[Fix] (MG_IntegrationTest/Harness): list the canned narrow check unarmed

- The driver-watch control makes no GL call, so it never arms the comparator
- The verify-split arm proof needs it named, on both backends

.github/actions/setup-test-runner/action.yml

@@ -44,4 +44,14 @@ runs:
             printf 'Acquire::Retries "3";\nAcquire::http::Timeout "30";\nAcquire::https::Timeout "30";\n' |
               sudo tee /etc/apt/apt.conf.d/80-mobilegl-ci-network > /dev/null
           fi
+          # Cores go through zstd: a unit run's intentional aborts (death tests) left hundreds
+          # of raw cores in /tmp and filled the disk. The handler keeps honouring each
+          # process's RLIMIT_CORE (%c), so only steps that raise it with ulimit -c get cores;
+          # read one with 'zstd -d core.<exe>.<pid>.zst' first.
+          if [ ! -f /.dockerenv ] && command -v sudo > /dev/null && command -v zstd > /dev/null; then
+            printf '#!/bin/sh\n[ "$3" = 0 ] && exec cat > /dev/null\nexec %s -q -1 -o "/tmp/core.$1.$2.zst"\n' \
+              "$(command -v zstd)" | sudo tee /usr/local/bin/mobilegl-core-handler > /dev/null
+            sudo chmod 755 /usr/local/bin/mobilegl-core-handler
+            sudo sysctl -q -w kernel.core_pattern='|/usr/local/bin/mobilegl-core-handler %e %p %c'
+          fi
         fi

.github/workflows/apk.yml

@@ -31,7 +31,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
       contents: read
@@ -249,7 +249,7 @@ jobs:
 
   trace-cases:
     name: trace case matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     env:
       MOBILEGL_CI_DISAGGREGATED: ${{ (github.ref_name == 'feat/disaggregated' || github.ref_name == 'codex/fix-github-ci' || github.ref_name == 'cleanup') && 'ON' || 'OFF' }}
     outputs:
@@ -272,7 +272,7 @@ jobs:
 
   trace-fixtures:
     name: trace fixture (${{ matrix.case }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: trace-cases
     strategy:
       fail-fast: false
@@ -337,7 +337,7 @@ jobs:
 
   android-avd:
     name: android avd image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     env:
       AVD_NAME: mobilegl-ci
       ANDROID_AVD_HOME: ${{ github.workspace }}/.android/avd
@@ -379,7 +379,7 @@ jobs:
             ${{ env.ANDROID_SDK_ROOT }}/platform-tools
             ${{ env.ANDROID_SDK_ROOT }}/platforms/android-35
             ${{ env.ANDROID_SDK_ROOT }}/system-images/android-35/google_apis/x86_64
-          key: ${{ runner.os }}-mobilegl-avd-api35-google_apis-x86_64-pixel_6-v2-${{ hashFiles('android-plugin/run-avd-ci.sh') }}
+          key: ${{ runner.os }}-mobilegl-avd-api35-google_apis-x86_64-pixel_6-v4-${{ hashFiles('android-plugin/run-avd-ci.sh') }}
 
       - name: Create AVD
         if: steps.android-avd-cache.outputs.cache-hit != 'true'
@@ -391,9 +391,36 @@ jobs:
             --profile pixel_6 \
             --avd-name "${AVD_NAME}"
 
+      - name: Enable KVM
+        if: steps.android-avd-cache.outputs.cache-hit != 'true'
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      # Boot the new AVD once so the cached AVD is past its first-boot setup (measured 37 s first
+      # boot, 26 s for the next cold boot). A quick-boot snapshot was tried instead: it doubled the
+      # cache restore and tripled "device offline" retries, so retrace jobs cold-boot. If the
+      # pre-boot fails, the AVD is created afresh so the cache never holds a half-booted one.
+      - name: Pre-boot AVD
+        if: steps.android-avd-cache.outputs.cache-hit != 'true'
+        run: |
+          log="${RUNNER_TEMP}/avd-preboot.log"
+          pid="${RUNNER_TEMP}/avd-preboot.pid"
+          if ! sh android-plugin/run-avd-ci.sh preboot --avd-name "${AVD_NAME}" --gpu software \
+              --emulator-log "${log}" --pid-file "${pid}" --boot-timeout 300; then
+            echo "::warning::the AVD pre-boot failed; caching a never-booted AVD instead"
+            tail -50 "${log}" || true
+            sh android-plugin/run-avd-ci.sh stop --avd-name "${AVD_NAME}" --emulator-log "${log}" --pid-file "${pid}"
+            timeout 60 tail --pid="$(cat "${pid}")" -f /dev/null || true
+            sh android-plugin/run-avd-ci.sh create --api-level 35 --target google_apis --arch x86_64 \
+              --profile pixel_6 --avd-name "${AVD_NAME}"
+          fi
+          du -sh "${ANDROID_AVD_HOME}"
+
   retrace:
     name: retrace (${{ matrix.backend.name }} / ${{ matrix.transport || 'monolith' }}, ${{ matrix.case.name }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs:
       - build
       - android-avd
@@ -410,7 +437,10 @@ jobs:
       ANDROID_SDK_ROOT: ${{ github.workspace }}/.android/sdk
     strategy:
       fail-fast: false
-      max-parallel: 4
+      # The account runs at most 20 jobs at once, shared with Test. These ~230 emulator jobs are
+      # the longer of the two runs, so they may take the whole pool: what is minimised is when the
+      # later of APK and Test finishes, not Test alone.
+      max-parallel: 20
       matrix: ${{ fromJSON(needs.trace-cases.outputs.android) }}
     steps:
       - name: Set swap space
@@ -438,8 +468,29 @@ jobs:
           echo "EMULATOR_LOG=${RUNNER_TEMP}/mobilegl-emulator.log" >> "$GITHUB_ENV"
           echo "EMULATOR_PID_FILE=${RUNNER_TEMP}/mobilegl-emulator.pid" >> "$GITHUB_ENV"
 
+      - name: Restore Android AVD cache
+        id: android-avd-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: |
+            ${{ env.ANDROID_AVD_HOME }}
+            ${{ env.ANDROID_SDK_ROOT }}/emulator
+            ${{ env.ANDROID_SDK_ROOT }}/platform-tools
+            ${{ env.ANDROID_SDK_ROOT }}/platforms/android-35
+            ${{ env.ANDROID_SDK_ROOT }}/system-images/android-35/google_apis/x86_64
+          key: ${{ runner.os }}-mobilegl-avd-api35-google_apis-x86_64-pixel_6-v4-${{ hashFiles('android-plugin/run-avd-ci.sh') }}
+
+      # The cache holds everything a retrace job runs (emulator, adb, image, AVD); the SDK manager
+      # is only needed to create the AVD when the cache missed.
+      - name: Use the cached SDK tools
+        if: steps.android-avd-cache.outputs.cache-hit == 'true'
+        run: |
+          echo "${ANDROID_SDK_ROOT}/platform-tools" >> "$GITHUB_PATH"
+          echo "${ANDROID_SDK_ROOT}/emulator" >> "$GITHUB_PATH"
+
       - name: Setup Android SDK
         id: netsetup415
+        if: steps.android-avd-cache.outputs.cache-hit != 'true'
         continue-on-error: true
         timeout-minutes: 15
         uses: android-actions/setup-android@v4
@@ -458,20 +509,9 @@ jobs:
           cmdline-tools-version: 13114758
 
       - name: Accept Android SDK licenses
+        if: steps.android-avd-cache.outputs.cache-hit != 'true'
         run: yes | sdkmanager --licenses >/dev/null
 
-      - name: Restore Android AVD cache
-        id: android-avd-cache
-        uses: actions/cache/restore@v5
-        with:
-          path: |
-            ${{ env.ANDROID_AVD_HOME }}
-            ${{ env.ANDROID_SDK_ROOT }}/emulator
-            ${{ env.ANDROID_SDK_ROOT }}/platform-tools
-            ${{ env.ANDROID_SDK_ROOT }}/platforms/android-35
-            ${{ env.ANDROID_SDK_ROOT }}/system-images/android-35/google_apis/x86_64
-          key: ${{ runner.os }}-mobilegl-avd-api35-google_apis-x86_64-pixel_6-v2-${{ hashFiles('android-plugin/run-avd-ci.sh') }}
-
       - name: Download retrace APK
         uses: actions/download-artifact@v8
         with:
@@ -659,16 +699,33 @@ jobs:
             --pid-file "${EMULATOR_PID_FILE}"
 
       - name: Upload Android retrace result
+        id: upload-retrace-result
         if: always()
+        continue-on-error: true
         uses: actions/upload-artifact@v7
         with:
           name: MobileGL-android-retrace-result-${{ matrix.lane || 'monolith-control' }}-${{ matrix.transport || 'monolith' }}-${{ env.date_today }}-${{ github.sha }}-${{ matrix.backend.name }}-${{ matrix.case.name }}
           path: android-retrace-result/**
           if-no-files-found: warn
 
+      # The artifact service sometimes times out (ETIMEDOUT on CreateArtifact, one job in 231 on
+      # 2026-10-18), which turned a passing case red; one delayed retry absorbs that.
+      - name: Wait before retrying the upload
+        if: always() && steps.upload-retrace-result.outcome == 'failure'
+        run: sleep 30
+
+      - name: Upload Android retrace result (retry)
+        if: always() && steps.upload-retrace-result.outcome == 'failure'
+        uses: actions/upload-artifact@v7
+        with:
+          name: MobileGL-android-retrace-result-${{ matrix.lane || 'monolith-control' }}-${{ matrix.transport || 'monolith' }}-${{ env.date_today }}-${{ github.sha }}-${{ matrix.backend.name }}-${{ matrix.case.name }}
+          path: android-retrace-result/**
+          if-no-files-found: warn
+          overwrite: true
+
   retrace-summary:
     name: retrace summary
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: retrace
     if: ${{ !cancelled() }}
     env:
@@ -759,7 +816,7 @@ jobs:
 
   remove-artifact-clutter:
     name: remove artifact clutter
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: retrace-summary
     if: always()
     permissions:

.github/workflows/hygiene.yml

@@ -15,7 +15,7 @@ permissions:
 jobs:
   text-hygiene:
     name: Commit messages and source text
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     env:
       TEXT_HYGIENE_BASE_BRANCH: feat/disaggregated

CMakeLists.txt

@@ -400,6 +400,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/TranslationCache.cpp
     MobileGL/MG_Util/ShaderTranspiler/glslang/TMglGlslIoResolver.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenInterfaceStructPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripCompatPerVertexMembersPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/EliminateFloatEqualsZeroPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RenameSamplerFunctionParameterPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RenameBuiltinShadowingFunctionsPass.cpp
@@ -410,6 +411,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LowerDrawParametersPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LowerViewportIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DeferGeometryEmitsPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RetainGeometryOutputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/PackDoubleVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenXfbInterfaceBlocksPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/UniquifyIoBlockNamesPass.cpp
@@ -417,6 +419,8 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/SplitArrayVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RebaseInstanceIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ZeroBaseVertexPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ExtendNarrowIntegerVertexInputsPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/NarrowIntegerRuntimeWidths.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LowerPixelCenterIntegerPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ZeroLayerOutputPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FullCoverageSampleMaskPass.cpp
@@ -525,6 +529,7 @@ set(SOURCE_FILES
     MobileGL/MG_Backend/DirectGLES/ManagersTextures.cpp
     MobileGL/MG_Backend/DirectGLES/ManagersVertexArrays.cpp
     MobileGL/MG_Backend/DirectGLES/MultiDraw.cpp
+    MobileGL/MG_Backend/DirectGLES/NarrowIntegerSeeds.cpp
 
     MobileGL/MG_Backend/DirectVulkan/DirectVulkan.cpp
     MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

MobileGL/Config.h

@@ -244,8 +244,6 @@ namespace MobileGL::MG_Config {
         // flush calls on rewritten maps become error-free no-ops. Non-persistent maps
         // keep spec FLUSH_EXPLICIT behavior.
         Bool CoherentAsFlush = false;
-        // MOBILEGL_TRACE_SKIP_AUTODESTROY: skip teardown in the ELF destructor (Init.cpp).
-        Bool TraceSkipAutodestroy = false;
         // MOBILEGL_ESPRYT_DISABLE_UBO_RING: force the DirectGLES global-UBO upload back to the
         // per-draw glBufferSubData path instead of the persistent-mapped ring allocator
         // (negative control / driver-bug escape hatch).
@@ -463,24 +461,12 @@ namespace MobileGL::MG_Config {
         // the semantic gate that replaces byte identity, and it catches the dangerous
         // direction - a dirty bit that fires too RARELY - which no purity gate can see.
         Bool PipeVerify = false;
-        // The three knobs of the MOBILEGL_PIPE_VERIFY build (P1 brief D2). Compiled only
-        // under MOBILEGL_PIPE_PUSH so the pull build's FeaturesTable does not change size.
         // MOBILEGL_PIPE_VERIFY_FATAL: the first divergence aborts (default). 0 logs and
         // counts instead, for triage and for the lane that must survive to read its own
-        // log. Tri-state parse like PipeLegacyMemos: only an explicit falsy value turns it
-        // off.
+        // log. Tri-state parse: only an explicit falsy value turns it off. The comparator's
+        // negative control, MOBILEGL_PIPE_VERIFY_CORRUPT, has no field here: only a verify
+        // build reads it, when the comparator arms (MG_Impl/Pipe/PipeFill.cpp, ArmVerify).
         Bool PipeVerifyFatal = true;
-        // MOBILEGL_PIPE_VERIFY_CORRUPT: a field name from kMGPipeInputFieldNames[]; the
-        // comparator perturbs that field in the SNAPSHOT arm before the entry compare, so a
-        // green verify run goes red naming it (negative control A). Unknown name is
-        // Fatal{PipeVerifyBadKnob}.
-        String PipeVerifyCorrupt;
-        // MOBILEGL_PIPE_POISON_OMIT: <Verb>:<FieldName>; the filler skips the STAMP (not
-        // the value) of that field for that verb, an omission indistinguishable from a
-        // forgotten FillPoints.def row, so that verb's read of it is
-        // Fatal{UnmigratedPipeInput} (negative control B). Unknown name is
-        // Fatal{PipeVerifyBadKnob}.
-        String PipePoisonOmit;
         // MOBILEGL_PIPE_STATS: dump the boundary counters (bytes, calls, roundtrips,
         // texture pulls, upload shapes, residual-block bytes, index mirror bytes).
         Bool PipeStats = false;
@@ -513,8 +499,7 @@ namespace MobileGL::MG_Config {
     // in MG_Backend/Init.cpp compiles away entirely rather than becoming a branch nobody can
     // take. A FeaturesTable member is a runtime field in every build, which is the opposite
     // of that; it would also resize MG_Config::Features and break G1 (the pull build's
-    // symbol set must not move) for the same reason the MOBILEGL_PIPE_VERIFY knobs above sit
-    // behind their own #if.
+    // symbol set must not move).
     //
     // ONE CONSEQUENCE, STATED SO IT IS NOT REDISCOVERED: in a build without the option,
     // MOBILEGL_TRANSPORT=inproc is ACCEPTED BY THE ENVIRONMENT AND SILENTLY IGNORED - the
@@ -550,10 +535,6 @@ namespace MobileGL::MG_Config {
         // by design": no forced sync, so a one-frame respecify-and-draw loop grows without bound
         // and MagmaWireReclaimScenario's watermark cases must go red.
         Uint32 WireDeferredMb = 64;
-        // MOBILEGL_IPC_PERSISTENT_BLOCK_KB: block granularity of the persistent-map push.
-        // 0 IS A NEGATIVE CONTROL, NOT "unlimited": it disables the push, and
-        // PersistentCoherentMapScenario must go RED under it (exit gate E3(a)).
-        Uint32 PersistentBlockKb = 64;
         // MOBILEGL_IPC_PERSISTENT_HASH_SUPPRESS: 1 = the persistent-map push ships only
         // blocks whose xxHash64 changed since the last push, instead of the whole mapped
         // range every verb. 0 restores the whole-range push (A/B control).
@@ -696,12 +677,6 @@ namespace MobileGL::MG_Config {
         // platform and the backend's POST self-test allow it; 0 = never grant it (the session
         // runs T2 and says so). Read by the server role only; kept through ServerSpawn.
         Uint32 AllowAdoptT0 = 1;
-        // MOBILEGL_IPC_VERB_BARRIER: 1 = the client blocks at every verb boundary until
-        // appliedSeq reaches its emitSeq (R-1). 0 is the negative control: it is EXPECTED to
-        // be red, because 31 of the 63 PipeInputs fields are still pulled from a live
-        // GLContext by the client's residual fill and a free-running queue lets the server
-        // read a FUTURE value of them.
-        Uint32 VerbBarrier = 1;
         // MOBILEGL_IPC_RUN_AHEAD (P5e, docs/archive/contracts/CONTRACT-P5E.md §1): 1 = after publishing an
         // UNBARRIERED record the client returns immediately instead of waiting for its apply.
         // It is one half of a conjunction and never a switch on its own - the client arms
@@ -712,9 +687,7 @@ namespace MobileGL::MG_Config {
         // 0 IS THE A/B CONTROL AND NOT A NEGATIVE ONE: the server code, the fill decision and
         // every record are identical on both arms, and the only difference is whether the
         // client waits. That is what makes "is the picture the same" a question about the wait
-        // rule alone. MOBILEGL_IPC_VERB_BARRIER=0 keeps its own meaning and stays the
-        // lockstep arm's negative control; under run-ahead it is the one that must go red, at
-        // the first barriered row's stale pull.
+        // rule alone.
         //
         // Forced to 0 by MOBILEGL_PIPE_VERIFY, beside BatchWaits: the comparator needs a
         // client-filled gPipeInputs block for every verb, and run-ahead is precisely the

MobileGL/ConfigLoader.cpp

@@ -137,8 +137,9 @@ namespace MobileGL::MG_ConfigLoader {
         }
 
         // Everything the system files say, the backend file ahead of client.conf (first emplace
-        // wins). Re-read on every call: callers are few (Init, and a handful of lookups before it),
-        // and a file that changed between two processes' starts must not be served stale.
+        // wins). Re-read on every call: callers are few (Init, a handful of lookups before it, and a
+        // verify build's comparator when it arms), and a file that changed between two processes'
+        // starts must not be served stale.
         void ReadSystemConfig(UnorderedMap<String, String>& out, Bool log) {
             if (IsServerProcess()) return;
             ReadBackendFile(FilePathSetting("MOBILEGL_BACKEND_FILE", kDefaultBackendFile), out);
@@ -402,7 +403,6 @@ namespace MobileGL::MG_ConfigLoader {
         features.EsprytInvalidImagePlaceholder = QueryEnvQuirkOverride("MOBILEGL_ESPRYT_INVALID_IMAGE_PLACEHOLDER");
         features.PointSizeDemotion = QueryEnvQuirkOverride("MOBILEGL_POINT_SIZE_DEMOTION");
         features.CoherentAsFlush = QueryEnvFlag("MOBILEGL_COHERENT_AS_FLUSH");
-        features.TraceSkipAutodestroy = QueryEnvFlag("MOBILEGL_TRACE_SKIP_AUTODESTROY");
         features.EsprytDisableUboRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UBO_RING");
         features.EsprytDisableUnpackRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UNPACK_RING");
         features.EsprytDisableUploadRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING");
@@ -452,8 +452,6 @@ namespace MobileGL::MG_ConfigLoader {
         // Defaults ON: read as a tri-state so only an explicitly falsy value turns it off.
         features.PipeVerifyFatal =
             QueryEnvQuirkOverride("MOBILEGL_PIPE_VERIFY_FATAL") != MG_Config::QuirkOverride::ForceOff;
-        QueryEnvVariable("MOBILEGL_PIPE_VERIFY_CORRUPT", features.PipeVerifyCorrupt, "");
-        QueryEnvVariable("MOBILEGL_PIPE_POISON_OMIT", features.PipePoisonOmit, "");
         features.PipeStats = QueryEnvFlag("MOBILEGL_PIPE_STATS");
         features.PipeIndexMirrorMb = QueryEnvUint32("MOBILEGL_PIPE_INDEX_MIRROR_MB", 64, 0, 4096);
         features.PipeStatsPeriod = QueryEnvUint32("MOBILEGL_PIPE_STATS_PERIOD", 120, 1, 1000000);
@@ -601,22 +599,25 @@ namespace MobileGL::MG_ConfigLoader {
         // The verify harness compares the pushed block against the applier per verb; a
         // batched queue lets the comparer read a supplied field mid-apply, which is a
         // torn read rather than a divergence. The batch is therefore off whenever the
-        // shadow comparer is armed.
+        // shadow comparer is armed, which only a verify build compiles.
+#if MOBILEGL_PIPE_VERIFY
         if (MG_Config::Features.PipeVerify) ipc.BatchWaits = 0;
+#endif
         // UNSET is T0 with quiet fallbacks (the default since 2026-09-29); 0 asks for T0 by name, 1 is
         // refused by name, 2 is T2 - settled at the handshake from the data plane (P11 A1/B2,
         // MG_Remote/Transport/AdoptTier.h). An unparseable value is warned about and reads as unset.
         ipc.AdoptTier = QueryEnvUint32("MOBILEGL_IPC_ADOPT_TIER", MG_Config::kAdoptTierUnset, 0, 2);
         // P11 B2: the server's own T0 allow switch (Config.h).
         ipc.AllowAdoptT0 = QueryEnvUint32("MOBILEGL_IPC_ALLOW_ADOPT_T0", 1, 0, 1);
-        ipc.VerbBarrier = QueryEnvUint32("MOBILEGL_IPC_VERB_BARRIER", 1, 0, 1);
         // P5e (docs/archive/contracts/CONTRACT-P5E.md §1). The wait rule's A/B, parsed here like every
         // other IPC knob and armed only where the server publishes kCapRunAheadApply.
         ipc.RunAhead = QueryEnvUint32("MOBILEGL_IPC_RUN_AHEAD", 1, 0, 1);
         // ... and forced OFF by the verify harness for BatchWaits' reason, one step further:
         // run-ahead's whole point is that the client stops filling gPipeInputs for an
         // unbarriered record, and the comparator has nothing left to compare when it does.
+#if MOBILEGL_PIPE_VERIFY
         if (MG_Config::Features.PipeVerify) ipc.RunAhead = 0;
+#endif
         // The present credit (ruling 4). 1 is one frame of overlap; 8 is the ceiling because a
         // deeper queue buys nothing on a CPU-bound client and pays for it in latency. 0 is NOT
         // admitted: a credit of zero would mean "publish no present at all".
@@ -646,12 +647,14 @@ namespace MobileGL::MG_ConfigLoader {
         // own and needs no applier quiesce. 0 still turns it off (the negative control does).
         ipc.RoleSplitState =
             QueryEnvQuirkOverride("MOBILEGL_IPC_ROLE_SPLIT_STATE") != MG_Config::QuirkOverride::ForceOff;
+#if MOBILEGL_PIPE_VERIFY
         if (MG_Config::Features.PipeVerify && ipc.RoleSplitState) {
             MGLOG_W("Config: MOBILEGL_IPC_ROLE_SPLIT_STATE=1 is incompatible with "
                     "MOBILEGL_PIPE_VERIFY (the comparator owns the single fill block); "
                     "the dual-block rehearsal is OFF for this run");
             ipc.RoleSplitState = false;
         }
+#endif
 
