against a handful of enumerators.
-            Int basicType = 0;
-        };
-
-        // One glslang::TObjectReflection, flattened. Used for uniforms, blocks, pipe inputs
-        // and pipe outputs alike, because glslang reflects all four as TObjectReflection.
-        struct ResourceReflection {
-            String name;
-            GLenum glDefineType = 0;
-            Int offset = -1;
-            // TObjectReflection::size, RAW. For a uniform prefer `arraySize` below, which is
-            // the resolved GL_UNIFORM_SIZE answer.
-            Int size = 0;
-            // TObjectReflection::index - for a uniform, the TPROGRAM block index owning it
-            // (-1 for a default-block one; translate with GlBlockIndexFromTProgram).
-            Int index = -1;
-            Int counterIndex = -1;
-            Int arrayStride = 0;
-            Int topLevelArraySize = 0;
-            Int topLevelArrayStride = 0;
-            Int binding = -1;
-            Int location = -1; // layoutLocation()
-            // EShLanguageMask of the stages that reference it; 0 means "declared but read by
-            // nobody", which is what the dead-default-block-uniform filter tests.
-            Uint32 stages = 0;
-            // GL_UNIFORM_SIZE / GL_ARRAY_SIZE, already resolved through the
-            // isSizedArray()/getOuterArraySize()/size fallback.
-            GLint arraySize = 1;
-            TypeFacts type;
-        };
-
-        using UniformReflection = ResourceReflection;
-        using BlockReflection = ResourceReflection;
-        using PipeInputReflection = ResourceReflection;
+        // The five reflection/artifact types live at namespace scope in ProgramArtifacts.h
+        // (P0.5). Re-exported here so every existing spelling (ProgramObject::LinkArtifacts,
+        // ProgramObject::TypeFacts, ...) compiles unchanged. Fully qualified on the right-hand
+        // side on purpose: an unqualified `TypeFacts` would name the alias being declared.
+        using TypeFacts            = MobileGL::MG_State::GLState::TypeFacts;
+        using ResourceReflection   = MobileGL::MG_State::GLState::ResourceReflection;
+        using UniformReflection    = ResourceReflection;
+        using BlockReflection      = ResourceReflection;
+        using PipeInputReflection  = ResourceReflection;
         using PipeOutputReflection = ResourceReflection;
+        using XfbVarying           = MobileGL::MG_State::GLState::XfbVarying;
+        using LinkArtifacts        = MobileGL::MG_State::GLState::LinkArtifacts;
+        using SpirvArtifacts       = MobileGL::MG_State::GLState::SpirvArtifacts;
 
         ProgramObject(Uint externalIndex) : m_externalIndex(externalIndex), m_lifetimeId(AllocateLifetimeId()) {}
         // Cancel-not-join, exactly like ~ShaderObject: the link job owns its inputs, so an
@@ -544,7 +493,7 @@ namespace MobileGL::MG_State::GLState {
         }
         // Sentinel for a uniform location without global-UBO backing storage (should not
         // survive linking: GenerateBinary falls back to tail-allocated scratch storage).
-        static constexpr Uint kInvalidUniformOffset = ~0u;
+        static constexpr Uint kInvalidUniformOffset = MobileGL::MG_State::GLState::kInvalidUniformOffset;
         // PHASE B (joins the SPIR-V job; see EnsureSpirvJoined).
         //
         // BOUNDS-CHECKED, and that is not defensive padding - it is the load-bearing half of
@@ -603,6 +552,11 @@ namespace MobileGL::MG_State::GLState {
         // other question about the global UBO's layout - and it is one: it decides how wide a
         // `double` uniform's slot is.
         Bool UsesNativeFloat64() const { return Spirv().nativeFloat64; }
+        // Whether gl_PointSize was demoted out of this program's tessellation/geometry
+        // modules into the ordinary carrier varying. Joins phase B: it is a fact about the
+        // generated modules, and its readers (the backends' capture-name respelling) already
+        // hold the phase-B join.
+        Bool PointSizeDemoted() const { return Spirv().pointSizeDemoted; }
         SizeT GetUniformStorageSpanInBytes(Uint location) const {
             return UniformStorageSpanInBytes(GetUniformTypeFacts(location), GetUniformSizesInBytes(location),
                                              UsesNativeFloat64());
@@ -1136,301 +1090,6 @@ namespace MobileGL::MG_State::GLState {
             return it == m_shaders.end() ? -1 : (Int)std::distance(m_shaders.begin(), it);
         }
 
