[Perf, Test] (MG_Util): libfork execution engine for the shader compile pool, runtime-selectable

Adds libfork v3.8.0 (3rdparty submodule, header-only, wired like the asio
precedent) as a second execution engine behind ShaderCompilePool, selected
per process by MOBILEGL_ASYNC_POOL=asio|libfork (default asio; unknown
values warn and fall back). The engine boundary is deliberately tiny: the
queue, the concurrency budget and its clamping, the suspension latch,
cancel request-vs-outcome, the stopped-is-synchronous fallback and the
drain all stay in the shared Impl - an engine only answers how a
budget-cleared job reaches a worker.

The libfork engine runs detached root tasks as CHAINS: a finished body
takes the next queued job in the same coroutine on the same worker, so
the refills a worker posts are absorbed without a scheduler round trip
(the naive dispatch-thread shape measured 4x worse than asio on short
jobs). Absorption is bounded at one job per live chain - unbounded
absorption serialized bursts posted from inside the pool, which is the
shipped shape (one compile settling fans out link jobs via SubmitAfter
and the adoption map), caught by the review and pinned by a permanent
peak-concurrency regression test (pre-fix: libfork peak 1 vs asio peak 4
on a 16-job worker-posted burst). External submissions go through a
round-robin adaptor instead of lf::lazy_pool::schedule, which both
avoids a data race on lazy_pool's unsynchronized xoshiro under
concurrent submits and beats birthday-collision placement by ~1.3x at
budget == thread count.

The measured answer to "does asio scale poorly": no - the executor was
never the bottleneck. On real pack corpora extracted from the trace
fixtures (BSL 61 shaders, Complementary 277), interleaved best-of-5 per
cell, the engines are within noise of each other at every thread count
(complementary: 4965/2506/1376/824 ms at 1/2/4/8 threads for asio;
libfork within 1%), both ~6x at 8 threads. perf counters show the
flattening past 4 threads is machine-level (instructions flat at 22.1e9
from 1 to 16 threads - no added work, no lock spinning - while cycles
and LLC misses double: memory-stall bound), and the separating control
- N fully independent single-threaded processes with no shared
scheduler at all - scales WORSE than the pool (5.27x vs 5.94x at 8).
The pool microbenchmark does favor libfork on pure dispatch (518 vs
530 ns/job at 1 worker, growing with worker count), but a real compile
body is 1-100 ms, so dispatch is under 0.1% either way. asio therefore
stays the default; this branch exists to make the comparison
reproducible (MG_Test/Util/AsyncPoolBench drives either engine over a
corpus directory) and to keep the alternative viable.

613/613 unit tests in all four combos ({asio, libfork} x {async default
on, kill switch}), integration scenarios byte-identical between engines
on both backends.

.gitmodules

@@ -34,3 +34,6 @@
 [submodule "3rdparty/asio"]
 	path = 3rdparty/asio
 	url = https://github.com/chriskohlhoff/asio.git
+[submodule "3rdparty/libfork"]
+	path = 3rdparty/libfork
+	url = https://github.com/ConorWilliams/libfork.git

CMakeLists.txt

@@ -232,6 +232,7 @@ set(SOURCE_FILES
     MobileGL/MG_Impl/GLImpl/Framebuffer/Validators.cpp
     MobileGL/MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.cpp
     MobileGL/MG_Impl/GLImpl/Program/GL_Program.cpp
+    MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.cpp
     MobileGL/MG_Impl/GLImpl/Program/GL_ProgramPipeline.cpp
     MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp
     MobileGL/MG_Impl/GLImpl/Texture/Validators.cpp
@@ -372,6 +373,13 @@ set(MOBILEGL_INCLUDE_DIR
         # MG_Util/Async/ShaderCompilePool.cpp includes it, and it stays behind that file's
         # pimpl so no consumer target needs this path.
         ${CMAKE_SOURCE_DIR}/3rdparty/asio/asio/include
+        # The second shader-compile execution engine (MOBILEGL_ASYNC_POOL=libfork), on the
+        # same terms as Asio above: header-only, no add_subdirectory (its CMakeLists only
+        # declares an INTERFACE target plus install/test scaffolding we do not want), no link
+        # target, and reachable from exactly one translation unit. libfork's own
+        # target_compile_features asks for cxx_std_23, which this project already sets
+        # globally, so its C++20 coroutines need no per-source standard override.
+        ${CMAKE_SOURCE_DIR}/3rdparty/libfork/include
 )
 
 add_library(${CMAKE_PROJECT_NAME} SHARED

MobileGL/Config.h

@@ -66,6 +66,12 @@ namespace MobileGL::MG_Config {
     //   - DISPLAY: X11 session variable, not MobileGL configuration.
     //   - MOBILEGL_LOG_FILE_PATH: log-file init runs before MG_ConfigLoader::Init
     //     (see MG_Util/Debug/Log.cpp).
+    //   - MOBILEGL_ASYNC_POOL: a ShaderCompilePool is constructed by binaries that never call
+    //     MobileGL::Initialize() and so never run MG_ConfigLoader::Init - MG_Test's
+    //     JobNodeTest builds pools directly, and it is the suite that runs the whole async
+    //     matrix against both execution engines. Mirroring it here would resolve to the
+    //     default in exactly the tests that exist to tell the engines apart (see
+    //     MG_Util/Async/ShaderCompilePool.cpp, DetectAsyncPoolEngine).
     struct FeaturesTable {
         // MOBILEGL_DISABLE_TIMERQUERY: do not advertise or use GPU timer queries.
         Bool DisableTimerQuery = false;

MobileGL/MG_Backend/BackendObject.h

@@ -181,15 +181,18 @@ namespace MobileGL {
             void (*GetIntegeri_v)(GLenum target, GLuint index, GLint* data);
             void (*GetInteger64i_v)(GLenum target, GLuint index, GLint64* data);
             void (*GetProgramiv)(GLuint program, GLenum pname, GLint* params);
-            void (*GetProgramInterfaceiv)(GLuint program, GLenum programInterface, GLenum pname, GLint* params);
+            // The GL program interface (glGetProgramInterfaceiv / glGetProgramResource*) is NOT
-            GLuint (*GetProgramResourceIndex)(GLuint program, GLenum programInterface, const GLchar* name);
+            // a backend query: it describes the program the application wrote, in the
-            void (*GetProgramResourceName)(GLuint program, GLenum programInterface, GLuint index, GLsizei bufSize,
+            // application's namespace, which neither backend program is in. It is answered
-                                           GLsizei* length, GLchar* name);
+            // entirely by MG_Impl/GLImpl/Program/ProgramInterface from the frontend reflection.
-            void (*GetProgramResourceiv)(GLuint program, GLenum programInterface, GLuint index, GLsizei propCount,
+            // Takes the block's GL NAME, not glShaderStorageBlockBinding's index. The index
-                                         const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params);
+            // the application passes is the frontend interface-query enumeration's, and no
-            GLint (*GetProgramResourceLocation)(GLuint program, GLenum programInterface, const GLchar* name);
+            // backend shares that index space: DirectVulkan enumerates SPIR-V descriptor
-            GLint (*GetProgramResourceLocationIndex)(GLuint program, GLenum programInterface, const GLchar* name);
+            // bindings and DirectGLES asks a real driver about SPIRV-Cross-generated ESSL.
-            void (*ShaderStorageBlockBinding)(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding);
+            // The name is the one coordinate all three agree on, so the frontend resolves the
+            // index against its own enumeration and each backend maps the name to its own.
+            void (*ShaderStorageBlockBinding)(GLuint program, const GLchar* storageBlockName,
+                                              GLuint storageBlockBinding);
             // GL fence sync objects. All entries are optional (may be null); the
             // frontend then falls back to always-signaled sync semantics.
             // FenceSync may itself return null when the backend cannot create a

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -210,7 +210,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 reasons.push_back("GL_DEPTH_COMPONENT32 native probe failed on OpenGL ES");
             }
             if (options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget) {
-                reasons.push_back("no three-channel multisample storage format on OpenGL ES");
+                reasons.push_back("no colour-renderable three-channel format on OpenGL ES");
             }
             if (options & PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget) {
                 reasons.push_back("EXT_render_snorm not supported");
@@ -553,26 +553,60 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
                 for (SizeT targetIndex = 0; targetIndex < kFormatCapabilityTextureTargetCount; ++targetIndex) {
                     const auto target = static_cast<TextureTarget>(targetIndex);
-                    // A multisample texture can only ever be rendered into, so its storage format
+                    // Colour-attachable targets need a colour-renderable fallback; the ordinary
-                    // has to stay colour-renderable; the ordinary fallback for a three-channel
+                    // fallback for a three-channel format is another three-channel one, which ES
-                    // format is a three-channel one, which ES accepts as a texture but rejects as
+                    // accepts as a texture but never as an attachment. Recompute the fallback per
-                    // multisample storage. Recompute the fallback per target so those formats get
+                    // target so those formats get widened where the target demands it.
-                    // widened here and nowhere else.
+                    const Flags<PixelFormatNormalizeOptionBit> renderTargetOptions =
-                    Flags<PixelFormatNormalizeOptionBit> targetOptions;
+                        TextureImpl::GetRenderTargetNormalizeOptions(capabilities, targetIndex);
-                    if (IsGLESProbeMultisampleTarget(target)) {
+                    // Multisample storage has no three-channel form on ES at all, so its widening
-                        targetOptions |= PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget;
+                    // is unconditional and skips the native probe (which cannot succeed). Every
-                        if (!capabilities.SupportsRenderSnorm || !capabilities.SupportsNorm16Texture) {
+                    // other target keeps the widening on the DRIVER branch, behind the native
-                            targetOptions |= PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget;
+                    // probe: `shouldProbeFallback = !nativeCreated || !nativeRenderable` below is
-                        }
+                    // what makes the substitution conditional on the driver actually refusing, so
-                    }
+                    // a driver that does render to a three-channel image keeps allocating it byte
+                    // for byte. That is a per-format runtime answer, NOT a desktop-vs-device
+                    // split: llvmpipe renders to GL_RGB16F but refuses GL_RGB8_SNORM, GL_SRGB8,
+                    // GL_RGB32F and the RGB integer formats, so the CI driver widens those eight
+                    // too. Re-run the retrace fixtures and the glcts suites on any change here.
+                    const Bool widenUnconditionally = IsGLESProbeMultisampleTarget(target);
                     GLESProbeFormatInfo fallbackInfo = outerFallbackInfo;
                     Bool hasForcedFallback = outerHasForcedFallback;
-                    if (targetOptions) {
+                    if (renderTargetOptions) {
-                        hasForcedFallback = BuildFallbackProbeFormatInfo(
+                        // Folded into the forced options only when a forced fallback already
-                            requestedInternalFormat, forcedOptions | targetOptions, true, fallbackInfo);
+                        // applies, so the render-target bits never *create* one: ANGLE's forced
-                        if (!hasForcedFallback) {
+                        // GL_RGB8_SNORM -> GL_RGB16F is still three-channel and still needs
-                            BuildFallbackProbeFormatInfo(requestedInternalFormat, driverOptions | targetOptions, false,
+                        // widening, but a non-ANGLE driver must not lose its native probe.
+                        const Flags<PixelFormatNormalizeOptionBit> forcedProbeOptions =
+                            (outerHasForcedFallback || widenUnconditionally) ? forcedOptions | renderTargetOptions
+                                                                             : forcedOptions;
+                        hasForcedFallback =
+                            BuildFallbackProbeFormatInfo(requestedInternalFormat, forcedProbeOptions, true,
                                                          fallbackInfo);
+                        if (!hasForcedFallback) {
+                            BuildFallbackProbeFormatInfo(requestedInternalFormat,
+                                                         driverOptions | renderTargetOptions, false, fallbackInfo);
+                        }
+                        // HONEST STATUS OF THE FORCED PATH. A forced fallback is only ever built
+                        // for ANGLE (GetForcedPixelFormatNormalizeOptions returns nothing for any
+                        // other renderer), and it SKIPS the native probe entirely - the widened
+                        // format is asserted rather than measured on this device. That assertion
+                        // is validated on exactly one configuration, the android-angle retrace
+                        // golden; it is NOT covered by the headless llvmpipe suites, which take
+                        // the driver branch below and prove nothing about ANGLE's answers. So log
+                        // the choice at INFO rather than the usual MGLOG_D caveat: on any other
+                        // ANGLE device the device report is the only evidence there is of which
+                        // storage format the image really got. Once per format on the ordinary 2D
+                        // target - repeating it for all ten targets would bury the report.
+                        if (hasForcedFallback && target == TextureTarget::Texture2D &&
+                            (MG_Util::TextureFormatProcessor::GetApplicablePixelFormatNormalizeOptions(
+                                 requestedInternalFormat, renderTargetOptions) &
+                             PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget)) {
+                            MGLOG_I("Three-channel widening (FORCED path, no native probe): %s stored as %s. "
+                                    "Reason: %s. Device-validated on the android-angle golden only.",
+                                    MG_Util::ConvertTextureInternalFormatToString(logicalFormat).c_str(),
+                                    ConvertFallbackInternalFormatToString(fallbackInfo.InternalFormat).c_str(),
+                                    fallbackInfo.Reason.c_str());
                         }
                     }
 
@@ -618,8 +652,26 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 }
 
                 const SizeT renderbufferTargetIndex = GetRenderbufferFormatCapabilityTargetIndex();
-                Bool shouldProbeFallbackRenderbuffer = outerHasForcedFallback;
+                // A renderbuffer exists only to be attached, so it needs the same three-channel
-                if (!outerHasForcedFallback) {
+                // widening the colour-attachable texture targets get - and on the same terms: the
+                // native storage is probed first, so a driver that renders to it keeps it.
+                const Flags<PixelFormatNormalizeOptionBit> renderbufferOptions =
+                    TextureImpl::GetRenderTargetNormalizeOptions(capabilities, renderbufferTargetIndex);
+                GLESProbeFormatInfo renderbufferFallbackInfo = outerFallbackInfo;
+                Bool renderbufferHasForcedFallback = outerHasForcedFallback;
+                if (renderbufferOptions) {
+                    const Flags<PixelFormatNormalizeOptionBit> forcedProbeOptions =
+                        outerHasForcedFallback ? forcedOptions | renderbufferOptions : forcedOptions;
+                    renderbufferHasForcedFallback = BuildFallbackProbeFormatInfo(
+                        requestedInternalFormat, forcedProbeOptions, true, renderbufferFallbackInfo);
+                    if (!renderbufferHasForcedFallback) {
+                        BuildFallbackProbeFormatInfo(requestedInternalFormat, driverOptions | renderbufferOptions,
+                                                     false, renderbufferFallbackInfo);
+                    }
+                }
+
+                Bool shouldProbeFallbackRenderbuffer = renderbufferHasForcedFallback;
+                if (!renderbufferHasForcedFallback) {
                     const Bool nativeRenderbufferComplete =
                         ProbeRenderbuffer(gl, nativeInfo.InternalFormat, logicalFormat, false, 1);
                     if (nativeRenderbufferComplete) {
@@ -633,16 +685,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         shouldProbeFallbackRenderbuffer = true;
                     }
                 }
-                if (shouldProbeFallbackRenderbuffer && outerFallbackInfo.InternalFormat != GL_UNKNOWN_MGL &&
+                if (shouldProbeFallbackRenderbuffer && renderbufferFallbackInfo.InternalFormat != GL_UNKNOWN_MGL &&
-                    ProbeRenderbuffer(gl, outerFallbackInfo.InternalFormat, logicalFormat, false, 1)) {
+                    ProbeRenderbuffer(gl, renderbufferFallbackInfo.InternalFormat, logicalFormat, false, 1)) {
                     if (AddCaveatFormatCaps(cache, renderbufferTargetIndex, formatIndex,
                                             GetRenderbufferFeatureCaps(logicalFormat))) {
-                        LogGLESFormatCaveat(logicalFormat, renderbufferTargetIndex, outerFallbackInfo);
+                        LogGLESFormatCaveat(logicalFormat, renderbufferTargetIndex, renderbufferFallbackInfo);
                     }
                     const Int maxSamples =
-                        GetGLESFormatMaxSamples(capabilities, logicalFormat, outerFallbackInfo.ImageFormat);
+                        GetGLESFormatMaxSamples(capabilities, logicalFormat, renderbufferFallbackInfo.ImageFormat);
-                    cache.SampleCounts[renderbufferTargetIndex][formatIndex] =
+                    cache.SampleCounts[renderbufferTargetIndex][formatIndex] = ProbeRenderbufferSampleCounts(
-                        ProbeRenderbufferSampleCounts(gl, outerFallbackInfo.InternalFormat, logicalFormat, maxSamples);
+                        gl, renderbufferFallbackInfo.InternalFormat, logicalFormat, maxSamples);
                 }
             }
         }
@@ -968,12 +1020,6 @@ namespace MobileGL::MG_Backend::DirectGLES {
             funcsTable.GL.GetIntegeri_v = GetIntegeri_v;
             funcsTable.GL.GetInteger64i_v = GetInteger64i_v;
             funcsTable.GL.GetProgramiv = GetProgramiv;
-            funcsTable.GL.GetProgramInterfaceiv = GetProgramInterfaceiv;
-            funcsTable.GL.GetProgramResourceIndex = GetProgramResourceIndex;
-            funcsTable.GL.GetProgramResourceName = GetProgramResourceName;
-            funcsTable.GL.GetProgramResourceiv = GetProgramResourceiv;
-            funcsTable.GL.GetProgramResourceLocation = GetProgramResourceLocation;
-            funcsTable.GL.GetProgramResourceLocationIndex = GetProgramResourceLocationIndex;
             funcsTable.GL.ShaderStorageBlockBinding = ShaderStorageBlockBinding;
             funcsTable.GL.Clear = Clear;
             funcsTable.GL.ClearBufferfi = ClearBufferfi;

MobileGL/MG_Backend/DirectGLES/DirectGLES.cpp

@@ -1127,10 +1127,29 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // slot the key covers still holds a reference to it. Holding either side by shared_ptr
         // instead would keep dead frontend textures alive and defeat the registry's
         // weak-reference GC.
+        //
+        // `texture` records WHICH frontend object `backend` was paired with when the entry was
+        // built, and PairingsIntact re-checks it before any replay. The keys above are the
+        // primary guard, but they are all derived state: a slot swap that never reaches the
+        // bind generation (the DSA by-name emulation used to swap a slot silently) would leave
+        // every key matching while the borrowed slot pointed at a different texture, and the
+        // replay would then drive texture A's backend twin from texture B's frontend state -
+        // re-specifying A's backend storage with B's shape and destroying A's contents. A raw
+        // pointer compare per entry is far cheaper than the walk it guards, and a stale pairing
+        // costs only a list rebuild, so this stays as the structural net under the keys.
         struct UnitTextureSyncEntry {
             const SharedPtr<MG_State::GLState::ITextureObject>* slot = nullptr;
+            MG_State::GLState::ITextureObject* texture = nullptr;
             BackendTextureObject* backend = nullptr;
         };
+        // True while every entry's borrowed slot still holds the texture the entry was paired
+        // with. Callers put it LAST in the key conjunction so it only runs on a key hit.
+        static Bool PairingsIntact(const Vector<UnitTextureSyncEntry>& list) {
+            for (const auto& entry : list) {
+                if (entry.slot->get() != entry.texture) return false;
+            }
+            return true;
+        }
         static Vector<UnitTextureSyncEntry> g_unitTextureSyncList;
         static Bool g_unitTextureSyncListValid = false;
         static Uint64 g_unitTextureSyncListContextId = 0;
@@ -1197,7 +1216,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 g_unitTextureSyncListMaxUnit == maxTouchedUnit &&
                 g_unitTextureSyncListContextGeneration == g_textureContextGeneration &&
                 g_unitTextureSyncListEpoch == unitBindingsEpoch &&
-                g_unitTextureSyncListSamplingGeneration == samplingGeneration) {
+                g_unitTextureSyncListSamplingGeneration == samplingGeneration &&
+                PairingsIntact(g_unitTextureSyncList)) {
                 for (const auto& entry : g_unitTextureSyncList) {
                     // Aggregate gate == the conjunction of the three callees' own
                     // early-outs (see IsDrawSyncClean); skipping on true is
@@ -1219,8 +1239,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         // An image-less default texture (name 0) is the slot's initial / "unbound"
                         // state; it has nothing to sync, so skip it as cheaply as the old null slot.
                         if (textureObject && !MG_State::GLState::IsUndefinedDefaultTexture(textureObject.get())) {
-                            g_unitTextureSyncList.push_back(
+                            g_unitTextureSyncList.push_back({&textureObject, textureObject.get(),
-                                {&textureObject, SyncTextureObjectToBackend(textureObject).get()});
+                                                             SyncTextureObjectToBackend(textureObject).get()});
                         }
                     }
                 }
@@ -1254,7 +1274,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     g_fboTextureSyncListSlotVersion == fboSlotVersion &&
                     g_fboTextureSyncListObjectVersion == fboObjectVersion &&
                     g_fboTextureSyncListContextId == keys.contextId &&
-                    g_fboTextureSyncListContextGeneration == g_textureContextGeneration;
+                    g_fboTextureSyncListContextGeneration == g_textureContextGeneration &&
+                    PairingsIntact(g_fboTextureSyncList);
                 if (fboListValid) {
                     for (const auto& entry : g_fboTextureSyncList) {
                         // Same aggregate gate as the unit list above.
@@ -1273,8 +1294,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         if (!attachment.IsTexture()) continue;
                         auto& textureObject = attachment.GetTexture();
                         if (textureObject) {
-                            g_fboTextureSyncList.push_back(
+                            g_fboTextureSyncList.push_back({&textureObject, textureObject.get(),
-                                {&textureObject, SyncTextureObjectToBackend(textureObject).get()});
+                                                            SyncTextureObjectToBackend(textureObject).get()});
                         }
                     }
                     g_fboTextureSyncListFbo = currentFBO.get();
@@ -1380,7 +1401,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 }
 
                 if (currentFBO == MG_Impl::GLImpl::FramebufferImpl::pDefaultFramebufferInfo->defaultFBO) {
-                    // Default FBO, nothing to sync
+                    // Default FBO, nothing to sync - except the widened-attachment mask, which is
+                    // only ever WRITTEN by SyncToBackend and would otherwise still describe the
+                    // user FBO that was draw-bound before. The window surface is a real RGBA
+                    // buffer, so nothing here is ever widened.
+                    if (target == FramebufferTarget::Draw) {
+                        g_alphaWidenedDrawBufferMask = 0;
+                        g_integerColorDrawBufferMask = 0;
+                    }
                     StampSyncedFBO(target, slotVersion, objectVersion, currentPtr);
                     continue;
                 }
@@ -1422,15 +1450,53 @@ namespace MobileGL::MG_Backend::DirectGLES {
         static Bool g_hasSyncedRenderState = false;
         static RenderStateParameters g_syncedRenderStateParameters;
         static IntVec4 g_syncedBackendViewport = IntVec4(-1, -1, -1, -1);
+        // The RESOLVED scissor rectangle last pushed (see the scissor block in SyncRenderState);
+        // an impossible value so the first sync always pushes.
+        static IntVec4 g_syncedBackendScissorBox = IntVec4(-1, -1, -1, -1);
         // GLES starts with sRGB framebuffer encoding on, so the first sync always has to push the
         // frontend's (desktop-GL default) disabled state down.
         static Bool g_syncedSrgbFramebufferWrites = true;
-        void SyncRenderState() {
+        // Set when the shadow below stops describing the real ES context. The ES context
+        // OUTLIVES every MobileGL context, so a MobileGL context switch leaves it holding the
+        // previous context's enable state while the frontend's parameter block AND its
+        // version counter both restart from defaults. Every "differs from what I last pushed"
+        // test in SyncRenderState would then agree that nothing needs pushing, and the
+        // leftover state silently applies to the new context - the class of bug the CTS
+        // caught as GL_FRAMEBUFFER_SRGB surviving from vertex_attrib_binding into
+        // direct_state_access.renderbuffers_storage. One unconditional push settles the whole
+        // block rather than the one cap that happened to be noticed.
+        static Bool g_forceFullRenderStateResync = true;
+        // Which draw buffers' alpha channel the colour mask last pushed to the driver had forced
+        // OFF - i.e. the value of `appliedWidenMask` in the last SyncRenderState that reached the
+        // colour-mask block. NOT derivable from the frontend parameter block: it depends on the
+        // bound DRAW framebuffer's attachment formats and on whether the caller is a draw or a
+        // clear, neither of which bumps the frontend render-state version. Without it a
+        // clear-then-draw pair on an unchanged parameter block early-outs and the draw inherits
+        // the clear's undoctored mask.
+        static Uint32 g_syncedColorMaskAlphaWidenMask = 0;
+        void InvalidateSyncedRenderState() {
+            g_forceFullRenderStateResync = true;
+            g_hasSyncedRenderState = false;
+            g_syncedBackendViewport = IntVec4(-1, -1, -1, -1);
+            g_syncedBackendScissorBox = IntVec4(-1, -1, -1, -1);
+        }
+        void SyncRenderState(Bool forColorClear) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
             Uint16 currentRenderStateVersion = MG_State::pGLContext->GetRenderStateParametersVersion();
-            if (g_hasSyncedRenderState && currentRenderStateVersion == g_syncedRenderStateVersion) return;
+            const Bool forceFullPush = g_forceFullRenderStateResync;
+            g_forceFullRenderStateResync = false;
+            // The alpha discipline for widened colour attachments (see the header comment on
+            // SyncRenderState): a DRAW must not be able to move the stored alpha off 1.0, a CLEAR
+            // is what puts it there. So the draw path masks alpha off on every widened draw
+            // buffer and the clear path masks nothing.
+            const Uint32 appliedWidenMask = forColorClear ? 0u : FramebufferImpl::g_alphaWidenedDrawBufferMask;
+            const Bool colorMaskWidenDirty = appliedWidenMask != g_syncedColorMaskAlphaWidenMask;
+            if (!forceFullPush && !colorMaskWidenDirty && g_hasSyncedRenderState &&
+                currentRenderStateVersion == g_syncedRenderStateVersion) {
+                return;
+            }
 
             const auto& parameters = MG_State::pGLContext->GetRenderStateParameters();
 
@@ -1478,7 +1544,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // All 12 capability bools live after LogicOp in the struct, i.e. in the tail span.
             if (tailSpanDirty) {
 #define SYNC_CAPABILITY(cap_mg, cap_gl)                                                                                \
-    if (parameters.cap_mg##Enabled != g_syncedRenderStateParameters.cap_mg##Enabled) {                                 \
+    if (forceFullPush || parameters.cap_mg##Enabled != g_syncedRenderStateParameters.cap_mg##Enabled) {                                 \
         if (parameters.cap_mg##Enabled) {                                                                              \
             g_GLESFuncs.glEnable(cap_gl);                                                                              \
         } else {                                                                                                       \
@@ -1507,7 +1573,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
               // into an sRGB colour buffer comes back encoded once too often (the shader's own
               // decode on the next fetch then leaves the value one conversion short).
                 const Bool srgbWrites = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::FramebufferSrgb);
-                if (g_GLESCapabilities.SupportsSrgbWriteControl && srgbWrites != g_syncedSrgbFramebufferWrites) {
+                if (g_GLESCapabilities.SupportsSrgbWriteControl &&
+                    (forceFullPush || srgbWrites != g_syncedSrgbFramebufferWrites)) {
                     srgbWrites ? g_GLESFuncs.glEnable(GL_FRAMEBUFFER_SRGB)
                                : g_GLESFuncs.glDisable(GL_FRAMEBUFFER_SRGB);
                     g_syncedSrgbFramebufferWrites = srgbWrites;
@@ -1520,7 +1587,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 const Bool restart = parameters.PrimitiveRestartFixedIndexEnabled || parameters.PrimitiveRestartEnabled;
                 const Bool syncedRestart = g_syncedRenderStateParameters.PrimitiveRestartFixedIndexEnabled ||
                                            g_syncedRenderStateParameters.PrimitiveRestartEnabled;
-                if (restart != syncedRestart) {
+                if (forceFullPush || restart != syncedRestart) {
                     restart ? g_GLESFuncs.glEnable(GL_PRIMITIVE_RESTART_FIXED_INDEX)
                             : g_GLESFuncs.glDisable(GL_PRIMITIVE_RESTART_FIXED_INDEX);
                 }
@@ -1556,7 +1623,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
                 Bool allEnabled = true;
                 Bool allDisabled = true;
-                Bool anyCapDirty = false;
+                Bool anyCapDirty = forceFullPush;
 
                 for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS; ++i) {
                     Bool enabled = targetStates[i].Enabled;
@@ -1581,7 +1648,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             s.Enabled = false;
                     } else {
                         for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS; ++i) {
-                            if (targetStates[i].Enabled != syncedStates[i].Enabled) {
+                            if (forceFullPush || targetStates[i].Enabled != syncedStates[i].Enabled) {
                                 syncedStates[i].Enabled = targetStates[i].Enabled;
                                 syncedStates[i].Enabled ? g_GLESFuncs.glEnablei(GL_BLEND, i)
                                                         : g_GLESFuncs.glDisablei(GL_BLEND, i);
@@ -1591,7 +1658,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 }
 
                 Bool allFuncsSame = true;
-                Bool anyFuncDirty = false;
+                Bool anyFuncDirty = forceFullPush;
                 const auto& first = targetStates[0];
 
                 for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS; ++i) {
@@ -1630,8 +1697,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             const auto& cur = targetStates[i];
                             auto& syn = syncedStates[i];
 
-                            if (cur.SrcFactorRGB != syn.SrcFactorRGB || cur.DstFactorRGB != syn.DstFactorRGB ||
+                            if (forceFullPush || cur.SrcFactorRGB != syn.SrcFactorRGB ||
-                                cur.SrcFactorAlpha != syn.SrcFactorAlpha || cur.DstFactorAlpha != syn.DstFactorAlpha) {
+                                cur.DstFactorRGB != syn.DstFactorRGB ||
+                                cur.SrcFactorAlpha != syn.SrcFactorAlpha ||
+                                cur.DstFactorAlpha != syn.DstFactorAlpha) {
                                 syn.SrcFactorRGB = cur.SrcFactorRGB;
                                 syn.DstFactorRGB = cur.DstFactorRGB;
                                 syn.SrcFactorAlpha = cur.SrcFactorAlpha;
@@ -1648,7 +1717,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 }
 
                 Bool allEquationsSame = true;
-                Bool anyEquationDirty = false;
+                Bool anyEquationDirty = forceFullPush;
 
                 for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS; ++i) {
                     const auto& cur = targetStates[i];
@@ -1679,7 +1748,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             const auto& cur = targetStates[i];
                             auto& syn = syncedStates[i];
 
-                            if (cur.ColorEquation != syn.ColorEquation || cur.AlphaEquation != syn.AlphaEquation) {
+                            if (forceFullPush || cur.ColorEquation != syn.ColorEquation ||
+                                cur.AlphaEquation != syn.AlphaEquation) {
                                 syn.ColorEquation = cur.ColorEquation;
                                 syn.AlphaEquation = cur.AlphaEquation;
 
@@ -1693,13 +1763,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
 
             if (tailSpanDirty) { // Depth state
-                if (parameters.DepthFunc != g_syncedRenderStateParameters.DepthFunc) {
+                if (forceFullPush || parameters.DepthFunc != g_syncedRenderStateParameters.DepthFunc) {
                     g_GLESFuncs.glDepthFunc(MG_Util::ConvertDepthTestFuncToGLEnum(parameters.DepthFunc));
                 }
-                if (parameters.DepthMask != g_syncedRenderStateParameters.DepthMask) {
+                if (forceFullPush || parameters.DepthMask != g_syncedRenderStateParameters.DepthMask) {
                     g_GLESFuncs.glDepthMask(parameters.DepthMask ? GL_TRUE : GL_FALSE);
                 }
-                if (parameters.DepthRange != g_syncedRenderStateParameters.DepthRange) {
+                if (forceFullPush || parameters.DepthRange != g_syncedRenderStateParameters.DepthRange) {
                     g_GLESFuncs.glDepthRangef(parameters.DepthRange.x(), parameters.DepthRange.y());
                 }
             }
@@ -1710,16 +1780,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     const StencilFaceState& synced = g_syncedRenderStateParameters.StencilStates[faceIndex];
                     const GLenum glFace = faceIndex == 0 ? GL_FRONT : GL_BACK;
 
-                    if (current.Func != synced.Func || current.Ref != synced.Ref ||
+                    if (forceFullPush || current.Func != synced.Func || current.Ref != synced.Ref ||
                         current.ValueMask != synced.ValueMask) {
                         g_GLESFuncs.glStencilFuncSeparate(
                             glFace, MG_Util::ConvertDepthTestFuncToGLEnum(current.Func), current.Ref,
                             current.ValueMask);
                     }
-                    if (current.WriteMask != synced.WriteMask) {
+                    if (forceFullPush || current.WriteMask != synced.WriteMask) {
                         g_GLESFuncs.glStencilMaskSeparate(glFace, current.WriteMask);
                     }
-                    if (current.FailOp != synced.FailOp || current.PassDepthFailOp != synced.PassDepthFailOp ||
+                    if (forceFullPush || current.FailOp != synced.FailOp ||
+                        current.PassDepthFailOp != synced.PassDepthFailOp ||
                         current.PassDepthPassOp != synced.PassDepthPassOp) {
                         g_GLESFuncs.glStencilOpSeparate(
                             glFace, MG_Util::ConvertStencilOperationToGLEnum(current.FailOp),
@@ -1729,23 +1800,42 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 }
             }
 
-            if (tailSpanDirty) { // Color mask. Uniform masks use the non-indexed glColorMask (works everywhere); divergent
+            if (tailSpanDirty || colorMaskWidenDirty) { // Color mask. Uniform masks use the non-indexed glColorMask
-              // per-draw-buffer masks use the indexed glColorMaski when draw_buffers_indexed is
+              // (works everywhere); divergent per-draw-buffer masks use the indexed glColorMaski when
-              // available, otherwise fall back to broadcasting draw buffer 0. Mirrors the blend block.
+              // draw_buffers_indexed is available, otherwise fall back to broadcasting draw buffer 0.
+              // Mirrors the blend block.
                 using FBO = MG_State::GLState::FramebufferObject;
                 const auto& targetMasks = parameters.ColorMasks;
                 const auto& syncedMasks = g_syncedRenderStateParameters.ColorMasks;
 
-                Bool anyDirty = false;
+                // What the DRIVER is told for draw buffer i. Identical to the application's mask
+                // except on a widened attachment during a draw, where alpha is forced off; the
+                // frontend's own array is never written, so glGet(GL_COLOR_WRITEMASK) keeps
+                // answering with the application's value.
+                const auto driverMask = [&](Uint i) -> BoolVec4 {
+                    BoolVec4 m = targetMasks[i];
+                    if (i < 32 && (appliedWidenMask & (1u << i)) != 0) {
+                        m.w() = false;
+                    }
+                    return m;
+                };
+
+                Bool anyDirty = forceFullPush || colorMaskWidenDirty;
                 Bool allSame = true;
+                const BoolVec4 driverMask0 = driverMask(0);
                 for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS; ++i) {
                     if (targetMasks[i] != syncedMasks[i]) anyDirty = true;
-                    if (i > 0 && targetMasks[i] != targetMasks[0]) allSame = false;
+                    if (i > 0 && driverMask(i) != driverMask0) allSame = false;
                 }
 
                 if (anyDirty) {
                     if (allSame || !g_GLESCapabilities.SupportsIndexedColorMask) {
-                        const BoolVec4& m = targetMasks[0];
+                        // Without draw_buffers_indexed there is only one mask for the whole
+                        // framebuffer, so a widened draw buffer 0 costs every other buffer its
+                        // alpha writes. ES 3.2 makes glColorMaski core and ES 3.1 has it as
+                        // EXT/OES; the only devices that reach this line are ES 3.0-class, where
+                        // MRT with a mixed widened/native colour attachment set is already rare.
+                        const BoolVec4& m = driverMask0;
                         g_GLESFuncs.glColorMask(ToGLBoolean(m.x()), ToGLBoolean(m.y()), ToGLBoolean(m.z()),
                                                 ToGLBoolean(m.w()));
                     } else {
@@ -1753,19 +1843,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                                   : g_GLESFuncs.glColorMaskiEXT ? g_GLESFuncs.glColorMaskiEXT
                                                                                 : g_GLESFuncs.glColorMaskiOES;
                         for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS; ++i) {
-                            if (targetMasks[i] != syncedMasks[i]) {
+                            // colorMaskWidenDirty forces every slot: the previous push may have
-                                const BoolVec4& m = targetMasks[i];
+                            // been the non-indexed glColorMask above (which set all of them), and
+                            // the per-slot diff below only knows about the application's array.
+                            if (forceFullPush || colorMaskWidenDirty || targetMasks[i] != syncedMasks[i]) {
+                                const BoolVec4 m = driverMask(i);
                                 colorMaskiFn(i, ToGLBoolean(m.x()), ToGLBoolean(m.y()), ToGLBoolean(m.z()),
                                              ToGLBoolean(m.w()));
                             }
                         }
                     }
                 }
+                g_syncedColorMaskAlphaWidenMask = appliedWidenMask;
             }
 
             if (tailSpanDirty) { // Polygon mode. GLES core has no glPolygonMode; use NV/ANGLE_polygon_mode when present.
               // Without the extension the mode stays FILL and non-FILL requests are dropped.
-                if (parameters.PolygonModeFront != g_syncedRenderStateParameters.PolygonModeFront &&
+                if ((forceFullPush || parameters.PolygonModeFront != g_syncedRenderStateParameters.PolygonModeFront) &&
                     g_GLESCapabilities.SupportsPolygonMode) {
                     const auto polygonModeFn =
                         g_GLESFuncs.glPolygonModeNV ? g_GLESFuncs.glPolygonModeNV : g_GLESFuncs.glPolygonModeANGLE;
@@ -1774,67 +1868,97 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
 
             if (tailSpanDirty) { // Clear values
-                if (parameters.ClearColor != g_syncedRenderStateParameters.ClearColor) {
+                if (forceFullPush || parameters.ClearColor != g_syncedRenderStateParameters.ClearColor) {
                     const FloatVec4& clearCol = parameters.ClearColor;
                     g_GLESFuncs.glClearColor(clearCol.x(), clearCol.y(), clearCol.z(), clearCol.w());
                 }
-                if (parameters.ClearDepth != g_syncedRenderStateParameters.ClearDepth) {
+                if (forceFullPush || parameters.ClearDepth != g_syncedRenderStateParameters.ClearDepth) {
                     g_GLESFuncs.glClearDepthf(parameters.ClearDepth);
                 }
-                if (parameters.ClearStencil != g_syncedRenderStateParameters.ClearStencil) {
+                if (forceFullPush || parameters.ClearStencil != g_syncedRenderStateParameters.ClearStencil) {
                     g_GLESFuncs.glClearStencil(static_cast<GLint>(parameters.ClearStencil));
                 }
-                if (parameters.BlendColor != g_syncedRenderStateParameters.BlendColor) {
+                if (forceFullPush || parameters.BlendColor != g_syncedRenderStateParameters.BlendColor) {
                     const FloatVec4& blendColor = parameters.BlendColor;
                     g_GLESFuncs.glBlendColor(blendColor.x(), blendColor.y(), blendColor.z(), blendColor.w());
                 }
             }
 
             if (tailSpanDirty) { // Cull face mode
-                if (parameters.CullFaceModeSetting != g_syncedRenderStateParameters.CullFaceModeSetting) {
+                if (forceFullPush || parameters.CullFaceModeSetting != g_syncedRenderStateParameters.CullFaceModeSetting) {
                     const CullFaceMode& cfm = parameters.CullFaceModeSetting;
                     g_GLESFuncs.glCullFace(MG_Util::ConvertCullFaceModeToGLEnum(cfm));
                 }
-                if (parameters.FrontFaceModeSetting != g_syncedRenderStateParameters.FrontFaceModeSetting) {
+                if (forceFullPush || parameters.FrontFaceModeSetting != g_syncedRenderStateParameters.FrontFaceModeSetting) {
                     const FrontFaceMode& ffm = parameters.FrontFaceModeSetting;
                     g_GLESFuncs.glFrontFace(MG_Util::ConvertFrontFaceModeToGLEnum(ffm));
                 }
             }
 
-            if (tailSpanDirty) { // Scissor box
+            if (tailSpanDirty) { // Scissor box. Resolved and shadowed like the viewport above, and
-                if (parameters.ScissorBox != g_syncedRenderStateParameters.ScissorBox) {
+              // for the same reason: what has to reach the driver is NOT simply the parameter
-                    const IntVec4& scissorBox = parameters.ScissorBox;
+              // field. (0,0,0,0) is where RenderStateParameters::ScissorBox starts and the only
-                    g_GLESFuncs.glScissor(scissorBox.x(), scissorBox.y(), scissorBox.z(), scissorBox.w());
+              // thing that ever writes it is glScissor, so that value means "the application has
+              // never called glScissor" - it is not a GL scissor box. GL's initial box is the
+              // whole window, which the frontend has no way to spell before a surface exists.
+              // The pre-resync code got away with pushing the field verbatim only by accident:
+              // the shadow held the same default, the field never compared unequal, and the ES
+              // context kept its own correct default. Under the forced full push that accident
+              // is gone, glScissor(0,0,0,0) shrinks the scissor to an EMPTY rectangle, and
+              // everything drawn with GL_SCISSOR_TEST enabled before the app's first glScissor
+              // is clipped away - Minecraft 26.2 keeps only its unscissored sky and hand and
+              // loses the terrain and the whole GUI.
+                IntVec4 backendScissorBox = parameters.ScissorBox;
+                if (backendScissorBox.z() <= 0 || backendScissorBox.w() <= 0) {
+                    Int surfaceWidth = 0;
+                    Int surfaceHeight = 0;
+                    if (QueryCurrentSurfaceSize(surfaceWidth, surfaceHeight)) {
+                        backendScissorBox = IntVec4(0, 0, surfaceWidth, surfaceHeight);
+                    }
+                }
+                // Compared against what was actually PUSHED, not against the parameter field, so
+                // the resolved value and the diff can never disagree.
+                if (backendScissorBox != g_syncedBackendScissorBox) {
+                    g_GLESFuncs.glScissor(backendScissorBox.x(), backendScissorBox.y(), backendScissorBox.z(),
+                                          backendScissorBox.w());
+                    g_syncedBackendScissorBox = backendScissorBox;
                 }
             }
 
             if (tailSpanDirty) { // Logic op (first field of the tail span)
-                if (parameters.LogicOp != g_syncedRenderStateParameters.LogicOp) {
+              // glLogicOp is GLES 1.x / EXT only - eglGetProcAddress returns null for it on a
+              // plain ES 3.x driver. Before the forced resync it was reached only when an app
+              // actually set a logic op; now every MakeCurrent would call it, so the null check
+              // is mandatory rather than defensive.
+                if (g_GLESFuncs.glLogicOp &&
+                    (forceFullPush || parameters.LogicOp != g_syncedRenderStateParameters.LogicOp)) {
                     g_GLESFuncs.glLogicOp(MG_Util::ConvertLogicOperationToGLEnum(parameters.LogicOp));
                 }
             }
 
             if (headSpanDirty) { // Polygon offset (head-span scalars, like line width / point size below)
-                if (parameters.PolygonOffsetFactor != g_syncedRenderStateParameters.PolygonOffsetFactor ||
+                if (forceFullPush || parameters.PolygonOffsetFactor != g_syncedRenderStateParameters.PolygonOffsetFactor ||
                     parameters.PolygonOffsetUnits != g_syncedRenderStateParameters.PolygonOffsetUnits) {
                     g_GLESFuncs.glPolygonOffset(parameters.PolygonOffsetFactor, parameters.PolygonOffsetUnits);
                 }
             }
 
             if (headSpanDirty) { // Line width
-                if (parameters.LineWidth != g_syncedRenderStateParameters.LineWidth) {
+                if (forceFullPush || parameters.LineWidth != g_syncedRenderStateParameters.LineWidth) {
                     g_GLESFuncs.glLineWidth(parameters.LineWidth);
                 }
             }
 
-            if (headSpanDirty) { // Point size
+            if (headSpanDirty) { // Point size (GLES 1.x only - ES 2+ sets it from gl_PointSize,
-                if (parameters.PointSize != g_syncedRenderStateParameters.PointSize) {
+              // so the entry point is absent on most drivers; see the glLogicOp note above)
+                if (g_GLESFuncs.glPointSize &&
+                    (forceFullPush || parameters.PointSize != g_syncedRenderStateParameters.PointSize)) {
                     g_GLESFuncs.glPointSize(parameters.PointSize);
                 }
             }
 
             if (tailSpanDirty) { // Sample coverage
-                if (parameters.SampleCoverageValue != g_syncedRenderStateParameters.SampleCoverageValue ||
+                if (forceFullPush || parameters.SampleCoverageValue != g_syncedRenderStateParameters.SampleCoverageValue ||
                     parameters.SampleCoverageInvert != g_syncedRenderStateParameters.SampleCoverageInvert) {
                     g_GLESFuncs.glSampleCoverage(parameters.SampleCoverageValue,
                                                 ToGLBoolean(parameters.SampleCoverageInvert));
@@ -1842,7 +1966,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
 
             if (tailSpanDirty) { // Sample mask
-                if (g_GLESFuncs.glSampleMaski && parameters.SampleMaskValue != g_syncedRenderStateParameters.SampleMaskValue) {
+                if (g_GLESFuncs.glSampleMaski &&
+                    (forceFullPush || parameters.SampleMaskValue != g_syncedRenderStateParameters.SampleMaskValue)) {
                     g_GLESFuncs.glSampleMaski(0, parameters.SampleMaskValue);
                 }
             }
@@ -2009,6 +2134,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (!framebuffer || framebuffer == MG_Impl::GLImpl::FramebufferImpl::pDefaultFramebufferInfo->defaultFBO) {
+            // Same reset as SyncCurrentFBO's default-framebuffer branch: SyncToBackend is the
+            // only writer of the widened-attachment mask, so a path that skips it has to say so
+            // explicitly. It matters here because the DSA clears and glBlitFramebuffer briefly
+            // sync a DIFFERENT framebuffer as DRAW and then restore the application's through
+            // ForceBindCurrentFBO - which lands right here when that one is the default.
+            if (target == FramebufferTarget::Draw) {
+                FramebufferImpl::g_alphaWidenedDrawBufferMask = 0;
+                FramebufferImpl::g_integerColorDrawBufferMask = 0;
+            }
             FramebufferImpl::BindFramebufferId(
                 target == FramebufferTarget::Draw ? GL_DRAW_FRAMEBUFFER : GL_READ_FRAMEBUFFER, 0);
             return;
@@ -2929,7 +3063,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #endif
         TextureImpl::SyncNeccessaryTextures();
         FramebufferImpl::SyncCurrentFBO();
-        RenderStateImpl::SyncRenderState();
+        // A colour clear is exactly the operation that is allowed to write a widened
+        // attachment's alpha - it is what puts the 1.0 there that every later draw is masked
+        // away from. SyncCurrentFBO ran first, so g_alphaWidenedDrawBufferMask already describes
+        // the framebuffer this clear will land on.
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/(mask & GL_COLOR_BUFFER_BIT) != 0);
 
         BindCurrentFBO(FramebufferTarget::Draw);
 
@@ -2967,10 +3105,26 @@ namespace MobileGL::MG_Backend::DirectGLES {
             const FloatVec4& cc = MG_State::pGLContext->GetRenderStateParameters().ClearColor;
             const Bool outOfRange = cc.x() < 0.f || cc.x() > 1.f || cc.y() < 0.f || cc.y() > 1.f || cc.z() < 0.f ||
                                     cc.z() > 1.f || cc.w() < 0.f || cc.w() > 1.f;
+            // A widened attachment's stored alpha has to end up 1.0, and glClear applies ONE
+            // clear colour to every draw buffer - so a framebuffer that mixes a widened
+            // attachment with a native one cannot be served by doctoring glClearColor. Take the
+            // same per-draw-buffer glClearBufferfv route the out-of-range case already uses and
+            // substitute the alpha only where it belongs. Scissor and the colour write mask apply
+            // to glClearBufferfv exactly as they do to glClear, so a scissored clear stays
+            // scissored and an application that masked alpha off still gets its way (the storage
+            // then keeps the 1.0 an earlier clear left, which is the same answer).
+            //
+            // glClearBufferfv on an INTEGER colour buffer is GL_INVALID_OPERATION, so a
+            // framebuffer with one of those as a draw buffer keeps plain glClear - which ES
+            // leaves undefined for integer colour buffers anyway, and which an application that
+            // wants a defined answer must replace with glClearBufferuiv/iv (those DO substitute
+            // the widened alpha). The out-of-range trigger is left exactly as it was.
+            const Uint32 widenedDrawBuffers = FramebufferImpl::g_alphaWidenedDrawBufferMask;
+            const Bool widenedColorClear =
+                widenedDrawBuffers != 0 && FramebufferImpl::g_integerColorDrawBufferMask == 0;
             GLint clearDrawFbo = 0;
             g_GLESFuncs.glGetIntegerv(GL_DRAW_FRAMEBUFFER_BINDING, &clearDrawFbo);
-            if (outOfRange && clearDrawFbo != 0) {
+            if ((outOfRange || widenedColorClear) && clearDrawFbo != 0) {
-                const GLfloat value[4] = {cc.x(), cc.y(), cc.z(), cc.w()};
                 GLint maxDrawBuffers = 0;
                 GLint clearedCount = 0;
                 GLint firstDb = -1;
@@ -2980,6 +3134,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     g_GLESFuncs.glGetIntegerv(GL_DRAW_BUFFER0 + static_cast<GLenum>(i), &db);
                     if (i == 0) firstDb = db;
                     if (db != GL_NONE) {
+                        const Bool widened = i < 32 && (widenedDrawBuffers & (1u << i)) != 0;
+                        const GLfloat value[4] = {cc.x(), cc.y(), cc.z(), widened ? 1.0f : cc.w()};
                         g_GLESFuncs.glClearBufferfv(GL_COLOR, i, value);
                         ++clearedCount;
                     }
@@ -5189,50 +5345,41 @@ namespace MobileGL::MG_Backend::DirectGLES {
         g_GLESFuncs.glGetProgramiv(backendProgramId, pname, params);
     }
 
-    void GetProgramInterfaceiv(GLuint program, GLenum programInterface, GLenum pname, GLint* params) {
+    // NOTE the shape here, and do not "simplify" it back to GetBackendProgramId(): this entry
-        GLuint backendProgramId = GetBackendProgramId(program);
+    // point must never be the thing that BUILDS a backend program.
-        if (!backendProgramId) return;
+    //
-        g_GLESFuncs.glGetProgramInterfaceiv(backendProgramId, programInterface, pname, params);
+    // The frontend has already recorded the rebinding on the program object
-    }
+    // (SetShaderStorageBlockBinding) - that record is what GL_BUFFER_BINDING reports and what
+    // BackendProgramObjectImpl::SyncToBackend replays onto every driver program it builds. So
+    // the only work left here is an optimisation: push the change straight onto a driver
+    // program that is ALREADY built and already current with this link, so the next draw does
+    // not have to be preceded by a rebuild.
+    //
+    // Calling GetBackendProgramId() instead would sync-on-demand from a non-draw entry point,
+    // i.e. transpile and compile the whole program while the draw-path globals that the ESSL
+    // is generated against (PrgramImpl::g_fragColorBroadcastCount, the snorm/unorm clamp
+    // masks - established by SyncCurrentProgram) still hold another program's values. That
+    // bakes a program against the wrong state, and under CPU load it was also observed to
+    // fail the driver compile outright. Deferring is spec-fine: a binding only has to take
+    // effect by the block's next use.
+    void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding) {
+        if (!storageBlockName) return;
+        if (!MG_State::pGLContext->ValidateProgramName(program)) return;
+        auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+        if (!programObject) return;
 
-    GLuint GetProgramResourceIndex(GLuint program, GLenum programInterface, const GLchar* name) {
+        auto* backendProgramSlot = PrgramImpl::g_backendProgramObjects.Find(programObject.get());
-        GLuint backendProgramId = GetBackendProgramId(program);
+        if (!backendProgramSlot || !*backendProgramSlot) return;
-        if (!backendProgramId) return GL_INVALID_INDEX;
+        auto& backendObj = *backendProgramSlot;
-        return g_GLESFuncs.glGetProgramResourceIndex(backendProgramId, programInterface, name);
+        // Not merely "a program id exists": a backend object whose synced link version has
-    }
+        // fallen behind is about to be rebuilt anyway, and its current driver interface is
-
+        // the PREVIOUS link's - applying to it could land the binding on an unrelated block.
-    void GetProgramResourceName(GLuint program, GLenum programInterface, GLuint index, GLsizei bufSize, GLsizei* length,
+        if (!backendObj->GetBackendProgramId() ||
-                                GLchar* name) {
+            backendObj->GetSyncedLinkVersion() != programObject->GetLinkVersion()) {
-        GLuint backendProgramId = GetBackendProgramId(program);
+            return; // SyncToBackend's reseed will carry it
-        if (!backendProgramId) return;
+        }
-        g_GLESFuncs.glGetProgramResourceName(backendProgramId, programInterface, index, bufSize, length, name);
+        PrgramImpl::ApplyShaderStorageBlockBinding(backendObj->GetBackendProgramId(), storageBlockName,
-    }
+                                                   storageBlockBinding);
-
-    void GetProgramResourceiv(GLuint program, GLenum programInterface, GLuint index, GLsizei propCount,
-                              const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params) {
-        GLuint backendProgramId = GetBackendProgramId(program);
-        if (!backendProgramId) return;
-        g_GLESFuncs.glGetProgramResourceiv(backendProgramId, programInterface, index, propCount, props, bufSize, length,
-                                           params);
-    }
-
-    GLint GetProgramResourceLocation(GLuint program, GLenum programInterface, const GLchar* name) {
-        GLuint backendProgramId = GetBackendProgramId(program);
-        if (!backendProgramId) return -1;
-        return g_GLESFuncs.glGetProgramResourceLocation(backendProgramId, programInterface, name);
-    }
-
-    GLint GetProgramResourceLocationIndex(GLuint program, GLenum programInterface, const GLchar* name) {
-        (void)program;
-        (void)programInterface;
-        (void)name;
-        return -1;
-    }
-
-    void ShaderStorageBlockBinding(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding) {
-        GLuint backendProgramId = GetBackendProgramId(program);
-        if (!backendProgramId) return;
-        g_GLESFuncs.glShaderStorageBlockBinding(backendProgramId, storageBlockIndex, storageBlockBinding);
     }
 
     void ClearBufferfi(GLenum buffer, GLint drawbuffer, GLfloat depth, GLint stencil) {
@@ -5245,37 +5392,82 @@ namespace MobileGL::MG_Backend::DirectGLES {
         g_GLESFuncs.glClearBufferfi(buffer, drawbuffer, depth, stencil);
     }
 
+    namespace {
+        using FramebufferImpl::SubstituteWidenedClearAlpha;
+
+        // A colour attachment the backend widened from three channels to four has to end up
+        // holding alpha 1.0 - the value GL reports for a channel the application's format does
+        // not have - so an explicit per-buffer clear of it writes 1.0 rather than whatever the
+        // application passed (SubstituteWidenedClearAlpha, in Managers.h). Draws can never move
+        // it again: their alpha write mask is forced off, see SyncRenderState. That pairing is
+        // what makes GL_DST_ALPHA blending, glReadPixels and glBlitFramebuffer all see the right
+        // value without any of them being intercepted.
+
+        // Whether draw buffer `drawbuffer` of the framebuffer currently bound as DRAW is such an
+        // attachment. Answered from the mask SyncCurrentFBO just recomputed, so it costs nothing.
+        Bool IsWidenedBoundDrawBuffer(GLenum buffer, GLint drawbuffer) {
+            return buffer == GL_COLOR && drawbuffer >= 0 && drawbuffer < 32 &&
+                   (FramebufferImpl::g_alphaWidenedDrawBufferMask & (1u << drawbuffer)) != 0;
+        }
+
+        // The same question for an explicitly named framebuffer (the DSA clears), which is NOT
+        // the one g_alphaWidenedDrawBufferMask describes at the point these run.
+        Bool IsWidenedNamedDrawBuffer(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer,
+                                      GLenum buffer, GLint drawbuffer) {
+            using FBO = MG_State::GLState::FramebufferObject;
+            if (buffer != GL_COLOR || !framebuffer || drawbuffer < 0 ||
+                drawbuffer >= static_cast<GLint>(FBO::MAX_DRAW_BUFFERS)) {
+                return false;
+            }
+            const auto frontendBuf = framebuffer->GetDrawBuffers()[static_cast<SizeT>(drawbuffer)];
+            if (frontendBuf < FramebufferAttachmentType::Color0 ||
+                frontendBuf > FramebufferAttachmentType::Color31) {
+                return false;
+            }
+            return FramebufferImpl::IsAlphaWidenedColorAttachment(framebuffer->GetAttachment(frontendBuf));
+        }
+    } // namespace
+
     void ClearBufferfv(GLenum buffer, GLint drawbuffer, const GLfloat* value) {
         TextureImpl::SyncNeccessaryTextures();
         FramebufferImpl::SyncCurrentFBO();
-        RenderStateImpl::SyncRenderState();
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/buffer == GL_COLOR);
 
         BindCurrentFBO(FramebufferTarget::Draw);
 
-        g_GLESFuncs.glClearBufferfv(buffer, drawbuffer, value);
+        GLfloat widenedValue[4] = {};
+        g_GLESFuncs.glClearBufferfv(
+            buffer, drawbuffer,
+            SubstituteWidenedClearAlpha(value, IsWidenedBoundDrawBuffer(buffer, drawbuffer), 1.0f, widenedValue));
     }
 
     void ClearBufferiv(GLenum buffer, GLint drawbuffer, const GLint* value) {
         TextureImpl::SyncNeccessaryTextures();
         FramebufferImpl::SyncCurrentFBO();
-        RenderStateImpl::SyncRenderState();
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/buffer == GL_COLOR);
 
         // SyncCurrentFBO early-outs for the default framebuffer, so without this
         // bind a user-FBO -> default-FBO switch would leave the clear landing on
         // the stale driver DRAW binding (the fi/fv/uiv siblings all bind too).
         BindCurrentFBO(FramebufferTarget::Draw);
 
-        g_GLESFuncs.glClearBufferiv(buffer, drawbuffer, value);
+        GLint widenedValue[4] = {};
+        g_GLESFuncs.glClearBufferiv(
+            buffer, drawbuffer,
+            SubstituteWidenedClearAlpha(value, IsWidenedBoundDrawBuffer(buffer, drawbuffer), GLint(1), widenedValue));
     }
 
     void ClearBufferuiv(GLenum buffer, GLint drawbuffer, const GLuint* value) {
         TextureImpl::SyncNeccessaryTextures();
         FramebufferImpl::SyncCurrentFBO();
-        RenderStateImpl::SyncRenderState();
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/buffer == GL_COLOR);
 
         BindCurrentFBO(FramebufferTarget::Draw);
 
-        g_GLESFuncs.glClearBufferuiv(buffer, drawbuffer, value);
+        GLuint widenedValue[4] = {};
+        g_GLESFuncs.glClearBufferuiv(
+            buffer, drawbuffer,
+            SubstituteWidenedClearAlpha(value, IsWidenedBoundDrawBuffer(buffer, drawbuffer), GLuint(1), widenedValue));
     }
 
     void ClearNamedFramebufferfv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer,
@@ -5284,9 +5476,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         DebugImpl::OpenGLScopeMarker marker(__func__);
 #endif
         TextureImpl::SyncNeccessaryTextures();
-        RenderStateImpl::SyncRenderState();
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/buffer == GL_COLOR);
 
         SyncAndBindFramebufferObject(framebuffer, FramebufferTarget::Draw, true);
+        GLfloat widenedValue[4] = {};
+        value = SubstituteWidenedClearAlpha(value, IsWidenedNamedDrawBuffer(framebuffer, buffer, drawbuffer), 1.0f,
+                                            widenedValue);
         g_GLESFuncs.glClearBufferfv(buffer, drawbuffer, value);
         DebugImpl::ErrorLopper::Loop([file = __FILE__, line = __LINE__](auto err) {
             MGLOG_D("ES error (%s:%d): %s", file, line, MG_Util::ConvertGLEnumToString(err).c_str());
@@ -5318,9 +5513,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         DebugImpl::OpenGLScopeMarker marker(__func__);
 #endif
         TextureImpl::SyncNeccessaryTextures();
-        RenderStateImpl::SyncRenderState();
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/buffer == GL_COLOR);
 