         // P6 `dl` (CONTRACT-P6 5.3): MOBILEGL_IPC_RESPAWN IS A NAMED REFUSAL, NOT A NO-OP.
         //
@@ -715,24 +718,18 @@ namespace MobileGL::MG_ConfigLoader {
         // changes the wall clock by seconds (the P12 sweep: 28.3 s at 1 down to 10.8 s at 6) a
         // log that does not name it makes every run ambiguous about its own configuration.
         MGLOG_I("Config: IPC ring=%uMiB stage=%uMiB wire-deferred=%uMiB spin=%uus event-wait=%ums "
-                "persistent-block=%uKiB create-window=%u pbo-readback-sync=%u poll-escalate=%u "
-                "adopt-tier=%s allow-t0=%u verb-barrier=%u run-ahead=%u present-credit=%u control-timeout=%ums "
+                "create-window=%u pbo-readback-sync=%u poll-escalate=%u "
+                "adopt-tier=%s allow-t0=%u run-ahead=%u present-credit=%u control-timeout=%ums "
                 "cold-start=%ums strict=%d audit=%d role-split-state=%d affinity='%s' surface=%s",
                 ipc.RingMb, ipc.StageMb, MG_Config::RecordArm.WireDeferredMb, ipc.SpinUs, ipc.EventWaitMs,
-                MG_Config::RecordArm.PersistentBlockKb, ipc.CreateWindow, ipc.PboReadbackSync, ipc.PollEscalate,
+                ipc.CreateWindow, ipc.PboReadbackSync, ipc.PollEscalate,
                 ipc.AdoptTier == 0   ? "0"
                 : ipc.AdoptTier == 1 ? "1"
                 : ipc.AdoptTier == 2 ? "2"
                                      : "unset(T0)",
-                ipc.AllowAdoptT0, ipc.VerbBarrier, ipc.RunAhead, ipc.PresentCredit, ipc.ControlTimeoutMs,
-                ipc.ColdStartMs, static_cast<int>(ipc.StrictErrors), static_cast<int>(ipc.Audit),
-                static_cast<int>(ipc.RoleSplitState), ipc.ServerAffinity.c_str(),
-                MG_Config::ServerOwnedWindowSurfaces() ? "server" : "offscreen");
-        if (ipc.VerbBarrier == 0) {
-            MGLOG_W("Config: MOBILEGL_IPC_VERB_BARRIER=0 is the R-1 NEGATIVE CONTROL and is "
-                    "expected to fail: the client still pulls 31 of 63 PipeInputs fields from a "
-                    "live GLContext, so an unbarriered queue lets the server read future values");
-        }
+                ipc.AllowAdoptT0, ipc.RunAhead, ipc.PresentCredit, ipc.ControlTimeoutMs, ipc.ColdStartMs,
+                static_cast<int>(ipc.StrictErrors), static_cast<int>(ipc.Audit), static_cast<int>(ipc.RoleSplitState),
+                ipc.ServerAffinity.c_str(), MG_Config::ServerOwnedWindowSurfaces() ? "server" : "offscreen");
     }
 #endif
 
@@ -742,9 +739,6 @@ namespace MobileGL::MG_ConfigLoader {
         // P7 wave 4 M2 (Config.h has the semantics). 0 is admitted ON PURPOSE as the negative
         // control: no forced sync, and MagmaWireReclaimScenario's watermark case must go red.
         ipc.WireDeferredMb = QueryEnvUint32("MOBILEGL_IPC_WIRE_DEFERRED_MB", 64, 0, 65536);
-        // 0 is admitted ON PURPOSE and is the negative control of exit gate E3(a): it turns
-        // the persistent-map push OFF, and PersistentCoherentMapScenario must go red.
-        ipc.PersistentBlockKb = QueryEnvUint32("MOBILEGL_IPC_PERSISTENT_BLOCK_KB", 64, 0, 65536);
         // Whole-range push is the 0 arm; with it on (default) only blocks whose
         // xxHash64 changed since the last push are shipped.
         ipc.PersistentHashSuppress = QueryEnvUint32("MOBILEGL_IPC_PERSISTENT_HASH_SUPPRESS", 1, 0, 1);
@@ -758,10 +752,6 @@ namespace MobileGL::MG_ConfigLoader {
                     "server never forces a sync for orphaned wire buffer stores, so a long frame "
                     "that respecifies and draws holds every one of them until the frame ends");
         }
-        if (ipc.PersistentBlockKb == 0) {
-            MGLOG_W("Config: MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0 is the E3(a) NEGATIVE CONTROL: "
-                    "the persistent-map push is OFF and a coherent-map scenario must go red");
-        }
     }
 
     void Init() {

MobileGL/Init.cpp

@@ -206,8 +206,12 @@ namespace MobileGL {
         // flag here rather than inside PrewarmBuiltins so ShaderCompiler keeps no dependency
         // on the async subsystem (ProgramUtilTest compiles that file without it).
         // MOBILEGL_DISABLE_SHADER_PREWARM skips it for processes too short-lived to repay it.
-        if (MG_Util::Async::AsyncShaderCompileEnabled() && !MG_Config::Features.DisableShaderPrewarm) {
-            MG_Util::ShaderTranspiler::ShaderCompiler::PrewarmBuiltins();
+        if (MG_Util::Async::AsyncShaderCompileEnabled()) {
+            if (MG_Config::Features.DisableShaderPrewarm) {
+                MGLOG_I("glslang built-in table prewarm skipped: MOBILEGL_DISABLE_SHADER_PREWARM is set");
+            } else {
+                MG_Util::ShaderTranspiler::ShaderCompiler::PrewarmBuiltins();
+            }
         }
         MGLOG_D("glslang initialized");
         g_isInitialized = true;

MobileGL/Init.h

@@ -28,7 +28,8 @@ namespace MobileGL {
         void Init();
         // One setting resolved the way Init() resolves it - the environment, then the system
         // configuration files (ConfigLoader.cpp) - for the few readers that must decide something
-        // before MobileGL initializes. False when neither names it.
+        // before MobileGL initializes, and for a verify build's comparator, which reads
+        // MOBILEGL_PIPE_VERIFY_CORRUPT when it arms. False when neither names it.
         Bool LookupSetting(const char* key, String& outValue);
     } // namespace MG_ConfigLoader
 

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -1832,8 +1832,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // GL_MAX_TEXTURE_IMAGE_UNITS must never exceed host-side fixed arrays sized off it (e.g.
         // Minecraft's 128-entry Blaze3D GlStateManager.TEXTURES[], iterated by Iris), and the combined
         // limit must stay within our texture-unit state array capacity.
+        //
+        // The fragment limit is raised to the desktop value (32) even where the ES driver counts 16
+        // per stage: Iris sizes its WHOLE-PROGRAM unit budget off this query (vertex and fragment
+        // samplers share it, and it refuses the next sampler as soon as the budget is full), so 16
+        // leaves shader packs such as iterationT without a pipeline at all. Unit NUMBERS up to the
+        // driver's combined limit are legal in every stage, and a stage that really samples more
+        // textures than the driver allows still fails at link with the driver's own log.
         m_dynamicParameters.MaxTextureImageUnits =
-            std::min(m_GLESCapabilities.MaxTextureImageUnits,
+            std::min(std::max(m_GLESCapabilities.MaxTextureImageUnits, m_GLESCapabilities.MaxCombinedTextureImageUnits),
                      static_cast<Int>(MG_State::GLState::TextureState::MAX_PER_STAGE_TEXTURE_IMAGE_UNITS));
         m_dynamicParameters.MaxVertexTextureImageUnits =
             std::min(m_GLESCapabilities.MaxVertexTextureImageUnits,

MobileGL/MG_Backend/DirectGLES/DirectGLESBind.cpp

@@ -398,12 +398,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // PrepareForDraw turns into BindBackendVAOId(0) exactly as a null frontend VAO did;
         // logging about it would fire on every draw of a session that legitimately has no
         // vertex-elements CSO yet.
-        void SyncCurrentVAOFromRecords(BackendVertexArrayObject* vaoTwin) {
+        void SyncCurrentVAOFromRecords(BackendVertexArrayObject* vaoTwin, const IntegerAttributePlan& plan) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
             if (!vaoTwin) return;
-            vaoTwin->SyncToBackendFromApplier();
+            vaoTwin->SyncToBackendFromApplier(plan);
         }
 
         // GL: a shader input whose generic attribute array is DISABLED reads that attribute's *current
@@ -910,7 +910,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         BufferImpl::SyncNeccessaryBuffers(currentVAO, vaoTwin, vaoConfigVersion, syncBit & DrawSyncBit::IndexBuffer,
                                           syncBit & DrawSyncBit::IndirectBuffer);
-        VertexArrayImpl::SyncCurrentVAOFromRecords(vaoTwin);
+        // The draw's integer arrays and the program's narrow-integer seeds (NarrowIntegerSeeds.h).
+        IntegerAttributePlan integerPlan = ResolveIntegerAttributePlanForDraw(MG_Pipe::MGPipeApplier().DrawProgram);
+        VertexArrayImpl::SyncCurrentVAOFromRecords(vaoTwin, integerPlan);
         TextureImpl::SyncNeccessaryTextures(textureKeys);
         // A draw reads and writes through its image units too, so the unit bindings have to be
         // as current as the sampled ones. Gated (see the sweep): a program with no image binding
@@ -927,7 +929,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // at all; the remaining uses of it below are the two callees' own, and both have a
         // handle arm of their own. P5e (pa) finished it: the pull itself is gone on that arm and
         // `currentProgram` is a null SharedPtr there, which this branch never reaches for.
-        PrgramImpl::SyncCurrentProgramByHandle(MG_Pipe::MGPipeApplier().DrawProgram, true);
+        PrgramImpl::SyncCurrentProgramByHandle(MG_Pipe::MGPipeApplier().DrawProgram, true, &integerPlan);
+        if (DropRefusedNarrowIntegerSeeds(integerPlan, MG_Pipe::MGPipeApplier().DrawProgram))
+            VertexArrayImpl::SyncCurrentVAOFromRecords(vaoTwin, integerPlan);
         RenderStateImpl::SyncRenderState();
 
         BindCurrentFBO(FramebufferTarget::Draw);
@@ -951,6 +955,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         BindCurrentTextures(textureKeys, currentProgram);
         BindCurrentProgramWithResources(currentProgram, textureKeys, MG_Pipe::MGPipeApplier().DrawProgram);
+        PushNarrowIntegerWidthsForDraw(integerPlan, MG_Pipe::MGPipeApplier().DrawProgram);
 
         // Last: opening the capture span needs the program current and the capture
         // buffers bound, and ES rejects most binding changes once it is open.

MobileGL/MG_Backend/DirectGLES/DirectGLESInternal.h

@@ -387,7 +387,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
         const MG_Pipe::MGPipeShaderCsoRecord* ResolveGlobalConstantsRecordForHandle(MG_Pipe::MGPipeHandle handle,
                                                                                     Uint uboSize);
 
-        void SyncCurrentProgramByHandle(MG_Pipe::MGPipeHandle cso, Bool forDraw);
+        // `plan` (a draw's) arms the program's narrow-integer seeds when it needs them.
+        void SyncCurrentProgramByHandle(MG_Pipe::MGPipeHandle cso, Bool forDraw,
+                                        const IntegerAttributePlan* plan = nullptr);
     } // namespace PrgramImpl
 
     // Defined with the surface registry, below.

MobileGL/MG_Backend/DirectGLES/DirectGLESState.cpp

@@ -1434,7 +1434,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // and the clamp masks, the broadcast count, ImageUnitFormatsStillMatch and the three
         // patch clauses are unchanged - they are backend globals, fb's row and VALUE rows of the
         // residual block, none of which this family owns.
-        void SyncCurrentProgramByHandle(MG_Pipe::MGPipeHandle cso, Bool forDraw) {
+        void SyncCurrentProgramByHandle(MG_Pipe::MGPipeHandle cso, Bool forDraw, const IntegerAttributePlan* plan) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
@@ -1468,8 +1468,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 g_lastUsedBackendProgramId = 0;
                 return;
             }
+            // Sticky for the twin's lifetime: a draw that needs the seeds rebuilds the program once.
+            if (plan != nullptr && plan->NeedsSeeds()) twin->NarrowIntegerSeeds().wanted = true;
             if (!twin->GetBackendProgramId() || twin->GetSyncedShaderCsoSerial() != record->Serial ||
-                twin->GetSyncedBindingsSerial() != record->BindingsSerial ||
+                twin->NarrowIntegerSeeds().Stale() || twin->GetSyncedBindingsSerial() != record->BindingsSerial ||
                 twin->GetSnormFallbackClampOutputMask() != g_snormFallbackClampOutputMask ||
                 twin->GetUnormFallbackClampOutputMask() != g_unormFallbackClampOutputMask ||
                 twin->GetFragColorBroadcastCount() != g_fragColorBroadcastCount ||

MobileGL/MG_Backend/DirectGLES/IntegerAttributePlan.h

@@ -0,0 +1,121 @@
+// MobileGL - MobileGL/MG_Backend/DirectGLES/IntegerAttributePlan.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+
+#include <Includes.h>
+#include <MG_Util/ShaderTranspiler/NarrowIntegerVertexInputs.h>
+
+namespace MobileGL::MG_Backend::DirectGLES {
+    using MG_Util::ShaderTranspiler::IntegerVertexInputMasks;
+
+    // What one draw does with its integer vertex arrays. ES defines an integer attribute's value
+    // only when the array's type has the input's signedness, so every integer array feeding an
+    // integer input of the other signedness is ISSUED with the input's signedness (retypeMask).
+    // For 32-bit data that is the same bits, which is GL's value. For 8/16-bit data the driver
+    // then extends by the input's rule, and the program's seeds (ExtendNarrowIntegerVertexInputs-
+    // Pass's RuntimeWidths mode) widen the low 8 or 16 bits again by the data's rule: widths8 and
+    // widths16 are the locations to widen, and they are the two uniforms the draw sets.
+    struct IntegerAttributePlan {
+        Uint32 retypeMask = 0;
+        // Integer arrays feeding integer inputs: the only locations whose issued type is
+        // observable, so a VAO keeps whatever it holds for every other location.
+        Uint32 careMask = 0;
+        Uint32 widths8 = 0;
+        Uint32 widths16 = 0;
+
+        constexpr Bool NeedsSeeds() const { return (widths8 | widths16) != 0; }
+        // The plan for a program without working seeds: a narrow array keeps the application's
+        // type (the value the driver gives today) rather than a retype nothing widens back.
+        constexpr IntegerAttributePlan WithoutSeeds() const {
+            IntegerAttributePlan plan = *this;
+            plan.retypeMask &= ~(widths8 | widths16);
+            plan.widths8 = 0;
+            plan.widths16 = 0;
+            return plan;
+        }
+        constexpr Bool operator==(const IntegerAttributePlan&) const = default;
+    };
+
+    // The locations whose integer array data is of each width and signedness.
+    struct IntegerAttributeDataMasks {
+        MG_Util::ShaderTranspiler::NarrowIntegerAttributeMasks narrow;
+        Uint32 unsigned32 = 0;
+        Uint32 signed32 = 0;
+
+        constexpr void Note(Uint32 location, DataType type) {
+            if (location >= 32) return;
+            const Uint32 bit = 1u << location;
+            switch (type) {
+            case DataType::Uint8:
+                narrow.unsigned8 |= bit;
+                break;
+            case DataType::Uint16:
+                narrow.unsigned16 |= bit;
+                break;
+            case DataType::Uint32:
+                unsigned32 |= bit;
+                break;
+            case DataType::Int8:
+                narrow.signed8 |= bit;
+                break;
+            case DataType::Int16:
+                narrow.signed16 |= bit;
+                break;
+            case DataType::Int32:
+                signed32 |= bit;
+                break;
+            default:
+                break;
+            }
+        }
+        constexpr Uint32 Unsigned() const { return narrow.unsigned8 | narrow.unsigned16 | unsigned32; }
+        constexpr Uint32 Signed() const { return narrow.signed8 | narrow.signed16 | signed32; }
+    };
+
+    // `seedsUsable` is false once the program's armed build could not give it working seeds.
+    constexpr IntegerAttributePlan ResolveIntegerAttributePlan(const IntegerVertexInputMasks& inputs,
+                                                               const IntegerAttributeDataMasks& data,
+                                                               Bool seedsUsable) {
+        IntegerAttributePlan plan;
+        plan.careMask = (inputs.signedInputs | inputs.unsignedInputs) & (data.Unsigned() | data.Signed());
+        plan.retypeMask = (inputs.signedInputs & data.Unsigned()) | (inputs.unsignedInputs & data.Signed());
+        const auto narrow = MG_Util::ShaderTranspiler::ResolveNarrowIntegerVertexInputs(inputs, data.narrow);
+        plan.widths8 = narrow.zeroExtend8 | narrow.signExtend8;
+        plan.widths16 = narrow.zeroExtend16 | narrow.signExtend16;
+        return seedsUsable ? plan : plan.WithoutSeeds();
+    }
+
+    // The array type to issue: the application's, or its counterpart of the other signedness.
+    constexpr GLenum IntegerAttribTypeForInput(GLenum applicationType, Bool retype) {
+        if (!retype) return applicationType;
+        switch (applicationType) {
+        case GL_BYTE:
+            return GL_UNSIGNED_BYTE;
+        case GL_UNSIGNED_BYTE:
+            return GL_BYTE;
+        case GL_SHORT:
+            return GL_UNSIGNED_SHORT;
+        case GL_UNSIGNED_SHORT:
+            return GL_SHORT;
+        case GL_INT:
+            return GL_UNSIGNED_INT;
+        case GL_UNSIGNED_INT:
+            return GL_INT;
+        default:
+            return applicationType;
+        }
+    }
+
+    // What a vertex array issues after this plan: the plan's choice wherever it can be observed,
+    // what it already holds everywhere else, so a program switch that only changes which
+    // locations are read does not re-issue any pointer.
+    constexpr Uint32 HeldIntegerRetype(Uint32 held, const IntegerAttributePlan& plan) {
+        return (held & ~plan.careMask) | (plan.retypeMask & plan.careMask);
+    }
+} // namespace MobileGL::MG_Backend::DirectGLES

MobileGL/MG_Backend/DirectGLES/Managers.cpp

@@ -374,6 +374,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         if (shaderType != GL_VERTEX_SHADER) {
             return source;
         }
+        source = PromoteNarrowIntegerWidthGlobals(std::move(source));
         for (const char* name : {DRAW_ID_UNIFORM_NAME, BASE_VERTEX_UNIFORM_NAME}) {
             for (const char* declPrefix :
                  {"highp int ", "mediump int ", "lowp int ", "int ", "highp uint ", "mediump uint ", "uint "}) {

MobileGL/MG_Backend/DirectGLES/Managers.h

@@ -30,8 +30,8 @@
 // so a forward declaration would not do. Push-only, like everything else P4a adds to this
 // header, so the pull build's include graph is unchanged (D-P).
 #include <MG_Pipe/PipeApply.h>
-// P13 W5: the record arm's deaths (the slot tables' handle refusals below), in every build.
-#include <MG_Pipe/PipeSessionFail.h>
+#include <MG_Pipe/PipeSessionFail.h> // P13 W5: the slot tables' handle refusals, in every build
+#include "NarrowIntegerSeeds.h"
 
 namespace MobileGL::MG_Backend::DirectGLES {
     String EmulateBaseInstanceInVertexShader(String source, GLenum shaderType);
@@ -1230,9 +1230,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // above, so VertexArrayImpl::SyncCurrentVAOFromRecords calls this ENTRY directly
             // instead of passing a null SharedPtr into a function whose signature promises one.
             // CONTRACT-P5E §4.1's rule ("the object parameter is deleted from the transport
-            // overload, not defaulted to null") is what this obeys. The body is unchanged and
-            // was already record-only - it is this family's existence proof (scout S1 §2).
-            void SyncToBackendFromApplier();
+            // overload, not defaulted to null") is what this obeys. `plan`: IntegerAttributePlan.h.
+            void SyncToBackendFromApplier(const IntegerAttributePlan& plan);
             // P14: the applier's buffer-set serials move whenever ANY VAO's set is published, so
             // switching between two VAOs moves them although neither twin's buffers changed. Called
             // before the draw's syncs: when the window this twin last emitted is the applier's
@@ -1455,12 +1454,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // one monotone Uint64, no wrap, nothing to patch. This is the Track H re-key
             // ARCHITECTURE.md 9.5 counts.
             Uint64 m_syncedIndexSerial = 0;
-            // Byte shift currently baked into the instanced arrays' offsets by the baseInstance
-            // emulation (see SetPendingFetchBaseInstance). It is draw state, not VAO state, so it
-            // is deliberately NOT covered by the config version: the frontend never bumps for it.
-            // Kept here because it describes what was last EMITTED, which is what the next sync
-            // has to correct.
+            // Byte shift baked into the instanced arrays' offsets by the baseInstance emulation:
+            // draw state, not VAO state, kept because the next sync has to correct what was EMITTED.
             Uint32 m_syncedFetchBaseInstance = 0;
+            // The integer arrays last issued with the other signedness (HeldIntegerRetype).
+            Uint32 m_syncedRetypeMask = 0;
             // BufferImpl::g_bufferBackendIdGeneration as of this twin's last emit. A
             // mismatch means some live buffer's driver id was re-minted since; the ids
             // baked into the driver VAO's attribute/element bindings may be dead even
@@ -2847,6 +2845,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // shader failed to transpile or compile, or the link itself failed). Use()
             // must not leave the previously bound program current in that case.
             Bool IsBackendProgramUsable() const { return m_backendProgramUsable; }
+            NarrowIntegerSeedState& NarrowIntegerSeeds() { return m_narrowIntegerSeeds; }
             Uint GetBackendGlobalUBOId() const { return m_backendGlobalUBOId; }
             Uint32 GetSnormFallbackClampOutputMask() const { return m_snormFallbackClampOutputMask; }
             Uint32 GetUnormFallbackClampOutputMask() const { return m_unormFallbackClampOutputMask; }
@@ -2971,7 +2970,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                       const std::map<String, String>& inputBlockRenames,
                                       const std::map<String, String>& outputBlockRenames, Bool stripInputBlockLocations,
                                       Bool stripOutputBlockLocations, Int atomicCounterEsslBindingTop,
-                                      Bool enableSpirvValidation, String& outSource,
+                                      Bool narrowIntegerSeedsArmed, Bool enableSpirvValidation, String& outSource,
                                       std::set<String>& outFlattenedXfbBlockNames,
                                       Vector<Int>& outAtomicCounterGlBindings, String& outError) const;
 