-        // Transform feedback (GL 3.0 core: glTransformFeedbackVaryings applies on
-        // the NEXT link; the linked snapshot below is what draws and queries see).
-        struct XfbVarying {
-            String name;
-            GLenum type = GL_FLOAT;
-            GLint size = 1;           // array element count
-            Uint32 bufferIndex = 0;   // capture buffer slot
-            Uint32 offsetBytes = 0;   // offset within the capture buffer
-            Uint32 byteSize = 0;      // bytes captured per vertex for this varying
-            // Offset within the gap-free record a backend that cannot express the GL
-            // layout captures into; see NeedsScatteredTransformFeedbackCapture.
-            Uint32 packedOffsetBytes = 0;
-
-            // GL 4.6 core 11.1.2.1 / 7.3.1.1: a member of an output interface block is
-            // captured under "<block name>.<member>". `name` keeps that GL spelling (it is
-            // what the interface queries and the ESSL backend's driver-side capture list
-            // need, since SPIRV-Cross re-emits the block under its own type name), while
-            // the three fields below carry what a SPIR-V backend needs instead: the
-            // decoration target is the block's *instance* variable and the member index
-            // inside it. blockMemberIndex < 0 means "not a block member".
-            String blockInstanceName;
-            String blockName;
-            Int blockMemberIndex = -1;
-            // Which element of an arrayed block member this capture names, -1 for "the
-            // member as a whole". SPIR-V cannot decorate a single array element, so a
-            // backend needs the element index to tell a full run from a partial one.
-            Int blockMemberElement = -1;
-        };
-
-        // ---- P1: everything a link PRODUCES, in one movable block ----
-        //
-        // The membership rule is mechanical, not editorial: this is exactly the field list
-        // ResetLinkArtifacts() clears (plus the four it forgot to - infoLog,
-        // linkedFragDataLocation/Index and the geometry strip-capture pair - which are just
-        // as much link output). Nothing else belongs here.
-        //
-        // Why a struct: once glLinkProgram runs on a worker (P1 stage 4) the worker writes
-        // its OWN LinkArtifacts and the GL thread publishes it with a single move, instead
-        // of thirty cross-thread field assignments. Until then this is a pure refactor.
-        //
-        // Access rule (invariant I5): the member below is private and reachable ONLY
-        // through ProgramObject::Artifacts(), which calls EnsureLinkJoined() first. That is
-        // what makes "every read of link output joins the pending link" a property the
-        // compiler checks rather than a review item - a new reader cannot spell the field
-        // without going through the gate.
-        // ---- the owned mirror of glslang's reflection ----
-        //
-        // WHY THIS EXISTS. Every GL query about a linked program used to be answered by
-        // asking the live glslang::TProgram - program->getUniform(i).getType()->isMatrix()
-        // and friends. That made the TProgram part of the program's PERMANENT state, which
-        // in turn made the whole front end (parse + link) unskippable: the L1 shader
-        // translation memo could hand back the SPIR-V but the reflection still had to be
-        // rebuilt from a freshly parsed AST.
-        //
-        // These three tables are a snapshot of everything the query surface ever reads off
-        // the TProgram, in PLAIN OWNED VALUES - no TType*, no TString, nothing pointing into
-        // a glslang pool. Taken once at the tail of DoReflection (SnapshotGlslangReflection),
-        // they are copyable, immutable after the link, and safe to memoize and share between
-        // ProgramObjects and threads. Once they are filled, `program` is dead weight to
-        // everything except DoReflection itself.
-        //
-        // INDEXED BY TPROGRAM INDEX, deliberately: that is the space uniformIndexInTProgram,
-        // glUniformIndexToTProgram and tProgramUniformIndexToGl already speak, so every
-        // accessor that used to call program->getUniform(i) indexes uniformReflection[i]
-        // instead, unchanged in every other respect.
-
-        struct LinkArtifacts {
-            // Live only between LinkProgram() and the end of DoReflection. Everything after
-            // that reads the owned mirror below; a link served from the L1 memo never
-            // constructs one at all, so this is null for such a program and MUST NOT be
-            // dereferenced outside DoReflection.
-            SharedPtr<glslang::TProgram> program;
-
-            // The owned reflection snapshot. Indexed by TProgram index; see the structs above.
-            Vector<UniformReflection> uniformReflection;
-            Vector<BlockReflection> blockReflection;
-            Vector<PipeInputReflection> pipeInputReflection;
-            Vector<PipeOutputReflection> pipeOutputReflection;
-            // Program-level scalars glslang answers off the linked intermediates.