         SyncAndBindFramebufferObject(framebuffer, FramebufferTarget::Draw, true);
+        GLint widenedValue[4] = {};
+        value = SubstituteWidenedClearAlpha(value, IsWidenedNamedDrawBuffer(framebuffer, buffer, drawbuffer),
+                                            GLint(1), widenedValue);
         g_GLESFuncs.glClearBufferiv(buffer, drawbuffer, value);
         DebugImpl::ErrorLopper::Loop([file = __FILE__, line = __LINE__](auto err) {
             MGLOG_D("ES error (%s:%d): %s", file, line, MG_Util::ConvertGLEnumToString(err).c_str());
@@ -5335,9 +5533,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         DebugImpl::OpenGLScopeMarker marker(__func__);
 #endif
         TextureImpl::SyncNeccessaryTextures();
-        RenderStateImpl::SyncRenderState();
+        RenderStateImpl::SyncRenderState(/*forColorClear=*/buffer == GL_COLOR);
 
         SyncAndBindFramebufferObject(framebuffer, FramebufferTarget::Draw, true);
+        GLuint widenedValue[4] = {};
+        value = SubstituteWidenedClearAlpha(value, IsWidenedNamedDrawBuffer(framebuffer, buffer, drawbuffer),
+                                            GLuint(1), widenedValue);
         g_GLESFuncs.glClearBufferuiv(buffer, drawbuffer, value);
         DebugImpl::ErrorLopper::Loop([file = __FILE__, line = __LINE__](auto err) {
             MGLOG_D("ES error (%s:%d): %s", file, line, MG_Util::ConvertGLEnumToString(err).c_str());
@@ -5610,16 +5811,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                format == GL_RGBA_INTEGER;
     }
 
-    // Expands a tightly-packed narrow read (1-3 channels per texel) into the 4-channel wide RGBA
+    // The bit pattern of 1.0 in a wide-read component type: what GL reports for a channel the
-    // layout ConvertWideReadbackRow expects. Missing G/B read zero; missing A reads one, encoded in
+    // attachment's format does not have.
-    // the source component type.
+    static void FillWideReadOneBits(GLenum componentType, Uint8* oneBits) {
-    static void ExpandNarrowWideRead(Vector<Uint8>& data, SizeT pixelCount, Int srcChannels, GLenum componentType) {
-        const SizeT componentSize = GetReadbackComponentSize(componentType);
-        if (componentSize == 0 || srcChannels <= 0 || srcChannels >= 4) {
-            return;
-        }
-        Uint8 zeroBits[4] = {0, 0, 0, 0};
-        Uint8 oneBits[4] = {0, 0, 0, 0};
         switch (componentType) {
         case GL_UNSIGNED_BYTE:
             oneBits[0] = 0xFF;
@@ -5656,6 +5850,35 @@ namespace MobileGL::MG_Backend::DirectGLES {
         default:
             break;
         }
+    }
+
+    // Overwrites the alpha of a 4-channel wide read with the format's implied 1.0. Used for an
+    // attachment the backend widened from three channels to keep it colour-renderable: the storage
+    // has a real alpha channel holding whatever the draw wrote, but the format the application
+    // asked for has none, and GL reads a missing channel back as one.
+    static void ForceWideReadAlphaToOne(Vector<Uint8>& data, SizeT pixelCount, GLenum componentType) {
+        const SizeT componentSize = GetReadbackComponentSize(componentType);
+        if (componentSize == 0 || data.size() < pixelCount * 4 * componentSize) {
+            return;
+        }
+        Uint8 oneBits[4] = {0, 0, 0, 0};
+        FillWideReadOneBits(componentType, oneBits);
+        for (SizeT i = 0; i < pixelCount; ++i) {
+            Memcpy(data.data() + (i * 4 + 3) * componentSize, oneBits, componentSize);
+        }
+    }
+
+    // Expands a tightly-packed narrow read (1-3 channels per texel) into the 4-channel wide RGBA
+    // layout ConvertWideReadbackRow expects. Missing G/B read zero; missing A reads one, encoded in
+    // the source component type.
+    static void ExpandNarrowWideRead(Vector<Uint8>& data, SizeT pixelCount, Int srcChannels, GLenum componentType) {
+        const SizeT componentSize = GetReadbackComponentSize(componentType);
+        if (componentSize == 0 || srcChannels <= 0 || srcChannels >= 4) {
+            return;
+        }
+        Uint8 zeroBits[4] = {0, 0, 0, 0};
+        Uint8 oneBits[4] = {0, 0, 0, 0};
+        FillWideReadOneBits(componentType, oneBits);
 
         Vector<Uint8> expanded(pixelCount * 4 * componentSize);
         for (SizeT i = 0; i < pixelCount; ++i) {
@@ -5700,9 +5923,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // Reads the current READ framebuffer as wide RGBA(_INTEGER) and repacks the pixels into the client's
     // (format, type) layout. Returns false when the combination is not convertible (the caller keeps its
     // "not implemented" skip); returns true when the request was handled, even if it degraded to a logged no-op.
+    // `forceOpaqueAlpha`: the source image is a three-channel format the backend widened to four to
+    // keep it colour-renderable, so its alpha channel holds whatever the draw wrote and has to be
+    // answered with the 1.0 the application's format implies. Passed in rather than derived here:
+    // glReadPixels reads the bound READ framebuffer, but glGetTexImage reads a texture through a
+    // scratch framebuffer, so the frontend's READ binding describes a different image entirely -
+    // consulting it there would both miss real widenings and corrupt readbacks of ordinary
+    // textures taken while some unrelated widened attachment happened to be bound.
     static Bool ReadPixelsViaFormatConversion(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format,
-                                              GLenum type, void* pixels, Bool honorPackImageParams = false,
+                                              GLenum type, void* pixels, Bool honorPackImageParams,
-                                              Bool applyFixedPointReadClamp = true) {
+                                              Bool applyFixedPointReadClamp, Bool forceOpaqueAlpha) {
         ReadbackChannelMapping mapping{};
         if (!GetReadbackChannelMapping(format, mapping)) {
             return false;
@@ -5829,6 +6059,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
             ExpandNarrowWideRead(wide, static_cast<SizeT>(width) * static_cast<SizeT>(height), readChannels, wideType);
         }
 
+        // Undo the three-channel widening (see the parameter's comment). Deliberately not gated on
+        // applyFixedPointReadClamp: that flag implements GL_CLAMP_READ_COLOR, which glGetTexImage
+        // is exempt from, whereas "a format without alpha reads as 1.0" is the format's own
+        // semantics and applies to every read.
+        if (forceOpaqueAlpha) {
+            ForceWideReadAlphaToOne(wide, static_cast<SizeT>(width) * static_cast<SizeT>(height), wideType);
+        }
+
         // GL clamps a read from a fixed-point colour buffer to [0,1] (GL_CLAMP_READ_COLOR
         // defaults to GL_FIXED_ONLY). Formats the backend substitutes with a floating-point
         // one keep the out-of-range value the app stored, so apply the clamp here - a
@@ -5987,11 +6225,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // the driver accepts for the current attachment. GL_PACK_SWAP_BYTES has no ES equivalent, so
         // it always takes the conversion path (which swaps on the CPU).
         const Bool packSwapBytes = MG_State::pGLContext->GetPixelStoreParameters(false).SwapBytes;
-        const Bool nativeFastPair = !packSwapBytes &&
+        // The read buffer is what glReadPixels reads, so the frontend's READ binding is exactly
+        // the right thing to ask here.
+        const Bool forceOpaqueAlpha = FramebufferImpl::IsAlphaWidenedFallbackReadAttachment();
+        // An attachment widened from three channels to stay colour-renderable also has to leave
+        // the fast pair: only the conversion path knows to answer its alpha with the 1.0 the
+        // application's format implies instead of whatever the draw wrote into the added channel.
+        const Bool nativeFastPair = !packSwapBytes && !forceOpaqueAlpha &&
                                     ((format == GL_RGBA && type == GL_UNSIGNED_BYTE) ||
                                      (format == GL_RGBA_INTEGER && (type == GL_UNSIGNED_INT || type == GL_INT)));
         if (convertible && !nativeFastPair) {
-            if (ReadPixelsViaFormatConversion(x, y, width, height, format, type, pixels)) {
+            if (ReadPixelsViaFormatConversion(x, y, width, height, format, type, pixels,
+                                              /*honorPackImageParams=*/false, /*applyFixedPointReadClamp=*/true,
+                                              forceOpaqueAlpha)) {
                 MGLOG_D("ReadPixels: finished via client-format conversion");
                 return;
             }
@@ -6050,7 +6296,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
             MGLOG_D("ReadPixels: native read of %s/%s failed (%s), retrying via client-format conversion",
                     MG_Util::ConvertGLEnumToString(format).c_str(), MG_Util::ConvertGLEnumToString(type).c_str(),
                     MG_Util::ConvertGLEnumToString(nativeReadError).c_str());
-            if (ReadPixelsViaFormatConversion(x, y, width, height, format, type, pixels)) {
+            if (ReadPixelsViaFormatConversion(x, y, width, height, format, type, pixels,
+                                              /*honorPackImageParams=*/false, /*applyFixedPointReadClamp=*/true,
+                                              forceOpaqueAlpha)) {
                 MGLOG_D("ReadPixels: finished via client-format conversion after native failure");
                 return;
             }
@@ -6231,6 +6479,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // for normalized attachments), while the conversion path reads a wide format that is always
         // accepted and repacks on the CPU.
         if (convertible) {
+            // The image being read is this texture, not whatever the application left bound to
+            // GL_READ_FRAMEBUFFER, so the widening question has to be asked of the texture.
+            const Bool forceOpaqueAlpha =
+                TextureImpl::BackendTextureFormatAddsAlpha(textureObject->GetFormat(), textureObject->GetTarget());
             // GL_PACK_IMAGE_HEIGHT/GL_PACK_SKIP_IMAGES only apply to 3D/array image
             // readbacks (cube-map arrays address as arrays); 2D targets must ignore
             // them (GL 3.3 section 6.1.4).
@@ -6276,7 +6528,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     void* sliceDst = static_cast<Uint8*>(pixels) + sliceOffset;
                     if (!ReadPixelsViaFormatConversion(0, 0, size.x(), size.y(), format, type, sliceDst,
                                                        /*honorPackImageParams=*/false,
-                                                       /*applyFixedPointReadClamp=*/false)) {
+                                                       /*applyFixedPointReadClamp=*/false, forceOpaqueAlpha)) {
                         allSlicesRead = false;
                         break;
                     }
@@ -6298,7 +6550,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
             if (tempFBOComplete && ReadPixelsViaFormatConversion(0, 0, size.x(), size.y(), format, type, pixels,
                                                                  applyPackImageParams,
-                                                                 /*applyFixedPointReadClamp=*/false)) {
+                                                                 /*applyFixedPointReadClamp=*/false,
+                                                                 forceOpaqueAlpha)) {
                 MGLOG_D("GetTexImage: finished via client-format conversion");
                 return;
             }
@@ -6778,6 +7031,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
         BufferImpl::InvalidatePixelBufferBindingCaches();
         FramebufferImpl::InvalidateFramebufferBindingCache();
         PixelStoreImpl::InvalidatePackStateCache();
+        // The render-state shadow belongs in this list for the same reason as the ones above:
+        // it describes the real ES context, which outlives the MobileGL context that is
+        // becoming current. See InvalidateSyncedRenderState.
+        RenderStateImpl::InvalidateSyncedRenderState();
         // eglSwapInterval requires a current context; a request made while none was
         // current (and dropped by the driver) is retried here.
         ApplyRequestedSwapInterval();

MobileGL/MG_Backend/DirectGLES/DirectGLES.h

@@ -92,15 +92,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
     void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
     void GetProgramiv(GLuint program, GLenum pname, GLint* params);
-    void GetProgramInterfaceiv(GLuint program, GLenum programInterface, GLenum pname, GLint* params);
+    void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding);
-    GLuint GetProgramResourceIndex(GLuint program, GLenum programInterface, const GLchar* name);
-    void GetProgramResourceName(GLuint program, GLenum programInterface, GLuint index, GLsizei bufSize, GLsizei* length,
-                                GLchar* name);
-    void GetProgramResourceiv(GLuint program, GLenum programInterface, GLuint index, GLsizei propCount,
-                              const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params);
-    GLint GetProgramResourceLocation(GLuint program, GLenum programInterface, const GLchar* name);
-    GLint GetProgramResourceLocationIndex(GLuint program, GLenum programInterface, const GLchar* name);
-    void ShaderStorageBlockBinding(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding);
     Bool InitWindowSurface(NativeWindowType window);
     Bool InitPbufferSurface(EGLint width, EGLint height);
     Bool MakeCurrent();
@@ -196,6 +188,26 @@ namespace MobileGL::MG_Backend::DirectGLES {
         void OnBackendContextDestroyed();
     } // namespace XfbImpl
 
+    namespace RenderStateImpl {
+        // Pushes the frontend's render-state block to the ES driver, diffed against what was
+        // last pushed.
+        //
+        // `forColorClear` names the CALLER, and the only thing it changes is the colour write
+        // mask handed to the driver. A draw into a colour attachment the backend widened from
+        // three channels to four gets that buffer's alpha channel masked OFF, so nothing can
+        // move the stored alpha away from the 1.0 the application's three-channel format
+        // implies (see FramebufferImpl::g_alphaWidenedDrawBufferMask). A CLEAR is how that 1.0
+        // gets there in the first place, so it must be allowed to write alpha - hence the flag
+        // rather than an unconditional doctoring. It is part of the sync memo, so a clear
+        // followed by a draw re-pushes the mask instead of early-outing on an unchanged
+        // frontend version.
+        //
+        // The application's own colour mask is never modified: glGet(GL_COLOR_WRITEMASK)
+        // answers from the frontend state, which this function only reads.
+        void SyncRenderState(Bool forColorClear = false);
+        void InvalidateSyncedRenderState();
+    } // namespace RenderStateImpl
+
     extern MG_External::EGLFunctionsTable g_EGLFuncs;
     extern MG_External::GLESFunctionsTable g_GLESFuncs;
     extern MG_External::GLESCapabilities g_GLESCapabilities;

MobileGL/MG_Backend/DirectGLES/Managers.cpp

@@ -1869,6 +1869,154 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
         }
 
+        // Components per texel the frontend format's client data carries. Only the three-channel
+        // formats that can be widened to a four-channel render target need an answer (see
+        // PrepareChannelWidenedUpload); everything else keeps its own layout and reports 0.
+        Uint GetWidenableClientComponentCount(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::RGB8Snorm:
+            case TextureInternalFormat::RGB16Snorm:
+            case TextureInternalFormat::RGB16:
+            case TextureInternalFormat::RGB10: // stored as RGB16 (UNorm16 shadow)
+            case TextureInternalFormat::RGB12: // stored as RGB16 (UNorm16 shadow)
+            case TextureInternalFormat::RGB16F:
+            case TextureInternalFormat::RGB32F:
+            case TextureInternalFormat::SRGB8:
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGB32I:
+            case TextureInternalFormat::RGB32UI:
+                return 3;
+            default:
+                return 0;
+            }
+        }
+
+        // True when the widened format's client data is integer rather than normalized. The two
+        // classes share every narrow component type - GL_RGB8I and GL_RGB8_SNORM are both uploaded
+        // as GL_BYTE - but their "1.0" differs: an integer channel's one is the integer 1, a
+        // normalized channel's is the saturated field. The type alone cannot tell them apart, so
+        // the source format has to.
+        Bool IsIntegerWidenableFormat(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGB32I:
+            case TextureInternalFormat::RGB32UI:
+                return true;
+            default:
+                return false;
+            }
+        }
+
+        // The bit pattern of 1.0 in an upload component type: what a format without alpha reads
+        // back as, and therefore what the synthetic fourth channel of a widened render target has
+        // to hold. Integer components carry the integer one, not a saturated field - and since
+        // GL_BYTE/GL_SHORT/GL_UNSIGNED_BYTE/GL_UNSIGNED_SHORT serve both classes, `integerData`
+        // is what decides, not the type.
+        static Bool GetUploadComponentOneBits(GLenum uploadType, Bool integerData, Uint8* outOneBits,
+                                              SizeT* outComponentSize) {
+            switch (uploadType) {
+            case GL_BYTE: {
+                const Int8 one = integerData ? Int8(1) : Int8(0x7F);
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_UNSIGNED_BYTE: {
+                const Uint8 one = integerData ? Uint8(1) : Uint8(0xFF);
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_SHORT: {
+                const Int16 one = integerData ? Int16(1) : Int16(0x7FFF);
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_UNSIGNED_SHORT: {
+                const Uint16 one = integerData ? Uint16(1) : Uint16(0xFFFF);
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_HALF_FLOAT: {
+                const Uint16 one = 0x3C00; // half 1.0
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_FLOAT: {
+                const Float one = 1.0f;
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_INT: {
+                const Int32 one = 1;
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            case GL_UNSIGNED_INT: {
+                const Uint32 one = 1;
+                Memcpy(outOneBits, &one, sizeof(one));
+                *outComponentSize = sizeof(one);
+                return true;
+            }
+            default:
+                return false;
+            }
+        }
+
+        // A three-channel format widened to four to keep a colour attachment renderable (see
+        // NormalizePixelFormat) is described to the driver as a four-component transfer, so the
+        // three-component client data has to be repacked with an alpha of 1.0 - otherwise the
+        // driver walks three texels' worth of data per four-texel row and the image shears.
+        // `componentCount` is the SOURCE component count and `byteSize` the source's size, so this
+        // runs after any type conversion (which keeps the component count) has already happened.
+        const void* PrepareChannelWidenedUpload(Uint componentCount, const IntVec3& texelSize,
+                                                const void* data, SizeT byteSize, GLenum uploadType,
+                                                Vector<Uint8>& widenedData, Bool integerData) {
+            Uint8 oneBits[8] = {};
+            SizeT componentSize = 0;
+            if (componentCount != 3 || data == nullptr || byteSize == 0 ||
+                !GetUploadComponentOneBits(uploadType, integerData, oneBits, &componentSize)) {
+                return data;
+            }
+
+            const SizeT srcTexelBytes = componentSize * componentCount;
+            // Sized from the level, never from the source: the driver reads a full
+            // width*height*depth*4 components for the transfer it was handed, so a source that
+            // somehow holds fewer texels must still leave a full destination behind (its tail
+            // reads as transparent black with the format's implied opaque alpha) rather than a
+            // short buffer the driver would run off the end of.
+            const SizeT texelCount = static_cast<SizeT>(std::max(texelSize.x(), 0)) *
+                                     static_cast<SizeT>(std::max(texelSize.y(), 0)) *
+                                     static_cast<SizeT>(std::max(texelSize.z(), 1));
+            if (texelCount == 0) {
+                return data;
+            }
+            const SizeT copyTexelCount = std::min(texelCount, byteSize / srcTexelBytes);
+
+            widenedData.assign(texelCount * componentSize * 4, 0);
+            const auto* src = static_cast<const Uint8*>(data);
+            Uint8* dst = widenedData.data();
+            for (SizeT i = 0; i < texelCount; ++i, dst += componentSize * 4) {
+                if (i < copyTexelCount) {
+                    Memcpy(dst, src, srcTexelBytes);
+                    src += srcTexelBytes;
+                }
+                Memcpy(dst + srcTexelBytes, oneBits, componentSize);
+            }
+            return widenedData.data();
+        }
+
         static const void* PrepareNormFloatFallbackUpload(TextureInternalFormat format,
                                                           const IntVec3& texelSize,
                                                           const void* data,
@@ -1914,6 +2062,39 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return convertedData.data();
         }
 
+        // The two shadow -> upload conversions a fallback storage format can need, in order:
+        // the component type first (SNORM/UNORM shadows into the float the fallback stores), then
+        // the component count (three-channel client data into a four-channel widened render
+        // target). They compose: GL_RGB8_SNORM on a driver with no renderable three-channel
+        // format becomes GL_RGBA16F, so its Int8x3 shadow is converted to Float x3 and then
+        // repacked as Float x4 with alpha 1.0.
+        //
+        // Both scratch buffers belong to the caller so they outlive the returned pointer; the
+        // return value is `data` itself whenever neither conversion applies, which is what the
+        // sub-rect upload fast path tests for.
+        static const void* PrepareFallbackUpload(TextureInternalFormat format, TextureTarget target,
+                                                 const IntVec3& texelSize, const void* data, SizeT byteSize,
+                                                 GLenum uploadType, Vector<Float>& convertedData,
+                                                 Vector<Uint8>& widenedData) {
+            const void* uploadData =
+                PrepareNormFloatFallbackUpload(format, texelSize, data, byteSize, uploadType, convertedData);
+            // The component-count switch first: it rules out every format that cannot be widened
+            // (which is nearly all of them, including GL_RGBA8) without touching the capability
+            // cache, so an ordinary atlas upload does not pay for a per-level cache lookup.
+            const Uint componentCount = GetWidenableClientComponentCount(format);
+            if (componentCount == 0 || !TextureImpl::BackendTextureFormatAddsAlpha(format, target)) {
+                return uploadData;
+            }
+            // The type conversion above rewrites the level into `convertedData` at four bytes per
+            // component while keeping the component count, so the widening's source size is that
+            // buffer's, not the shadow's.
+            const SizeT uploadByteSize = (!convertedData.empty() && uploadData == convertedData.data())
+                                             ? convertedData.size() * sizeof(Float)
+                                             : byteSize;
+            return PrepareChannelWidenedUpload(componentCount, texelSize, uploadData, uploadByteSize, uploadType,
+                                               widenedData, IsIntegerWidenableFormat(format));
+        }
+
         // RGB565/RGB5_A1 shadow data is stored as 8-bit unorm; uploading it as GL_UNSIGNED_BYTE
         // leaves the 8-bit -> 5/6-bit requantization to the driver, whose rounding direction is
         // implementation-defined: Adreno rounds to nearest (lossless round trip) but Mali floors,
@@ -2121,9 +2302,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                               ? textureMipmapObject->MapMipmapData(uploadTarget, level)
                                               : nullptr;
                             Vector<Float> convertedUploadData;
-                            const void* uploadData = PrepareNormFloatFallbackUpload(
+                            Vector<Uint8> widenedUploadData;
-                                textureMipmapObject->GetFormat(), levelTexelSize, pData, levelByteSize, glType,
+                            const void* uploadData = PrepareFallbackUpload(
-                                convertedUploadData);
+                                textureMipmapObject->GetFormat(), targetInternal, levelTexelSize, pData,
+                                levelByteSize, glType, convertedUploadData, widenedUploadData);
                             Vector<Uint8> packedUploadData;
                             uploadData = PreparePackedNormUpload(textureMipmapObject->GetFormat(), levelTexelSize,
                                                                  uploadData, levelByteSize, &glType, packedUploadData);
@@ -2253,9 +2435,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                     auto glUploadTarget = ConvertTextureUploadTargetToBackendGLEnum(uploadTarget);
                                     auto* pData = textureMipmapObject->MapMipmapData(uploadTarget, level);
                                     Vector<Float> convertedUploadData;
-                                    const void* uploadData = PrepareNormFloatFallbackUpload(
+                                    Vector<Uint8> widenedUploadData;
-                                        textureMipmapObject->GetFormat(), levelTexelSize, pData, levelByteSize, glType,
+                                    const void* uploadData = PrepareFallbackUpload(
-                                        convertedUploadData);
+                                        textureMipmapObject->GetFormat(), targetInternal, levelTexelSize, pData,
+                                        levelByteSize, glType, convertedUploadData, widenedUploadData);
                                     Vector<Uint8> packedUploadData;
                                     uploadData =
                                         PreparePackedNormUpload(textureMipmapObject->GetFormat(), levelTexelSize,
@@ -2312,9 +2495,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                                   ? textureMipmapObject->MapMipmapData(uploadTarget, level)
                                                   : nullptr;
                                 Vector<Float> convertedUploadData;
-                                const void* uploadData = PrepareNormFloatFallbackUpload(
+                                Vector<Uint8> widenedUploadData;
-                                    textureMipmapObject->GetFormat(), levelTexelSize, pData, levelByteSize, glType,
+                                const void* uploadData = PrepareFallbackUpload(
-                                    convertedUploadData);
+                                    textureMipmapObject->GetFormat(), targetInternal, levelTexelSize, pData,
+                                    levelByteSize, glType, convertedUploadData, widenedUploadData);
                                 Vector<Uint8> packedUploadData;
                                 uploadData =
                                     PreparePackedNormUpload(textureMipmapObject->GetFormat(), levelTexelSize,
@@ -2422,9 +2606,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             auto texelSize = textureMipmapObject->GetMipmapTexelSize(uploadTarget, level);
                             const void* mipData = textureMipmapObject->MapMipmapData(uploadTarget, level);
                             Vector<Float> convertedUploadData;
-                            const void* uploadData = PrepareNormFloatFallbackUpload(
+                            Vector<Uint8> widenedUploadData;
-                                textureMipmapObject->GetFormat(), texelSize, mipData, byteSize, glType,
+                            const void* uploadData = PrepareFallbackUpload(
-                                convertedUploadData);
+                                textureMipmapObject->GetFormat(), targetInternal, texelSize, mipData, byteSize,
+                                glType, convertedUploadData, widenedUploadData);
                             Vector<Uint8> packedUploadData;
                             uploadData = PreparePackedNormUpload(textureMipmapObject->GetFormat(), texelSize,
                                                                  uploadData, byteSize, &glType, packedUploadData);
@@ -2827,7 +3012,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 MGLOG_D("%s(%s:%d) ES error %s", func, file, line, MG_Util::ConvertGLEnumToString(err).c_str());
             });
 
-            // A three-channel format widened to four for a multisample target (see
+            // A three-channel format widened to four to keep the image colour-renderable (see
             // NormalizePixelFormat) gains an alpha channel the frontend format does not have, and
             // whatever the draw that filled it wrote there is not what GL would report: a format
             // without alpha reads back as 1.0. Answer the ALPHA swizzle source with ONE so the
@@ -3139,6 +3324,113 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return false;
         }
 
+        // The colour attachment glReadPixels/glGetTexImage would read from, or nullptr when the
+        // read buffer names no colour attachment at all.
+        static const MG_State::GLState::FramebufferAttachmentObject* GetReadColorAttachment() {
+            const auto& readFBO =
+                MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject();
+            if (!readFBO) {
+                return nullptr;
+            }
+            const auto readBuffer = readFBO->GetReadBuffer();
+            if (readBuffer < FramebufferAttachmentType::Color0 || readBuffer > FramebufferAttachmentType::Color31) {
+                return nullptr;
+            }
+            return &readFBO->GetAttachment(readBuffer);
+        }
+
+        Bool IsAlphaWidenedColorAttachment(
+            const MG_State::GLState::FramebufferAttachmentObject& attachmentObject) {
+            if (attachmentObject.IsTexture()) {
+                const auto& textureObject = attachmentObject.GetTexture();
+                return textureObject && TextureImpl::BackendTextureFormatAddsAlpha(textureObject->GetFormat(),
+                                                                                   textureObject->GetTarget());
+            }
+            if (attachmentObject.IsRenderbuffer()) {
+                const auto& renderbufferObject = attachmentObject.GetRenderbuffer();
+                return renderbufferObject &&
+                       TextureImpl::BackendRenderbufferFormatAddsAlpha(renderbufferObject->GetInternalFormat());
+            }
+            return false;
+        }
+
+        Uint32 g_alphaWidenedDrawBufferMask = 0;
+        Uint32 g_integerColorDrawBufferMask = 0;
+
+        static Bool IsIntegerColorFormat(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::R8I:
+            case TextureInternalFormat::R8UI:
+            case TextureInternalFormat::R16I:
+            case TextureInternalFormat::R16UI:
+            case TextureInternalFormat::R32I:
+            case TextureInternalFormat::R32UI:
+            case TextureInternalFormat::RG8I:
+            case TextureInternalFormat::RG8UI:
+            case TextureInternalFormat::RG16I:
+            case TextureInternalFormat::RG16UI:
+            case TextureInternalFormat::RG32I:
+            case TextureInternalFormat::RG32UI:
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGB32I:
+            case TextureInternalFormat::RGB32UI:
+            case TextureInternalFormat::RGBA8I:
+            case TextureInternalFormat::RGBA8UI:
+            case TextureInternalFormat::RGBA16I:
+            case TextureInternalFormat::RGBA16UI:
+            case TextureInternalFormat::RGBA32I:
+            case TextureInternalFormat::RGBA32UI:
+            case TextureInternalFormat::RGB10A2UI:
+                return true;
+            default:
+                return false;
+            }
+        }
+
+        static Bool IsIntegerColorAttachment(
+            const MG_State::GLState::FramebufferAttachmentObject& attachmentObject) {
+            if (attachmentObject.IsTexture()) {
+                const auto& textureObject = attachmentObject.GetTexture();
+                return textureObject && IsIntegerColorFormat(textureObject->GetFormat());
+            }
+            if (attachmentObject.IsRenderbuffer()) {
+                const auto& renderbufferObject = attachmentObject.GetRenderbuffer();
+                return renderbufferObject && IsIntegerColorFormat(renderbufferObject->GetInternalFormat());
+            }
+            return false;
+        }
+
+        Uint32 ComputeAlphaWidenedDrawBufferMask(const MG_State::GLState::FramebufferObject& fbo) {
+            using FBO = MG_State::GLState::FramebufferObject;
+            const auto& drawBuffers = fbo.GetDrawBuffers();
+            Uint32 mask = 0;
+            for (Uint i = 0; i < FBO::MAX_DRAW_BUFFERS && i < 32; ++i) {
+                const auto frontendBuf = drawBuffers[i];
+                if (frontendBuf < FramebufferAttachmentType::Color0 ||
+                    frontendBuf > FramebufferAttachmentType::Color31) {
+                    continue;
+                }
+                if (IsAlphaWidenedColorAttachment(fbo.GetAttachment(frontendBuf))) {
+                    mask |= (1u << i);
+                }
+            }
+            return mask;
+        }
+
+        // The read attachment's storage carries an alpha channel its frontend format does not
+        // (the three-channel colour-renderable widening). GL answers such a read with 1.0, but
+        // the storage holds whatever the draw wrote there, so the readback has to overwrite it.
+        Bool IsAlphaWidenedFallbackReadAttachment() {
+            const auto* attachmentObject = GetReadColorAttachment();
+            if (attachmentObject == nullptr) {
+                return false;
+            }
+            return IsAlphaWidenedColorAttachment(*attachmentObject);
+        }
+
         Bool IsFixedPointFallbackReadAttachment() {
             const auto& readFBO =
                 MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Read).GetBoundObject();
@@ -3344,6 +3636,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             if (asTarget == FramebufferTarget::Draw) {
                 Uint32 snormClampOutputMask = 0;
                 Uint32 unormClampOutputMask = 0;
+                Uint32 alphaWidenedMask = 0;
+                Uint32 integerColorMask = 0;
                 for (Uint i = 0; i < FramebufferObject::MAX_DRAW_BUFFERS && i < 32; ++i) {
                     const auto frontendBuf = stateDrawBuffers[i];
                     if (frontendBuf < FramebufferAttachmentType::Color0 ||
@@ -3356,9 +3650,21 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     } else if (IsUnormFallbackAttachment(attachmentObject)) {
                         unormClampOutputMask |= (1u << i);
                     }
+                    // Independent of the two above: a widened attachment can be SNORM
+                    // (GL_RGB8_SNORM -> GL_RGBA16F, which also clamps) or not (GL_SRGB8 ->
+                    // GL_SRGB8_ALPHA8, which does not), so it gets its own bit rather than an
+                    // `else if` branch of theirs.
+                    if (IsAlphaWidenedColorAttachment(attachmentObject)) {
+                        alphaWidenedMask |= (1u << i);
+                    }
+                    if (IsIntegerColorAttachment(attachmentObject)) {
+                        integerColorMask |= (1u << i);
+                    }
                 }
                 PrgramImpl::g_snormFallbackClampOutputMask = snormClampOutputMask;
                 PrgramImpl::g_unormFallbackClampOutputMask = unormClampOutputMask;
+                g_alphaWidenedDrawBufferMask = alphaWidenedMask;
+                g_integerColorDrawBufferMask = integerColorMask;
             }
 
             // 2. Remap read buffer. glReadBuffer writes the READ-bound FBO's state, so
@@ -3812,6 +4118,34 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
         }
 
+        Bool ApplyShaderStorageBlockBinding(Uint backendProgramId, const String& blockName, Uint binding) {
+            if (backendProgramId == 0 || blockName.empty()) return false;
+            if (!g_GLESFuncs.glGetProgramResourceIndex || !g_GLESFuncs.glShaderStorageBlockBinding) return false;
+            GLuint driverIndex =
+                g_GLESFuncs.glGetProgramResourceIndex(backendProgramId, GL_SHADER_STORAGE_BLOCK, blockName.c_str());
+            if (driverIndex == GL_INVALID_INDEX) {
+                // An arrayed block is enumerated per element by GL but declared once; the
+                // generated ESSL carries the bare block name.
+                const auto bracket = blockName.rfind('[');
+                if (bracket == String::npos || blockName.back() != ']') return false;
+                driverIndex = g_GLESFuncs.glGetProgramResourceIndex(backendProgramId, GL_SHADER_STORAGE_BLOCK,
+                                                                    blockName.substr(0, bracket).c_str());
+                if (driverIndex == GL_INVALID_INDEX) return false;
+            }
+            g_GLESFuncs.glShaderStorageBlockBinding(backendProgramId, driverIndex, binding);
+            return true;
+        }
+
+        void ReseedShaderStorageBlockBindings(Uint backendProgramId,
+                                              const MG_State::GLState::ProgramObject& stateProgramObject) {
+            const auto& overrides = stateProgramObject.GetShaderStorageBlockBindingOverrides();
+            if (overrides.empty()) return; // the overwhelming majority of programs
+            for (const auto& [blockName, binding] : overrides) {
+                if (binding < 0) continue;
+                ApplyShaderStorageBlockBinding(backendProgramId, blockName, static_cast<Uint>(binding));
+            }
+        }
+
         void BackendProgramObjectImpl::SyncToBackend(
             const SharedPtr<MG_State::GLState::ProgramObject>& stateProgramObject) {
 #ifdef TRACY_ENABLE
@@ -3846,9 +4180,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
             if (attachedCount > 0) {
                 Vector<GLuint> attachedShaders(attachedCount);
-                GLsizei actualCount;
+                // Every GL out-param in this function is pre-initialized and every count is
+                // re-clamped after the query. A driver that returns without writing the
+                // out-param (no current context, a lost context, a stubbed entry point) would
+                // otherwise leak an uninitialized stack value straight into a container size
+                // or a loop bound - which is exactly how this path used to throw
+                // length_error out of a Vector fill-ctor.
+                GLsizei actualCount = 0;
                 g_GLESFuncs.glGetAttachedShaders(m_backendProgramId, attachedCount, &actualCount,
                                                  attachedShaders.data());
+                actualCount = std::clamp<GLsizei>(actualCount, 0, static_cast<GLsizei>(attachedShaders.size()));
                 MGLOG_D("Detaching %d existing shaders from program %u", actualCount, m_backendProgramId);
 
                 for (GLsizei i = 0; i < actualCount; ++i) {
@@ -3986,13 +4327,21 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 g_GLESFuncs.glShaderSource(backendShaderId, 1, &sourceCStr, nullptr);
                 g_GLESFuncs.glCompileShader(backendShaderId);
 
-                GLint compileStatus;
+                // GL_FALSE, not GL_TRUE: an unwritten out-param must read as "compile failed"
+                // and take the diagnostic path, never as a silent success that attaches an
+                // uncompiled shader.
+                GLint compileStatus = GL_FALSE;
                 g_GLESFuncs.glGetShaderiv(backendShaderId, GL_COMPILE_STATUS, &compileStatus);
                 if (compileStatus == GL_FALSE) {
-                    GLint logLength;
+                    GLint logLength = 0;
                     g_GLESFuncs.glGetShaderiv(backendShaderId, GL_INFO_LOG_LENGTH, &logLength);
-                    Vector<GLchar> log(logLength);
+                    if (logLength < 0) logLength = 0;
+                    // +1 and zero-filled: GL_INFO_LOG_LENGTH already counts the terminator,
+                    // but a driver that reports 0 (or fails the query) must still leave
+                    // log.data() a readable empty C string for the %s below.
+                    Vector<GLchar> log(static_cast<SizeT>(logLength) + 1, '\0');
                     g_GLESFuncs.glGetShaderInfoLog(backendShaderId, logLength, nullptr, log.data());
+                    log.back() = '\0';
                     MGLOG_E("Shader compilation failed for backend ID %u: %s", backendShaderId, log.data());
                     m_backendProgramUsable = false;
                     continue;
@@ -4028,14 +4377,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
             MGLOG_D("Linking program %u", m_backendProgramId);
             g_GLESFuncs.glLinkProgram(m_backendProgramId);
 
-            GLint linkStatus;
+            GLint linkStatus = GL_FALSE;
             g_GLESFuncs.glGetProgramiv(m_backendProgramId, GL_LINK_STATUS, &linkStatus);
             m_backendProgramUsable = m_backendProgramUsable && linkStatus == GL_TRUE;
             if (linkStatus != GL_TRUE) {
-                GLint logLength;
+                GLint logLength = 0;
                 g_GLESFuncs.glGetProgramiv(m_backendProgramId, GL_INFO_LOG_LENGTH, &logLength);
-                Vector<GLchar> log(logLength);
+                if (logLength < 0) logLength = 0;
+                Vector<GLchar> log(static_cast<SizeT>(logLength) + 1, '\0');
                 g_GLESFuncs.glGetProgramInfoLog(m_backendProgramId, logLength, nullptr, log.data());
+                log.back() = '\0';
                 MGLOG_E("Program %u linking failed for %u: %s", stateProgramObject->GetExternalIndex(),
                         m_backendProgramId, log.data());
             } else {
@@ -4068,6 +4419,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
 
             CacheResourceLocations(stateProgramObject);
+            // AFTER the link, because glShaderStorageBlockBinding needs the driver's linked
+            // interface. This is the only place Espryt applies a rebinding: the frontend
+            // record is authoritative and the glShaderStorageBlockBinding entry point itself
+            // deliberately never forces a program build (see DirectGLES.cpp), so a rebinding
+            // requested while no backend program existed yet arrives here instead.
+            ReseedShaderStorageBlockBindings(m_backendProgramId, *stateProgramObject);
             m_syncedLinkVersion = stateProgramObject->GetLinkVersion();
 
             m_isInitialized = true;

MobileGL/MG_Backend/DirectGLES/Managers.h

@@ -515,6 +515,25 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return target == TextureTarget::Texture3D || target == TextureTarget::TextureCubeMap;
         }
 
+        // Components per texel the frontend format's client data carries, for the three-channel
+        // formats that can be widened to a four-channel colour-renderable target; 0 for everything
+        // else. See PrepareChannelWidenedUpload.
+        Uint GetWidenableClientComponentCount(TextureInternalFormat format);
+
+        // True when a widenable format's components are integer rather than normalized, which is
+        // what decides the synthetic alpha's value: GL_RGB8I and GL_RGB8_SNORM are both uploaded
+        // as GL_BYTE, but their 1.0 is 1 and 0x7F respectively.
+        Bool IsIntegerWidenableFormat(TextureInternalFormat format);
+
+        // Repacks three-component client data as four components with an alpha of 1.0 in
+        // `uploadType`, for a format the backend widened to keep a colour attachment renderable.
+        // Returns `data` untouched when no widening applies. Pure CPU and context-free so a unit
+        // test can exercise the exact packing the driver is handed; `widenedData` is the caller's
+        // scratch buffer and has to outlive the returned pointer.
+        const void* PrepareChannelWidenedUpload(Uint componentCount, const IntVec3& texelSize, const void* data,
+                                                SizeT byteSize, GLenum uploadType, Vector<Uint8>& widenedData,
+                                                Bool integerData = false);
+
         struct StateTextureBasicInfo { // Used for tracking texture state changes
             TextureInternalFormat internalFormat = TextureInternalFormat::Unknown;
             SizeT width = 0;
@@ -630,6 +649,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
         SharedPtr<BackendTextureObject>& SyncTextureObjectToBackend(
             const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
             Bool imageBindableStorageRequired = false);
+        // Brings every texture the next draw reads - the touched units' bindings and the draw
+        // FBO's texture attachments - onto the backend, through the two borrowed-pair memos
+        // documented at their definitions. Declared here so tests can drive those memos directly.
+        void SyncNeccessaryTextures();
         extern Array<Array<BackendTextureObject*, (SizeT)TextureTarget::TextureTargetCount>,
                      MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS>
             g_boundTexturesCache;
@@ -710,6 +733,67 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // has to apply the clamp itself.
         Bool IsFixedPointFallbackReadAttachment();
 
+        // True when the read buffer names a three-channel attachment the backend actually stores
+        // in a four-channel format (the colour-renderable widening). A format without alpha reads
+        // back as 1.0, so the readback path has to overwrite the alpha the draw left behind -
+        // unconditionally, since this is the format's own semantics rather than the
+        // GL_CLAMP_READ_COLOR rule the clamp above implements.
+        Bool IsAlphaWidenedFallbackReadAttachment();
+
+        // True when this attachment's storage carries an alpha channel its frontend format does
+        // not (the three-channel colour-renderable widening).
+        Bool IsAlphaWidenedColorAttachment(const MG_State::GLState::FramebufferAttachmentObject& attachmentObject);
+
+        // Bit i set = DRAW BUFFER i of `fbo` resolves to a colour attachment the backend widened
+        // from three channels to four. Indexed by draw-buffer slot, not by attachment point,
+        // because that is what glColorMaski / glClearBufferfv address.
+        Uint32 ComputeAlphaWidenedDrawBufferMask(const MG_State::GLState::FramebufferObject& fbo);
+
+        // The same mask for whatever is currently bound to GL_DRAW_FRAMEBUFFER, recomputed by
+        // SyncCurrentFBO (BackendFramebufferObject::SyncToBackend for the DRAW target, and reset
+        // to 0 on the default framebuffer). Read by the draw/clear state sync, so it is only
+        // trustworthy after SyncCurrentFBO has run in the same entry point.
+        //
+        // WHY IT EXISTS (the dst-alpha discipline). A widened attachment has a real alpha channel
+        // the application's format does not, and GL says a missing channel reads as 1.0. Readback
+        // can paper over that (ForceWideReadAlphaToOne), but GL_DST_ALPHA /
+        // GL_ONE_MINUS_DST_ALPHA blending and glBlitFramebuffer read the STORED alpha inside the
+        // driver where no interception is possible. So the stored alpha is kept at 1.0 instead:
+        // a clear touching a widened buffer writes alpha 1.0, and every draw into it has its
+        // alpha write mask forced off, so nothing can ever move it again. The application's own
+        // colour mask is untouched - glGet(GL_COLOR_WRITEMASK) still reports what it set.
+        extern Uint32 g_alphaWidenedDrawBufferMask;
+
+        // Bit i set = DRAW BUFFER i of the framebuffer bound as DRAW resolves to a colour
+        // attachment with an INTEGER format. Recomputed beside the mask above and for its sake:
+        // glClearBufferfv on an integer colour buffer is GL_INVALID_OPERATION, so the
+        // per-draw-buffer clear route the widening needs has to stand down when one is present.
+        // (glClear on an integer colour buffer is left undefined by ES in the first place, and
+        // an application that wants a defined answer has to call glClearBufferuiv/iv - which does
+        // carry the widened alpha substitution.)
+        extern Uint32 g_integerColorDrawBufferMask;
+
+        // The colour a clear has to hand the driver for one draw buffer: the application's value,
+        // except that a widened attachment's alpha is replaced by the 1.0 its three-channel
+        // format implies. `one` is 1.0 encoded in the clear call's own component type - the
+        // integer clears carry the integer 1, the float clear carries 1.0f.
+        //
+        // Returns `value` itself when nothing is substituted, so the ordinary path allocates and
+        // copies nothing; `scratch` is the caller's buffer and has to outlive the returned
+        // pointer. Free of GL state on purpose, so the substitution can be unit-tested exactly as
+        // the driver sees it.
+        template <typename T>
+        const T* SubstituteWidenedClearAlpha(const T* value, Bool widened, T one, T (&scratch)[4]) {
+            if (!widened || value == nullptr) {
+                return value;
+            }
+            scratch[0] = value[0];
+            scratch[1] = value[1];
+            scratch[2] = value[2];
+            scratch[3] = one;
+            return scratch;
+        }
+
         // What SyncCurrentFBO last pushed for each target, as a (binding, object, revision)
         // triple; it re-syncs unless all three still match. Stamped by SyncCurrentFBO and
         // ForceBindCurrentFBO, cleared by InvalidateFramebufferBindingCache. The three are
@@ -981,6 +1065,22 @@ namespace MobileGL::MG_Backend::DirectGLES {
         extern Uint g_lastUsedBackendProgramId;
         extern StateBackendObjectRegistry<MG_State::GLState::ProgramObject, BackendProgramObjectImpl>
             g_backendProgramObjects;
+
+        // Points one shader storage block of an ALREADY-LINKED backend program at
+        // `binding`. `blockName` is the frontend interface-query spelling; the real
+        // driver's own index for it is looked up here, because the transpiled ESSL's
+        // block order is not the frontend's. Returns false when the block does not exist
+        // on the backend program (eliminated as unused, or the driver lacks the entry
+        // points), which is not an error - GL_BUFFER_BINDING is served from the frontend
+        // record either way.
+        Bool ApplyShaderStorageBlockBinding(Uint backendProgramId, const String& blockName, Uint binding);
+        // Replays every glShaderStorageBlockBinding recorded on the program onto a backend
+        // program that was just built. The frontend record is authoritative (only the
+        // shader's DECLARED binding survives in the SPIR-V), so without this replay any
+        // rebuild would silently revert rebound blocks. Mirrors DirectVulkan's
+        // reseed-on-rebuild in BuildProgramResourceCache.
+        void ReseedShaderStorageBlockBindings(Uint backendProgramId,
+                                              const MG_State::GLState::ProgramObject& stateProgramObject);
     } // namespace PrgramImpl
 
     namespace SamplerImpl {

MobileGL/MG_Backend/DirectGLES/Utils.cpp

@@ -61,29 +61,6 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 requestedInternalFormat, GetDriverPixelFormatNormalizeOptions() | extraOptions);
         }
 
-        // Multisample textures can only ever be rendered into, never uploaded to, so a fallback
-        // format for them has to stay colour-renderable - a three-channel float fallback is a legal
-        // ES texture format but not a legal multisample storage format. Widening to four channels
-        // is safe here precisely because there is no transfer path that would have to expand
-        // three-channel client data, and the alpha the draw writes for a three-channel source is
-        // already the 1.0 the frontend format implies.
-        Bool TargetRequiresRenderableFormat(SizeT targetIndex) {
-            return targetIndex == static_cast<SizeT>(TextureTarget::Texture2DMultisample) ||
-                   targetIndex == static_cast<SizeT>(TextureTarget::Texture2DMultisampleArray);
-        }
-
-        Flags<PixelFormatNormalizeOptionBit> GetRenderTargetNormalizeOptions(SizeT targetIndex) {
-            Flags<PixelFormatNormalizeOptionBit> options;
-            if (!TargetRequiresRenderableFormat(targetIndex)) {
-                return options;
-            }
-            options |= PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget;
-            if (!g_GLESCapabilities.SupportsRenderSnorm || !g_GLESCapabilities.SupportsNorm16Texture) {
-                options |= PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget;
-            }
-            return options;
-        }
-
         Bool HasCachedFormatCapability(TextureInternalFormat internalFormat,
                                        SizeT targetIndex,
                                        Bool caveat,
@@ -141,14 +118,61 @@ namespace MobileGL::MG_Backend::DirectGLES {
             const GLenum requestedInternalFormat = MG_Util::ConvertTextureInternalFormatToGLEnum(internalFormat);
             Flags<PixelFormatNormalizeOptionBit> options;
             if (!pActiveBackendObject || ShouldUseCaveatFormat(internalFormat, targetIndex)) {
-                options = GetRuntimeFallbackNormalizeOptions(requestedInternalFormat,
+                options = GetRuntimeFallbackNormalizeOptions(
-                                                             GetRenderTargetNormalizeOptions(targetIndex));
+                    requestedInternalFormat,
+                    TextureImpl::GetRenderTargetNormalizeOptions(g_GLESCapabilities, targetIndex));
             }
             NormalizePixelFormat(requestedInternalFormat, options, outInternalFormat, outFormat, outType);
         }
     } // namespace
 
     namespace TextureImpl {
+        // Every image that can back a colour attachment needs a colour-renderable storage format,
+        // and ES has no renderable three-channel format at all: a three-channel float fallback is
+        // a legal ES texture but neither legal multisample storage nor a legal attachment, so
+        // GL_RGB8_SNORM / GL_RGB16F / ... have to be widened to four channels for any of them.
+        // This used to cover the multisample pair alone, on the grounds that only those can never
+        // be uploaded to; the transfer paths now expand three-channel client data themselves
+        // (Managers.cpp PrepareFallbackUpload) and hide the added alpha again on sample and
+        // readback, so the same substitution is available everywhere.
+        //
+        // The widening only ever *happens* where the driver refuses the native form (see
+        // PopulateFormatCapabilitiesImpl: outside multisample storage it rides the driver branch,
+        // behind the native probe), so a driver that does render to a three-channel image keeps
+        // allocating it byte for byte.
+        //
+        // Do NOT read that as "nothing changes off-device". Measured on Mesa 26.1.6 llvmpipe
+        // (the headless CI driver), an ES 3.2 GL_TEXTURE_2D colour attachment is COMPLETE for
+        // GL_RGB8 and GL_RGB16F but INCOMPLETE_ATTACHMENT for GL_RGB8_SNORM, GL_SRGB8 and every
+        // RGB integer format, and UNSUPPORTED for GL_RGB32F. Those eight formats therefore DO
+        // take the widened path on llvmpipe, which is where the retrace fixtures and the glcts
+        // green suites run - the substitution is driver-conditional, not desktop-exempt.
+        //
+        // A buffer texture is the one image that can never be an attachment; its storage is the
+        // buffer object's, and widening it would misdescribe the application's data.
+        Bool TargetRequiresRenderableFormat(SizeT targetIndex) {
+            if (targetIndex >= kFormatCapabilityTargetCount) {
+                return false;
+            }
+            if (targetIndex == kFormatCapabilityRenderbufferTargetIndex) {
+                return true;
+            }
+            return static_cast<TextureTarget>(targetIndex) != TextureTarget::TextureBuffer;
+        }
+
+        Flags<PixelFormatNormalizeOptionBit> GetRenderTargetNormalizeOptions(
+            const MG_External::GLESCapabilities& capabilities, SizeT targetIndex) {
+            Flags<PixelFormatNormalizeOptionBit> options;
+            if (!TargetRequiresRenderableFormat(targetIndex)) {
+                return options;
+            }
+            options |= PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget;
+            if (!capabilities.SupportsRenderSnorm || !capabilities.SupportsNorm16Texture) {
+                options |= PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget;
+            }
+            return options;
+        }
+
         void GenerateTextureFormatInfo(TextureInternalFormat internalFormat, GLenum* outInternalFormat,
                                        GLenum* outFormat, GLenum* outType, TextureTarget target) {
 #ifdef TRACY_ENABLE
@@ -178,20 +202,29 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return ShouldUseCaveatFormat(internalFormat, GetRenderbufferFormatCapabilityTargetIndex());
         }
 
+        namespace {
+            Bool BackendFormatAddsAlpha(TextureInternalFormat internalFormat, SizeT targetIndex) {
+                if (!TargetRequiresRenderableFormat(targetIndex)) {
+                    return false;
+                }
+                if (pActiveBackendObject && !ShouldUseCaveatFormat(internalFormat, targetIndex)) {
+                    return false;
+                }
+                const GLenum requestedInternalFormat = MG_Util::ConvertTextureInternalFormatToGLEnum(internalFormat);
+                const Flags<PixelFormatNormalizeOptionBit> options = GetRuntimeFallbackNormalizeOptions(
+                    requestedInternalFormat, GetRenderTargetNormalizeOptions(g_GLESCapabilities, targetIndex));
+                return static_cast<Bool>(options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget);
+            }
+        } // namespace
+
         Bool BackendTextureFormatAddsAlpha(TextureInternalFormat internalFormat, TextureTarget target) {
             const SizeT targetIndex =
                 target == TextureTarget::Unknown ? kFormatCapabilityTargetCount : GetFormatCapabilityTargetIndex(target);
-            if (!TargetRequiresRenderableFormat(targetIndex)) {
+            return BackendFormatAddsAlpha(internalFormat, targetIndex);
-                return false;
+        }
-            }
+
-            if (pActiveBackendObject && !ShouldUseCaveatFormat(internalFormat, targetIndex)) {
+        Bool BackendRenderbufferFormatAddsAlpha(TextureInternalFormat internalFormat) {
-                return false;
+            return BackendFormatAddsAlpha(internalFormat, GetRenderbufferFormatCapabilityTargetIndex());
-            }
-            const GLenum requestedInternalFormat = MG_Util::ConvertTextureInternalFormatToGLEnum(internalFormat);
-            const Flags<PixelFormatNormalizeOptionBit> options =
-                GetRuntimeFallbackNormalizeOptions(requestedInternalFormat,
-                                                   GetRenderTargetNormalizeOptions(targetIndex));
-            return static_cast<Bool>(options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget);
         }
     } // namespace TextureImpl
     namespace PrgramImpl {

MobileGL/MG_Backend/DirectGLES/Utils.h

@@ -9,6 +9,8 @@
 #pragma once
 #include <Includes.h>
 #include <MG_State/GLState/Core.h>
+#include <MG_Util/BackendLoaders/OpenGL/Loader.h>
+#include <MG_Util/Texture/TextureFormatProcessor.h>
 
 namespace MobileGL::MG_Backend::DirectGLES {
     namespace DebugImpl {
@@ -34,6 +36,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
     } // namespace VertexArrayImpl
 
     namespace TextureImpl {
+        // Whether images on this format-capability target can back a colour attachment, and so
+        // need a colour-renderable storage format even when the frontend asked for a
+        // three-channel one ES never renders to. Shared by the capability probe (which passes the
+        // capabilities it has just queried, before the globals are published) and by the
+        // allocation path (which reads the active backend's), so the format the cache was probed
+        // with is always the format the image is created with.
+        Bool TargetRequiresRenderableFormat(SizeT targetIndex);
+        Flags<PixelFormatNormalizeOptionBit> GetRenderTargetNormalizeOptions(
+            const MG_External::GLESCapabilities& capabilities, SizeT targetIndex);
+
         void GenerateTextureFormatInfo(TextureInternalFormat internalFormat, GLenum* outInternalFormat,
                                        GLenum* outFormat, GLenum* outType,
                                        TextureTarget target = TextureTarget::Unknown);
@@ -41,10 +53,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                             GLenum* outFormat, GLenum* outType);
         Bool ShouldUseCaveatTextureFormat(TextureInternalFormat internalFormat, TextureTarget target);
 
-        // True when the format the texture is actually created with has an alpha channel the
+        // True when the format the image is actually created with has an alpha channel the
-        // frontend format does not (the three-channel multisample widening). GL reads such a
+        // frontend format does not (the three-channel colour-renderable widening). GL reads such
-        // channel back as 1.0, so any swizzle source of ALPHA has to be answered with ONE.
+        // a channel back as 1.0, so any swizzle source of ALPHA has to be answered with ONE and
+        // any readback of the image has to overwrite the alpha the draw happened to leave there.
         Bool BackendTextureFormatAddsAlpha(TextureInternalFormat internalFormat, TextureTarget target);
+        Bool BackendRenderbufferFormatAddsAlpha(TextureInternalFormat internalFormat);
         Bool ShouldUseCaveatRenderbufferFormat(TextureInternalFormat internalFormat);
     } // namespace TextureImpl
 

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

@@ -617,12 +617,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             funcsTable.GL.GetIntegeri_v = GetIntegeri_v;
             funcsTable.GL.GetInteger64i_v = GetInteger64i_v;
             funcsTable.GL.GetProgramiv = GetProgramiv;
-            funcsTable.GL.GetProgramInterfaceiv = GetProgramInterfaceiv;
-            funcsTable.GL.GetProgramResourceIndex = GetProgramResourceIndex;
-            funcsTable.GL.GetProgramResourceName = GetProgramResourceName;
-            funcsTable.GL.GetProgramResourceiv = GetProgramResourceiv;
-            funcsTable.GL.GetProgramResourceLocation = GetProgramResourceLocation;
-            funcsTable.GL.GetProgramResourceLocationIndex = GetProgramResourceLocationIndex;
             funcsTable.GL.ShaderStorageBlockBinding = ShaderStorageBlockBinding;
             funcsTable.GL.FenceSync = FenceSync;
             funcsTable.GL.ClientWaitSync = ClientWaitSync;

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.cpp

@@ -232,6 +232,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     StorageBlockResource block{};
                     block.name = blockName;
                     block.binding = binding->binding;
+                    // glShaderStorageBlockBinding survives every rebuild of this cache: the
+                    // authoritative record of a rebound block lives on the program (it is what
+                    // GL_BUFFER_BINDING reports), and only the shader's declared binding is
+                    // recoverable from the SPIR-V. Without this, any unrelated state-version
+                    // bump would silently revert the block to its declared binding.
+                    const Int rebound = program.GetShaderStorageBlockBindingOverride(blockName);
+                    if (rebound >= 0) block.binding = static_cast<Uint32>(rebound);
                     block.dataSize = static_cast<GLint>(binding->block.size);
                     const GLuint blockIndex = static_cast<GLuint>(cache.storageBlocks.size());
                     AddBufferVariablesRecursive(binding->block, blockName, blockIndex, cache.bufferVariables,
@@ -256,18 +263,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return programObject.get();
         }
 
-        void CopyResourceName(const String& source, GLsizei bufSize, GLsizei* length, GLchar* name) {
-            const GLsizei writtenLength = static_cast<GLsizei>(source.size());
-            if (length) {
-                *length = writtenLength;
-            }
-            if (name && bufSize > 0) {
-                const GLsizei copyLength = std::min<GLsizei>(bufSize - 1, writtenLength);
-                std::memcpy(name, source.data(), static_cast<SizeT>(copyLength));
-                name[copyLength] = '\0';
-            }
-        }
-
         const Uint8* ResolveIndirectCommandBytes(const void* indirect, SizeT requiredBytes, const char* label) {
             auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
             if (drawBuffer) {
@@ -288,100 +283,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return reinterpret_cast<const Uint8*>(indirect);
         }
 
-        Vector<GLuint> GetUniformBlockActiveVariables(const MG_State::GLState::ProgramObject& program,
-                                                      GLuint blockIndex) {
-            Vector<GLuint> activeVariables;
-            const Uint uniformCount = program.GetUniformCount();
-            activeVariables.reserve(uniformCount);
-            for (Uint uniformIndex = 0; uniformIndex < uniformCount; ++uniformIndex) {
-                if (program.GetActiveUniformBlockIndex(uniformIndex) == static_cast<Int>(blockIndex)) {
-                    activeVariables.push_back(uniformIndex);
-                }
-            }
-            return activeVariables;
-        }
-
-        GLuint FindProgramInputIndex(const MG_State::GLState::ProgramObject& program, const String& name) {
-            const Int activeCount = program.GetActiveAttributesCount();
-            for (Int index = 0; index < activeCount; ++index) {
-                if (program.GetActiveAttribName(index) == name) {
-                    return static_cast<GLuint>(index);
-                }
-            }
-            return GL_INVALID_INDEX;
-        }
-
-        GLuint FindProgramOutputIndex(const MG_State::GLState::ProgramObject& program, const String& name) {
-            const Int activeCount = program.GetActiveFragmentOutputCount();
-            for (Int index = 0; index < activeCount; ++index) {
-                if (program.GetActiveFragmentOutputName(index) == name) {
-                    return static_cast<GLuint>(index);
-                }
-            }
-            return GL_INVALID_INDEX;
-        }
-
-        GLint GetProgramOutputLocation(const MG_State::GLState::ProgramObject& program, const String& name) {
-            const Int activeCount = program.GetActiveFragmentOutputCount();
-            for (Int index = 0; index < activeCount; ++index) {
-                if (program.GetActiveFragmentOutputName(index) == name) {
-                    return program.GetFragmentOutputLocation(index);
-                }
-            }
-            return -1;
-        }
-
-        GLint GetProgramResourceActiveCount(const MG_State::GLState::ProgramObject& program, GLenum programInterface,
-                                            const ProgramResourceCache& cache) {
-            switch (programInterface) {
-            case GL_SHADER_STORAGE_BLOCK:
-                return static_cast<GLint>(cache.storageBlocks.size());
-            case GL_BUFFER_VARIABLE:
-                return static_cast<GLint>(cache.bufferVariables.size());
-            case GL_UNIFORM_BLOCK:
-                return program.GetActiveUniformBlocksCount();
-            case GL_UNIFORM:
-                return static_cast<GLint>(program.GetUniformCount());
-            case GL_PROGRAM_INPUT:
-                return program.GetActiveAttributesCount();
-            case GL_PROGRAM_OUTPUT:
-                return program.GetActiveFragmentOutputCount();
-            default:
-                return 0;
-            }
-        }
-
-        GLint GetProgramResourceMaxNameLength(const MG_State::GLState::ProgramObject& program, GLenum programInterface,
-                                              const ProgramResourceCache& cache) {
-            switch (programInterface) {
-            case GL_SHADER_STORAGE_BLOCK: {
-                SizeT maxLength = 0;
-                for (const auto& block : cache.storageBlocks) maxLength = std::max(maxLength, block.name.size() + 1);
-                return static_cast<GLint>(maxLength);
-            }
-            case GL_BUFFER_VARIABLE: {
-                SizeT maxLength = 0;
-                for (const auto& var : cache.bufferVariables) maxLength = std::max(maxLength, var.name.size() + 1);
-                return static_cast<GLint>(maxLength);
-            }
-            case GL_UNIFORM_BLOCK:
-                return program.GetActiveUniformBlocksMaxNameLength() + 1;
-            case GL_UNIFORM:
-                return program.GetUniformMaxLength() + 1;
-            case GL_PROGRAM_INPUT:
-                return program.GetActiveAttributesMaxLength() + 1;
-            case GL_PROGRAM_OUTPUT: {
-                SizeT maxLength = 0;
-                const Int activeCount = program.GetActiveFragmentOutputCount();
-                for (Int index = 0; index < activeCount; ++index) {
-                    maxLength = std::max(maxLength, program.GetActiveFragmentOutputName(index).size() + 1);
-                }
-                return static_cast<GLint>(maxLength);
-            }
-            default:
-                return 0;
-            }
-        }
     } // namespace
 
     void ClearProgramResourceCaches() {
@@ -395,11 +296,21 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     GLuint GetShaderStorageBlockIndex(const MG_State::GLState::ProgramObject& program, const String& name) {
         auto& cache = GetProgramResourceCache(program);
-        const auto it = std::find_if(cache.storageBlocks.begin(), cache.storageBlocks.end(),
+        auto find = [&cache](const String& key) {
-            [&](const StorageBlockResource& block) { return block.name == name; });
+            return std::find_if(cache.storageBlocks.begin(), cache.storageBlocks.end(),
-        return it == cache.storageBlocks.end()
+                [&](const StorageBlockResource& block) { return block.name == key; });
-            ? GL_INVALID_INDEX
+        };
-            : static_cast<GLuint>(std::distance(cache.storageBlocks.begin(), it));
+        auto it = find(name);
+        if (it == cache.storageBlocks.end()) {
+            // Cache names are normalized (NormalizeDescriptorName drops the array suffix), so
+            // an arrayed block that GL enumerates per element - "B[0]", "B[1]" - is one entry
+            // here, spelled "B". Retry against the bare name before giving up.
+            const auto bracket = name.rfind('[');
+            if (bracket == String::npos || name.empty() || name.back() != ']') return GL_INVALID_INDEX;
+            it = find(name.substr(0, bracket));
+            if (it == cache.storageBlocks.end()) return GL_INVALID_INDEX;
+        }
+        return static_cast<GLuint>(std::distance(cache.storageBlocks.begin(), it));
     }
 