@@ -3030,6 +3029,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             Vector<Int> m_formatlessImageUnits;
             Uint64 m_imageUnitFormatSignature = 0;
             SamplerPassMemo m_samplerPassMemo;
+            NarrowIntegerSeedState m_narrowIntegerSeeds;
         };
 
         extern Uint32 g_snormFallbackClampOutputMask;

MobileGL/MG_Backend/DirectGLES/ManagersPrograms.cpp

@@ -888,8 +888,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             const UnorderedMap<String, Int>& storageBlockBindingOverrides,
             const std::map<String, String>& inputBlockRenames, const std::map<String, String>& outputBlockRenames,
             const Bool stripInputBlockLocations, const Bool stripOutputBlockLocations,
-            const Int atomicCounterEsslBindingTop, const Bool enableSpirvValidation, String& outSource,
-            std::set<String>& outFlattenedXfbBlockNames, Vector<Int>& outAtomicCounterGlBindings,
+            const Int atomicCounterEsslBindingTop, const Bool narrowIntegerSeedsArmed, const Bool enableSpirvValidation,
+            String& outSource, std::set<String>& outFlattenedXfbBlockNames, Vector<Int>& outAtomicCounterGlBindings,
             String& outError) const {
             // ESSL cannot express gl_DrawID/gl_BaseInstance/gl_BaseVertex; demote them to
             // plain globals (mg_*) before handing the module to SPIRV-Cross.
@@ -1050,24 +1050,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 MG_Util::ShaderTranspiler::ShaderCompiler::SplitArrayVertexInputsForEssl(
                     *effectiveSpirv, splitArrayInputSpirv, enableSpirvValidation) &&
                 !splitArrayInputSpirv.empty() && splitArrayInputSpirv != *effectiveSpirv) {
-                // Only when the pass ACTUALLY split something. The optimizer hands back a
-                // re-serialised copy either way, and adopting that copy for every vertex
-                // shader would put every one of them through a round trip they do not need
-                // - which is not free: it cost the create-indirect retrace 0.15 SSIM the
-                // first time this gate was missing (the original capture; the case is now
-                // minecraft-1.21.1-neoforge-create-indirect-in-world-align1024).
+                // Only when the pass ACTUALLY split something: the optimizer hands back a
+                // re-serialised copy either way, and that round trip is not free - it cost the
+                // minecraft-1.21.1-neoforge-create-indirect-in-world-align1024 retrace 0.15 SSIM.
                 effectiveSpirv = &splitArrayInputSpirv;
             }
 
-            // Adopt the rewritten module only when THIS stage actually had one of the
-            // blocks - the optimizer hands back a re-serialised copy either way, and taking
-            // that copy for a module it did not rewrite is not free (it cost the
-            // create-indirect retrace 0.15 SSIM when the array-input split first missed
-            // this gate; the case is now
-            // minecraft-1.21.1-neoforge-create-indirect-in-world-align1024). The report has to be
-            // per stage, not cumulative: a fragment shader consuming the same block reports a
-            // name the vertex stage already reported,
-            // and its own rewrite must still be taken or the two stages stop matching.
+            // An armed vertex stage's narrow-integer seeds (NarrowIntegerSeeds.h), after the split
+            // and adopted only when the pass rewrote the module. Keyed by narrowIntegerSeedsArmed.
+            Vector<unsigned int> narrowSeededSpirv;
+            effectiveSpirv =
+                SeedNarrowIntegerVertexInputsForEssl(narrowIntegerSeedsArmed && glShaderType == GL_VERTEX_SHADER,
+                                                     *effectiveSpirv, narrowSeededSpirv, enableSpirvValidation);
+
+            // Adopt the rewritten module only when THIS stage actually had one of the blocks, for
+            // the array-input split's reason above. The report is per stage, not cumulative: a
+            // fragment shader consuming a block the vertex stage reported must still take its own
+            // rewrite or the two stages stop matching.
             Vector<unsigned int> flattenedXfbSpirv;
             if (!xfbCaptureBlockNames.empty()) {
                 // Reported into a local first, and published only if the module is really
@@ -1605,8 +1604,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
-            // Recorded before either early return below, so Use() can always name the GL
-            // program a no-op draw belongs to - including the "linked but not drawable" exit.
+            // Before either early return below, so Use() can name the GL program of a no-op draw.
             m_frontendProgramId = src.GetExternalIndex();
 
             // GetSpirvStatus() as well as GetLinkStatus(): a program whose phase-B job was
@@ -1620,6 +1618,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
                              src.GetExternalIndex());
                 return;
             }
+            // After the return above, which keeps the previous driver program and the widths it holds.
+            BeginNarrowIntegerSeedBuild(m_narrowIntegerSeeds);
 
             MGLOG_D("Syncing program to backend. State program ID: %u, Backend ID: %u", src.GetExternalIndex(),
                     m_backendProgramId);
@@ -1636,9 +1636,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // this build current - the draw path compares the signature and rebuilds on a change.
             const auto& storageBlockBindingOverrides = src.GetShaderStorageBlockBindingOverrides();
             m_shaderStorageBlockBindingSignature = ComputeShaderStorageBlockBindingSignature(src);
-            // Rebuilt by the transpile loop below, one entry per atomic-counter block it finds.
-            // The top is snapshotted here so every stage of this program - and the draw path
-            // reading it afterwards - resolves the same slot for the same GL binding.
+            // Rebuilt by the transpile loop below, one entry per atomic-counter block; the top is
+            // snapshotted so every stage and the draw path resolve one slot per GL binding.
             m_atomicCounterGlBindings.clear();
             m_atomicCounterEsslBindingTop = AtomicCounterEsslBindingTop();
             // Re-established by AttachPassthroughTessControlStage below when this program needs
@@ -2045,6 +2044,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 esslKeyInputs.stripInputBlockLocations = stripInputBlockLocations;
                 esslKeyInputs.stripOutputBlockLocations = stripOutputBlockLocations;
                 esslKeyInputs.enableSpirvValidation = enableSpirvValidation;
+                esslKeyInputs.narrowIntegerSeedsArmed = glShaderType == GL_VERTEX_SHADER && m_narrowIntegerSeeds.built;
 
                 auto& esslCache = MG_Util::ShaderTranspiler::GetEsslTranslationCache();
                 MG_Util::ShaderTranspiler::TranslationCacheKey esslCacheKey;
@@ -2070,9 +2070,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     if (!TranspileSpirvToEssl(spirvCode, glShaderType, xfbCaptureBlockNames, imageFormatBake,
                                               storageBlockBindingOverrides, inputBlockRenames, outputBlockRenames,
                                               stripInputBlockLocations, stripOutputBlockLocations,
-                                              m_atomicCounterEsslBindingTop, enableSpirvValidation, source,
-                                              stageFlattenedXfbBlockNames, stageAtomicCounterGlBindings,
-                                              transpileError)) {
+                                              m_atomicCounterEsslBindingTop, esslKeyInputs.narrowIntegerSeedsArmed,
+                                              enableSpirvValidation, source, stageFlattenedXfbBlockNames,
+                                              stageAtomicCounterGlBindings, transpileError)) {
                         // MGLOG_E, unlatched, like the compile- and link-failure diagnostics
                         // below: one line per failing stage is bounded by program count and
                         // naming the stage is the entire diagnostic value. A stage that never
@@ -2286,14 +2286,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     pos = source.find(findStr, pos);
                 }
 
+                NoteNarrowIntegerSeedSource(m_narrowIntegerSeeds, source, glShaderType);
                 const char* sourceCStr = source.c_str();
                 MGLOG_D("Setting shader source for backend shader ID: %u\nsrc:\n%s", backendShaderId, sourceCStr);
                 g_GLESFuncs.glShaderSource(backendShaderId, 1, &sourceCStr, nullptr);
                 g_GLESFuncs.glCompileShader(backendShaderId);
 
-                // GL_FALSE, not GL_TRUE: an unwritten out-param must read as "compile failed"
-                // and take the diagnostic path, never as a silent success that attaches an
-                // uncompiled shader.
+                // GL_FALSE, not GL_TRUE: an unwritten out-param must read as "compile failed", never
+                // as a silent success that attaches an uncompiled shader.
                 GLint compileStatus = GL_FALSE;
                 g_GLESFuncs.glGetShaderiv(backendShaderId, GL_COMPILE_STATUS, &compileStatus);
                 if (compileStatus == GL_FALSE) {
@@ -2649,6 +2649,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 m_backendProgramUsable = false;
                 return;
             }
+            // A capture program with integer inputs is armed at its first build, so arming never
+            // relinks a program in the middle of a capture (NarrowIntegerSeeds.h).
+            PrepareNarrowIntegerSeedBuild(m_narrowIntegerSeeds, *record);
             SyncToBackendFromSource(ProgramArchiveSource::FromRecord(cso, *record));
             // The two server-owned keys the draw path's clean condition reads instead of
             // GetLinkVersion()/GetImageUnitVersion(). BindingsSerial is the second because a
@@ -2769,6 +2772,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 binding.lastAssignedMsSampleMax = 0;
                 m_samplerUniformBindings.push_back(binding);
             }
+            FinishNarrowIntegerSeedBuild(m_narrowIntegerSeeds, m_backendProgramId, m_backendProgramUsable);
         }
 
         void BackendProgramObjectImpl::Use() {

MobileGL/MG_Backend/DirectGLES/ManagersVertexArrays.cpp

@@ -422,7 +422,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // SyncZeroStrideAttribute on the wire views: the one spelling that can carry a resolved
         // stride of zero, which glVertexAttribPointer's zero means the opposite of.
         inline Bool SyncZeroStrideAttributeByHandle(Uint attribIndex, const MGPVertexAttribWire& attrib,
-                                                    const MG_Pipe::MGPVertexBuffer& binding) {
+                                                    const MG_Pipe::MGPVertexBuffer& binding, GLenum issuedType) {
             if (MG_Pipe::MGPipeHandleIsNull(binding.Res)) {
                 MGLOG_W_ONCE("Zero-stride attribute %u has no bound buffer, skipping.", attribIndex);
                 return false;
@@ -438,9 +438,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                                  MG_Util::ConvertDataTypeToGLEnum(static_cast<DataType>(attrib.Type)),
                                                  attrib.Normalized ? GL_TRUE : GL_FALSE, 0);
             } else {
-                g_GLESFuncs.glVertexAttribIFormat(attribIndex, static_cast<GLint>(attrib.Size),
-                                                  MG_Util::ConvertDataTypeToGLEnum(static_cast<DataType>(attrib.Type)),
-                                                  0);
+                g_GLESFuncs.glVertexAttribIFormat(attribIndex, static_cast<GLint>(attrib.Size), issuedType, 0);
             }
             g_GLESFuncs.glVertexAttribBinding(attribIndex, attribIndex);
             // The resolved offset goes on the binding point, not into a relative offset (the
@@ -506,7 +504,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         //                                                        as the record of what was last
         //                                                        EMITTED, which is what the next
         //                                                        sync has to correct
-        void BackendVertexArrayObject::SyncToBackendFromApplier() {
+        void BackendVertexArrayObject::SyncToBackendFromApplier(const IntegerAttributePlan& plan) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
@@ -545,7 +543,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // same whichever side resolved it first - it is idempotent.
             const Uint32 fetchBaseInstance = BackendUsesNativeBaseInstance() ? 0u : st.VertexFetchBaseInstance;
             const Bool baseInstanceDirty = m_syncedFetchBaseInstance != fetchBaseInstance;
-            const Bool emitAttributes = attributesDirty || baseInstanceDirty || m_hasConvertedAttribute;
+            // The integer arrays to issue with the other signedness; only a pointer whose type flips
+            // is re-issued, through the shadow below.
+            const Uint32 retypeHeld = HeldIntegerRetype(m_syncedRetypeMask, plan);
+            const Bool emitAttributes =
+                attributesDirty || baseInstanceDirty || m_hasConvertedAttribute || retypeHeld != m_syncedRetypeMask;
             if (!emitAttributes && !indexBufferDirty) {
                 return;
             }
@@ -649,7 +651,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     // The binding API rewrote this attribute's format and binding: whatever the
                     // shadow said about its pointer no longer holds.
                     m_hostPointer[attribIndex].valid = false;
-                    if (!SyncZeroStrideAttributeByHandle(attribIndex, attrib, *binding)) {
+                    const GLenum issuedType =
+                        IntegerAttribTypeForInput(MG_Util::ConvertDataTypeToGLEnum(static_cast<DataType>(attrib.Type)),
+                                                  attrib.IsInteger && ((retypeHeld >> attribIndex) & 1u));
+                    if (!SyncZeroStrideAttributeByHandle(attribIndex, attrib, *binding, issuedType)) {
                         continue;
                     }
                     // No shift here on purpose: a zero stride never advances. Binding index ==
@@ -674,7 +679,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
                 const SizeT fetchOffset = static_cast<SizeT>(attrib.Offset) +
                                           BaseInstanceByteShiftWire(attrib.Stride, divisor, fetchBaseInstance);
-                const GLenum glType = MG_Util::ConvertDataTypeToGLEnum(static_cast<DataType>(attrib.Type));
+                const GLenum glType =
+                    IntegerAttribTypeForInput(MG_Util::ConvertDataTypeToGLEnum(static_cast<DataType>(attrib.Type)),
+                                              attrib.IsInteger && ((retypeHeld >> attribIndex) & 1u));
                 const GLint glSize = static_cast<GLint>(attrib.Size);
 
                 // The pointer the driver VAO already holds for this attribute - the buffer it
@@ -759,6 +766,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
             if (emitAttributes) {
                 m_syncedFetchBaseInstance = fetchBaseInstance;
+                m_syncedRetypeMask = retypeHeld;
                 m_lastWalkWasPlain = walkWasPlain;
             }
             m_syncedBufferIdGeneration = currentBufferIdGeneration;
@@ -923,7 +931,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         reinterpret_cast<const void*>(BaseInstanceByteShift(attrib, fetchBaseInstance)));
                 } else {
                     g_GLESFuncs.glVertexAttribIPointer(
-                        attribIndex, attrib.Size, MG_Util::ConvertDataTypeToGLEnum(attrib.Type),
+                        attribIndex, attrib.Size,
+                        IntegerAttribTypeForInput(MG_Util::ConvertDataTypeToGLEnum(attrib.Type),
+                                                  ((m_syncedRetypeMask >> attribIndex) & 1u) != 0),
                         static_cast<GLsizei>(stride),
                         // See the pointer call above: the divisor'd
                         // arrays' baseInstance shift is the pointer.

MobileGL/MG_Backend/DirectGLES/NarrowIntegerSeeds.cpp

@@ -0,0 +1,189 @@
+// MobileGL - MobileGL/MG_Backend/DirectGLES/NarrowIntegerSeeds.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "NarrowIntegerSeeds.h"
+
+#include "DirectGLESInternal.h"
+
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+
+namespace MobileGL::MG_Backend::DirectGLES {
+    namespace {
+        using MG_Util::ShaderTranspiler::kNarrowIntegerWidths16GlobalName;
+        using MG_Util::ShaderTranspiler::kNarrowIntegerWidths8GlobalName;
+
+        // The twin a handle already has, without creating one: a program that was never built has
+        // no seeds to refuse.
+        PrgramImpl::BackendProgramObjectImpl* ExistingProgramTwin(MG_Pipe::MGPipeHandle program) {
+            auto* slot = PrgramImpl::g_backendProgramObjects.FindByHandle(program);
+            return slot != nullptr ? slot->get() : nullptr;
+        }
+
+        // Whether the program's build for `record`'s link refused the seeds; a link not built yet
+        // is presumed to take them.
+        Bool SeedsRefused(MG_Pipe::MGPipeHandle program, const MG_Pipe::MGPipeShaderCsoRecord& record) {
+            auto* twin = ExistingProgramTwin(program);
+            return twin != nullptr && twin->NarrowIntegerSeeds().RefusedAt(record.Serial);
+        }
+
+        String UniformDeclaration(const char* name) {
+            return String("uniform highp uint ") + name + ";";
+        }
+    } // namespace
+
+    IntegerVertexInputMasks IntegerVertexInputsOf(const MG_Pipe::MGPipeShaderCsoRecord& record) {
+        auto& memo = record.BackendIntegerInputs;
+        if (!memo.Valid || memo.Serial != record.Serial) {
+            IntegerVertexInputMasks inputs;
+            if (record.Archive) {
+                // Indexed by location, an empty name being no active input: the same reading
+                // SyncCurrentVertexAttributeValues makes of these two vectors.
+                const auto& link = record.Archive->Link;
+                const SizeT count = std::min<SizeT>(std::min(link.attribs.size(), link.attribTypes.size()), 32);
+                for (SizeT location = 0; location < count; ++location) {
+                    if (!link.attribs[location].empty())
+                        inputs.Note(static_cast<Uint32>(location), link.attribTypes[location]);
+                }
+            }
+            memo.SignedInputs = inputs.signedInputs;
+            memo.UnsignedInputs = inputs.unsignedInputs;
+            memo.Serial = record.Serial;
+            memo.Valid = true;
+        }
+        IntegerVertexInputMasks inputs;
+        inputs.signedInputs = memo.SignedInputs;
+        inputs.unsignedInputs = memo.UnsignedInputs;
+        return inputs;
+    }
+
+    IntegerAttributePlan ResolveIntegerAttributePlanForDraw(MG_Pipe::MGPipeHandle program) {
+        if (MG_Pipe::MGPipeHandleIsNull(program)) return {};
+        const MG_Pipe::MGPipeShaderCsoRecord* const record = PipeShaderCsoRecordForHandle(program);
+        if (record == nullptr || !record->Archive) return {};
+        const IntegerVertexInputMasks inputs = IntegerVertexInputsOf(*record);
+        Uint32 remaining = inputs.signedInputs | inputs.unsignedInputs;
+        if (remaining == 0) return {};
+        const auto* elements = VertexArrayImpl::BoundVertexElementsRecord(MG_Pipe::MGPipeApplier());
+        if (elements == nullptr) return {};
+        IntegerAttributeDataMasks data;
+        for (; remaining != 0; remaining &= remaining - 1) {
+            const Uint32 location = static_cast<Uint32>(std::countr_zero(remaining));
+            const auto& attrib = elements->Attributes[location];
+            if (attrib.Enabled && attrib.IsInteger && !attrib.IsLong)
+                data.Note(location, static_cast<DataType>(attrib.Type));
+        }
+        // The twin is looked up only for a plan that needs seeds; most integer draws need none.
+        const IntegerAttributePlan plan = ResolveIntegerAttributePlan(inputs, data, true);
+        return plan.NeedsSeeds() && SeedsRefused(program, *record) ? plan.WithoutSeeds() : plan;
+    }
+
+    Bool DropRefusedNarrowIntegerSeeds(IntegerAttributePlan& plan, MG_Pipe::MGPipeHandle program) {
+        if (!plan.NeedsSeeds()) return false;
+        const MG_Pipe::MGPipeShaderCsoRecord* const record = PipeShaderCsoRecordForHandle(program);
+        if (record == nullptr || !SeedsRefused(program, *record)) return false;
+        plan = plan.WithoutSeeds();
+        return true;
+    }
+
+    void PrepareNarrowIntegerSeedBuild(NarrowIntegerSeedState& state, const MG_Pipe::MGPipeShaderCsoRecord& record) {
+        const IntegerVertexInputMasks inputs = IntegerVertexInputsOf(record);
+        state.PrepareBuild(record.Serial, (inputs.signedInputs | inputs.unsignedInputs) != 0,
+                           record.Archive && !record.Archive->Link.xfbVaryings.empty());
+    }
+
+    void PushNarrowIntegerWidthsForDraw(const IntegerAttributePlan& plan, MG_Pipe::MGPipeHandle program) {
+        // Only the twin this draw's sync stashed, and only while it is the program Use() bound: a
+        // uniform call with program 0, or on another program, is an error or a wrong write.
+        if (PrgramImpl::g_currentDrawProgramHandle != program) return;
+        auto* twin = PrgramImpl::g_currentDrawBackendProgram;
+        if (twin == nullptr || !twin->IsBackendProgramUsable() ||
+            PrgramImpl::g_lastUsedBackendProgramId != twin->GetBackendProgramId())
+            return;
+        NarrowIntegerSeedState& state = twin->NarrowIntegerSeeds();
+        if (!state.available) return;
+        if (state.pushed8 != plan.widths8) {
+            g_GLESFuncs.glUniform1ui(state.widths8Location, plan.widths8);
+            state.pushed8 = plan.widths8;
+        }
+        if (state.pushed16 != plan.widths16) {
+            g_GLESFuncs.glUniform1ui(state.widths16Location, plan.widths16);
+            state.pushed16 = plan.widths16;
+        }
+    }
+
+    void BeginNarrowIntegerSeedBuild(NarrowIntegerSeedState& state) {
+        state.built = state.Target();
+        state.declared = false;
+        state.available = false;
+        state.widths8Location = -1;
+        state.widths16Location = -1;
+        state.pushed8 = 0;
+        state.pushed16 = 0;
+    }
+
+    void NoteNarrowIntegerSeedSource(NarrowIntegerSeedState& state, const String& source, GLenum shaderType) {
+        if (!state.built || shaderType != GL_VERTEX_SHADER) return;
+        state.declared = source.find(UniformDeclaration(kNarrowIntegerWidths8GlobalName)) != String::npos &&
+                         source.find(UniformDeclaration(kNarrowIntegerWidths16GlobalName)) != String::npos;
+    }
+
+    void FinishNarrowIntegerSeedBuild(NarrowIntegerSeedState& state, GLuint program, Bool programUsable) {
+        if (!state.built) return;
+        if (!programUsable) {
+            // The seeds may be why the build failed; the next build of this link goes without them.
+            state.disabled = true;
+            MGLOG_E_ONCE("DirectGLES: a program built with narrow integer seeds did not link; it is rebuilt "
+                         "without them, and its 8/16-bit integer attributes keep the driver's own value");
+            return;
+        }
+        if (state.declared) {
+            state.widths8Location = g_GLESFuncs.glGetUniformLocation(program, kNarrowIntegerWidths8GlobalName);
+            state.widths16Location = g_GLESFuncs.glGetUniformLocation(program, kNarrowIntegerWidths16GlobalName);
+        }
+        state.available = state.widths8Location >= 0 && state.widths16Location >= 0;
+        if (!state.available) {
+            MGLOG_E_ONCE("DirectGLES: a program built with narrow integer seeds has no width uniforms (%s); its "
+                         "8/16-bit integer attributes keep the driver's own value",
+                         state.declared ? "the link dropped them" : "the vertex stage does not declare them");
+        }
+    }
+
+    const Vector<unsigned int>* SeedNarrowIntegerVertexInputsForEssl(Bool armed, const Vector<unsigned int>& spirv,
+                                                                     Vector<unsigned int>& storage,
+                                                                     Bool enableSpirvValidation) {
+        if (!armed) return &spirv;
+        Bool changed = false;
+        if (!MG_Util::ShaderTranspiler::ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(spirv, storage, changed,
+                                                                                               enableSpirvValidation)) {
+            MGLOG_E_ONCE("DirectGLES: the narrow integer seed pass declined a vertex stage; it keeps the driver's "
+                         "own value for 8/16-bit integer attributes");
+            return &spirv;
+        }
+        return changed && !storage.empty() ? &storage : &spirv;
+    }
+
+    String PromoteNarrowIntegerWidthGlobals(String source) {
+        for (const char* name : {kNarrowIntegerWidths8GlobalName, kNarrowIntegerWidths16GlobalName}) {
+            // The zero-initialised Private global is printed with or without a precision qualifier;
+            // only a declaration starting its own line is the global itself.
+            for (const char* prefix : {"highp uint ", "mediump uint ", "lowp uint ", "uint "}) {
+                Bool promoted = false;
+                for (const char* initializer : {" = 0u;", ";"}) {
+                    const String declaration = String(prefix) + name + initializer;
+                    const SizeT pos = source.find(declaration);
+                    if (pos == String::npos || (pos != 0 && source[pos - 1] != '\n')) continue;
+                    source.replace(pos, declaration.size(), UniformDeclaration(name));
+                    promoted = true;
+                    break;
+                }
+                if (promoted) break;
+            }
+        }
+        return source;
+    }
+} // namespace MobileGL::MG_Backend::DirectGLES