-            // Whether the program's LAST stage is the fragment stage. A color number - and so a
-            // color index - exists only there; a separable tess/geometry/vertex program's
-            // outputs are varyings and must report -1 (KHR-GL43.program_interface_query.
-            // separate-programs-tess-control).
-            Bool lastStageIsFragment = false;
-            Array<GLuint, 3> computeLocalSize{};
-            // Replaces program->getUniformIndex(name). Maps the reflected name to its
-            // TProgram uniform index.
-            UnorderedMap<String, Int> uniformIndexByName;
-
-            // Attributes (Vertex in)
-            Vector<String> attribs;
-            Vector<GLenum> attribTypes;
-
-            // FragData (Frag out): the per-link snapshot of the explicit request maps.
-            UnorderedMap<String, Uint> linkedFragDataLocation;
-            UnorderedMap<String, Uint> linkedFragDataIndex;
-
-            // GL-facing index spaces (see the translation helpers above): GL active-uniform
-            // index <-> glslang TProgram uniform index, GL uniform-block index <-> TProgram
-            // block index. -1 marks a TProgram entry GL does not expose (dead default-block
-            // uniforms swept into MGL_GLOBAL_UBO by the relaxed parse, and that block itself).
-            Vector<Int> glUniformIndexToTProgram;
-            Vector<Int> tProgramUniformIndexToGl;
-            Vector<Int> glBlockIndexToTProgram;
-            Vector<Int> tProgramBlockIndexToGl;
-            // GL_UNIFORM_BLOCK index space: ACTUAL uniform blocks only, a strict subsequence of
-            // glBlockIndexToTProgram above.
-            //
-            // That list is the BLOCK space - everything the relaxed parse produced except
-            // MGL_GLOBAL_UBO - and it is what the backends walk and what every block-keyed table
-            // here (uniformBlockBinding, uniformBlockIndexByName, blockReflection ordering) is
-            // indexed by. It is NOT the GL uniform-block list: MobileGL does not pass
-            // EShReflectionSeparateBuffers to buildReflection, so glslang routes BUFFER blocks
-            // through indexToUniformBlock too, and the list therefore also carries every shader
-            // storage block and every synthesized gl_AtomicCounterBlock_N. GL 4.6 core 7.6 gives
-            // those their own enumerations (GL_SHADER_STORAGE_BLOCK and
-            // GL_ACTIVE_ATOMIC_COUNTER_BUFFERS respectively), and GL_ACTIVE_UNIFORM_BLOCKS /
-            // glGetActiveUniformBlock*/glGetUniformBlockIndex must not see either.
-            //
-            // Kept as a SECOND space rather than filtering the first in place: DirectGLES assigns
-            // one ESSL uniform-buffer binding point per entry of the block list as it walks it
-            // (Managers.cpp CacheResourceLocations and the matching per-draw loop in
-            // DirectGLES.cpp), so compacting that list would renumber every backend binding
-            // point, and tProgramBlockIndexToGl[i] < 0 is what DoReflection and
-            // BuildGlobalUboRouting read as "member of the synthesized global UBO".
-            Vector<Int> glUniformBlockIndexToBlock; // GL uniform-block index -> block index
-            Vector<Int> blockIndexToGlUniformBlock; // block index -> GL uniform-block index (-1)
-            // Per-link merged snapshot of the layout(location = N) qualifiers the attached
-            // shaders' default-block uniforms declared, as glslang recorded them at the point
-            // its relaxed remap dropped them (the relaxed parse drops them from reflection; the
-            // DoReflection assigner restores them from here).
-            UnorderedMap<String, Int> linkedExplicitUniformLocations;
-            // Per-link snapshot of the default-block uniform INITIALIZERS the attached shaders
-            // declared ("uniform int i = 1;"). Desktop GLSL says that value is what the uniform
-            // reads until the application overwrites it, and relinking restores it - but the
-            // relaxed parse turns those uniforms into members of MGL_GLOBAL_UBO, where SPIR-V
-            // cannot carry an initializer, so the value only survives as this side-channel.
-            // Applied into the uniform shadow at the phase-B publish (ApplyUniformInitialValues).
-            Vector<glslang::TIntermediate::TUniformInitializer> uniformInitialValues;
-            UnorderedMap<String, Uint> uniformLocations;
-            // ---- "written since link" (see MarkUniformWrittenAtLocation) ----
-            // In LinkArtifacts deliberately: a link is exactly the event that retracts every
-            // write (GL resets uniforms to their initial values), so living here means the set
-            // is cleared by the same three paths that clear the rest of a link's output -
-            // Link()'s whole-struct reset, ResetLinkArtifacts, and the publish's move - and no
-            // fourth reset site can be forgotten. Empty (and never allocated) for a program
-            // that never asked to be separable.