     GLuint GetShaderStorageBlockBinding(const MG_State::GLState::ProgramObject& program, GLuint blockIndex) {
@@ -874,357 +785,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
     }
 
-    void GetProgramInterfaceiv(GLuint program, GLenum programInterface, GLenum pname, GLint* params) {
+    void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding) {
-        if (!params) return;
         auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject) return;
+        if (!programObject || storageBlockName == nullptr) return;
-        auto& cache = GetProgramResourceCache(*programObject);
-        switch (pname) {
-        case GL_ACTIVE_RESOURCES:
-            *params = GetProgramResourceActiveCount(*programObject, programInterface, cache);
-            return;
-        case GL_MAX_NAME_LENGTH:
-            *params = GetProgramResourceMaxNameLength(*programObject, programInterface, cache);
-            return;
-        case GL_MAX_NUM_ACTIVE_VARIABLES:
-            if (programInterface == GL_SHADER_STORAGE_BLOCK) {
-                SizeT maxCount = 0;
-                for (const auto& block : cache.storageBlocks) {
-                    maxCount = std::max(maxCount, block.activeVariables.size());
-                }
-                *params = static_cast<GLint>(maxCount);
-            } else if (programInterface == GL_UNIFORM_BLOCK) {
-                GLint maxCount = 0;
-                const Int activeBlocks = programObject->GetActiveUniformBlocksCount();
-                for (Int index = 0; index < activeBlocks; ++index) {
-                    maxCount = std::max(maxCount, programObject->GetUniformBlockActiveUniformCount(index));
-                }
-                *params = maxCount;
-            } else {
-                *params = 0;
-            }
-            return;
-        default:
-            *params = 0;
-            return;
-        }
-    }
-
-    GLuint GetProgramResourceIndex(GLuint program, GLenum programInterface, const GLchar* name) {
-        if (!name) return GL_INVALID_INDEX;
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject) return GL_INVALID_INDEX;
-        auto& cache = GetProgramResourceCache(*programObject);
-        const String resourceName = name;
-        if (programInterface == GL_SHADER_STORAGE_BLOCK) {
-            return GetShaderStorageBlockIndex(*programObject, name);
-        }
-        if (programInterface == GL_BUFFER_VARIABLE) {
-            const auto it = std::find_if(cache.bufferVariables.begin(), cache.bufferVariables.end(),
-                [&](const BufferVariableResource& var) { return var.name == resourceName; });
-            return it == cache.bufferVariables.end()
-                ? GL_INVALID_INDEX
-                : static_cast<GLuint>(std::distance(cache.bufferVariables.begin(), it));
-        }
-        if (programInterface == GL_UNIFORM_BLOCK) {
-            return programObject->GetUniformBlockIndex(name);
-        }
-        if (programInterface == GL_UNIFORM) {
-            const Int activeUniformIndex = programObject->GetActiveUniformIndex(resourceName);
-            return activeUniformIndex >= 0 ? static_cast<GLuint>(activeUniformIndex) : GL_INVALID_INDEX;
-        }
-        if (programInterface == GL_PROGRAM_INPUT) {
-            return FindProgramInputIndex(*programObject, resourceName);
-        }
-        if (programInterface == GL_PROGRAM_OUTPUT) {
-            return FindProgramOutputIndex(*programObject, resourceName);
-        }
-        return GL_INVALID_INDEX;
-    }
-
-    void GetProgramResourceName(GLuint program, GLenum programInterface, GLuint index, GLsizei bufSize,
-                                GLsizei* length, GLchar* name) {
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject) return;
-        auto& cache = GetProgramResourceCache(*programObject);
-        if (programInterface == GL_SHADER_STORAGE_BLOCK && index < cache.storageBlocks.size()) {
-            CopyResourceName(cache.storageBlocks[index].name, bufSize, length, name);
-            return;
-        }
-        if (programInterface == GL_BUFFER_VARIABLE && index < cache.bufferVariables.size()) {
-            CopyResourceName(cache.bufferVariables[index].name, bufSize, length, name);
-            return;
-        }
-        if (programInterface == GL_UNIFORM_BLOCK && programObject->IsActiveUniformBlock(index)) {
-            CopyResourceName(programObject->GetUniformBlockName(index), bufSize, length, name);
-            return;
-        }
-        if (programInterface == GL_UNIFORM && index < programObject->GetUniformCount()) {
-            CopyResourceName(programObject->GetActiveUniformName(index), bufSize, length, name);
-            return;
-        }
-        if (programInterface == GL_PROGRAM_INPUT && index < static_cast<GLuint>(programObject->GetActiveAttributesCount())) {
-            CopyResourceName(programObject->GetActiveAttribName(index), bufSize, length, name);
-            return;
-        }
-        if (programInterface == GL_PROGRAM_OUTPUT &&
-            index < static_cast<GLuint>(programObject->GetActiveFragmentOutputCount())) {
-            CopyResourceName(programObject->GetActiveFragmentOutputName(index), bufSize, length, name);
-            return;
-        }
-        if (length) *length = 0;
-        if (name && bufSize > 0) name[0] = '\0';
-    }
-
-    void GetProgramResourceiv(GLuint program, GLenum programInterface, GLuint index, GLsizei propCount,
-                              const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params) {
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject || !props || !params || bufSize <= 0) return;
-        auto& cache = GetProgramResourceCache(*programObject);
-        GLsizei written = 0;
-        auto writeValue = [&](GLint value) {
-            if (written < bufSize) {
-                params[written++] = value;
-            }
-        };
-
-        for (GLsizei propIndex = 0; propIndex < propCount; ++propIndex) {
-            const GLenum prop = props[propIndex];
-            if (programInterface == GL_SHADER_STORAGE_BLOCK && index < cache.storageBlocks.size()) {
-                const auto& block = cache.storageBlocks[index];
-                switch (prop) {
-                case GL_NAME_LENGTH:
-                    writeValue(static_cast<GLint>(block.name.size() + 1));
-                    break;
-                case GL_BUFFER_BINDING:
-                    writeValue(static_cast<GLint>(block.binding));
-                    break;
-                case GL_BUFFER_DATA_SIZE:
-                    writeValue(block.dataSize);
-                    break;
-                case GL_NUM_ACTIVE_VARIABLES:
-                    writeValue(static_cast<GLint>(block.activeVariables.size()));
-                    break;
-                case GL_ACTIVE_VARIABLES:
-                    for (const auto variable : block.activeVariables) writeValue(static_cast<GLint>(variable));
-                    break;
-                default:
-                    writeValue(0);
-                    break;
-                }
-            } else if (programInterface == GL_BUFFER_VARIABLE && index < cache.bufferVariables.size()) {
-                const auto& var = cache.bufferVariables[index];
-                switch (prop) {
-                case GL_NAME_LENGTH:
-                    writeValue(static_cast<GLint>(var.name.size() + 1));
-                    break;
-                case GL_TYPE:
-                    writeValue(GL_FLOAT);
-                    break;
-                case GL_ARRAY_SIZE:
-                    writeValue(1);
-                    break;
-                case GL_OFFSET:
-                    writeValue(var.offset);
-                    break;
-                case GL_BLOCK_INDEX:
-                    writeValue(static_cast<GLint>(var.blockIndex));
-                    break;
-                case GL_ARRAY_STRIDE:
-                case GL_MATRIX_STRIDE:
-                case GL_TOP_LEVEL_ARRAY_SIZE:
-                case GL_TOP_LEVEL_ARRAY_STRIDE:
-                case GL_IS_ROW_MAJOR:
-                    writeValue(0);
-                    break;
-                default:
-                    writeValue(0);
-                    break;
-                }
-            } else if (programInterface == GL_UNIFORM_BLOCK &&
-                       programObject->IsActiveUniformBlock(index)) {
-                const auto activeVariables = GetUniformBlockActiveVariables(*programObject, index);
-                switch (prop) {
-                case GL_NAME_LENGTH:
-                    writeValue(static_cast<GLint>(programObject->GetUniformBlockName(index).size() + 1));
-                    break;
-                case GL_BUFFER_BINDING:
-                    writeValue(static_cast<GLint>(programObject->GetUniformBlockBinding(index)));
-                    break;
-                case GL_BUFFER_DATA_SIZE:
-                    writeValue(static_cast<GLint>(programObject->GetUBOSizeAt(index)));
-                    break;
-                case GL_NUM_ACTIVE_VARIABLES:
-                    writeValue(static_cast<GLint>(activeVariables.size()));
-                    break;
-                case GL_ACTIVE_VARIABLES:
-                    for (const GLuint variableIndex : activeVariables) {
-                        writeValue(static_cast<GLint>(variableIndex));
-                    }
-                    break;
-                case GL_REFERENCED_BY_VERTEX_SHADER:
-                    writeValue(programObject->IsUniformBlockReferencedByStage(index, EShLangVertex) ? GL_TRUE
-                                                                                                     : GL_FALSE);
-                    break;
-                case GL_REFERENCED_BY_FRAGMENT_SHADER:
-                    writeValue(programObject->IsUniformBlockReferencedByStage(index, EShLangFragment) ? GL_TRUE
-                                                                                                       : GL_FALSE);
-                    break;
-                case GL_REFERENCED_BY_COMPUTE_SHADER:
-                    writeValue(programObject->IsUniformBlockReferencedByStage(index, EShLangCompute) ? GL_TRUE
-                                                                                                      : GL_FALSE);
-                    break;
-                case GL_REFERENCED_BY_GEOMETRY_SHADER:
-                case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
-                case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
-                    writeValue(GL_FALSE);
-                    break;
-                default:
-                    writeValue(0);
-                    break;
-                }
-            } else if (programInterface == GL_UNIFORM && index < programObject->GetUniformCount()) {
-                const auto& uniformName = programObject->GetActiveUniformName(index);
-                const GLint location = programObject->GetUniformLocation(uniformName);
-                switch (prop) {
-                case GL_NAME_LENGTH:
-                    writeValue(static_cast<GLint>(uniformName.size() + 1));
-                    break;
-                case GL_TYPE:
-                    writeValue(static_cast<GLint>(programObject->GetActiveUniformType(index)));
-                    break;
-                case GL_ARRAY_SIZE:
-                    writeValue(programObject->GetActiveUniformArraySize(index));
-                    break;
-                case GL_BLOCK_INDEX:
-                    writeValue(programObject->GetActiveUniformBlockIndex(index));
-                    break;
-                case GL_LOCATION:
-                    writeValue(location);
-                    break;
-                case GL_OFFSET:
-                    writeValue(location >= 0 && programObject->IsValidUniformLocation(location)
-                                   ? static_cast<GLint>(programObject->GetUniformOffset(location))
-                                   : 0);
-                    break;
-                case GL_ARRAY_STRIDE:
-                case GL_MATRIX_STRIDE:
-                case GL_IS_ROW_MAJOR:
-                case GL_TOP_LEVEL_ARRAY_SIZE:
-                case GL_TOP_LEVEL_ARRAY_STRIDE:
-                case GL_REFERENCED_BY_VERTEX_SHADER:
-                case GL_REFERENCED_BY_FRAGMENT_SHADER:
-                case GL_REFERENCED_BY_COMPUTE_SHADER:
-                case GL_REFERENCED_BY_GEOMETRY_SHADER:
-                case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
-                case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
-                    writeValue(0);
-                    break;
-                default:
-                    writeValue(0);
-                    break;
-                }
-            } else if (programInterface == GL_PROGRAM_INPUT &&
-                       index < static_cast<GLuint>(programObject->GetActiveAttributesCount())) {
-                const auto& resourceName = programObject->GetActiveAttribName(index);
-                switch (prop) {
-                case GL_NAME_LENGTH:
-                    writeValue(static_cast<GLint>(resourceName.size() + 1));
-                    break;
-                case GL_TYPE:
-                    writeValue(static_cast<GLint>(programObject->GetActiveAttribType(index)));
-                    break;
-                case GL_ARRAY_SIZE:
-                    writeValue(programObject->GetActiveAttribArraySize(index));
-                    break;
-                case GL_LOCATION:
-                    writeValue(programObject->GetAttributeLocation(resourceName));
-                    break;
-                case GL_REFERENCED_BY_VERTEX_SHADER:
-                    writeValue(GL_TRUE);
-                    break;
-                case GL_REFERENCED_BY_FRAGMENT_SHADER:
-                case GL_REFERENCED_BY_COMPUTE_SHADER:
-                case GL_REFERENCED_BY_GEOMETRY_SHADER:
-                case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
-                case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
-                case GL_IS_PER_PATCH:
-                case GL_LOCATION_INDEX:
-                    writeValue(0);
-                    break;
-                default:
-                    writeValue(0);
-                    break;
-                }
-            } else if (programInterface == GL_PROGRAM_OUTPUT &&
-                       index < static_cast<GLuint>(programObject->GetActiveFragmentOutputCount())) {
-                const auto& resourceName = programObject->GetActiveFragmentOutputName(index);
-                switch (prop) {
-                case GL_NAME_LENGTH:
-                    writeValue(static_cast<GLint>(resourceName.size() + 1));
-                    break;
-                case GL_TYPE:
-                    writeValue(static_cast<GLint>(programObject->GetFragmentOutputType(index)));
-                    break;
-                case GL_ARRAY_SIZE:
-                    writeValue(programObject->GetActiveFragmentOutputArraySize(index));
-                    break;
-                case GL_LOCATION:
-                    writeValue(programObject->GetFragmentOutputLocation(index));
-                    break;
-                case GL_LOCATION_INDEX:
-                    writeValue(0);
-                    break;
-                case GL_REFERENCED_BY_FRAGMENT_SHADER:
-                    writeValue(GL_TRUE);
-                    break;
-                case GL_REFERENCED_BY_VERTEX_SHADER:
-                case GL_REFERENCED_BY_COMPUTE_SHADER:
-                case GL_REFERENCED_BY_GEOMETRY_SHADER:
-                case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
-                case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
-                case GL_IS_PER_PATCH:
-                    writeValue(0);
-                    break;
-                default:
-                    writeValue(0);
-                    break;
-                }
-            } else {
-                writeValue(0);
-            }
-        }
-        if (length) *length = written;
-    }
-
-    GLint GetProgramResourceLocation(GLuint program, GLenum programInterface, const GLchar* name) {
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject || !name) return -1;
-        if (programInterface == GL_UNIFORM) {
-            return programObject->GetUniformLocation(name);
-        }
-        if (programInterface == GL_PROGRAM_INPUT) {
-            return programObject->GetAttributeLocation(name);
-        }
-        if (programInterface == GL_PROGRAM_OUTPUT) {
-            return GetProgramOutputLocation(*programObject, name);
-        }
-        return -1;
-    }
-
-    GLint GetProgramResourceLocationIndex(GLuint program, GLenum programInterface, const GLchar* name) {
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject || !name) return -1;
-        if (programInterface == GL_PROGRAM_OUTPUT) {
-            return GetProgramOutputLocation(*programObject, name) >= 0 ? 0 : -1;
-        }
-        return -1;
-    }
-
-    void ShaderStorageBlockBinding(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding) {
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject) return;
-        auto& cache = GetProgramResourceCache(*programObject);
         const Int maxBindings = pActiveBackendObject
             ? pActiveBackendObject->GetDynamicParameters().MaxShaderStorageBufferBindings
             : 0;
@@ -1234,13 +797,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 MakeUnique<GenericErrorInfo>("DirectVulkan", __func__, "Shader storage binding is out of range."));
             return;
         }
-        if (storageBlockIndex >= cache.storageBlocks.size()) {
+        // The frontend already validated that the name denotes an active block, and has
-            MG_State::pGLContext->RecordError(
+        // already recorded the new binding on the program - which is what reseeds this cache
-                ErrorCode::InvalidValue,
+        // whenever it is rebuilt. Writing the entry here as well keeps an ALREADY-BUILT cache
-                MakeUnique<GenericErrorInfo>("DirectVulkan", __func__, "Shader storage block index is not active."));
+        // (the common case: the very next draw reads it) from having to be thrown away.
-            return;
+        auto& cache = GetProgramResourceCache(*programObject);
-        }
+        const GLuint blockIndex = GetShaderStorageBlockIndex(*programObject, storageBlockName);
-        cache.storageBlocks[storageBlockIndex].binding = storageBlockBinding;
+        if (blockIndex == GL_INVALID_INDEX) return;
+        cache.storageBlocks[blockIndex].binding = storageBlockBinding;
     }
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ReadPixels called with null VulkanRenderer");

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.h

@@ -97,15 +97,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
     void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
     void GetProgramiv(GLuint program, GLenum pname, GLint* params);
-    void GetProgramInterfaceiv(GLuint program, GLenum programInterface, GLenum pname, GLint* params);
+    void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding);
-    GLuint GetProgramResourceIndex(GLuint program, GLenum programInterface, const GLchar* name);
-    void GetProgramResourceName(GLuint program, GLenum programInterface, GLuint index, GLsizei bufSize,
-                                GLsizei* length, GLchar* name);
-    void GetProgramResourceiv(GLuint program, GLenum programInterface, GLuint index, GLsizei propCount,
-                              const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params);
-    GLint GetProgramResourceLocation(GLuint program, GLenum programInterface, const GLchar* name);
-    GLint GetProgramResourceLocationIndex(GLuint program, GLenum programInterface, const GLchar* name);
-    void ShaderStorageBlockBinding(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding);
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels);
     void GetTexImage(GLenum target, GLint level, GLenum format, GLenum type, GLvoid* pixels);
     void GetTextureImage(const SharedPtr<MG_State::GLState::ITextureObject>& texture, TextureUploadTarget uploadTarget,

MobileGL/MG_Impl/GLImpl/Buffer/GL_Buffer.cpp

@@ -9,6 +9,7 @@
 #include "GL_Buffer.h"
 #include "Validators.h"
 #include "../Texture/GL_Texture.h"
+#include "../Getter/GL_Getter.h"
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Metrics/TextureMetrics.h>
 #include <Config.h>
@@ -861,6 +862,10 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         Range1D mappedRange = bufferObject->GetMappedRange();
         auto mappingAccess = bufferObject->GetMappingAccess();
+        // GL 4.6 6.5: the error is on OVERLAP with the mapped range, i.e. a half-open
+        // intersection test. There used to be a second test below this one asking only
+        // `offset + size >= mappedRange.start`, which rejects every write that starts
+        // before a mapped tail as well - it made a legal disjoint glBufferSubData fail.
         if (bufferObject->IsMapped() && !(mappingAccess & BufferMappingAccessBit::Persistent) &&
             (offset < mappedRange.end) && (offset + size > mappedRange.start)) {
             MG_State::pGLContext->RecordError(
@@ -871,18 +876,6 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
-        if (bufferObject->IsMapped() && !(mappingAccess & BufferMappingAccessBit::Persistent)) {
-            Range1D mappedRange = bufferObject->GetMappedRange();
-            if (offset + size >= mappedRange.start) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "BufferSubData_State",
-                                                 "Cannot modify a mapped buffer object unless it was "
-                                                 "mapped with GL_MAP_PERSISTENT_BIT."));
-                return;
-            }
-        }
-
         bufferObject->UploadSubData({(void*)data, (SizeT)size}, offset);
     }
 
@@ -1013,6 +1006,11 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void BufferStorage_State(GLenum target, GLsizeiptr size, const void* data, GLbitfield flags) {
+        // Error precedence: "no buffer is bound to target" outranks a bad size or bad
+        // flags, so the binding has to be resolved before either is validated.
+        auto bufferObject = GetBoundBufferObject(target, BufferOp::BufferStorage);
+        if (!bufferObject) return;
+
         if (size <= 0) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
@@ -1021,8 +1019,6 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         if (!ValidateStorageFlags(flags, BufferOp::BufferStorage)) return;
 
-        auto bufferObject = GetBoundBufferObject(target, BufferOp::BufferStorage);
-        if (!bufferObject) return;
         if (bufferObject->IsImmutableStorage()) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
@@ -1057,6 +1053,10 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void NamedBufferStorage_State(GLuint buffer, GLsizeiptr size, const void* data, GLbitfield flags) {
+        // Same precedence as BufferStorage_State: the buffer-name error comes first.
+        auto bufferObject = GetNamedBufferObject(buffer, BufferOp::NamedBufferStorage);
+        if (!bufferObject) return;
+
         if (size <= 0) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
@@ -1065,8 +1065,6 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         if (!ValidateStorageFlags(flags, BufferOp::NamedBufferStorage)) return;
 
-        auto bufferObject = GetNamedBufferObject(buffer, BufferOp::NamedBufferStorage);
-        if (!bufferObject) return;
         if (bufferObject->IsImmutableStorage()) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
@@ -1486,12 +1484,71 @@ namespace MobileGL::MG_Impl::GLImpl {
         GetBufferBindingSlot(bufferTarget).Bind(bufferObject);
     }
 
+    // GL 4.6 core 6.1.1: the constraints glBindBufferRange puts on the (offset, size) pair.
+    // Every one of them is INVALID_VALUE, and all of them are checked before a single piece
+    // of state is written - a rejected bind must leave the binding point exactly as it was.
+    // They apply only to a non-zero buffer: buffer 0 detaches the binding point and ignores
+    // offset and size, which is also how glBindBuffersRange spells "reset this element"
+    // (a NULL buffers array, or a zero entry inside one).
+    static Bool ValidateBufferRangeOffsetAndSize(GLenum target, GLintptr offset, GLsizeiptr size,
+                                                 const char* funcName) {
+        if (size <= 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", funcName,
+                                             std::format("size ({}) must be greater than zero.", size)));
+            return false;
+        }
+        if (offset < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", funcName,
+                                             std::format("offset ({}) must not be negative.", offset)));
+            return false;
+        }
+        // GL_UNIFORM_BUFFER and GL_SHADER_STORAGE_BUFFER each constrain the offset to their own
+        // implementation-defined alignment, which glGetIntegerv already answers.
+        GLenum alignmentQuery = GL_NONE;
+        if (target == GL_SHADER_STORAGE_BUFFER) {
+            alignmentQuery = GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT;
+        } else if (target == GL_UNIFORM_BUFFER) {
+            alignmentQuery = GL_UNIFORM_BUFFER_OFFSET_ALIGNMENT;
+        }
+        if (alignmentQuery != GL_NONE) {
+            GLint alignment = 0;
+            GetIntegerv(alignmentQuery, &alignment);
+            if (alignment > 0 && (offset % static_cast<GLintptr>(alignment)) != 0) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", funcName,
+                        std::format("offset ({}) must be a multiple of {} ({}).", offset,
+                                    MG_Util::ConvertGLEnumToString(alignmentQuery), alignment)));
+                return false;
+            }
+        }
+        // A transform feedback capture binding is addressed in 32-bit components, so BOTH the
+        // offset and the size must be multiples of 4.
+        if (target == GL_TRANSFORM_FEEDBACK_BUFFER && ((offset % 4) != 0 || (size % 4) != 0)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", funcName,
+                    std::format("offset ({}) and size ({}) must both be multiples of 4 for "
+                                "GL_TRANSFORM_FEEDBACK_BUFFER.",
+                                offset, size)));
+            return false;
+        }
+        return true;
+    }
+
     void BindBufferRange_State(GLenum target, GLuint index, GLuint buffer, GLintptr offset, GLsizeiptr size) {
         MGLOG_D("%s: target = %s, index = %u, buffer = %u, offset = %d, size = %d", __func__,
                 MG_Util::ConvertGLEnumToString(target).c_str(), index, buffer, offset, size);
         BufferTarget bufferTarget = MG_Util::ConvertGLEnumToBufferTarget(target);
         if (!BufferImpl::ValidateBufferBindingPointTarget(bufferTarget)) return;
         if (!BufferImpl::ValidateBufferBindingPointIndex(bufferTarget, index)) return;
+        if (buffer != 0 && !ValidateBufferRangeOffsetAndSize(target, offset, size, __func__)) return;
         if (bufferTarget == BufferTarget::TransformFeedback && MG_State::pGLContext->IsTransformFeedbackActive()) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
@@ -1665,15 +1722,32 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     // ARB_multi_bind: defined by the spec as equivalent to a loop over the single-bind entry
-    // points (with buffer 0 resetting the binding point).
+    // points (with buffer 0 resetting the binding point) - but only AFTER an up-front check
+    // of the whole [first, first + count) range. Looping straight into the single-bind entry
+    // points reports the single-bind INVALID_VALUE for an out-of-range index instead of the
+    // multi-bind INVALID_OPERATION, and binds the in-range prefix before failing.
+    static Bool ValidateMultiBindBufferRange(GLenum target, GLuint first, GLsizei count, const char* funcName) {
+        BufferTarget bufferTarget = MG_Util::ConvertGLEnumToBufferTarget(target);
+        if (!BufferImpl::ValidateBufferBindingPointTarget(bufferTarget)) return false;
+        return BufferImpl::ValidateBufferBindingPointRange(bufferTarget, first, count, funcName);
+    }
+
     void BindBuffersBase(GLenum target, GLuint first, GLsizei count, const GLuint* buffers) {
+        if (!ValidateMultiBindBufferRange(target, first, count, __func__)) return;
         for (GLsizei i = 0; i < count; ++i) {
             BindBufferBase_State(target, first + i, buffers ? buffers[i] : 0);
         }
     }
 
+    // The (offset, size) constraints are the one part of glBindBuffersRange that stays
+    // per-element: ARB_multi_bind checks them separately for each binding point, leaves that
+    // point unchanged on failure, and still applies the remaining elements - which is exactly
+    // what looping into BindBufferRange_State does. Only the [first, first + count) range is
+    // an up-front, all-or-nothing check. Elements that name buffer 0 (or a NULL buffers array)
+    // reset the binding point through BindBufferBase_State and carry no offset/size to check.
     void BindBuffersRange(GLenum target, GLuint first, GLsizei count, const GLuint* buffers, const GLintptr* offsets,
                           const GLsizeiptr* sizes) {
+        if (!ValidateMultiBindBufferRange(target, first, count, __func__)) return;
         for (GLsizei i = 0; i < count; ++i) {
             if (!buffers || buffers[i] == 0) {
                 BindBufferBase_State(target, first + i, 0);

MobileGL/MG_Impl/GLImpl/Buffer/Validators.cpp

@@ -53,18 +53,46 @@ namespace MobileGL::MG_Impl::GLImpl::BufferImpl {
         return true;
     }
 
+    namespace {
+        // The GL-visible number of indexed binding points for `target`.
+        SizeT GetBufferBindingPointLimit(BufferTarget target) {
+            SizeT pointCount = MG_State::pGLContext->GetBufferBindingPointCount(target);
+            if (target == BufferTarget::ShaderStorage && MG_Backend::pActiveBackendObject) {
+                const Int backendCount =
+                    MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxShaderStorageBufferBindings;
+                pointCount = std::min(pointCount, static_cast<SizeT>(std::max(backendCount, 0)));
+            }
+            if (target == BufferTarget::TransformFeedback) {
+                // GL_MAX_TRANSFORM_FEEDBACK_SEPARATE_ATTRIBS bounds the indexed capture
+                // binding points in GL 3.3 (no ARB_transform_feedback3).
+                pointCount = std::min<SizeT>(pointCount, 4);
+            }
+            return pointCount;
+        }
+    } // namespace
+
+    Bool ValidateBufferBindingPointRange(BufferTarget target, Uint first, GLsizei count, const char* funcName) {
+        if (count < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl/BufferImpl", funcName,
+                                                                      "count must be non-negative."));
+            return false;
+        }
+        const SizeT pointCount = GetBufferBindingPointLimit(target);
+        if (static_cast<Uint64>(first) + static_cast<Uint64>(count) > static_cast<Uint64>(pointCount)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl/BufferImpl", funcName,
+                    std::format("first + count ({} + {}) exceeds the {} indexed binding points of target {}.", first,
+                                count, pointCount, MG_Util::ConvertBufferTargetToString(target))));
+            return false;
+        }
+        return true;
+    }
+
     Bool ValidateBufferBindingPointIndex(BufferTarget target, Uint index) {
-        SizeT pointCount = MG_State::pGLContext->GetBufferBindingPointCount(target);
+        const SizeT pointCount = GetBufferBindingPointLimit(target);
-        if (target == BufferTarget::ShaderStorage && MG_Backend::pActiveBackendObject) {
-            const Int backendCount =
-                MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxShaderStorageBufferBindings;
-            pointCount = std::min(pointCount, static_cast<SizeT>(std::max(backendCount, 0)));
-        }
-        if (target == BufferTarget::TransformFeedback) {
-            // GL_MAX_TRANSFORM_FEEDBACK_SEPARATE_ATTRIBS bounds the indexed capture
-            // binding points in GL 3.3 (no ARB_transform_feedback3).
-            pointCount = std::min<SizeT>(pointCount, 4);
-        }
 
         if (index < pointCount) {
             return true;

MobileGL/MG_Impl/GLImpl/Buffer/Validators.h

@@ -17,4 +17,8 @@ namespace MobileGL::MG_Impl::GLImpl::BufferImpl {
     Bool ValidateBufferMappingAccess(Flags<BufferMappingAccessBit> accessBits);
     Bool ValidateBufferBindingPointTarget(BufferTarget target);
     Bool ValidateBufferBindingPointIndex(BufferTarget target, Uint index);
+    // ARB_multi_bind: glBindBuffersBase/Range validate the whole [first, first + count) range
+    // up front and report INVALID_OPERATION, where a single out-of-range index would be
+    // INVALID_VALUE. Naively looping the single-bind entry points reports the wrong class.
+    Bool ValidateBufferBindingPointRange(BufferTarget target, Uint first, GLsizei count, const char* funcName);
 } // namespace MobileGL::MG_Impl::GLImpl::BufferImpl

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.cpp

@@ -474,6 +474,21 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         if (!ValidateCurrentProgramForCompute(__func__)) return;
+        // GL 4.6 core 19: each num_groups_* must be within GL_MAX_COMPUTE_WORK_GROUP_COUNT
+        // for its dimension. GetIntegeri_v already floors that at the spec minimum.
+        const GLuint numGroups[3] = {numGroupsX, numGroupsY, numGroupsZ};
+        for (GLuint dimension = 0; dimension < 3; ++dimension) {
+            GLint maxGroups = 0;
+            GetIntegeri_v(GL_MAX_COMPUTE_WORK_GROUP_COUNT, dimension, &maxGroups);
+            if (numGroups[dimension] > static_cast<GLuint>(std::max(maxGroups, 0))) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 "num_groups exceeds GL_MAX_COMPUTE_WORK_GROUP_COUNT for dimension " +
+                                                     std::to_string(dimension) + "."));
+                return;
+            }
+        }
         dispatchCompute(numGroupsX, numGroupsY, numGroupsZ);
     }
 
@@ -487,6 +502,24 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         if (!ValidateCurrentProgramForCompute(__func__)) return;
+        // GL 4.6 core 19: `indirect` is a byte offset into GL_DISPATCH_INDIRECT_BUFFER -
+        // negative or misaligned is INVALID_VALUE, nothing bound is INVALID_OPERATION.
+        if (indirect < 0 || (indirect % 4) != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "indirect must be non-negative and a multiple of 4."));
+            return;
+        }
+        const auto& indirectBuffer =
+            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DispatchIndirect).GetBoundObject();
+        if (!indirectBuffer) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "No buffer is bound to GL_DISPATCH_INDIRECT_BUFFER."));
+            return;
+        }
         dispatchComputeIndirect(indirect);
     }
 

MobileGL/MG_Impl/GLImpl/Exporting/Definitions.cpp

@@ -977,8 +977,8 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, ScissorIndexed, GLuint index, GLint left, GL
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ScissorIndexedv, GLuint index, const GLint* v) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ScissorIndexedv, index, v)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, DepthRangeArrayv, GLuint first, GLsizei count, const GLdouble* v) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, DepthRangeArrayv, first, count, v)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, DepthRangeIndexed, GLuint index, GLdouble n, GLdouble f) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, DepthRangeIndexed, index, n, f)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, GetFloati_v, GLenum target, GLuint index, GLfloat* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetFloati_v, target, index, data)
+DECLARE_GL_FUNCTION_HEAD(void, GetFloati_v, GLenum target, GLuint index, GLfloat* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, GetFloati_v, target, index, data)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, GetDoublei_v, GLenum target, GLuint index, GLdouble* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetDoublei_v, target, index, data)
+DECLARE_GL_FUNCTION_HEAD(void, GetDoublei_v, GLenum target, GLuint index, GLdouble* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, GetDoublei_v, target, index, data)
 DECLARE_GL_FUNCTION_HEAD(void, DrawArraysInstancedBaseInstance, GLenum mode, GLint first, GLsizei count, GLsizei instancecount, GLuint baseinstance) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawArraysInstancedBaseInstance, mode, first, count, instancecount, baseinstance)
 DECLARE_GL_FUNCTION_HEAD(void, DrawElementsInstancedBaseInstance, GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount, GLuint baseinstance) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawElementsInstancedBaseInstance, mode, count, type, indices, instancecount, baseinstance)
 DECLARE_GL_FUNCTION_HEAD(void, DrawElementsInstancedBaseVertexBaseInstance, GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount, GLint basevertex, GLuint baseinstance) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawElementsInstancedBaseVertexBaseInstance, mode, count, type, indices, instancecount, basevertex, baseinstance)

MobileGL/MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.cpp

@@ -106,9 +106,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         // `capabilityTargetIndex` is the row of the cache the attachment actually lives in;
         // kFormatCapabilityTargetCount asks about the format in general. Asking per target matters
         // because a capability recorded for one of them says nothing about the others: DirectGLES
-        // widens three-channel formats to four channels to keep them renderable as *multisample*
+        // decides each target's substitution against that target's own probe, and a buffer texture
-        // storage, and a format that survives only through that substitution is still texture-only
+        // never gets one at all. This is also where the three-channel widening becomes visible to
-        // on every ordinary target.
+        // the application - a GL_RGB8_SNORM colour attachment on a driver with no renderable
+        // three-channel format answers COMPLETE because the backend stores it as GL_RGBA16F and
+        // recorded FramebufferRenderable in CaveatCaps.
         Bool IsColorInternalFormatRenderable(TextureInternalFormat format, SizeT capabilityTargetIndex) {
             const SizeT formatIndex = static_cast<SizeT>(format);
             if (MG_Backend::pActiveBackendObject && formatIndex < MG_Backend::kFormatCapabilityFormatCount) {

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.cpp

@@ -51,6 +51,14 @@ namespace MobileGL::MG_Impl::GLImpl {
         constexpr GLint kFrontendMaxTessControlAtomicCounters = 0;
         constexpr GLint kFrontendMaxTessEvaluationAtomicCounters = 0;
         constexpr GLint kFrontendMaxVertexAtomicCounters = 0;
+        // One atomic counter is a uint, and a buffer never has to hold more counters than the
+        // combined limit the frontend advertises. GL 4.6 table 23.63 floors this at 32 bytes.
+        constexpr GLint kFrontendMaxAtomicCounterBufferSize =
+            kFrontendMaxCombinedAtomicCounters * static_cast<GLint>(sizeof(GLuint));
+        // KHR_debug minima (GL 4.6 table 23.66); the debug entry points are stubs, but the
+        // limits they advertise still have to be legal.
+        constexpr GLint kFrontendMaxDebugGroupStackDepth = 64;
+        constexpr GLint kFrontendMaxDebugLoggedMessages = 1;
         constexpr GLint kFrontendMaxVertexUniformComponents = 4096;
         constexpr GLint kFrontendMaxVertexUniformVectors = 128;
         constexpr GLint kFrontendMaxVertexUniformBlocks = 14;
@@ -264,6 +272,60 @@ namespace MobileGL::MG_Impl::GLImpl {
             return true;
         }
 
+        // GL_TEXTURE_BINDING_* is per-texture-unit state: glGetIntegerv answers for the
+        // active unit, glGetIntegeri_v answers for unit `index`. Both need the same
+        // pname -> target decode, so it lives here instead of being spelled out twice.
+        bool TryDecodeTextureUnitBindingPname(GLenum pname, TextureTarget& outTarget) {
+            switch (pname) {
+            case GL_TEXTURE_BINDING_1D: outTarget = TextureTarget::Texture1D; return true;
+            case GL_TEXTURE_BINDING_1D_ARRAY: outTarget = TextureTarget::Texture1DArray; return true;
+            case GL_TEXTURE_BINDING_2D: outTarget = TextureTarget::Texture2D; return true;
+            case GL_TEXTURE_BINDING_2D_ARRAY: outTarget = TextureTarget::Texture2DArray; return true;
+            case GL_TEXTURE_BINDING_2D_MULTISAMPLE: outTarget = TextureTarget::Texture2DMultisample; return true;
+            case GL_TEXTURE_BINDING_2D_MULTISAMPLE_ARRAY:
+                outTarget = TextureTarget::Texture2DMultisampleArray;
+                return true;
+            case GL_TEXTURE_BINDING_3D: outTarget = TextureTarget::Texture3D; return true;
+            case GL_TEXTURE_BINDING_BUFFER: outTarget = TextureTarget::TextureBuffer; return true;
+            case GL_TEXTURE_BINDING_CUBE_MAP: outTarget = TextureTarget::TextureCubeMap; return true;
+            case GL_TEXTURE_BINDING_CUBE_MAP_ARRAY: outTarget = TextureTarget::TextureCubeMapArray; return true;
+            case GL_TEXTURE_BINDING_RECTANGLE: outTarget = TextureTarget::TextureRectangle; return true;
+            default: return false;
+            }
+        }
+
+        GLint QueryTextureBindingOnUnit(Int unit, TextureTarget target) {
+            auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+            const auto& obj = textureUnit.GetBindingSlot(target).GetBoundObject();
+            return obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
+        }
+
+        GLint QuerySamplerBindingOnUnit(Int unit) {
+            const auto& textureUnit = MG_State::pGLContext->GetTextureUnitObject(unit);
+            const auto& sampler = textureUnit.GetSamplerObject();
+            return sampler ? static_cast<GLint>(sampler->GetExternalIndex()) : 0;
+        }
+
+        // The ARB_viewport_array indexed rectangles. MobileGL keeps exactly one viewport, one
+        // scissor box and one depth range, so every in-range index answers with that single
+        // value - but it has to come from the frontend state the non-indexed getters read.
+        // The generic path at the bottom of GetIntegeri_v is a raw backend passthrough that
+        // has no case for these, so routing them through it returned zeros.
+        Bool IsIndexedViewportQuery(GLenum target) {
+            return target == GL_VIEWPORT || target == GL_SCISSOR_BOX || target == GL_DEPTH_RANGE;
+        }
+
+        // ARB_viewport_array: `index` selects a viewport and MAX_VIEWPORTS bounds it.
+        Bool ValidateViewportQueryIndex(GLuint index, const char* caller) {
+            GLint maxViewports = 0;
+            GetIntegerv(GL_MAX_VIEWPORTS, &maxViewports);
+            if (index < static_cast<GLuint>(std::max(maxViewports, 1))) return true;
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Viewport index is out of range."));
+            return false;
+        }
+
         void CopyIntsToBooleans(const GLint* src, SizeT count, GLboolean* dst) {
             for (SizeT i = 0; i < count; ++i) {
                 dst[i] = src[i] ? GL_TRUE : GL_FALSE;
@@ -671,7 +733,37 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
         }
 
+        // Per-texture-unit bindings: GL 4.6 core table 23.19 makes every GL_TEXTURE_BINDING_*
+        // and GL_SAMPLER_BINDING indexed by texture unit. Without this they fell through to
+        // the raw backend passthrough at the bottom, which knows nothing about the
+        // frontend's binding state.
+        if (TextureTarget textureBindingTarget = TextureTarget::Unknown;
+            TryDecodeTextureUnitBindingPname(target, textureBindingTarget) || target == GL_SAMPLER_BINDING) {
+            GLint maxUnits = 0;
+            GetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &maxUnits);
+            maxUnits = std::min<GLint>(maxUnits, MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS);
+            if (index >= static_cast<GLuint>(std::max(maxUnits, 0))) {
+                *data = 0;
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Texture unit index is out of range."));
+                return;
+            }
+            *data = target == GL_SAMPLER_BINDING
+                ? QuerySamplerBindingOnUnit(static_cast<Int>(index))
+                : QueryTextureBindingOnUnit(static_cast<Int>(index), textureBindingTarget);
+            return;
+        }
+
         switch (target) {
+        // ARB_viewport_array queries the indexed rectangles through glGetIntegeri_v as well
+        // (gl4cMultiBindTests and the viewport_array group both do). The frontend keeps one
+        // viewport and one scissor box, so every in-range index reports that one.
+        case GL_VIEWPORT:
+        case GL_SCISSOR_BOX:
+            if (!ValidateViewportQueryIndex(index, __func__)) return;
+            GetIntegerv(target, data);
+            return;
         // The vertex buffer binding points of the vertex array object that is bound. Indexed by
         // binding point, not by attribute (GL 4.6 core 10.3.1).
         case GL_VERTEX_BINDING_BUFFER:
@@ -783,6 +875,46 @@ namespace MobileGL::MG_Impl::GLImpl {
         getIntegeri(target, index, data);
     }
 
+    // GL_ARB_viewport_array's typed indexed getters. They were no-op stubs, which left the
+    // caller's output buffer holding whatever was on the stack. The multi-component indexed
+    // rectangles are answered from the frontend's own viewport/scissor/depth-range state, via
+    // the non-indexed getter of the matching type - GL_DEPTH_RANGE is float state, so putting
+    // it through the integer query would round it to 0/1. Everything else MobileGL answers
+    // indexed is scalar integer-domain state, where converting the integer query is exact.
+    void GetFloati_v(GLenum target, GLuint index, GLfloat* data) {
+        if (!data) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "data pointer cannot be null"));
+            return;
+        }
+        if (IsIndexedViewportQuery(target)) {
+            if (!ValidateViewportQueryIndex(index, __func__)) return;
+            GetFloatv(target, data);
+            return;
+        }
+        GLint ints[4] = {};
+        GetIntegeri_v(target, index, ints);
+        data[0] = static_cast<GLfloat>(ints[0]);
+    }
+
+    void GetDoublei_v(GLenum target, GLuint index, GLdouble* data) {
+        if (!data) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "data pointer cannot be null"));
+            return;
+        }
+        if (IsIndexedViewportQuery(target)) {
+            if (!ValidateViewportQueryIndex(index, __func__)) return;
+            GetDoublev(target, data);
+            return;
+        }
+        GLint ints[4] = {};
+        GetIntegeri_v(target, index, ints);
+        data[0] = static_cast<GLdouble>(ints[0]);
+    }
+
     void GetInteger64i_v(GLenum target, GLuint index, GLint64* data) {
         if (!data) {
             MG_State::pGLContext->RecordError(
@@ -959,6 +1091,13 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        // Per-texture-unit bindings: the non-indexed query reports the active unit.
+        if (TextureTarget textureBindingTarget = TextureTarget::Unknown;
+            TryDecodeTextureUnitBindingPname(pname, textureBindingTarget)) {
+            *params = QueryTextureBindingOnUnit(MG_State::pGLContext->GetActiveTextureUnit(), textureBindingTarget);
+            return;
+        }
+
         switch (pname) {
         case GL_ACTIVE_TEXTURE:
             *params = MG_State::pGLContext->GetActiveTextureUnit() + GL_TEXTURE0;
@@ -1085,11 +1224,17 @@ namespace MobileGL::MG_Impl::GLImpl {
                           : 0;
             return;
         case GL_MAX_DEBUG_GROUP_STACK_DEPTH:
-            *params = 0; // debug-group entrypoints are stubbed
+            // KHR_debug floors this at 64 even when the group entry points are stubs: the
+            // limit describes how deep glPushDebugGroup may nest, and 0 is not a legal answer.
+            *params = kFrontendMaxDebugGroupStackDepth;
             return;
         case GL_MAX_DEBUG_MESSAGE_LENGTH:
             *params = 1024; // debug-message entrypoints are stubbed, but KHR_debug requires a valid limit
             return;
+        case GL_MAX_DEBUG_LOGGED_MESSAGES:
+            // Size of the message log ring; KHR_debug requires at least 1.
+            *params = kFrontendMaxDebugLoggedMessages;
+            return;
         case GL_DEBUG_GROUP_STACK_DEPTH:
             *params = 0; // debug-group entrypoints are stubbed
             return;
@@ -1531,13 +1676,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_SAMPLE_MASK_VALUE:
             *params = static_cast<GLint>(MG_State::pGLContext->GetSampleMaskValue());
             return;
-        case GL_SAMPLER_BINDING: {
+        case GL_SAMPLER_BINDING:
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
+            *params = QuerySamplerBindingOnUnit(MG_State::pGLContext->GetActiveTextureUnit());
-            const auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& sampler = tu.GetSamplerObject();
-            *params = sampler ? static_cast<GLint>(sampler->GetExternalIndex()) : 0;
             return;
-        }
         case GL_SAMPLES:
             *params = ResolveDrawFramebufferSampleCount();
             return;
@@ -1633,87 +1774,6 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_STEREO:
             *params = 0; // stereo surfaces are not exposed
             return;
-        case GL_TEXTURE_BINDING_1D: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture1D);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_1D_ARRAY: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture1DArray);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_2D: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture2D);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            MGLOG_D("Get GL_TEXTURE_BINDING_2D: %d", *params);
-            return;
-        }
-        case GL_TEXTURE_BINDING_2D_ARRAY: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture2DArray);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_2D_MULTISAMPLE: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture2DMultisample);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_2D_MULTISAMPLE_ARRAY: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture2DMultisampleArray);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_3D: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::Texture3D);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_BUFFER: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::TextureBuffer);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_CUBE_MAP: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::TextureCubeMap);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_TEXTURE_BINDING_RECTANGLE: {
-            Int unit = MG_State::pGLContext->GetActiveTextureUnit();
-            auto& tu = MG_State::pGLContext->GetTextureUnitObject(unit);
-            const auto& slot = tu.GetBindingSlot(TextureTarget::TextureRectangle);
-            const auto& obj = slot.GetBoundObject();
-            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
         case GL_TEXTURE_COMPRESSION_HINT:
             *params = static_cast<GLint>(MG_State::pGLContext->GetHint(pname));
             return;
@@ -1986,6 +2046,18 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS:
             *params = static_cast<GLint>(GetIndexedBufferQueryPointCount(BufferTarget::ShaderStorage));
             break;
+        case GL_MAX_SHADER_STORAGE_BLOCK_SIZE:
+            // 64-bit state (see GetInteger64v); the 32-bit query saturates, per the GL
+            // state-query conversion rules.
+            *params = static_cast<GLint>(std::min<Uint64>(dynamicParameters.MaxShaderStorageBlockSize,
+                                                          static_cast<Uint64>(INT32_MAX)));
+            break;
+        case GL_MAX_ATOMIC_COUNTER_BUFFER_BINDINGS:
+            *params = static_cast<GLint>(GetIndexedBufferQueryPointCount(BufferTarget::AtomicCounter));
+            break;
+        case GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE:
+            *params = kFrontendMaxAtomicCounterBufferSize;
+            break;
         case GL_MAX_TEXTURE_BUFFER_SIZE:
             *params = dynamicParameters.MaxTextureBufferSize;
             break;

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.h

@@ -19,6 +19,8 @@ namespace MobileGL::MG_Impl::GLImpl {
     void GetIntegerv(GLenum pname, GLint* params);
     void GetInteger64v(GLenum pname, GLint64* params);
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
+    void GetFloati_v(GLenum target, GLuint index, GLfloat* data);
+    void GetDoublei_v(GLenum target, GLuint index, GLdouble* data);
     void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
     GLenum GetError();
     GLenum GetGraphicsResetStatus();

MobileGL/MG_Impl/GLImpl/Program/GL_Program.cpp

@@ -7,6 +7,7 @@
 // End of Source File Header
 
 #include "GL_Program.h"
+#include "ProgramInterface.h"
 #include "Config.h"
 #include <cmath>
 #include <limits>
@@ -109,32 +110,37 @@ namespace MobileGL::MG_Impl::GLImpl {
         return programObject;
     }
 
-    static bool IsProgramInterfaceEnum(GLenum programInterface) {
+    // The four non-location interface queries validate the NAME only: GL 4.6 imposes the
-        switch (programInterface) {
+    // successful-link requirement on GetProgramResourceLocation/LocationIndex alone, and
-        case GL_UNIFORM:
+    // requires the others to report a program that has never linked as one with zero active
-        case GL_UNIFORM_BLOCK:
+    // resources. Being stricter leaves a stray GL_INVALID_OPERATION behind that aborts the
-        case GL_PROGRAM_INPUT:
+    // caller's next subcase.
-        case GL_PROGRAM_OUTPUT:
+    static const SharedPtr<MG_State::GLState::ProgramObject>& TryToGetProgramForInterfaceQuery(GLuint program,
-        case GL_BUFFER_VARIABLE:
+                                                                                               const char* caller) {
-        case GL_SHADER_STORAGE_BLOCK:
+        static const SharedPtr<MG_State::GLState::ProgramObject> nullProgramObject = nullptr;
-        case GL_ATOMIC_COUNTER_BUFFER:
+        if (!MG_State::pGLContext->ValidateProgramName(program)) {
-        case GL_TRANSFORM_FEEDBACK_VARYING:
+            const ErrorCode error = MG_State::pGLContext->ValidateShaderName(program)
-        case GL_VERTEX_SUBROUTINE:
+                ? ErrorCode::InvalidOperation
-        case GL_TESS_CONTROL_SUBROUTINE:
+                : ErrorCode::InvalidValue;
-        case GL_TESS_EVALUATION_SUBROUTINE:
+            MG_State::pGLContext->RecordError(
-        case GL_GEOMETRY_SUBROUTINE:
+                error,
-        case GL_FRAGMENT_SUBROUTINE:
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
-        case GL_COMPUTE_SUBROUTINE:
+                                             std::to_string(program) + " is not a program object."));
-        case GL_VERTEX_SUBROUTINE_UNIFORM:
+            return nullProgramObject;
-        case GL_TESS_CONTROL_SUBROUTINE_UNIFORM:
-        case GL_TESS_EVALUATION_SUBROUTINE_UNIFORM:
-        case GL_GEOMETRY_SUBROUTINE_UNIFORM:
-        case GL_FRAGMENT_SUBROUTINE_UNIFORM:
-        case GL_COMPUTE_SUBROUTINE_UNIFORM:
-            return true;
-        default:
-            return false;
         }
+        auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+        if (!programObject) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                             std::to_string(program) + " is not a program object."));
+            return nullProgramObject;
+        }
+        return programObject;
+    }
+
+    static bool IsProgramInterfaceEnum(GLenum programInterface) {
+        return ProgramInterface::IsInterfaceEnum(programInterface);
     }
 
     static bool IsSubroutineUniformInterface(GLenum programInterface) {
@@ -157,11 +163,16 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_ACTIVE_RESOURCES:
             break;
         case GL_MAX_NAME_LENGTH:
-            valid = valid && programInterface != GL_ATOMIC_COUNTER_BUFFER;
+            // Neither buffer interface has resource names. GL_TRANSFORM_FEEDBACK_BUFFER only
+            // became reachable here when IsInterfaceEnum grew the GL 4.4 interfaces, so it
+            // needs the same exclusion GL_ATOMIC_COUNTER_BUFFER already had.
+            valid = valid && programInterface != GL_ATOMIC_COUNTER_BUFFER &&
+                    programInterface != GL_TRANSFORM_FEEDBACK_BUFFER;
             break;
         case GL_MAX_NUM_ACTIVE_VARIABLES:
             valid = programInterface == GL_UNIFORM_BLOCK || programInterface == GL_ATOMIC_COUNTER_BUFFER ||
-                    programInterface == GL_SHADER_STORAGE_BLOCK;
+                    programInterface == GL_SHADER_STORAGE_BLOCK ||
+                    programInterface == GL_TRANSFORM_FEEDBACK_BUFFER;
             break;
         case GL_MAX_NUM_COMPATIBLE_SUBROUTINES:
             valid = IsSubroutineUniformInterface(programInterface);
@@ -180,7 +191,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     static bool ValidateNamedProgramResourceInterface(GLenum programInterface, const char* caller) {
-        if (!IsProgramInterfaceEnum(programInterface) || programInterface == GL_ATOMIC_COUNTER_BUFFER) {
+        if (!ProgramInterface::IsNamedInterface(programInterface)) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
@@ -190,66 +201,6 @@ namespace MobileGL::MG_Impl::GLImpl {
         return true;
     }
 
-    static Int GetKnownProgramResourceCount(const SharedPtr<MG_State::GLState::ProgramObject>& programObject,
-                                            GLenum programInterface) {
-        switch (programInterface) {
-        case GL_UNIFORM:
-            return programObject->GetUniformCount();
-        case GL_UNIFORM_BLOCK:
-            return programObject->GetActiveUniformBlocksCount();
-        case GL_PROGRAM_INPUT:
-            return programObject->GetActiveAttributesCount();
-        case GL_PROGRAM_OUTPUT:
-            return programObject->GetActiveFragmentOutputCount();
-        default:
-            return -1;
-        }
-    }
-
-    // The GL_UNIFORM interface and glGetActiveUniform(s)iv are the same query in two
-    // spellings, so they answer from the same place - the frontend reflection. The backend
-    // program is not that place: it does not exist at all for a program whose types its
-    // shading language cannot express (a double-precision uniform has no ESSL form), and
-    // the interface queries would then describe a program with no uniforms.
-    //
-    // Writes the GL_UNIFORM value of `prop` for active uniform `index`; false for a prop
-    // the reflection does not model, which the caller forwards to the backend instead.
-    Bool GetUniformResourceProp(const SharedPtr<MG_State::GLState::ProgramObject>& programObject, Uint index,
-                                GLenum prop, GLint* out) {
-        switch (prop) {
-        case GL_TYPE:
-            *out = static_cast<GLint>(programObject->GetActiveUniformType(index));
-            return true;
-        case GL_ARRAY_SIZE:
-            *out = programObject->GetActiveUniformArraySize(index);
-            return true;
-        case GL_NAME_LENGTH:
-            *out = static_cast<GLint>(programObject->GetActiveUniformName(index).length() + 1);
-            return true;
-        case GL_BLOCK_INDEX:
-            *out = programObject->GetActiveUniformBlockIndex(index);
-            return true;
-        case GL_OFFSET:
-            *out = programObject->GetActiveUniformOffset(index);
-            return true;
-        case GL_ARRAY_STRIDE:
-            *out = programObject->GetActiveUniformArrayStride(index);
-            return true;
-        case GL_MATRIX_STRIDE:
-            *out = programObject->GetActiveUniformMatrixStride(index);
-            return true;
-        case GL_IS_ROW_MAJOR:
-            *out = programObject->GetActiveUniformIsRowMajor(index);
-            return true;
-        case GL_LOCATION:
-            // A block member has no location; GetUniformLocation already reports -1 for one.
-            *out = programObject->GetUniformLocation(programObject->GetActiveUniformName(index));
-            return true;
-        default:
-            return false;
-        }
-    }
-
     void CopyStr(GLsizei bufSize, GLsizei* length, GLchar* dst, const char* src, GLsizei srcLength) {
         if (bufSize <= 0) {
             if (length) *length = 0;
@@ -409,14 +360,19 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     GLuint CreateShader_State(GLenum type) {
-        auto shaderId = MG_State::pGLContext->CreateShader(MG_Util::ConvertGLEnumToShaderStage(type));
+        // GL 4.6 core 7.1: shaderType is an enum, so an unrecognised one is INVALID_ENUM (it
-        if (shaderId == 0) {
+        // used to be documented as INVALID_VALUE). The check has to happen HERE: the state
+        // layer hands out a name for ShaderStage::Unknown just as happily as for a real
+        // stage, so the old "shaderId == 0 means bad type" test could never fire and an
+        // unknown shaderType silently produced a usable shader name and no error at all.
+        const ShaderStage stage = MG_Util::ConvertGLEnumToShaderStage(type);
+        if (stage == ShaderStage::Unknown) {
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue,
+                ErrorCode::InvalidEnum,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "`shaderType` is not an accepted value."));
             return 0;
         }
-        return shaderId;
+        return MG_State::pGLContext->CreateShader(stage);
     }
 
     void DeleteProgram_State(GLuint program) {
@@ -855,6 +811,31 @@ namespace MobileGL::MG_Impl::GLImpl {
         return loc;
     }
 
+    // A float matrix lives in the global UBO under std140 rules - one 16-byte-aligned column
+    // vector per column - while the value glGetUniform* must return is tightly packed
+    // columns * rows floats. Only mat4 is the same either way; every other shape needs the
+    // padding undone, and the readback has to undo exactly what UniformMatrixfv_Object put
+    // there. Returns false when `ttype` is not a float matrix (nothing to unpack).
+    Bool TryGatherFloatMatrixColumns(const glslang::TType* ttype, const char* pBase, void* params) {
+        if (ttype == nullptr || !ttype->isMatrix() || ttype->getBasicType() == glslang::EbtDouble) return false;
+        const Int columns = ttype->getMatrixCols();
+        const Int rows = ttype->getMatrixRows();
+        for (Int column = 0; column < columns; ++column) {
+            Memcpy(static_cast<char*>(params) + static_cast<SizeT>(column) * rows * sizeof(GLfloat),
+                   pBase + static_cast<SizeT>(column) * 4 * sizeof(GLfloat), rows * sizeof(GLfloat));
+        }
+        return true;
+    }
+
+    // Bytes a uniform actually occupies in the global UBO. It is the tight GL type size for
+    // everything except a float matrix, whose padded columns make it wider.
+    SizeT UniformStorageSpanInBytes(const glslang::TType* ttype, SizeT tightSize) {
+        if (ttype != nullptr && ttype->isMatrix() && ttype->getBasicType() != glslang::EbtDouble) {
+            return static_cast<SizeT>(ttype->getMatrixCols()) * 4 * sizeof(GLfloat);
+        }
+        return tightSize;
+    }
+
     void GetUniform_State(GLuint program, GLint location, void* params) {
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
@@ -885,23 +866,16 @@ namespace MobileGL::MG_Impl::GLImpl {
             auto size = programObject->GetUniformSizesInBytes(location);
             char* pUBO = (char*)programObject->MapUBO();
             auto* ttype = programObject->GetUniformTType(location);
+            const SizeT span = UniformStorageSpanInBytes(ttype, size);
             if (pUBO == nullptr || offset == MG_State::GLState::ProgramObject::kInvalidUniformOffset ||
-                offset + size > programObject->GetUBOSize()) {
+                offset + span > programObject->GetUBOSize()) {
                 MGLOG_E("%s: uniform at program %u location %d has no backing storage; returning nothing", __func__,
                         program, location);
                 return;
             }
 