MobileGL/MG_Backend/DirectGLES/NarrowIntegerSeeds.h

@@ -0,0 +1,97 @@
+// MobileGL - MobileGL/MG_Backend/DirectGLES/NarrowIntegerSeeds.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+
+#include "IntegerAttributePlan.h"
+
+#include <Includes.h>
+#include <MG_Pipe/MGPipeHandles.h>
+#include <MG_Pipe/PipeApply.h>
+
+// The program half of IntegerAttributePlan: the two width uniforms a program carries once some
+// draw has fed it 8/16-bit data of the other signedness, and the per-draw plan that drives them.
+//
+// A program is built with the seeds only when it needs them ("armed"), so a program that never
+// meets such data keeps its ESSL byte for byte. Arming is sticky for the program object's
+// lifetime, so data alternating in signedness rebuilds it at most once and from then on moves two
+// uniforms. A program that captures transform feedback and has integer inputs is armed at its
+// first build, so arming never relinks a program in the middle of a capture.
+//
+// Every failure falls back to the values the driver gives today: a build whose ESSL lacks either
+// uniform, or whose link dropped one, is "refused" and its draws keep the application's type for
+// 8/16-bit data; a build that fails outright disables arming until the application relinks the
+// object, and it is rebuilt without the seeds. A relink is presumed to arm until its build says no.
+namespace MobileGL::MG_Backend::DirectGLES {
+    struct NarrowIntegerSeedState {
+        Bool wanted = false;
+        Bool disabled = false;
+        // The record Serial (the application's link) the last build was for.
+        Uint64 buildSerial = 0;
+        // What the last build ran with and what it verified.
+        Bool built = false;
+        Bool declared = false;
+        Bool available = false;
+        Int widths8Location = -1;
+        Int widths16Location = -1;
+        // The values the linked program holds; a link resets them to 0.
+        Uint32 pushed8 = 0;
+        Uint32 pushed16 = 0;
+
+        Bool Target() const { return wanted && !disabled; }
+        // The program's next build has to change its arming.
+        Bool Stale() const { return Target() != built; }
+        // An armed build of the link at `serial` that could not give the program working seeds.
+        Bool RefusedAt(Uint64 serial) const { return serial == buildSerial && (disabled || (built && !available)); }
+
+        // Before a build of the link at `serial`: a failure of an earlier link says nothing about
+        // this one, a link without integer inputs has nothing to arm, and a capturing one is armed.
+        void PrepareBuild(Uint64 serial, Bool hasIntegerInputs, Bool captures) {
+            if (serial != buildSerial) {
+                disabled = false;
+                buildSerial = serial;
+            }
+            if (!hasIntegerInputs)
+                wanted = false;
+            else if (captures)
+                wanted = true;
+        }
+    };
+
+    // The program's 32-bit int and uint vertex inputs, memoized on the record.
+    IntegerVertexInputMasks IntegerVertexInputsOf(const MG_Pipe::MGPipeShaderCsoRecord& record);
+
+    // The draw's plan, from the program's record and the bound vertex-elements record. All zero for
+    // a program without integer inputs, which costs two loads.
+    IntegerAttributePlan ResolveIntegerAttributePlanForDraw(MG_Pipe::MGPipeHandle program);
+    // After the program sync: true when this draw's build refused the seeds the plan counted on,
+    // in which case the plan has dropped them and the vertex array must be synced again.
+    Bool DropRefusedNarrowIntegerSeeds(IntegerAttributePlan& plan, MG_Pipe::MGPipeHandle program);
+    // After Use(): the two widths on the program the draw runs, when they differ from what it holds.
+    void PushNarrowIntegerWidthsForDraw(const IntegerAttributePlan& plan, MG_Pipe::MGPipeHandle program);
+
+    // PrepareBuild from the record the build is for.
+    void PrepareNarrowIntegerSeedBuild(NarrowIntegerSeedState& state, const MG_Pipe::MGPipeShaderCsoRecord& record);
+    // The build's three steps: reset at its start, note each stage's final ESSL, verify after the link.
+    void BeginNarrowIntegerSeedBuild(NarrowIntegerSeedState& state);
+    void NoteNarrowIntegerSeedSource(NarrowIntegerSeedState& state, const String& source, GLenum shaderType);
+    void FinishNarrowIntegerSeedBuild(NarrowIntegerSeedState& state, GLuint program, Bool programUsable);
+
+    // The armed vertex stage's SPIR-V step (after the array-input split): `spirv` itself unless
+    // the pass rewrote it into `storage`.
+    const Vector<unsigned int>* SeedNarrowIntegerVertexInputsForEssl(Bool armed, const Vector<unsigned int>& spirv,
+                                                                     Vector<unsigned int>& storage,
+                                                                     Bool enableSpirvValidation);
+
+    // The two width globals of a seeded vertex stage, as `uniform highp uint`.
+    String PromoteNarrowIntegerWidthGlobals(String source);
+
+    namespace VertexArrayImpl {
+        const MG_Pipe::MGPipeVertexElementsRecord* BoundVertexElementsRecord(const MG_Pipe::MGPipeApplierState& st);
+    } // namespace VertexArrayImpl
+} // namespace MobileGL::MG_Backend::DirectGLES

MobileGL/MG_Backend/DirectVulkan/Renderer/MagmaProgramSource.h

@@ -53,24 +53,26 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // The view has no lifetime of its own, so the memo lives in the server record it views
         // (MGPipeShaderCsoRecord::BackendHashMemo), never in the client's program object: an entry
         // answers only while the record's Serial and BindingsSerial are the ones it was taken at.
-        Bool GetBackendHashMemo(Uint flags, Uint64& hash) const {
-            for (const auto& entry : m_record->BackendHashMemo) {
-                if (entry.Valid && entry.Key == flags && entry.Serial == m_record->Serial &&
-                    entry.BindingsSerial == m_record->BindingsSerial) {
-                    hash = entry.Hash;
-                    return true;
-                }
+        using BackendHashMemoEntry = MG_Pipe::MGPipeShaderCsoRecord::BackendHashMemoEntry;
+        BackendHashMemoEntry* FindBackendHashMemo(Uint key) const {
+            for (auto& entry : m_record->BackendHashMemo) {
+                if (entry.Valid && entry.Key == key && entry.Serial == m_record->Serial &&
+                    entry.BindingsSerial == m_record->BindingsSerial)
+                    return &entry;
             }
-            return false;
+            return nullptr;
         }
-        void SetBackendHashMemo(Uint flags, Uint64 hash) const {
+        // Takes the next slot round robin; its LastVariantHash starts as the plain `hash`.
+        BackendHashMemoEntry& SetBackendHashMemo(Uint key, Uint64 hash) const {
             auto& memo = m_record->BackendHashMemo;
             auto& entry = memo[m_record->BackendHashMemoNext++ % memo.size()];
             entry.Serial = m_record->Serial;
             entry.BindingsSerial = m_record->BindingsSerial;
             entry.Hash = hash;
-            entry.Key = flags;
+            entry.LastVariantHash = hash;
+            entry.Key = key;
             entry.Valid = true;
+            return entry;
         }
         Uint64 GetBackendStateVersion() const { return m_record->Serial; }
         Uint64 GetBlockBindingVersion() const { return m_record->BindingsSerial; }

MobileGL/MG_Backend/DirectVulkan/Renderer/NarrowIntegerVertexFormats.h

@@ -0,0 +1,87 @@
+// MobileGL - MobileGL/MG_Backend/DirectVulkan/Renderer/NarrowIntegerVertexFormats.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+
+#include "../VkIncludes.h"
+#include <MG_Util/ShaderTranspiler/NarrowIntegerVertexInputs.h>
+
+#include <Includes.h>
+
+namespace MobileGL::MG_Backend::DirectVulkan {
+    using MG_Util::ShaderTranspiler::IntegerVertexInputMasks;
+    using MG_Util::ShaderTranspiler::NarrowIntegerVertexInputs;
+    using MG_Util::ShaderTranspiler::ResolveNarrowIntegerVertexInputs;
+
+    // Which vertex inputs need the ExtendNarrowIntegerVertexInputs program variant, decided from
+    // two halves that are each computed once and cached with the object they describe.
+    //
+    // The pipeline gives an integer attribute the fetch format of the shader input's signedness
+    // (VUID-VkGraphicsPipelineCreateInfo-Input-08733). For 32-bit data that swap only renames the
+    // bits; for 8/16-bit data it changes the extension rule, so 240 in GL_UNSIGNED_BYTE data
+    // reaches an `int` input as -16. These are exactly the (data, input) pairs that need it.
+    enum class NarrowIntegerVertexFormat : Uint8 {
+        None = 0,
+        Unsigned8,
+        Unsigned16,
+        Signed8,
+        Signed16,
+    };
+
+    constexpr NarrowIntegerVertexFormat ClassifyNarrowIntegerVertexFormat(VkFormat format) {
+        switch (format) {
+        case VK_FORMAT_R8_UINT:
+        case VK_FORMAT_R8G8_UINT:
+        case VK_FORMAT_R8G8B8_UINT:
+        case VK_FORMAT_R8G8B8A8_UINT:
+            return NarrowIntegerVertexFormat::Unsigned8;
+        case VK_FORMAT_R16_UINT:
+        case VK_FORMAT_R16G16_UINT:
+        case VK_FORMAT_R16G16B16_UINT:
+        case VK_FORMAT_R16G16B16A16_UINT:
+            return NarrowIntegerVertexFormat::Unsigned16;
+        case VK_FORMAT_R8_SINT:
+        case VK_FORMAT_R8G8_SINT:
+        case VK_FORMAT_R8G8B8_SINT:
+        case VK_FORMAT_R8G8B8A8_SINT:
+            return NarrowIntegerVertexFormat::Signed8;
+        case VK_FORMAT_R16_SINT:
+        case VK_FORMAT_R16G16_SINT:
+        case VK_FORMAT_R16G16B16_SINT:
+        case VK_FORMAT_R16G16B16A16_SINT:
+            return NarrowIntegerVertexFormat::Signed16;
+        default:
+            return NarrowIntegerVertexFormat::None;
+        }
+    }
+
+    // The vertex-input half, filled from the source formats when a vertex input layout is built,
+    // so a draw reads four words instead of walking its attributes.
+    struct NarrowIntegerAttributeMasks : MG_Util::ShaderTranspiler::NarrowIntegerAttributeMasks {
+        constexpr void Note(Uint32 location, VkFormat format) {
+            if (location >= 32) return;
+            const Uint32 bit = 1u << location;
+            switch (ClassifyNarrowIntegerVertexFormat(format)) {
+            case NarrowIntegerVertexFormat::Unsigned8:
+                unsigned8 |= bit;
+                break;
+            case NarrowIntegerVertexFormat::Unsigned16:
+                unsigned16 |= bit;
+                break;
+            case NarrowIntegerVertexFormat::Signed8:
+                signed8 |= bit;
+                break;
+            case NarrowIntegerVertexFormat::Signed16:
+                signed16 |= bit;
+                break;
+            case NarrowIntegerVertexFormat::None:
+                break;
+            }
+        }
+    };
+} // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.cpp

@@ -20,6 +20,7 @@
 #include <cstring>
 #include <format>
 #include <map>
+#include <unordered_set>
 #include <utility>
 #include <spirv-tools/libspirv.h>
 #include <spirv-tools/optimizer.hpp>
@@ -914,6 +915,36 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return true;
         }
 
+        // Where a per-vertex fix-up of `entryPoint`'s outputs goes: in front of every emit a
+        // geometry shader can execute - EmitVertex and EmitStreamVertex alike, in the entry
+        // function or in any function it calls, since the front end does not inline helpers - and,
+        // for the other stages, in front of each return from the entry function itself, as a
+        // helper's return does not end the invocation. Collected before anything is inserted.
+        Vector<spvtools::opt::Instruction*> CollectPerVertexFixupSites(spvtools::opt::IRContext* context,
+                                                                       const spvtools::opt::Instruction& entryPoint) {
+            Vector<spvtools::opt::Instruction*> sites;
+            const Uint32 entryFunctionId = entryPoint.GetSingleWordInOperand(1);
+            if (context->GetFunction(entryFunctionId) == nullptr) return sites;
+            const auto collect = [&sites](spvtools::opt::Function& function, auto isSite) {
+                function.ForEachInst([&](spvtools::opt::Instruction* inst) {
+                    if (isSite(inst->opcode())) sites.push_back(inst);
+                });
+            };
+            if (static_cast<spv::ExecutionModel>(entryPoint.GetSingleWordInOperand(0)) !=
+                spv::ExecutionModel::Geometry) {
+                collect(*context->GetFunction(entryFunctionId), [](spv::Op op) { return op == spv::Op::OpReturn; });
+                return sites;
+            }
+            std::unordered_set<Uint32> callTree;
+            context->CollectCallTreeFromRoots(entryFunctionId, &callTree);
+            for (auto& function : *context->module()) {
+                if (callTree.count(function.result_id()) == 0) continue;
+                collect(function,
+                        [](spv::Op op) { return op == spv::Op::OpEmitVertex || op == spv::Op::OpEmitStreamVertex; });
+            }
+            return sites;
+        }
+
         // Is `pointerId` the position target itself, or an access chain rooted at it?
         Bool PointerReachesPositionTarget(spvtools::opt::IRContext* context, Uint32 pointerId,
                                           const PositionTargetInfo& target) {
@@ -1095,22 +1126,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         continue;
                     }
 
-                    auto* function = context()->GetFunction(entryPoint.GetSingleWordInOperand(1));
-                    if (!function) continue;
-
                     Bool modifiedThisEntryPoint = false;
-                    for (auto& bb : *function) {
-                        for (auto instIter = bb.begin(); instIter != bb.end(); ++instIter) {
-                            auto* inst = &*instIter;
-                            const Bool needsFixup =
-                                (model == spv::ExecutionModel::Geometry && inst->opcode() == spv::Op::OpEmitVertex) ||
-                                (model != spv::ExecutionModel::Geometry && inst->opcode() == spv::Op::OpReturn);
-                            if (!needsFixup) continue;
-
-                            modifiedThisEntryPoint |=
-                                InsertPositionFixup(context(), inst, target, halfConstId, doYFlip, doZRemap,
-                                                    doSurfaceRotate90, doSurfaceRotate180, doSurfaceRotate270);
-                        }
+                    for (auto* site : CollectPerVertexFixupSites(context(), entryPoint)) {
+                        modifiedThisEntryPoint |=
+                            InsertPositionFixup(context(), site, target, halfConstId, doYFlip, doZRemap,
+                                                doSurfaceRotate90, doSurfaceRotate180, doSurfaceRotate270);
                     }
                     // Per entry point, and only for one this pass actually injected into: the
                     // injected load/store is a static use of the position variable, so the
@@ -1364,8 +1384,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Decorates the module's captured varyings for VK_EXT_transform_feedback:
         // user outputs get XfbBuffer/XfbStride/Offset directly; a captured
         // gl_Position (a gl_PerVertex member) is mirrored into a dedicated output
-        // variable copied before every OpReturn, BEFORE the position fixup runs,
-        // so the captured value is the shader's own (pre-remap) gl_Position.
+        // variable copied at every CollectPerVertexFixupSites site, BEFORE the position
+        // fixup runs, so the captured value is the shader's own (pre-remap) gl_Position.
         class XfbCaptureDecoratePass final : public spvtools::opt::Pass {
         public:
             struct CapturedVarying {
@@ -1393,7 +1413,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 auto entryPointIter = get_module()->entry_points().begin();
                 if (entryPointIter == get_module()->entry_points().end()) return Status::SuccessWithoutChange;
                 spvtools::opt::Instruction* entryPoint = &*entryPointIter;
-                const Uint32 entryFunctionId = entryPoint->GetSingleWordInOperand(1);
 
                 // Name -> result id map from the debug section.
                 std::unordered_map<std::string, Uint32> idsByName;
@@ -1542,14 +1561,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 }
 
                 if (needsPositionMirror) {
-                    modified |= MirrorPerVertexBuiltInForCapture(entryFunctionId, *entryPoint, spv::BuiltIn::Position,
-                                                                 IsVec4Float32, "gl_Position", positionBufferIndex,
-                                                                 positionOffset, decorateForXfb);
+                    modified |= MirrorPerVertexBuiltInForCapture(*entryPoint, spv::BuiltIn::Position, IsVec4Float32,
+                                                                 "gl_Position", positionBufferIndex, positionOffset,
+                                                                 decorateForXfb);
                 }
                 if (needsPointSizeMirror) {
-                    modified |= MirrorPerVertexBuiltInForCapture(entryFunctionId, *entryPoint, spv::BuiltIn::PointSize,
-                                                                 IsFloat32Scalar, "gl_PointSize", pointSizeBufferIndex,
-                                                                 pointSizeOffset, decorateForXfb);
+                    modified |= MirrorPerVertexBuiltInForCapture(*entryPoint, spv::BuiltIn::PointSize, IsFloat32Scalar,
+                                                                 "gl_PointSize", pointSizeBufferIndex, pointSizeOffset,
+                                                                 decorateForXfb);
                 }
 
                 if (!modified) return Status::SuccessWithoutChange;
@@ -1592,11 +1611,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // built-in is looked up and what type it has, so one injector serves both. Anything
             // else in gl_PerVertex would need its own type check before it could be added here.
             template <typename DecorateFn>
-            Bool MirrorPerVertexBuiltInForCapture(Uint32 entryFunctionId, spvtools::opt::Instruction& entryPoint,
-                                                  spv::BuiltIn builtIn, BuiltInTypeCheckFn typeCheck,
-                                                  const char* glslName, Uint32 bufferIndex, Uint32 offsetBytes,
+            Bool MirrorPerVertexBuiltInForCapture(spvtools::opt::Instruction& entryPoint, spv::BuiltIn builtIn,
+                                                  BuiltInTypeCheckFn typeCheck, const char* glslName,
+                                                  Uint32 bufferIndex, Uint32 offsetBytes,
                                                   const DecorateFn& decorateForXfb) {
-                const Uint32 entryPointModel = entryPoint.GetSingleWordInOperand(0);
                 using namespace spvtools::opt;
                 PositionTargetInfo target{};
                 if (!FindBuiltInTarget(context(), builtIn, typeCheck, &target)) {
@@ -1640,27 +1658,17 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 decorateForXfb(mirrorVariableId, bufferIndex, offsetBytes);
                 entryPoint.AddOperand({SPV_OPERAND_TYPE_ID, {mirrorVariableId}});
 
-                auto* function = context()->GetFunction(entryFunctionId);
-                if (function == nullptr) return false;
-                const auto model = static_cast<spv::ExecutionModel>(entryPointModel);
+                // Geometry stages capture per emitted vertex; other stages at return.
                 Bool injected = false;
-                for (auto& block : *function) {
-                    for (auto instIter = block.begin(); instIter != block.end(); ++instIter) {
-                        // Geometry stages capture per emitted vertex; other stages at return.
-                        const Bool isInjectionSite = model == spv::ExecutionModel::Geometry
-                                                         ? instIter->opcode() == spv::Op::OpEmitVertex
-                                                         : instIter->opcode() == spv::Op::OpReturn;
-                        if (!isInjectionSite) continue;
-                        InstructionBuilder builder(context(), &*instIter, IRContext::kAnalysisNone);
-                        const Uint32 memberIndexId = builder.GetUintConstantId(target.memberIndex);
-                        auto* access =
-                            builder.AddAccessChain(target.vectorPtrTypeId, target.variableId, {memberIndexId});
-                        if (access == nullptr) return injected;
-                        auto* value = builder.AddLoad(target.vectorTypeId, access->result_id());
-                        if (value == nullptr) return injected;
-                        builder.AddStore(mirrorVariableId, value->result_id());
-                        injected = true;
-                    }
+                for (auto* site : CollectPerVertexFixupSites(context(), entryPoint)) {
+                    InstructionBuilder builder(context(), site, IRContext::kAnalysisNone);
+                    const Uint32 memberIndexId = builder.GetUintConstantId(target.memberIndex);
+                    auto* access = builder.AddAccessChain(target.vectorPtrTypeId, target.variableId, {memberIndexId});
+                    if (access == nullptr) return injected;
+                    auto* value = builder.AddLoad(target.vectorTypeId, access->result_id());
+                    if (value == nullptr) return injected;
+                    builder.AddStore(mirrorVariableId, value->result_id());
+                    injected = true;
                 }
                 // The mirror was listed on the entry point above, but the loop just added a READ
                 // of the SOURCE block through an access chain, and the interface rule covers
@@ -1951,36 +1959,37 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
             return success;
         }
+    } // namespace
 
-        Bool TransformSpirvForVulkanPositionFix(const Vector<Uint>& input, Vector<Uint>& output,
-                                                ProgramFactory::CompileOptionFlags transformFlags) {
-            if (input.empty()) {
-                output.clear();
-                return true;
-            }
-
-            if (!transformFlags) {
-                output = input;
-                return true;
-            }
-
-            spvtools::Optimizer optimizer(SPV_ENV_VULKAN_1_3);
-            spvtools::OptimizerOptions options;
-            options.set_run_validator(false); // see TransformSpirvForExplicitLod0Sampling
-            optimizer.SetMessageConsumer(
-                [](spv_message_level_t, const char*, const spv_position_t&, const char* message) {
-                    MGLOG_E("Vulkan: position fix pass: %s", message != nullptr ? message : "");
-                });
-            optimizer.RegisterPass(CreateGlToVulkanPositionFixPass(transformFlags));
-
-            const Bool success = optimizer.Run(input.data(), input.size(), &output, options);
-            if (!success) {
-                MGLOG_E("Vulkan: failed to run GL->Vulkan position fix pass");
-                output = input;
-            }
-            return success;
+    Bool TransformSpirvForVulkanPositionFix(const Vector<Uint>& input, Vector<Uint>& output,
+                                            ProgramFactory::CompileOptionFlags transformFlags) {
+        if (input.empty()) {
+            output.clear();
+            return true;
         }
 