-            Vector<Uint64> writtenUniformLocationBits;
-            Vector<Uint64> writtenUniformIndexBits;
-            Vector<Uint> writtenUniformIndices;
-            // Ordered by location,
-            // aka. uniformIndexInTProgram[loc] == "uniform index of TProgram at location `loc`"
-            Vector<Int> uniformIndexInTProgram;
-            // ditto. Will be set at glUniform1i
-            Vector<Int> uniformSamplerOrImageUnitIndex;
-            // Sampler/image layout(binding = N) initial texture/image units, captured by
-            // TMglGlslIoResolver at mapIO's collect callback - the last point at which the
-            // qualifier still says what the shader declared. An OUTPUT of the link, not an
-            // input to it: nothing supplies this map, the resolver fills it.
-            UnorderedMap<String, Uint> explicitOpaqueUniformBindings;
-
-            // Ordered by uniform block index
-            // index is DIFFERENT from binding!!!
-            //
-            // Let's define UniformBlockIndex == the order at glslang getUniformBlock()
-            // aka `i = glGetUniformBlockIndex(prog, "BlockName")` implies:
-            // `prog->getUniformBlock(i) == "BlockName"`
-            // These stuff are present for GL semantics, not for backend inspection
-            // These may change after-link (because GL spec decided to have `glUniformBlockBinding`)
-            UnorderedMap<String, Uint> uniformBlockIndexByName;
-            Vector<Int> uniformBlockBinding;
-            // glShaderStorageBlockBinding overrides, keyed by GL block name. See
-            // SetShaderStorageBlockBinding for why this one is by name and not by index.
-            //
-            // ALSO SEEDED AT LINK, by ProgramLinkTask::SeedDefaultStorageBlockBindings, with the
-            // GL-mandated binding 0 for every storage block whose shader declared no
-            // layout(binding = N). Those blocks have no other way to be told apart from a block
-            // that declared one: glslang's IO mapper invents a binding and writes it into the
-            // qualifier, so the reflection reports the invention. A seed is therefore "GL's
-            // default binding for this block", and a later glShaderStorageBlockBinding simply
-            // overwrites it - default and rebind travel one path.
-            UnorderedMap<String, Int> shaderStorageBlockBinding;
-            // Block type names of the storage blocks the program's shaders declared with NO
-            // layout(binding = N). Input to the seeding above; filled during mapIO by
-            // TMglGlslIoResolver, which is the last observer that can still tell a declared
-            // binding from an invented one - and, unlike the per-shader lexer this replaced,
-            // sees the declaration with its macros expanded.
-            std::set<String> storageBlocksWithoutBinding;
-            // The same list for UNIFORM blocks, and it is needed for the same reason: glslang's
-            // auto-mapper assigns every uniform block a binding whether or not the shader asked
-            // for one, so uniformBlockBinding below cannot tell "declared 1" from "invented 1".
-            // GL 4.6 core 7.6.2 requires an unqualified block to report ZERO.
-            std::set<String> uniformBlocksWithoutBinding;
-
-            Uint activeUniformCount = 0;
-            // This program's fragment stage read gl_NumSamples, so the source pipeline lowered it
-            // onto the reserved default-block uniform (ShaderTranspiler::NUM_SAMPLES_UNIFORM_NAME)
-            // and the draw path owes it the draw framebuffer's sample count before every draw.
-            //
-            // PHASE A on purpose, even though the byte offset it needs is phase-B output: the
-            // gate has to be answerable without joining the SPIR-V job, or every draw of every
-            // program would pay a join to discover it has nothing to write.
-            Bool usesReservedNumSamples = false;
-            Uint maxUniformLocation = 0;
-            Int uniformNameMaxLength = 0;
-            Int attribInNameMaxLength = 0;
-            Int uniformBlockNameMaxLength = 0;
-
-            String infoLog;
-            Bool linkStatus = false;
-
-            // Transform feedback: the linked snapshot (the request lives outside, on the
-            // GL-thread-owned side).
-            Vector<XfbVarying> xfbVaryings;
-            // The glTransformFeedbackVaryings request list exactly as this link consumed it,
-            // INCLUDING the gl_NextBuffer / gl_SkipComponentsN pseudo-varyings that
-            // xfbVaryings deliberately drops (they steer the capture layout and must never
-            // reach a backend's varying list). GL_TRANSFORM_FEEDBACK_VARYING enumerates the
-            // full request, pseudo-varyings and all, so the interface query needs its own copy.
-            Vector<String> xfbInterfaceNames;
-            Vector<Uint32> xfbStrides;
-            Vector<Uint32> gsStripTriangles;
-            Bool gsStripCaptureFixup = false;
-            GLenum gsInputPrimitive = GL_NONE;