-            if (!ttype->isMatrix() || ttype->getMatrixCols() != 3)
+            if (!TryGatherFloatMatrixColumns(ttype, pUBO + offset, params)) {
                 Memcpy(params, pUBO + offset, size);
-            else {
-                // TODO: we only deal with mat3 yet, deal with other types later
-                // assuming float here, which may not be the case
-                auto* pBase = pUBO + offset;
-                for (int i = 0; i < ttype->getMatrixRows(); i++) {
-                    Memcpy((char*)params + ttype->getMatrixCols() * sizeof(float) * i, pBase + 4 * sizeof(float) * i,
-                           ttype->getMatrixCols() * sizeof(float));
-                }
             }
         }
         // TODO: handle 1i variant as texture unit
@@ -940,23 +914,16 @@ namespace MobileGL::MG_Impl::GLImpl {
         auto size = programObject->GetUniformSizesInBytes(location);
         char* pUBO = static_cast<char*>(programObject->MapUBO());
         auto* ttype = programObject->GetUniformTType(location);
+        const SizeT span = UniformStorageSpanInBytes(ttype, size);
         if (pUBO == nullptr || offset == MG_State::GLState::ProgramObject::kInvalidUniformOffset ||
-            offset + size > programObject->GetUBOSize()) {
+            offset + span > programObject->GetUBOSize()) {
             MGLOG_E("%s: uniform at program %u location %d has no backing storage; returning nothing", __func__,
                     program, location);
             return;
         }
 
         if constexpr (std::is_same_v<T, GLfloat>) {
-            if (ttype->getBasicType() != glslang::EbtDouble && ttype->isMatrix() &&
+            if (TryGatherFloatMatrixColumns(ttype, pUBO + offset, params)) return;
-                ttype->getMatrixCols() == 3) {
-                auto* pBase = pUBO + offset;
-                for (int i = 0; i < ttype->getMatrixRows(); i++) {
-                    Memcpy(reinterpret_cast<char*>(params) + ttype->getMatrixCols() * sizeof(GLfloat) * i,
-                           pBase + 4 * sizeof(GLfloat) * i, ttype->getMatrixCols() * sizeof(GLfloat));
-                }
-                return;
-            }
         }
 
         // A double-precision uniform is the one case where the stored component type can
@@ -1257,6 +1224,52 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
+    // glUniformMatrix*fv / glProgramUniformMatrix*fv, every shape (square and non-square).
+    // A float matrix sits in the global UBO under std140 rules: each of its `columns`
+    // column vectors starts on its own 16-byte boundary no matter how many rows it has, so
+    // the only shape that may be written as one contiguous block is mat4. Writing a matNxM
+    // as N*M packed floats puts every column after the first at the wrong byte offset.
+    template <typename Program>
+    void UniformMatrixfv_Object(Program& programObject, const char* caller, GLint location, GLsizei count,
+                                GLboolean transpose, const GLfloat* value, Int columns, Int rows,
+                                const String& ownerDescription) {
+        // std140: a column vector of a float matrix is padded out to a vec4.
+        constexpr SizeT kColumnStride = 4 * sizeof(GLfloat);
+        const SizeT componentCount = static_cast<SizeT>(columns) * static_cast<SizeT>(rows);
+        GLfloat column[4] = {};
+        for (GLint matrix = 0; matrix < count; ++matrix) {
+            if (matrix > 0 && !programObject.UniformLocationsAliasSameUniform(location, location + matrix)) {
+                // GL 3.3 2.11.4: values for elements beyond the end of the uniform array
+                // are ignored. Never step onto a neighboring uniform's location.
+                break;
+            }
+            if (!programObject.IsValidUniformLocation(location + matrix)) {
+                RecordInvalidUniformLocationError(caller, location + matrix, ownerDescription);
+                return;
+            }
+            if (programObject.IsUniformOpaqueAtLocation(location + matrix)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                                 "Opaque uniforms cannot be set with matrix Uniform calls."));
+                return;
+            }
+            if (value == nullptr) return;
+            const GLfloat* source = value + static_cast<SizeT>(matrix) * componentCount;
+            for (Int c = 0; c < columns; ++c) {
+                for (Int r = 0; r < rows; ++r) {
+                    column[r] = transpose == GL_TRUE ? source[r * columns + c] : source[c * rows + r];
+                }
+                const SizeT byteOffset = static_cast<SizeT>(c) * kColumnStride;
+                switch (rows) {
+                case 2: Uniform_State<2>(programObject, location + matrix, column, byteOffset); break;
+                case 3: Uniform_State<3>(programObject, location + matrix, column, byteOffset); break;
+                default: Uniform_State<4>(programObject, location + matrix, column, byteOffset); break;
+                }
+            }
+        }
+    }
+
     // Helper function to transpose a 2x2 matrix
     void TransposeMatrix2x2(const GLfloat* input, GLfloat* output) {
         // Input matrix is in column-major order (OpenGL default)
@@ -1362,8 +1375,8 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void UniformMatrix2fv_State(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        // For 2x2 matrices, we have 4 elements per matrix
+        // A mat2 is NOT four contiguous floats in the global UBO: std140 pads each column
-        // If transpose is GL_TRUE, we need to transpose the matrix data
+        // vector out to 16 bytes, so column 1 starts at byte 16, not byte 8.
         if (location == -1) return;
 
         auto& programObject = MG_State::pGLContext->GetProgramForUniform();
@@ -1374,26 +1387,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
-        // For matrix uniforms, we handle each matrix individually
+        UniformMatrixfv_Object(*programObject, __func__, location, count, transpose, value, 2, 2,
-        for (GLint i = 0; i < count; i++) {
+                               "the current program object");
-            if (i > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + i)) {
-                // Values for elements beyond the end of the uniform array are ignored.
-                break;
-            }
-            if (!programObject->IsValidUniformLocation(location + i)) {
-                RecordInvalidUniformLocationError(__func__, location + i, "the current program object");
-                return;
-            }
-            if (transpose == GL_TRUE) {
-                // Transpose the matrix before uploading
-                GLfloat transposedMatrix[4];
-                TransposeMatrix2x2(value + i * 4, transposedMatrix);
-                Uniform_State<4>(*programObject, location + i, transposedMatrix);
-            } else {
-                // No transpose needed, directly copy the matrix data
-                Uniform_State<4>(*programObject, location + i, value + i * 4);
-            }
-        }
     }
 
     void UniformMatrix3fv_State(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
@@ -1471,7 +1466,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
-    void UniformMatrixNonSquarefv_State(const char* caller, GLint location, GLsizei count) {
+    void UniformMatrixNonSquarefv_State(const char* caller, GLint location, GLsizei count, GLboolean transpose,
+                                        const GLfloat* value, Int columns, Int rows) {
         if (location == -1) return;
 
         auto& programObject = MG_State::pGLContext->GetProgramForUniform();
@@ -1482,21 +1478,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
-        for (GLint i = 0; i < count; i++) {
+        UniformMatrixfv_Object(*programObject, caller, location, count, transpose, value, columns, rows,
-            if (!programObject->IsValidUniformLocation(location + i)) {
+                               "the current program object");
-                RecordInvalidUniformLocationError(caller, location + i, "the current program object");
-                return;
-            }
-            if (programObject->IsUniformOpaqueAtLocation(location + i)) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
-                                                 "Opaque uniforms cannot be set with matrix Uniform calls."));
-                return;
-            }
-        }
-
-        // TODO: Implement non-square matrix uniform uploads for non-opaque uniforms.
     }
 
     void ProgramUniformMatrix2fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
@@ -1514,23 +1497,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
-        for (GLint i = 0; i < count; i++) {
+        UniformMatrixfv_Object(*programObject, __func__, location, count, transpose, value, 2, 2,
-            if (i > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + i)) {
+                               "program " + std::to_string(program));
-                // Values for elements beyond the end of the uniform array are ignored.
-                break;
-            }
-            if (!programObject->IsValidUniformLocation(location + i)) {
-                RecordInvalidUniformLocationError(__func__, location + i, "program " + std::to_string(program));
-                return;
-            }
-            if (transpose == GL_TRUE) {
-                GLfloat transposedMatrix[4];
-                TransposeMatrix2x2(value + i * 4, transposedMatrix);
-                Uniform_State<4>(*programObject, location + i, transposedMatrix);
-            } else {
-                Uniform_State<4>(*programObject, location + i, value + i * 4);
-            }
-        }
     }
 
     void ProgramUniformMatrix3fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
@@ -1605,7 +1573,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
-    void ProgramUniformMatrixNonSquarefv_State(const char* caller, GLuint program, GLint location, GLsizei count) {
+    void ProgramUniformMatrixNonSquarefv_State(const char* caller, GLuint program, GLint location, GLsizei count,
+                                               GLboolean transpose, const GLfloat* value, Int columns, Int rows) {
         if (location == -1) return;
 
         auto& programObject = TryToGetProgramObject(program);
@@ -1619,21 +1588,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
-        for (GLint i = 0; i < count; i++) {
+        UniformMatrixfv_Object(*programObject, caller, location, count, transpose, value, columns, rows,
-            if (!programObject->IsValidUniformLocation(location + i)) {
+                               "program " + std::to_string(program));
-                RecordInvalidUniformLocationError(caller, location + i, "program " + std::to_string(program));
-                return;
-            }
-            if (programObject->IsUniformOpaqueAtLocation(location + i)) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
-                                                 "Opaque uniforms cannot be set with matrix Uniform calls."));
-                return;
-            }
-        }
-
-        // TODO: Implement non-square matrix uniform uploads for non-opaque uniforms.
     }
 
     GLuint GetUniformBlockIndex_State(GLuint program, const GLchar* uniformBlockName) {
@@ -2442,27 +2398,27 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void UniformMatrix2x3fv(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        UniformMatrixNonSquarefv_State(__func__, location, count);
+        UniformMatrixNonSquarefv_State(__func__, location, count, transpose, value, 2, 3);
     }
 
     void UniformMatrix3x2fv(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        UniformMatrixNonSquarefv_State(__func__, location, count);
+        UniformMatrixNonSquarefv_State(__func__, location, count, transpose, value, 3, 2);
     }
 
     void UniformMatrix2x4fv(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        UniformMatrixNonSquarefv_State(__func__, location, count);
+        UniformMatrixNonSquarefv_State(__func__, location, count, transpose, value, 2, 4);
     }
 
     void UniformMatrix4x2fv(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        UniformMatrixNonSquarefv_State(__func__, location, count);
+        UniformMatrixNonSquarefv_State(__func__, location, count, transpose, value, 4, 2);
     }
 
     void UniformMatrix3x4fv(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        UniformMatrixNonSquarefv_State(__func__, location, count);
+        UniformMatrixNonSquarefv_State(__func__, location, count, transpose, value, 3, 4);
     }
 
     void UniformMatrix4x3fv(GLint location, GLsizei count, GLboolean transpose, const GLfloat* value) {
-        UniformMatrixNonSquarefv_State(__func__, location, count);
+        UniformMatrixNonSquarefv_State(__func__, location, count, transpose, value, 4, 3);
     }
 
     void ProgramUniform1f(GLuint program, GLint location, GLfloat v0) {
@@ -2587,32 +2543,32 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2x3fv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                    const GLfloat* value) {
-        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count);
+        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count, transpose, value, 2, 3);
     }
 
     void ProgramUniformMatrix3x2fv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                    const GLfloat* value) {
-        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count);
+        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count, transpose, value, 3, 2);
     }
 
     void ProgramUniformMatrix2x4fv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                    const GLfloat* value) {
-        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count);
+        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count, transpose, value, 2, 4);
     }
 
     void ProgramUniformMatrix4x2fv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                    const GLfloat* value) {
-        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count);
+        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count, transpose, value, 4, 2);
     }
 
     void ProgramUniformMatrix3x4fv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                    const GLfloat* value) {
-        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count);
+        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count, transpose, value, 3, 4);
     }
 
     void ProgramUniformMatrix4x3fv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                    const GLfloat* value) {
-        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count);
+        ProgramUniformMatrixNonSquarefv_State(__func__, program, location, count, transpose, value, 4, 3);
     }
 
     GLuint GetUniformBlockIndex(GLuint program, const GLchar* uniformBlockName) {
@@ -2649,171 +2605,160 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GetProgramInterfaceiv(GLuint program, GLenum programInterface, GLenum pname, GLint* params) {
-        auto& programObject = TryToGetLinkedProgramForInterfaceQuery(program, __func__);
+        auto& programObject = TryToGetProgramForInterfaceQuery(program, __func__);
         if (!programObject) return;
         if (!ValidateProgramInterfaceivQuery(programInterface, pname)) return;
-        auto getProgramInterfaceiv = MG_Backend::gBackendFunctionsTable.GL.GetProgramInterfaceiv;
+        if (!params) return;
-        if (!getProgramInterfaceiv) {
+        switch (pname) {
-            MG_State::pGLContext->RecordError(
+        case GL_ACTIVE_RESOURCES:
-                ErrorCode::InvalidOperation,
+            *params = ProgramInterface::GetActiveResourceCount(*programObject, programInterface);
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+            return;
-                                             "Backend does not support program interface queries."));
+        case GL_MAX_NAME_LENGTH:
+            *params = ProgramInterface::GetMaxNameLength(*programObject, programInterface);
+            return;
+        case GL_MAX_NUM_ACTIVE_VARIABLES:
+            *params = ProgramInterface::GetMaxNumActiveVariables(*programObject, programInterface);
+            return;
+        default:
+            // GL_MAX_NUM_COMPATIBLE_SUBROUTINES: the subroutine interfaces are always empty
+            // here (glslang refuses `subroutine` when generating SPIR-V), so zero it is.
+            *params = 0;
             return;
         }
-        if (programInterface == GL_UNIFORM) {
-            if (pname == GL_ACTIVE_RESOURCES) {
-                *params = static_cast<GLint>(programObject->GetUniformCount());
-                return;
-            }
-            if (pname == GL_MAX_NAME_LENGTH) {
-                // Stored as the bare length; GL_MAX_NAME_LENGTH counts the terminator.
-                *params = programObject->GetUniformMaxLength() + 1;
-                return;
-            }
-        }
-        getProgramInterfaceiv(program, programInterface, pname, params);
     }
 
     GLuint GetProgramResourceIndex(GLuint program, GLenum programInterface, const GLchar* name) {
-        auto& programObject = TryToGetLinkedProgramForInterfaceQuery(program, __func__);
+        auto& programObject = TryToGetProgramForInterfaceQuery(program, __func__);
         if (!programObject) return GL_INVALID_INDEX;
         if (!ValidateNamedProgramResourceInterface(programInterface, __func__)) return GL_INVALID_INDEX;
         if (!name) return GL_INVALID_INDEX;
-        if (programInterface == GL_UNIFORM) {
+        return ProgramInterface::GetResourceIndex(*programObject, programInterface, name);
-            const Int uniformIndex = programObject->GetActiveUniformIndex(name);
-            return uniformIndex < 0 ? GL_INVALID_INDEX : static_cast<GLuint>(uniformIndex);
-        }
-        auto getProgramResourceIndex = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceIndex;
-        if (!getProgramResourceIndex) {
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidOperation,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                             "Backend does not support program interface queries."));
-            return GL_INVALID_INDEX;
-        }
-        GLuint index = getProgramResourceIndex(program, programInterface, name);
-        const String resourceName = name;
-        if (index == GL_INVALID_INDEX && resourceName.length() > 3 &&
-            resourceName.compare(resourceName.length() - 3, 3, "[0]") == 0) {
-            index = getProgramResourceIndex(program, programInterface,
-                                            resourceName.substr(0, resourceName.length() - 3).c_str());
-        }
-        return index;
     }
 
     void GetProgramResourceName(GLuint program, GLenum programInterface, GLuint index, GLsizei bufSize, GLsizei* length,
                                 GLchar* name) {
-        auto& programObject = TryToGetLinkedProgramForInterfaceQuery(program, __func__);
+        auto& programObject = TryToGetProgramForInterfaceQuery(program, __func__);
         if (!programObject) return;
         if (!ValidateNamedProgramResourceInterface(programInterface, __func__)) return;
-        const Int resourceCount = GetKnownProgramResourceCount(programObject, programInterface);
-        if (resourceCount >= 0 && index >= static_cast<GLuint>(resourceCount)) {
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "index is out of range."));
-            return;
-        }
         if (bufSize < 0) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "bufSize must be non-negative."));
             return;
         }
-        if (programInterface == GL_UNIFORM) {
+        String resourceName;
-            // Same index space GetProgramResourceIndex answers in, and the range check above
+        if (!ProgramInterface::GetResourceName(*programObject, programInterface, index, resourceName)) {
-            // already used it.
-            const String& uniformName = programObject->GetActiveUniformName(index);
-            CopyStr(bufSize, length, name, uniformName.c_str(), static_cast<GLsizei>(uniformName.length()));
-            return;
-        }
-        auto getProgramResourceName = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceName;
-        if (!getProgramResourceName) {
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidOperation,
+                ErrorCode::InvalidValue,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "index is out of range."));
-                                             "Backend does not support program interface queries."));
             return;
         }
-        getProgramResourceName(program, programInterface, index, bufSize, length, name);
+        CopyStr(bufSize, length, name, resourceName.c_str(), static_cast<GLsizei>(resourceName.length()));
     }
 
     void GetProgramResourceiv(GLuint program, GLenum programInterface, GLuint index, GLsizei propCount,
                               const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params) {
-        auto& programObject = TryToGetLinkedProgramForInterfaceQuery(program, __func__);
+        auto& programObject = TryToGetProgramForInterfaceQuery(program, __func__);
         if (!programObject) return;
-        if (propCount < 0 || bufSize < 0) {
+        if (!ProgramInterface::IsInterfaceEnum(programInterface)) {
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                ErrorCode::InvalidEnum,
-                                                                      "propCount and bufSize must be non-negative."));
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Unsupported program interface."));
             return;
         }
-        if (programInterface == GL_UNIFORM) {
+        if (propCount <= 0 || bufSize < 0) {
-            if (index >= programObject->GetUniformCount()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                                      "propCount must be positive and bufSize "
+                                                                      "non-negative."));
+            return;
+        }
+        if (props == nullptr) return;
+        // Both prop checks run BEFORE any value is produced: a property this command does
+        // not know at all is INVALID_ENUM, one it knows but the interface does not carry is
+        // INVALID_OPERATION (GL 4.6 Table 7.2). The two are deliberately different errors.
+        for (GLsizei i = 0; i < propCount; ++i) {
+            if (!ProgramInterface::IsResourceProp(props[i])) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidEnum,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "prop is not a valid property name."));
+                return;
+            }
+            if (!ProgramInterface::InterfaceSupportsProp(programInterface, props[i])) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 "prop is not supported for this program interface."));
+                return;
+            }
+        }
+
+        Vector<GLint> values;
+        for (GLsizei i = 0; i < propCount; ++i) {
+            if (!ProgramInterface::GetResourceProp(*programObject, programInterface, index, props[i], values)) {
                 MG_State::pGLContext->RecordError(
                     ErrorCode::InvalidValue,
                     MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "index is out of range."));
                 return;
             }
-            if (props == nullptr || params == nullptr) return;
-            GLsizei written = 0;
-            for (GLsizei i = 0; i < propCount && written < bufSize; ++i) {
-                GLint value = 0;
-                if (!GetUniformResourceProp(programObject, index, props[i], &value)) {
-                    // GL_ATOMIC_COUNTER_BUFFER_INDEX and the GL_REFERENCED_BY_* stage props are
-                    // not modelled here; ask the backend, which indexes resources by name.
-                    auto backendGetIndex = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceIndex;
-                    auto backendGetiv = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceiv;
-                    if (backendGetIndex && backendGetiv) {
-                        const GLuint backendIndex = backendGetIndex(program, GL_UNIFORM,
-                                                                   programObject->GetActiveUniformName(index).c_str());
-                        if (backendIndex != GL_INVALID_INDEX) {
-                            GLsizei one = 0;
-                            backendGetiv(program, GL_UNIFORM, backendIndex, 1, &props[i], 1, &one, &value);
-                        }
-                    }
-                }
-                params[written++] = value;
-            }
-            if (length) *length = written;
-            return;
         }
-        auto getProgramResourceiv = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceiv;
+        if (params == nullptr) return;
-        if (!getProgramResourceiv) {
+        const GLsizei written = static_cast<GLsizei>(std::min<SizeT>(values.size(), static_cast<SizeT>(bufSize)));
-            MG_State::pGLContext->RecordError(
+        for (GLsizei i = 0; i < written; ++i) params[i] = values[i];
-                ErrorCode::InvalidOperation,
+        if (length) *length = written;
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                             "Backend does not support program interface queries."));
-            return;
-        }
-        getProgramResourceiv(program, programInterface, index, propCount, props, bufSize, length, params);
     }
 
     GLint GetProgramResourceLocation(GLuint program, GLenum programInterface, const GLchar* name) {
+        // Unlike the four queries above, this one and GetProgramResourceLocationIndex really
+        // do require a successful link (GL 4.6 §7.3.1.3).
         auto& programObject = TryToGetLinkedProgramForInterfaceQuery(program, __func__);
         if (!programObject) return -1;
-        auto getProgramResourceLocation = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceLocation;
+        if (!ProgramInterface::InterfaceHasLocations(programInterface)) {
-        if (!getProgramResourceLocation) {
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidOperation,
+                ErrorCode::InvalidEnum,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                             "Backend does not support program interface queries."));
+                                             "Program interface has no locations."));
             return -1;
         }
-        return getProgramResourceLocation(program, programInterface, name);
+        return ProgramInterface::GetResourceLocation(*programObject, programInterface, name);
     }
 
     GLint GetProgramResourceLocationIndex(GLuint program, GLenum programInterface, const GLchar* name) {
         auto& programObject = TryToGetLinkedProgramForInterfaceQuery(program, __func__);
         if (!programObject) return -1;
-        auto getProgramResourceLocationIndex = MG_Backend::gBackendFunctionsTable.GL.GetProgramResourceLocationIndex;
+        if (programInterface != GL_PROGRAM_OUTPUT) {
-        if (!getProgramResourceLocationIndex) return -1;
+            MG_State::pGLContext->RecordError(
-        return getProgramResourceLocationIndex(program, programInterface, name);
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "GetProgramResourceLocationIndex only accepts GL_PROGRAM_OUTPUT."));
+            return -1;
+        }
+        return ProgramInterface::GetResourceLocationIndex(*programObject, programInterface, name);
     }
 
+    // GL 4.6 §7.6.2: <storageBlockIndex> is an active shader storage block index of <program>
+    // - that is, exactly what glGetProgramResourceIndex(GL_SHADER_STORAGE_BLOCK) returned.
+    // Since wave 2 that index is the interface-query layer's, so this is where the one index
+    // space the application sees gets turned into whatever the backend's is; the backends are
+    // handed the block NAME and do their own lookup. Getting this wrong is silent: the call
+    // succeeds and rebinds a DIFFERENT buffer.
     void ShaderStorageBlockBinding(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding) {
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject || !programObject->GetLinkStatus()) return;
         if (!ValidateShaderStorageBlockBinding(storageBlockBinding)) return;
+        String blockName;
+        if (!ProgramInterface::GetResourceName(*programObject, GL_SHADER_STORAGE_BLOCK, storageBlockIndex,
+                                               blockName)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "storageBlockIndex is not an active shader storage block index."));
+            return;
+        }
+        // Recorded before the backend call, and independently of whether a backend is even
+        // present: this is the state GL_BUFFER_BINDING reports, and it is also what reseeds a
+        // backend's own reflection cache after any rebuild.
+        programObject->SetShaderStorageBlockBinding(blockName, storageBlockBinding);
         auto shaderStorageBlockBinding = MG_Backend::gBackendFunctionsTable.GL.ShaderStorageBlockBinding;
         if (!shaderStorageBlockBinding) {
             MG_State::pGLContext->RecordError(
@@ -2822,7 +2767,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support shader storage block binding."));
             return;
         }
-        shaderStorageBlockBinding(program, storageBlockIndex, storageBlockBinding);
+        shaderStorageBlockBinding(program, blockName.c_str(), storageBlockBinding);
     }
 
     void ValidateProgram(GLuint program) {
@@ -2859,6 +2804,16 @@ namespace MobileGL::MG_Impl::GLImpl {
     // is written as that sequence rather than as a private shortcut - every error it can
     // raise is one of theirs, raised at the point they would raise it.
     GLuint CreateShaderProgramv(GLenum type, GLsizei count, const GLchar* const* strings) {
+        // GL 4.6 core 7.3: a negative count is INVALID_VALUE and is checked before anything
+        // is created, so a bad count never leaks a shader name. An unrecognised type is
+        // INVALID_ENUM, which CreateShader_State raises below.
+        if (count < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "count must be non-negative."));
+            return 0;
+        }
+
         const GLuint shader = CreateShader_State(type);
         if (shader == 0) return 0;
 

MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.cpp

@@ -0,0 +1,841 @@
+// MobileGL - MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "ProgramInterface.h"
+
+#include <MG_State/GLState/ProgramState/ProgramObject.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+
+#include <cstring>
+
+namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
+    namespace {
+        // glslang folds atomic counters into synthesized blocks named
+        // "<getAtomicCounterBlockName()>_<binding>" (ParseContextBase.cpp), one per GL
+        // atomic-counter binding point. That block IS the GL_ATOMIC_COUNTER_BUFFER resource
+        // and its trailing number IS GL_BUFFER_BINDING; its members stay GL_UNIFORMs.
+        constexpr const char* kAtomicCounterBlockPrefix = "gl_AtomicCounterBlock";
+
+        enum class BlockKind {
+            Uniform,       // a real GL uniform block
+            GlobalUbo,     // the synthesized MGL_GLOBAL_UBO: GL sees its members as default-block
+            AtomicCounter, // gl_AtomicCounterBlock_<binding>
+            Storage,       // a shader storage block
+        };
+
+        // One row of any interface. Fields a given interface does not have keep the
+        // spec-mandated "not applicable" value, so a prop read never has to special-case
+        // the interface a second time.
+        struct Resource {
+            String name;
+            GLenum type = GL_NONE;
+            GLint arraySize = 1;
+            GLint location = -1;
+            GLint locationIndex = -1;
+            GLint blockIndex = -1;
+            GLint offset = -1;
+            GLint arrayStride = -1;
+            GLint matrixStride = -1;
+            GLint isRowMajor = 0;
+            GLint atomicCounterBufferIndex = -1;
+            GLint topLevelArraySize = 0;
+            GLint topLevelArrayStride = 0;
+            GLint bufferBinding = 0;
+            GLint bufferDataSize = 0;
+            GLint isPerPatch = 0;
+            GLint xfbBufferIndex = 0;
+            Uint32 stages = 0; // EShLanguageMask
+            Vector<GLuint> activeVariables;
+        };
+
+        using ResourceList = Vector<Resource>;
+
+        struct Model {
+            ResourceList uniforms;
+            ResourceList uniformBlocks;
+            ResourceList atomicCounterBuffers;
+            ResourceList bufferVariables;
+            ResourceList storageBlocks;
+            ResourceList programInputs;
+            ResourceList programOutputs;
+            ResourceList xfbVaryings;
+            Bool valid = false;
+        };
+
+        const ResourceList& EmptyList() {
+            static const ResourceList empty;
+            return empty;
+        }
+
+        // ---- name spelling (cluster 6) -------------------------------------------------
+
+        Bool EndsWithZeroSubscript(const String& name) {
+            return name.length() >= 3 && name.compare(name.length() - 3, 3, "[0]") == 0;
+        }
+
+        // The enumerated spelling of an array resource is "name[0]". glslang already applies
+        // that to uniforms and buffer variables (EShReflectionBasicArraySuffix), but never to
+        // stage inputs/outputs, so those get it here.
+        String WithArraySuffix(const String& name, const glslang::TType* type) {
+            if (type == nullptr || !type->isArray() || EndsWithZeroSubscript(name)) return name;
+            return name + "[0]";
+        }
+
+        // GL_ARRAY_SIZE: element count for a sized array, 0 for a runtime-sized one
+        // (a shader storage block's unsized trailing member), 1 for a non-array.
+        GLint ArraySizeOf(const glslang::TType* type, GLint reflectedSize) {
+            if (type != nullptr && type->isArray()) {
+                if (!type->isSizedArray()) return 0;
+                return type->getOuterArraySize();
+            }
+            return reflectedSize < 1 ? 1 : reflectedSize;
+        }
+
+        // Two spellings name the same resource when they are equal, or differ only by the
+        // "[0]" the enumeration appends to an array.
+        Bool NamesMatch(const String& resourceName, const String& query) {
+            if (resourceName == query) return true;
+            if (EndsWithZeroSubscript(resourceName) &&
+                resourceName.compare(0, resourceName.length() - 3, query) == 0) {
+                return true;
+            }
+            return EndsWithZeroSubscript(query) && query.compare(0, query.length() - 3, resourceName) == 0;
+        }
+
+        // Splits "base[k]" into ("base", k). GL 4.6 §7.3.1.1 requires the subscript to be a
+        // decimal integer with no white space and no leading zeros, which is exactly what
+        // separates array-names' "a[1]" (resolves) from "a[01]", "a[0 + 0]" and "a[ 0]" (do
+        // not). Returns false when there is no trailing subscript at all; sets `malformed`
+        // when there is one but it is not a strict decimal.
+        Bool SplitTrailingSubscript(const String& name, String& outBase, Uint& outElement, Bool& outMalformed) {
+            outMalformed = false;
+            if (name.empty() || name.back() != ']') return false;
+            const SizeT bracket = name.rfind('[');
+            if (bracket == String::npos) return false;
+            const SizeT first = bracket + 1;
+            const SizeT last = name.length() - 1; // one past the digits
+            if (first >= last) {
+                outMalformed = true;
+                return false;
+            }
+            // No leading zeros: "0" is the only spelling that may start with '0'.
+            if (name[first] == '0' && last - first > 1) {
+                outMalformed = true;
+                return false;
+            }
+            Uint element = 0;
+            for (SizeT i = first; i < last; ++i) {
+                if (name[i] < '0' || name[i] > '9') {
+                    outMalformed = true;
+                    return false;
+                }
+                element = element * 10 + static_cast<Uint>(name[i] - '0');
+                if (element > 0x0FFFFFFFu) {
+                    outMalformed = true;
+                    return false;
+                }
+            }
+            outBase = name.substr(0, bracket);
+            outElement = element;
+            return true;
+        }
+
+        // ---- block classification ------------------------------------------------------
+
+        Bool IsAtomicCounterBlockName(const String& name) {
+            return name.compare(0, std::strlen(kAtomicCounterBlockPrefix), kAtomicCounterBlockPrefix) == 0;
+        }
+
+        // "gl_AtomicCounterBlock_5" -> 5. The suffix is the GL binding the counters were
+        // declared with, which glslang does NOT keep in the block's own layout qualifier
+        // (that one is remapped to a plain buffer binding).
+        GLint AtomicCounterBlockBinding(const String& name) {
+            const SizeT underscore = name.rfind('_');
+            if (underscore == String::npos || underscore + 1 >= name.length()) return 0;
+            GLint binding = 0;
+            for (SizeT i = underscore + 1; i < name.length(); ++i) {
+                if (name[i] < '0' || name[i] > '9') return 0;
+                binding = binding * 10 + (name[i] - '0');
+            }
+            return binding;
+        }
+
+        // Element index of an arrayed block instance ("TrickyBuffer[1]" -> 1).
+        GLint BlockArrayElement(const String& name) {
+            String base;
+            Uint element = 0;
+            Bool malformed = false;
+            if (!SplitTrailingSubscript(name, base, element, malformed)) return 0;
+            return static_cast<GLint>(element);
+        }
+
+        BlockKind ClassifyBlock(const glslang::TObjectReflection& block) {
+            if (std::strstr(block.name.c_str(), MG_Util::ShaderTranspiler::GLOBAL_UBO_NAME) != nullptr) {
+                return BlockKind::GlobalUbo;
+            }
+            if (IsAtomicCounterBlockName(block.name)) return BlockKind::AtomicCounter;
+            const glslang::TType* type = block.getType();
+            if (type != nullptr && type->getQualifier().storage == glslang::EvqBuffer) return BlockKind::Storage;
+            return BlockKind::Uniform;
+        }
+
+        // std140/std430 column stride, the same vec4-rounded rule ProgramObject applies to
+        // uniform matrices. 0 for a non-matrix.
+        GLint MatrixStrideOf(const glslang::TType* type) {
+            if (type == nullptr || !type->isMatrix()) return 0;
+            const bool rowMajor = type->getQualifier().layoutMatrix == glslang::ElmRowMajor;
+            const int strideVectorComponents = rowMajor ? type->getMatrixCols() : type->getMatrixRows();
+            constexpr int scalarSize = 4;
+            const int vectorAlignment = (strideVectorComponents <= 1)    ? scalarSize
+                                        : (strideVectorComponents == 2) ? 2 * scalarSize
+                                                                        : 4 * scalarSize;
+            return (vectorAlignment + 15) & ~15;
+        }
+
+        GLint IsRowMajorOf(const glslang::TType* type) {
+            if (type == nullptr || !type->isMatrix()) return 0;
+            return type->getQualifier().layoutMatrix == glslang::ElmRowMajor ? 1 : 0;
+        }
+
+        GLint MappedLocation(Int rawLocation) {
+            // glslang parks "no location" at layoutLocationEnd; GL spells it -1.
+            if (rawLocation < 0 || rawLocation >= static_cast<Int>(glslang::TQualifier::layoutLocationEnd)) return -1;
+            return rawLocation;
+        }
+
+        // ---- model construction --------------------------------------------------------
+
+        void BuildBlocks(ProgramObject& program, const glslang::TProgram& reflection, Model& model,
+                         Vector<BlockKind>& blockKind, Vector<Int>& blockInterfaceIndex) {
+            const Int blockCount = const_cast<glslang::TProgram&>(reflection).getNumUniformBlocks();
+            blockKind.assign(blockCount, BlockKind::Uniform);
+            blockInterfaceIndex.assign(blockCount, -1);
+
+            for (Int tIndex = 0; tIndex < blockCount; ++tIndex) {
+                const auto& block = const_cast<glslang::TProgram&>(reflection).getUniformBlock(tIndex);
+                const BlockKind kind = ClassifyBlock(block);
+                blockKind[tIndex] = kind;
+                if (kind == BlockKind::AtomicCounter) {
+                    Resource resource;
+                    // GL_ATOMIC_COUNTER_BUFFER resources have no name (and GetProgramResource
+                    // Index/Name reject the interface outright, which is why this stays empty).
+                    resource.bufferBinding = AtomicCounterBlockBinding(block.name);
+                    resource.bufferDataSize = block.size;
+                    resource.stages = static_cast<Uint32>(block.stages);
+                    blockInterfaceIndex[tIndex] = static_cast<Int>(model.atomicCounterBuffers.size());
+                    model.atomicCounterBuffers.push_back(Move(resource));
+                } else if (kind == BlockKind::Storage) {
+                    Resource resource;
+                    resource.name = block.name;
+                    // glslang reports the DECLARED binding for every instance of an arrayed
+                    // block; GL gives element k the binding base + k. That is only the initial
+                    // value: GL_BUFFER_BINDING must report the CURRENT binding, so a later
+                    // glShaderStorageBlockBinding wins over the declaration (GL 4.6 §7.6.2 -
+                    // exactly the same rule GL_UNIFORM_BLOCK follows through
+                    // GetUniformBlockBinding below).
+                    const GLint declared = block.getBinding();
+                    resource.bufferBinding = declared < 0 ? 0 : declared + BlockArrayElement(block.name);
+                    const Int rebound = program.GetShaderStorageBlockBindingOverride(block.name);
+                    if (rebound >= 0) resource.bufferBinding = static_cast<GLint>(rebound);
+                    resource.bufferDataSize = block.size;
+                    resource.stages = static_cast<Uint32>(block.stages);
+                    blockInterfaceIndex[tIndex] = static_cast<Int>(model.storageBlocks.size());
+                    model.storageBlocks.push_back(Move(resource));
+                }
+            }
+
+            // GL_UNIFORM_BLOCK keeps the index space glUniformBlockBinding and
+            // glGetActiveUniformBlockiv already use, so an index handed out here is usable
+            // with them (which is exactly what the CTS does).
+            const Int glBlockCount = program.GetActiveUniformBlocksCount();
+            for (Int glIndex = 0; glIndex < glBlockCount; ++glIndex) {
+                Resource resource;
+                resource.name = program.GetUniformBlockName(glIndex);
+                resource.bufferBinding = static_cast<GLint>(program.GetUniformBlockBinding(glIndex));
+                resource.bufferDataSize = static_cast<GLint>(program.GetUBOSizeAt(glIndex));
+                const Int tIndex = program.TProgramBlockIndex(static_cast<Uint>(glIndex));
+                if (tIndex >= 0 && tIndex < blockCount) {
+                    resource.stages =
+                        static_cast<Uint32>(const_cast<glslang::TProgram&>(reflection).getUniformBlock(tIndex).stages);
+                }
+                model.uniformBlocks.push_back(Move(resource));
+            }
+        }
+
+        void BuildUniformsAndBufferVariables(ProgramObject& program, const glslang::TProgram& reflection, Model& model,
+                                             const Vector<BlockKind>& blockKind,
+                                             const Vector<Int>& blockInterfaceIndex) {
+            const Uint uniformCount = program.GetUniformCount();
+            for (Uint glIndex = 0; glIndex < uniformCount; ++glIndex) {
+                const Int tIndex = program.TProgramUniformIndex(glIndex);
+                const auto& refl = const_cast<glslang::TProgram&>(reflection).getUniform(tIndex);
+                const glslang::TType* type = refl.getType();
+                const Int owner = refl.index;
+                const BlockKind kind = (owner >= 0 && owner < static_cast<Int>(blockKind.size()))
+                                           ? blockKind[owner]
+                                           : BlockKind::GlobalUbo;
+
+                Resource resource;
+                resource.name = refl.name;
+                resource.type = static_cast<GLenum>(refl.glDefineType);
+                resource.arraySize = ArraySizeOf(type, refl.size);
+                resource.stages = static_cast<Uint32>(refl.stages);
+
+                if (kind == BlockKind::Storage) {
+                    resource.blockIndex = blockInterfaceIndex[owner];
+                    resource.offset = refl.offset;
+                    resource.arrayStride = refl.arrayStride;
+                    resource.matrixStride = MatrixStrideOf(type);
+                    resource.isRowMajor = IsRowMajorOf(type);
+                    // GL requires 1 for a member that is not inside a top-level array (and for
+                    // the top-level array itself); glslang leaves 0/-1 there.
+                    resource.topLevelArraySize = refl.topLevelArraySize > 0 ? refl.topLevelArraySize : 1;
+                    resource.topLevelArrayStride = refl.topLevelArrayStride;
+                    model.bufferVariables.push_back(Move(resource));
+                    continue;
+                }
+
+                if (kind == BlockKind::AtomicCounter) {
+                    // An atomic counter is a default-block uniform with no location and no
+                    // owning uniform block; what it does have is a buffer to point at.
+                    resource.type = GL_UNSIGNED_INT_ATOMIC_COUNTER;
+                    resource.blockIndex = -1;
+                    resource.offset = refl.offset;
+                    resource.arrayStride = refl.arrayStride;
+                    resource.matrixStride = 0;
+                    resource.atomicCounterBufferIndex = blockInterfaceIndex[owner];
+                    resource.location = -1;
+                } else {
+                    resource.blockIndex = program.GetActiveUniformBlockIndex(glIndex);
+                    resource.offset = program.GetActiveUniformOffset(glIndex);
+                    resource.arrayStride = program.GetActiveUniformArrayStride(glIndex);
+                    resource.matrixStride = program.GetActiveUniformMatrixStride(glIndex);
+                    resource.isRowMajor = program.GetActiveUniformIsRowMajor(glIndex);
+                    // A member of a named uniform block has no location, whatever the
+                    // frontend's own location table says (it hands one out to every uniform
+                    // so glUniform* can address block members through the global UBO).
+                    resource.location =
+                        resource.blockIndex >= 0 ? -1 : program.GetUniformLocation(refl.name);
+                }
+                model.uniforms.push_back(Move(resource));
+            }
+
+            // GL_ACTIVE_VARIABLES, both directions.
+            for (SizeT i = 0; i < model.uniforms.size(); ++i) {
+                const Resource& uniform = model.uniforms[i];
+                if (uniform.atomicCounterBufferIndex >= 0 &&
+                    uniform.atomicCounterBufferIndex < static_cast<GLint>(model.atomicCounterBuffers.size())) {
+                    model.atomicCounterBuffers[uniform.atomicCounterBufferIndex].activeVariables.push_back(
+                        static_cast<GLuint>(i));
+                }
+            }
+            for (SizeT blockIndex = 0; blockIndex < model.uniformBlocks.size(); ++blockIndex) {
+                // Members of an arrayed block are reflected once, against instance [0].
+                const Int owner = static_cast<Int>(program.GetUniformBlockMemberOwnerIndex(static_cast<Uint>(blockIndex)));
+                for (SizeT i = 0; i < model.uniforms.size(); ++i) {
+                    if (model.uniforms[i].blockIndex == owner) {
+                        model.uniformBlocks[blockIndex].activeVariables.push_back(static_cast<GLuint>(i));
+                    }
+                }
+            }
+            for (SizeT blockIndex = 0; blockIndex < model.storageBlocks.size(); ++blockIndex) {
+                for (SizeT i = 0; i < model.bufferVariables.size(); ++i) {
+                    if (model.bufferVariables[i].blockIndex == static_cast<GLint>(blockIndex)) {
+                        model.storageBlocks[blockIndex].activeVariables.push_back(static_cast<GLuint>(i));
+                    }
+                }
+            }
+        }
+
+        void BuildStageIO(ProgramObject& program, const glslang::TProgram& reflection, Model& model) {
+            auto& mutableReflection = const_cast<glslang::TProgram&>(reflection);
+
+            const Int inputCount = mutableReflection.getNumPipeInputs();
+            for (Int index = 0; index < inputCount; ++index) {
+                const auto& refl = mutableReflection.getPipeInput(index);
+                const glslang::TType* type = refl.getType();
+                Resource resource;
+                // The Vulkan-semantics parse reflects the vertex builtins under their SPIR-V
+                // names; GL enumerates the GL spellings.
+                const String& glName = ProgramObject::NormalizeBuiltinPipeInputName(refl.name);
+                resource.name = WithArraySuffix(glName, type);
+                resource.type = static_cast<GLenum>(refl.glDefineType);
+                resource.arraySize = ArraySizeOf(type, refl.size);
+                resource.location = program.GetAttributeLocation(refl.name);
+                if (resource.location < 0) resource.location = MappedLocation(static_cast<Int>(refl.layoutLocation()));
+                resource.isPerPatch = (type != nullptr && type->getQualifier().patch) ? 1 : 0;
+                resource.stages = static_cast<Uint32>(refl.stages);
+                model.programInputs.push_back(Move(resource));
+            }
+
+            const Int outputCount = mutableReflection.getNumPipeOutputs();
+            for (Int index = 0; index < outputCount; ++index) {
+                const auto& refl = mutableReflection.getPipeOutput(index);
+                const glslang::TType* type = refl.getType();
+                Resource resource;
+                resource.name = WithArraySuffix(refl.name, type);
+                resource.type = static_cast<GLenum>(refl.glDefineType);
+                resource.arraySize = ArraySizeOf(type, refl.size);
+                resource.location = MappedLocation(program.GetFragmentDataLocation(refl.name.c_str()));
+                if (resource.location < 0) {
+                    // A built-in output (gl_FragDepth, gl_SampleMask) and a non-fragment stage
+                    // output both have no location, and therefore no color index either.
+                    resource.locationIndex = -1;
+                } else {
+                    resource.locationIndex = program.GetFragmentDataIndex(refl.name.c_str());
+                    // glBindFragDataLocationIndexed wins; otherwise the shader's
+                    // layout(index = N), which the frag-data maps never saw.
+                    if (resource.locationIndex == 0 && type != nullptr && type->getQualifier().hasIndex()) {
+                        resource.locationIndex = static_cast<GLint>(type->getQualifier().layoutIndex);
+                    }
+                }
+                resource.isPerPatch = (type != nullptr && type->getQualifier().patch) ? 1 : 0;
+                resource.stages = static_cast<Uint32>(refl.stages);
+                model.programOutputs.push_back(Move(resource));
+            }
+        }
+
+        void BuildXfb(ProgramObject& program, Model& model) {
+            const auto& requested = program.GetTransformFeedbackInterfaceNames();
+            const auto& captured = program.GetTransformFeedbackVaryings();
+            for (const String& name : requested) {
+                Resource resource;
+                resource.name = name;
+                // ARB_transform_feedback3's layout controls are enumerated as resources of
+                // type NONE: gl_NextBuffer with array size 0, gl_SkipComponentsN with N.
+                if (name == "gl_NextBuffer") {
+                    resource.type = GL_NONE;
+                    resource.arraySize = 0;
+                } else if (name.size() == 18 && name.compare(0, 17, "gl_SkipComponents") == 0 && name[17] >= '1' &&
+                           name[17] <= '4') {
+                    resource.type = GL_NONE;
+                    resource.arraySize = name[17] - '0';
+                } else {
+                    resource.type = GL_NONE;
+                    resource.arraySize = 1;
+                    for (const auto& varying : captured) {
+                        if (varying.name != name) continue;
+                        resource.type = varying.type;
+                        resource.arraySize = varying.size < 1 ? 1 : varying.size;
+                        resource.offset = static_cast<GLint>(varying.offsetBytes);
+                        resource.xfbBufferIndex = static_cast<GLint>(varying.bufferIndex);
+                        break;
+                    }
+                }
+                model.xfbVaryings.push_back(Move(resource));
+            }
+        }
+
+        Model BuildModel(ProgramObject& program) {
+            Model model;
+            if (!program.GetLinkStatus()) return model;
+            const glslang::TProgram* reflection = program.GetReflection();
+            if (reflection == nullptr) return model;
+            model.valid = true;
+
+            Vector<BlockKind> blockKind;
+            Vector<Int> blockInterfaceIndex;
+            BuildBlocks(program, *reflection, model, blockKind, blockInterfaceIndex);
+            BuildUniformsAndBufferVariables(program, *reflection, model, blockKind, blockInterfaceIndex);
+            BuildStageIO(program, *reflection, model);
+            BuildXfb(program, model);
+            return model;
+        }
+
+        const ResourceList& Select(const Model& model, GLenum programInterface) {
+            switch (programInterface) {
+            case GL_UNIFORM:
+                return model.uniforms;
+            case GL_UNIFORM_BLOCK:
+                return model.uniformBlocks;
+            case GL_ATOMIC_COUNTER_BUFFER:
+                return model.atomicCounterBuffers;
+            case GL_BUFFER_VARIABLE:
+                return model.bufferVariables;
+            case GL_SHADER_STORAGE_BLOCK:
+                return model.storageBlocks;
+            case GL_PROGRAM_INPUT:
+                return model.programInputs;
+            case GL_PROGRAM_OUTPUT:
+                return model.programOutputs;
+            case GL_TRANSFORM_FEEDBACK_VARYING:
+                return model.xfbVaryings;
+            default:
+                // The subroutine interfaces are accepted by the API but nothing can populate
+                // them: glslang refuses `subroutine` when generating SPIR-V, so a program
+                // using one never links. Zero active resources is the honest answer.
+                return EmptyList();
+            }
+        }
+    } // namespace
+
+    Bool IsInterfaceEnum(GLenum programInterface) {
+        switch (programInterface) {
+        case GL_UNIFORM:
+        case GL_UNIFORM_BLOCK:
+        case GL_PROGRAM_INPUT:
+        case GL_PROGRAM_OUTPUT:
+        case GL_BUFFER_VARIABLE:
+        case GL_SHADER_STORAGE_BLOCK:
+        case GL_ATOMIC_COUNTER_BUFFER:
+        case GL_TRANSFORM_FEEDBACK_VARYING:
+        case GL_TRANSFORM_FEEDBACK_BUFFER:
+        case GL_VERTEX_SUBROUTINE:
+        case GL_TESS_CONTROL_SUBROUTINE:
+        case GL_TESS_EVALUATION_SUBROUTINE:
+        case GL_GEOMETRY_SUBROUTINE:
+        case GL_FRAGMENT_SUBROUTINE:
+        case GL_COMPUTE_SUBROUTINE:
+        case GL_VERTEX_SUBROUTINE_UNIFORM:
+        case GL_TESS_CONTROL_SUBROUTINE_UNIFORM:
+        case GL_TESS_EVALUATION_SUBROUTINE_UNIFORM:
+        case GL_GEOMETRY_SUBROUTINE_UNIFORM:
+        case GL_FRAGMENT_SUBROUTINE_UNIFORM:
+        case GL_COMPUTE_SUBROUTINE_UNIFORM:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    Bool IsNamedInterface(GLenum programInterface) {
+        // GL 4.6 §7.3.1.2: the two buffer interfaces have no resource names, and asking for
+        // one is INVALID_ENUM (deliberately asymmetric with GetProgramInterfaceiv, which
+        // does count them).
+        return IsInterfaceEnum(programInterface) && programInterface != GL_ATOMIC_COUNTER_BUFFER &&
+               programInterface != GL_TRANSFORM_FEEDBACK_BUFFER;
+    }
+
+    Bool InterfaceHasLocations(GLenum programInterface) {
+        switch (programInterface) {
+        case GL_UNIFORM:
+        case GL_PROGRAM_INPUT:
+        case GL_PROGRAM_OUTPUT:
+        case GL_VERTEX_SUBROUTINE_UNIFORM:
+        case GL_TESS_CONTROL_SUBROUTINE_UNIFORM:
+        case GL_TESS_EVALUATION_SUBROUTINE_UNIFORM:
+        case GL_GEOMETRY_SUBROUTINE_UNIFORM:
+        case GL_FRAGMENT_SUBROUTINE_UNIFORM:
+        case GL_COMPUTE_SUBROUTINE_UNIFORM:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    Bool IsResourceProp(GLenum prop) {
+        switch (prop) {
+        case GL_NAME_LENGTH:
+        case GL_TYPE:
+        case GL_ARRAY_SIZE:
+        case GL_OFFSET:
+        case GL_BLOCK_INDEX:
+        case GL_ARRAY_STRIDE:
+        case GL_MATRIX_STRIDE:
+        case GL_IS_ROW_MAJOR:
+        case GL_ATOMIC_COUNTER_BUFFER_INDEX:
+        case GL_BUFFER_BINDING:
+        case GL_BUFFER_DATA_SIZE:
+        case GL_NUM_ACTIVE_VARIABLES:
+        case GL_ACTIVE_VARIABLES:
+        case GL_REFERENCED_BY_VERTEX_SHADER:
+        case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
+        case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
+        case GL_REFERENCED_BY_GEOMETRY_SHADER:
+        case GL_REFERENCED_BY_FRAGMENT_SHADER:
+        case GL_REFERENCED_BY_COMPUTE_SHADER:
+        case GL_TOP_LEVEL_ARRAY_SIZE:
+        case GL_TOP_LEVEL_ARRAY_STRIDE:
+        case GL_LOCATION:
+        case GL_LOCATION_INDEX:
+        case GL_IS_PER_PATCH:
+        case GL_LOCATION_COMPONENT:
+        case GL_TRANSFORM_FEEDBACK_BUFFER_INDEX:
+        case GL_TRANSFORM_FEEDBACK_BUFFER_STRIDE:
+        case GL_NUM_COMPATIBLE_SUBROUTINES:
+        case GL_COMPATIBLE_SUBROUTINES:
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    // GL 4.6 Table 7.2, transcribed row by row: which interfaces each property applies to.
+    // Too tight a table turns a currently-answered prop into a fresh INVALID_OPERATION, so
+    // the rows below are deliberately no narrower than the spec's.
+    Bool InterfaceSupportsProp(GLenum programInterface, GLenum prop) {
+        const Bool isSubroutine =
+            programInterface == GL_VERTEX_SUBROUTINE || programInterface == GL_TESS_CONTROL_SUBROUTINE ||
+            programInterface == GL_TESS_EVALUATION_SUBROUTINE || programInterface == GL_GEOMETRY_SUBROUTINE ||
+            programInterface == GL_FRAGMENT_SUBROUTINE || programInterface == GL_COMPUTE_SUBROUTINE;
+        const Bool isSubroutineUniform =
+            programInterface == GL_VERTEX_SUBROUTINE_UNIFORM ||
+            programInterface == GL_TESS_CONTROL_SUBROUTINE_UNIFORM ||
+            programInterface == GL_TESS_EVALUATION_SUBROUTINE_UNIFORM ||
+            programInterface == GL_GEOMETRY_SUBROUTINE_UNIFORM ||
+            programInterface == GL_FRAGMENT_SUBROUTINE_UNIFORM || programInterface == GL_COMPUTE_SUBROUTINE_UNIFORM;
+
+        switch (prop) {
+        case GL_NAME_LENGTH:
+            return programInterface != GL_ATOMIC_COUNTER_BUFFER && programInterface != GL_TRANSFORM_FEEDBACK_BUFFER;
+        case GL_TYPE:
+        case GL_ARRAY_SIZE:
+            return programInterface == GL_UNIFORM || programInterface == GL_PROGRAM_INPUT ||
+                   programInterface == GL_PROGRAM_OUTPUT || programInterface == GL_BUFFER_VARIABLE ||
+                   programInterface == GL_TRANSFORM_FEEDBACK_VARYING ||
+                   (prop == GL_ARRAY_SIZE && isSubroutineUniform);
+        case GL_OFFSET:
+            return programInterface == GL_UNIFORM || programInterface == GL_BUFFER_VARIABLE ||
+                   programInterface == GL_TRANSFORM_FEEDBACK_VARYING;
+        case GL_BLOCK_INDEX:
+        case GL_ARRAY_STRIDE:
+        case GL_MATRIX_STRIDE:
+        case GL_IS_ROW_MAJOR:
+            return programInterface == GL_UNIFORM || programInterface == GL_BUFFER_VARIABLE;
+        case GL_ATOMIC_COUNTER_BUFFER_INDEX:
+            return programInterface == GL_UNIFORM;
+        case GL_BUFFER_BINDING:
+        case GL_NUM_ACTIVE_VARIABLES:
+        case GL_ACTIVE_VARIABLES:
+            // Table 7.2 lists GL_TRANSFORM_FEEDBACK_BUFFER on these three rows too. This
+            // implementation enumerates no resources on that interface, so the query still
+            // ends in an error - but INVALID_VALUE for the out-of-range index, not the
+            // INVALID_OPERATION a narrower table would invent.
+            return programInterface == GL_UNIFORM_BLOCK || programInterface == GL_ATOMIC_COUNTER_BUFFER ||
+                   programInterface == GL_SHADER_STORAGE_BLOCK ||
+                   programInterface == GL_TRANSFORM_FEEDBACK_BUFFER;
+        case GL_BUFFER_DATA_SIZE:
+            return programInterface == GL_UNIFORM_BLOCK || programInterface == GL_ATOMIC_COUNTER_BUFFER ||
+                   programInterface == GL_SHADER_STORAGE_BLOCK;
+        case GL_REFERENCED_BY_VERTEX_SHADER:
+        case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
+        case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
+        case GL_REFERENCED_BY_GEOMETRY_SHADER:
+        case GL_REFERENCED_BY_FRAGMENT_SHADER:
+        case GL_REFERENCED_BY_COMPUTE_SHADER:
+            return programInterface == GL_UNIFORM || programInterface == GL_UNIFORM_BLOCK ||
+                   programInterface == GL_ATOMIC_COUNTER_BUFFER || programInterface == GL_BUFFER_VARIABLE ||
+                   programInterface == GL_SHADER_STORAGE_BLOCK || programInterface == GL_PROGRAM_INPUT ||
+                   programInterface == GL_PROGRAM_OUTPUT || isSubroutineUniform;
+        case GL_TOP_LEVEL_ARRAY_SIZE:
+        case GL_TOP_LEVEL_ARRAY_STRIDE:
+            return programInterface == GL_BUFFER_VARIABLE;
+        case GL_LOCATION:
+            return InterfaceHasLocations(programInterface);
+        case GL_LOCATION_INDEX:
+            return programInterface == GL_PROGRAM_OUTPUT;
+        case GL_IS_PER_PATCH:
+        case GL_LOCATION_COMPONENT:
+            return programInterface == GL_PROGRAM_INPUT || programInterface == GL_PROGRAM_OUTPUT;
+        case GL_TRANSFORM_FEEDBACK_BUFFER_INDEX:
+            return programInterface == GL_TRANSFORM_FEEDBACK_VARYING;
+        case GL_TRANSFORM_FEEDBACK_BUFFER_STRIDE:
+            return programInterface == GL_TRANSFORM_FEEDBACK_BUFFER;
+        case GL_NUM_COMPATIBLE_SUBROUTINES:
+        case GL_COMPATIBLE_SUBROUTINES:
+            return isSubroutineUniform;
+        default:
+            (void)isSubroutine;
+            return false;
+        }
+    }
+
+    Int GetActiveResourceCount(ProgramObject& program, GLenum programInterface) {
+        const Model model = BuildModel(program);
+        return static_cast<Int>(Select(model, programInterface).size());
+    }
+
+    Int GetMaxNameLength(ProgramObject& program, GLenum programInterface) {
+        if (!IsNamedInterface(programInterface)) return 0;
+        const Model model = BuildModel(program);
+        SizeT longest = 0;
+        for (const Resource& resource : Select(model, programInterface)) {
+            longest = std::max(longest, resource.name.length() + 1);
+        }
+        return static_cast<Int>(longest);
+    }
+
+    Int GetMaxNumActiveVariables(ProgramObject& program, GLenum programInterface) {
+        const Model model = BuildModel(program);
+        SizeT longest = 0;
+        for (const Resource& resource : Select(model, programInterface)) {
+            longest = std::max(longest, resource.activeVariables.size());
+        }
+        return static_cast<Int>(longest);
+    }
+
+    GLuint GetResourceIndex(ProgramObject& program, GLenum programInterface, const char* name) {
+        if (name == nullptr || name[0] == '\0') return GL_INVALID_INDEX;
+        const Model model = BuildModel(program);
+        const ResourceList& resources = Select(model, programInterface);
+        const String query = name;
+        // The layout controls of an interleaved capture are enumerable but not addressable
+        // by name (GL 4.6 §7.3.1.1).
+        if (programInterface == GL_TRANSFORM_FEEDBACK_VARYING &&
+            (query == "gl_NextBuffer" ||
+             (query.size() == 18 && query.compare(0, 17, "gl_SkipComponents") == 0))) {
+            return GL_INVALID_INDEX;
+        }
+        for (SizeT i = 0; i < resources.size(); ++i) {
+            if (NamesMatch(resources[i].name, query)) return static_cast<GLuint>(i);
+        }
+        return GL_INVALID_INDEX;
+    }
+
+    Bool GetResourceName(ProgramObject& program, GLenum programInterface, GLuint index, String& outName) {
+        const Model model = BuildModel(program);
+        const ResourceList& resources = Select(model, programInterface);
+        if (index >= resources.size()) return false;
+        outName = resources[index].name;
+        return true;
+    }
+
+    Bool GetResourceProp(ProgramObject& program, GLenum programInterface, GLuint index, GLenum prop,
+                         Vector<GLint>& outValues) {
+        const Model model = BuildModel(program);
+        const ResourceList& resources = Select(model, programInterface);
+        if (index >= resources.size()) return false;
+        const Resource& resource = resources[index];
+
+        const auto referencedBy = [&resource](EShLanguage stage) {
+            return (resource.stages & static_cast<Uint32>(1u << stage)) != 0 ? GL_TRUE : GL_FALSE;
+        };
+
+        switch (prop) {
+        case GL_NAME_LENGTH:
+            outValues.push_back(static_cast<GLint>(resource.name.length() + 1));
+            break;
+        case GL_TYPE:
+            outValues.push_back(static_cast<GLint>(resource.type));
+            break;
+        case GL_ARRAY_SIZE:
+            outValues.push_back(resource.arraySize);
+            break;
+        case GL_OFFSET:
+            outValues.push_back(resource.offset);
+            break;
+        case GL_BLOCK_INDEX:
+            outValues.push_back(resource.blockIndex);
+            break;
+        case GL_ARRAY_STRIDE:
+            outValues.push_back(resource.arrayStride);
+            break;
+        case GL_MATRIX_STRIDE:
+            outValues.push_back(resource.matrixStride);
+            break;
+        case GL_IS_ROW_MAJOR:
+            outValues.push_back(resource.isRowMajor);
+            break;
+        case GL_ATOMIC_COUNTER_BUFFER_INDEX:
+            outValues.push_back(resource.atomicCounterBufferIndex);
+            break;
+        case GL_BUFFER_BINDING:
+            outValues.push_back(resource.bufferBinding);
+            break;
+        case GL_BUFFER_DATA_SIZE:
+            outValues.push_back(resource.bufferDataSize);
+            break;
+        case GL_NUM_ACTIVE_VARIABLES:
+            outValues.push_back(static_cast<GLint>(resource.activeVariables.size()));
+            break;
+        case GL_ACTIVE_VARIABLES:
+            for (const GLuint variable : resource.activeVariables) outValues.push_back(static_cast<GLint>(variable));
+            break;
+        case GL_REFERENCED_BY_VERTEX_SHADER:
+            outValues.push_back(referencedBy(EShLangVertex));
+            break;
+        case GL_REFERENCED_BY_TESS_CONTROL_SHADER:
+            outValues.push_back(referencedBy(EShLangTessControl));
+            break;
+        case GL_REFERENCED_BY_TESS_EVALUATION_SHADER:
+            outValues.push_back(referencedBy(EShLangTessEvaluation));
+            break;
+        case GL_REFERENCED_BY_GEOMETRY_SHADER:
+            outValues.push_back(referencedBy(EShLangGeometry));
+            break;
+        case GL_REFERENCED_BY_FRAGMENT_SHADER:
+            outValues.push_back(referencedBy(EShLangFragment));
+            break;
+        case GL_REFERENCED_BY_COMPUTE_SHADER:
+            outValues.push_back(referencedBy(EShLangCompute));
+            break;
+        case GL_TOP_LEVEL_ARRAY_SIZE:
+            outValues.push_back(resource.topLevelArraySize);
+            break;
+        case GL_TOP_LEVEL_ARRAY_STRIDE:
+            outValues.push_back(resource.topLevelArrayStride);
+            break;
+        case GL_LOCATION:
+            outValues.push_back(resource.location);
+            break;
+        case GL_LOCATION_INDEX:
+            outValues.push_back(resource.locationIndex);
+            break;
+        case GL_IS_PER_PATCH:
+            outValues.push_back(resource.isPerPatch);
+            break;
+        case GL_LOCATION_COMPONENT:
+            outValues.push_back(0);
+            break;
+        case GL_TRANSFORM_FEEDBACK_BUFFER_INDEX:
+            outValues.push_back(resource.xfbBufferIndex);
+            break;
+        default:
+            outValues.push_back(0);
+            break;
+        }
+        return true;
+    }
+
+    GLint GetResourceLocation(ProgramObject& program, GLenum programInterface, const char* name) {
+        if (name == nullptr || name[0] == '\0') return -1;
+        const String query = name;
+
+        String base;
+        Uint element = 0;
+        Bool malformed = false;
+        const Bool subscripted = SplitTrailingSubscript(query, base, element, malformed);
+        if (malformed) return -1;
+
+        const Model model = BuildModel(program);
+        const ResourceList& resources = Select(model, programInterface);
+        for (const Resource& resource : resources) {
+            if (NamesMatch(resource.name, query)) return resource.location;
+        }
+        if (!subscripted || element == 0) return -1;
+        // "d[1]" addresses the second element of an array resource enumerated as "d[0]".
+        for (const Resource& resource : resources) {
+            if (!NamesMatch(resource.name, base)) continue;
+            if (resource.location < 0 || static_cast<GLint>(element) >= resource.arraySize) return -1;
+            return resource.location + static_cast<GLint>(element);
+        }
+        return -1;
+    }
+
+    GLint GetResourceLocationIndex(ProgramObject& program, GLenum programInterface, const char* name) {
+        if (programInterface != GL_PROGRAM_OUTPUT || name == nullptr || name[0] == '\0') return -1;
+        const String query = name;
+        String base;
+        Uint element = 0;
+        Bool malformed = false;
+        const Bool subscripted = SplitTrailingSubscript(query, base, element, malformed);
+        if (malformed) return -1;
+
+        const Model model = BuildModel(program);
+        for (const Resource& resource : model.programOutputs) {
+            if (NamesMatch(resource.name, query)) return resource.locationIndex;
+        }
+        if (!subscripted) return -1;
+        for (const Resource& resource : model.programOutputs) {
+            if (!NamesMatch(resource.name, base)) continue;
+            if (resource.location < 0 || static_cast<GLint>(element) >= resource.arraySize) return -1;
+            return resource.locationIndex;
+        }
+        return -1;
+    }
+} // namespace MobileGL::MG_Impl::GLImpl::ProgramInterface

MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.h

@@ -0,0 +1,66 @@
+// MobileGL - MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+namespace MobileGL::MG_State::GLState {
+    class ProgramObject;
+}
+
+// The GL program interface (ARB_program_interface_query / GL 4.3 §7.3.1) as a frontend
+// resource model.
+//
+// WHY IT IS HERE AND NOT IN A BACKEND. glGetProgramResource* describes the program the
+// APPLICATION wrote, in the application's namespace. Neither backend program is in that
+// namespace: DirectGLES compiles SPIRV-Cross-generated ESSL where default-block uniforms
+// live inside the synthesized MGL_GLOBAL_UBO (so a GL_UNIFORM location query against it is
+// structurally -1) and stage in/out names are rewritten; DirectVulkan has no GL-level
+// reflection at all and can only re-derive a partial, diverging copy. The one authoritative
+// source is the frontend glslang reflection a link already produced, which is the same
+// place glGetActiveUniform answers from. This layer generalizes that rule to every
+// interface, so the six entry points never consult gBackendFunctionsTable.
+//
+// NAMING RULES LIVE HERE, NOT IN ProgramObject. The interface query spells resources
+// differently from glGetActiveUniform / glGetActiveAttrib (an array is "name[0]", a lookup
+// accepts both "name" and "name[0]", a subscript must be a strict decimal). Those two
+// getters are what GL30-33 exercises and they must not move, so every normalization is
+// applied on the way in and out of THIS file.
+namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
+    using ProgramObject = MG_State::GLState::ProgramObject;
+
+    // <programInterface> is one of the GL 4.6 Table 7.1 interfaces.
+    Bool IsInterfaceEnum(GLenum programInterface);
+    // Interfaces whose resources have names (everything except GL_ATOMIC_COUNTER_BUFFER).
+    Bool IsNamedInterface(GLenum programInterface);
+    // <prop> is a property token GetProgramResourceiv knows at all (else GL_INVALID_ENUM).
+    Bool IsResourceProp(GLenum prop);
+    // <prop> applies to <programInterface> (else GL_INVALID_OPERATION).
+    Bool InterfaceSupportsProp(GLenum programInterface, GLenum prop);
+    // Interfaces GetProgramResourceLocation accepts (else GL_INVALID_ENUM).
+    Bool InterfaceHasLocations(GLenum programInterface);
+
+    // GL_ACTIVE_RESOURCES / GL_MAX_NAME_LENGTH / GL_MAX_NUM_ACTIVE_VARIABLES. All three
+    // report zero for an interface this implementation cannot enumerate and for a program
+    // that has not linked successfully - which is what the spec requires of a program with
+    // no active resources.
+    Int GetActiveResourceCount(ProgramObject& program, GLenum programInterface);
+    Int GetMaxNameLength(ProgramObject& program, GLenum programInterface);
+    Int GetMaxNumActiveVariables(ProgramObject& program, GLenum programInterface);
+
+    // GL_INVALID_INDEX when <name> names no active resource of the interface.
+    GLuint GetResourceIndex(ProgramObject& program, GLenum programInterface, const char* name);
+    // False when <index> is out of range for the interface (the caller raises INVALID_VALUE).
+    Bool GetResourceName(ProgramObject& program, GLenum programInterface, GLuint index, String& outName);
+    // Appends the value(s) of <prop> for the resource; GL_ACTIVE_VARIABLES appends several.
+    // False when <index> is out of range.
+    Bool GetResourceProp(ProgramObject& program, GLenum programInterface, GLuint index, GLenum prop,
+                         Vector<GLint>& outValues);
+    GLint GetResourceLocation(ProgramObject& program, GLenum programInterface, const char* name);
+    GLint GetResourceLocationIndex(ProgramObject& program, GLenum programInterface, const char* name);
+} // namespace MobileGL::MG_Impl::GLImpl::ProgramInterface

MobileGL/MG_Impl/GLImpl/Sampler/GL_Sampler.cpp

@@ -8,6 +8,7 @@
 
 #include "GL_Sampler.h"
 #include "Validators.h"
+#include "../Getter/GL_Getter.h"
 #include <MG_State/GLState/Core.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
@@ -268,9 +269,20 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
+    // The number of texture units a sampler may be bound to. GL 3.3 core 3.8.2 names
+    // GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, which is what the backend advertises; the frontend's
+    // MAX_TEXTURE_IMAGE_UNITS is only the capacity of the unit array, so it is a clamp on the
+    // answer and never the answer itself - gating on it alone accepts every unit up to 192 no
+    // matter what the driver reports.
+    static GLint GetSamplerBindableTextureUnitCount() {
+        GLint maxTextureUnits = 0;
+        GetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &maxTextureUnits);
+        return std::min<GLint>(std::max(maxTextureUnits, 0), MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS);
+    }
+
     void BindSampler_State(GLuint unit, GLuint sampler) {
         MGLOG_D("BindSampler_State: unit = %u, sampler = %u", unit, sampler);
-        if (unit >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
+        if (static_cast<Uint64>(unit) >= static_cast<Uint64>(GetSamplerBindableTextureUnitCount())) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "BindSampler", "texture unit out of range"));
@@ -309,6 +321,20 @@ namespace MobileGL::MG_Impl::GLImpl {
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "BindSamplers", "count must be non-negative"));
             return;
         }
+        // ARB_multi_bind: the whole [first, first + count) range is checked up front and a
+        // range that runs past the last texture unit is INVALID_OPERATION - not the
+        // INVALID_VALUE the single-bind BindSampler_State reports per element, and nothing is
+        // bound when it fails. Both gates read the same limit (see
+        // GetSamplerBindableTextureUnitCount), so an out-of-range multi-bind can no longer slip
+        // past this check and be caught one element at a time with the wrong error class.
+        const GLint maxTextureUnits = GetSamplerBindableTextureUnitCount();
+        if (static_cast<Uint64>(first) + static_cast<Uint64>(count) > static_cast<Uint64>(maxTextureUnits)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "BindSamplers",
+                                             "first + count exceeds the number of texture units."));
+            return;
+        }
 
         for (GLsizei i = 0; i < count; ++i) {
             BindSampler_State(first + i, samplers ? samplers[i] : 0);

MobileGL/MG_Impl/GLImpl/Sampler/Validators.cpp

@@ -75,7 +75,11 @@ namespace MobileGL::MG_Impl::GLImpl::SamplerImpl {
             break;
 
         case GL_TEXTURE_COMPARE_FUNC:
-            if (param < GL_LEQUAL || param > GL_ALWAYS) {
+            // The eight depth-compare functions are contiguous from GL_NEVER (0x0200) to
+            // GL_ALWAYS (0x0207); GL_LEQUAL sits in the middle of that block, so starting
+            // the range there rejected NEVER/LESS/EQUAL and let GREATER/NOTEQUAL/GEQUAL
+            // through only by accident of them being above LEQUAL.
+            if (param < GL_NEVER || param > GL_ALWAYS) {
                 MG_State::pGLContext->RecordError(ErrorCode::InvalidEnum,
                                                   MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "ValidateSamplerParam",
                                                                                "Invalid compare function parameter"));

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp

@@ -86,17 +86,65 @@ namespace MobileGL::MG_Impl::GLImpl {
             return false;
         }
 
+        // DSA emulation: the by-name entry points are implemented by putting the named texture
+        // on the active unit's slot for their target, running the classic bound-texture code,
+        // then putting the previous binding back.
+        //
+        // Both of those binds are REAL changes to "which texture is bound at this unit" for as
+        // long as `fn` runs, so both have to move the texture bind generation. Backends memoise
+        // per-unit work keyed on that generation and BORROW the binding slot (they hold a
+        // pointer to the slot's shared_ptr, not a copy); a slot swap the generation never saw
+        // let such a memo replay texture A's backend twin against texture B now sitting in the
+        // slot - which re-specified A's backend storage with B's shape and silently destroyed
+        // A's GPU-rendered contents (Minecraft's lightmap, blanked by a by-name upload to an
+        // Iris shadow map, which then discarded every glyph).
+        //
+        // The generation is bumped directly rather than through NoteTextureUnitTouched because
+        // the touched-unit HIGH-WATER MARK must NOT move: glActiveTexture does not advance it,
+        // so a DSA-only app would otherwise have every later draw walk up to the highest unit it
+        // ever aimed a by-name call at. Not advancing it is also sufficient - a unit above the
+        // mark is outside every memo's coverage and outside the epoch walk, so nothing can
+        // observe the transient swap there; at or below it, the bump is exactly what makes the
+        // epoch re-derive. Bumping only on a real change keeps the very common redundant case (a
+        // by-name call on the texture already bound to the active unit) free.
+        //
+        // The restore is a scope guard because `fn` can throw (the unsupported-state paths use
+        // THROW_EXCEPTION): leaking the temporary binding would leave the wrong texture bound to
+        // a live unit for the rest of the context's life.
         template <typename Fn>
         void WithTemporarilyBoundNamedTexture(const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
                                              Fn&& fn) {
             if (!textureObject) return;
 
-            auto& activeUnit = MG_State::pGLContext->GetTextureUnitObject(MG_State::pGLContext->GetActiveTextureUnit());
+            const Int activeUnitIndex = MG_State::pGLContext->GetActiveTextureUnit();
+            auto& activeUnit = MG_State::pGLContext->GetTextureUnitObject(activeUnitIndex);
             auto& bindingSlot = activeUnit.GetBindingSlot(textureObject->GetTarget());
             const auto previousBinding = bindingSlot.GetBoundObject();
-            bindingSlot.Bind(textureObject);
+
+            using SlotType = std::remove_reference_t<decltype(bindingSlot)>;
+            class ScopedSlotRestore {
+            public:
+                ScopedSlotRestore(SlotType& slot, SharedPtr<MG_State::GLState::ITextureObject> previous)
+                    : m_slot(slot), m_previous(Move(previous)) {}
+                ~ScopedSlotRestore() {
+                    if (m_slot.Bind(m_previous)) {
+                        MG_State::pGLContext->BumpTextureBindGeneration();
+                    }
+                }
+                ScopedSlotRestore(const ScopedSlotRestore&) = delete;
+                ScopedSlotRestore& operator=(const ScopedSlotRestore&) = delete;
+
+            private:
+                SlotType& m_slot;
+                SharedPtr<MG_State::GLState::ITextureObject> m_previous;
+            };
+
+            if (bindingSlot.Bind(textureObject)) {
+                MG_State::pGLContext->BumpTextureBindGeneration();
+            }
+            ScopedSlotRestore restore(bindingSlot, previousBinding);
+
             fn(MG_Util::ConvertTextureTargetToGLEnum(textureObject->GetTarget()));
-            bindingSlot.Bind(previousBinding);
         }
 
         SizeT ComputeTextureStorageByteSize(TextureInternalFormat textureInternalFormat, GLsizei width, GLsizei height,

MobileGL/MG_Impl/GLImpl/VertexArray/GL_VertexArray.cpp

@@ -106,6 +106,21 @@ namespace MobileGL::MG_Impl::GLImpl {
             return pname == GL_CURRENT_VERTEX_ATTRIB;
         }
 
+        // The two ARB_vertex_attrib_binding per-attribute queries. They do not live on the
+        // resolved VertexAttribute (which is the flat, already-combined view) but on the VAO's
+        // binding-point mapping, so they need the object, not the attribute.
+        static bool TryGetVertexAttribBindingQuery(GLuint index, GLenum pname, GLint& out) {
+            if (pname != GL_VERTEX_ATTRIB_BINDING && pname != GL_VERTEX_ATTRIB_RELATIVE_OFFSET) return false;
+            const auto& vao = MG_State::pGLContext->GetBoundVertexArray();
+            if (!vao) {
+                out = 0;
+                return true;
+            }
+            out = pname == GL_VERTEX_ATTRIB_BINDING ? static_cast<GLint>(vao->GetAttributeBindingIndex(index))
+                                                    : static_cast<GLint>(vao->GetAttributeRelativeOffset(index));
+            return true;
+        }
+
         // The stride a pointer-style call gives its binding point: the argument when it is non-zero,
         // otherwise the tightly packed element size (GL 4.6 core 10.3.2). A packed 2_10_10_10 or
         // 10F_11F_11F attribute is one 32-bit word regardless of its component count.
@@ -179,6 +194,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             case GL_VERTEX_ATTRIB_ARRAY_LONG:
             case GL_VERTEX_ATTRIB_ARRAY_DIVISOR:
             case GL_VERTEX_ATTRIB_ARRAY_POINTER:
+            // ARB_vertex_attrib_binding (core since GL 4.3). The binding-point view is real
+            // state on the VAO (GetAttributeBindingIndex / GetAttributeRelativeOffset), so
+            // both of its per-attribute queries are answerable.
+            case GL_VERTEX_ATTRIB_BINDING:
+            case GL_VERTEX_ATTRIB_RELATIVE_OFFSET:
                 return true;
             default:
                 MG_State::pGLContext->RecordError(
@@ -944,6 +964,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_VERTEX_ATTRIB_ARRAY_DIVISOR:
             params[0] = static_cast<GLfloat>(attr->Divisor);
             return;
+        case GL_VERTEX_ATTRIB_BINDING:
+        case GL_VERTEX_ATTRIB_RELATIVE_OFFSET: {
+            GLint value = 0;
+            TryGetVertexAttribBindingQuery(index, pname, value);
+            params[0] = static_cast<GLfloat>(value);
+            return;
+        }
         default:
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,
@@ -1007,6 +1034,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_VERTEX_ATTRIB_ARRAY_DIVISOR:
             params[0] = static_cast<GLdouble>(attr->Divisor);
             return;
+        case GL_VERTEX_ATTRIB_BINDING:
+        case GL_VERTEX_ATTRIB_RELATIVE_OFFSET: {
+            GLint value = 0;
+            TryGetVertexAttribBindingQuery(index, pname, value);
+            params[0] = static_cast<GLdouble>(value);
+            return;
+        }
         default:
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,
@@ -1066,6 +1100,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_VERTEX_ATTRIB_ARRAY_DIVISOR:
             params[0] = static_cast<GLint>(attr->Divisor);
             return;
+        case GL_VERTEX_ATTRIB_BINDING:
+        case GL_VERTEX_ATTRIB_RELATIVE_OFFSET:
+            TryGetVertexAttribBindingQuery(index, pname, params[0]);
+            return;
         default:
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,
@@ -1204,6 +1242,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_VERTEX_ATTRIB_RELATIVE_OFFSET:
             *param = static_cast<GLint>(vao->GetAttributeRelativeOffset(index));
             return;
+        case GL_VERTEX_ATTRIB_BINDING:
+            *param = static_cast<GLint>(vao->GetAttributeBindingIndex(index));
+            return;
         default:
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,

MobileGL/MG_Impl/GLImpl/VertexArray/Validators.cpp

@@ -147,6 +147,30 @@ namespace MobileGL::MG_Impl::GLImpl::VertexArrayImpl {
             return false;
         }
 
+        // The integer path takes exactly the six signed/unsigned integer types (GL 4.6
+        // core 10.3.2): BYTE, UNSIGNED_BYTE, SHORT, UNSIGNED_SHORT, INT, UNSIGNED_INT.
+        // A blacklist could not express that: GL_FLOAT, GL_HALF_FLOAT,
+        // GL_DOUBLE and GL_FIXED all convert to a perfectly valid DataType, so they slipped
+        // through and were recorded as integer attributes.
+        if (integerPath) {
+            switch (type) {
+            case DataType::Int8:
+            case DataType::Uint8:
+            case DataType::Int16:
+            case DataType::Uint16:
+            case DataType::Int32:
+            case DataType::Uint32:
+                break;
+            default:
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidEnum,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", fn,
+                        std::format("Type is not an integer vertex attribute type (attribute {}).", index)));
+                return false;
+            }
+        }
+
         if (sizeRaw == static_cast<GLint>(GL_BGRA)) {
             // GL_BGRA is a float-path-only size: it needs GL_UNSIGNED_BYTE or a 2_10_10_10 type and
             // normalized == GL_TRUE. On the integer path it is simply an out-of-range size.

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -52,6 +52,7 @@ add_executable(MobileGLIntegrationTest
     Scenarios/MultiDrawScenario.cpp
     Scenarios/AsyncCompileScenario.cpp
     Scenarios/XfbAfterClipDistanceScenario.cpp
+    Scenarios/ThreeChannelAttachmentScenario.cpp
 )
 
 target_include_directories(MobileGLIntegrationTest PRIVATE

MobileGL/MG_IntegrationTest/Scenarios/ThreeChannelAttachmentScenario.cpp

@@ -0,0 +1,300 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/ThreeChannelAttachmentScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - THREE-CHANNEL COLOUR ATTACHMENTS, on a live driver.
+//
+// The bug: no OpenGL ES driver renders to a three-channel image. EXT_render_snorm covers
+// R/RG/RGBA only, EXT_color_buffer_float excludes RGB16F, and RGB integer formats are not
+// colour-renderable anywhere. Complementary Reimagined declares colortex1 = RGB8_SNORM and
+// colortex2 = RGB16F, so every framebuffer Iris built from them answered
+// GL_FRAMEBUFFER_UNSUPPORTED and Iris refused to load the shaderpack. DirectGLES now stores such
+// an attachment in its four-channel sibling (GL_RGB8_SNORM -> GL_RGBA16F) and reports the
+// substitution as a caveat capability, which is what makes glCheckFramebufferStatus say COMPLETE.
+//
+// WHY THIS SCENARIO EXISTS RATHER THAN A UNIT TEST. The unit tests in
+// MG_Test/Framebuffer/FramebufferTest.cpp drive a HAND-BUILT capability cache: they prove the
+// frontend accepts a caveat capability, and prove the colour-mask/clear discipline that keeps a
+// widened attachment's stored alpha at 1.0, but they cannot prove that a real driver's probe
+// actually PRODUCES that caveat. Only a live glCheckFramebufferStatus can, and the answer is
+// per-driver, not per-platform:
+//
+//   Mesa llvmpipe (the headless CI driver), ES 3.2, GL_TEXTURE_2D colour attachment:
+//     COMPLETE               GL_RGB8, GL_RGB16F, GL_R11F_G11F_B10F, every RGBA*
+//     INCOMPLETE_ATTACHMENT  GL_RGB8_SNORM, GL_SRGB8, every RGB integer format
+//     UNSUPPORTED            GL_RGB32F
+//
+// So the widening is LIVE on llvmpipe - "the desktop build is unaffected" was simply wrong, and
+// the CI retraces were green before the fix only because retrace ignores what
+// glCheckFramebufferStatus returns. This scenario is the gate that actually looks.
+//
+// DirectGLES only. DirectVulkan's format story is its own (Vulkan exposes R8G8B8_SNORM on almost
+// nothing, and Magma substitutes on different terms); asserting Espryt's answers there would
+// only pin a coincidence.
+
+#include <cmath>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr const char* kVS = R"(#version 330 core
+in vec2 aPos;
+void main() {
+    gl_Position = vec4(aPos, 0.0, 1.0);
+}
+)";
+
+        // Two outputs so the mixed case is covered: draw buffer 0 is a natively renderable
+        // four-channel format whose alpha the application owns, draw buffer 1 is the widened
+        // three-channel one whose alpha the format says is 1.0. Both alphas are deliberately
+        // NOT 1.0 in the shader, so an implementation that simply passed the value through would
+        // fail the second assertion.
+        constexpr const char* kFS = R"(#version 330 core
+layout(location = 0) out vec4 oNative;
+layout(location = 1) out vec4 oWidened;
+void main() {
+    oNative  = vec4(1.0, 0.0, 0.0, 0.25);
+    oWidened = vec4(0.0, 1.0, 0.0, 0.75);
+}
+)";
+
+        constexpr int kSize = 16;
+
+        class ThreeChannelAttachmentScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                if (Gl().BackendName() != "DirectGLES") {
+                    GTEST_SKIP() << "three-channel widening is a DirectGLES substitution; backend is "
+                                 << Gl().BackendName();
+                }
+            }
+
+            // A single-level 2D texture in `internalFormat`, or 0 when the driver rejects the
+            // storage outright (which is a different failure from rejecting the ATTACHMENT).
+            static GLuint MakeTexture(GLenum internalFormat) {
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                glBindTexture(GL_TEXTURE_2D, texture);
+                glTexStorage2D(GL_TEXTURE_2D, 1, internalFormat, kSize, kSize);
+                if (glGetError() != GL_NO_ERROR) {
+                    glDeleteTextures(1, &texture);
+                    return 0;
+                }
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glBindTexture(GL_TEXTURE_2D, 0);
+                return texture;
+            }
+
+            static GLenum SingleAttachmentStatus(GLenum internalFormat) {
+                const GLuint texture = MakeTexture(internalFormat);
+                if (texture == 0) return GL_NONE;
+                GLuint fbo = 0;
+                glGenFramebuffers(1, &fbo);
+                glBindFramebuffer(GL_DRAW_FRAMEBUFFER, fbo);
+                glFramebufferTexture2D(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+                const GLenum status = glCheckFramebufferStatus(GL_DRAW_FRAMEBUFFER);
+                glBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+                glDeleteFramebuffers(1, &fbo);
+                glDeleteTextures(1, &texture);
+                return status;
+            }
+        };
+
+        // THE regression gate for the frontend's answer: this is the exact call Iris makes, and
+        // GL_FRAMEBUFFER_UNSUPPORTED here is the whole shaderpack load failure.
+        TEST_F(ThreeChannelAttachmentScenario, ThreeChannelColorAttachmentsReportComplete) {
+            if (!Ready() || IsSkipped()) return;
+
+            // GL_RGB8 is the control: colour-renderable in ES core, so it must pass with or
+            // without any substitution. If it ever fails, nothing below means anything.
+            EXPECT_EQ(SingleAttachmentStatus(GL_RGB8), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE))
+                << "GL_RGB8 is ES-core colour-renderable";
+
+            // Complementary Reimagined's colortex1 and colortex2.
+            EXPECT_EQ(SingleAttachmentStatus(GL_RGB8_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE))
+                << "colortex1 (RGB8_SNORM) must be renderable through the four-channel widening";
+            EXPECT_EQ(SingleAttachmentStatus(GL_RGB16F), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE))
+                << "colortex2 (RGB16F) must be renderable, natively or through the widening";
+
+            // The other formats the widening covers. GL_RGB32F only reaches a renderable
+            // four-channel form when EXT_color_buffer_float is present, so a half-float-only
+            // driver legitimately answers UNSUPPORTED for it - see the POST's per-format row.
+            EXPECT_EQ(SingleAttachmentStatus(GL_SRGB8), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+            EXPECT_EQ(SingleAttachmentStatus(GL_RGB8UI), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+            EXPECT_EQ(FirstGLError(), 0u) << GLErrorName(FirstGLError());
+        }
+
+        // The other half: the substitution has to be INVISIBLE. A three-channel format has no
+        // alpha, so GL answers 1.0 for it - and that answer has to hold after a draw that wrote
+        // something else into the widened storage's real alpha channel, which is what the
+        // colour-mask discipline in SyncRenderState is for. GL_DST_ALPHA blending and
+        // glBlitFramebuffer read that stored alpha inside the driver, where no readback fixup can
+        // reach it, so "the storage really holds 1.0" is the only workable invariant.
+        TEST_F(ThreeChannelAttachmentScenario, WidenedAttachmentReadsBackOpaqueWhileItsNeighbourKeepsItsAlpha) {
+            if (!Ready() || IsSkipped()) return;
+
+            std::string error;
+            const GLuint program = CompileProgram(kVS, kFS, &error);
+            ASSERT_NE(program, 0u) << error;
+
+            const GLuint nativeTexture = MakeTexture(GL_RGBA16F);
+            const GLuint widenedTexture = MakeTexture(GL_RGB8_SNORM);
+            ASSERT_NE(nativeTexture, 0u);
+            ASSERT_NE(widenedTexture, 0u);
+
+            GLuint fbo = 0;
+            glGenFramebuffers(1, &fbo);
+            glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+            glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, nativeTexture, 0);
+            glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT1, GL_TEXTURE_2D, widenedTexture, 0);
+            const GLenum drawBuffers[2] = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1};
+            glDrawBuffers(2, drawBuffers);
+            ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+            glViewport(0, 0, kSize, kSize);
+            // Alpha 0.0 on purpose: the widened attachment must come back 1.0 anyway, and the
+            // native one must come back 0.0 where the draw does not cover it.
+            glClearColor(0.0f, 0.0f, 0.0f, 0.0f);
+            glClear(GL_COLOR_BUFFER_BIT);
+
+            const float quad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+            GLuint vao = 0;
+            GLuint vbo = 0;
+            glGenVertexArrays(1, &vao);
+            glBindVertexArray(vao);
+            glGenBuffers(1, &vbo);
+            glBindBuffer(GL_ARRAY_BUFFER, vbo);
+            glBufferData(GL_ARRAY_BUFFER, sizeof(quad), quad, GL_STATIC_DRAW);
+            glEnableVertexAttribArray(0);
+            glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+            glUseProgram(program);
+            glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+
+            std::vector<float> pixels(static_cast<std::size_t>(kSize) * kSize * 4, -1.0f);
+
+            glReadBuffer(GL_COLOR_ATTACHMENT1);
+            glReadPixels(0, 0, kSize, kSize, GL_RGBA, GL_FLOAT, pixels.data());
+            EXPECT_NEAR(pixels[0], 0.0f, 0.02f) << "widened attachment red";
+            EXPECT_NEAR(pixels[1], 1.0f, 0.02f) << "widened attachment green";
+            EXPECT_NEAR(pixels[2], 0.0f, 0.02f) << "widened attachment blue";
+            EXPECT_NEAR(pixels[3], 1.0f, 0.001f)
+                << "a three-channel format has no alpha channel, so GL must report 1.0 for it";
+
+            glReadBuffer(GL_COLOR_ATTACHMENT0);
+            glReadPixels(0, 0, kSize, kSize, GL_RGBA, GL_FLOAT, pixels.data());
+            EXPECT_NEAR(pixels[0], 1.0f, 0.02f) << "native attachment red";
+            EXPECT_NEAR(pixels[3], 0.25f, 0.02f)
+                << "the alpha discipline must not leak onto a natively renderable attachment";
+
+            glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            glDeleteFramebuffers(1, &fbo);
+            glDeleteBuffers(1, &vbo);
+            glDeleteVertexArrays(1, &vao);
+            glDeleteTextures(1, &nativeTexture);
+            glDeleteTextures(1, &widenedTexture);
+            glDeleteProgram(program);
+            EXPECT_EQ(FirstGLError(), 0u) << GLErrorName(FirstGLError());
+        }
+
+        // The case above can be satisfied by the readback fixup alone (ForceWideReadAlphaToOne
+        // rewrites glReadPixels' alpha), so it does NOT prove the STORED alpha is 1.0. This one
+        // does, by asking the driver to read that alpha itself: GL_DST_ALPHA blending multiplies
+        // by the destination alpha inside the raster pipeline, where nothing MobileGL does can
+        // intervene. Same reason GL_ONE_MINUS_DST_ALPHA and glBlitFramebuffer are covered for
+        // free once this holds - and the reason the discipline is a write mask rather than a
+        // readback patch.
+        //
+        // Ablation-checked on llvmpipe, each half separately: disable the alpha doctoring in
+        // SyncRenderState and the opaque draw leaves 0.25 in the stored alpha; disable the clear
+        // substitution in Clear() and it stays at the application's 0.0. Either way this case
+        // reads back the wrong number, which is what makes it a gate rather than a description.
+        TEST_F(ThreeChannelAttachmentScenario, DstAlphaBlendingSeesOneInAWidenedAttachment) {
+            if (!Ready() || IsSkipped()) return;
+
+            static constexpr const char* kSingleOutFS = R"(#version 330 core
+out vec4 oColor;
+uniform vec4 uColor;
+void main() { oColor = uColor; }
+)";
+            std::string error;
+            const GLuint program = CompileProgram(kVS, kSingleOutFS, &error);
+            ASSERT_NE(program, 0u) << error;
+            const GLint colorLocation = glGetUniformLocation(program, "uColor");
+            ASSERT_GE(colorLocation, 0);
+
+            const GLuint widenedTexture = MakeTexture(GL_RGB8_SNORM);
+            ASSERT_NE(widenedTexture, 0u);
+            GLuint fbo = 0;
+            glGenFramebuffers(1, &fbo);
+            glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+            glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, widenedTexture, 0);
+            ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+            const float quad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+            GLuint vao = 0;
+            GLuint vbo = 0;
+            glGenVertexArrays(1, &vao);
+            glBindVertexArray(vao);
+            glGenBuffers(1, &vbo);
+            glBindBuffer(GL_ARRAY_BUFFER, vbo);
+            glBufferData(GL_ARRAY_BUFFER, sizeof(quad), quad, GL_STATIC_DRAW);
+            glEnableVertexAttribArray(0);
+            glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+            glUseProgram(program);
+            glViewport(0, 0, kSize, kSize);
+
+            // The clear's alpha is 0.0 and the draw's is 0.25 - neither is the 1.0 the format
+            // implies, so both halves of the discipline have to fire for the blend below to see
+            // 1.0: the clear substitutes it, and the draw is masked away from it.
+            glDisable(GL_BLEND);
+            glClearColor(0.0f, 0.0f, 0.0f, 0.0f);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glUniform4f(colorLocation, 0.0f, 1.0f, 0.0f, 0.25f);
+            glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+
+            // dst = stored alpha; src factor GL_DST_ALPHA, dst factor GL_ZERO, source white
+            // => the destination colour becomes (storedAlpha, storedAlpha, storedAlpha).
+            glEnable(GL_BLEND);
+            glBlendFunc(GL_DST_ALPHA, GL_ZERO);
+            glUniform4f(colorLocation, 1.0f, 1.0f, 1.0f, 1.0f);
+            glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+            glDisable(GL_BLEND);
+
+            std::vector<float> pixels(static_cast<std::size_t>(kSize) * kSize * 4, -1.0f);
+            glReadBuffer(GL_COLOR_ATTACHMENT0);
+            glReadPixels(0, 0, kSize, kSize, GL_RGBA, GL_FLOAT, pixels.data());
+            EXPECT_NEAR(pixels[0], 1.0f, 0.02f)
+                << "GL_DST_ALPHA read the stored alpha of a three-channel attachment; it must be 1.0";
+
+            glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            glDeleteFramebuffers(1, &fbo);
+            glDeleteBuffers(1, &vbo);
+            glDeleteVertexArrays(1, &vao);
+            glDeleteTextures(1, &widenedTexture);
+            glDeleteProgram(program);
+            EXPECT_EQ(FirstGLError(), 0u) << GLErrorName(FirstGLError());
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_State/GLState/BufferState/BufferObject.cpp

@@ -206,8 +206,11 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::UploadSubData(DataPtr data, SizeT atOffset) {
-        MOBILEGL_ASSERT(!m_isMapped || (m_mappingAccess & BufferMappingAccessBit::Persistent),
+        // GL 4.6 core 6.5 forbids only the OVERLAPPING write: a glBufferSubData that stays
-                        "Cannot upload sub data while buffer is non-persistently mapped.");
+        // clear of a non-persistent mapping is legal, and the frontend lets it through.
+        MOBILEGL_ASSERT(!m_isMapped || (m_mappingAccess & BufferMappingAccessBit::Persistent) ||
+                            atOffset >= m_mappedRange.end || atOffset + data.size <= m_mappedRange.start,
+                        "Cannot upload sub data overlapping a non-persistent mapping.");
         MOBILEGL_ASSERT(atOffset + data.size <= m_size,
                         "UploadSubData out of bounds: atOffset (%zu) + data.size (%zu) > m_size (%zu)", atOffset,
                         data.size, m_size);

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.cpp

@@ -1057,6 +1057,10 @@ namespace MobileGL::MG_State::GLState {
 
     Bool ProgramLinkTask::ResolveTransformFeedbackVaryings() {
         artifacts.xfbVaryings.clear();
+        // The GL_TRANSFORM_FEEDBACK_VARYING interface enumerates the request verbatim -
+        // pseudo-varyings included - while xfbVaryings below keeps only what is actually
+        // captured. Snapshot it before the loop consumes gl_NextBuffer/gl_SkipComponentsN.
+        artifacts.xfbInterfaceNames = in.requestedXfbVaryings;
         artifacts.xfbStrides.clear();
         artifacts.xfbBufferMode = in.requestedXfbBufferMode;
         artifacts.xfbVaryingNameMaxLength = 0;
@@ -1127,15 +1131,45 @@ namespace MobileGL::MG_State::GLState {
                 bytesPerElement = 4;
                 resolved = true;
             } else if (linkerObjects != nullptr) {
+                // GL lets a capture name a single element of an output array ("b[0]"), which
+                // captures one element of the element type - not the whole array. Strip a
+                // trailing strict-decimal subscript and look the base declaration up.
+                String declaredName = name;
+                Bool singleElement = false;
+                Uint element = 0;
+                if (name.size() > 3 && name.back() == ']') {
+                    const SizeT bracket = name.rfind('[');
+                    if (bracket != String::npos && bracket + 1 < name.size() - 1) {
+                        Bool digitsOnly = true;
+                        for (SizeT c = bracket + 1; c + 1 < name.size(); ++c) {
+                            if (name[c] < '0' || name[c] > '9') {
+                                digitsOnly = false;
+                                break;
+                            }
+                            element = element * 10 + static_cast<Uint>(name[c] - '0');
+                        }
+                        if (digitsOnly) {
+                            declaredName = name.substr(0, bracket);
+                            singleElement = true;
+                        }
+                    }
+                }
                 for (const auto* node : linkerObjects->getSequence()) {
                     const glslang::TIntermSymbol* symbol = node->getAsSymbolNode();
                     if (symbol == nullptr || symbol->getType().getQualifier().storage != glslang::EvqVaryingOut) {
                         continue;
                     }
-                    if (symbol->getName() != name.c_str()) {
+                    if (symbol->getName() != declaredName.c_str()) {
                         continue;
                     }
                     resolved = ResolveXfbSymbolType(symbol->getType(), varying.type, varying.size, bytesPerElement);
+                    if (resolved && singleElement) {
+                        if (static_cast<Int>(element) >= varying.size) {
+                            resolved = false;
+                            break;
+                        }
+                        varying.size = 1;
+                    }
                     break;
                 }
             }

MobileGL/MG_State/GLState/ProgramState/ProgramObject.cpp

@@ -116,6 +116,7 @@ namespace MobileGL::MG_State::GLState {
         artifacts.explicitOpaqueUniformBindings.clear();
         artifacts.uniformBlockIndexByName.clear();
         artifacts.uniformBlockBinding.clear();
+        artifacts.shaderStorageBlockBinding.clear();
         artifacts.uniformOffsets.clear();
         artifacts.uniformSizesInBytes.clear();
         artifacts.globalUboScratch.clear();
@@ -127,6 +128,7 @@ namespace MobileGL::MG_State::GLState {
         artifacts.attribInNameMaxLength = 0;
         artifacts.uniformBlockNameMaxLength = 0;
         artifacts.xfbVaryings.clear();
+        artifacts.xfbInterfaceNames.clear();
         artifacts.xfbStrides.clear();
         artifacts.xfbBufferMode = GL_INTERLEAVED_ATTRIBS;
         artifacts.xfbVaryingNameMaxLength = 0;

MobileGL/MG_State/GLState/ProgramState/ProgramObject.h

@@ -82,6 +82,14 @@ namespace MobileGL::MG_State::GLState {
                 return -1;
             }
             if (name.length() < 4) return -1;
+            // An array of arrays is keyed by its full "[0]"-terminated spelling
+            // ("a[2][1][0]"), so a query that already ends in a subscript may still be the
+            // NAME of an array rather than an element of one. Try that first; only then
+            // treat the trailing subscript as an element index.
+            {
+                const auto arrayOfArraysIt = Artifacts().uniformLocations.find(name + "[0]");
+                if (arrayOfArraysIt != Artifacts().uniformLocations.end()) return (Int)arrayOfArraysIt->second;
+            }
             const SizeT bracket = name.rfind('[');
             // Require at least one digit between the brackets.
             if (bracket == String::npos || bracket + 1 >= name.length() - 1) return -1;
@@ -130,6 +138,14 @@ namespace MobileGL::MG_State::GLState {
             if (tIndex < 0 || tIndex >= static_cast<Int>(Artifacts().tProgramUniformIndexToGl.size())) return -1;
             return Artifacts().tProgramUniformIndexToGl[tIndex];
         }
+        // GL uniform-block index -> glslang TProgram block index (the inverse of
+        // GlBlockIndexFromTProgram). The interface-query layer needs it to reach block
+        // properties glslang exposes but no typed getter here does.
+        Int TProgramBlockIndex(Uint glBlockIndex) const {
+            return glBlockIndex < Artifacts().glBlockIndexToTProgram.size()
+                ? Artifacts().glBlockIndexToTProgram[glBlockIndex]
+                : -1;
+        }
         Int GlBlockIndexFromTProgram(Int tBlockIndex) const {
             if (tBlockIndex < 0 || tBlockIndex >= static_cast<Int>(Artifacts().tProgramBlockIndexToGl.size())) return -1;
             return Artifacts().tProgramBlockIndexToGl[tBlockIndex];
@@ -529,9 +545,42 @@ namespace MobileGL::MG_State::GLState {
 
         Uint GetUniformBlockBinding(Uint index) const { return Artifacts().uniformBlockBinding[index]; }
 
+        // Set by glShaderStorageBlockBinding, keyed by the block's GL name rather than by any
+        // index. A shader storage block has THREE index spaces - the frontend interface-query
+        // enumeration, DirectVulkan's SPIR-V descriptor order and DirectGLES's real-driver
+        // order - and the name is the only coordinate all three agree on. Absent from the map
+        // means "never rebound", and the shader's declared binding still stands.
+        void SetShaderStorageBlockBinding(const String& blockName, Uint binding) {
+            Artifacts().shaderStorageBlockBinding[blockName] = static_cast<Int>(binding);
+        }
+        // -1 when the block has never been rebound. `blockName` is the interface-query
+        // spelling; an arrayed block's elements ("B[0]", "B[1]") are separate GL resources
+        // with separate bindings, so they are separate keys.
+        Int GetShaderStorageBlockBindingOverride(const String& blockName) const {
+            const auto it = Artifacts().shaderStorageBlockBinding.find(blockName);
+            if (it != Artifacts().shaderStorageBlockBinding.end()) return it->second;
+            // A backend that collapses an arrayed block down to one resource knows it only by
+            // the bare block name; answer that with element zero's binding.
+            const auto zeroth = Artifacts().shaderStorageBlockBinding.find(blockName + "[0]");
+            return zeroth != Artifacts().shaderStorageBlockBinding.end() ? zeroth->second : -1;
+        }
+        // Every rebinding recorded so far, for a backend that has to REPLAY them onto a
+        // driver program it just (re)built. Empty for the overwhelming majority of programs -
+        // check .empty() before doing any per-block work.
+        const UnorderedMap<String, Int>& GetShaderStorageBlockBindingOverrides() const {
+            return Artifacts().shaderStorageBlockBinding;
+        }
+
         Vector<Vector<unsigned>>& GetGeneratedSpirv() { return Artifacts().generatedSpirv; }
         const Vector<Vector<unsigned>>& GetGeneratedSpirv() const { return Artifacts().generatedSpirv; }
 
+        // The linked glslang reflection itself, for the ONE consumer that needs resource
+        // lists no typed getter above exposes: the GL program-interface query layer
+        // (MG_Impl/GLImpl/Program/ProgramInterface.cpp), which has to enumerate buffer
+        // blocks, buffer variables, atomic counters and per-stage reference masks. Null
+        // until a link has succeeded. Read through the join gate like everything else.
+        const glslang::TProgram* GetReflection() const { return Artifacts().program.get(); }
+
         Int GetShaderIndexByStage(ShaderStage stage) const {
             auto it = std::find_if(m_shaders.begin(), m_shaders.end(), [stage](const SharedPtr<ShaderObject>& shader) {
                 return shader->GetShaderStage() == stage;
@@ -611,6 +660,9 @@ namespace MobileGL::MG_State::GLState {
             // These may change after-link (because GL spec decided to have `glUniformBlockBinding`)
             UnorderedMap<String, Uint> uniformBlockIndexByName;
             Vector<Int> uniformBlockBinding;
+            // glShaderStorageBlockBinding overrides, keyed by GL block name. See
+            // SetShaderStorageBlockBinding for why this one is by name and not by index.
+            UnorderedMap<String, Int> shaderStorageBlockBinding;
 
             // Need to be reflected after linking of SPIR-V binary
             Vector<Uint> uniformOffsets;
@@ -629,6 +681,12 @@ namespace MobileGL::MG_State::GLState {
             // Transform feedback: the linked snapshot (the request lives outside, on the
             // GL-thread-owned side).
             Vector<XfbVarying> xfbVaryings;
+            // The glTransformFeedbackVaryings request list exactly as this link consumed it,
+            // INCLUDING the gl_NextBuffer / gl_SkipComponentsN pseudo-varyings that
+            // xfbVaryings deliberately drops (they steer the capture layout and must never
+            // reach a backend's varying list). GL_TRANSFORM_FEEDBACK_VARYING enumerates the
+            // full request, pseudo-varyings and all, so the interface query needs its own copy.
+            Vector<String> xfbInterfaceNames;
             Vector<Uint32> xfbStrides;
             Vector<Uint32> gsStripTriangles;
             Bool gsStripCaptureFixup = false;
@@ -711,6 +769,9 @@ namespace MobileGL::MG_State::GLState {
             return index < Artifacts().xfbVaryings.size() ? &Artifacts().xfbVaryings[index] : nullptr;
         }
         const Vector<XfbVarying>& GetTransformFeedbackVaryings() const { return Artifacts().xfbVaryings; }
+        // The GL_TRANSFORM_FEEDBACK_VARYING resource list: every name the last successful
+        // link was asked to capture, in request order, pseudo-varyings included.
+        const Vector<String>& GetTransformFeedbackInterfaceNames() const { return Artifacts().xfbInterfaceNames; }
         // Stride of one captured vertex in the given capture buffer slot.
         Uint32 GetTransformFeedbackStride(Uint32 bufferIndex) const {
             return bufferIndex < Artifacts().xfbStrides.size() ? Artifacts().xfbStrides[bufferIndex] : 0;

MobileGL/MG_Test/Buffer/BufferTest.cpp

@@ -455,16 +455,24 @@ TEST_F(BufferTest, BindBufferBaseZeroUnbindsBindingPoint) {
 }
 
 TEST_F(BufferTest, BindBufferRangeZeroUnbindsBindingPoint) {
+    // GL_SHADER_STORAGE_BUFFER offsets must be a multiple of
+    // GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT, so the offset cannot be a literal.
+    GLint ssboAlignment = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT, &ssboAlignment);
+    ASSERT_GT(ssboAlignment, 0);
+    const GLintptr offset = ssboAlignment;
+    const GLsizeiptr size = 8;
+
     GLuint buffer = 0;
     MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
     MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
-    MobileGL::MG_Impl::GLImpl::BufferData(GL_SHADER_STORAGE_BUFFER, 16, nullptr, GL_DYNAMIC_DRAW);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_SHADER_STORAGE_BUFFER, offset + size, nullptr, GL_DYNAMIC_DRAW);
 
-    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 3, buffer, 4, 8);
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 3, buffer, offset, size);
     auto& point = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, 3);
     ASSERT_NE(point.GetBoundObject(), nullptr);
-    EXPECT_EQ(point.GetRange().start, 4);
+    EXPECT_EQ(point.GetRange().start, static_cast<SizeT>(offset));
-    EXPECT_EQ(point.GetRange().end, 12);
+    EXPECT_EQ(point.GetRange().end, static_cast<SizeT>(offset + size));
 
     MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 3, 0, 0, 0);
     EXPECT_EQ(point.GetBoundObject(), nullptr);
@@ -540,6 +548,305 @@ TEST_F(BufferTest, ClearNamedBufferSubDataRepeatsPattern) {
     EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
 }
 
+
+// GL 4.6 core 6.5: glBufferSubData fails only when the written range OVERLAPS the mapped range.
+// A second, wrong test used to sit next to the correct one and reject any write whose end reached
+// the start of the mapping - which killed every legal disjoint update in front of a mapped tail.
+TEST_F(BufferTest, BufferSubDataRejectsOnlyRangesOverlappingTheMapping) {
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_ARRAY_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    void* mapped = MobileGL::MG_Impl::GLImpl::MapBufferRange(GL_ARRAY_BUFFER, 32, 32, GL_MAP_WRITE_BIT);
+    ASSERT_NE(mapped, nullptr);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // Entirely before the mapping: legal, and the bytes must land.
+    const Uint32 payload[4] = {1u, 2u, 3u, 4u};
+    MobileGL::MG_Impl::GLImpl::BufferSubData(GL_ARRAY_BUFFER, 0, sizeof(payload), payload);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // Touching the first mapped byte: overlap, so INVALID_OPERATION.
+    MobileGL::MG_Impl::GLImpl::BufferSubData(GL_ARRAY_BUFFER, 16, 32, payload);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    EXPECT_TRUE(MobileGL::MG_Impl::GLImpl::UnmapBuffer(GL_ARRAY_BUFFER));
+
+    Vector<Uint32> actual(4, 0);
+    auto bufferObject = MobileGL::MG_State::pGLContext->GetBufferObject(buffer);
+    ASSERT_NE(bufferObject, nullptr);
+    Memcpy(actual.data(), bufferObject->AcquireMemory(false, true, false), sizeof(payload));
+    EXPECT_EQ(actual, (Vector<Uint32>{1u, 2u, 3u, 4u}));
+
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_ARRAY_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
+// GL 4.6 core 6.2: "no buffer bound to target" outranks a bad size or bad flags, so the binding has
+// to be resolved before either is validated. It used to be checked last, which turned every
+// unbound-target call into INVALID_VALUE.
+TEST_F(BufferTest, BufferStorageReportsTheUnboundTargetBeforeSizeAndFlags) {
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_ARRAY_BUFFER, 0);
+    DrainPendingGlErrors();
+
+    // Both a zero size and a nonsense flag set are present; the unbound target still wins.
+    MobileGL::MG_Impl::GLImpl::BufferStorage(GL_ARRAY_BUFFER, 0, nullptr, GL_MAP_PERSISTENT_BIT);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    // With a buffer bound, the size check is reachable again.
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_ARRAY_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferStorage(GL_ARRAY_BUFFER, 0, nullptr, GL_MAP_READ_BIT);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_ARRAY_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
+// GL 4.6 core 6.1.1: glBindBufferRange on GL_SHADER_STORAGE_BUFFER must reject an offset that is
+// not a multiple of GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT.
+TEST_F(BufferTest, BindBufferRangeRejectsMisalignedShaderStorageOffset) {
+    GLint ssboAlignment = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT, &ssboAlignment);
+    ASSERT_GT(ssboAlignment, 1) << "a 1-byte alignment cannot express a misaligned offset";
+
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_SHADER_STORAGE_BUFFER, ssboAlignment * 4, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 1, buffer, 1, ssboAlignment);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    auto& point = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, 1);
+    EXPECT_EQ(point.GetBoundObject(), nullptr) << "a rejected bind must not take effect";
+
+    // The uniform target has its own alignment and must not inherit the SSBO rule's rejection.
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 1, buffer, ssboAlignment, ssboAlignment);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_NE(point.GetBoundObject(), nullptr);
+
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 1, 0, 0, 0);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
+// ARB_multi_bind: the [first, first + count) range is checked up front and reports
+// INVALID_OPERATION - not the per-element INVALID_VALUE a naive loop over glBindBufferBase would
+// produce, and nothing may be bound when it fails.
+TEST_F(BufferTest, BindBuffersBaseChecksTheWholeRangeBeforeBindingAnything) {
+    GLint maxBindings = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS, &maxBindings);
+    ASSERT_GT(maxBindings, 1);
+
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_SHADER_STORAGE_BUFFER, 16, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // first is in range but first + count is not: one error, of the multi-bind class.
+    const GLuint first = static_cast<GLuint>(maxBindings - 1);
+    const GLuint buffers[2] = {buffer, buffer};
+    MobileGL::MG_Impl::GLImpl::BindBuffersBase(GL_SHADER_STORAGE_BUFFER, first, 2, buffers);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+    auto& point = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, first);
+    EXPECT_EQ(point.GetBoundObject(), nullptr) << "the in-range prefix must not be bound either";
+
+    MobileGL::MG_Impl::GLImpl::BindBuffersRange(GL_SHADER_STORAGE_BUFFER, first, 2, buffers, nullptr, nullptr);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    // A range that fits binds normally.
+    MobileGL::MG_Impl::GLImpl::BindBuffersBase(GL_SHADER_STORAGE_BUFFER, first, 1, buffers);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    ASSERT_NE(point.GetBoundObject(), nullptr);
+    EXPECT_EQ(point.GetBoundObject()->GetExternalIndex(), buffer);
+
+    MobileGL::MG_Impl::GLImpl::BindBufferBase(GL_SHADER_STORAGE_BUFFER, first, 0);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
+// These limits were reachable only through glGetInteger64v (SSBO block size) or not at all (the
+// atomic-counter pair), so glGetIntegerv answered them with INVALID_ENUM out of its default arm.
+TEST_F(BufferTest, GetIntegervAnswersSsboAndAtomicCounterLimits) {
+    GLint ssboBlockSize = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_MAX_SHADER_STORAGE_BLOCK_SIZE, &ssboBlockSize);
+    EXPECT_GT(ssboBlockSize, 0);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The 32-bit query saturates rather than truncating what glGetInteger64v reports.
+    GLint64 ssboBlockSize64 = 0;
+    MobileGL::MG_Impl::GLImpl::GetInteger64v(GL_MAX_SHADER_STORAGE_BLOCK_SIZE, &ssboBlockSize64);
+    EXPECT_EQ(static_cast<GLint64>(ssboBlockSize), std::min<GLint64>(ssboBlockSize64, INT32_MAX));
+
+    GLint atomicBindings = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_MAX_ATOMIC_COUNTER_BUFFER_BINDINGS, &atomicBindings);
+    EXPECT_GE(atomicBindings, 1);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint atomicBufferSize = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE, &atomicBufferSize);
+    EXPECT_GE(atomicBufferSize, 32); // GL 4.6 table 23.63 minimum
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // KHR_debug requires these to be legal even while the debug entry points are stubs.
+    GLint debugGroupDepth = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_MAX_DEBUG_GROUP_STACK_DEPTH, &debugGroupDepth);
+    EXPECT_GE(debugGroupDepth, 64);
+    GLint debugLoggedMessages = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_MAX_DEBUG_LOGGED_MESSAGES, &debugLoggedMessages);
+    EXPECT_GE(debugLoggedMessages, 1);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+// GL 4.6 core 6.1.1: glBindBufferRange validates the (offset, size) pair before it writes any
+// state. Nothing validated either one, so a negative offset reached Range1D(offset, offset + size)
+// - which has no ordering check of its own - and a zero or negative size installed an empty or
+// backwards range on the binding point.
+TEST_F(BufferTest, BindBufferRangeRejectsNegativeOffsetAndNonPositiveSize) {
+    GLint ssboAlignment = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT, &ssboAlignment);
+    ASSERT_GT(ssboAlignment, 0);
+
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_SHADER_STORAGE_BUFFER, ssboAlignment * 4, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    auto& point = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, 2);
+
+    // A negative offset is INVALID_VALUE - including one that is a multiple of the alignment, which
+    // the modulo gate alone waves through (-alignment % alignment == 0).
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 2, buffer, -ssboAlignment, ssboAlignment);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(point.GetBoundObject(), nullptr) << "a rejected bind must not take effect";
+
+    // size must be strictly positive.
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 2, buffer, 0, 0);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 2, buffer, 0, -4);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(point.GetBoundObject(), nullptr);
+
+    // The well-formed bind still goes through.
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 2, buffer, ssboAlignment, ssboAlignment);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    ASSERT_NE(point.GetBoundObject(), nullptr);
+    EXPECT_EQ(point.GetRange().start, static_cast<SizeT>(ssboAlignment));
+    EXPECT_EQ(point.GetRange().end, static_cast<SizeT>(ssboAlignment * 2));
+
+    // Buffer 0 detaches with offset and size ignored: the one case the size rule must not fire on,
+    // and the shape glBindBuffersRange uses to reset an element.
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_SHADER_STORAGE_BUFFER, 2, 0, 0, 0);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_EQ(point.GetBoundObject(), nullptr);
+
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
+// GL 4.6 core 6.1.1 gives GL_UNIFORM_BUFFER its own offset alignment
+// (GL_UNIFORM_BUFFER_OFFSET_ALIGNMENT) and requires BOTH offset and size to be multiples of 4 on
+// GL_TRANSFORM_FEEDBACK_BUFFER. Only the shader-storage half of the rule was implemented, so a
+// misaligned uniform range bound happily.
+TEST_F(BufferTest, BindBufferRangeEnforcesUniformAndTransformFeedbackAlignment) {
+    GLint uboAlignment = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_UNIFORM_BUFFER_OFFSET_ALIGNMENT, &uboAlignment);
+    ASSERT_GT(uboAlignment, 1) << "a 1-byte alignment cannot express a misaligned offset";
+
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_UNIFORM_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_UNIFORM_BUFFER, uboAlignment * 4, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    auto& uniformPoint = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::Uniform, 1);
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_UNIFORM_BUFFER, 1, buffer, 1, uboAlignment);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(uniformPoint.GetBoundObject(), nullptr) << "a misaligned uniform range must not bind";
+
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_UNIFORM_BUFFER, 1, buffer, uboAlignment, uboAlignment);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_NE(uniformPoint.GetBoundObject(), nullptr);
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_UNIFORM_BUFFER, 1, 0, 0, 0);
+    EXPECT_EQ(uniformPoint.GetBoundObject(), nullptr);
+
+    // Transform feedback captures 32-bit components: offset and size are both constrained, and the
+    // size half has no analogue on any other target.
+    auto& feedbackPoint =
+        MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::TransformFeedback, 0);
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer, 2, 4);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(feedbackPoint.GetBoundObject(), nullptr);
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer, 4, 2);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(feedbackPoint.GetBoundObject(), nullptr);
+
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer, 4, 4);
+    EXPECT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_NE(feedbackPoint.GetBoundObject(), nullptr);
+
+    MobileGL::MG_Impl::GLImpl::BindBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0, 0, 0);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_UNIFORM_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
+// ARB_multi_bind checks offsets and sizes separately for each binding point: the offending element
+// is left unchanged and reports INVALID_VALUE while every other element still binds. Only the
+// [first, first + count) range is the up-front, all-or-nothing check - so glBindBuffersRange gets
+// the new gates by looping over the single-bind entry point, and must keep going after one fails.
+TEST_F(BufferTest, BindBuffersRangeAppliesTheOffsetAndSizeGatesPerElement) {
+    GLint ssboAlignment = 0;
+    MobileGL::MG_Impl::GLImpl::GetIntegerv(GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT, &ssboAlignment);
+    ASSERT_GT(ssboAlignment, 1) << "a 1-byte alignment cannot express a misaligned offset";
+
+    GLuint buffer = 0;
+    MobileGL::MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+    MobileGL::MG_Impl::GLImpl::BufferData(GL_SHADER_STORAGE_BUFFER, ssboAlignment * 8, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    auto& firstPoint = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, 0);
+    auto& secondPoint = MobileGL::MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, 1);
+    const GLuint buffers[2] = {buffer, buffer};
+
+    // Element 0 is misaligned; element 1 is well formed and must still be bound.
+    const GLintptr misalignedOffsets[2] = {1, ssboAlignment};
+    const GLsizeiptr sizes[2] = {ssboAlignment, ssboAlignment};
+    MobileGL::MG_Impl::GLImpl::BindBuffersRange(GL_SHADER_STORAGE_BUFFER, 0, 2, buffers, misalignedOffsets, sizes);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(firstPoint.GetBoundObject(), nullptr) << "the rejected element must not bind";
+    ASSERT_NE(secondPoint.GetBoundObject(), nullptr) << "a per-element error must not abort the rest of the range";
+    EXPECT_EQ(secondPoint.GetRange().start, static_cast<SizeT>(ssboAlignment));
+
+    MobileGL::MG_Impl::GLImpl::BindBufferBase(GL_SHADER_STORAGE_BUFFER, 1, 0);
+    ASSERT_EQ(MobileGL::MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // Same for a non-positive size, on the other element this time.
+    const GLintptr offsets[2] = {0, ssboAlignment};
+    const GLsizeiptr badSizes[2] = {ssboAlignment, 0};
+    MobileGL::MG_Impl::GLImpl::BindBuffersRange(GL_SHADER_STORAGE_BUFFER, 0, 2, buffers, offsets, badSizes);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_NE(firstPoint.GetBoundObject(), nullptr);
+    EXPECT_EQ(secondPoint.GetBoundObject(), nullptr);
+
+    MobileGL::MG_Impl::GLImpl::BindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, 0);
+    MobileGL::MG_Impl::GLImpl::BindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+    MobileGL::MG_Impl::GLImpl::DeleteBuffers(1, &buffer);
+    DrainPendingGlErrors();
+}
+
 using namespace MobileGL::MG_Impl::GLImpl;
 
 class GeneralBufferTest : public ::testing::Test {

MobileGL/MG_Test/Framebuffer/FramebufferTest.cpp

@@ -13,10 +13,13 @@
 #include "Includes.h"
 #include "Init.h"
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Backend/DirectGLES/DirectGLES.h>
+#include <MG_Backend/DirectGLES/Managers.h>
 #include <MG_Backend/DirectGLES/Utils.h>
 #include <MG_Impl/GLImpl/Buffer/GL_Buffer.h>
 #include <MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h>
 #include <MG_Impl/GLImpl/Getter/GL_Getter.h>
+#include <MG_Impl/GLImpl/RenderState/GL_RenderState.h>
 #include <MG_Impl/GLImpl/Texture/GL_Texture.h>
 #include <MG_State/GLState/Core.h>
 