+        if (!transformFlags) {
+            output = input;
+            return true;
+        }
+
+        spvtools::Optimizer optimizer(SPV_ENV_VULKAN_1_3);
+        spvtools::OptimizerOptions options;
+        options.set_run_validator(false); // see TransformSpirvForExplicitLod0Sampling
+        optimizer.SetMessageConsumer([](spv_message_level_t, const char*, const spv_position_t&, const char* message) {
+            MGLOG_E("Vulkan: position fix pass: %s", message != nullptr ? message : "");
+        });
+        optimizer.RegisterPass(CreateGlToVulkanPositionFixPass(transformFlags));
+
+        const Bool success = optimizer.Run(input.data(), input.size(), &output, options);
+        if (!success) {
+            MGLOG_E("Vulkan: failed to run GL->Vulkan position fix pass");
+            output = input;
+        }
+        return success;
+    }
+
+    namespace {
         ShaderStage PickClipFixupStage(const Vector<ShaderStage>& stages) {
             Bool hasGeometry = false;
             Bool hasTessEval = false;
@@ -2727,6 +2736,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                              VkProgramObject& entry) const {
         entry.activeVertexInputLocationMask = 0;
         entry.vertexInputTypes.fill(0);
+        entry.integerVertexInputs = {};
         entry.readsBaseVertexBuiltin = false;
 
         for (SizeT moduleIndex = 0; moduleIndex < stages.size() && moduleIndex < spirv.size(); ++moduleIndex) {
@@ -2793,6 +2803,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
                         entry.activeVertexInputLocationMask |= (1u << expandedLocation);
                         entry.vertexInputTypes[expandedLocation] = locationType;
+                        entry.integerVertexInputs.Note(expandedLocation, locationType);
                     }
                 }
             }
@@ -3544,8 +3555,79 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         ++m_cacheStructureEpoch;
     }
 
-    const ProgramFactory::VkProgramObject& ProgramFactory::GetOrCreateProgram(const MagmaProgramSource& program,
-                                                                              CompileOptionFlags flags) {
+    namespace {
+        // The vertex stage's own transforms, in the order they have to run: the ZeroBaseVertex
+        // variant, the unconditional 64-bit input packing, then the narrow-integer variant.
+        void TransformVertexStageForVulkan(Vector<Uint>& module, ProgramFactory::CompileOptionFlags flags,
+                                           const NarrowIntegerVertexInputs& narrowIntegerInputs,
+                                           Bool enableSpirvValidation, Uint programIndex) {
+            // The non-indexed variant of a vertex stage that reads gl_BaseVertex: GL wants zero
+            // there, Vulkan's builtin would hand it the draw's firstVertex. Requested per draw
+            // through CompileOptionBit::ZeroBaseVertex, so the indexed variant of the same
+            // program keeps the native builtin and stays correct for glDrawElementsBaseVertex
+            // and for the baseVertex word of an indexed indirect command.
+            if (flags & ProgramFactory::CompileOptionBit::ZeroBaseVertex) {
+                Vector<Uint> zeroedSpirv;
+                if (MG_Util::ShaderTranspiler::ShaderCompiler::ZeroBaseVertexForVulkan(module, zeroedSpirv,
+                                                                                       enableSpirvValidation)) {
+                    module = std::move(zeroedSpirv);
+                } else {
+                    // Failing open keeps the native builtin, which is the pre-fix behavior:
+                    // gl_BaseVertex reads firstVertex on a DrawArrays instead of zero.
+                    MGLOG_E("ProgramFactory: failed to zero gl_BaseVertex for program %u; non-indexed "
+                            "draws will read the draw's first vertex from it instead of zero",
+                            programIndex);
+                }
+            }
+
+            // A 64-bit vertex input has to arrive as its 32-bit word pair: VK_FORMAT_R64*_SFLOAT is
+            // optional and lavapipe advertises none of them at all. The pass is unconditional so it
+            // always agrees with the Float64 case in VertexInputStateFactory::ToVkVertexFormat, and
+            // ReflectVertexInputs then sees an ordinary uvec2/uvec4 input.
+            //
+            // Failure here is not recoverable and must not be swallowed: ToVkVertexFormat has already
+            // committed to R32G32{,B32A32}_UINT for the attribute, so a module still declaring
+            // `in double` would reconcile to Unknown and build a pipeline with a UINT format under a
+            // double input - garbage with no diagnostic anywhere.
+            {
+                Vector<Uint> packedSpirv;
+                const Bool packOk = MG_Util::ShaderTranspiler::ShaderCompiler::PackDoubleVertexInputsForVulkan(
+                    module, packedSpirv, enableSpirvValidation);
+                MOBILEGL_ASSERT(packOk,
+                                "ProgramFactory: 64-bit vertex input packing failed for program %u; the "
+                                "vertex-input format and the shader input type now disagree",
+                                programIndex);
+                if (packOk) {
+                    module = std::move(packedSpirv);
+                } else {
+                    MGLOG_E("ProgramFactory: failed to pack 64-bit vertex inputs for program %u; "
+                            "double-typed vertex attributes will be fetched as uint32 words and not "
+                            "reinterpreted",
+                            programIndex);
+                }
+            }
+
+            // The narrow-integer variant: the pipeline fetches these attributes with the format of
+            // the input's signedness, and this restores the extension rule of the data's own (see
+            // ResolveNarrowIntegerVertexInputs). After the 64-bit packing so it sees the inputs in
+            // the shape the pipeline's vertex input state and ReflectVertexInputs describe.
+            if (narrowIntegerInputs.Any()) {
+                Vector<Uint> extendedSpirv;
+                if (MG_Util::ShaderTranspiler::ShaderCompiler::ExtendNarrowIntegerVertexInputsForVulkan(
+                        module, extendedSpirv, narrowIntegerInputs, enableSpirvValidation)) {
+                    module = std::move(extendedSpirv);
+                } else {
+                    MGLOG_E("ProgramFactory: failed to extend narrow integer vertex inputs for program %u; "
+                            "8/16-bit integer attributes read through an input of the other signedness keep "
+                            "the fetch format's extension",
+                            programIndex);
+                }
+            }
+        }
+    } // namespace
+
+    MagmaProgramSource::BackendHashMemoEntry& ProgramFactory::ProgramHashMemo(const MagmaProgramSource& program,
+                                                                              CompileOptionFlags flags) const {
         // Hashing the full SPIR-V of every stage is far too expensive to repeat per draw;
         // reuse the program's memoized hash while its backend state version is unchanged.
         // The memo keys on the flags word, which ComputeHash is no longer a pure function of:
@@ -3561,16 +3643,46 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Uint memoKey = (flags & CompileOptionBit::FragCoordYFlip)
                                  ? (flags.GetRaw() | (m_defaultFramebufferHeight << 16))
                                  : flags.GetRaw();
-        HashType hash = 0;
-        if (!program.GetBackendHashMemo(memoKey, hash)) {
-            hash = ComputeHash(program, flags);
-            program.SetBackendHashMemo(memoKey, hash);
+        if (auto* memo = program.FindBackendHashMemo(memoKey)) return *memo;
+        return program.SetBackendHashMemo(memoKey, ComputeHash(program, flags));
+    }
+
+    const ProgramFactory::VkProgramObject& ProgramFactory::GetOrCreateProgram(
+        const MagmaProgramSource& program, CompileOptionFlags flags,
+        const NarrowIntegerVertexInputs& narrowIntegerInputs) {
+        auto& memo = ProgramHashMemo(program, flags);
+        // Mixed in after the memo, which keys on the flags word alone: the memo keeps answering
+        // for the plain program, and the variant costs one 16-byte hash on top of it.
+        HashType hash = memo.Hash;
+        if (narrowIntegerInputs.Any()) hash = MixNarrowIntegerVertexInputs(hash, narrowIntegerInputs);
+        memo.LastVariantHash = hash;
+        return FindOrBuildProgram(program, flags, narrowIntegerInputs, hash);
+    }
+
+    const ProgramFactory::VkProgramObject& ProgramFactory::GetOrCreateDrawProgram(const MagmaProgramSource& program,
+                                                                                  CompileOptionFlags flags) {
+        auto& memo = ProgramHashMemo(program, flags);
+        if (memo.LastVariantHash != memo.Hash) {
+            const auto it = m_cache.find(memo.LastVariantHash);
+            if (it != m_cache.end()) {
+                it->second.lastUsedFrame = m_frameCounter;
+                return it->second;
+            }
+            // The variant aged out, and its hash alone cannot rebuild it: start from the plain
+            // program, and the draw settles on its variant again.
+            memo.LastVariantHash = memo.Hash;
         }
+        return FindOrBuildProgram(program, flags, {}, memo.Hash);
+    }
+
+    const ProgramFactory::VkProgramObject& ProgramFactory::FindOrBuildProgram(
+        const MagmaProgramSource& program, CompileOptionFlags flags,
+        const NarrowIntegerVertexInputs& narrowIntegerInputs, HashType hash) {
         auto it = m_cache.find(hash);
         if (it != m_cache.end()) {
-            // Every draw/dispatch funnels through this lookup (the renderer memos only
-            // skip re-hashing, never the factory lookup), so an actively-used entry is
-            // stamped at least once per frame boundary and can never be aged out while
+            // Every draw/dispatch funnels through this lookup or GetOrCreateDrawProgram's (the
+            // renderer memos only skip re-hashing, never the factory lookup), so an actively-used
+            // entry is stamped at least once per frame boundary and can never be aged out while
             // any in-flight command buffer still references it.
             it->second.lastUsedFrame = m_frameCounter;
             return it->second;
@@ -3581,6 +3693,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         ++m_cacheStructureEpoch;
         auto& entry = m_cache[hash];
         entry.hash = hash;
+        entry.narrowIntegerInputs = narrowIntegerInputs;
         entry.lastUsedFrame = m_frameCounter;
         // The EXECUTABLE's stage list, not GetAttachedShaders(): `spirv` is a link artifact with
         // one module per linked stage, while the attach list is live and grows on
@@ -3818,50 +3931,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 }
             }
 
-            // The non-indexed variant of a vertex stage that reads gl_BaseVertex: GL wants zero
-            // there, Vulkan's builtin would hand it the draw's firstVertex. Requested per draw
-            // through CompileOptionBit::ZeroBaseVertex, so the indexed variant of the same
-            // program keeps the native builtin and stays correct for glDrawElementsBaseVertex
-            // and for the baseVertex word of an indexed indirect command.
-            if (stages[i] == ShaderStage::Vertex && (flags & CompileOptionBit::ZeroBaseVertex)) {
-                Vector<Uint> zeroedSpirv;
-                if (MG_Util::ShaderTranspiler::ShaderCompiler::ZeroBaseVertexForVulkan(moduleSpirvs[i], zeroedSpirv,
-                                                                                       enableSpirvValidation)) {
-                    moduleSpirvs[i] = std::move(zeroedSpirv);
-                } else {
-                    // Failing open keeps the native builtin, which is the pre-fix behavior:
-                    // gl_BaseVertex reads firstVertex on a DrawArrays instead of zero.
-                    MGLOG_E("ProgramFactory: failed to zero gl_BaseVertex for program %u; non-indexed "
-                            "draws will read the draw's first vertex from it instead of zero",
-                            program.GetExternalIndex());
-                }
-            }
-
-            // A 64-bit vertex input has to arrive as its 32-bit word pair: VK_FORMAT_R64*_SFLOAT is
-            // optional and lavapipe advertises none of them at all. The pass is unconditional so it
-            // always agrees with the Float64 case in VertexInputStateFactory::ToVkVertexFormat, and
-            // ReflectVertexInputs below then sees an ordinary uvec2/uvec4 input.
-            //
-            // Failure here is not recoverable and must not be swallowed: ToVkVertexFormat has already
-            // committed to R32G32{,B32A32}_UINT for the attribute, so a module still declaring
-            // `in double` would reconcile to Unknown and build a pipeline with a UINT format under a
-            // double input - garbage with no diagnostic anywhere.
             if (stages[i] == ShaderStage::Vertex) {
-                Vector<Uint> packedSpirv;
-                const Bool packOk = MG_Util::ShaderTranspiler::ShaderCompiler::PackDoubleVertexInputsForVulkan(
-                    moduleSpirvs[i], packedSpirv, enableSpirvValidation);
-                MOBILEGL_ASSERT(packOk,
-                                "ProgramFactory: 64-bit vertex input packing failed for program %u; the "
-                                "vertex-input format and the shader input type now disagree",
-                                program.GetExternalIndex());
-                if (packOk) {
-                    moduleSpirvs[i] = std::move(packedSpirv);
-                } else {
-                    MGLOG_E("ProgramFactory: failed to pack 64-bit vertex inputs for program %u; "
-                            "double-typed vertex attributes will be fetched as uint32 words and not "
-                            "reinterpreted",
-                            program.GetExternalIndex());
-                }
+                TransformVertexStageForVulkan(moduleSpirvs[i], flags, narrowIntegerInputs, enableSpirvValidation,
+                                              program.GetExternalIndex());
             }
 
             // When Vulkan can legally access storage images without a statically declared

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -12,6 +12,7 @@
 #include "../MagmaSession.h"
 #include "PipelineFactory.h"
 #include "MagmaProgramSource.h"
+#include "NarrowIntegerVertexFormats.h"
 #include "MG_State/GLState/ProgramState/ShaderObject.h"
 #include "MG_State/GLState/TextureState/TextureEnum.h"
 
@@ -200,6 +201,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Int globalUboBinding = -1;
             Uint32 activeVertexInputLocationMask = 0;
             Array<GLenum, kMaxVertexInputLocations> vertexInputTypes{};
+            // The locations of vertexInputTypes that are int / uint, for the per-draw narrow-integer
+            // variant decision (ResolveNarrowIntegerVertexInputs). Identical in every variant.
+            IntegerVertexInputMasks integerVertexInputs;
+            // The narrow-integer correction this entry's vertex stage was built with (none for the
+            // plain program): what a draw compares its own resolved set against.
+            NarrowIntegerVertexInputs narrowIntegerInputs;
             Uint32 activeFragmentOutputLocationMask = 0;
             Array<GLenum, kMaxVertexInputLocations> fragmentOutputTypes{};
             ShaderStage rasterizationProducerStage = ShaderStage::Unknown;
@@ -328,6 +335,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 globalUboBinding = other.globalUboBinding;
                 activeVertexInputLocationMask = other.activeVertexInputLocationMask;
                 vertexInputTypes = other.vertexInputTypes;
+                integerVertexInputs = other.integerVertexInputs;
+                narrowIntegerInputs = other.narrowIntegerInputs;
                 activeFragmentOutputLocationMask = other.activeFragmentOutputLocationMask;
                 fragmentOutputTypes = other.fragmentOutputTypes;
                 rasterizationProducerStage = other.rasterizationProducerStage;
@@ -351,6 +360,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.pointSizeCapabilityUnsupported = false;
                 other.globalUboBinding = -1;
                 other.activeVertexInputLocationMask = 0;
+                other.integerVertexInputs = {};
+                other.narrowIntegerInputs = {};
                 other.activeFragmentOutputLocationMask = 0;
                 other.rasterizationProducerStage = ShaderStage::Unknown;
                 other.producerOutputComponentCount = 0;
@@ -402,6 +413,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 globalUboBinding = other.globalUboBinding;
                 activeVertexInputLocationMask = other.activeVertexInputLocationMask;
                 vertexInputTypes = other.vertexInputTypes;
+                integerVertexInputs = other.integerVertexInputs;
+                narrowIntegerInputs = other.narrowIntegerInputs;
                 activeFragmentOutputLocationMask = other.activeFragmentOutputLocationMask;
                 fragmentOutputTypes = other.fragmentOutputTypes;
                 rasterizationProducerStage = other.rasterizationProducerStage;
@@ -425,6 +438,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.pointSizeCapabilityUnsupported = false;
                 other.globalUboBinding = -1;
                 other.activeVertexInputLocationMask = 0;
+                other.integerVertexInputs = {};
+                other.narrowIntegerInputs = {};
                 other.activeFragmentOutputLocationMask = 0;
                 other.rasterizationProducerStage = ShaderStage::Unknown;
                 other.producerOutputComponentCount = 0;
@@ -518,7 +533,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         ProgramFactory(const ProgramFactory&) = delete;
 
         HashType ComputeHash(const MagmaProgramSource& program, CompileOptionFlags flags) const;
-        const VkProgramObject& GetOrCreateProgram(const MagmaProgramSource& program, CompileOptionFlags flags);
+        // `narrowIntegerInputs` selects the variant whose vertex stage widens narrow integer
+        // attribute data GL's way (ExtendNarrowIntegerVertexInputsPass). It is draw-time state like
+        // the flags, and the draw path asks for it only when ResolveNarrowIntegerVertexInputs finds
+        // a location that needs it, so every other program keeps a single entry. The variant
+        // returned is remembered per flags for GetOrCreateDrawProgram.
+        const VkProgramObject& GetOrCreateProgram(const MagmaProgramSource& program, CompileOptionFlags flags,
+                                                  const NarrowIntegerVertexInputs& narrowIntegerInputs = {});
+        // A draw's first lookup: the variant GetOrCreateProgram last returned for these flags, plain
+        // or narrow-integer. Every variant reflects the same vertex inputs and builtins, which is all
+        // a draw reads before it knows the variant it needs, so a program whose draws keep needing
+        // one variant costs a single lookup and its plain entry, never drawn with, ages out.
+        const VkProgramObject& GetOrCreateDrawProgram(const MagmaProgramSource& program, CompileOptionFlags flags);
+        // The cache identity of a narrow-integer variant: the hash of the same program and flags
+        // without it, mixed with the corrected locations. Content in, content out, so the variant's
+        // pipelines key apart from the plain program's through programHash alone.
+        static HashType MixNarrowIntegerVertexInputs(HashType hash, const NarrowIntegerVertexInputs& inputs) {
+            return XXH64(&inputs, sizeof(inputs), hash);
+        }
 
         // The default framebuffer's current image height, baked as a literal into every
         // FragCoordYFlip variant (there is no push-constant or specialization channel here, and
@@ -654,6 +686,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             HashType hash = 0;
         };
 
+        // The program's memo slot for `flags`, its plain hash computed on a miss.
+        MagmaProgramSource::BackendHashMemoEntry& ProgramHashMemo(const MagmaProgramSource& program,
+                                                                  CompileOptionFlags flags) const;
+        // The cache entry under `hash`, built as that variant of `program` when absent.
+        const VkProgramObject& FindOrBuildProgram(const MagmaProgramSource& program, CompileOptionFlags flags,
+                                                  const NarrowIntegerVertexInputs& narrowIntegerInputs, HashType hash);
+
         static TextureTarget UniformTypeToTextureTarget(GLenum glType);
         // `stages` is ALWAYS ProgramObject::GetLinkedShaderStages() - one entry per module of
         // `spirv`, at the same index. Taking the stages rather than the shader objects is what
@@ -726,4 +765,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     // Private copy whose y is (framebufferHeight - y). Fails open (output = input, false). Exposed
     // so a unit case can validate the bytes it hands the driver.
     Bool TransformSpirvForFragCoordYFlip(const Vector<Uint>& input, Vector<Uint>& output, Uint32 framebufferHeight);
+
+    // The clip-space fix-up of the last pre-rasterization stage: gl_Position is rewritten in place
+    // per `transformFlags` before every vertex the stage produces. Fails open (output = input,
+    // false). Exposed, like the transform above, so a unit case can validate its bytes.
+    Bool TransformSpirvForVulkanPositionFix(const Vector<Uint>& input, Vector<Uint>& output,
+                                            ProgramFactory::CompileOptionFlags transformFlags);
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.cpp

@@ -214,6 +214,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             out.bindings.push_back(
                 {binding, stride, buffer.Divisor ? VK_VERTEX_INPUT_RATE_INSTANCE : VK_VERTEX_INPUT_RATE_VERTEX});
             out.attributes.push_back({location, binding, format, 0});
+            out.narrowIntegerAttributes.Note(location, format);
             out.bindingAttributeLocations.push_back(location);
             out.bindingBaseOffsets.push_back(static_cast<SizeT>(offset));
             out.bindingConversions.push_back(conversion);

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.h

@@ -14,6 +14,7 @@
 
 #include "Config.h"
 #include "MagmaPipeArms.h"
+#include "NarrowIntegerVertexFormats.h"
 #include "VertexInputStateBuilder.h"
 #include "MG_State/GLState/VertexArrayState/VertexArrayObject.h"
 #include <Includes.h>
@@ -63,6 +64,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // Bitmask of `attributes[i].location` - the draw path needs it up to
             // three times per draw, so it is baked once at build time.
             Uint32 attributeLocationMask = 0;
+            // The locations of `attributes` whose source data is 8/16-bit integer, by width and
+            // signedness - the vertex-input half of the narrow-integer program variant decision
+            // (NarrowIntegerVertexFormats.h). A pure function of `attributes`, so `layoutHash`
+            // already covers it.
+            NarrowIntegerAttributeMasks narrowIntegerAttributes;
             // Per-binding glVertexAttribDivisor values other than 1. Vulkan's instance input
             // rate advances once per instance and nothing else, so anything else has to be
             // stated through VK_EXT_vertex_attribute_divisor. Empty when every instanced

MobileGL/MG_Backend/DirectVulkan/Renderer/VkBufferManager.cpp

@@ -27,19 +27,6 @@
 
 namespace MobileGL::MG_Backend::DirectVulkan {
     namespace {
-        // P7 wave 2 package B3, INVESTIGATION PROBE (split-only, read once, not in
-        // ConfigLoader's accepted-env table - package B's MGITEST_MAGMA_FORCE_SHADER_MIPMAP
-        // shape). MOBILEGL_MAGMA_WIREBUF_PROBE=1 prints one line per streamed-buffer event so
-        // the `glBufferSubData -> draw` ordering of a trace can be read off a log instead of
-        // inferred. Costs a branch on a cached bool when unset.
-        Bool WireBufProbeEnabled() {
-            static const Bool enabled = [] {
-                const char* value = std::getenv("MOBILEGL_MAGMA_WIREBUF_PROBE");
-                return value && value[0] == '1';
-            }();
-            return enabled;
-        }
-
         // P7 wave 2 package B3, FORCING KNOB (split-only, read once, not in ConfigLoader's
         // accepted-env table - package B's MGITEST_MAGMA_FORCE_SHADER_MIPMAP shape).
         //
@@ -424,8 +411,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         resource->contentSerial = ++m_wireContentSerial;
         if (!resource->shadow.empty()) Memcpy(resource->shadow.data() + offset, bytes, static_cast<SizeT>(size));
         Bool uploaded = false;
-        const Uint64 probeLastUse = resource->lastUseSerial;
-        const Uint64 probeCompleted = GetCompletedSerial();
 