-            // GL_TESS_CONTROL_OUTPUT_VERTICES: the `layout(vertices = N) out` of the linked
-            // tessellation control stage, or 0 when the program has none. Checked against
-            // GL_MAX_PATCH_VERTICES at link (GL 4.6 core 11.2.1.1).
-            Int tcsOutputVertices = 0;
-            // The rest of the geometry stage's link properties, and the tessellation evaluation
-            // stage's. Every one of these is a glGetProgramiv answer that had no source at all:
-            // the query surface listed the geometry pnames only to fall through to
-            // GL_INVALID_ENUM, and the GL_TESS_GEN_* pnames were not mentioned anywhere. They
-            // come from the linked intermediates for the same reason gsInputPrimitive and
-            // tcsOutputVertices do - glslang has already merged the compilation units' layout
-            // qualifiers and diagnosed contradictions, so the linked program is the thing that
-            // knows.
-            GLenum gsOutputPrimitive = GL_NONE;
-            Int gsMaxVertices = 0;
-            Int gsInvocations = 0;
-            // The tessellation evaluation stage's layout: GL_QUADS / GL_TRIANGLES / GL_ISOLINES,
-            // GL_EQUAL / GL_FRACTIONAL_EVEN / GL_FRACTIONAL_ODD, GL_CW / GL_CCW, and point mode.
-            GLenum tessGenMode = GL_NONE;
-            GLenum tessGenSpacing = GL_NONE;
-            GLenum tessGenVertexOrder = GL_NONE;
-            Bool tessGenPointMode = false;
-            GLenum xfbBufferMode = GL_INTERLEAVED_ATTRIBS;
-            Int xfbVaryingNameMaxLength = 0;
-            Bool xfbNeedsScatteredCapture = false;
-            Uint32 xfbPackedStride = 0;
-        };
-
-        // ---- everything phase B of a link produces, in one movable block ----
-        //
-        // The membership rule is the same mechanical one LinkArtifacts uses: this is exactly
-        // what ProgramSpirvTask writes, which is what makes moving it THE publish. It is
-        // deliberately NOT part of LinkArtifacts, and that separation is what routes the five
-        // readers of SPIR-V-derived data through their own join gate by compiler rather than
-        // by review - m_spirv is private and Spirv() is the only spelling that reaches it.
-        //
-        // Why these three and nothing else: `generatedSpirv` has no GL-thread reader at all
-        // (every consumer is a backend draw/prepare path), and `uniformOffsets` +
-        // `globalUboScratch` are the ONLY things glUniform*/glGetUniform* need that are
-        // derived from the OPTIMIZED SPIR-V rather than from glslang reflection - spirv-opt
-        // runs in place and can delete a uniform, or the whole global UBO, so the offsets
-        // cannot be lifted out of glslang's reflection instead.
-        struct SpirvArtifacts {
-            Vector<Vector<unsigned>> generatedSpirv;
-            Bool enableSpirvValidation = false;
-            // Byte offset of each uniform location inside globalUboScratch, or
-            // kInvalidUniformOffset. Sized maxUniformLocation + 1 by the routing pass.
-            Vector<Uint> uniformOffsets;
-            Vector<Uint8> globalUboScratch;
-            // Byte offset of the reserved gl_NumSamples stand-in inside globalUboScratch, or
-            // kInvalidUniformOffset. Taken by NAME from the SPIR-V metadata rather than through
-            // uniformOffsets, because the member has no GL location at all: the link task keeps
-            // it out of the GL-visible uniform index space so no application can see or write it.
-            Uint reservedNumSamplesOffset = kInvalidUniformOffset;
-            // False for a program whose SPIR-V was never produced (phase B cancelled at
-            // teardown or by a relink) or whose optimizer run failed. GL has no way to
-            // retract a LINK_STATUS it already reported true, so such a program stays
-            // "linked" and every reflection answer it has given stays correct - it is simply
-            // not drawable, which the backends already express through their link-status
-            // gates.
-            Bool spirvStatus = false;
-            // Whether these modules KEPT their 64-bit floats instead of being narrowed to 32
-            // (ShaderTranspiler::DemoteFloat64Pass). Decided per PROGRAM, never per module - the
-            // global UBO is one buffer all stages read, so two stages disagreeing about whether a
-            // `uniform double` occupies 4 or 8 bytes would put every uniform after it at a
-            // different offset in each. Recorded here rather than re-derived from the backend
-            // because it is the layout THESE modules were built with: it is what the routing
-            // table's offsets mean, and glUniform*d / glGetUniform*v have to write and read the
-            // width the shader actually declares.
-            Bool nativeFloat64 = false;
-        };
-
         // ---- artifacts-only helpers, shared with ProgramLinkTask ----
         // Static and taking the block explicitly, because from stage 4 the link BODY needs
         // them while its artifacts still live on the job node, not on any ProgramObject. The

MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.cpp

@@ -16,10 +16,29 @@
 #include <MG_Util/ShaderTranspiler/TranslationCache.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 
+#include <atomic>
 #include <cstring>
 
 namespace MobileGL::MG_State::GLState {
-    void ProgramSpirvTask::DeferLog(String line) { diagnostics.logLines.push_back(Move(line)); }
+    namespace {
+        // The MGLOG_*_ONCE latch, moved to the SOURCE of a deferred line. It cannot live at
+        // the replay: Async::ApplyDeferredDiagnostics is ONE site shared by every job in the
+        // tree, so a latch there would silence unrelated lines. And it has to exist: a shader
+        // pack hands the same refusal to program after program, and a per-program WARN on a
+        // path like that is exactly the repeated production logging the house rule forbids.
+        // First occurrence at WARN - the one a bug report needs - every later one back at
+        // DEBUG, which shipped builds compile out.
+        Int FirstTimeWarnLevel(std::atomic_flag& latch) {
+            return latch.test_and_set(std::memory_order_relaxed) ? MOBILEGL_LOG_LEVEL_DEBUG
+                                                                 : MOBILEGL_LOG_LEVEL_WARN;
+        }
+        std::atomic_flag g_pointSizeDeclineReported;
+        std::atomic_flag g_pointSizeOptimizerFailureReported;
+    } // namespace
+
+    void ProgramSpirvTask::DeferLog(String line, const Int level) {
+        diagnostics.logLines.push_back({level, Move(line)});
+    }
 