@@ -858,3 +861,394 @@ TEST_F(FramebufferTest, NonRenderableColorFormatsReportUnsupportedFramebuffer) {
     MG_Impl::GLImpl::ReadPixels(0, 0, 4, 4, GL_RGBA, GL_UNSIGNED_BYTE, pixelStorage);
     EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_INVALID_FRAMEBUFFER_OPERATION);
 }
+
+// ---- Three-channel colour attachments: the Complementary Reimagined / Iris load failure --------
+//
+// Complementary declares colortex1 = RGB8_SNORM and colortex2 = RGB16F. No real OpenGL ES driver
+// renders to a three-channel image (EXT_render_snorm covers R/RG/RGBA only; EXT_color_buffer_float
+// excludes RGB16F), so the DirectGLES probe records those formats as creatable-but-not-renderable
+// and the frontend answered every framebuffer built from them GL_FRAMEBUFFER_UNSUPPORTED - which
+// Iris turns into a hard "Draw buffers [0, 1] Status: 36061" load failure. The backend now records
+// the four-channel substitution it will actually allocate as a caveat capability, and the frontend
+// has to accept that as renderable.
+namespace {
+    class ThreeChannelAttachmentBackend final : public MG_Backend::BackendObject {
+    public:
+        // `substituted` stands in for a driver where the four-channel widening probe succeeded, i.e.
+        // for what PopulateFormatCapabilitiesImpl records on Mali. false is the pre-fix state: the
+        // native form is creatable, nothing is renderable, and no fallback was ever built.
+        explicit ThreeChannelAttachmentBackend(Bool substituted) {
+            auto& cache = MutableFormatCapabilities();
+            const auto texture2DIndex = MG_Backend::GetFormatCapabilityTargetIndex(TextureTarget::Texture2D);
+
+            // IsColorInternalFormatRenderable only trusts the cache once it looks populated, which
+            // it decides from RGBA8 being creatable somewhere. Without this the static deny-list
+            // answers instead and the caveat below would never be consulted.
+            const auto rgba8Index = static_cast<SizeT>(TextureInternalFormat::RGBA8);
+            cache.FullCaps[texture2DIndex][rgba8Index] |= MG_Backend::FormatCapability::Creatable;
+            cache.FullCaps[texture2DIndex][rgba8Index] |= MG_Backend::FormatCapability::FramebufferRenderable;
+            cache.FullCaps[texture2DIndex][rgba8Index] |= MG_Backend::FormatCapability::ColorAttachment;
+
+            for (const TextureInternalFormat format :
+                 {TextureInternalFormat::RGB8Snorm, TextureInternalFormat::RGB16F}) {
+                const auto formatIndex = static_cast<SizeT>(format);
+                // Creatable and samplable as an ordinary texture, but the driver's
+                // glCheckFramebufferStatus said no - exactly Mali r32p1's answer.
+                cache.FullCaps[texture2DIndex][formatIndex] |= MG_Backend::FormatCapability::Creatable;
+                cache.FullCaps[texture2DIndex][formatIndex] |= MG_Backend::FormatCapability::Sampled;
+                if (substituted) {
+                    cache.CaveatCaps[texture2DIndex][formatIndex] |=
+                        MG_Backend::FormatCapability::FramebufferRenderable;
+                    cache.CaveatCaps[texture2DIndex][formatIndex] |= MG_Backend::FormatCapability::ColorAttachment;
+                }
+            }
+        }
+
+        void Initialize() override {}
+        Bool InitCapabilities() override { return true; }
+        Bool InitWindowSurface() override { return true; }
+        const RendererInfo& GetRendererInfo() const override {
+            static RendererInfo info = {};
+            return info;
+        }
+        String GetBackendAPIVersionString() const override { return {}; }
+        const MG_Backend::GlobalBackendFunctionsTable& GetBackendFunctions() const override {
+            static MG_Backend::GlobalBackendFunctionsTable table = {};
+            return table;
+        }
+        const MG_Backend::DynamicBackendParameters& GetDynamicParameters() const override {
+            static MG_Backend::DynamicBackendParameters params = {};
+            return params;
+        }
+        BackendType GetBackendType() const override { return BackendType::Unknown; }
+    };
+
+    class ScopedBackendOverride {
+    public:
+        explicit ScopedBackendOverride(UniquePtr<MG_Backend::BackendObject> backend):
+            m_previous(Move(MG_Backend::pActiveBackendObject)) {
+            MG_Backend::pActiveBackendObject = Move(backend);
+        }
+
+        ~ScopedBackendOverride() { MG_Backend::pActiveBackendObject = Move(m_previous); }
+
+    private:
+        UniquePtr<MG_Backend::BackendObject> m_previous;
+    };
+
+    GLenum CheckSingleColorAttachmentStatus(GLenum internalFormat) {
+        GLuint framebuffer = 0;
+        GLuint texture = 0;
+        MG_Impl::GLImpl::CreateFramebuffers(1, &framebuffer);
+        MG_Impl::GLImpl::CreateTextures(GL_TEXTURE_2D, 1, &texture);
+        MG_Impl::GLImpl::TextureStorage2D(texture, 1, internalFormat, 4, 4);
+        MG_Impl::GLImpl::NamedFramebufferTexture(framebuffer, GL_COLOR_ATTACHMENT0, texture, 0);
+        return MG_Impl::GLImpl::CheckNamedFramebufferStatus(framebuffer, GL_DRAW_FRAMEBUFFER);
+    }
+} // namespace
+
+TEST_F(FramebufferTest, ThreeChannelColorAttachmentsAreUnsupportedWithoutTheWidenedSubstitution) {
+    // The pre-fix behaviour, pinned so a regression is a red test rather than a shaderpack that
+    // silently stops loading: no caveat capability, so nothing makes these renderable.
+    ScopedBackendOverride backend(MakeUnique<ThreeChannelAttachmentBackend>(/*substituted=*/false));
+
+    EXPECT_EQ(CheckSingleColorAttachmentStatus(GL_RGB8_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_UNSUPPORTED));
+    EXPECT_EQ(CheckSingleColorAttachmentStatus(GL_RGB16F), static_cast<GLenum>(GL_FRAMEBUFFER_UNSUPPORTED));
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+TEST_F(FramebufferTest, ThreeChannelColorAttachmentsAreCompleteThroughTheWidenedSubstitution) {
+    ScopedBackendOverride backend(MakeUnique<ThreeChannelAttachmentBackend>(/*substituted=*/true));
+
+    // Complementary's colortex1 (RGB8_SNORM) and colortex2 (RGB16F): both must come out COMPLETE,
+    // because the backend stores them as GL_RGBA16F. Shipping only the first would move the
+    // failure one composite pass down instead of fixing it.
+    EXPECT_EQ(CheckSingleColorAttachmentStatus(GL_RGB8_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+    EXPECT_EQ(CheckSingleColorAttachmentStatus(GL_RGB16F), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+TEST_F(FramebufferTest, TwoAttachmentCompositeFramebufferMatchesIrisComplementaryPass) {
+    // The exact framebuffer Iris failed on: Complementary's `composite` pass draws to colortex7
+    // (RGBA16F, natively renderable) and colortex1 (RGB8_SNORM, only renderable widened). Iris
+    // logs it as "Draw buffers [0, 1]" - a two-attachment FBO, not colortex 0 and 1.
+    ScopedBackendOverride backend(MakeUnique<ThreeChannelAttachmentBackend>(/*substituted=*/true));
+
+    GLuint framebuffer = 0;
+    GLuint colortex7 = 0;
+    GLuint colortex1 = 0;
+    MG_Impl::GLImpl::CreateFramebuffers(1, &framebuffer);
+    MG_Impl::GLImpl::CreateTextures(GL_TEXTURE_2D, 1, &colortex7);
+    MG_Impl::GLImpl::CreateTextures(GL_TEXTURE_2D, 1, &colortex1);
+    MG_Impl::GLImpl::TextureStorage2D(colortex7, 1, GL_RGBA8, 4, 4);
+    MG_Impl::GLImpl::TextureStorage2D(colortex1, 1, GL_RGB8_SNORM, 4, 4);
+    MG_Impl::GLImpl::NamedFramebufferTexture(framebuffer, GL_COLOR_ATTACHMENT0, colortex7, 0);
+    MG_Impl::GLImpl::NamedFramebufferTexture(framebuffer, GL_COLOR_ATTACHMENT1, colortex1, 0);
+
+    EXPECT_EQ(MG_Impl::GLImpl::CheckNamedFramebufferStatus(framebuffer, GL_DRAW_FRAMEBUFFER),
+              static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+    // Both entry points answer from the same helpers, and CheckFramebufferStatus is what Iris
+    // actually calls; they are near-verbatim duplicates, so assert they agree.
+    MG_Impl::GLImpl::BindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffer);
+    EXPECT_EQ(MG_Impl::GLImpl::CheckFramebufferStatus(GL_DRAW_FRAMEBUFFER),
+              static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+// ---- Widened attachments: the stored-alpha discipline -----------------------------------------
+//
+// A widened attachment has a real alpha channel the application's three-channel format does not,
+// and GL says a channel a format lacks reads back as 1.0. glReadPixels and glGetTexImage can be
+// made to say that (ForceWideReadAlphaToOne), but GL_DST_ALPHA / GL_ONE_MINUS_DST_ALPHA blending
+// and glBlitFramebuffer read the STORED alpha inside the driver, where nothing can intercept it.
+// So the stored alpha is held at 1.0 instead: a clear writes 1.0 into it, and every draw has that
+// buffer's alpha write mask forced off so nothing can move it again.
+//
+// These cases pin the two halves of that pairing at the seam where they are visible - what the ES
+// driver is actually handed - and pin the invariant that the application's own colour mask is
+// never touched.
+namespace {
+    struct RecordedColorMask {
+        Bool seen = false;
+        GLboolean r = GL_FALSE, g = GL_FALSE, b = GL_FALSE, a = GL_FALSE;
+    };
+
+    constexpr Uint kRecordedDrawBuffers = 8;
+    RecordedColorMask g_driverIndexedColorMasks[kRecordedDrawBuffers];
+    RecordedColorMask g_driverUniformColorMask;
+
+    void ResetRecordedColorMasks() {
+        for (auto& recorded : g_driverIndexedColorMasks) recorded = {};
+        g_driverUniformColorMask = {};
+    }
+
+    void StubColorMask(GLboolean r, GLboolean g, GLboolean b, GLboolean a) {
+        g_driverUniformColorMask = {true, r, g, b, a};
+        // The non-indexed call sets every draw buffer, so record it as such: a later assertion
+        // about draw buffer 1 must not read a stale indexed record the uniform push overwrote.
+        for (auto& recorded : g_driverIndexedColorMasks) recorded = {true, r, g, b, a};
+    }
+
+    void StubColorMaski(GLuint index, GLboolean r, GLboolean g, GLboolean b, GLboolean a) {
+        if (index < kRecordedDrawBuffers) g_driverIndexedColorMasks[index] = {true, r, g, b, a};
+    }
+
+    void StubViewport(GLint, GLint, GLsizei, GLsizei) {}
+    void StubScissor(GLint, GLint, GLsizei, GLsizei) {}
+    void StubEnable(GLenum) {}
+    void StubDisable(GLenum) {}
+    void StubEnablei(GLenum, GLuint) {}
+    void StubDisablei(GLenum, GLuint) {}
+    void StubBlendFuncSeparate(GLenum, GLenum, GLenum, GLenum) {}
+    void StubBlendFuncSeparatei(GLuint, GLenum, GLenum, GLenum, GLenum) {}
+    void StubBlendEquationSeparate(GLenum, GLenum) {}
+    void StubBlendEquationSeparatei(GLuint, GLenum, GLenum) {}
+    void StubBlendColor(GLfloat, GLfloat, GLfloat, GLfloat) {}
+    void StubDepthFunc(GLenum) {}
+    void StubDepthMask(GLboolean) {}
+    void StubDepthRangef(GLfloat, GLfloat) {}
+    void StubStencilFuncSeparate(GLenum, GLenum, GLint, GLuint) {}
+    void StubStencilMaskSeparate(GLenum, GLuint) {}
+    void StubStencilOpSeparate(GLenum, GLenum, GLenum, GLenum) {}
+    void StubClearColor(GLfloat, GLfloat, GLfloat, GLfloat) {}
+    void StubClearDepthf(GLfloat) {}
+    void StubClearStencil(GLint) {}
+    void StubCullFace(GLenum) {}
+    void StubFrontFace(GLenum) {}
+    void StubPolygonOffset(GLfloat, GLfloat) {}
+    void StubLineWidth(GLfloat) {}
+    void StubSampleCoverage(GLfloat, GLboolean) {}
+
+    // Replaces the ES function table with no-ops that record only what these cases assert on.
+    // The table is ZEROED first on purpose: SyncRenderState is long, and a call it makes that
+    // this fixture did not anticipate must crash here rather than silently reach a stale pointer
+    // into a driver that this process never made current.
+    class ScopedRenderStateDriverStubs {
+    public:
+        ScopedRenderStateDriverStubs():
+            m_funcs(MG_Backend::DirectGLES::g_GLESFuncs), m_caps(MG_Backend::DirectGLES::g_GLESCapabilities) {
+            auto& gl = MG_Backend::DirectGLES::g_GLESFuncs;
+            gl = MG_External::GLESFunctionsTable{};
+            gl.glViewport = StubViewport;
+            gl.glScissor = StubScissor;
+            gl.glEnable = StubEnable;
+            gl.glDisable = StubDisable;
+            gl.glEnablei = StubEnablei;
+            gl.glDisablei = StubDisablei;
+            gl.glBlendFuncSeparate = StubBlendFuncSeparate;
+            gl.glBlendFuncSeparatei = StubBlendFuncSeparatei;
+            gl.glBlendEquationSeparate = StubBlendEquationSeparate;
+            gl.glBlendEquationSeparatei = StubBlendEquationSeparatei;
+            gl.glBlendColor = StubBlendColor;
+            gl.glDepthFunc = StubDepthFunc;
+            gl.glDepthMask = StubDepthMask;
+            gl.glDepthRangef = StubDepthRangef;
+            gl.glStencilFuncSeparate = StubStencilFuncSeparate;
+            gl.glStencilMaskSeparate = StubStencilMaskSeparate;
+            gl.glStencilOpSeparate = StubStencilOpSeparate;
+            gl.glClearColor = StubClearColor;
+            gl.glClearDepthf = StubClearDepthf;
+            gl.glClearStencil = StubClearStencil;
+            gl.glCullFace = StubCullFace;
+            gl.glFrontFace = StubFrontFace;
+            gl.glPolygonOffset = StubPolygonOffset;
+            gl.glLineWidth = StubLineWidth;
+            gl.glSampleCoverage = StubSampleCoverage;
+            gl.glColorMask = StubColorMask;
+            gl.glColorMaski = StubColorMaski;
+
+            auto& caps = MG_Backend::DirectGLES::g_GLESCapabilities;
+            caps.SupportsIndexedColorMask = true;
+            caps.SupportsSrgbWriteControl = false;
+            caps.SupportsPolygonMode = false;
+            caps.SupportsDualSourceBlend = true;
+
+            ResetRecordedColorMasks();
+            // The viewport and scissor blocks fall back to querying the surface size when the
+            // frontend's rectangle is degenerate, and there is no surface in this process.
+            MG_Impl::GLImpl::Viewport(0, 0, 4, 4);
+            MG_Impl::GLImpl::Scissor(0, 0, 4, 4);
+            MG_Backend::DirectGLES::RenderStateImpl::InvalidateSyncedRenderState();
+        }
+
+        ~ScopedRenderStateDriverStubs() {
+            MG_Backend::DirectGLES::FramebufferImpl::g_alphaWidenedDrawBufferMask = 0;
+            MG_Backend::DirectGLES::g_GLESFuncs = m_funcs;
+            MG_Backend::DirectGLES::g_GLESCapabilities = m_caps;
+            // The shadow now describes pushes that went to the stubs, not to any driver.
+            MG_Backend::DirectGLES::RenderStateImpl::InvalidateSyncedRenderState();
+            MG_Impl::GLImpl::ColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+        }
+
+    private:
+        MG_External::GLESFunctionsTable m_funcs;
+        MG_External::GLESCapabilities m_caps;
+    };
+} // namespace
+
+TEST_F(FramebufferTest, WidenedDrawBufferIsIdentifiedPerDrawBufferSlotNotPerAttachmentPoint) {
+    ScopedBackendOverride backend(MakeUnique<ThreeChannelAttachmentBackend>(/*substituted=*/true));
+
+    // Complementary's `composite` framebuffer again: draw buffer 0 is a natively renderable
+    // RGBA8, draw buffer 1 is the widened RGB8_SNORM. Only the second may be doctored.
+    GLuint framebuffer = 0;
+    GLuint colortex7 = 0;
+    GLuint colortex1 = 0;
+    MG_Impl::GLImpl::CreateFramebuffers(1, &framebuffer);
+    MG_Impl::GLImpl::CreateTextures(GL_TEXTURE_2D, 1, &colortex7);
+    MG_Impl::GLImpl::CreateTextures(GL_TEXTURE_2D, 1, &colortex1);
+    MG_Impl::GLImpl::TextureStorage2D(colortex7, 1, GL_RGBA8, 4, 4);
+    MG_Impl::GLImpl::TextureStorage2D(colortex1, 1, GL_RGB8_SNORM, 4, 4);
+    MG_Impl::GLImpl::NamedFramebufferTexture(framebuffer, GL_COLOR_ATTACHMENT0, colortex7, 0);
+    MG_Impl::GLImpl::NamedFramebufferTexture(framebuffer, GL_COLOR_ATTACHMENT1, colortex1, 0);
+
+    auto& framebufferObject = MG_State::pGLContext->GetFramebufferObject(framebuffer);
+    ASSERT_NE(framebufferObject, nullptr);
+    framebufferObject->SetDrawBuffer(0, FramebufferAttachmentType::Color0);
+    framebufferObject->SetDrawBuffer(1, FramebufferAttachmentType::Color1);
+
+    EXPECT_EQ(MG_Backend::DirectGLES::FramebufferImpl::ComputeAlphaWidenedDrawBufferMask(*framebufferObject),
+              1u << 1);
+
+    // Swapping the draw-buffer array moves the bit with the SLOT, not with the attachment point:
+    // glColorMaski and glClearBufferfv both address slots.
+    framebufferObject->SetDrawBuffer(0, FramebufferAttachmentType::Color1);
+    framebufferObject->SetDrawBuffer(1, FramebufferAttachmentType::Color0);
+    EXPECT_EQ(MG_Backend::DirectGLES::FramebufferImpl::ComputeAlphaWidenedDrawBufferMask(*framebufferObject),
+              1u << 0);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+TEST_F(FramebufferTest, DrawIntoAWidenedDrawBufferReachesTheDriverWithAlphaWritesMaskedOff) {
+    ScopedRenderStateDriverStubs driver;
+    MG_Backend::DirectGLES::FramebufferImpl::g_alphaWidenedDrawBufferMask = 1u << 1;
+
+    // What the application asked for: write every channel of every draw buffer.
+    MG_Impl::GLImpl::ColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+    MG_Backend::DirectGLES::RenderStateImpl::SyncRenderState(/*forColorClear=*/false);
+
+    // What the driver was told. Draw buffer 0 is untouched; draw buffer 1 loses alpha.
+    ASSERT_TRUE(g_driverIndexedColorMasks[0].seen);
+    EXPECT_EQ(g_driverIndexedColorMasks[0].r, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[0].g, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[0].b, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[0].a, GL_TRUE);
+    ASSERT_TRUE(g_driverIndexedColorMasks[1].seen);
+    EXPECT_EQ(g_driverIndexedColorMasks[1].r, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[1].g, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[1].b, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[1].a, GL_FALSE) << "a widened draw buffer must not take alpha writes";
+
+    // And what the application sees back. The doctoring lives entirely on the push; the frontend
+    // state it is derived from is never written, so glGet still answers with the app's value.
+    GLboolean appMask[4] = {GL_FALSE, GL_FALSE, GL_FALSE, GL_FALSE};
+    MG_Impl::GLImpl::GetBooleanv(GL_COLOR_WRITEMASK, appMask);
+    EXPECT_EQ(appMask[0], GL_TRUE);
+    EXPECT_EQ(appMask[1], GL_TRUE);
+    EXPECT_EQ(appMask[2], GL_TRUE);
+    EXPECT_EQ(appMask[3], GL_TRUE) << "glGet(GL_COLOR_WRITEMASK) must report the application's mask";
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+TEST_F(FramebufferTest, ClearIntoAWidenedDrawBufferKeepsAlphaWritableAndSubstitutesOne) {
+    ScopedRenderStateDriverStubs driver;
+    MG_Backend::DirectGLES::FramebufferImpl::g_alphaWidenedDrawBufferMask = 1u << 1;
+    MG_Impl::GLImpl::ColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+
+    // A draw first, so the mask really is doctored when the clear arrives...
+    MG_Backend::DirectGLES::RenderStateImpl::SyncRenderState(/*forColorClear=*/false);
+    ASSERT_EQ(g_driverIndexedColorMasks[1].a, GL_FALSE);
+
+    // ...and now the clear, with NOTHING changed in the frontend parameter block. The frontend's
+    // render-state version has not moved, so only the purpose-aware memo can force this push -
+    // without it the clear would inherit the draw's alpha-off mask and never write the 1.0.
+    ResetRecordedColorMasks();
+    MG_Backend::DirectGLES::RenderStateImpl::SyncRenderState(/*forColorClear=*/true);
+    ASSERT_TRUE(g_driverIndexedColorMasks[1].seen) << "the clear must re-push the colour mask";
+    EXPECT_EQ(g_driverIndexedColorMasks[1].a, GL_TRUE) << "a clear is what puts the 1.0 in the stored alpha";
+
+    // The value that clear writes: the application's RGB, alpha replaced by the 1.0 the
+    // three-channel format implies, and only on the widened buffer.
+    const GLfloat appColor[4] = {0.25f, 0.5f, 0.75f, 0.0f};
+    GLfloat scratch[4] = {};
+    const GLfloat* widened =
+        MG_Backend::DirectGLES::FramebufferImpl::SubstituteWidenedClearAlpha(appColor, true, 1.0f, scratch);
+    EXPECT_EQ(widened[0], 0.25f);
+    EXPECT_EQ(widened[1], 0.5f);
+    EXPECT_EQ(widened[2], 0.75f);
+    EXPECT_EQ(widened[3], 1.0f);
+
+    const GLfloat* untouched =
+        MG_Backend::DirectGLES::FramebufferImpl::SubstituteWidenedClearAlpha(appColor, false, 1.0f, scratch);
+    EXPECT_EQ(untouched, appColor) << "a native attachment's clear must not even be copied";
+
+    // An integer widened format (GL_RGB8UI -> GL_RGBA8UI) carries the INTEGER one, not a
+    // saturated field: glClearBufferuiv takes the value verbatim.
+    const GLuint appIntegerColor[4] = {7u, 8u, 9u, 0u};
+    GLuint integerScratch[4] = {};
+    const GLuint* widenedInteger = MG_Backend::DirectGLES::FramebufferImpl::SubstituteWidenedClearAlpha(
+        appIntegerColor, true, GLuint(1), integerScratch);
+    EXPECT_EQ(widenedInteger[3], 1u);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+TEST_F(FramebufferTest, ApplicationAlphaMaskOffIsStillHonouredOnANativeDrawBuffer) {
+    // The doctoring only ever REMOVES alpha writes on a widened buffer; it must never add them
+    // back on a buffer the application masked itself, and must never touch a native one.
+    ScopedRenderStateDriverStubs driver;
+    MG_Backend::DirectGLES::FramebufferImpl::g_alphaWidenedDrawBufferMask = 1u << 1;
+
+    MG_Impl::GLImpl::ColorMaski(0, GL_TRUE, GL_TRUE, GL_TRUE, GL_FALSE);
+    MG_Impl::GLImpl::ColorMaski(1, GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+    MG_Impl::GLImpl::ColorMaski(2, GL_FALSE, GL_TRUE, GL_FALSE, GL_TRUE);
+    MG_Backend::DirectGLES::RenderStateImpl::SyncRenderState(/*forColorClear=*/false);
+
+    EXPECT_EQ(g_driverIndexedColorMasks[0].a, GL_FALSE) << "the application's own alpha mask survives";
+    EXPECT_EQ(g_driverIndexedColorMasks[1].a, GL_FALSE) << "the widened buffer loses alpha";
+    EXPECT_EQ(g_driverIndexedColorMasks[2].r, GL_FALSE);
+    EXPECT_EQ(g_driverIndexedColorMasks[2].g, GL_TRUE);
+    EXPECT_EQ(g_driverIndexedColorMasks[2].b, GL_FALSE);
+    EXPECT_EQ(g_driverIndexedColorMasks[2].a, GL_TRUE) << "a native buffer keeps its alpha writes";
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}

MobileGL/MG_Test/Program/CMakeLists.txt

@@ -130,6 +130,22 @@ target_link_libraries(
         ${LINK_LIBRARIES}
 )
 
+add_executable(
+        ProgramInterfaceTest
+        ProgramInterfaceTest.cpp
+)
+
+target_include_directories(ProgramInterfaceTest PRIVATE
+        ${MGL_ROOT}/include
+        ${MGL_ROOT}/MobileGL
+)
+
+target_link_libraries(
+        ProgramInterfaceTest PRIVATE
+        GTest::gtest_main
+        ${LINK_LIBRARIES}
+)
+
 target_include_directories(ProgramTest PRIVATE
         ${MGL_ROOT}/include
         ${MGL_ROOT}/MobileGL
@@ -144,6 +160,7 @@ target_link_libraries(
 include(GoogleTest)
 gtest_discover_tests(ProgramUtilTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
 gtest_discover_tests(ProgramTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
+gtest_discover_tests(ProgramInterfaceTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
 # Heavier than the rest of the unit suite by design: several cases deliberately saturate the
 # compile pool so there is something in flight to race against.
 gtest_discover_tests(AsyncCompileTest DISCOVERY_TIMEOUT 60 PROPERTIES LABELS unit TIMEOUT 300)

MobileGL/MG_Test/Program/ProgramTest.cpp

@@ -3091,3 +3091,148 @@ TEST_F(ProgramTest, PreprocessCacheOverflowKeepsCompilingCorrectly) {
     EXPECT_GE(GetUniformLocation(programB, "uColor"), 0);
     EXPECT_EQ(GetError(), GL_NO_ERROR);
 }
+
+// glUniformMatrix{2x3,2x4,3x2,3x4,4x2,4x3}fv and their twelve glProgramUniformMatrix* twins were
+// validate-only no-ops: they never took the value pointer at all. They upload column-at-a-time at
+// the std140 16-byte column stride, honouring `transpose`, and glGetUniformfv undoes that padding.
+TEST_F(ProgramTest, NonSquareMatrixUniformsRoundTripThroughTheGlobalUbo) {
+    const char* vsSource = R"(#version 430 core
+uniform mat2x3 uM2x3;
+uniform mat3x2 uM3x2;
+uniform mat4x3 uM4x3;
+uniform mat2 uM2;
+void main() {
+    vec3 a = uM2x3 * vec2(1.0);
+    vec2 b = uM3x2 * vec3(1.0);
+    vec3 c = uM4x3 * vec4(1.0);
+    vec2 d = uM2 * vec2(1.0);
+    gl_Position = vec4(a.xy + b + c.xy + d, 0.0, 1.0);
+}
+)";
+    const char* fsSource = R"(#version 430 core
+out vec4 fragColor;
+void main() { fragColor = vec4(1.0); }
+)";
+    GLuint vs = CompileShaderChecked(GL_VERTEX_SHADER, vsSource);
+    GLuint fs = CompileShaderChecked(GL_FRAGMENT_SHADER, fsSource);
+    GLuint program = LinkVsFs(vs, fs, GL_TRUE);
+    UseProgram(program);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    // matCxR is C columns of R rows, column-major: value[c * R + r].
+    const GLfloat m2x3[6] = {1, 2, 3, 4, 5, 6};
+    const GLfloat m3x2[6] = {1, 2, 3, 4, 5, 6};
+    const GLfloat m4x3[12] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12};
+
+    const GLint loc2x3 = GetUniformLocation(program, "uM2x3");
+    const GLint loc3x2 = GetUniformLocation(program, "uM3x2");
+    const GLint loc4x3 = GetUniformLocation(program, "uM4x3");
+    ASSERT_GE(loc2x3, 0);
+    ASSERT_GE(loc3x2, 0);
+    ASSERT_GE(loc4x3, 0);
+
+    UniformMatrix2x3fv(loc2x3, 1, GL_FALSE, m2x3);
+    UniformMatrix3x2fv(loc3x2, 1, GL_FALSE, m3x2);
+    UniformMatrix4x3fv(loc4x3, 1, GL_FALSE, m4x3);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    GLfloat readBack[12] = {};
+    GetUniformfv(program, loc2x3, readBack);
+    EXPECT_EQ(std::memcmp(readBack, m2x3, sizeof(m2x3)), 0);
+    std::memset(readBack, 0, sizeof(readBack));
+    GetUniformfv(program, loc3x2, readBack);
+    EXPECT_EQ(std::memcmp(readBack, m3x2, sizeof(m3x2)), 0);
+    std::memset(readBack, 0, sizeof(readBack));
+    GetUniformfv(program, loc4x3, readBack);
+    EXPECT_EQ(std::memcmp(readBack, m4x3, sizeof(m4x3)), 0);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+    // transpose = GL_TRUE means the source is row-major: a mat3x2 (3 columns, 2 rows) is then
+    // given as 2 rows of 3, so {1,2,3, 4,5,6} is the column-major {1,4, 2,5, 3,6}.
+    UniformMatrix3x2fv(loc3x2, 1, GL_TRUE, m3x2);
+    const GLfloat expectedTransposed3x2[6] = {1, 4, 2, 5, 3, 6};
+    std::memset(readBack, 0, sizeof(readBack));
+    GetUniformfv(program, loc3x2, readBack);
+    EXPECT_EQ(std::memcmp(readBack, expectedTransposed3x2, sizeof(expectedTransposed3x2)), 0);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+    // The glProgramUniform* twin writes the same bytes without the program being current.
+    UseProgram(0);
+    const GLfloat other2x3[6] = {9, 8, 7, 6, 5, 4};
+    ProgramUniformMatrix2x3fv(program, loc2x3, 1, GL_FALSE, other2x3);
+    std::memset(readBack, 0, sizeof(readBack));
+    GetUniformfv(program, loc2x3, readBack);
+    EXPECT_EQ(std::memcmp(readBack, other2x3, sizeof(other2x3)), 0);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+}
+
+// A mat2 is not four contiguous floats in the global UBO: std140 pads each column vector out to
+// 16 bytes, so column 1 starts at byte 16. Writing it packed put column 1 on top of column 0's
+// padding, where the shader never reads it.
+TEST_F(ProgramTest, Mat2UniformUsesTheStd140ColumnStride) {
+    const char* vsSource = R"(#version 430 core
+uniform mat2 uM2;
+void main() { gl_Position = vec4(uM2 * vec2(1.0), 0.0, 1.0); }
+)";
+    const char* fsSource = R"(#version 430 core
+out vec4 fragColor;
+void main() { fragColor = vec4(1.0); }
+)";
+    GLuint vs = CompileShaderChecked(GL_VERTEX_SHADER, vsSource);
+    GLuint fs = CompileShaderChecked(GL_FRAGMENT_SHADER, fsSource);
+    GLuint program = LinkVsFs(vs, fs, GL_TRUE);
+    UseProgram(program);
+    const GLint loc = GetUniformLocation(program, "uM2");
+    ASSERT_GE(loc, 0);
+
+    const GLfloat m2[4] = {1, 2, 3, 4};
+    UniformMatrix2fv(loc, 1, GL_FALSE, m2);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    // The GL-visible value is tightly packed...
+    GLfloat readBack[4] = {};
+    GetUniformfv(program, loc, readBack);
+    EXPECT_EQ(std::memcmp(readBack, m2, sizeof(m2)), 0);
+
+    // ...while the bytes in the UBO put column 1 at offset 16, not 8.
+    const auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+    ASSERT_NE(programObject, nullptr);
+    const auto* ubo = static_cast<const char*>(programObject->MapUBO());
+    ASSERT_NE(ubo, nullptr);
+    const Uint offset = programObject->GetUniformOffset(static_cast<Uint>(loc));
+    ASSERT_NE(offset, MG_State::GLState::ProgramObject::kInvalidUniformOffset);
+    GLfloat column0[2] = {};
+    GLfloat column1[2] = {};
+    std::memcpy(column0, ubo + offset, sizeof(column0));
+    std::memcpy(column1, ubo + offset + 16, sizeof(column1));
+    EXPECT_FLOAT_EQ(column0[0], 1.0f);
+    EXPECT_FLOAT_EQ(column0[1], 2.0f);
+    EXPECT_FLOAT_EQ(column1[0], 3.0f);
+    EXPECT_FLOAT_EQ(column1[1], 4.0f);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+}
+
+// GL 4.6 core 7.1: shaderType is an enum, so an unrecognised one is INVALID_ENUM - it used to be
+// reported as INVALID_VALUE. glCreateShaderProgramv adds a count < 0 gate ahead of everything.
+TEST_F(ProgramTest, CreateShaderAndCreateShaderProgramvReportTheRightErrorClasses) {
+    while (GetError() != GL_NO_ERROR) {
+    }
+
+    EXPECT_EQ(CreateShader(GL_FLOAT), 0u);
+    EXPECT_EQ(GetError(), GL_INVALID_ENUM);
+    EXPECT_EQ(GetError(), GL_NO_ERROR) << "the call recorded more than one error";
+
+    const char* source = "#version 330 core\nvoid main() { gl_Position = vec4(1.0); }\n";
+    EXPECT_EQ(CreateShaderProgramv(GL_FLOAT, 1, &source), 0u);
+    EXPECT_EQ(GetError(), GL_INVALID_ENUM);
+    EXPECT_EQ(GetError(), GL_NO_ERROR) << "the call recorded more than one error";
+
+    EXPECT_EQ(CreateShaderProgramv(GL_VERTEX_SHADER, -1, &source), 0u);
+    EXPECT_EQ(GetError(), GL_INVALID_VALUE);
+    EXPECT_EQ(GetError(), GL_NO_ERROR) << "the call recorded more than one error";
+
+    // A well-formed call still works.
+    const GLuint program = CreateShaderProgramv(GL_VERTEX_SHADER, 1, &source);
+    EXPECT_NE(program, 0u);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+}

MobileGL/MG_Test/SanityTest.cpp

@@ -1898,3 +1898,132 @@ TEST(FastSTLSanity, ErasingTheOnlyElementReturnsEnd) {
     EXPECT_EQ(next, map.end());
     EXPECT_TRUE(map.empty());
 }
+
+namespace {
+    // Records what the per-unit texture sync actually pushed at the driver: which backend
+    // texture id was current when each glTexImage2D landed, and the shape it was given.
+    struct TexSpecCall {
+        GLuint texture;
+        GLsizei width;
+        GLsizei height;
+    };
+    MobileGL::Vector<TexSpecCall>* g_texSpecCalls = nullptr;
+    GLuint g_texSpecBoundTexture = 0;
+
+    void TS_BindTexture(GLenum, GLuint texture) { g_texSpecBoundTexture = texture; }
+    void TS_ActiveTexture(GLenum) {}
+    void TS_TexParameteri(GLenum, GLenum, GLint) {}
+    void TS_TexParameterf(GLenum, GLenum, GLfloat) {}
+    void TS_TexParameterfv(GLenum, GLenum, const GLfloat*) {}
+    void TS_PixelStorei(GLenum, GLint) {}
+    void TS_BindBuffer(GLenum, GLuint) {}
+    void TS_TexImage2D(GLenum, GLint level, GLint, GLsizei width, GLsizei height, GLint, GLenum, GLenum,
+                       const void*) {
+        if (g_texSpecCalls && level == 0) {
+            g_texSpecCalls->push_back({g_texSpecBoundTexture, width, height});
+        }
+    }
+
+    // Clears the recording hook even when a gtest assertion unwinds the test body.
+    struct ScopedTexSpecRecording {
+        explicit ScopedTexSpecRecording(MobileGL::Vector<TexSpecCall>& sink) {
+            g_texSpecCalls = &sink;
+            g_texSpecBoundTexture = 0;
+        }
+        ~ScopedTexSpecRecording() { g_texSpecCalls = nullptr; }
+        ScopedTexSpecRecording(const ScopedTexSpecRecording&) = delete;
+        ScopedTexSpecRecording& operator=(const ScopedTexSpecRecording&) = delete;
+    };
+
+    // Gives `name` a complete single-level 2D image of the requested size without going through
+    // the frontend upload path (the mock table below wires only the state-pushing entry points).
+    MobileGL::SharedPtr<MobileGL::MG_State::GLState::ITextureObject> MakeComplete2DTexture(GLuint name,
+                                                                                           MobileGL::Int size) {
+        using namespace MobileGL;
+        MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, name);
+        auto object = MG_State::pGLContext->GetTextureUnitObject(0)
+                          .GetBindingSlot(TextureTarget::Texture2D)
+                          .GetBoundObject();
+        object->SetInternalFormat(TextureInternalFormat::RGBA8);
+        MG_State::GLState::AsMipmapTexture(object.get())
+            ->AllocateStorage(TextureUploadTarget::Texture2D, 0, {{size, size, 1}, 4});
+        return object;
+    }
+} // namespace
+
+// The per-unit texture sync memo BORROWS the binding slot: an entry holds a pointer to the
+// slot's shared_ptr plus the backend twin of whatever was in it when the entry was built. Its
+// keys (context id, bind-generation epoch, high-water mark, sampling generation) are the primary
+// guard, but they are all derived state - so the memo also has to survive a slot swap that never
+// reached them.
+//
+// It did not. The DSA by-name emulation swapped a slot silently, every key still matched, and
+// the replay drove texture A's backend twin from texture B's frontend object: A's backend
+// storage was re-specified with B's shape, destroying anything A only ever had on the GPU. On
+// Espryt + Iris/BSL that blanked Minecraft's 16x16 lightmap the moment a 2048x2048 shadow map
+// was uploaded through a by-name call, and since the text shader multiplies by the lightmap,
+// `if (color.a < 0.1) discard` then threw away every glyph in the process - HUD, menus and the
+// vanilla title screen alike.
+TEST(DirectGLESTextureSync, UnitMemoRefusesToDriveATwinFromAnotherTexture) {
+    using namespace MobileGL;
+    ScopedDirectGLESTextureBindings scoped; // fresh GLContext + registry + binding caches
+    Vector<TexSpecCall> specs;
+    ScopedTexSpecRecording recording(specs);
+
+    auto functions = MG_Backend::DirectGLES::g_GLESFuncs;
+    functions.glBindTexture = TS_BindTexture;
+    functions.glActiveTexture = TS_ActiveTexture;
+    functions.glTexImage2D = TS_TexImage2D;
+    functions.glTexParameteri = TS_TexParameteri;
+    functions.glTexParameterf = TS_TexParameterf;
+    functions.glTexParameterfv = TS_TexParameterfv;
+    functions.glPixelStorei = TS_PixelStorei;
+    functions.glBindBuffer = TS_BindBuffer;
+    MG_Backend::DirectGLES::SetGLESFuncsTable(functions);
+
+    GLuint names[2] = {};
+    MG_Impl::GLImpl::GenTextures(2, names);
+    // `foreign` stands in for the shadow map, `resident` for the lightmap. Both are fully
+    // specified BEFORE the first sync so that nothing between the two syncs can move the
+    // sampling-resolution generation and invalidate the memo for an unrelated reason.
+    const auto foreign = MakeComplete2DTexture(names[1], 32);
+    const auto resident = MakeComplete2DTexture(names[0], 16);
+    ASSERT_NE(foreign, nullptr);
+    ASSERT_NE(resident, nullptr);
+
+    // First sync: builds the memo with unit 0 -> `resident`, and gives `resident`'s twin its
+    // 16x16 backend storage.
+    MG_Backend::DirectGLES::TextureImpl::SyncNeccessaryTextures();
+    auto* residentSlot = MG_Backend::DirectGLES::TextureImpl::g_backendTextureObjects.Find(resident.get());
+    ASSERT_NE(residentSlot, nullptr);
+    ASSERT_NE(*residentSlot, nullptr);
+    const GLuint residentBackendId = (*residentSlot)->GetBackendTextureId();
+    ASSERT_NE(residentBackendId, 0u);
+    ASSERT_FALSE(specs.empty());
+    EXPECT_EQ(specs.back().texture, residentBackendId);
+    EXPECT_EQ(specs.back().width, 16);
+
+    // The hazard, reproduced at the state level: put `foreign` on the slot the memo borrows
+    // WITHOUT telling the binding accounting, exactly as the by-name emulation used to.
+    MG_State::pGLContext->GetTextureUnitObject(0).GetBindingSlot(TextureTarget::Texture2D).Bind(foreign);
+
+    const SizeT specsBeforeReplay = specs.size();
+    MG_Backend::DirectGLES::TextureImpl::SyncNeccessaryTextures();
+
+    // `foreign` must have been synced through its OWN twin...
+    auto* foreignSlot = MG_Backend::DirectGLES::TextureImpl::g_backendTextureObjects.Find(foreign.get());
+    ASSERT_NE(foreignSlot, nullptr);
+    ASSERT_NE(*foreignSlot, nullptr);
+    const GLuint foreignBackendId = (*foreignSlot)->GetBackendTextureId();
+    EXPECT_NE(foreignBackendId, residentBackendId);
+
+    // ...and above all, nothing may have re-specified the RESIDENT texture's backend storage.
+    // That single call is what destroyed the lightmap.
+    for (SizeT i = specsBeforeReplay; i < specs.size(); ++i) {
+        EXPECT_NE(specs[i].texture, residentBackendId)
+            << "the stale memo entry re-specified the resident texture's backend storage with "
+            << specs[i].width << "x" << specs[i].height;
+    }
+
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, 0);
+}

MobileGL/MG_Test/Texture/TextureTest.cpp

@@ -15,6 +15,7 @@
 #include <Config.h>
 #include <MG_Backend/BackendObjects.h>
 #include <MG_Backend/DirectGLES/Managers.h>
+#include <MG_Backend/DirectGLES/Utils.h>
 #include <MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h>
 #include <MG_Impl/GLImpl/Getter/GL_Getter.h>
 #include <MG_Impl/GLImpl/RenderState/GL_RenderState.h>
@@ -27,6 +28,7 @@
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToMG/TextureEnumConverter.h>
+#include <MG_Util/Converters/MGToStr/TextureEnumConverter.h>
 #include <MG_Util/Math/SmallFloat.h>
 #include <MG_Util/Texture/PixelStoreProcessor.h>
 #include <MG_Util/Texture/TextureFormatProcessor.h>
@@ -2672,3 +2674,505 @@ TEST_F(TextureTest, DecodeShadowDataToWideRGBACoversComponentAndPackedLayouts) {
         EXPECT_EQ(rgba[3], 2u);
     }
 }
+
+// GL 4.6 core table 23.18: GL_TEXTURE_COMPARE_FUNC takes the whole eight-function depth-compare
+// range. The validator used to start it at GL_LEQUAL, which sits in the middle of the contiguous
+// GL_NEVER..GL_ALWAYS block, so NEVER/LESS/EQUAL were rejected while GREATER/NOTEQUAL/GEQUAL only
+// got through because they happen to be numerically above LEQUAL.
+TEST_F(TextureTest, SamplerCompareFuncAcceptsTheWholeNeverToAlwaysRange) {
+    GLuint sampler = 0;
+    MG_Impl::GLImpl::GenSamplers(1, &sampler);
+    ASSERT_NE(sampler, 0u);
+
+    const GLenum compareFuncs[] = {GL_NEVER,   GL_LESS,     GL_EQUAL,  GL_LEQUAL,
+                                   GL_GREATER, GL_NOTEQUAL, GL_GEQUAL, GL_ALWAYS};
+    for (GLenum func : compareFuncs) {
+        MG_Impl::GLImpl::SamplerParameteri(sampler, GL_TEXTURE_COMPARE_FUNC, static_cast<GLint>(func));
+        EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR) << "compare func " << func << " was rejected";
+        GLint readBack = 0;
+        MG_Impl::GLImpl::GetSamplerParameteriv(sampler, GL_TEXTURE_COMPARE_FUNC, &readBack);
+        EXPECT_EQ(static_cast<GLenum>(readBack), func);
+        EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    }
+
+    // Just outside the block on both sides is still INVALID_ENUM.
+    MG_Impl::GLImpl::SamplerParameteri(sampler, GL_TEXTURE_COMPARE_FUNC, GL_NEVER - 1);
+    ExpectSingleGlError(GL_INVALID_ENUM);
+    MG_Impl::GLImpl::SamplerParameteri(sampler, GL_TEXTURE_COMPARE_FUNC, GL_ALWAYS + 1);
+    ExpectSingleGlError(GL_INVALID_ENUM);
+
+    MG_Impl::GLImpl::DeleteSamplers(1, &sampler);
+}
+
+// GL 4.6 core table 23.19: GL_TEXTURE_BINDING_* and GL_SAMPLER_BINDING are per-texture-unit, so
+// glGetIntegeri_v must answer for unit `index` - not fall through to the backend, which knows
+// nothing about the frontend's binding state.
+TEST_F(TextureTest, GetIntegeriVReportsPerUnitTextureAndSamplerBindings) {
+    GLuint textures[2] = {0, 0};
+    MG_Impl::GLImpl::GenTextures(2, textures);
+    ASSERT_NE(textures[0], 0u);
+    ASSERT_NE(textures[1], 0u);
+
+    MG_Impl::GLImpl::ActiveTexture(GL_TEXTURE0);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, textures[0]);
+    MG_Impl::GLImpl::ActiveTexture(GL_TEXTURE3);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, textures[1]);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint binding = -1;
+    MG_Impl::GLImpl::GetIntegeri_v(GL_TEXTURE_BINDING_2D, 0, &binding);
+    EXPECT_EQ(static_cast<GLuint>(binding), textures[0]);
+    MG_Impl::GLImpl::GetIntegeri_v(GL_TEXTURE_BINDING_2D, 3, &binding);
+    EXPECT_EQ(static_cast<GLuint>(binding), textures[1]);
+    // An unbound unit reports 0, and a target nothing was bound to reports 0 as well.
+    MG_Impl::GLImpl::GetIntegeri_v(GL_TEXTURE_BINDING_2D, 2, &binding);
+    EXPECT_EQ(binding, 0);
+    MG_Impl::GLImpl::GetIntegeri_v(GL_TEXTURE_BINDING_3D, 0, &binding);
+    EXPECT_EQ(binding, 0);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The non-indexed query keeps reporting the ACTIVE unit, which is still unit 3.
+    GLint activeUnitBinding = -1;
+    MG_Impl::GLImpl::GetIntegerv(GL_TEXTURE_BINDING_2D, &activeUnitBinding);
+    EXPECT_EQ(static_cast<GLuint>(activeUnitBinding), textures[1]);
+
+    GLuint sampler = 0;
+    MG_Impl::GLImpl::GenSamplers(1, &sampler);
+    ASSERT_NE(sampler, 0u);
+    MG_Impl::GLImpl::BindSampler(2, sampler);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    MG_Impl::GLImpl::GetIntegeri_v(GL_SAMPLER_BINDING, 2, &binding);
+    EXPECT_EQ(static_cast<GLuint>(binding), sampler);
+    MG_Impl::GLImpl::GetIntegeri_v(GL_SAMPLER_BINDING, 1, &binding);
+    EXPECT_EQ(binding, 0);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // Out of range is INVALID_VALUE, not a backend passthrough.
+    GLint maxUnits = 0;
+    MG_Impl::GLImpl::GetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &maxUnits);
+    ASSERT_GT(maxUnits, 0);
+    MG_Impl::GLImpl::GetIntegeri_v(GL_TEXTURE_BINDING_2D, static_cast<GLuint>(maxUnits) + 1024u, &binding);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+
+    MG_Impl::GLImpl::BindSampler(2, 0);
+    MG_Impl::GLImpl::DeleteSamplers(1, &sampler);
+    MG_Impl::GLImpl::ActiveTexture(GL_TEXTURE0);
+    MG_Impl::GLImpl::DeleteTextures(2, textures);
+    DrainPendingGlErrors();
+}
+
+// glGetFloati_v / glGetDoublei_v were no-op stubs: they left the caller's buffer holding whatever
+// was on the stack. They are converters over the integer indexed query.
+TEST_F(TextureTest, GetFloatiVAndGetDoubleiVConvertTheIndexedIntegerQuery) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    ASSERT_NE(texture, 0u);
+    MG_Impl::GLImpl::ActiveTexture(GL_TEXTURE1);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLfloat asFloat = -1.0f;
+    MG_Impl::GLImpl::GetFloati_v(GL_TEXTURE_BINDING_2D, 1, &asFloat);
+    EXPECT_FLOAT_EQ(asFloat, static_cast<GLfloat>(texture));
+
+    GLdouble asDouble = -1.0;
+    MG_Impl::GLImpl::GetDoublei_v(GL_TEXTURE_BINDING_2D, 1, &asDouble);
+    EXPECT_DOUBLE_EQ(asDouble, static_cast<GLdouble>(texture));
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    MG_Impl::GLImpl::ActiveTexture(GL_TEXTURE0);
+    MG_Impl::GLImpl::DeleteTextures(1, &texture);
+    DrainPendingGlErrors();
+}
+
+// GL 3.3 core 3.8.2: the unit glBindSampler accepts is bounded by
+// GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS. The gate read the frontend's MAX_TEXTURE_IMAGE_UNITS
+// instead - the capacity of the unit array, 192 - so every unit the backend does not have was
+// accepted, and the single-bind path disagreed with the multi-bind twin about where the units end.
+// The backend is stood in so the two limits are distinguishable no matter what the real one
+// advertises.
+TEST_F(TextureTest, BindSamplerRejectsUnitsBeyondMaxCombinedTextureImageUnits) {
+    GLuint sampler = 0;
+    MG_Impl::GLImpl::GenSamplers(1, &sampler);
+    ASSERT_NE(sampler, 0u);
+
+    constexpr GLint kCombinedUnits = 24;
+    static_assert(kCombinedUnits < MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS,
+                  "the stand-in limit has to be below the unit array capacity to tell the two apart");
+    auto backend = MakeUnique<FormatCapabilityBackend>();
+    FormatCapabilityBackend::MutableDynamicParameters().MaxCombinedTextureImageUnits = kCombinedUnits;
+    ScopedBackendOverride backendOverride(Move(backend));
+
+    GLint reportedUnits = 0;
+    MG_Impl::GLImpl::GetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &reportedUnits);
+    ASSERT_EQ(reportedUnits, kCombinedUnits);
+
+    // The last unit that exists still binds.
+    const GLuint lastUnit = static_cast<GLuint>(kCombinedUnits - 1);
+    MG_Impl::GLImpl::BindSampler(lastUnit, sampler);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_NE(MG_State::pGLContext->GetTextureUnitObject(static_cast<Int>(lastUnit)).GetSamplerObject(), nullptr);
+
+    // One past it does not - this is the unit the old gate accepted.
+    MG_Impl::GLImpl::BindSampler(static_cast<GLuint>(kCombinedUnits), sampler);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+    EXPECT_EQ(MG_State::pGLContext->GetTextureUnitObject(kCombinedUnits).GetSamplerObject(), nullptr);
+
+    // Past the unit array as well is the same error, not an out-of-bounds index.
+    MG_Impl::GLImpl::BindSampler(
+        static_cast<GLuint>(MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) + 4u, sampler);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+
+    // Both gates now read the same limit: a multi-bind that ends exactly at it binds, and one that
+    // runs a single unit past it is the multi-bind's INVALID_OPERATION, reported up front - not the
+    // single-bind INVALID_VALUE from somewhere inside the loop.
+    const GLuint samplers[2] = {sampler, sampler};
+    MG_Impl::GLImpl::BindSamplers(static_cast<GLuint>(kCombinedUnits - 2), 2, samplers);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    MG_Impl::GLImpl::BindSamplers(lastUnit, 2, samplers);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    MG_Impl::GLImpl::BindSampler(lastUnit, 0);
+    MG_Impl::GLImpl::BindSampler(static_cast<GLuint>(kCombinedUnits - 2), 0);
+    MG_Impl::GLImpl::DeleteSamplers(1, &sampler);
+    DrainPendingGlErrors();
+}
+
+// The DSA by-name entry points are emulated by temporarily binding the named texture onto the
+// active unit's slot for its target, running the classic bound-texture code, then putting the
+// previous binding back. For as long as the emulated call runs, that swap is a REAL change to
+// which texture is bound at that unit, so both transitions have to move the texture bind
+// generation.
+//
+// They used to move nothing. Backends memoise per-unit work keyed on the bind generation and
+// BORROW the binding slot (they hold a pointer to the slot's shared_ptr, not a copy), so a memo
+// built while texture A sat in the slot stayed "valid" while B was temporarily in it - and the
+// backend then drove A's backend twin from B's frontend state, re-specifying A's backend storage
+// with B's shape. Any content A only ever had on the GPU was gone. That is what blanked
+// Minecraft's lightmap when Iris uploaded to a BSL shadow map: the text shader multiplies by the
+// lightmap, so `if (color.a < 0.1) discard` then threw away every glyph in the process.
+TEST_F(TextureTest, NamedTextureCallKeepsUnitBindingAccountingCoherent) {
+    GLuint names[2] = {};
+    MG_Impl::GLImpl::GenTextures(2, names);
+    const GLuint boundName = names[0];
+    const GLuint namedName = names[1];
+
+    MG_Impl::GLImpl::ActiveTexture(GL_TEXTURE0);
+    // Instantiate both as 2D objects, then leave `boundName` on the unit.
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, namedName);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, boundName);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    auto& slot = MG_State::pGLContext->GetTextureUnitObject(0).GetBindingSlot(TextureTarget::Texture2D);
+    const auto boundObject = slot.GetBoundObject();
+    ASSERT_NE(boundObject, nullptr);
+    ASSERT_EQ(boundObject->GetExternalIndex(), boundName);
+
+    // TextureParameteriv is one of the by-name calls that is emulated by binding: it reaches
+    // WithTemporarilyBoundNamedTexture, unlike the scalar TextureParameteri, which edits the
+    // object directly and never touches a unit.
+    const Uint64 base = MG_State::pGLContext->GetTextureBindGeneration();
+    const GLint maxLevel = 0;
+    MG_Impl::GLImpl::TextureParameteriv(namedName, GL_TEXTURE_MAX_LEVEL, &maxLevel);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The emulation put `namedName` on the unit and took it off again. A generation-keyed memo
+    // must be able to see that the slot it borrows was not stable across the call.
+    EXPECT_GT(MG_State::pGLContext->GetTextureBindGeneration(), base)
+        << "a by-name texture call swapped a live unit binding without moving the bind generation";
+    // ...and the application-visible binding is exactly what it was before the call.
+    EXPECT_EQ(slot.GetBoundObject(), boundObject);
+
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, 0);
+    MG_Impl::GLImpl::DeleteTextures(2, names);
+    DrainPendingGlErrors();
+}
+
+// ---- Three-channel colour-renderable widening (Complementary Reimagined / Iris) ----------------
+//
+// No real OpenGL ES driver renders to a three-channel image, so a colour attachment the
+// application asked for as GL_RGB8_SNORM or GL_RGB16F has to be stored in the four-channel
+// sibling. The bit that says so used to be reachable for multisample storage only, which is why
+// an ordinary GL_TEXTURE_2D attachment in one of those formats had no fallback at all and the
+// frontend could only answer GL_FRAMEBUFFER_UNSUPPORTED.
+
+TEST_F(TextureTest, ColorAttachableTargetsRequestTheThreeChannelWidening) {
+    using MobileGL::MG_Backend::DirectGLES::TextureImpl::GetRenderTargetNormalizeOptions;
+    using MobileGL::MG_Backend::DirectGLES::TextureImpl::TargetRequiresRenderableFormat;
+
+    MG_External::GLESCapabilities capabilities{};
+    capabilities.SupportsRenderSnorm = true;
+    capabilities.SupportsNorm16Texture = true;
+
+    // Every image that can be a colour attachment, not just the multisample pair: an ordinary 2D
+    // texture is what Iris attaches, and it used to be excluded.
+    for (const TextureTarget target : {TextureTarget::Texture2D, TextureTarget::Texture3D,
+                                       TextureTarget::TextureCubeMap, TextureTarget::Texture2DArray,
+                                       TextureTarget::TextureCubeMapArray, TextureTarget::Texture2DMultisample,
+                                       TextureTarget::Texture2DMultisampleArray, TextureTarget::Texture1D,
+                                       TextureTarget::Texture1DArray, TextureTarget::TextureRectangle}) {
+        const SizeT targetIndex = MobileGL::MG_Backend::GetFormatCapabilityTargetIndex(target);
+        EXPECT_TRUE(TargetRequiresRenderableFormat(targetIndex))
+            << "target " << MG_Util::ConvertTextureTargetToString(target);
+        EXPECT_TRUE(GetRenderTargetNormalizeOptions(capabilities, targetIndex) &
+                    PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget)
+            << "target " << MG_Util::ConvertTextureTargetToString(target);
+    }
+    // A renderbuffer exists only to be attached.
+    EXPECT_TRUE(TargetRequiresRenderableFormat(MobileGL::MG_Backend::GetRenderbufferFormatCapabilityTargetIndex()));
+
+    // A buffer texture is the one image that can never be an attachment; its storage belongs to
+    // the buffer object, so widening it would misdescribe the application's data.
+    const SizeT bufferIndex = MobileGL::MG_Backend::GetFormatCapabilityTargetIndex(TextureTarget::TextureBuffer);
+    EXPECT_FALSE(TargetRequiresRenderableFormat(bufferIndex));
+    EXPECT_FALSE(GetRenderTargetNormalizeOptions(capabilities, bufferIndex));
+
+    // Without EXT_render_snorm a 16-bit SNORM render target cannot keep its encoding either.
+    MG_External::GLESCapabilities noSnormCapabilities{};
+    const SizeT texture2DIndex = MobileGL::MG_Backend::GetFormatCapabilityTargetIndex(TextureTarget::Texture2D);
+    EXPECT_TRUE(GetRenderTargetNormalizeOptions(noSnormCapabilities, texture2DIndex) &
+                PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget);
+    EXPECT_FALSE(GetRenderTargetNormalizeOptions(capabilities, texture2DIndex) &
+                 PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget);
+}
+
+TEST_F(TextureTest, ThreeChannelRenderTargetOptionAppliesToEveryDeniedThreeChannelFormat) {
+    using MG_Util::TextureFormatProcessor::GetApplicablePixelFormatNormalizeOptions;
+    const Flags<PixelFormatNormalizeOptionBit> requested =
+        PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget;
+
+    // GL_RGB16F in particular matched no case at all, so no option could ever apply to it and it
+    // fell through NormalizePixelFormat's default passthrough unchanged.
+    for (const GLenum internalFormat : {GL_RGB8_SNORM, GL_RGB16_SNORM, GL_RGB16, GL_RGB10, GL_RGB12, GL_RGB16F,
+                                        GL_RGB32F, GL_SRGB8, GL_RGB8I, GL_RGB8UI, GL_RGB16I, GL_RGB16UI, GL_RGB32I,
+                                        GL_RGB32UI}) {
+        EXPECT_TRUE(GetApplicablePixelFormatNormalizeOptions(internalFormat, requested) &
+                    PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget)
+            << "internalformat 0x" << std::hex << internalFormat;
+    }
+
+    // Four-channel and shared-exponent formats are not widened: RGBA8_SNORM has its own always-on
+    // fallback, and GL_RGB9_E5 has no four-channel sibling that would not need the shared exponent
+    // unpacked on every transfer (nothing renders to it on desktop GL either).
+    for (const GLenum internalFormat : {GL_RGBA8_SNORM, GL_RGBA16F, GL_RGBA8, GL_RGB8, GL_RGB9_E5}) {
+        EXPECT_FALSE(GetApplicablePixelFormatNormalizeOptions(internalFormat, requested) &
+                     PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget)
+            << "internalformat 0x" << std::hex << internalFormat;
+    }
+}
+
+TEST_F(TextureTest, ThreeChannelWideningRetargetsInternalFormatAndTransferPairTogether) {
+    using MG_Util::TextureFormatProcessor::NormalizePixelFormat;
+    struct Case {
+        GLenum requested;
+        Flags<PixelFormatNormalizeOptionBit> options;
+        GLenum internalFormat;
+        GLenum format;
+        GLenum type;
+    };
+    const Flags<PixelFormatNormalizeOptionBit> widen = PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget;
+    const Flags<PixelFormatNormalizeOptionBit> widenNoSnorm16 =
+        PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget |
+        PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget;
+
+    const Case cases[] = {
+        // Complementary's colortex1 and colortex2. The transfer pair used to stay three-channel
+        // and keep the *source* component type, emitting (GL_RGBA16F, GL_RGB, GL_BYTE) - which ES
+        // rejects for glTexImage2D outright, and which only went unnoticed because the bit was
+        // reachable for multisample storage alone (glTexStorage*Multisample takes no pair).
+        {GL_RGB8_SNORM, widen, GL_RGBA16F, GL_RGBA, GL_FLOAT},
+        {GL_RGB16F, widen, GL_RGBA16F, GL_RGBA, GL_HALF_FLOAT},
+        {GL_RGB32F, widen, GL_RGBA32F, GL_RGBA, GL_FLOAT},
+        // 16-bit SNORM keeps its encoding where EXT_render_snorm can render to it; a half float's
+        // 11-bit mantissa cannot represent a 16-bit SNORM channel exactly.
+        {GL_RGB16_SNORM, widen, GL_RGBA16_SNORM, GL_RGBA, GL_SHORT},
+        {GL_RGB16_SNORM, widenNoSnorm16, GL_RGBA16F, GL_RGBA, GL_FLOAT},
+        // 16-bit UNORM and the legacy 10/12-bit formats stored as RGB16.
+        {GL_RGB16, widen, GL_RGBA32F, GL_RGBA, GL_FLOAT},
+        {GL_RGB10, widen, GL_RGBA32F, GL_RGBA, GL_FLOAT},
+        {GL_RGB12, widen, GL_RGBA32F, GL_RGBA, GL_FLOAT},
+        // sRGB and the integer formats: the base format has to move to the four-channel one of the
+        // right class, GL_RGBA_INTEGER included.
+        {GL_SRGB8, widen, GL_SRGB8_ALPHA8, GL_RGBA, GL_UNSIGNED_BYTE},
+        {GL_RGB8I, widen, GL_RGBA8I, GL_RGBA_INTEGER, GL_BYTE},
+        {GL_RGB8UI, widen, GL_RGBA8UI, GL_RGBA_INTEGER, GL_UNSIGNED_BYTE},
+        {GL_RGB16I, widen, GL_RGBA16I, GL_RGBA_INTEGER, GL_SHORT},
+        {GL_RGB16UI, widen, GL_RGBA16UI, GL_RGBA_INTEGER, GL_UNSIGNED_SHORT},
+        {GL_RGB32I, widen, GL_RGBA32I, GL_RGBA_INTEGER, GL_INT},
+        {GL_RGB32UI, widen, GL_RGBA32UI, GL_RGBA_INTEGER, GL_UNSIGNED_INT},
+        // The widening outranks the other fallbacks, which all pick a three-channel storage the
+        // driver still refuses to render to (GL_RGB8_SNORM -> GL_RGB16F, GL_RGB16 -> GL_RGB32F).
+        {GL_RGB8_SNORM, widen | PixelFormatNormalizeOptionBit::NoSnorm8, GL_RGBA16F, GL_RGBA, GL_FLOAT},
+        {GL_RGB16, widen | PixelFormatNormalizeOptionBit::NoNorm16, GL_RGBA32F, GL_RGBA, GL_FLOAT},
+        // Control: without the bit nothing moves. The bit is only ever set for a target whose
+        // native probe failed, so this is the shape every driver that does render to the
+        // three-channel form keeps - per format, not per platform (llvmpipe renders to GL_RGB16F
+        // but not to GL_RGB8_SNORM, GL_SRGB8, GL_RGB32F or the RGB integer formats).
+        {GL_RGB8_SNORM, PixelFormatNormalizeOptionBit::None, GL_RGB8_SNORM, GL_RGB, GL_BYTE},
+        {GL_RGB16F, PixelFormatNormalizeOptionBit::None, GL_RGB16F, GL_RGB, GL_HALF_FLOAT},
+        {GL_RGB32F, PixelFormatNormalizeOptionBit::None, GL_RGB32F, GL_RGB, GL_FLOAT},
+        {GL_SRGB8, PixelFormatNormalizeOptionBit::None, GL_SRGB8, GL_RGB, GL_UNSIGNED_BYTE},
+        // Not widened even under the bit: no four-channel shared-exponent sibling exists.
+        {GL_RGB9_E5, widen, GL_RGB9_E5, GL_RGB, GL_UNSIGNED_INT_5_9_9_9_REV},
+        // Four-channel formats are unaffected by the bit; RGBA8_SNORM keeps its own fallback.
+        {GL_RGBA8_SNORM, widen, GL_RGBA8_SNORM, GL_RGBA, GL_BYTE},
+        {GL_RGBA8_SNORM, widen | PixelFormatNormalizeOptionBit::NoRGBA8Snorm, GL_RGBA16F, GL_RGBA, GL_FLOAT},
+    };
+
+    for (const auto& testCase : cases) {
+        GLenum internalFormat = 0;
+        GLenum format = 0;
+        GLenum type = 0;
+        NormalizePixelFormat(testCase.requested, testCase.options, &internalFormat, &format, &type);
+        EXPECT_EQ(internalFormat, testCase.internalFormat) << "requested 0x" << std::hex << testCase.requested;
+        EXPECT_EQ(format, testCase.format) << "requested 0x" << std::hex << testCase.requested;
+        EXPECT_EQ(type, testCase.type) << "requested 0x" << std::hex << testCase.requested;
+    }
+}
+
+TEST_F(TextureTest, WidenedRenderTargetUploadExpandsThreeChannelDataWithOpaqueAlpha) {
+    using MobileGL::MG_Backend::DirectGLES::TextureImpl::GetWidenableClientComponentCount;
+    using MobileGL::MG_Backend::DirectGLES::TextureImpl::PrepareChannelWidenedUpload;
+
+    // Only the three-channel formats that can be widened report a source component count; the
+    // repack is what keeps the driver from walking three texels' worth of data per four-texel row.
+    for (const TextureInternalFormat format :
+         {TextureInternalFormat::RGB8Snorm, TextureInternalFormat::RGB16F, TextureInternalFormat::RGB32F,
+          TextureInternalFormat::RGB16Snorm, TextureInternalFormat::RGB16, TextureInternalFormat::SRGB8,
+          TextureInternalFormat::RGB8UI, TextureInternalFormat::RGB32I}) {
+        EXPECT_EQ(GetWidenableClientComponentCount(format), 3u)
+            << MG_Util::ConvertTextureInternalFormatToString(format);
+    }
+    EXPECT_EQ(GetWidenableClientComponentCount(TextureInternalFormat::RGBA8), 0u);
+    EXPECT_EQ(GetWidenableClientComponentCount(TextureInternalFormat::RGBA8Snorm), 0u);
+    EXPECT_EQ(GetWidenableClientComponentCount(TextureInternalFormat::RGB9E5), 0u);
+
+    const IntVec3 texelSize(2, 1, 1);
+
+    // GL_RGB8_SNORM -> GL_RGBA16F: PrepareNormFloatFallbackUpload has already turned the Int8
+    // shadow into floats, so what arrives here is three floats per texel.
+    {
+        const Float source[] = {0.25f, -0.5f, 0.75f, -1.0f, 0.0f, 1.0f};
+        Vector<Uint8> widened;
+        const auto* result = static_cast<const Float*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_FLOAT, widened));
+        ASSERT_NE(result, static_cast<const void*>(source));
+        ASSERT_EQ(widened.size(), 8 * sizeof(Float));
+        const Float expected[] = {0.25f, -0.5f, 0.75f, 1.0f, -1.0f, 0.0f, 1.0f, 1.0f};
+        for (SizeT i = 0; i < 8; ++i) {
+            EXPECT_FLOAT_EQ(result[i], expected[i]) << "component " << i;
+        }
+    }
+
+    // GL_RGB16F -> GL_RGBA16F uploads halves untouched, so the synthetic alpha is the half
+    // encoding of 1.0 rather than a saturated field.
+    {
+        const Uint16 source[] = {0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006};
+        Vector<Uint8> widened;
+        const auto* result = static_cast<const Uint16*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_HALF_FLOAT, widened));
+        ASSERT_NE(result, static_cast<const void*>(source));
+        const Uint16 expected[] = {0x0001, 0x0002, 0x0003, 0x3C00, 0x0004, 0x0005, 0x0006, 0x3C00};
+        for (SizeT i = 0; i < 8; ++i) {
+            EXPECT_EQ(result[i], expected[i]) << "component " << i;
+        }
+    }
+
+    // GL_SRGB8 -> GL_SRGB8_ALPHA8: fixed-point one is the saturated field.
+    {
+        const Uint8 source[] = {1, 2, 3, 4, 5, 6};
+        Vector<Uint8> widened;
+        const auto* result = static_cast<const Uint8*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_UNSIGNED_BYTE, widened));
+        const Uint8 expected[] = {1, 2, 3, 0xFF, 4, 5, 6, 0xFF};
+        ASSERT_NE(result, static_cast<const void*>(source));
+        EXPECT_EQ(std::memcmp(result, expected, sizeof(expected)), 0);
+    }
+
+    // GL_RGB16_SNORM -> GL_RGBA16_SNORM keeps GL_SHORT, whose 1.0 is the positive maximum.
+    {
+        const Int16 source[] = {-1, 2, -3, 4, -5, 6};
+        Vector<Uint8> widened;
+        const auto* result = static_cast<const Int16*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_SHORT, widened));
+        const Int16 expected[] = {-1, 2, -3, 0x7FFF, 4, -5, 6, 0x7FFF};
+        ASSERT_NE(result, static_cast<const void*>(source));
+        EXPECT_EQ(std::memcmp(result, expected, sizeof(expected)), 0);
+    }
+
+    // An integer format's added channel carries the integer one, not a saturated field.
+    {
+        const Uint32 source[] = {10, 20, 30, 40, 50, 60};
+        Vector<Uint8> widened;
+        const auto* result = static_cast<const Uint32*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_UNSIGNED_INT, widened, /*integerData=*/true));
+        const Uint32 expected[] = {10, 20, 30, 1, 40, 50, 60, 1};
+        ASSERT_NE(result, static_cast<const void*>(source));
+        EXPECT_EQ(std::memcmp(result, expected, sizeof(expected)), 0);
+    }
+
+    // GL_RGB8I -> GL_RGBA8I uploads as GL_BYTE, the very type GL_RGB8_SNORM uses, so the type
+    // alone cannot decide the added channel's value: the integer format's one is 1, the
+    // signed-normalized format's is 0x7F. Getting this wrong is invisible through sampling and
+    // glGetTexImage (both answer the alpha with the format's implied one) but escapes through a
+    // blit or glCopyTexSubImage out of the widened attachment.
+    {
+        const Int8 source[] = {-1, 2, -3, 4, -5, 6};
+        Vector<Uint8> widened;
+        const auto* asInteger = static_cast<const Int8*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_BYTE, widened, /*integerData=*/true));
+        const Int8 expectedInteger[] = {-1, 2, -3, 1, 4, -5, 6, 1};
+        ASSERT_NE(asInteger, static_cast<const void*>(source));
+        EXPECT_EQ(std::memcmp(asInteger, expectedInteger, sizeof(expectedInteger)), 0);
+
+        Vector<Uint8> widenedNorm;
+        const auto* asNormalized = static_cast<const Int8*>(PrepareChannelWidenedUpload(
+            3, texelSize, source, sizeof(source), GL_BYTE, widenedNorm, /*integerData=*/false));
+        const Int8 expectedNormalized[] = {-1, 2, -3, 0x7F, 4, -5, 6, 0x7F};
+        EXPECT_EQ(std::memcmp(asNormalized, expectedNormalized, sizeof(expectedNormalized)), 0);
+    }
+
+    // Which class a widenable format belongs to.
+    for (const TextureInternalFormat format :
+         {TextureInternalFormat::RGB8I, TextureInternalFormat::RGB8UI, TextureInternalFormat::RGB16I,
+          TextureInternalFormat::RGB16UI, TextureInternalFormat::RGB32I, TextureInternalFormat::RGB32UI}) {
+        EXPECT_TRUE(MobileGL::MG_Backend::DirectGLES::TextureImpl::IsIntegerWidenableFormat(format))
+            << MG_Util::ConvertTextureInternalFormatToString(format);
+    }
+    for (const TextureInternalFormat format :
+         {TextureInternalFormat::RGB8Snorm, TextureInternalFormat::RGB16Snorm, TextureInternalFormat::RGB16,
+          TextureInternalFormat::RGB16F, TextureInternalFormat::RGB32F, TextureInternalFormat::SRGB8}) {
+        EXPECT_FALSE(MobileGL::MG_Backend::DirectGLES::TextureImpl::IsIntegerWidenableFormat(format))
+            << MG_Util::ConvertTextureInternalFormatToString(format);
+    }
+
+    // The destination is sized from the level, never from the source. The driver reads a full
+    // width*height*4 components for the transfer it was handed, so a short source must still
+    // leave a full buffer behind - sizing it from the source would hand the driver a buffer it
+    // runs off the end of.
+    {
+        const Float shortSource[] = {0.5f, 0.25f, 0.125f};
+        Vector<Uint8> widened;
+        const auto* result = static_cast<const Float*>(PrepareChannelWidenedUpload(
+            3, IntVec3(2, 2, 1), shortSource, sizeof(shortSource), GL_FLOAT, widened));
+        ASSERT_NE(result, static_cast<const void*>(shortSource));
+        ASSERT_EQ(widened.size(), 4 * 4 * sizeof(Float));
+        const Float expected[] = {0.5f, 0.25f, 0.125f, 1.0f, 0.0f, 0.0f, 0.0f, 1.0f,
+                                  0.0f, 0.0f,  0.0f,   1.0f, 0.0f, 0.0f, 0.0f, 1.0f};
+        for (SizeT i = 0; i < 16; ++i) {
+            EXPECT_FLOAT_EQ(result[i], expected[i]) << "component " << i;
+        }
+    }
+
+    // No widening in effect (or nothing to convert): the caller's pointer comes straight back, so
+    // the sub-rect upload fast path still recognises an unconverted level.
+    {
+        const Float source[] = {1.0f, 2.0f, 3.0f, 4.0f};
+        Vector<Uint8> widened;
+        EXPECT_EQ(PrepareChannelWidenedUpload(4, texelSize, source, sizeof(source), GL_FLOAT, widened),
+                  static_cast<const void*>(source));
+        EXPECT_EQ(PrepareChannelWidenedUpload(0, texelSize, source, sizeof(source), GL_FLOAT, widened),
+                  static_cast<const void*>(source));
+        EXPECT_EQ(PrepareChannelWidenedUpload(3, texelSize, nullptr, 0, GL_FLOAT, widened), nullptr);
+    }
+}