         // ---- P7 wave 2 package B3: WHAT EACH TERM OF THIS PREDICATE IS FOR -----------------
         //
@@ -451,10 +436,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // submission - BindProgramUniformBuffers -> SyncWireTextureShape's preserve path ->
         // FlushWirePendingCommandsForTextureUpdate submits the stamped index without the draw -
         // so the stamp can name S1 while the draw rides S2. What it does do: with the floor
-        // sound it should never be the term that says "busy" (the WBUF probe reports bySubmit
-        // separately, so a device that shows one has found a floor hole), and it is the only
-        // thing the MGITEST_MAGMA_FORCE_STALE_BUFFER_SERIAL knob leaves standing, which is what
-        // the StaleSerial. entries pin.
+        // sound it should never be the term that says "busy" (a write it alone orders points to a
+        // floor hole), and it is the only thing the MGITEST_MAGMA_FORCE_STALE_BUFFER_SERIAL knob
+        // leaves standing, which is what the StaleSerial. entries pin.
         Bool busyBySerial = resource->lastUseSerial > GetCompletedSerial();
         if (busyBySerial && ForceStaleSerialSelector() != 0) {
             const Uint64 index = ++g_orderedWireWriteCounter;
@@ -494,16 +478,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             MGLOG_F("Magma: Fatal{ResourceUnavailable, \"buffer-upload\"}");
             std::abort();
         }
-        if (WireBufProbeEnabled()) {
-            MGLOG_I("WBUF write slot=%u gen=%u off=%llu size=%llu branch=%s bySerial=%d bySubmit=%d "
-                    "lastUse=%llu completed=%llu frameSerial=%llu floor=%llu lastUseSubmit=%llu",
-                    res.Slot, res.Gen, static_cast<unsigned long long>(offset), static_cast<unsigned long long>(size),
-                    (busyBySerial || busyBySubmission) ? "STAGED-or-WAIT" : "HOST-IMMEDIATE", busyBySerial ? 1 : 0,
-                    busyBySubmission ? 1 : 0, static_cast<unsigned long long>(probeLastUse),
-                    static_cast<unsigned long long>(probeCompleted), static_cast<unsigned long long>(m_frameSerial),
-                    static_cast<unsigned long long>(m_completedSerialFloor),
-                    static_cast<unsigned long long>(resource->lastUseSubmitIndex));
-        }
         MG_Record::StagedShadowStore::CoverageAdd(resource->stagedCoverage, static_cast<SizeT>(offset),
                                                   static_cast<SizeT>(offset + size));
     }
@@ -624,10 +598,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             resource->lastUseSubmitIndex = pVulkanRenderer->GetWireNextSubmitIndex();
         outSlice = resource->buffer.GetSlice(0, resource->size);
         outSlice.mapped = nullptr;
-        if (WireBufProbeEnabled()) {
-            MGLOG_I("WBUF bind  slot=%u gen=%u frameSerial=%llu", res.Slot, res.Gen,
-                    static_cast<unsigned long long>(m_frameSerial));
-        }
         return true;
     }
 
@@ -1422,11 +1392,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         "VkBufferManager::BeginFrame frame index out of range");
         m_currentFrameIndex = frameIndex;
         ++m_frameSerial;
-        if (WireBufProbeEnabled()) {
-            MGLOG_I("WBUF BEGINFRAME idx=%u newSerial=%llu floor=%llu (arena slot rewound)", frameIndex,
-                    static_cast<unsigned long long>(m_frameSerial),
-                    static_cast<unsigned long long>(m_completedSerialFloor));
-        }
         CollectDeferredReleases(frameIndex);
         m_transientUploadArena.BeginFrame(frameIndex);
     }

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRendererPipeline.cpp

@@ -918,6 +918,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Uint32 vertexInputAttribMask = vis.attributeLocationMask;
         const Uint32 activeAttribMask = programObj.activeVertexInputLocationMask;
         const Uint32 missingAttribMask = activeAttribMask & ~vertexInputAttribMask;
+        // The fetch format takes the shader input's signedness (VUID-VkGraphicsPipelineCreateInfo-
+        // Input-08733). That renames the bits of 32-bit data, but extends 8/16-bit data by the
+        // input's rule instead of the data's; the program variant SetupWireDraw picks for exactly
+        // those attributes (ResolveNarrowIntegerVertexInputs) puts GL's value back in the shader.
         auto& patchedAttributes = m_patchedAttributesScratch;
         patchedAttributes.assign(vis.attributes.begin(), vis.attributes.end());
         Bool hasPatchedVertexAttributes = false;

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRendererSubmit.cpp

@@ -242,10 +242,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             for (const auto& remaining : m_inFlightSubmits) {
                 if (remaining.frameSerial <= advanceTo) {
                     WireDeclineTally::CountUnsoundSerialComplete();
-                    // Logged per event, not once: this is the red-once's reading and the log is
-                    // the only place it can be read from: the renderer this trace builds is
-                    // never Shutdown() (the process exits), so a teardown dump reports the
-                    // start-up context's zero instead of the replay's count.
+                    // Logged per event, not once: this line is the red-once's reading and the only
+                    // place the count is printed. A line at teardown would not do: the renderer
+                    // this trace builds is never Shutdown() (the process exits).
                     MGLOG_W("MGWIRE-FLOOR unsound-serial-complete #%llu: advancing the completed "
                             "frame-serial floor to %llu, which submission %llu (serial %llu) still carries",
                             static_cast<unsigned long long>(WireDeclineTally::UnsoundSerialCompleteEvents()),
@@ -255,23 +254,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     break;
                 }
             }
-            {
-                static const Bool probe = [] {
-                    const char* value = std::getenv("MOBILEGL_MAGMA_WIREBUF_PROBE");
-                    return value && value[0] == '1';
-                }();
-                if (probe) {
-                    Uint64 minRemaining = ~Uint64{0};
-                    for (const auto& r : m_inFlightSubmits)
-                        minRemaining = std::min(minRemaining, r.frameSerial);
-                    MGLOG_I("FLOOR retire upTo=%llu advanceTo=%llu remaining=%zu minRemainingSerial=%lld "
-                            "frameSerial=%llu",
-                            static_cast<unsigned long long>(submitIndex), static_cast<unsigned long long>(advanceTo),
-                            m_inFlightSubmits.size(),
-                            m_inFlightSubmits.empty() ? -1LL : static_cast<long long>(minRemaining),
-                            static_cast<unsigned long long>(m_bufferManager.GetFrameSerial()));
-                }
-            }
             m_bufferManager.NotifyFrameSerialComplete(advanceTo);
         }
         // Mid-frame-flushed command buffers whose submission just completed can
@@ -338,23 +320,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // loops still rewind the arena and age their caches every 8 iterations -
         // bounded by 8 iterations' transient usage.
         ++m_drainsSinceLastPresent;
-        // B3 probe: a drain that reaches here found the GPU caught up and nothing recording.
-        // Every 8th one is treated as a FRAME BOUNDARY - mid-frame. This probe is what REFUTED
-        // that as the OpenRA mechanism (one successful drain, zero boundary works across the
-        // replay; magma-b3.md §2.4): the cause was the floor in OnSubmitsCompletedUpTo.
-        {
-            static const Bool probe = [] {
-                const char* value = std::getenv("MOBILEGL_MAGMA_WIREBUF_PROBE");
-                return value && value[0] == '1';
-            }();
-            if (probe) {
-                MGLOG_I("WBUF drain#%llu%s submit=%llu completed=%llu",
-                        static_cast<unsigned long long>(m_drainsSinceLastPresent),
-                        (m_drainsSinceLastPresent % 8) == 0 ? " ***FRAME-BOUNDARY-WORK***" : "",
-                        static_cast<unsigned long long>(m_submitCounter),
-                        static_cast<unsigned long long>(m_completedSubmitCounter));
-            }
-        }
         if ((m_drainsSinceLastPresent % 8) != 0) {
             return true;
         }

MobileGL/MG_Backend/DirectVulkan/Renderer/WireDeclineTally.h

@@ -19,8 +19,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     // P7 wave 2 package B3: the per-site tally behind CONTRACT-P7 §0 rule I.
     //
-    // Shape is PipeApplier.h's ServerVerbSink tallies, and for the same reason (R-16: a probe may
-    // not arm against a stub). "The retrace passed" and "the retrace silently dropped nine draws"
+    // Shape is RecordVerbSink.h's per-verb tallies, and for the same reason (R-16: a probe may not
+    // arm against a stub). "The retrace passed" and "the retrace silently dropped nine draws"
     // produce the same exit code and the same log, so the lane has to assert the number that only
     // this path can move.
     //
@@ -100,10 +100,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // from the forced-condition harness; silent when nothing declined, so a green lane stays
         // quiet and a lane that dropped a draw cannot.
         static void Dump(const char* tag) {
-            // The floor counter prints unconditionally: "zero unsound advances" is the reading the
-            // red-once needs, and an absent line cannot be told from a lane that never ran.
-            MGLOG_I("MGWIRE-FLOOR[%s] unsoundSerialComplete=%llu", tag,
-                    static_cast<unsigned long long>(UnsoundSerialCompleteEvents()));
             if (TotalDeclines() == 0 && PeakPendingUploadBytes() == 0) return;
             MGLOG_I("MGWIRE-DECLINES[%s] total=%llu pendingEntries=%llu pendingBytes=%llu peakPendingBytes=%llu", tag,
                     static_cast<unsigned long long>(TotalDeclines()),

MobileGL/MG_Backend/DirectVulkan/Renderer/WireDraw.cpp

@@ -734,11 +734,51 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (m_transformFeedbackFeatureEnabled && MG_Pipe::gPipeInputs->IsTransformFeedbackActive() &&
             program.GetTransformFeedbackVaryingCount() > 0)
             flags |= ProgramFactory::CompileOptionBit::XfbCapture;
-        const auto* programObject = &m_programFactory->GetOrCreateProgram(program, flags);
+        // The variant this program's last draw with these flags settled on: what the draw reads
+        // from it before the narrow-integer pick below is the same in every variant.
+        const auto* programObject = &m_programFactory->GetOrCreateDrawProgram(program, flags);
         if (!(aspects & DrawSetupAspect::IndexBuffer) && programObject->readsBaseVertexBuiltin) {
             flags |= ProgramFactory::CompileOptionBit::ZeroBaseVertex;
-            programObject = &m_programFactory->GetOrCreateProgram(program, flags);
+            programObject = &m_programFactory->GetOrCreateDrawProgram(program, flags);
         }
+        const auto vaoHandle = state.BoundVertexElements;
+        if (MG_Pipe::MGPipeHandleIsNull(vaoHandle)) MagmaWireFatal("vertex-elements-record");
+        if (vaoHandle.Slot >= state.VertexElementsCsos.size()) MagmaWireFatal("vertex-elements-record");
+        const auto& vao = state.VertexElementsCsos[vaoHandle.Slot];
+        if (!vao.Live || vao.Gen != vaoHandle.Gen) MagmaWireFatal("vertex-elements-generation");
+        // P7 wave 2 package C, CONTRACT-P7 §3.2: THE `vertex-layout` ROW IS RETIRED AND SPLIT.
+        //
+        // A false is now ONE reason and only one - `buffer-window`, an enabled attribute the
+        // program reads whose slot lies outside the window set_vertex_buffers published. That
+        // is a disagreement about what crossed, not about what this device can express, so it
+        // keeps a named Fatal through the hook (MGPipeSessionFail -> Session::Fail, which is
+        // what rule I asks of a refusal that must stay a refusal). It is the check that caught
+        // the Redmi VAO hash collision fixed in 376c04be, which is why it is not softened.
+        // The P7 marker is gone from the detail string with the abort: this is a permanent
+        // protocol error, not a shape the split path has yet to migrate, so it must not keep
+        // counting against the census of unmigrated refusals (scripts/ci/fatal_census.py
+        // counts the marker literally, which is also why no comment in this package spells it).
+        // P14: resolved through the record's own memo (ResolveWireVertexInput), except in a nested
+        // preparation, which builds into its own scratch rather than under the outer draw's feet.
+        const VertexInputStateFactory::BackendVertexInputState* resolvedInput = nullptr;
+        if (&scratch == &m_wireDrawScratch) {
+            resolvedInput = m_vertexInputStateFactory->ResolveWireVertexInput(
+                vao, state, programObject->activeVertexInputLocationMask);
+        } else if (m_vertexInputStateFactory->BuildWireVertexInput(
+                       vao, state, programObject->activeVertexInputLocationMask, scratch.input)) {
+            resolvedInput = &scratch.input;
+        }
+        if (resolvedInput == nullptr) MagmaWireFatal("vertex-layout-buffer-window");
+        const auto& input = *resolvedInput;
+        // The narrow-integer variant (NarrowIntegerVertexFormats.h), chosen from two masks cached on
+        // the program entry and on the resolved layout: a program without integer vertex inputs pays
+        // four ANDs and a compare here. Every variant reflects the same inputs, so the layout
+        // resolved above with the entry's active mask is the chosen variant's too. A second lookup
+        // only when this draw needs another variant than the last one with these flags.
+        const NarrowIntegerVertexInputs narrowIntegerInputs =
+            ResolveNarrowIntegerVertexInputs(programObject->integerVertexInputs, input.narrowIntegerAttributes);
+        if (narrowIntegerInputs != programObject->narrowIntegerInputs)
+            programObject = &m_programFactory->GetOrCreateProgram(program, flags, narrowIntegerInputs);
         if (programObject->invalidSpirvDeclined) {
             MGL_WIRE_DECLINE_AT(ProgramInvalidSpirv,
                                 "a module of the program fails SPIR-V validation and was never built");
@@ -776,35 +816,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 (void)ResolveWireImage(*fbo, fbo->Stencil, VK_IMAGE_ASPECT_STENCIL_BIT);
         }
         m_textureManager->FlushPendingUploads();
-        const auto vaoHandle = state.BoundVertexElements;
-        if (MG_Pipe::MGPipeHandleIsNull(vaoHandle)) MagmaWireFatal("vertex-elements-record");
-        if (vaoHandle.Slot >= state.VertexElementsCsos.size()) MagmaWireFatal("vertex-elements-record");
-        const auto& vao = state.VertexElementsCsos[vaoHandle.Slot];
-        if (!vao.Live || vao.Gen != vaoHandle.Gen) MagmaWireFatal("vertex-elements-generation");
-        // P7 wave 2 package C, CONTRACT-P7 §3.2: THE `vertex-layout` ROW IS RETIRED AND SPLIT.
-        //
-        // A false is now ONE reason and only one - `buffer-window`, an enabled attribute the
-        // program reads whose slot lies outside the window set_vertex_buffers published. That
-        // is a disagreement about what crossed, not about what this device can express, so it
-        // keeps a named Fatal through the hook (MGPipeSessionFail -> Session::Fail, which is
-        // what rule I asks of a refusal that must stay a refusal). It is the check that caught
-        // the Redmi VAO hash collision fixed in 376c04be, which is why it is not softened.
-        // The P7 marker is gone from the detail string with the abort: this is a permanent
-        // protocol error, not a shape the split path has yet to migrate, so it must not keep
-        // counting against the census of unmigrated refusals (scripts/ci/fatal_census.py
-        // counts the marker literally, which is also why no comment in this package spells it).
-        // P14: resolved through the record's own memo (ResolveWireVertexInput), except in a nested
-        // preparation, which builds into its own scratch rather than under the outer draw's feet.
-        const VertexInputStateFactory::BackendVertexInputState* resolvedInput = nullptr;
-        if (&scratch == &m_wireDrawScratch) {
-            resolvedInput =
-                m_vertexInputStateFactory->ResolveWireVertexInput(vao, state, programObj.activeVertexInputLocationMask);
-        } else if (m_vertexInputStateFactory->BuildWireVertexInput(vao, state, programObj.activeVertexInputLocationMask,
-                                                                   scratch.input)) {
-            resolvedInput = &scratch.input;
-        }
-        if (resolvedInput == nullptr) MagmaWireFatal("vertex-layout-buffer-window");
-        const auto& input = *resolvedInput;
         // The seven device/format reasons are now MASKED OUT of the vertex input state, and
         // this is the monolith arm's pre-flight for them, statement for statement
         // (VulkanRenderer.cpp's SetupDraw: "Fail loudly rather than render wrong pixels"). An

MobileGL/MG_Backend/MGPipe/PipeInputs.cpp

@@ -6,13 +6,14 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 // End of Source File Header
 
-// The backend-side half of the PipeInputs block: the poison Fatal with its verb name, the
-// name lookups the runtime knobs need, and - in a verify build - the per-field equality,
-// the entry comparator and the corruption injector. Compiled only under MOBILEGL_PIPE_PUSH
-// (CMakeLists.txt appends it to SOURCE_FILES there), so the pull build never sees it. Spells
-// no MG_State global: everything that reads the live context lives in MG_Impl/Pipe/PipeFill.cpp.
+// The backend-side half of the PipeInputs block: the poison Fatal with its verb name and -
+// in a verify build - the per-field equality, the entry comparator, the corruption injector,
+// the name lookups its knob and the poison omission need, and the omission's server half.
+// Spells no MG_State global: everything that reads the live context lives in
+// MG_Impl/Pipe/PipeFill.cpp.
 #include <MG_Backend/MGPipe/PipeInputs.h>
 
+#include <atomic>
 #include <cstdint>
 #include <cstring>
 
@@ -29,22 +30,6 @@ namespace MobileGL::MG_Pipe {
         MGPipeInputPoisonFatal(field, MGPipeVerbName(verb));
     }
 
-    Optional<MGPipeInputField> MGPipeFindInputField(const char* name) {
-        if (name == nullptr) return std::nullopt;
-        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
-            if (std::strcmp(kMGPipeInputFieldNames[i], name) == 0) return static_cast<MGPipeInputField>(i);
-        }
-        return std::nullopt;
-    }
-
-    Optional<MGPipeVerb> MGPipeFindVerb(const char* name) {
-        if (name == nullptr) return std::nullopt;
-        for (SizeT i = 0; i < kMGPipeVerbCount; ++i) {
-            if (std::strcmp(kMGPipeVerbNames[i], name) == 0) return static_cast<MGPipeVerb>(i);
-        }
-        return std::nullopt;
-    }
-
 // The stamp is the poison's (m_filled, the generations): a build without MOBILEGL_PIPE_POISON
 // compiles no read check that could ask any of this. Every transport build has the poison.
 #if MOBILEGL_PIPE_POISON
@@ -55,46 +40,24 @@ namespace MobileGL::MG_Pipe {
         Uint64 g_residualPulls = 0;
 
 #if MOBILEGL_PIPE_VERIFY
-        // ---- MOBILEGL_PIPE_POISON_OMIT, server half ----
+        // ---- negative control B, server half (MGPipeServerSetPoisonOmission) ----
         //
-        // The knob withholds the stamp of one (verb, field) pair, a negative control for the
+        // The omission withholds the stamp of one (verb, field) pair, a negative control for the
         // poison check. Under a transport the backend reads the server's stamp, which re-stamps
         // every field the verb's class can answer, so the server must withhold the pair too or
-        // the control cannot go red. Parsed here because this file is in the server library and
-        // MG_Impl is not; a malformed value is the client's Fatal{PipeVerifyBadKnob}, and this
-        // side simply does not arm. Verify builds only, so the shipped stamp stays branch-free.
-        struct ServerPoisonOmission {
-            Bool Parsed = false;
-            String Value;
-            Bool Armed = false;
-            MGPipeVerb Verb = MGPipeVerb::kVerbCount;
-            MGPipeInputField Field = MGPipeInputField::kFieldCount;
-        };
-        ServerPoisonOmission g_serverOmission;
+        // the control cannot go red. The harness arms it while the apply thread is already
+        // running, so the pair is ONE atomic word: the verb in the high half, the field in the
+        // low one, and no verb at all (0xffff) until something is armed. Verify builds only, so
+        // the shipped stamp stays branch-free.
+        constexpr Uint32 kNoServerOmission = ~Uint32{0};
+        std::atomic<Uint32> g_serverOmission{kNoServerOmission};
 
-        const ServerPoisonOmission& ServerOmission() {
-            const String& knob = MG_Config::Features.PipePoisonOmit;
-            if (g_serverOmission.Parsed && knob.size() == g_serverOmission.Value.size() &&
-                (knob.empty() || knob == g_serverOmission.Value)) {
-                return g_serverOmission;
-            }
-            g_serverOmission = ServerPoisonOmission{};
-            g_serverOmission.Parsed = true;
-            g_serverOmission.Value = knob;
-            const auto colon = knob.find(':');
-            if (colon == String::npos || colon == 0 || colon + 1 >= knob.size()) return g_serverOmission;
-            const auto verb = MGPipeFindVerb(knob.substr(0, colon).c_str());
-            const auto field = MGPipeFindInputField(knob.substr(colon + 1).c_str());
-            if (!verb || !field) return g_serverOmission;
-            g_serverOmission.Armed = true;
-            g_serverOmission.Verb = *verb;
-            g_serverOmission.Field = *field;
-            return g_serverOmission;
+        constexpr Uint32 PackServerOmission(MGPipeVerb verb, MGPipeInputField field) {
+            return (static_cast<Uint32>(verb) << 16) | static_cast<Uint32>(field);
         }
 
         Bool ServerOmitsStamp(MGPipeVerb verb, MGPipeInputField field) {
-            const ServerPoisonOmission& omission = ServerOmission();
-            return omission.Armed && omission.Verb == verb && omission.Field == field;
+            return g_serverOmission.load(std::memory_order_acquire) == PackServerOmission(verb, field);
         }
 #endif // MOBILEGL_PIPE_VERIFY
 
@@ -453,12 +416,10 @@ namespace MobileGL::MG_Pipe {
             filled.FilledGen[i] = serial & (Uint64{0} - bit);
         }
 #if MOBILEGL_PIPE_VERIFY
-        // Negative control B's server half (ServerPoisonOmission above): the one withheld pair.
+        // Negative control B's server half (g_serverOmission above): the one withheld pair.
         {
-            const ServerPoisonOmission& omission = ServerOmission();
-            if (omission.Armed && omission.Verb == verb) {
-                filled.FilledGen[static_cast<SizeT>(omission.Field)] = 0;
-            }
+            const Uint32 omission = g_serverOmission.load(std::memory_order_acquire);
+            if ((omission >> 16) == static_cast<Uint32>(verb)) filled.FilledGen[omission & 0xffffu] = 0;
         }
 #endif
         MGPipeStampAccess::SetServerStamped(inputs, true);
@@ -475,6 +436,12 @@ namespace MobileGL::MG_Pipe {
         MGPipeStampAccess::SetServerStamped(gPipeInputs, false);
     }
 