     void ProgramSpirvTask::SubmitAfter(const SharedPtr<ProgramLinkTask>& phaseA) {
         MOBILEGL_ASSERT(phaseA != nullptr, "ProgramSpirvTask::SubmitAfter: the phase-A node is missing");
@@ -128,8 +147,15 @@ namespace MobileGL::MG_State::GLState {
         // with (ProgramLinkTask::BuildSpirvCacheKey reads the same env) or a memo written under
         // one answer could be handed back under the other.
         const Bool nativeFloat64 = m_phaseA->in.env != nullptr && m_phaseA->in.env->ConsumesFloat64Natively();
+        // The point-size demotion verdicts, read from the SAME snapshot for the same reason
+        // - and the same bits BuildSpirvCacheKey put in the L1 key, so a memo written under
+        // one answer can never be handed back under the other.
+        const Bool demoteTessellationPointSize =
+            m_phaseA->in.env != nullptr && m_phaseA->in.env->DemotesTessellationPointSize();
+        const Bool demoteGeometryPointSize =
+            m_phaseA->in.env != nullptr && m_phaseA->in.env->DemotesGeometryPointSize();
         GenerateSpirv(handoff, externalIndex, deferOutputValidationForDirectVulkan, enableSpirvValidation,
-                      nativeFloat64);
+                      nativeFloat64, demoteTessellationPointSize, demoteGeometryPointSize);
         // GlslangToSpv was the only consumer of the parsed ASTs; everything after this point
         // works on the SPIR-V and on the TProgram's own self-contained reflection pool. Drop
         // them here rather than at the end of the body, which is ~87% of this node's runtime
@@ -188,7 +214,9 @@ namespace MobileGL::MG_State::GLState {
 
     void ProgramSpirvTask::GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, const Uint externalIndex,
                                          const Bool deferOutputValidationForDirectVulkan,
-                                         const Bool enableSpirvValidation, const Bool nativeFloat64) {
+                                         const Bool enableSpirvValidation, const Bool nativeFloat64,
+                                         const Bool demoteTessellationPointSize,
+                                         const Bool demoteGeometryPointSize) {
         /* As we passed first stage compilation/linking,
          * we'll assume all the operations here should
          * pass. We may be able to employ some optimizations
@@ -267,6 +295,50 @@ namespace MobileGL::MG_State::GLState {
             }
         }
         artifacts.spirvStatus = allOptimized;
+
+        // The point-size demotion, program-wide and after the sanitize chain, so it works
+        // on the final shared bytes both backends consume and nothing downstream can trim
+        // the carriers it declares. Only the env half of the verdict lives here (and in the
+        // L1 key); whether the program actually declares the capability is probed inside,
+        // so the common case on an affected device - a program that never touches point
+        // size in those stages - pays one module parse per stage and no rewrite.
+        artifacts.pointSizeDemoted = false;
+        if (allOptimized && (demoteTessellationPointSize || demoteGeometryPointSize)) {
+            // Read off the HANDOFF's own derived bit, not off `handoff.reflection`: that
+            // field is the routing slice phase A fills with eight named members, and
+            // xfbVaryings is not one of them - reading it there answered "no capture ever
+            // asks for gl_PointSize" on every production link, which left a read-only
+            // capture stage without the carrier its capture binds to.
+            const Bool captureRequestsPointSize = handoff.captureRequestsPointSize;
+            ShaderCompiler::PointSizeDemotionOutcome outcome;
+            if (!ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram(
+                    artifacts.generatedSpirv, handoff.shaderTypes, demoteTessellationPointSize,
+                    demoteGeometryPointSize, captureRequestsPointSize, outcome,
+                    !deferOutputValidationForDirectVulkan, enableSpirvValidation)) {
+                // Optimizer failure: modules untouched, so the capability is still declared
+                // and the backends' existing refusals stay in charge - honest, just slower.
+                DeferLog(std::format("ProgramObject {}: point-size demotion failed in the optimizer; the "
+                                     "program keeps its built-in and the device's declines apply",
+                                     externalIndex),
+                         FirstTimeWarnLevel(g_pointSizeOptimizerFailureReported));
+            } else if (outcome.demoted) {
+                artifacts.pointSizeDemoted = true;
+                DeferLog(std::format("ProgramObject {}: gl_PointSize demoted to an ordinary varying across "
+                                     "the tessellation/geometry chain (value preserved for capture and "
+                                     "gl_in reads; rasterized size falls back to 1.0)",
+                                     externalIndex));
+            } else if (!outcome.declineDetail.empty()) {
+                // THE MOST VALUABLE LINE THIS FEATURE PRODUCES: which module shape the pass
+                // refused, and therefore why an affected device is still about to lose the
+                // program. Nothing else records it - `declineDetail` has no other runtime
+                // surface - so at the deferred channel's DEBUG default it was formatted and
+                // then dropped by every INFO build, i.e. every device and every CI artifact.
+                DeferLog(std::format("ProgramObject {}: point-size demotion declined ({}); the program "
+                                     "keeps its built-in and the device's declines apply",
+                                     externalIndex, outcome.declineDetail),
+                         FirstTimeWarnLevel(g_pointSizeDeclineReported));
+            }
+        }
     }
 