MobileGL/MG_Test/Util/AsyncPoolBench.cpp

@@ -0,0 +1,368 @@
+// MobileGL - MobileGL/MG_Test/Util/AsyncPoolBench.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// A head-to-head harness for the two ShaderCompilePool execution engines
+// (MOBILEGL_ASYNC_POOL=asio|libfork). Not a gtest: it measures one wall-clock interval per
+// process, because most of what it drives is memoized per process (the shader preprocess
+// cache and the compile-adoption map both live for the life of the GL context), so a second
+// timed repetition inside one process would measure the cache, not the compiler. The driver
+// script re-executes the binary for every repetition instead.
+//
+// Two modes:
+//
+//   corpus - the REAL frontend path. glCreateShader/glShaderSource are done untimed, then
+//            the clock starts and glCompileShader/glLinkProgram submit every job, and stops
+//            once glGetProgramiv(GL_LINK_STATUS) has joined all of them. That is exactly the
+//            first-submit-to-all-joined interval a shaderpack load pays.
+//
+//   micro  - N trivial JobNodes straight through ShaderCompilePool::Post, isolating the
+//            executor's own dispatch overhead from any workload contention.
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include "Includes.h"
+#include "Init.h"
+#include <Config.h>
+
+#include <MG_Impl/GLImpl/Program/GL_Program.h>
+#include <MG_Util/Async/JobNode.h>
+#include <MG_Util/Async/ShaderCompilePool.h>
+
+using namespace MobileGL;
+using namespace MobileGL::MG_Util::Async;
+namespace GLImpl = MobileGL::MG_Impl::GLImpl;
+namespace fs = std::filesystem;
+
+namespace {
+    using Clock = std::chrono::steady_clock;
+
+    double MillisSince(const Clock::time_point start) {
+        return std::chrono::duration<double, std::milli>(Clock::now() - start).count();
+    }
+
+    GLenum StageFromExtension(const std::string& ext) {
+        if (ext == ".vert") return GL_VERTEX_SHADER;
+        if (ext == ".frag") return GL_FRAGMENT_SHADER;
+        if (ext == ".geom") return GL_GEOMETRY_SHADER;
+        if (ext == ".comp") return GL_COMPUTE_SHADER;
+        if (ext == ".tesc") return GL_TESS_CONTROL_SHADER;
+        if (ext == ".tese") return GL_TESS_EVALUATION_SHADER;
+        return 0;
+    }
+
+    std::string ReadFile(const fs::path& path) {
+        std::ifstream in(path, std::ios::binary);
+        std::ostringstream buf;
+        buf << in.rdbuf();
+        return buf.str();
+    }
+
+    struct CorpusShader {
+        std::string name;
+        std::string source;
+        GLenum stage = 0;
+    };
+
+    // One program's worth of the corpus: the trace's link group. Shaders are indices into
+    // the flat shader list, because a source shared by several programs must stay ONE entry
+    // - that sharing is what the compile-adoption map sees in the real path too.
+    struct CorpusProgram {
+        std::vector<SizeT> shaders;
+    };
+
+    struct Corpus {
+        std::vector<CorpusShader> shaders;
+        std::vector<CorpusProgram> programs;
+        SizeT totalBytes = 0;
+    };
+
+    // Reads a corpus directory written by extract_corpus.py: one file per compiled shader,
+    // stage in the extension, plus manifest.txt naming the trace's link groups.
+    Corpus LoadCorpus(const fs::path& dir) {
+        Corpus corpus;
+        std::unordered_map<std::string, SizeT> byName;
+
+        const auto intern = [&](const std::string& name) -> SizeT {
+            if (const auto it = byName.find(name); it != byName.end()) return it->second;
+            const fs::path path = dir / name;
+            if (!fs::exists(path)) return static_cast<SizeT>(-1);
+            CorpusShader shader;
+            shader.name = name;
+            shader.source = ReadFile(path);
+            shader.stage = StageFromExtension(path.extension().string());
+            if (shader.stage == 0) return static_cast<SizeT>(-1);
+            corpus.totalBytes += shader.source.size();
+            corpus.shaders.push_back(Move(shader));
+            const SizeT index = corpus.shaders.size() - 1;
+            byName.emplace(name, index);
+            return index;
+        };
+
+        const fs::path manifest = dir / "manifest.txt";
+        if (fs::exists(manifest)) {
+            std::ifstream in(manifest);
+            std::string line;
+            while (std::getline(in, line)) {
+                if (line.empty() || line[0] == '#') continue;
+                CorpusProgram program;
+                std::istringstream fields(line);
+                std::string name;
+                while (fields >> name) {
+                    const SizeT index = intern(name);
+                    if (index != static_cast<SizeT>(-1)) program.shaders.push_back(index);
+                }
+                if (!program.shaders.empty()) corpus.programs.push_back(Move(program));
+            }
+        }
+
+        // Anything in the directory the manifest never linked still gets compiled, as a
+        // program-less group, so the corpus on disk and the corpus measured are the same set.
+        std::vector<fs::path> leftovers;
+        for (const auto& entry : fs::directory_iterator(dir)) {
+            if (!entry.is_regular_file()) continue;
+            const std::string name = entry.path().filename().string();
+            if (name == "manifest.txt") continue;
+            if (StageFromExtension(entry.path().extension().string()) == 0) continue;
+            if (byName.count(name) != 0) continue;
+            leftovers.push_back(entry.path());
+        }
+        std::sort(leftovers.begin(), leftovers.end());
+        for (const auto& path : leftovers) intern(path.filename().string());
+
+        return corpus;
+    }
+
+    struct CorpusResult {
+        double submitMs = 0;  // first glCompileShader -> last glLinkProgram returned
+        double joinMs = 0;    // last submit -> every program joined
+        double totalMs = 0;   // the number that matters: first submit -> all joined
+        SizeT linkFailures = 0;
+        SizeT compileFailures = 0;
+    };
+
+    CorpusResult RunCorpus(const Corpus& corpus) {
+        // ---- Untimed: create every GL object and stage every source ----------------------
+        // glShaderSource is a memcpy into the shader object and glAttachShader is a pointer
+        // append; neither touches the pool. Keeping them outside the clock makes the measured
+        // interval exactly the compile+link critical path, which is what an application's
+        // loading screen waits on.
+        std::vector<GLuint> shaderNames(corpus.shaders.size(), 0);
+        for (SizeT i = 0; i < corpus.shaders.size(); ++i) {
+            const CorpusShader& shader = corpus.shaders[i];
+            const GLuint name = GLImpl::CreateShader(shader.stage);
+            const GLchar* text = shader.source.c_str();
+            const GLint length = static_cast<GLint>(shader.source.size());
+            GLImpl::ShaderSource(name, 1, &text, &length);
+            shaderNames[i] = name;
+        }
+
+        std::vector<GLuint> programNames(corpus.programs.size(), 0);
+        for (SizeT p = 0; p < corpus.programs.size(); ++p) {
+            const GLuint program = GLImpl::CreateProgram();
+            for (const SizeT shaderIndex : corpus.programs[p].shaders) {
+                GLImpl::AttachShader(program, shaderNames[shaderIndex]);
+            }
+            programNames[p] = program;
+        }
+
+        // ---- Timed ------------------------------------------------------------------------
+        const Clock::time_point start = Clock::now();
+
+        // Submission order follows the trace: a program's shaders, then its link. That order
+        // is what exercises ProgramLinkTask::SubmitAfter's dependency chaining rather than a
+        // flat burst of independent compiles.
+        std::vector<Bool> submitted(corpus.shaders.size(), false);
+        for (SizeT p = 0; p < corpus.programs.size(); ++p) {
+            for (const SizeT shaderIndex : corpus.programs[p].shaders) {
+                if (submitted[shaderIndex]) continue;
+                submitted[shaderIndex] = true;
+                GLImpl::CompileShader(shaderNames[shaderIndex]);
+            }
+            GLImpl::LinkProgram(programNames[p]);
+        }
+        for (SizeT i = 0; i < corpus.shaders.size(); ++i) {
+            if (submitted[i]) continue;
+            submitted[i] = true;
+            GLImpl::CompileShader(shaderNames[i]);
+        }
+
+        const Clock::time_point submitted_at = Clock::now();
+
+        CorpusResult result;
+        // GL_LINK_STATUS is a joining query (GL_COMPLETION_STATUS_KHR is the one that must
+        // not join), so this loop is the all-joined barrier.
+        for (const GLuint program : programNames) {
+            GLint status = 0;
+            GLImpl::GetProgramiv(program, GL_LINK_STATUS, &status);
+            if (status == GL_FALSE) ++result.linkFailures;
+        }
+        for (const GLuint shader : shaderNames) {
+            GLint status = 0;
+            GLImpl::GetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) ++result.compileFailures;
+        }
+
+        result.totalMs = MillisSince(start);
+        result.submitMs = std::chrono::duration<double, std::milli>(submitted_at - start).count();
+        result.joinMs = result.totalMs - result.submitMs;
+
+        for (const GLuint program : programNames) GLImpl::DeleteProgram(program);
+        for (const GLuint shader : shaderNames) GLImpl::DeleteShader(shader);
+        return result;
+    }
+
+    // ---- Executor microbenchmark ----------------------------------------------------------
+    // The body is deliberately near-empty: what is being measured is Post -> engine ->
+    // RunOnWorker -> next dispatch, i.e. the executor's own cost per job, with no compiler
+    // work to hide it.
+    //
+    // The barrier is an all-jobs-ran latch, and it has to be. This bench used to stop the
+    // clock at StopAndDrain(), which is not a "wait for everything" - it is the teardown path,
+    // and its contract is to ABANDON whatever the budget has not dispatched yet (see
+    // ShaderCompilePool::StopAndDrain, and the JobNodeTest case that pins exactly that). With
+    // 100k jobs behind a budget of N, most of them were therefore cancelled rather than run,
+    // and the fraction that survived was decided by how fast the engine drained the queue
+    // relative to the posting loop - i.e. by the very quantity under test. Measured on this
+    // machine at 8 workers: Asio ran 75,906 of 100,000 and libfork 99,998, and both were
+    // scored as if they had run 100,000. The reported "libfork is 1.36x faster" was libfork
+    // being charged for 32% more work than Asio.
+    class TrivialJob final : public JobNode {
+    public:
+        TrivialJob(std::atomic<Uint64>* sink, const Uint64 total, std::mutex* mutex,
+                   std::condition_variable* cv)
+            : m_sink(sink), m_total(total), m_mutex(mutex), m_cv(cv) {}
+
+    private:
+        void RunBody() override {
+            if (m_sink->fetch_add(1, std::memory_order_acq_rel) + 1 == m_total) {
+                // The last job wakes the timer. Under the lock, so the waiter cannot miss it
+                // between its predicate check and its wait.
+                const std::lock_guard<std::mutex> lock(*m_mutex);
+                m_cv->notify_all();
+            }
+        }
+
+        std::atomic<Uint64>* m_sink;
+        Uint64 m_total;
+        std::mutex* m_mutex;
+        std::condition_variable* m_cv;
+    };
+
+    struct MicroResult {
+        double ms = 0;
+        Uint64 ran = 0;
+    };
+
+    MicroResult RunMicrobench(const Uint threads, const SizeT jobs) {
+        ShaderCompilePool pool(threads);
+        std::atomic<Uint64> counter{0};
+        std::mutex mutex;
+        std::condition_variable cv;
+        const auto total = static_cast<Uint64>(jobs);
+
+        // Nodes are allocated up front: MakeShared is not what is under test, and leaving it
+        // inside the loop would put an allocator on the critical path in front of the
+        // dispatch path this is meant to isolate.
+        std::vector<SharedPtr<JobNode>> nodes;
+        nodes.reserve(jobs);
+        for (SizeT i = 0; i < jobs; ++i) {
+            nodes.push_back(MakeShared<TrivialJob>(&counter, total, &mutex, &cv));
+        }
+
+        const Clock::time_point start = Clock::now();
+        for (auto& node : nodes) pool.Post(Move(node));
+        {
+            std::unique_lock<std::mutex> lock(mutex);
+            cv.wait(lock, [&] { return counter.load(std::memory_order_acquire) >= total; });
+        }
+        const double ms = MillisSince(start);
+
+        MicroResult result;
+        result.ms = ms;
+        result.ran = counter.load(std::memory_order_acquire);
+        return result;
+    }
+
+    [[noreturn]] void Usage() {
+        std::fprintf(stderr,
+                     "usage: AsyncPoolBench --corpus DIR\n"
+                     "       AsyncPoolBench --micro JOBS --threads N\n"
+                     "env: MOBILEGL_ASYNC_POOL=asio|libfork, "
+                     "MOBILEGL_ASYNC_SHADER_COMPILE_THREADS=N\n");
+        std::exit(2);
+    }
+} // namespace
+
+int main(int argc, char** argv) {
+    std::string corpusDir;
+    SizeT microJobs = 0;
+    Uint microThreads = 0;
+
+    for (int i = 1; i < argc; ++i) {
+        const std::string arg = argv[i];
+        const auto next = [&]() -> std::string {
+            if (i + 1 >= argc) Usage();
+            return argv[++i];
+        };
+        if (arg == "--corpus") corpusDir = next();
+        else if (arg == "--micro") microJobs = static_cast<SizeT>(std::stoull(next()));
+        else if (arg == "--threads") microThreads = static_cast<Uint>(std::stoul(next()));
+        else Usage();
+    }
+    if (corpusDir.empty() && microJobs == 0) Usage();
+
+    Initialize();
+
+    const AsyncPoolEngine engine = DetectAsyncPoolEngine();
+    const char* engineName = AsyncPoolEngineName(engine);
+
+    if (microJobs != 0) {
+        const Uint threads = microThreads != 0 ? microThreads : DetectShaderCompileThreadCount();
+        const MicroResult result = RunMicrobench(threads, microJobs);
+        // `ran` is printed, not just checked, so that a run in which the arms did different
+        // amounts of work is visible in the results file rather than on a stderr the driver
+        // script redirects to /dev/null. ns_per_job divides by what actually ran.
+        std::printf("RESULT mode=micro engine=%s threads=%u jobs=%zu ran=%llu total_ms=%.3f "
+                    "ns_per_job=%.1f\n",
+                    engineName, threads, microJobs, static_cast<unsigned long long>(result.ran),
+                    result.ms, result.ms * 1e6 / static_cast<double>(result.ran));
+        return result.ran == microJobs ? 0 : 1;
+    }
+
+    const Corpus corpus = LoadCorpus(corpusDir);
+    if (corpus.shaders.empty()) {
+        std::fprintf(stderr, "AsyncPoolBench: no shaders found in %s\n", corpusDir.c_str());
+        return 1;
+    }
+
+    if (!AsyncShaderCompileActive()) {
+        std::fprintf(stderr, "AsyncPoolBench: asynchronous compilation is OFF; measuring the "
+                             "inline path\n");
+    }
+
+    const CorpusResult result = RunCorpus(corpus);
+    const Uint threads = ShaderCompilePool::Get().GetThreadCount();
+
+    std::printf("RESULT mode=corpus engine=%s threads=%u corpus=%s shaders=%zu programs=%zu "
+                "bytes=%zu total_ms=%.3f submit_ms=%.3f join_ms=%.3f link_fail=%zu "
+                "compile_fail=%zu\n",
+                engineName, threads, corpusDir.c_str(), corpus.shaders.size(),
+                corpus.programs.size(), corpus.totalBytes, result.totalMs, result.submitMs,
+                result.joinMs, result.linkFailures, result.compileFailures);
+    return 0;
+}

MobileGL/MG_Test/Util/CMakeLists.txt

@@ -10,11 +10,35 @@ target_include_directories(JobNodeTest PRIVATE
         ${MGL_ROOT}/MobileGL
 )
 
+# GTest::gtest, not GTest::gtest_main: JobNodeTest supplies its own main so that
+# MOBILEGL_LOG_FILE_PATH is set before the first log write in the process. The engine
+# -selection cases read the log back to assert that an unrecognized MOBILEGL_ASYNC_POOL value
+# warns, and the desktop log sink is the file (MOBILEGL_LOG_ENABLE_CONSOLE is 0).
 target_link_libraries(
         JobNodeTest PRIVATE
-        GTest::gtest_main
+        GTest::gtest
         ${LINK_LIBRARIES}
 )
 
 include(GoogleTest)
 gtest_discover_tests(JobNodeTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
+
+# The engine comparison harness. Deliberately NOT registered with add_test: it measures wall
+# time, so it has no pass/fail verdict to give CI, and it is driven by a script that varies
+# MOBILEGL_ASYNC_POOL and MOBILEGL_ASYNC_SHADER_COMPILE_THREADS across a matrix. It lives
+# beside JobNodeTest because it drives the same pool through the same two engines; it links
+# MobileGL_s for the real glCompileShader/glLinkProgram frontend path.
+add_executable(
+        AsyncPoolBench
+        AsyncPoolBench.cpp
+)
+
+target_include_directories(AsyncPoolBench PRIVATE
+        ${MGL_ROOT}/include
+        ${MGL_ROOT}/MobileGL
+)
+
+target_link_libraries(
+        AsyncPoolBench PRIVATE
+        ${LINK_LIBRARIES}
+)

MobileGL/MG_Test/Util/JobNodeTest.cpp

@@ -9,8 +9,19 @@
 #include <gtest/gtest.h>
 
 #include <chrono>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
 #include <stdexcept>
 
+#ifdef _WIN32
+#include <process.h>
+#define MGL_TEST_GETPID _getpid
+#else
+#include <unistd.h>
+#define MGL_TEST_GETPID getpid
+#endif
+
 #include "Includes.h"
 #include <Config.h>
 
@@ -21,6 +32,29 @@ using namespace MobileGL;
 using namespace MobileGL::MG_Util::Async;
 
 namespace {
+    // Where this binary's MobileGL log lands, set by main() below. The engine-selection cases
+    // read it back: MobileGL's desktop log sink is the FILE, not the console
+    // (MOBILEGL_LOG_ENABLE_CONSOLE is 0 in Defines.h), so gtest's stdout capture would see
+    // nothing, and "unrecognized value warns" is a contract worth pinning rather than
+    // assuming - a silent fallback makes a misspelt engine name look exactly like an unset
+    // variable.
+    String g_logFilePath;
+
+    // Log.cpp flushes the file after every line, so everything written before this call is
+    // already visible.
+    String ReadLogFrom(const std::streamoff offset) {
+        std::ifstream file(g_logFilePath, std::ios::binary);
+        if (!file) return {};
+        file.seekg(offset);
+        return String((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+    }
+
+    std::streamoff LogSize() {
+        std::error_code error;
+        const auto size = std::filesystem::file_size(g_logFilePath, error);
+        return error ? 0 : static_cast<std::streamoff>(size);
+    }
+
     // Every test drives its own pool instance rather than ShaderCompilePool::Get(): the
     // process-wide pool is stopped permanently by StopAndDrain (that is the teardown
     // contract), so a test that drained the singleton would poison every test after it.
@@ -73,6 +107,21 @@ namespace {
         Bool m_open = false;
     };
 
+    // Live thread count of this process. Linux only - /proc/self/task has one entry per
+    // thread - and 0 where that is not available, which is how the one case that uses it
+    // decides to skip rather than to assert something it cannot see.
+    SizeT LiveThreadCount() {
+#ifdef __linux__
+        std::error_code error;
+        const auto count = static_cast<SizeT>(
+            std::distance(std::filesystem::directory_iterator("/proc/self/task", error),
+                          std::filesystem::directory_iterator()));
+        return error ? 0 : count;
+#else
+        return 0;
+#endif
+    }
+
     Bool WaitUntil(const std::function<Bool()>& predicate,
                    const std::chrono::milliseconds timeout = std::chrono::seconds(10)) {
         const auto deadline = std::chrono::steady_clock::now() + timeout;
@@ -89,11 +138,33 @@ namespace {
 // ---------------------------------------------------------------------------------------
 
 TEST(ShaderCompilePoolLifecycle, ConstructingAPoolStartsNoThreadUntilSomethingIsPosted) {
+    const SizeT before = LiveThreadCount();
+
     ShaderCompilePool pool(kTestThreads);
     EXPECT_EQ(pool.GetThreadCount(), kTestThreads);
     EXPECT_EQ(pool.GetMaxConcurrency(), kTestThreads);
-    // Nothing observable to assert about thread creation from here; what this pins is that
+
-    // construction is side-effect free and the pool destructs cleanly without ever running.
+    if (before == 0) {
+        // No thread census on this platform. The rest still holds: construction is
+        // side-effect free and the pool destructs cleanly without ever having run.
+        SUCCEED();
+        return;
+    }
+
+    // "A build that never posts pays nothing" is a real requirement, not a stylistic one -
+    // asynchronous compilation can be switched off entirely, and a switched-off pool that
+    // still spawned its workers would cost every such process its threads and their stacks.
+    // Worth asserting rather than asserting-by-comment now that an engine's thread shape is
+    // selectable: the libfork engine starts its workers AND a dispatch thread of its own, so
+    // a regression here would cost more than it used to.
+    EXPECT_EQ(LiveThreadCount(), before) << "constructing a pool started " << (LiveThreadCount() - before)
+                                         << " thread(s) before anything was posted";
+
+    auto job = MakeShared<TestJob>();
+    pool.Post(job);
+    job->Wait();
+    EXPECT_GT(LiveThreadCount(), before) << "the first Post started no thread at all, so the engine did not "
+                                            "really run the job off the calling thread";
 }
 
 TEST(ShaderCompilePoolLifecycle, StopAndDrainIsIdempotentAndSafeOnAnUnusedPool) {
@@ -135,16 +206,18 @@ TEST(ShaderCompilePoolLifecycle, DetectedThreadCountIsPositive) {
     EXPECT_GE(DetectShaderCompileThreadCount(), 1u);
 }
 
-TEST(ShaderCompilePoolLifecycle, AsyncIsOffByDefaultAndTheOverrideDecidesEitherWay) {
+TEST(ShaderCompilePoolLifecycle, AsyncIsOnByDefaultAndTheOverrideDecidesEitherWay) {
-    // The shipped default is still off, and an unset MOBILEGL_ASYNC_SHADER_COMPILE resolves
+    // The shipped default flipped to ON at stage 7 (the GL30-40 + parallel_shader_compile
-    // to it. If the first expectation ever fails without the constant having been
+    // gate found zero async-attributable failures), and an unset
-    // deliberately flipped, something enabled async by accident.
+    // MOBILEGL_ASYNC_SHADER_COMPILE resolves to it. If the first expectation ever fails
+    // without the constant having been deliberately flipped back, something disabled async
+    // by accident - the kill switch below is the supported way off.
     //
-    // Driven through Features rather than read from it: from stage 3 on, the whole suite is
+    // Driven through Features rather than read from it: the suite is also run with
-    // also run with MOBILEGL_ASYNC_SHADER_COMPILE=1 exported, so a test that simply asserted
+    // MOBILEGL_ASYNC_SHADER_COMPILE exported both ways, so a test that simply asserted
-    // "the resolved answer is false" would either fail there or - worse - silently pass in a
+    // the resolved answer would fail in one of those runs or - worse - silently pass in a
     // binary that never loaded the config and prove nothing at all.
-    EXPECT_FALSE(kAsyncShaderCompileDefault);
+    EXPECT_TRUE(kAsyncShaderCompileDefault);
 
     const MG_Config::QuirkOverride saved = MG_Config::Features.AsyncShaderCompile;
     MG_Config::Features.AsyncShaderCompile = MG_Config::QuirkOverride::Auto;
@@ -215,6 +288,94 @@ TEST(JobNodeSubmit, ManyJobsAllComplete) {
     }
 }
 
+TEST(JobNodeSubmit, AJobBodyMayPostAnotherJobToTheSamePool) {
+    // The ProgramLinkTask::SubmitAfter shape, reduced to its scheduling core: the dependent is
+    // posted by whichever thread drove the dependency terminal, which for a job that finished
+    // on a worker is that WORKER. Every engine therefore has to accept a submission from
+    // inside its own pool.
+    //
+    // Not a hypothetical: libfork refuses this outright at its normal entry point
+    // (lf::schedule throws lf::schedule_in_worker, because a libfork worker may never block),
+    // which is why the libfork engine owns a dispatch thread of its own. Without this case a
+    // naive port passes every other test in the file and turns every dependency-released link
+    // job into a cancelled one on the real GL path.
+    ShaderCompilePool pool(kTestThreads);
+
+    std::atomic<Bool> innerSawPoolThread{false};
+    auto inner = MakeShared<TestJob>(
+        [&](TestJob&) { innerSawPoolThread.store(ShaderCompilePool::IsPoolThread(), std::memory_order_release); });
+
+    std::atomic<Bool> postedFromPoolThread{false};
+    auto outer = MakeShared<TestJob>([&](TestJob&) {
+        postedFromPoolThread.store(ShaderCompilePool::IsPoolThread(), std::memory_order_release);
+        pool.Post(inner);
+    });
+
+    pool.Post(outer);
+    outer->Wait();
+    inner->Wait();
+
+    EXPECT_TRUE(postedFromPoolThread.load()) << "the outer body did not run on a pool thread, so this case "
+                                                "did not exercise posting from inside the pool";
+    EXPECT_TRUE(outer->IsComplete());
+    // The load-bearing one: the inner job RAN. A dispatch the engine refused would have
+    // settled it Cancelled instead, and its body would never have executed.
+    EXPECT_TRUE(inner->IsComplete()) << "a job posted from a pool thread was not dispatched";
+    EXPECT_FALSE(inner->IsCancelled());
+    EXPECT_EQ(inner->ran.load(), 1u);
+    EXPECT_TRUE(innerSawPoolThread.load());
+}
+
+TEST(JobNodeSubmit, ABurstPostedFromInsideThePoolStillRunsInParallel) {
+    // The tail of a pack load: one compile job goes terminal and its continuations release
+    // several programs at once (ShaderCompileAdoptionMap lets one compile settle many), so a
+    // WORKER posts a burst into a pool that is otherwise idle. Every one of those posts clears
+    // the budget immediately, so the engine is handed `kBurst` runnable jobs from inside
+    // itself - and it has to spread them, not run them one behind another on the thread that
+    // submitted them.
+    //
+    // Asserting on peak concurrency rather than on wall time: the budget is the contract, and
+    // an engine that dispatches within the budget but executes serially has silently turned
+    // the budget into an upper bound nothing reaches.
+    constexpr Uint kBurst = 4; // == kTestThreads, so the budget can hold all of them at once
+    ShaderCompilePool pool(kTestThreads);
+
+    std::atomic<Uint> live{0};
+    std::atomic<Uint> peak{0};
+    std::atomic<Uint> finished{0};
+
+    Vector<SharedPtr<TestJob>> burst;
+    burst.reserve(kBurst);
+    for (Uint i = 0; i < kBurst; ++i) {
+        burst.push_back(MakeShared<TestJob>([&](TestJob&) {
+            const Uint now = live.fetch_add(1, std::memory_order_acq_rel) + 1;
+            Uint seen = peak.load(std::memory_order_acquire);
+            while (now > seen && !peak.compare_exchange_weak(seen, now, std::memory_order_acq_rel)) {
+            }
+            // Long enough that a serial engine cannot fake overlap, short enough to keep the
+            // case cheap: with any real spread every body is inside this window together.
+            std::this_thread::sleep_for(std::chrono::milliseconds(120));
+            live.fetch_sub(1, std::memory_order_acq_rel);
+            finished.fetch_add(1, std::memory_order_acq_rel);
+        }));
+    }
+
+    std::atomic<Bool> postedFromPoolThread{false};
+    auto seeder = MakeShared<TestJob>([&](TestJob&) {
+        postedFromPoolThread.store(ShaderCompilePool::IsPoolThread(), std::memory_order_release);
+        for (const auto& job : burst) pool.Post(job);
+    });
+
+    pool.Post(seeder);
+    seeder->Wait();
+    for (const auto& job : burst) job->Wait();
+
+    ASSERT_TRUE(postedFromPoolThread.load()) << "the burst was not posted from a pool thread";
+    EXPECT_EQ(finished.load(), kBurst);
+    EXPECT_GT(peak.load(), 1u) << "a burst posted from inside the pool ran strictly one at a time; the "
+                                  "engine serialized work the budget had already cleared";
+}
+
 TEST(JobNodeSubmit, ConcurrencyBudgetIsNeverExceeded) {
     constexpr Uint kBudget = 2;
     constexpr Uint kJobs = 64;
@@ -470,30 +631,58 @@ TEST(JobNodeException, AThrowingJobDoesNotPoisonTheWorkerForLaterJobs) {
 // ---------------------------------------------------------------------------------------
 
 TEST(ShaderCompilePoolDrain, StopAndDrainWithAThousandQueuedJobsLeavesNoneRunningOrPending) {
-    constexpr Uint kJobs = 1000;
+    constexpr Uint kQueued = 1000;
     ShaderCompilePool pool(kTestThreads);
-    pool.SetMaxConcurrency(1); // keep the vast majority queued behind the budget
+    pool.SetMaxConcurrency(1); // one slot, so everything behind the first job stays queued
 
-    Vector<SharedPtr<TestJob>> jobs;
+    // Pin that slot with a job that will not return until this test says so. Everything
-    jobs.reserve(kJobs);
+    // posted behind it is then PROVABLY still in the queue, which is what makes the counts
-    for (Uint i = 0; i < kJobs; ++i) {
+    // below exact.
-        jobs.push_back(MakeShared<TestJob>());
+    //
-        pool.Post(jobs.back());
+    // This case used to post a thousand trivial jobs and drain immediately, hoping the drain
+    // would beat the workers to some of them - and then assert only that "some" were
+    // cancelled. That hope does not survive an engine whose workers take their next job
+    // without a scheduler round trip: the libfork engine drained all thousand before the
+    // posting loop had finished, so the assertion failed about one run in fifty. The property
+    // being tested (a drain ABANDONS queued work rather than running it) is real and
+    // engine-independent; only the way it was provoked was a race.
+    Gate gate;
+    std::atomic<Bool> entered{false};
+    auto blocker = MakeShared<TestJob>([&](TestJob&) {
+        entered.store(true, std::memory_order_release);
+        gate.Wait();
+    });
+    pool.Post(blocker);
+    ASSERT_TRUE(WaitUntil([&] { return entered.load(); }));
+
+    Vector<SharedPtr<TestJob>> queued;
+    queued.reserve(kQueued);
+    for (Uint i = 0; i < kQueued; ++i) {
+        queued.push_back(MakeShared<TestJob>());
+        pool.Post(queued.back());
     }
+    for (const auto& job : queued) ASSERT_FALSE(job->IsTerminal());
 
-    pool.StopAndDrain();
+    std::thread drain([&] { pool.StopAndDrain(); });
+    // StopAndDrain settles the entire queue before it waits for the running body, so the
+    // first cancelled node proves it is past that point - and the gate can then be released
+    // without racing it.
+    ASSERT_TRUE(WaitUntil([&] { return queued.front()->IsTerminal(); }));
+    gate.Open();
+    drain.join();
 
-    // Every node is terminal, so nothing can be waiting on a worker that will never come.
+    // The job that was already running still finished: an in-flight body is waited for, not
-    Uint complete = 0;
+    // interrupted.
-    Uint cancelled = 0;
+    EXPECT_TRUE(blocker->IsComplete());
-    for (const auto& job : jobs) {
+    EXPECT_EQ(blocker->ran.load(), 1u);
+
+    // And every queued node is terminal, so nothing is left waiting on a worker that will
+    // never come - settled as cancelled, with its body never entered.
+    for (const auto& job : queued) {
         ASSERT_TRUE(job->IsTerminal());
-        if (job->IsComplete()) ++complete;
+        EXPECT_TRUE(job->IsCancelled());
-        if (job->IsCancelled()) ++cancelled;
+        EXPECT_EQ(job->ran.load(), 0u);
-        EXPECT_LE(job->ran.load(), 1u);
     }
-    EXPECT_EQ(complete + cancelled, kJobs);
-    EXPECT_GT(cancelled, 0u); // the drain really did abandon queued work rather than run it
 }
 
 TEST(ShaderCompilePoolDrain, StopAndDrainWaitsForARunningBodyToReturn) {
@@ -533,3 +722,141 @@ TEST(ShaderCompilePoolDrain, JobsPostedAfterADrainStillRun) {
     EXPECT_TRUE(job->IsComplete());
     EXPECT_EQ(job->ran.load(), 1u);
 }
+
+// ---------------------------------------------------------------------------------------
+// Execution engine selection (MOBILEGL_ASYNC_POOL)
+// ---------------------------------------------------------------------------------------
+//
+// The engine decides only HOW a job that the concurrency budget has already cleared reaches a
+// worker thread. Everything else in this file - the budget, cancel request-vs-outcome, the
+// continuation machinery, the inline fallback after a stop, the drain - is engine-independent
+// by construction, which is why the whole suite is expected to pass unchanged with
+// MOBILEGL_ASYNC_POOL unset and with it set to libfork. These cases pin the selection itself,
+// so that a run of the matrix cannot silently test asio twice.
+
+TEST(AsyncPoolEngineSelection, EveryAcceptedSpellingParsesToItsEngine) {
+    EXPECT_EQ(ParseAsyncPoolEngine("asio"), AsyncPoolEngine::Asio);
+    EXPECT_EQ(ParseAsyncPoolEngine("libfork"), AsyncPoolEngine::Libfork);
+    // Case-insensitive, like the other named-value variables (MOBILEGL_*_MULTIDRAW_MODE).
+    EXPECT_EQ(ParseAsyncPoolEngine("Libfork"), AsyncPoolEngine::Libfork);
+    EXPECT_EQ(ParseAsyncPoolEngine("LIBFORK"), AsyncPoolEngine::Libfork);
+    EXPECT_EQ(ParseAsyncPoolEngine("ASIO"), AsyncPoolEngine::Asio);
+
+    EXPECT_STREQ(AsyncPoolEngineName(AsyncPoolEngine::Asio), "asio");
+    EXPECT_STREQ(AsyncPoolEngineName(AsyncPoolEngine::Libfork), "libfork");
+    // Round trip: whatever the name prints is a spelling the variable accepts back.
+    EXPECT_EQ(ParseAsyncPoolEngine(AsyncPoolEngineName(AsyncPoolEngine::Asio)), AsyncPoolEngine::Asio);
+    EXPECT_EQ(ParseAsyncPoolEngine(AsyncPoolEngineName(AsyncPoolEngine::Libfork)), AsyncPoolEngine::Libfork);
+}
+
+TEST(AsyncPoolEngineSelection, EmptyAndAutoAreTheDefaultEngineAndSaySoSilently) {
+    // Unset resolves through the empty string, and "auto" is the spelling the other named
+    // -value variables accept for "no preference". Neither is a mistake, so neither warns.
+    const std::streamoff before = LogSize();
+    EXPECT_EQ(ParseAsyncPoolEngine(""), AsyncPoolEngine::Asio);
+    EXPECT_EQ(ParseAsyncPoolEngine("auto"), AsyncPoolEngine::Asio);
+    EXPECT_EQ(ReadLogFrom(before).find("MOBILEGL_ASYNC_POOL"), String::npos)
+        << "a legitimate value warned; only an unrecognized one may";
+}
+
+TEST(AsyncPoolEngineSelection, AnUnrecognizedEngineNameFallsBackToAsioAndWarns) {
+    const std::streamoff before = LogSize();
+    EXPECT_EQ(ParseAsyncPoolEngine("libfrok"), AsyncPoolEngine::Asio);
+
+// The warning is the other half of the contract: a misspelt engine name that fell back
+// silently would be indistinguishable from an unset variable, and a scaling measurement
+// taken against the wrong engine is worse than no measurement.
+//
+// Guarded because MGLOG_W is a compile-time no-op unless the build's log level admits it -
+// and the shipped level does not (Log.h orders the levels DEBUG=0, WARN=1, ERROR=2, INFO=3,
+// FATAL=4 and gates on `ACTIVE <= LEVEL`, so the default INFO build enables only INFO and
+// FATAL). Nothing is skipped: the fallback above is pinned in every build, and this half is
+// checked by a build configured with
+// -DMOBILEGL_LOG_ACTIVE_LEVEL=MOBILEGL_LOG_LEVEL_WARN. The same guard is what makes the
+// preceding "says so silently" case honest rather than vacuously true.
+#if MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_WARN
+    const String logged = ReadLogFrom(before);
+    EXPECT_NE(logged.find("MOBILEGL_ASYNC_POOL"), String::npos) << "no warning names the variable; log tail: " << logged;
+    EXPECT_NE(logged.find("libfrok"), String::npos)
+        << "the warning does not quote the rejected value; log tail: " << logged;
+    EXPECT_NE(logged.find("asio"), String::npos)
+        << "the warning does not say what it fell back to; log tail: " << logged;
+#else
+    (void)before;
+#endif
+}
+
+TEST(AsyncPoolEngineSelection, TheDetectedEngineIsTheOneTheEnvironmentAskedFor) {
+    // Read the variable directly rather than through the pool, so this really compares the
+    // process's answer against the environment the runner exported. This is the case that
+    // makes "the suite passed with MOBILEGL_ASYNC_POOL=libfork" mean something.
+    const char* const raw = std::getenv("MOBILEGL_ASYNC_POOL");
+    const AsyncPoolEngine expected = ParseAsyncPoolEngine(raw != nullptr ? String(raw) : String());
+    EXPECT_EQ(DetectAsyncPoolEngine(), expected);
+
+    // Stable: resolved once per process, so it cannot drift between calls.
+    EXPECT_EQ(DetectAsyncPoolEngine(), DetectAsyncPoolEngine());
+
+    if (DetectAsyncPoolEngine() != AsyncPoolEngine::Asio) {
+        // Selecting a non-default engine announces itself at INFO, which the shipped log level
+        // does admit - so on the libfork half of the matrix this doubles as the positive
+        // control for the log plumbing the preceding two cases read: it proves
+        // MOBILEGL_LOG_FILE_PATH took effect and that ReadLogFrom really sees MobileGL's
+        // output, rather than passing because the file is always empty.
+        const String logged = ReadLogFrom(0);
+        EXPECT_NE(logged.find("MOBILEGL_ASYNC_POOL"), String::npos)
+            << "the selected engine was never announced, so this binary's log capture proves nothing";
+        EXPECT_NE(logged.find(AsyncPoolEngineName(DetectAsyncPoolEngine())), String::npos);
+    }
+}
+
+TEST(AsyncPoolEngineSelection, EveryPoolReportsTheProcessEngineAndRunsWorkOnIt) {
+    ShaderCompilePool first(kTestThreads);
+    ShaderCompilePool second(kTestThreads);
+    EXPECT_EQ(first.GetEngine(), DetectAsyncPoolEngine());
+    EXPECT_EQ(second.GetEngine(), first.GetEngine())
+        << "two pools in one process disagree about the engine; a process must never run both";
+
+    // And the engine it reports is the one that actually executed the work: the body ran off
+    // the calling thread, on a thread the pool owns.
+    const auto callingThread = std::this_thread::get_id();
+    std::atomic<Bool> sawPoolThread{false};
+    std::thread::id bodyThread{};
+    auto job = MakeShared<TestJob>([&](TestJob&) {
+        sawPoolThread.store(ShaderCompilePool::IsPoolThread(), std::memory_order_release);
+        bodyThread = std::this_thread::get_id();
+    });
+    first.Post(job);
+    job->Wait();
+
+    ASSERT_TRUE(job->IsComplete());
+    EXPECT_TRUE(sawPoolThread.load());
+    EXPECT_NE(bodyThread, callingThread);
+}
+
+// gtest_main is replaced here for one reason: the engine-selection cases above assert that an
+// unrecognized MOBILEGL_ASYNC_POOL value WARNS, and MobileGL's desktop log sink is the log
+// file - MOBILEGL_LOG_ENABLE_CONSOLE is 0 in Defines.h, so there is nothing on stdout to
+// capture. MOBILEGL_LOG_FILE_PATH is read by Log.cpp's InitFile() at the first log write in
+// the process, so it has to be set before any test body runs.
+int main(int argc, char** argv) {
+    const std::filesystem::path logPath =
+        std::filesystem::temp_directory_path() /
+        ("mobilegl-jobnodetest-" + std::to_string(static_cast<long long>(MGL_TEST_GETPID())) + ".log");
+    g_logFilePath = logPath.string();
+    std::filesystem::remove(logPath);
+#ifdef _WIN32
+    ::_putenv_s("MOBILEGL_LOG_FILE_PATH", g_logFilePath.c_str());
+#else
+    ::setenv("MOBILEGL_LOG_FILE_PATH", g_logFilePath.c_str(), 1);
+#endif
+
+    ::testing::InitGoogleTest(&argc, argv);
+    const int result = RUN_ALL_TESTS();
+
+    // Best-effort: leaving a log file per test process in the temp directory would be litter,
+    // and a failed run has already printed the tail it needed into the gtest output.
+    std::error_code ignored;
+    std::filesystem::remove(logPath, ignored);
+    return result;
+}

MobileGL/MG_Test/VertexArray/VertexArrayTest.cpp

@@ -1290,3 +1290,77 @@ TEST_F(GeneralVertexArrayTest, ArrayFormat_IntegerPathRejectsPackedAndBgra) {
     EXPECT_FALSE(a0.IsBgra);
 }
 
+
+// The integer path takes exactly the eight signed/unsigned integer types (GL 4.6 core 10.3.2).
+// The old check was a blacklist of Unknown + the packed types, so GL_FLOAT / GL_HALF_FLOAT /
+// GL_DOUBLE / GL_FIXED all converted to a valid DataType and were silently recorded as integer
+// attributes.
+TEST_F(GeneralVertexArrayTest, ArrayFormat_IntegerPathRejectsFloatTypes) {
+    CreateVAO();
+    CreateVBO(GL_ARRAY_BUFFER, 64);
+
+    // Establish a known-good integer format first, so a rejected call is visible as "unchanged".
+    VertexAttribIPointer(0, 4, GL_INT, 0, nullptr);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    const GLenum floatTypes[] = {GL_FLOAT, GL_HALF_FLOAT, GL_DOUBLE, GL_FIXED};
+    for (GLenum type : floatTypes) {
+        VertexAttribIPointer(0, 4, type, 0, nullptr);
+        EXPECT_EQ(GetError(), GL_INVALID_ENUM) << "type " << type << " was accepted on the integer path";
+        const auto& attribute = MG_State::pGLContext->GetBoundVertexArray()->GetAttribute(0);
+        EXPECT_EQ(attribute.Type, DataType::Int32) << "a rejected format must not take effect";
+        EXPECT_TRUE(attribute.IsInteger);
+    }
+
+    // The float path still accepts them.
+    VertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+    EXPECT_EQ(MG_State::pGLContext->GetBoundVertexArray()->GetAttribute(0).Type, DataType::Float32);
+}
+
+// ARB_vertex_attrib_binding's two per-attribute queries. They were missing from
+// ValidateVertexAttribPname (so glGetVertexAttribiv answered INVALID_ENUM) and from
+// glGetVertexArrayIndexediv's switch (GL_VERTEX_ATTRIB_BINDING only).
+TEST_F(GeneralVertexArrayTest, ArrayFormat_BindingAndRelativeOffsetAreQueryable) {
+    const GLuint vao = CreateVAO();
+    CreateVBO(GL_ARRAY_BUFFER, 256);
+
+    VertexAttribFormat(2, 3, GL_FLOAT, GL_FALSE, 12);
+    VertexAttribBinding(2, 5);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    GLint binding = -1;
+    GetVertexAttribiv(2, GL_VERTEX_ATTRIB_BINDING, &binding);
+    EXPECT_EQ(binding, 5);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+    GLint relativeOffset = -1;
+    GetVertexAttribiv(2, GL_VERTEX_ATTRIB_RELATIVE_OFFSET, &relativeOffset);
+    EXPECT_EQ(relativeOffset, 12);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+    // The float and double views convert the same value.
+    GLfloat bindingAsFloat = -1.0f;
+    GetVertexAttribfv(2, GL_VERTEX_ATTRIB_BINDING, &bindingAsFloat);
+    EXPECT_FLOAT_EQ(bindingAsFloat, 5.0f);
+    GLdouble offsetAsDouble = -1.0;
+    GetVertexAttribdv(2, GL_VERTEX_ATTRIB_RELATIVE_OFFSET, &offsetAsDouble);
+    EXPECT_DOUBLE_EQ(offsetAsDouble, 12.0);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+    // The by-name (DSA) indexed query answers both as well.
+    GLint namedBinding = -1;
+    GetVertexArrayIndexediv(vao, 2, GL_VERTEX_ATTRIB_BINDING, &namedBinding);
+    EXPECT_EQ(namedBinding, 5);
+    GLint namedRelativeOffset = -1;
+    GetVertexArrayIndexediv(vao, 2, GL_VERTEX_ATTRIB_RELATIVE_OFFSET, &namedRelativeOffset);
+    EXPECT_EQ(namedRelativeOffset, 12);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+    // An attribute nobody re-bound keeps the default attribute-i -> binding-i mapping.
+    GetVertexAttribiv(1, GL_VERTEX_ATTRIB_BINDING, &binding);
+    EXPECT_EQ(binding, 1);
+    GetVertexAttribiv(1, GL_VERTEX_ATTRIB_RELATIVE_OFFSET, &relativeOffset);
+    EXPECT_EQ(relativeOffset, 0);
+    EXPECT_EQ(GetError(), GL_NO_ERROR);
+}

MobileGL/MG_Util/Async/ShaderCompilePool.cpp

@@ -12,8 +12,14 @@
 #include <asio/post.hpp>
 #include <asio/thread_pool.hpp>
 
+#include <libfork/core.hpp>
+#include <libfork/schedule/lazy_pool.hpp>
+
 #include <cstdio>
+#include <cstdlib>
 #include <deque>
+#include <functional>
+#include <span>
 
 namespace MobileGL::MG_Util::Async {
     namespace {
@@ -135,46 +141,506 @@ namespace MobileGL::MG_Util::Async {
         return std::clamp(DetectBigCoreCount(), 1u, kMaxAutoShaderCompileThreads);
     }
 