+#if MOBILEGL_PIPE_VERIFY
+    void MGPipeServerSetPoisonOmission(MGPipeVerb verb, MGPipeInputField field) {
+        g_serverOmission.store(PackServerOmission(verb, field), std::memory_order_release);
+    }
+#endif
+
     Uint64 MGPipeResidualPullCount() {
         return g_residualPulls;
     }
@@ -691,5 +658,21 @@ namespace MobileGL::MG_Pipe {
             return true;
         });
     }
+
+    Optional<MGPipeInputField> MGPipeFindInputField(const char* name) {
+        if (name == nullptr) return std::nullopt;
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            if (std::strcmp(kMGPipeInputFieldNames[i], name) == 0) return static_cast<MGPipeInputField>(i);
+        }
+        return std::nullopt;
+    }
+
+    Optional<MGPipeVerb> MGPipeFindVerb(const char* name) {
+        if (name == nullptr) return std::nullopt;
+        for (SizeT i = 0; i < kMGPipeVerbCount; ++i) {
+            if (std::strcmp(kMGPipeVerbNames[i], name) == 0) return static_cast<MGPipeVerb>(i);
+        }
+        return std::nullopt;
+    }
 #endif // MOBILEGL_PIPE_VERIFY
 } // namespace MobileGL::MG_Pipe

MobileGL/MG_Backend/MGPipe/PipeInputs.h

@@ -46,10 +46,6 @@ namespace MobileGL::MG_Pipe {
     [[noreturn]] void MGPipeInputPoisonFatalForVerb(MGPipeInputField field, MGPipeVerb verb);
     // kMGPipeVerbNames[verb], or "<none>" for kVerbCount (no verb has been filled yet).
     const char* MGPipeVerbName(MGPipeVerb verb);
-    // Name lookups for the runtime knobs (MOBILEGL_PIPE_VERIFY_CORRUPT names a field,
-    // MOBILEGL_PIPE_POISON_OMIT a Verb:Field pair). Empty on an unknown name.
-    Optional<MGPipeInputField> MGPipeFindInputField(const char* name);
-    Optional<MGPipeVerb> MGPipeFindVerb(const char* name);
 
     // The server-side read check (ARCHITECTURE.md §9.2.1). Inside a server-stamped verb
     // (PipeInputs::ServerStampedVerb) a stale read is judged by the field's ownership class:
@@ -965,9 +961,7 @@ namespace MobileGL::MG_Pipe {
     // PLAIN, NOT ATOMIC, AND THAT IS THE SAME RULING TABLE 3 MAKES FOR gPipeInputS ITSELF
     // (CONTRACT-P5.md section 4): the verb barrier leaves at most one of {GL thread, apply
     // thread} runnable, so there is one writer at any instant. This counter, m_serverStampedVerb
-    // and FilledGen[] all rest on that and on nothing else - so MOBILEGL_IPC_VERB_BARRIER=0,
-    // R-1's negative control, is a data race on all three as well as the correctness failure it
-    // is there to show. It is expected to be red; it is not expected to be meaningful.
+    // and FilledGen[] all rest on that and on nothing else.
     Uint64 MGPipeResidualPullCount();
     void MGPipeResetResidualPullCountForTesting();
 
@@ -998,6 +992,13 @@ namespace MobileGL::MG_Pipe {
     // dereferenced, the snapshot is only ever compared). Returns false for a forwarded field,
     // which has nothing to corrupt.
     Bool MGPipeApplyVerifyCorruption(PipeInputs& snapshot, MGPipeInputField field);
+    // PipeInputs.cpp. Name lookups for MOBILEGL_PIPE_VERIFY_CORRUPT (a field) and
+    // MGPipeSetPoisonOmission (a verb and a field). Empty on an unknown name.
+    Optional<MGPipeInputField> MGPipeFindInputField(const char* name);
+    Optional<MGPipeVerb> MGPipeFindVerb(const char* name);
+    // PipeInputs.cpp. Negative control B's server half, armed by MGPipeSetPoisonOmission: the
+    // server's verb stamp withholds the stamp of `field` at `verb` too.
+    void MGPipeServerSetPoisonOmission(MGPipeVerb verb, MGPipeInputField field);
     // PipeFill.cpp. Writes the MOBILEGL_PIPE_VERIFY_FATAL=0 summary line ("N divergence(s)
     // survived") NOW, while the role's log file is still open. MobileGL::Destroy calls it right
     // before MG_Util::Debug::Close(): the line used to come from a namespace-scope static's

MobileGL/MG_Impl/Pipe/FramebufferEmit.h

@@ -400,7 +400,9 @@ namespace MobileGL::MG_Pipe {
 
         void ResetCounters() { m_emissions = m_refusals = 0; }
 
-        void ResetForTest() {
+        // A session that replaced an ended one (MGPipeForgetEndedSession), and a unit fixture:
+        // the latches and the counters, and the build memo and last states beside them.
+        void ForgetSession() {
             Reset();
             ResetCounters();
             for (auto& memo : m_buildMemo)

MobileGL/MG_Impl/Pipe/PipeFill.cpp

@@ -8,10 +8,9 @@
 
 // The client side of the PipeInputs block (ARCHITECTURE.md 9.2 phase A): the only place in
 // the push arm that reads MG_State::pGLContext. Holds the per-verb filler, the F-class
-// forwarders, IsLive, the MOBILEGL_PIPE_POISON_OMIT knob and - in a verify build - the
-// second arm (SnapshotFromGLContext), the entry compare, the compare-at-read hook and the
-// MOBILEGL_PIPE_VERIFY_CORRUPT / _FATAL knobs. Compiled only under MOBILEGL_PIPE_PUSH
-// (CMakeLists.txt appends it to SOURCE_FILES there).
+// forwarders, IsLive and - in a verify build - the second arm (SnapshotFromGLContext), the
+// entry compare, the compare-at-read hook, the MOBILEGL_PIPE_VERIFY_CORRUPT knob, which only
+// this build reads, and the poison omission (MGPipeSetPoisonOmission).
 #include <MG_State/GLState/Core.h>
 #include <MG_State/GLState/BufferState/BufferState.h>
 // C-1: the vertex-elements CSO's death path raises the backend notice from here, between the
@@ -44,6 +43,8 @@
 #if MOBILEGL_PIPE_VERIFY
 #include <MG_Impl/Pipe/Verb/VerbPort.h>
 #include <MG_Impl/Pipe/Verb/GpuWriteSet.h>
+// MG_ConfigLoader::LookupSetting: ArmVerify reads MOBILEGL_PIPE_VERIFY_CORRUPT itself.
+#include <Init.h>
 #endif
 
 #if MOBILEGL_BUILD_DISAGGREGATED
@@ -456,62 +457,40 @@ namespace MobileGL::MG_Pipe {
             return null;
         }
 
+#if MOBILEGL_PIPE_VERIFY
         [[noreturn]] void BadKnob(const char* knob, const char* value, const char* why) {
             MGLOG_F("MGPipe: Fatal{PipeVerifyBadKnob, \"%s=%s\": %s}", knob, value, why);
             std::abort();
         }
 
-        // ---- MOBILEGL_PIPE_POISON_OMIT (negative control B, P1 brief D6) ----
+        // ---- negative control B (P1 brief D6), armed by MGPipeSetPoisonOmission ----
         // The filler skips the STAMP (never the value) of one (verb, field) pair: an omission
         // indistinguishable from a forgotten FillPoints.def row, so that verb's read of the
-        // field is Fatal{UnmigratedPipeInput, "Field@Verb"} and no other verb is affected.
+        // field is Fatal{UnmigratedPipeInput, "Field@Verb"} and no other verb is affected. The
+        // GL thread arms it and the GL thread's fill reads it; the server's stamp has its own.
         struct PoisonOmission {
             Bool Armed = false;
             MGPipeVerb Verb = MGPipeVerb::kVerbCount;
             MGPipeInputField Field = MGPipeInputField::kFieldCount;
         };
         PoisonOmission g_omission;
-        Bool g_omissionKnobParsed = false;
-        String g_omissionKnobValue; // the value the last parse saw
 
-        // Parsed on the first fill and again only when the value changes. A lane loads
-        // Features once, before any fill, so that is one parse per process there; a forked
-        // test child that sets Features after its parent already filled gets its own parse,
-        // which is what puts the parser and its Fatal{PipeVerifyBadKnob} under a unit test.
-        // An empty value never clears an omission a test armed through MGPipeSetPoisonOmission.
-        void ParsePoisonOmissionKnob() {
-            const String& knob = MG_Config::Features.PipePoisonOmit;
-            // THE UNSET KNOB IS TWO LENGTH LOADS AND A BRANCH, inline, and that is the whole
-            // change (P5d r3, package C): this runs at every verb - 852 draws a frame on the
-            // profiled workload - and `knob == g_omissionKnobValue` is an out-of-line String
-            // compare even when both sides are empty, which is every shipping configuration.
-            // Sizes first, contents only when a non-empty value is involved; the re-parse
-            // condition is unchanged (the value differing from what the last parse latched).
-            if (g_omissionKnobParsed && knob.size() == g_omissionKnobValue.size() &&
-                (knob.empty() || knob == g_omissionKnobValue)) {
-                return;
+        // The stamp the fill's walk is about to overwrite for the omitted pair, put back after the
+        // branch-free stamp of the whole walk: the value is copied either way, only the stamp is
+        // withheld. Index kMGPipeInputFieldCount is "nothing withheld at this verb".
+        struct WithheldStamp {
+            SizeT Index = kMGPipeInputFieldCount;
+            Uint64 Gen = 0;
+            void PutBack(MGPipeFilledState& filled) const {
+                if (Index < kMGPipeInputFieldCount) filled.FilledGen[Index] = Gen;
             }
-            g_omissionKnobParsed = true;
-            g_omissionKnobValue = knob;
-            if (knob.empty()) return;
-            const auto colon = knob.find(':');
-            if (colon == String::npos || colon == 0 || colon + 1 >= knob.size()) {
-                BadKnob("MOBILEGL_PIPE_POISON_OMIT", knob.c_str(), "expected <Verb>:<FieldName>");
-            }
-            const String verbName = knob.substr(0, colon);
-            const String fieldName = knob.substr(colon + 1);
-            const auto verb = MGPipeFindVerb(verbName.c_str());
-            if (!verb) BadKnob("MOBILEGL_PIPE_POISON_OMIT", knob.c_str(), "no such verb in kMGPipeVerbNames");
-            const auto field = MGPipeFindInputField(fieldName.c_str());
-            if (!field) BadKnob("MOBILEGL_PIPE_POISON_OMIT", knob.c_str(), "no such field in kMGPipeInputFieldNames");
-            MGPipeSetPoisonOmission(verbName.c_str(), fieldName.c_str());
+        };
+        WithheldStamp StampToWithhold(const MGPipeFilledState& filled, MGPipeVerb verb) {
+            if (!g_omission.Armed || g_omission.Verb != verb) return {};
+            const auto index = static_cast<SizeT>(g_omission.Field);
+            return {index, filled.FilledGen[index]};
         }
 
-        [[maybe_unused]] Bool IsOmitted(MGPipeVerb verb, MGPipeInputField field) {
-            return g_omission.Armed && g_omission.Verb == verb && g_omission.Field == field;
-        }
-
-#if MOBILEGL_PIPE_VERIFY
         // ---- the MOBILEGL_PIPE_VERIFY comparator (P1 brief D8) ----
         // Two mechanisms, both active only when Features.PipeVerify is set: the ENTRY compare
         // once per verb (the pushed block against a second snapshot of the live context,
@@ -543,7 +522,6 @@ namespace MobileGL::MG_Pipe {
             Bool Fatal = true;
             Bool InHook = false; // a re-read that re-enters an accessor is not re-verified
             Optional<MGPipeInputField> Corrupt;
-            String CorruptKnob; // the MOBILEGL_PIPE_VERIFY_CORRUPT value the last arm saw
             std::atomic<Uint64> Divergences{0};
             Uint64 Summarised = 0; // how many of them the summary line has reported so far
             // THE SUMMARY IS WRITTEN FROM MobileGL::Destroy, NOT FROM HERE (V1 fix round 2). This
@@ -568,24 +546,25 @@ namespace MobileGL::MG_Pipe {
         };
         VerifyState g_verify;
 
-        // Armed on the first fill and re-armed when any of the three verify knobs'
-        // Features value (PipeVerify, PipeVerifyFatal, PipeVerifyCorrupt) differs from what
-        // the last arm latched (the same reason as ParsePoisonOmissionKnob: one arm per lane
-        // process, a fresh arm for a forked test child that turns a knob after its parent
-        // filled). Cost: two Bool compares and one String compare per fill, verify builds only.
+        // Armed on the first fill and re-armed when PipeVerify or PipeVerifyFatal differs from
+        // what the last arm latched: one arm per lane process, a fresh arm for a forked test
+        // child that turns a knob after its parent filled. Each arm that enables the comparator
+        // reads MOBILEGL_PIPE_VERIFY_CORRUPT the way the loader resolves every knob (the
+        // environment, then the system configuration), so the knob exists in this build only.
+        // Cost: two Bool compares per fill, verify builds only.
         void ArmVerify() {
             const auto& features = MG_Config::Features;
             if (g_verify.Parsed && g_verify.Enabled == features.PipeVerify &&
-                g_verify.Fatal == features.PipeVerifyFatal && g_verify.CorruptKnob == features.PipeVerifyCorrupt) {
+                g_verify.Fatal == features.PipeVerifyFatal) {
                 return;
             }
             g_verify.Parsed = true;
             g_verify.Enabled = features.PipeVerify;
             g_verify.Fatal = features.PipeVerifyFatal;
-            g_verify.CorruptKnob = features.PipeVerifyCorrupt;
             g_verify.Corrupt = Optional<MGPipeInputField>{};
             if (!g_verify.Enabled) return;
-            const String& corrupt = g_verify.CorruptKnob;
+            String corrupt;
+            (void)MG_ConfigLoader::LookupSetting("MOBILEGL_PIPE_VERIFY_CORRUPT", corrupt);
             if (!corrupt.empty()) {
                 const auto field = MGPipeFindInputField(corrupt.c_str());
                 if (!field) {
@@ -1905,25 +1884,17 @@ namespace MobileGL::MG_Pipe {
         return published;
     }
 
-    void MGPipeSetPoisonOmission(const char* verb, const char* field) {
-        if (verb == nullptr || field == nullptr) {
-            g_omission = PoisonOmission{};
-            return;
-        }
+#if MOBILEGL_PIPE_VERIFY
+    Bool MGPipeSetPoisonOmission(const char* verb, const char* field) {
         const auto v = MGPipeFindVerb(verb);
         const auto f = MGPipeFindInputField(field);
-        if (!v || !f) BadKnob("MOBILEGL_PIPE_POISON_OMIT", verb, "unknown verb or field");
-        g_omission.Armed = true;
-        g_omission.Verb = *v;
-        g_omission.Field = *f;
-#if MOBILEGL_PIPE_POISON
+        if (!v || !f) return false;
+        g_omission = PoisonOmission{true, *v, *f};
+        MGPipeServerSetPoisonOmission(*v, *f);
         MGLOG_I("MGPipe: poison omission armed - %s@%s", field, verb);
-#else
-        MGLOG_W_ONCE("MGPipe: poison omission %s@%s requested but the poison is not compiled in "
-                     "(MOBILEGL_PIPE_POISON=0): no stamp exists to omit",
-                     field, verb);
-#endif
+        return true;
     }
+#endif
 
     // ---- liveness ----
     Bool PipeInputs::IsLive() const {
@@ -3038,7 +3009,6 @@ namespace MobileGL::MG_Pipe {
         // every verb) and the guard below then fires Fatal{RoleViolation, "gPipeInputs"} on
         // the first unbarriered verb, by name.
         const Bool runAhead = ClientRunsAhead();
-        ParsePoisonOmissionKnob();
 #if MOBILEGL_PIPE_VERIFY
         ArmVerify();
 #else
@@ -3389,18 +3359,19 @@ namespace MobileGL::MG_Pipe {
                 MGPipeFillAccess::CopyField(inputs, *ctx, static_cast<MGPipeInputField>(copies[k]));
             }
 #if MOBILEGL_PIPE_POISON
-            // The value is copied either way; only the stamp is withheld for the omitted pair,
-            // which is put back to what it held after the branch-free stamp of the whole walk.
             const Uint8* const walk = g_fillPlan.Walk[planClass].data();
             const SizeT walkCount = g_fillPlan.WalkCount[planClass];
             const Uint64 serial = filled.CurrentVerbSerial;
-            const Bool omit = g_omission.Armed && g_omission.Verb == verb;
-            const SizeT omitted = omit ? static_cast<SizeT>(g_omission.Field) : 0;
-            const Uint64 omittedGen = omit ? filled.FilledGen[omitted] : 0;
+#if MOBILEGL_PIPE_VERIFY
+            // Negative control B: the omitted pair's stamp goes back after the walk (WithheldStamp).
+            const WithheldStamp withheld = StampToWithhold(filled, verb);
+#endif
             for (SizeT k = 0; k < walkCount; ++k) {
                 filled.FilledGen[walk[k] & ~ResidualFillPlan::kCopy] = serial;
             }
-            if (omit) filled.FilledGen[omitted] = omittedGen;
+#if MOBILEGL_PIPE_VERIFY
+            withheld.PutBack(filled);
+#endif
 #endif
         }
         if (payloadBytes != 0 && MG_Util::PipeStats::Enabled()) {
@@ -3444,13 +3415,13 @@ namespace MobileGL::MG_Pipe {
         MGPipeTrackerInstance().Reset();
         // The texture emitter's records and its owed uploads belong to the ended server; its
         // sampler references go back to the cache before the cache is emptied.
-        MGPipeTextureEmitterInstance().ResetForTest();
+        MGPipeTextureEmitterInstance().ForgetSession();
         MGPipeSamplerEmitterInstance().Reset();
-        MGPipeSamplerCsoCacheInstance().ResetForTest();
+        MGPipeSamplerCsoCacheInstance().ForgetSession();
         MGPipeCsoCacheInstance().Reset();
         MGPipeSetHashSuppressorInstance().InvalidateAll();
         MGPipeVertexInputEmitterInstance().Reset();
-        MGPipeFramebufferEmitterInstance().ResetForTest();
+        MGPipeFramebufferEmitterInstance().ForgetSession();
         MGPipeImageEmitterInstance().Reset();
         MGPipeProgramEmitterInstance().Reset();
         MGPipeShaderBufferEmitterInstance().Reset();

MobileGL/MG_Impl/Pipe/PipeFill.h

@@ -81,14 +81,6 @@ namespace MobileGL::MG_Pipe {
     // (TrackerWalk.ABaseInstanceSurvivesTheFirstWalkOnAFreshContext).
     Uint32 MGPipePendingBaseInstance();
 
-    // PipeFill.cpp. Negative control B (P1 brief D6): the filler withholds the STAMP - never
-    // the value - of `field` at `verb`, so that verb's read of it is
-    // Fatal{UnmigratedPipeInput, "Field@Verb"} while every other verb is unaffected. The
-    // MOBILEGL_PIPE_POISON_OMIT knob ("<Verb>:<FieldName>") calls this once, on the first
-    // fill; tests call it directly. Both null clears the omission. An unknown name is
-    // Fatal{PipeVerifyBadKnob}.
-    void MGPipeSetPoisonOmission(const char* verb, const char* field);
-
     // PipeFill.cpp. How many times set_vertex_attrib_defaults' applier failed to reproduce
     // the value the call carried, so the client wrote the mirror itself
     // (EmitVertexAttribDefaults). It is the ONE observable of that repair: the window it
@@ -119,6 +111,13 @@ namespace MobileGL::MG_Pipe {
     // is the branch that survives P13, which is why it is its own function rather than the
     // filler's loop.
     void SnapshotFromGLContext(PipeInputs& snapshot, const MGPipeFieldMask& mask);
+
+    // PipeFill.cpp. Negative control B (P1 brief D6): from now on the filler withholds the STAMP -
+    // never the value - of `field` at `verb`, and so does the server's verb stamp, so that verb's
+    // read of it is Fatal{UnmigratedPipeInput, "Field@Verb"} while every other verb is unaffected.
+    // Names from kMGPipeVerbNames / kMGPipeInputFieldNames; false, arming nothing, for an unknown
+    // one. Call it on the GL thread. The integration harness arms it (Harness/PoisonOmissionArm.h).
+    Bool MGPipeSetPoisonOmission(const char* verb, const char* field);
 #endif
 } // namespace MobileGL::MG_Pipe
 #define MGP_FILL(Verb) ::MobileGL::MG_Pipe::MGPipeValidateForVerb(::MobileGL::MG_Pipe::MGPipeVerb::Verb)

MobileGL/MG_Impl/Pipe/SamplerEmit.h

@@ -151,7 +151,7 @@ namespace MobileGL::MG_Pipe {
             // never shrinks back.
             Uint64 OverCapacityMints = 0;
             // A RELEASE THIS CACHE COULD NOT ACCOUNT FOR. UnknownReleases: the handle names no
-            // entry here (a stale handle from before a ResetForTest, a handle of another kind
+            // entry here (a stale handle from before a ForgetSession, a handle of another kind
             // passed by mistake, a handle whose entry was already evicted). UnderflowedReleases:
             // the entry was found with a count already 0. Both are contract violations by a
             // HOLDER and are counted rather than absorbed, because the pin they steal is
@@ -189,11 +189,12 @@ namespace MobileGL::MG_Pipe {
         // named for it proves something else. It hashes nothing and simply uses the hash it is
         // given; production code has no reason to call it.
         //
-        // THE THREE MEMBERS A CONSUMER MUST NOT CALL are this one, ResetForTest() (which frees
-        // every slot the cache holds and drops their publication latches) and ResetCounters().
-        // Package B's seam is Acquire / Release / RefCountOf / RecordIsPublished / Size /
-        // GetCounters and nothing else - the class is public because it is header-only, not
-        // because all nine members are for callers.
+        // The members a consumer must not call are this one and ResetCounters(); ForgetSession()
+        // (which frees every slot the cache holds and drops their publication latches) belongs to
+        // the end of a session (MGPipeForgetEndedSession) and to unit fixtures. Package B's seam
+        // is Acquire / Release / RefCountOf / RecordIsPublished / Size / GetCounters and nothing
+        // else - the class is public because it is header-only, not because all nine members are
+        // for callers.
         MGPipeHandle AcquireWithForcedHashForTest(const SamplerParameters& params, Uint64 forcedHash,
                                                   Uint64& payloadBytes) {
             SamplerParameters canon;
@@ -255,8 +256,8 @@ namespace MobileGL::MG_Pipe {
             return false;
         }
 