     void ProgramSpirvTask::BuildGlobalUboRouting(const ProgramLinkTask::SpirvHandoff& handoff,

MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.h

@@ -67,12 +67,14 @@ namespace MobileGL::MG_State::GLState {
 
         void GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex,
                            Bool deferOutputValidationForDirectVulkan, Bool enableSpirvValidation,
-                           Bool nativeFloat64);
+                           Bool nativeFloat64, Bool demoteTessellationPointSize,
+                           Bool demoteGeometryPointSize);
         void BuildGlobalUboRouting(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex);
 
         // Worker-side MGLOG replacement, replayed by the join on the GL thread. Same reason as
-        // ProgramLinkTask::DeferLog.
-        void DeferLog(String line);
+        // ProgramLinkTask::DeferLog, and the same severity rule: DEBUG is compiled out of
+        // every shipped build, so a line that has to survive one names its own level.
+        void DeferLog(String line, Int level = MOBILEGL_LOG_LEVEL_DEBUG);
 
         SharedPtr<ProgramLinkTask> m_phaseA;
     };

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.cpp

@@ -384,12 +384,15 @@ namespace MobileGL::MG_State::GLState {
             // the log, for every failing shader. The info log is what names the offending
             // line; the source is recoverable from the application.
             const SizeT firstLineEnd = artifacts.infoLog.find('\n');
-            diagnostics.logLines.push_back(std::format(
-                "ShaderCompileTask: shader {} (stage {}) failed to compile; compileStatus = false. "
-                "Preprocessed source: {} bytes. First log line: {}",
-                externalIndex, static_cast<Int>(stage), shared.preprocessedSource.length(),
-                artifacts.infoLog.substr(0, firstLineEnd == String::npos ? artifacts.infoLog.length()
-                                                                        : firstLineEnd)));
+            diagnostics.logLines.push_back(
+                {MOBILEGL_LOG_LEVEL_DEBUG,
+                 std::format(
+                     "ShaderCompileTask: shader {} (stage {}) failed to compile; compileStatus = false. "
+                     "Preprocessed source: {} bytes. First log line: {}",
+                     externalIndex, static_cast<Int>(stage), shared.preprocessedSource.length(),
+                     artifacts.infoLog.substr(0, firstLineEnd == String::npos
+                                                     ? artifacts.infoLog.length()
+                                                     : firstLineEnd))});
             if (shouldPopulateCache) {
                 fresh->outcome = ShaderPreprocessOutcome::ParseFailed;
                 fresh->infoLog = artifacts.infoLog;