+    // ---- Engine selection -----------------------------------------------------------------
+
+    const char* AsyncPoolEngineName(const AsyncPoolEngine engine) {
+        switch (engine) {
+        case AsyncPoolEngine::Libfork: return "libfork";
+        case AsyncPoolEngine::Asio: break;
+        }
+        return "asio";
+    }
+
+    AsyncPoolEngine ParseAsyncPoolEngine(const String& value) {
+        String lowered = value;
+        std::transform(lowered.begin(), lowered.end(), lowered.begin(),
+                       [](const unsigned char c) { return static_cast<char>(std::tolower(c)); });
+        if (lowered == "libfork") return AsyncPoolEngine::Libfork;
+        if (lowered == "asio" || lowered == "auto" || lowered.empty()) return AsyncPoolEngine::Asio;
+        // Not silent: a misspelt engine name resolving to the default would be
+        // indistinguishable from not having set the variable at all, and the only reason to
+        // set it is to know which engine ran.
+        MGLOG_W("Config: Ignoring invalid env variable MOBILEGL_ASYNC_POOL='%s'; expected asio|libfork, "
+                "using asio",
+                value.c_str());
+        return AsyncPoolEngine::Asio;
+    }
+
+    AsyncPoolEngine DetectAsyncPoolEngine() {
+        // A live std::getenv rather than an MG_Config::Features mirror, and deliberately so:
+        // a ShaderCompilePool is constructed by binaries that never call MobileGL::Initialize()
+        // and therefore never run MG_ConfigLoader::Init() - MG_Test/Util/JobNodeTest builds
+        // pools directly, and it is the suite that exercises the engines against each other.
+        // Reading Features there would silently resolve to the default and the libfork half of
+        // the test matrix would prove nothing. See the exemption list in Config.h.
+        //
+        // Resolved once per process (a function-local static): every pool in a process gets
+        // the same engine, so a process can never end up running two.
+        static const AsyncPoolEngine engine = [] {
+            const char* value = std::getenv("MOBILEGL_ASYNC_POOL");
+            const AsyncPoolEngine resolved = ParseAsyncPoolEngine(value != nullptr ? String(value) : String());
+            if (resolved != AsyncPoolEngine::Asio) {
+                MGLOG_I("ShaderCompilePool: MOBILEGL_ASYNC_POOL selected the %s execution engine",
+                        AsyncPoolEngineName(resolved));
+            }
+            return resolved;
+        }();
+        return engine;
+    }
+
+    namespace {
+        // ---- The engine boundary ----------------------------------------------------------
+        // Submit() has exactly asio::post's contract, and ShaderCompilePool::Impl leans on all
+        // four halves of it:
+        //   * it NEVER runs `fn` on the calling thread. DispatchLocked calls it while holding
+        //     the pool's plain, non-recursive mutex, and a job body (or a terminal
+        //     continuation it releases) is free to call Post() again - an inline run would
+        //     deadlock on the lock this frame already owns.
+        //   * it is callable from ANY thread, a worker of this very pool included:
+        //     ProgramLinkTask::OnDepSettled posts the link job from whichever thread drove the
+        //     last compile terminal, which is a worker.
+        //   * it may throw, and when it does it must not have consumed the caller's job node,
+        //     so Post/DispatchLocked can settle the node instead of stranding it Pending with
+        //     a joiner blocked forever.
+        //   * once it has accepted `fn`, `fn` WILL run. A dropped callable is a node nothing
+        //     ever settles, so the engines run it themselves rather than discard it.
+        class JobExecutor {
+        public:
+            virtual ~JobExecutor() = default;
+            JobExecutor() = default;
+            JobExecutor(const JobExecutor&) = delete;
+            JobExecutor& operator=(const JobExecutor&) = delete;
+
+            virtual void Submit(std::function<void()> fn) = 0;
+
+            // Returns once every callable ever handed to Submit has finished running. The
+            // guarantee StopAndDrain sells to library teardown: after it returns, no worker is
+            // still inside a job body that could touch glslang's process globals.
+            virtual void JoinAll() = 0;
+        };
+
+        // ---- Engine 1: Asio (the shipped default) -----------------------------------------
+        class AsioJobExecutor final : public JobExecutor {
+        public:
+            explicit AsioJobExecutor(const Uint threads) : m_pool(threads) {}
+
+            // asio::post only enqueues; it never runs the handler on the calling thread, which
+            // is what makes calling it under the pool mutex safe.
+            void Submit(std::function<void()> fn) override { asio::post(m_pool, Move(fn)); }
+
+            void JoinAll() override { m_pool.join(); }
+
+        private:
+            asio::thread_pool m_pool;
+        };
+
+        // ---- Engine 2: libfork ------------------------------------------------------------
+        //
+        // libfork is a continuation-stealing fork-join runtime, and the shape that fits here is
+        // NOT fork-join: a job body is one coarse, blocking, non-forking unit (a glslang
+        // compile), and the concurrency budget that bounds peak RSS is Impl's, not the
+        // scheduler's. So libfork is used as a job executor - each dispatched job is a detached
+        // root task - and what it is being asked to beat is Asio's single scheduler queue with
+        // its per-worker work-stealing deques and sleeping workers.
+        //
+        // The one thing libfork forbids is the thing this pool does constantly: lf::schedule
+        // (which lf::detach is built on) THROWS lf::schedule_in_worker when the calling thread
+        // is a libfork worker, because workers may never block. Yet a worker submits on every
+        // job completion - RunOnWorker's tail refills the budget - and again whenever a
+        // terminal continuation posts (ProgramLinkTask::OnDepSettled). Routing those through a
+        // separate dispatch thread works but costs two thread wakeups per job, which measured
+        // 4x worse than Asio on short jobs. So instead a dispatched root is a CHAIN: when its
+        // body returns it takes the next queued job itself and runs it in the same coroutine
+        // on the same worker. The refill a worker submits is therefore absorbed by the very
+        // chain that submitted it - no scheduler round trip, no wakeup - and libfork is only
+        // entered for work that arrives from outside the pool.
+        //
+        // Absorption is bounded at one job per running chain, though, because a chain is one
+        // worker: past that bound the queue would be jobs the budget has already cleared,
+        // waiting behind each other on a single thread. See Submit.
+        //
+        // Why none of this can strand a job: the queue below is only ever added to from inside
+        // a running chain (tl_chainOwner == this), and a chain exits only when it finds the
+        // queue empty - unconditionally, whatever the bound says. Every other submitter goes
+        // to the dispatch thread or straight to lf::detach.
+        class LibforkJobExecutor;
+
+        // Which executor's chain, if any, is running on this thread. Deliberately narrower
+        // than ShaderCompilePool::IsPoolThread(): that flag is process-wide and latched
+        // forever, so a worker of a DIFFERENT pool would read as "mine" and queue a job into a
+        // chain that will never drain it. This says exactly "a chain of *this* executor is
+        // executing on this thread, and it will look at the queue again before it exits".
+        thread_local LibforkJobExecutor* tl_chainOwner = nullptr;
+
+        // One dispatched job, heap-owned. It reaches its coroutine as a POINTER passed BY
+        // VALUE: libfork forwards a root task's arguments into the coroutine frame, so a
+        // by-value pointer is copied into the frame, whereas anything passed by reference
+        // would dangle the moment lf::detach returns - and detach, unlike sync_wait, does not
+        // outlive the task.
+        struct LibforkJob {
+            std::function<void()> body;
+            LibforkJobExecutor* owner;
+        };
+
+        // A scheduler adaptor for lf::detach: it places external submissions round-robin over
+        // lf::lazy_pool's worker contexts instead of letting the pool pick one at random.
+        // Both reasons are load-bearing, and the second was worth 1.3x at a budget equal to
+        // the worker count - the configuration MobileGL actually ships, since maxConcurrency
+        // is clamped to the thread count:
+        //   * lf::lazy_pool::schedule chooses its victim with a
+        //     std::uniform_int_distribution over a lazy_pool-member xoshiro generator -
+        //     unsynchronized mutable state, so two concurrent submissions are a data race
+        //     inside libfork itself. An atomic cursor is not.
+        //   * A worker's SUBMISSION list is drained only by that worker
+        //     (worker_context::try_pop_all is documented "for use only by the owning worker
+        //     thread"); a thief takes from the task deque, which is a different queue. So a
+        //     job placed on a worker that is inside a long blocking body waits for that body
+        //     rather than being stolen - and random placement of `budget` submissions over
+        //     `budget` workers collides by the birthday rule. Round-robin lands the GL
+        //     thread's burst one per worker, which is exactly the intended shape.
+        struct RoundRobinSubmitter {
+            std::span<lf::worker_context*> contexts;
+            std::atomic<Uint64>* cursor;
+
+            void schedule(const lf::submit_handle job) const {
+                const Uint64 index = cursor->fetch_add(1, std::memory_order_relaxed);
+                contexts[static_cast<SizeT>(index % contexts.size())]->schedule(job);
+            }
+        };
+
+        void RunLibforkChain(LibforkJob* raw) noexcept;
+
+        // The root task every dispatched chain runs as. libfork async function objects are
+        // copyable, captureless callables returning lf::task<>, whose first parameter is the
+        // combinator's synthesized first argument (unused here: this task neither forks nor
+        // joins). The coroutine exists purely as libfork's entry protocol; the loop is in
+        // RunLibforkChain.
+        inline constexpr auto kLibforkChainTask = [](auto /*self*/, LibforkJob* job) -> lf::task<void> {
+            RunLibforkChain(job);
+            co_return;
+        };
+
+        class LibforkJobExecutor final : public JobExecutor {
+        public:
+            explicit LibforkJobExecutor(const Uint threads)
+                : m_pool(static_cast<std::size_t>(std::max(1u, threads))), m_contexts(m_pool.contexts()),
+                  m_fallback([this] { FallbackLoop(); }) {}
+
+            ~LibforkJobExecutor() override {
+                JoinAll();
+                {
+                    const std::lock_guard<std::mutex> lock(m_mutex);
+                    m_fallbackStop = true;
+                }
+                m_fallbackCv.notify_all();
+                if (m_fallback.joinable()) m_fallback.join();
+                // m_pool is destroyed last, and only here: lf::lazy_pool may not be destructed
+                // while any submitted task can still run or submit more. JoinAll() has
+                // established the first and the joined fallback thread the second. Its
+                // destructor then joins the worker threads, so a worker still unwinding a
+                // finished coroutine frame is waited for rather than pulled out from under.
+            }
+
+            void Submit(std::function<void()> fn) override {
+                if (tl_chainOwner == this) {
+                    const std::lock_guard<std::mutex> lock(m_mutex);
+                    // The hot path: ONE job per running chain. A chain picks up exactly one
+                    // queued job each time its body returns, so a queue no longer than the
+                    // number of live chains is a queue every entry of which has a distinct
+                    // worker waiting to take it - which is precisely the steady state this
+                    // absorption exists for (every worker finishes a job and refills its own
+                    // slot, all at once, with no scheduler round trip between them).
+                    //
+                    // Past that it is oversubscription, and absorbing it would be a
+                    // correctness-preserving way to destroy the pool's parallelism: the
+                    // budget would still say `maxConcurrency` jobs are in flight while one
+                    // worker ran them one behind another. That is not hypothetical - it is
+                    // the tail of a pack load, where one compile going terminal releases
+                    // several programs at once (ShaderCompileAdoptionMap lets a single
+                    // compile settle many) and the worker that drove it posts the whole
+                    // burst into an otherwise idle pool. Measured before this branch existed:
+                    // four such jobs took 4x one job's wall time on libfork and 1x on Asio.
+                    //
+                    // The overflow cannot go to lf::detach from here - a libfork worker may
+                    // not schedule - so it goes to the dispatch thread, which detaches it to
+                    // a worker of its own. That costs one thread wakeup; serializing costs a
+                    // whole compile.
+                    //
+                    // The count is taken AFTER the push, not before: deque::push_back is
+                    // strongly exception-safe, so an allocation failure here leaves `fn`
+                    // intact for DispatchLocked to settle - but a count incremented in front
+                    // of it would be a count nothing ever gives back, and JoinAll would wait
+                    // on it forever.
+                    const Bool takeable = m_chainQueue.size() < m_liveChains;
+                    if (takeable) {
+                        m_chainQueue.push_back(Move(fn));
+                        ++m_outstanding;
+                    } else {
+                        m_fallbackQueue.push_back(Move(fn));
+                        ++m_outstanding;
+                        m_fallbackCv.notify_one();
+                    }
+                    return;
+                }
+
+                {
+                    // Counted before anything can run it, so JoinAll cannot observe a zero
+                    // that this job would have broken.
+                    const std::lock_guard<std::mutex> lock(m_mutex);
+                    ++m_outstanding;
+                }
+                try {
+                    DetachChain(Move(fn));
+                } catch (const lf::schedule_in_worker&) {
+                    // Submitted from a libfork worker that is not running one of my chains -
+                    // a worker of another ShaderCompilePool. libfork will not take a
+                    // submission from there at all, and the queue above is not safe for it
+                    // (no chain of mine is running on that thread to drain it), so it goes to
+                    // the fallback thread, which is neither. DetachChain restored `fn` before
+                    // it threw.
+                    const std::lock_guard<std::mutex> lock(m_mutex);
+                    m_fallbackQueue.push_back(Move(fn));
+                    m_fallbackCv.notify_one();
+                } catch (...) {
+                    // Out of memory. Give the count back and let the caller settle its node:
+                    // that is Submit's contract and what DispatchLocked is written against.
+                    Retire();
+                    throw;
+                }
+            }
+
+            void JoinAll() override {
+                std::unique_lock<std::mutex> lock(m_mutex);
+                m_idleCv.wait(lock, [this] { return m_outstanding == 0; });
+            }
+
+            // A chain announces itself before it runs its first body, so that Submit's
+            // absorption rule can count the workers that are going to come back and ask for
+            // more. Under-counting is the only direction this can be wrong in (a detached
+            // chain is not counted until it starts), and under-counting only sends work to
+            // the dispatch thread that a chain could have taken - never the reverse.
+            void EnterChain() noexcept {
+                const std::lock_guard<std::mutex> lock(m_mutex);
+                ++m_liveChains;
+            }
+
+            // The end of one job in a chain. Returns true having loaded `body` with the next
+            // job to run on this same worker, false when there is nothing left - after which
+            // the caller must touch neither `this` nor anything owned by it, because the
+            // count this drops to zero may be the one JoinAll is waiting for.
+            //
+            // `body` must arrive empty: the finished job's captures (a strong reference to its
+            // JobNode) are released by the chain, outside this lock, so that no JobNode
+            // destructor ever runs inside the executor's critical section.
+            Bool RetireAndTakeNext(std::function<void()>& body) noexcept {
+                const std::lock_guard<std::mutex> lock(m_mutex);
+                --m_outstanding;
+                if (!m_chainQueue.empty()) {
+                    // Unconditional, and it has to stay that way: a chain that exited while
+                    // the queue was non-empty could be the last one, and the entry would then
+                    // be waiting on a worker that never comes. That is what makes the
+                    // absorption bound in Submit a scheduling policy rather than a liveness
+                    // requirement.
+                    //
+                    // swap, not move-assign: std::function's move assignment is not noexcept,
+                    // and this function is.
+                    body.swap(m_chainQueue.front());
+                    m_chainQueue.pop_front();
+                    return true; // the taken job's own count stays held
+                }
+                --m_liveChains;
+                // Notified while STILL HOLDING the lock, which is the whole reason this is not
+                // the usual notify-after-unlock. The wakeup this sends can be the one that
+                // lets JoinAll return and ~LibforkJobExecutor destroy m_idleCv - and a
+                // std::condition_variable may not be destroyed while another thread is inside
+                // notify_all() on it. Holding the lock across the notify means the waiter
+                // cannot re-acquire the mutex, and therefore cannot leave wait(), until this
+                // thread is out of both the notify and the unlock. ThreadSanitizer catches the
+                // other order immediately (pthread_cond_destroy vs pthread_cond_broadcast).
+                if (m_outstanding == 0) m_idleCv.notify_all();
+                return false;
+            }
+
+        private:
+            // Builds the root task and hands it to libfork. On any failure `fn` is restored,
+            // so the caller can still decide what to do with the job.
+            void DetachChain(std::function<void()>&& fn) {
+                // `new T{...}` allocates before it constructs, so a throwing operator new
+                // leaves `fn` untouched; the member move is std::function's noexcept one.
+                LibforkJob* job = new LibforkJob{Move(fn), this};
+                try {
+                    lf::detach(RoundRobinSubmitter{m_contexts, &m_cursor}, kLibforkChainTask, job);
+                } catch (...) {
+                    // lf::schedule upholds the strong exception guarantee, so nothing was
+                    // scheduled and the payload is still ours.
+                    const UniquePtr<LibforkJob> owned(job);
+                    fn = Move(owned->body);
+                    throw;
+                }
+            }
+
+            void Retire() noexcept {
+                // Under the lock, for the reason RetireAndTakeNext spells out.
+                const std::lock_guard<std::mutex> lock(m_mutex);
+                if (--m_outstanding == 0) m_idleCv.notify_all();
+            }
+
+            // The dispatch thread. It exists because lf::detach is illegal on a libfork worker
+            // and legal here, and it serves the two cases Submit cannot take itself: a
+            // submission from another pool's worker, and a chain's overflow past the
+            // one-job-per-chain bound. It sleeps otherwise, and it dispatches rather than
+            // executes - a body only ever runs here if libfork refuses the job outright.
+            void FallbackLoop() {
+                for (;;) {
+                    std::function<void()> fn;
+                    {
+                        std::unique_lock<std::mutex> lock(m_mutex);
+                        m_fallbackCv.wait(lock, [this] { return !m_fallbackQueue.empty() || m_fallbackStop; });
+                        // Emptiness is checked before the stop flag so that a stop can never
+                        // strand accepted work: an accepted job always runs, because the node
+                        // behind it has a joiner that would otherwise block forever.
+                        if (m_fallbackQueue.empty()) return;
+                        fn.swap(m_fallbackQueue.front());
+                        m_fallbackQueue.pop_front();
+                    }
+                    try {
+                        DetachChain(Move(fn));
+                    } catch (...) {
+                        MGLOG_E("ShaderCompilePool: libfork refused a fallback dispatch; running the job on "
+                                "the dispatch thread instead of dropping it");
+                        RunHere(Move(fn));
+                    }
+                }
+            }
+
+            // Last resort. Running the body here costs this engine its parallelism for one
+            // job; dropping it would cost a joiner its wakeup forever.
+            void RunHere(std::function<void()>&& fn) noexcept {
+                try {
+                    if (fn) fn();
+                } catch (...) {
+                    MGLOG_E("ShaderCompilePool: a job body escaped its own containment on the dispatch "
+                            "thread; it has been swallowed to keep the thread alive");
+                }
+                fn = nullptr;
+                Retire();
+            }
+
+            lf::lazy_pool m_pool;
+            // Fixed for the pool's lifetime, so it is read once rather than per submission.
+            std::span<lf::worker_context*> m_contexts;
+            std::atomic<Uint64> m_cursor{0};
+
+            std::mutex m_mutex;
+            std::condition_variable m_fallbackCv;
+            std::condition_variable m_idleCv;
+            // Refills and continuations submitted from inside a chain: drained by the chains.
+            std::deque<std::function<void()>> m_chainQueue;
+            // Chains currently executing, i.e. workers that will look at m_chainQueue again
+            // before they exit. The bound on how much Submit may absorb into a chain.
+            Uint m_liveChains = 0;
+            // Submissions from another pool's libfork worker, and the overflow of the rule
+            // above: drained by m_fallback, which detaches each one to a worker.
+            std::deque<std::function<void()>> m_fallbackQueue;
+            // Everything submitted and not yet finished, whichever queue it is in and whether
+            // or not it has reached a worker, so JoinAll needs a single predicate.
+            Uint m_outstanding = 0;
+            Bool m_fallbackStop = false;
+            std::thread m_fallback;
+        };
+
+        void RunLibforkChain(LibforkJob* const raw) noexcept {
+            UniquePtr<LibforkJob> job(raw);
+            LibforkJobExecutor* const owner = job->owner;
+            std::function<void()> body;
+            body.swap(job->body);
+            job.reset();
+
+            LibforkJobExecutor* const savedOwner = tl_chainOwner;
+            tl_chainOwner = owner;
+            owner->EnterChain();
+
+            for (;;) {
+                try {
+                    if (body) body();
+                } catch (...) {
+                    // JobNode::Run contains every body exception already; this is the backstop
+                    // for the wrapper itself. An exception escaping here would be stashed in
+                    // the root task's shared state, which lf::detach discards - i.e. silently
+                    // lost - and would abandon the rest of the chain.
+                    MGLOG_E("ShaderCompilePool: a job body escaped its own containment on a libfork worker; "
+                            "it has been swallowed to keep the chain alive");
+                }
+                // Release the finished job's captures (its strong JobNode reference) HERE,
+                // outside the executor's lock: a JobNode destructor is arbitrary code.
+                body = nullptr;
+                if (!owner->RetireAndTakeNext(body)) break;
+            }
+
+            // `owner` may already be destroyed - RetireAndTakeNext returning false can be the
+            // call that releases a JoinAll. Nothing below touches it.
+            tl_chainOwner = savedOwner;
+        }
+
+        UniquePtr<JobExecutor> MakeJobExecutor(const AsyncPoolEngine engine, const Uint threads) {
+            switch (engine) {
+            case AsyncPoolEngine::Libfork: return MakeUnique<LibforkJobExecutor>(threads);
+            case AsyncPoolEngine::Asio: break;
+            }
+            return MakeUnique<AsioJobExecutor>(threads);
+        }
+    } // namespace
+
     struct ShaderCompilePool::Impl {
-        explicit Impl(const Uint threads) : threadCount(std::max(1u, threads)), maxConcurrency(threadCount) {}
+        explicit Impl(const Uint threads)
+            : threadCount(std::max(1u, threads)), engine(DetectAsyncPoolEngine()), maxConcurrency(threadCount) {}
 
         const Uint threadCount;
+        // Latched at construction, not re-read: a pool may not change engines under its own
+        // workers, and GetEngine() is what the tests compare against the environment.
+        const AsyncPoolEngine engine;
 
         std::mutex mutex;
-        // Created on the first dispatched Post, never in the constructor: asio::thread_pool
+        // Created on the first dispatched Post, never in the constructor: both engines spawn
-        // spawns its threads eagerly, and a build with async off must not pay for threads it
+        // their threads eagerly (asio::thread_pool its workers, lf::lazy_pool its workers plus
+        // this file's dispatch thread), and a build with async off must not pay for threads it
         // will never use.
-        UniquePtr<asio::thread_pool> pool;
+        UniquePtr<JobExecutor> executor;
         std::deque<SharedPtr<JobNode>> queue;
         Uint inFlight = 0;
         Uint maxConcurrency;
         std::atomic<Bool> stopped{false};
 
-        // Callers hold `mutex`. Hands as many queued nodes to Asio as the concurrency budget
+        // Callers hold `mutex`. Hands as many queued nodes to the engine as the concurrency
-        // allows. Posting under the lock is safe and is what keeps `pool` from being moved
+        // budget allows. Submitting under the lock is safe and is what keeps `executor` from
-        // out by a concurrent StopAndDrain between the decision and the dispatch: asio::post
+        // being moved out by a concurrent StopAndDrain between the decision and the dispatch:
-        // only enqueues, it never runs the handler on the calling thread, so it cannot
+        // Submit only enqueues, it never runs the callable on the calling thread, so it cannot
         // re-enter this mutex.
         //
-        // A node asio::post fails to hand off is appended to `toCancel` instead of being
+        // A node the engine fails to accept is appended to `toCancel` instead of being
         // Cancel()'d here: Cancel() runs the node's OnTerminal continuations inline (stage 4
         // added ProgramLinkTask::OnDepSettled as a real one), and a continuation is free to
         // call ShaderCompilePool::Post() again. Every caller of DispatchLocked holds `mutex`
         // (a plain, non-recursive std::mutex) - Cancel()'ing in here would let that
         // re-entrant Post() deadlock on the very lock this frame already owns. The caller
         // drains `toCancel` after releasing the lock.
+        //
+        // The `stopped` check is also what keeps this loop from dereferencing a null
+        // `executor`: StopAndDrain sets the flag and moves the executor out in the same
+        // critical section, so a stopped pool never reaches the Submit below.
         void DispatchLocked(Vector<SharedPtr<JobNode>>& toCancel) {
             while (!queue.empty() && inFlight < maxConcurrency && !stopped.load(std::memory_order_acquire)) {
-                // Copy rather than move into the handler: if asio::post throws (it allocates)
+                // Copy rather than move into the callable: if Submit throws (both engines
-                // the local SharedPtr is still valid, so the node can be settled instead of
+                // allocate) the local SharedPtr is still valid, so the node can be settled
-                // being stranded Pending in a queue nothing will dispatch from again - a
+                // instead of being stranded Pending in a queue nothing will dispatch from
-                // joiner would block on it forever. Reclaiming the slot matters just as much:
+                // again - a joiner would block on it forever. Reclaiming the slot matters just
-                // a leaked `inFlight` shrinks the pool's concurrency budget permanently.
+                // as much: a leaked `inFlight` shrinks the pool's concurrency budget
+                // permanently.
                 SharedPtr<JobNode> node = queue.front();
                 queue.pop_front();
                 ++inFlight;
                 try {
-                    asio::post(*pool, [this, node]() mutable { RunOnWorker(Move(node)); });
+                    executor->Submit([this, node]() mutable { RunOnWorker(Move(node)); });
                 } catch (...) {
                     --inFlight;
                     toCancel.push_back(Move(node));
@@ -184,7 +650,7 @@ namespace MobileGL::MG_Util::Async {
 
         void RunOnWorker(SharedPtr<JobNode> node) {
             tl_isPoolThread = true;
-            // A node that was already handed to Asio when StopAndDrain ran still arrives
+            // A node that was already handed to the engine when StopAndDrain ran still arrives
             // here; cancelling it first turns the dispatch into a state transition instead of
             // a full compile, so the drain's join() returns promptly. This Cancel() runs
             // before `mutex` is ever taken in this frame, so it is not subject to the
@@ -234,13 +700,15 @@ namespace MobileGL::MG_Util::Async {
         return m_impl->maxConcurrency;
     }
 
+    AsyncPoolEngine ShaderCompilePool::GetEngine() const { return m_impl->engine; }
+
     void ShaderCompilePool::SetMaxConcurrency(const Uint n) {
         Vector<SharedPtr<JobNode>> toCancel;
         {
             const std::lock_guard<std::mutex> lock(m_impl->mutex);
             m_impl->maxConcurrency = std::clamp(n, 1u, m_impl->threadCount);
             // Raising the budget releases whatever the old one was holding back.
-            if (m_impl->pool) m_impl->DispatchLocked(toCancel);
+            if (m_impl->executor) m_impl->DispatchLocked(toCancel);
         }
         // Outside the lock: see DispatchLocked's comment.
         for (const auto& n2 : toCancel) {
@@ -252,23 +720,23 @@ namespace MobileGL::MG_Util::Async {
         if (!node) return;
         EnsureProcessTeardownSentinel();
 
-        // Enqueueing can throw: the thread_pool construction and asio::post both allocate,
+        // Enqueueing can throw: building the engine and submitting to it both allocate (and
-        // and under memory pressure a throw here would escape glCompileShader leaving the
+        // both spawn threads), and under memory pressure a throw here would escape
-        // node Pending with nothing left to dispatch it - the first observable read would
+        // glCompileShader leaving the node Pending with nothing left to dispatch it - the
-        // then block the GL thread forever. Settle the node instead: a cancelled node is a
+        // first observable read would then block the GL thread forever. Settle the node
-        // state every joiner already handles.
+        // instead: a cancelled node is a state every joiner already handles.
         //
-        // `node` is still valid in the catch for every throw this try can produce. The
+        // `node` is still valid in the catch for every throw this try can produce. The engine
-        // thread_pool construction runs before the move; deque::push_back is strongly
+        // construction runs before the move; deque::push_back is strongly exception-safe and
-        // exception-safe and SharedPtr's move constructor is noexcept, so a throwing
+        // SharedPtr's move constructor is noexcept, so a throwing push_back never consumed it;
-        // push_back never consumed it; and DispatchLocked contains its own asio::post
+        // and DispatchLocked contains its own Submit failures rather than propagating them
-        // failures rather than propagating them (see above). Keep it that way.
+        // (see above). Keep it that way.
         Bool enqueued = false;
         Vector<SharedPtr<JobNode>> toCancel;
         try {
             const std::lock_guard<std::mutex> lock(m_impl->mutex);
             if (!m_impl->stopped.load(std::memory_order_acquire) && !InProcessTeardown()) {
-                if (!m_impl->pool) m_impl->pool = MakeUnique<asio::thread_pool>(m_impl->threadCount);
+                if (!m_impl->executor) m_impl->executor = MakeJobExecutor(m_impl->engine, m_impl->threadCount);
                 m_impl->queue.push_back(Move(node));
                 m_impl->DispatchLocked(toCancel);
                 enqueued = true;
@@ -304,17 +772,17 @@ namespace MobileGL::MG_Util::Async {
     }
 
     void ShaderCompilePool::StopAndDrain() {
-        // asio::thread_pool::join() from a pool thread would deadlock on itself, and the
+        // Waiting for the workers from a worker would deadlock on itself (asio's join() says
-        // whole point of this call is that the GL thread waits for the workers.
+        // so outright), and the whole point of this call is that the GL thread waits.
         MOBILEGL_ASSERT(!IsPoolThread(), "ShaderCompilePool::StopAndDrain() called from a pool thread");
 
         std::deque<SharedPtr<JobNode>> abandoned;
-        UniquePtr<asio::thread_pool> pool;
+        UniquePtr<JobExecutor> executor;
         {
             const std::lock_guard<std::mutex> lock(m_impl->mutex);
             m_impl->stopped.store(true, std::memory_order_release);
             abandoned.swap(m_impl->queue);
-            pool = Move(m_impl->pool);
+            executor = Move(m_impl->executor);
         }
 
         // Queued but never dispatched: settle them so anything chained behind them is
@@ -323,9 +791,9 @@ namespace MobileGL::MG_Util::Async {
             if (node) node->Cancel();
         }
 
-        if (pool) {
+        if (executor) {
-            pool->join(); // returns once every handler already handed to Asio has finished
+            executor->JoinAll(); // returns once every job already handed to the engine is done
-            pool.reset();
+            executor.reset();    // and this stops the engine's threads
         }
 
         const std::lock_guard<std::mutex> lock(m_impl->mutex);

MobileGL/MG_Util/Async/ShaderCompilePool.h

@@ -11,20 +11,22 @@
 #include <MG_Util/Types.h>
 #include <MG_Util/Async/JobNode.h>
 
-// This header deliberately includes NO Asio header: asio::thread_pool lives behind the pimpl
+// This header deliberately includes NO Asio and NO libfork header: both execution engines
-// in ShaderCompilePool.cpp. Asio stays a private implementation detail of one translation
+// live behind the pimpl in ShaderCompilePool.cpp. They stay private implementation details of
-// unit, so no consumer target (MG_Test, MG_IntegrationTest, MG_Benchmark - each with its own
+// one translation unit, so no consumer target (MG_Test, MG_IntegrationTest, MG_Benchmark -
-// target_include_directories) needs the Asio include path, and no consumer pays its compile
+// each with its own target_include_directories) needs either include path, and no consumer
-// time. Do not add one here.
+// pays their compile time. libfork in particular is a C++20-coroutine header set whose
+// instantiation cost nothing outside the pool has any reason to carry. Do not add one here.
 
 namespace MobileGL::MG_Util::Async {
-    // Stage 1 ships the whole machinery switched off: the pool is constructible and tested,
+    // Stage 7: on by default. The gate behind the flip (2026-08-09, headless Mesa, both
-    // but nothing in the GL pipeline posts to it. The flip to true happens only after the
+    // backends): GL30-40 mustpass + KHR-GL46.parallel_shader_compile at async=1 with the
-    // real-client soak in the final stage, because the riskiest part of asynchronous
+    // extension advertised - 58,344 case-runs, 8 failures, and every one of the 8 also
-    // compilation is not the joins - it is that Iris and Sodium change their submission
+    // fails standalone at async=0 and under the pre-P1 library, i.e. zero async-attributable
-    // schedule the moment GL_KHR_parallel_shader_compile is advertised, and a recorded trace
+    // deltas. The risk this comment used to name - Iris and Sodium changing their submission
-    // can never cover that path.
+    // schedule the moment GL_KHR_parallel_shader_compile is advertised - remains the one
-    inline constexpr Bool kAsyncShaderCompileDefault = false;
+    // thing a recorded trace cannot cover, which is why the kill switch below stays.
+    inline constexpr Bool kAsyncShaderCompileDefault = true;
 
     // MOBILEGL_ASYNC_SHADER_COMPILE forces the answer either way; unset keeps the built-in
     // default above. Falsy is a complete kill switch: it reverts the threading *and*
@@ -65,6 +67,31 @@ namespace MobileGL::MG_Util::Async {
     // MOBILEGL_ASYNC_SHADER_COMPILE_THREADS overrides it outright.
     Uint DetectShaderCompileThreadCount();
 
+    // ---- MOBILEGL_ASYNC_POOL: which engine drives the worker threads ----------------------
+    // The engine is ONLY the execution engine. The job queue, the concurrency budget and its
+    // clamping, the suspension latch, cancel request-vs-outcome, the stopped-is-synchronous
+    // fallback and the drain are all engine-independent - they live in ShaderCompilePool::Impl
+    // and are shared verbatim by both engines, which is what lets the whole async suite run
+    // unchanged against either one. An engine answers exactly one question: how does a job
+    // that the budget has already cleared reach a worker thread?
+    enum class AsyncPoolEngine : Uint8 {
+        Asio,    // asio::thread_pool: one shared queue behind Asio's scheduler lock
+        Libfork, // lf::lazy_pool: per-worker work-stealing deques, workers sleep when idle
+    };
+
+    // "asio" / "libfork" - the spelling the environment variable accepts and the log prints.
+    const char* AsyncPoolEngineName(AsyncPoolEngine engine);
+
+    // Parses one MOBILEGL_ASYNC_POOL value. Case-insensitive; empty, "auto" and anything
+    // unrecognized resolve to Asio, and an unrecognized value warns (a misspelt engine name
+    // would otherwise be indistinguishable from the default, and the whole point of the
+    // variable is to know which engine ran).
+    AsyncPoolEngine ParseAsyncPoolEngine(const String& value);
+
+    // The process's engine, resolved from MOBILEGL_ASYNC_POOL on first call and cached. Every
+    // pool constructed afterwards reports the same answer, so a process never mixes engines.
+    AsyncPoolEngine DetectAsyncPoolEngine();
+
     class ShaderCompilePool {
     public:
         explicit ShaderCompilePool(Uint threadCount);
@@ -96,6 +123,11 @@ namespace MobileGL::MG_Util::Async {
         Uint GetThreadCount() const;
         Uint GetMaxConcurrency() const;
 
+        // The engine this pool was built with, latched at construction from
+        // DetectAsyncPoolEngine(). Reported rather than re-resolved so that a pool cannot
+        // change engines under its own workers.
+        AsyncPoolEngine GetEngine() const;
+
         // Bounded concurrency doubles as the memory bound, and is how
         // glMaxShaderCompilerThreadsKHR(n) is honoured: a 300-program pack load cannot put
         // 300 glslang arenas in flight at once. Clamped to [1, thread count].

MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.cpp

@@ -838,6 +838,12 @@ namespace MobileGL::MG_Util::BackendLoader {
                 if (std::strcmp(extension, "GL_EXT_render_snorm") == 0) {
                     caps.SupportsRenderSnorm = true;
                 }
+                if (std::strcmp(extension, "GL_EXT_color_buffer_float") == 0) {
+                    caps.SupportsColorBufferFloat = true;
+                }
+                if (std::strcmp(extension, "GL_EXT_color_buffer_half_float") == 0) {
+                    caps.SupportsColorBufferHalfFloat = true;
+                }
                 if (std::strcmp(extension, "GL_EXT_sRGB_write_control") == 0) {
                     caps.SupportsSrgbWriteControl = true;
                 }

MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.h

@@ -1034,6 +1034,16 @@ namespace MobileGL {
             // GL_EXT_render_snorm is present, so the signed-normalized formats are colour-renderable
             // (and usable as multisample texture storage) rather than texture-only.
             Bool SupportsRenderSnorm = false;
+            // GL_EXT_color_buffer_float is present, so GL_RGBA16F / GL_RGBA32F / GL_R11F_G11F_B10F
+            // (and the R/RG float formats) are colour-renderable. ES 3.x core makes them
+            // texture-only, and every Iris shaderpack renders into at least R11F_G11F_B10F, so
+            // without this no shaderpack can work at all.
+            Bool SupportsColorBufferFloat = false;
+            // GL_EXT_color_buffer_half_float is present: the half-float subset of the above, for
+            // drivers that ship only the smaller extension. Note it does NOT rescue GL_RGB16F -
+            // the extension nominally lists it but disclaims it under ES 3.x, and real drivers
+            // reject it, which is why three-channel float attachments are widened instead.
+            Bool SupportsColorBufferHalfFloat = false;
             // GL_EXT_sRGB_write_control is present, so GL_FRAMEBUFFER_SRGB can be turned off.
             // GLES has no such switch in core: writes into an sRGB attachment are ALWAYS encoded,
             // while desktop GL leaves GL_FRAMEBUFFER_SRGB disabled by default and writes raw.

MobileGL/MG_Util/SelfTest/DriverPost.cpp

@@ -16,7 +16,12 @@
 // Only for the compile-time MAX_VERTEX_ATTRIBS constant asserted below. The POST still executes no
 // MG_State code: it runs standalone, before MG_State::Init().
 #include <MG_State/GLState/VertexArrayState/VertexArrayObject.h>
+#include <MG_Backend/DirectGLES/Utils.h>
+#include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
+#include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToStr/GLExtensionConverter.h>
+#include <MG_Util/Converters/MGToStr/TextureEnumConverter.h>
+#include <MG_Util/Texture/TextureFormatProcessor.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <chrono>
 #include <thread>
@@ -146,12 +151,20 @@ namespace MobileGL::MG_Util::SelfTest {
                 return;
             }
             const Uint threads = MG_Util::Async::DetectShaderCompileThreadCount();
+            // The execution engine is named here too. It changes no observable GL behaviour -
+            // both engines run the same job queue under the same budget - but when a scaling
+            // or stall report comes back from a device, "which engine was this?" is the first
+            // question, and a POST page is the one artefact that always accompanies it.
+            const char* const engineName =
+                MG_Util::Async::AsyncPoolEngineName(MG_Util::Async::DetectAsyncPoolEngine());
             builder.Pass(rowName,
-                         format("on with {} compiler thread{}; GL_KHR_parallel_shader_compile is advertised "
+                         format("on with {} compiler thread{} on the {} execution engine; "
+                                "GL_KHR_parallel_shader_compile is advertised "
                                 "and GL_MAX_SHADER_COMPILER_THREADS_KHR = {} (set environment variable "
-                                "MOBILEGL_ASYNC_SHADER_COMPILE=0 to disable it, or "
+                                "MOBILEGL_ASYNC_SHADER_COMPILE=0 to disable it, "
-                                "MOBILEGL_ASYNC_SHADER_COMPILE_THREADS=n to change the count)",
+                                "MOBILEGL_ASYNC_SHADER_COMPILE_THREADS=n to change the count, or "
-                                threads, threads == 1 ? "" : "s", threads));
+                                "MOBILEGL_ASYNC_POOL=asio|libfork to change the engine)",
+                                threads, threads == 1 ? "" : "s", engineName, threads));
         }
 
         // Appends the four "MobileGL reported ..." rows for one backend section.
@@ -450,6 +463,35 @@ namespace MobileGL::MG_Util::SelfTest {
                 builder.Warn("GL_EXT_texture_norm16",
                              "not supported; 16-bit normalized texture formats need emulation");
             }
+            if (caps.SupportsRenderSnorm) {
+                builder.Pass("GL_EXT_render_snorm",
+                             "supported (signed-normalized formats are colour-renderable, so an "
+                             "SNORM render target keeps its own encoding instead of a float substitute)");
+            } else {
+                builder.Warn("GL_EXT_render_snorm",
+                             "not supported; signed-normalized formats are texture-only, so every SNORM "
+                             "render target is stored as a float (GL_RGBA8_SNORM/GL_RGB8_SNORM -> "
+                             "GL_RGBA16F) and its fragment outputs are clamped to [-1,1] in software");
+            }
+            // FAIL, not WARN: ES 3.x core makes every float format texture-only, and every Iris
+            // shaderpack renders into at least GL_R11F_G11F_B10F (Complementary's colortex0, BSL's
+            // colortex0). Without this extension there is no substitute format left - a half float
+            // is not renderable either - so shaderpacks cannot work at all on such a driver.
+            if (caps.SupportsColorBufferFloat) {
+                builder.Pass("GL_EXT_color_buffer_float",
+                             "supported (GL_R11F_G11F_B10F / GL_RGBA16F / GL_RGBA32F are "
+                             "colour-renderable, which is what every shaderpack renders into)");
+            } else if (caps.SupportsColorBufferHalfFloat) {
+                builder.Warn("GL_EXT_color_buffer_float",
+                             "not supported, but GL_EXT_color_buffer_half_float is; 16-bit float render "
+                             "targets work, 32-bit float ones (GL_RGBA32F, and the GL_RGBA16 fallback "
+                             "that lands on it) do not");
+            } else {
+                builder.Fail("GL_EXT_color_buffer_float",
+                             "not supported, and neither is GL_EXT_color_buffer_half_float; no floating-point "
+                             "format is colour-renderable on this driver, so no shaderpack can create its "
+                             "render targets (Iris reports GL_FRAMEBUFFER_UNSUPPORTED and refuses to load)");
+            }
 
             // INFO, never WARN: this is the HOST driver's ability to compile its own ESSL on
             // its own threads, and MobileGL's asynchronous compilation does not depend on it
@@ -783,6 +825,117 @@ namespace MobileGL::MG_Util::SelfTest {
             }
         }
 
+        // No real ES driver renders to a three-channel image, but desktop GL applications ask for
+        // one constantly - Complementary Reimagined's colortex1 is GL_RGB8_SNORM and its colortex2
+        // is GL_RGB16F, and Iris refuses to load when a framebuffer built from them is not
+        // COMPLETE. DirectGLES substitutes the four-channel sibling, and this row names the
+        // outcome per format so the failure mode is a five-second read instead of an
+        // investigation. Answered from the capability cache that was just probed on this very
+        // driver, so it costs no extra GL work.
+        void ReportThreeChannelColorAttachments(ReportBuilder& builder, const MG_External::GLESCapabilities& caps,
+                                                const MG_Backend::FormatCapabilityCache& cache) {
+            // GL_RGB8 is the control: it is ES-core renderable, and it is exactly why BSL loads on
+            // the same driver where Complementary does not. The rest are one representative of
+            // each widening class - signed-normalized, half float, 32-bit float, sRGB, integer -
+            // so the row says which CLASS of shaderpack target a device cannot serve rather than
+            // just "three-channel formats".
+            constexpr TextureInternalFormat kProbedFormats[] = {
+                TextureInternalFormat::RGB8,   TextureInternalFormat::RGB8Snorm, TextureInternalFormat::RGB16F,
+                TextureInternalFormat::RGB32F, TextureInternalFormat::SRGB8,     TextureInternalFormat::RGB8UI};
+            const SizeT targetIndex = MG_Backend::GetFormatCapabilityTargetIndex(TextureTarget::Texture2D);
+            const Flags<PixelFormatNormalizeOptionBit> renderTargetOptions =
+                MG_Backend::DirectGLES::TextureImpl::GetRenderTargetNormalizeOptions(caps, targetIndex);
+
+            String nativeList;
+            String widenedList;
+            String unusableList;
+            // GL_RGB8 is colour-renderable in ES 3.0 CORE. A driver that answers no to it is
+            // broken (or the probe itself is), and that is the ONLY three-channel verdict that
+            // deserves a FAIL on its own - see the verdict block below.
+            Bool controlFormatBroken = false;
+            const auto append = [](String& list, const String& entry) {
+                if (!list.empty()) list += ", ";
+                list += entry;
+            };
+
+            for (const TextureInternalFormat probedFormat : kProbedFormats) {
+                const SizeT formatIndex = static_cast<SizeT>(probedFormat);
+                const String name = MG_Util::ConvertTextureInternalFormatToString(probedFormat);
+                if (MG_Backend::HasFormatCapability(cache.FullCaps[targetIndex][formatIndex],
+                                                    MG_Backend::FormatCapability::FramebufferRenderable)) {
+                    append(nativeList, name);
+                    continue;
+                }
+                if (probedFormat == TextureInternalFormat::RGB8) {
+                    controlFormatBroken = true;
+                }
+                if (MG_Backend::HasFormatCapability(cache.CaveatCaps[targetIndex][formatIndex],
+                                                    MG_Backend::FormatCapability::FramebufferRenderable)) {
+                    GLenum widenedInternalFormat = GL_UNKNOWN_MGL;
+                    MG_Util::TextureFormatProcessor::NormalizePixelFormat(
+                        MG_Util::ConvertTextureInternalFormatToGLEnum(probedFormat), renderTargetOptions,
+                        &widenedInternalFormat, nullptr, nullptr);
+                    append(widenedList, name + " -> " + MG_Util::ConvertGLEnumToString(widenedInternalFormat));
+                    continue;
+                }
+                append(unusableList, name);
+            }
+
+            String detail;
+            if (!nativeList.empty()) detail += "renderable natively: " + nativeList;
+            if (!widenedList.empty()) {
+                if (!detail.empty()) detail += "; ";
+                detail += "widened to stay renderable: " + widenedList;
+            }
+            if (!unusableList.empty()) {
+                if (!detail.empty()) detail += "; ";
+                detail += "NOT renderable and not substitutable: " + unusableList;
+            }
+
+            // The verdict deliberately does NOT track "every probed format came out usable".
+            //
+            // GL_RGB32F widens to GL_RGBA32F, and GL_RGBA32F is colour-renderable only under
+            // GL_EXT_color_buffer_float. A perfectly healthy half-float-only driver (the common
+            // mobile shape: EXT_color_buffer_half_float and nothing more) therefore reports
+            // GL_RGB32F as unusable while every format a shaderpack actually renders into works.
+            // FAILing that device would make the POST's hardest verdict fire on a configuration
+            // MobileGL runs fine on, which is exactly how a report stops being read.
+            //
+            // So FAIL is reserved for the two answers that really are broken:
+            //   * the ES-core control (GL_RGB8) is not renderable - the probe or the driver is
+            //     wrong about something much more basic than three-channel widening; and
+            //   * a widenable format has no usable fallback ON A DRIVER THAT ADVERTISES
+            //     GL_EXT_color_buffer_float - the extension promises the widened float targets
+            //     are renderable, so a gap here is a real, unexplained refusal.
+            // Everything else is a WARN carrying the exact per-format status, which is what the
+            // row is for. The "no float render targets at all" case is already a FAIL of its own
+            // on the GL_EXT_color_buffer_float row above; repeating it here would only double-count.
+            if (controlFormatBroken) {
+                builder.Fail("Three-channel colour attachments",
+                             detail + " - GL_RGB8 is colour-renderable in OpenGL ES 3.0 core, so a driver "
+                                      "that refuses it cannot render to ANY three-channel attachment and the "
+                                      "capability probe itself is suspect");
+            } else if (!unusableList.empty() && caps.SupportsColorBufferFloat) {
+                builder.Fail("Three-channel colour attachments",
+                             detail + " - GL_EXT_color_buffer_float is supported, so the widened "
+                                      "four-channel float targets are required to be renderable; a framebuffer "
+                                      "using one of the formats above still reports GL_FRAMEBUFFER_UNSUPPORTED, "
+                                      "which Iris turns into a hard load failure");
+            } else if (!unusableList.empty()) {
+                builder.Warn("Three-channel colour attachments",
+                             detail + " - without GL_EXT_color_buffer_float the 32-bit float widening has no "
+                                      "renderable target left, so a shaderpack asking for one of the formats "
+                                      "above gets GL_FRAMEBUFFER_UNSUPPORTED; the half-float and fixed-point "
+                                      "ones above still work");
+            } else if (!widenedList.empty()) {
+                builder.Warn("Three-channel colour attachments",
+                             detail + " - the substitution costs the extra alpha channel's memory and is "
+                                      "hidden from the application by an ALPHA->ONE swizzle");
+            } else {
+                builder.Pass("Three-channel colour attachments", detail);
+            }
+        }
+
         // Everything the "MobileGL reported ..." rows need from the GLES device probe.
         struct GlesProbeSummary {
             Bool capsValid = false;
@@ -913,6 +1066,7 @@ namespace MobileGL::MG_Util::SelfTest {
             builder.report.formatCapabilities.emplace();
             MG_Backend::DirectGLES::PopulateFormatCapabilities(
                 glesFuncs, caps, builder.report.formatCapabilities.value());
+            ReportThreeChannelColorAttachments(builder, caps, builder.report.formatCapabilities.value());
         } while (false);
     }
 

MobileGL/MG_Util/Texture/TextureFormatProcessor.cpp

@@ -58,12 +58,99 @@ namespace MobileGL::MG_Util::TextureFormatProcessor {
         case GL_R8_SNORM:
             applicableOptions |= options & PixelFormatNormalizeOptionBit::NoSnorm8;
             break;
+        // The rest of the three-channel formats no real ES driver renders to. They have no
+        // other fallback: none of the driver/forced option bits names them, so before the
+        // render-target widening existed for ordinary targets an FBO attachment in one of
+        // them could only ever be answered GL_FRAMEBUFFER_UNSUPPORTED (Complementary
+        // Reimagined's colortex2 = RGB16F).
+        //
+        // GL_RGB9_E5 is deliberately absent: its four-channel sibling would have to be a
+        // half float, which means unpacking the shared exponent on every transfer, and
+        // nothing renders to a shared-exponent format on desktop GL either.
+        case GL_RGB16F:
+        case GL_RGB32F:
+        case GL_SRGB8:
+        case GL_RGB8I:
+        case GL_RGB8UI:
+        case GL_RGB16I:
+        case GL_RGB16UI:
+        case GL_RGB32I:
+        case GL_RGB32UI:
+            applicableOptions |= options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget;
+            break;
         default:
             break;
         }
         return applicableOptions;
     }
 
+    namespace {
+        // The four-channel sibling a three-channel format is widened to when the target has to
+        // stay colour-renderable, together with the transfer pair that describes client data for
+        // it. Kept in one place because all three of NormalizePixelFormat's switches have to agree:
+        // reporting the widened storage but the original three-channel base format emitted
+        // inconsistent triples such as (GL_RGBA16F, GL_RGB, GL_BYTE), which is
+        // GL_INVALID_OPERATION for glTexImage2D on ES. That only ever went unnoticed because the
+        // bit was reachable for multisample storage alone, and glTexStorage*Multisample takes no
+        // transfer pair at all.
+        struct ThreeChannelWidening {
+            GLenum InternalFormat = GL_UNKNOWN_MGL;
+            GLenum Format = GL_UNKNOWN_MGL;
+            GLenum Type = GL_UNKNOWN_MGL;
+
+            explicit operator Bool() const { return InternalFormat != GL_UNKNOWN_MGL; }
+        };
+
+        ThreeChannelWidening GetThreeChannelRenderTargetWidening(GLenum internalFormat,
+                                                                 Flags<PixelFormatNormalizeOptionBit> options) {
+            if (!(options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget)) {
+                return {};
+            }
+            switch (internalFormat) {
+            // Signed-normalized: matches what the always-on NoRGBA8Snorm fallback already does to
+            // GL_RGBA8_SNORM, so the two SNORM8 formats land on the same storage.
+            case GL_RGB8_SNORM:
+                return {GL_RGBA16F, GL_RGBA, GL_FLOAT};
+            case GL_RGB16_SNORM:
+                // A half float loses the low bits of a 16-bit SNORM channel, so keep the
+                // signed-normalized encoding whenever the driver can render to it.
+                return (options & PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget)
+                           ? ThreeChannelWidening{GL_RGBA16F, GL_RGBA, GL_FLOAT}
+                           : ThreeChannelWidening{GL_RGBA16_SNORM, GL_RGBA, GL_SHORT};
+            // Unsigned-normalized 16-bit (and the legacy 10/12-bit formats stored as RGB16):
+            // GL_RGB32F is a legal ES texture format but is not colour-renderable either.
+            case GL_RGB16:
+            case GL_RGB10:
+            case GL_RGB12:
+                return {GL_RGBA32F, GL_RGBA, GL_FLOAT};
+            // Floating point.
+            case GL_RGB16F:
+                return {GL_RGBA16F, GL_RGBA, GL_HALF_FLOAT};
+            case GL_RGB32F:
+                return {GL_RGBA32F, GL_RGBA, GL_FLOAT};
+            // sRGB: GL_SRGB8_ALPHA8 keeps the sRGB encoding of the colour channels and stores
+            // the added alpha linearly, which is exactly the three-channel format's semantics.
+            case GL_SRGB8:
+                return {GL_SRGB8_ALPHA8, GL_RGBA, GL_UNSIGNED_BYTE};
+            // Integer.
+            case GL_RGB8I:
+                return {GL_RGBA8I, GL_RGBA_INTEGER, GL_BYTE};
+            case GL_RGB8UI:
+                return {GL_RGBA8UI, GL_RGBA_INTEGER, GL_UNSIGNED_BYTE};
+            case GL_RGB16I:
+                return {GL_RGBA16I, GL_RGBA_INTEGER, GL_SHORT};
+            case GL_RGB16UI:
+                return {GL_RGBA16UI, GL_RGBA_INTEGER, GL_UNSIGNED_SHORT};
+            case GL_RGB32I:
+                return {GL_RGBA32I, GL_RGBA_INTEGER, GL_INT};
+            case GL_RGB32UI:
+                return {GL_RGBA32UI, GL_RGBA_INTEGER, GL_UNSIGNED_INT};
+            default:
+                return {};
+            }
+        }
+    } // namespace
+
     void NormalizePixelFormat(GLenum internalFormat, Flags<PixelFormatNormalizeOptionBit> options,
                               GLenum* outInternalFormat, GLenum* outFormat, GLenum* outType) {
 #ifdef TRACY_ENABLE
@@ -95,13 +182,6 @@ namespace MobileGL::MG_Util::TextureFormatProcessor {
                 *outInternalFormat = internalFormat;
                 break;
             case GL_RGB16:
-                if (options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget) {
-                    // GL_RGB32F is a legal ES texture format but is not colour-renderable, so
-                    // glTexStorage2DMultisample rejects it and the attachment ends up with no
-                    // storage at all.
-                    *outInternalFormat = GL_RGBA32F;
-                    break;
-                }
                 if ((options & PixelFormatNormalizeOptionBit::NoNorm16) ||
                     (options & PixelFormatNormalizeOptionBit::NoRgb16)) {
                     *outInternalFormat = GL_RGB32F;
@@ -132,14 +212,6 @@ namespace MobileGL::MG_Util::TextureFormatProcessor {
                 *outInternalFormat = internalFormat;
                 break;
             case GL_RGB16_SNORM:
-                if (options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget) {
-                    // A half float loses the low bits of a 16-bit SNORM channel, so keep the
-                    // signed-normalized encoding whenever the driver can render to it.
-                    *outInternalFormat = (options & PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget)
-                                             ? GL_RGBA16F
-                                             : GL_RGBA16_SNORM;
-                    break;
-                }
                 if ((options & PixelFormatNormalizeOptionBit::NoNorm16) ||
                     (options & PixelFormatNormalizeOptionBit::NoRGB16Snorm) ||
                     (options & PixelFormatNormalizeOptionBit::NoSnorm16)) {
@@ -173,10 +245,6 @@ namespace MobileGL::MG_Util::TextureFormatProcessor {
                 *outInternalFormat = internalFormat;
                 break;
             case GL_RGB8_SNORM:
-                if (options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget) {
-                    *outInternalFormat = GL_RGBA16F;
-                    break;
-                }
                 if (options & PixelFormatNormalizeOptionBit::NoSnorm8) {
                     *outInternalFormat = GL_RGB16F;
                     break;
@@ -615,5 +683,18 @@ namespace MobileGL::MG_Util::TextureFormatProcessor {
                 break;
             }
         }
+
+        // Applied last, over whatever the three switches above chose: widening a three-channel
+        // format to keep a colour attachment renderable outranks every other fallback, because
+        // the others all pick a three-channel storage the driver still refuses to render to
+        // (GL_RGB8_SNORM -> GL_RGB16F under NoSnorm8, GL_RGB16 -> GL_RGB32F under NoNorm16).
+        // All three outputs move together: reporting the widened storage while leaving the
+        // three-channel base format and its component type in place produced triples like
+        // (GL_RGBA16F, GL_RGB, GL_BYTE), which ES rejects for glTexImage2D outright.
+        if (const ThreeChannelWidening widening = GetThreeChannelRenderTargetWidening(internalFormat, options)) {
+            if (outInternalFormat) *outInternalFormat = widening.InternalFormat;
+            if (outFormat) *outFormat = widening.Format;
+            if (outType) *outType = widening.Type;
+        }
     }
 } // namespace MobileGL::MG_Util::TextureFormatProcessor

MobileGL/MG_Util/Texture/TextureFormatProcessor.h

@@ -20,9 +20,14 @@ namespace MobileGL {
         NoRGB16Snorm = 1 << 6,
         // The target must be colour-renderable and ES has no renderable three-channel
         // form of the requested format, so it has to be widened to the four-channel one.
-        // Only meaningful for multisample textures: those can never be uploaded to, only
+        // Set for any colour-attachable target whose native three-channel form the driver
-        // rendered into, so the extra alpha comes from the draw (1.0 for an RGB source)
+        // refused to render to (multisample storage always, since ES has no three-channel
-        // and no transfer path has to expand three-channel client data.
+        // multisample format at all; every other target only after its native probe failed).
+        // The widening is visible to every transfer path, so it also retargets the (format,
+        // type) pair NormalizePixelFormat reports: the upload has to describe four
+        // components in the widened storage's component type, the backend has to expand
+        // three-channel client data with an alpha of 1.0, and sampling/readback has to hide
+        // the added alpha again (BackendTextureFormatAddsAlpha).
         NoThreeChannelRenderTarget = 1 << 7,
         // Pairs with the bit above: the widened four-channel format has to stay renderable AND
         // keep 16-bit signed-normalized precision, which needs both EXT_texture_norm16 and

tools/trace_replay/README.md

@@ -63,6 +63,12 @@ The bundled fixtures cover:
 - minecraft-1.21.4-fabric-iris-bsl-in-world: captured from Minecraft 1.21.4 Fabric with Sodium, Iris, and BSL
   Shaders after entering a singleplayer world.
   ![Minecraft 1.21.4 Fabric Iris BSL in-world golden](fixtures/minecraft-1.21.4-fabric-iris-bsl-in-world.0000110725.png)
+- minecraft-1.21.4-fabric-iris-bsl-esc-menu-854: captured on an Android device (Mali-G77, FCL MobileGL capture) from
+  Minecraft 1.21.4 Fabric with Sodium, Iris, and BSL Shaders, at the pause menu over a BSL-blurred world. The frame
+  pins glyph rendering: every menu label, the menu title and the tutorial toast must be present. Regressions in the
+  DirectGLES per-draw texture memo have made the whole text path disappear here while sprites kept rendering, so a
+  failure that leaves the buttons but empties them is the signature to look for in the diff.
+  ![Minecraft 1.21.4 Fabric Iris BSL ESC menu 854x480 golden](fixtures/minecraft-1.21.4-fabric-iris-bsl-esc-menu-854.0001303534.png)
 - minecraft-1.21.4-fabric-iris-makeup-ultrafast-in-world: captured from Minecraft 1.21.4 Fabric with Sodium, Iris, and
   MakeUP UltraFast after entering a singleplayer world.
   ![Minecraft 1.21.4 Fabric Iris MakeUP UltraFast in-world golden](fixtures/minecraft-1.21.4-fabric-iris-makeup-ultrafast-in-world.0000095322.png)

tools/trace_replay/trace_cases.json

@@ -289,6 +289,12 @@
       "golden": "minecraft-1.21.4-fabric-iris-iterationrp-in-world.0000202020.png",
       "target_call": 202020,
       "timeout_seconds": 1800
+    },
+    {
+      "name": "minecraft-1.21.4-fabric-iris-bsl-esc-menu-854",
+      "trace_archive": "minecraft-1.21.4-fabric-iris-bsl-esc-menu-854.tgz",
+      "golden": "minecraft-1.21.4-fabric-iris-bsl-esc-menu-854.0001303534.png",
+      "target_call": 1303534
     }
   ]
 }