-        // A unit test's fixture, and a session that replaced an ended one (MGPipeForgetEndedSession:
-        // the fresh server holds none of these records). NOT called from the validate point's
+        // A session that replaced an ended one (MGPipeForgetEndedSession: the fresh server holds
+        // none of these records), and a unit test's fixture. NOT called from the validate point's
         // FreshlyPrimed arm: MGPipeApplierReset is a make-current and does NOT drop object
         // records, so a sampler CSO the applier holds outlives a context switch. Dropping the
         // cache there would leak the applier's record and re-mint a value it already has.
@@ -265,7 +266,7 @@ namespace MobileGL::MG_Pipe {
         // delete_sampler_state behind them, so a latch left standing would make a future death
         // helper - on the recycled slot at the same generation - emit a delete for a record
         // that never existed, which is the refusal the applier counts.
-        void ResetForTest() {
+        void ForgetSession() {
             for (const Entry& entry : m_entries) {
                 MGPipeNoteHandleUnpublished(MGPipeKind::SamplerCso, entry.Cso);
                 MGPipeSlots().Free(MGPipeKind::SamplerCso, entry.Cso);

MobileGL/MG_Impl/Pipe/TextureEmit.h

@@ -1154,16 +1154,16 @@ namespace MobileGL::MG_Pipe {
             m_deadResolves = 0;
         }
 
-        // A unit fixture's per-case reset, and the reset of a session that replaced an ended one
-        // (MGPipeForgetEndedSession: the fresh server holds none of these records). See
-        // MGPipeResourceTracker::ResetForTest for the rule this restates: a texture handle and
-        // the applier record it names are SHARE-GROUP OBJECT STATE, so nothing here is
-        // per-context and no re-publication path exists or may exist.
-        // Moves whenever the handle table below is dropped (ResetForTest), so a memo that skipped
+        // ForgetSession is the reset of a session that replaced an ended one
+        // (MGPipeForgetEndedSession: the fresh server holds none of these records), and a unit
+        // fixture's per-case reset. See MGPipeResourceTracker::ResetForTest for the rule this
+        // restates: a texture handle and the applier record it names are SHARE-GROUP OBJECT
+        // STATE, so nothing here is per-context and no re-publication path exists or may exist.
+        // Moves whenever the handle table below is dropped (ForgetSession), so a memo that skipped
         // NoteTextureBoundAs / AcquireTexture for handles it already noted knows to note again.
         Uint64 TableEpoch() const { return m_tableEpoch; }
 
-        void ResetForTest() {
+        void ForgetSession() {
             ++m_tableEpoch;
             // EVERY REFERENCE THIS EMITTER OWES IS GIVEN BACK FIRST. A case that dropped the
             // table without releasing would pin cache entries for the rest of the process and

MobileGL/MG_Impl/Pipe/Verb/VerbPort.cpp

@@ -45,7 +45,6 @@
 #include <algorithm>
 #include <cstdint>
 #include <cstdio>
-#include <cstdlib>
 #include <cstring>
 #include <limits>
 
@@ -69,52 +68,6 @@ namespace MobileGL::MG_Record {
 
     namespace {
 
-        Bool g_dropClearEmission = false;
-        Uint64 g_droppedClearEmissions = 0;
-        Bool g_dropDrawEmission = false;
-        Uint64 g_droppedDrawEmissions = 0;
-
-        // E2's control has to be armable from OUTSIDE the process that runs the replay, because
-        // the statement it makes is about a trace lane and not about a unit case: "drop an
-        // emission and OpenRA's SSIM falls below 0.99". A recompile would make the control
-        // arm against source text, which is ID-22(a)'s defect.
-        //
-        // READ WITH getenv RATHER THAN THROUGH MG_Config, DELIBERATELY AND TEMPORARILY. Config.h
-        // is c0's and a new MOBILEGL_IPC_* knob goes through the integrator; these are
-        // NEGATIVE-CONTROL switches no operator may ever set, and they announce themselves at
-        // warning level every time they arm so they cannot be on by accident. Flagged for
-        // adoption into IpcTable if the integrator wants them there.
-        Bool ReadControlKnob(const char* name) {
-            const char* value = std::getenv(name);
-            return value != nullptr && value[0] == '1' && value[1] == '\0';
-        }
-
-        // Two negative controls. MOBILEGL_IPC_E2_DROP_DRAW drops every DrawVbo record, so a
-        // frame that really crosses the wire can show only the clear colour; it is the OpenRA
-        // retrace's control. MOBILEGL_IPC_E2_DROP_CLEAR cannot be: OpenRA's last frame clears,
-        // then covers the whole 640x480 surface four times before the snapshot, so dropping the
-        // clear leaves SSIM at 1.0 (measured). It stays for scenarios whose picture depends on
-        // the clear, such as ClearThenReadPixelsScenario.
-        void ArmControlKnobs() {
-            g_dropClearEmission = ReadControlKnob("MOBILEGL_IPC_E2_DROP_CLEAR");
-            g_dropDrawEmission = ReadControlKnob("MOBILEGL_IPC_E2_DROP_DRAW");
-            if (g_dropClearEmission) {
-                MGLOG_W("MG_Remote client: MOBILEGL_IPC_E2_DROP_CLEAR=1 - a NEGATIVE CONTROL is "
-                        "armed and every glClear will be DROPPED on the wire. It is observable "
-                        "only where the picture depends on the clear: OpenRA overdraws its whole "
-                        "surface every frame, so this knob does NOT redden the E2 retrace "
-                        "(measured, joint-v1.md 3) - MOBILEGL_IPC_E2_DROP_DRAW is the one that "
-                        "does. The dropped count is published on the 'E2 control armed' line");
-            }
-            if (g_dropDrawEmission) {
-                MGLOG_W("MG_Remote client: MOBILEGL_IPC_E2_DROP_DRAW=1 - E2's NEGATIVE CONTROL is "
-                        "armed and every DrawVbo record will be DROPPED on the wire. The surface "
-                        "can then only carry the clear colour, so this arm is expected to fail its "
-                        "SSIM threshold; a lane that stays green with it set is not going through "
-                        "the wire at all");
-            }
-        }
-
         // ID-49's two halves, in one place so the emitter and its control read the same
         // arithmetic.
         //
@@ -376,16 +329,6 @@ namespace MobileGL::MG_Record {
             VerbChannel session = ChannelFor("Clear");
             BeforeReadOnlyVerb();
 
-            if (g_dropClearEmission) {
-                // A negative control. Everything above still ran, so the only difference
-                // between this arm and the live one is the record - which is exactly the
-                // statement "the picture comes from the wire" that E2 exists to prove. Its
-                // OBSERVABILITY is a property of the workload, not of this branch: see
-                // ArmControlKnobs for the measurement that took E2's retrace off this knob.
-                ++g_droppedClearEmissions;
-                return;
-            }
-
             MG_Pipe::MGPClear record{};
             // The DRAW framebuffer is whatever the server's own SyncRenderState resolves from
             // gPipeInputs, which the client's MGP_FILL(Clear) at GL_Drawing.cpp:534 has just
@@ -592,8 +535,8 @@ namespace MobileGL::MG_Record {
         // All nineteen slots emit one draw_vbo record, the GL call verbatim beside the handles,
         // which the server's sink turns into the backend call the monolith makes. Each entry
         // point reads the bindings, plans the head and ranges, then calls EmitDrawRecord: the
-        // pre-verb hooks in EmitDrawArrays' order (push, mark walk, record), the drop-draw
-        // control, client arrays and indices as owned buffers. Refused by name: +CLIENT_COMMANDS
+        // pre-verb hooks in EmitDrawArrays' order (push, mark walk, record), then client arrays
+        // and indices as owned buffers. Refused by name: +CLIENT_COMMANDS
         // (no indirect buffer), +UNBOUND_PARAMETER (no parameter buffer; the sink dereferences
         // it) and +INDEX_OFFSET (a byte offset that is not whole indices; Start counts indices).
 
@@ -676,14 +619,6 @@ namespace MobileGL::MG_Record {
             }
             MarkGpuWritesForDraw();
 
-            if (g_dropDrawEmission) {
-                // E2's negative control covers EVERY draw record, not only DrawArrays: the
-                // Minecraft traces are DrawElements frames, and a control that dropped only the
-                // one P5 entry point would leave those lanes green with the wire disarmed.
-                ++g_droppedDrawEmissions;
-                return;
-            }
-
             info.NumDraws = numDraws;
             MG_Pipe::MGPipeVerbTail tails[2] = {{ranges, static_cast<Uint64>(numDraws) * sizeof(MG_Pipe::MGPDrawRange)},
                                                 {nullptr, 0}};
@@ -1582,27 +1517,6 @@ namespace MobileGL::MG_Record {
 
     } // namespace
 
-    // THE CONTROL'S OWN EVIDENCE LINE, and it is emitted per frame rather than at teardown
-    // on purpose: a retrace that is killed by its own timeout, or whose library never runs
-    // MobileGL::Destroy, would leave a teardown-only line absent and the control would then
-    // have to accept a bare threshold failure - which is the thing R-16 forbids. One line
-    // per Present, only while a knob is armed, is bounded by the frame count and present
-    // whatever happens afterwards.
-    void LogE2ControlLine(Uint64 frameOrdinal) {
-        if (!g_dropClearEmission && !g_dropDrawEmission) return;
-        MGLOG_W("MGPipe: E2 control armed - drop-draw=%d drop-clear=%d, %llu records dropped "
-                "on the wire (draw=%llu clear=%llu), frame %llu",
-                g_dropDrawEmission ? 1 : 0, g_dropClearEmission ? 1 : 0,
-                static_cast<unsigned long long>(g_droppedDrawEmissions + g_droppedClearEmissions),
-                static_cast<unsigned long long>(g_droppedDrawEmissions),
-                static_cast<unsigned long long>(g_droppedClearEmissions),
-                static_cast<unsigned long long>(frameOrdinal));
-    }
-
-    void ArmVerbControlKnobs() {
-        ArmControlKnobs();
-    }
-
 #if MOBILEGL_PIPE_VERIFY
     Bool MonolithPortApplyingForVerify() {
         return t_portApplying;
@@ -1742,20 +1656,6 @@ namespace MobileGL::MG_Record {
         return previous;
     }
 
-    void SetDropClearEmissionForNegativeControl(Bool drop) {
-        g_dropClearEmission = drop;
-    }
-    Uint64 DroppedClearEmissions() {
-        return g_droppedClearEmissions;
-    }
-
-    void SetDropDrawEmissionForNegativeControl(Bool drop) {
-        g_dropDrawEmission = drop;
-    }
-    Uint64 DroppedDrawEmissions() {
-        return g_droppedDrawEmissions;
-    }
-
     Bool ReadbackPackStateIsTightForTest(GLsizei width, Uint64 bytesPerPixel, const PixelStoreParameters& pack) {
         return ReadbackPackStateIsTight(width, bytesPerPixel, pack);
     }

MobileGL/MG_Impl/Pipe/Verb/VerbPort.h

@@ -53,11 +53,6 @@ namespace MobileGL::MG_Record {
     // persistent-map push and the deferred destroys, before its record.
     void BeforeReadOnlyVerb();
 
-    // Arms the E2 negative controls from their environment knobs (once, at table build).
-    void ArmVerbControlKnobs();
-    // The E2 control's per-frame evidence line, emitted only while a control is armed.
-    void LogE2ControlLine(Uint64 frameOrdinal);
-
 #if MOBILEGL_PIPE_VERIFY
     // True while the monolith verb port applies a record on this thread. The verify read hook
     // answers a pack-state read inside that window from the applied pack payload, as it does for a
@@ -81,17 +76,6 @@ namespace MobileGL::MG_Record {
     // Returns the previous routing.
     Bool SetMonolithVerbPortRoutingForTesting(Bool viaPort);
 
-    // Negative controls for the retrace lanes. When set, the named emitter skips its record but
-    // still runs the pre-verb hooks, so a replay that really goes through the wire loses the
-    // verb while one that fell through to the driver does not. Functions rather than Config.h
-    // knobs: a running test process sets them, and no operator may. The counts let a control
-    // assert that it fired. The OpenRA retrace uses the draw drop: OpenRA overdraws every pixel
-    // it clears, so dropping the clear leaves SSIM at 1.0 (see ArmControlKnobs in VerbPort.cpp).
-    void SetDropClearEmissionForNegativeControl(Bool drop);
-    Uint64 DroppedClearEmissions();
-    void SetDropDrawEmissionForNegativeControl(Bool drop);
-    Uint64 DroppedDrawEmissions();
-
     // ID-47. The CLIENT refuses a readback whose answer would not fit a reply slot, BEFORE it
     // emits the record, and names the read. THE REFUSAL ITSELF IS s1's -
     // ClientSession::RequireReadPixelsReplyFits, forwarding to
@@ -177,7 +161,7 @@ namespace MobileGL::MG_Record {
     // over a snapshot of the bindings the emitter read from the GL context, so a unit case can
     // drive the PRODUCTION derivation with synthetic bindings (R-16) while the integration lane
     // proves the bindings are read from the right slots. The emitters compose these and add
-    // nothing but the hooks, the E2 draw-drop control and the staging of a client index array.
+    // nothing but the hooks and the staging of a client index array.
 
     // What the emitter reads from the GL context before it plans a draw.
     struct RemoteDrawBindings {

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -53,9 +53,11 @@ add_executable(MobileGLIntegrationTest
     Harness/BackendCapsPeek.cpp
     Harness/PipeSlotPeek.cpp
     Harness/PipeApplyPeek.cpp
+    Harness/IntegerAttributeTypePeek.cpp
     Harness/P4aSeamPeek.cpp
     Harness/P4aFinalFixPeek.cpp
     Harness/PersistentMapPeek.cpp
+    Harness/PoisonOmissionArm.cpp
     Harness/SplitRuntimePeek.cpp
     # ---- P3b/P4b wave 2-D package D2 (own block; D1 edits this file elsewhere) --------------
     # The client texture emitter's own counters, for TextureViewAliasScenario's half of the
@@ -146,6 +148,7 @@ add_executable(MobileGLIntegrationTest
     Scenarios/TessellationXfbCaptureScenario.cpp
     Scenarios/PointSizeDemotionScenario.cpp
     Scenarios/VertexArrayEnableDisableScenario.cpp
+    Scenarios/NarrowIntegerAttributeScenario.cpp
     Scenarios/CopyImageLevelRangeScenario.cpp
     Scenarios/CopyImageLayeredScenario.cpp
     Scenarios/CopyImagePacked16Scenario.cpp
@@ -794,12 +797,20 @@ set(MGL_ITEST_MONOLITH_MECHANISM_FILTER
 # would be a name in a list.
 set(MGL_ITEST_GLES_VIEW_FILTER
     "TextureViewScenario.*:TextureViewAliasScenario.*:F1WireScenario.ComputeImageStoreThroughViewPreservesOtherRootLayer:F1WireScenario.TextureViewClearTargetsItsRootMipAndLayer:F1WireScenario.GenerateMipmapThroughViewKeepsOwnerLevelsAndLayersOutsideItsWindow:InvalidImageUnitScenario.ALevelPastATextureViewsWindowReadsZero")
+# Cases that run only in the split-arm entries Harness/SplitLogPaths.cmake.in declares a lane
+# for, and skip by construction anywhere else (no split transport, no declared arm). They are
+# left out of the ambient, verify and whole-binary Magma registrations for the reason above:
+# there they would green-skip on every run.
+set(MGL_ITEST_SPLIT_ARM_ONLY_FILTER
+    "PersistentCoherentMapScenario.ThePushIsTheOnlyRouteAWriteTakesToTheServer")
 
-mgl_itest_lane("DirectGLES." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:${MGL_ITEST_GLES_VIEW_FILTER}"
-    ENV "${MGL_ITEST_GLES_ENVIRONMENT}")
+# The two lists are named so that SplitLogPaths.cmake.in can reach the ambient CtWireScenario
+# entries, which the integration job's inproc leg runs on the transport it exports.
+mgl_itest_lane("DirectGLES." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:${MGL_ITEST_GLES_VIEW_FILTER}:${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
+    TEST_LIST MGL_AMBIENT_TESTS_GLES ENV "${MGL_ITEST_GLES_ENVIRONMENT}")
 
-mgl_itest_lane("DirectVulkan." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}"
-    ENV "${MGL_ITEST_VULKAN_ENVIRONMENT}")
+mgl_itest_lane("DirectVulkan." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
+    TEST_LIST MGL_AMBIENT_TESTS_VULKAN ENV "${MGL_ITEST_VULKAN_ENVIRONMENT}")
 
 # ScenarioIsolationScenario's two cases in ONE process: the first leaves a deleted program current
 # and an error unread, the second asserts ScenarioTest::SetUp cleared both. The entries above run
@@ -995,9 +1006,7 @@ mgl_itest_lane("DirectVulkan.PointSizeDemotion." "PointSizeDemotionScenario.*"
 
 # --- MOBILEGL_PIPE_VERIFY lanes (ARCHITECTURE.md §13.2), under `if (MOBILEGL_PIPE_VERIFY)` below
 # They exist only in a -DMOBILEGL_PIPE_VERIFY=ON build, so `ctest -L integration-verify
-# --no-tests=error` fails when the option is lost. The ambient Verify. entries must not set
-# MOBILEGL_PIPE_VERIFY_CORRUPT or MOBILEGL_PIPE_POISON_OMIT: CI's negative controls export them
-# in the job environment, and a property of the same name would override them.
+# --no-tests=error` fails when the option is lost.
 # --- handle ABA: one always-on monolith HandleRecycle.Handles lane per backend -------------
 # MGITEST_HANDLE_ARM selects the arm (the scenario skips in the ambient entries). The lanes run
 # the default subsystem mask, so they measure the {slot, gen} key that ships.
@@ -1255,17 +1264,22 @@ if (MOBILEGL_PIPE_VERIFY)
     # boundary and again at every accessor read, which the design budgets at 5-10x.
     set(MGL_ITEST_VERIFY_TIMEOUT 900)
 
-    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-DirectGLES.log"
+    # What "the monolith verify lane" means, per backend, in one place: the ambient Verify. entries
+    # and every control entry below are this list plus their own log path and markers. So the
+    # controls run the configuration the ambient entries run, and an edit that leaves that lane
+    # unarmed or non-fatal turns PipeVerifyArmingScenario.Armed red, which asserts both.
+    set(MGL_ITEST_GLES_VERIFY_BASE_ENV
+        "MOBILEGL_TRANSPORT=monolith" "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
         ${MGL_ITEST_COMMON_ENV})
-    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-DirectVulkan.log"
+    set(MGL_ITEST_VULKAN_VERIFY_BASE_ENV
+        "MOBILEGL_TRANSPORT=monolith" "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
         ${MGL_ITEST_VULKAN_ENV})
 
+    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_ENVIRONMENT ${MGL_ITEST_GLES_VERIFY_BASE_ENV}
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-DirectGLES.log")
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_ENVIRONMENT ${MGL_ITEST_VULKAN_VERIFY_BASE_ENV}
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-DirectVulkan.log")
+
     # The arming assertion's own lane, one case per backend, with a log path nothing else writes to.
     #
     # PipeVerifyArmingScenario.Armed reads the library's log, and the log is a per-LANE resource: it
@@ -1275,65 +1289,52 @@ if (MOBILEGL_PIPE_VERIFY)
     # the primgen reroute, the point-size demotion) is registered exactly like this for the same
     # reason. MGITEST_PIPE_ARMING_LANE is a harness marker - the library never reads it - and it is
     # what makes the case skip in the ambient lane instead of racing there.
-    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_ARMING_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1" "MGITEST_PIPE_ARMING_LANE=1"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-arming-DirectGLES.log"
-        ${MGL_ITEST_COMMON_ENV})
-    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_ARMING_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1" "MGITEST_PIPE_ARMING_LANE=1"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-arming-DirectVulkan.log"
-        ${MGL_ITEST_VULKAN_ENV})
+    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_ARMING_ENVIRONMENT ${MGL_ITEST_GLES_VERIFY_BASE_ENV}
+        "MGITEST_PIPE_ARMING_LANE=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-arming-DirectGLES.log")
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_ARMING_ENVIRONMENT ${MGL_ITEST_VULKAN_VERIFY_BASE_ENV}
+        "MGITEST_PIPE_ARMING_LANE=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-arming-DirectVulkan.log")
 
     # Negative control A (G4). MOBILEGL_PIPE_VERIFY_FATAL=0 so the process SURVIVES its own
-    # divergence and the case can read the report back out of the log; the CI step that exports
-    # the same corruption against the ambient lane, where FATAL keeps its default of 1, asserts
-    # the other half - that a divergence aborts and reds the entry.
-    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_CORRUPT_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
+    # divergence and the case can read the report back out of the log; the other half, that with
+    # FATAL at its default of 1 a divergence aborts, is PipeInputsTest's
+    # VerifyCorruptKnobNamesTheFieldAtEntry.
+    mgl_itest_join_environment(MGL_ITEST_GLES_VERIFY_CORRUPT_ENVIRONMENT ${MGL_ITEST_GLES_VERIFY_BASE_ENV}
         "MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters" "MOBILEGL_PIPE_VERIFY_FATAL=0"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-corrupt-DirectGLES.log"
-        ${MGL_ITEST_COMMON_ENV})
-    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_CORRUPT_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-corrupt-DirectGLES.log")
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_VERIFY_CORRUPT_ENVIRONMENT ${MGL_ITEST_VULKAN_VERIFY_BASE_ENV}
         "MOBILEGL_PIPE_VERIFY_CORRUPT=GetRenderStateParameters" "MOBILEGL_PIPE_VERIFY_FATAL=0"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-corrupt-DirectVulkan.log"
-        ${MGL_ITEST_VULKAN_ENV})
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-verify-corrupt-DirectVulkan.log")
 
     # Negative control B (G5). The omission skips the STAMP of one field for one verb while still
     # copying its value, which is indistinguishable from a fill row nobody wrote; the scenario
-    # forks, so the resulting std::abort() is a datum in waitpid() rather than a dead lane.
+    # forks, so the resulting std::abort() is a datum in waitpid() rather than a dead lane. The
+    # pair is a harness marker, MGITEST_POISON_OMIT: the library has no knob for it, and the
+    # re-executed child arms it through the verify build's setter (Harness/PoisonOmissionArm.h).
     # P13 W5: the pair is the pack state at ReadPixels, which monolith's record arm still reads from
     # the fill (around its neutral-pack readback). GetActiveTextureUnit at GenerateMipmap was the
     # frontend arm's read; the record arm resolves the texture from the verb's own handle and never
     # reads it, so that pair could no longer go red for its own reason.
-    mgl_itest_join_environment(MGL_ITEST_GLES_POISON_OMIT_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_PIPE_VERIFY=1"
-        "MOBILEGL_PIPE_POISON_OMIT=ReadPixels:GetPixelStoreParameters"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-DirectGLES.log"
-        ${MGL_ITEST_COMMON_ENV})
-    mgl_itest_join_environment(MGL_ITEST_VULKAN_POISON_OMIT_ENVIRONMENT
-        "MOBILEGL_TRANSPORT=monolith"
-        "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_PIPE_VERIFY=1"
-        "MOBILEGL_PIPE_POISON_OMIT=ReadPixels:GetPixelStoreParameters"
-        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-DirectVulkan.log"
-        ${MGL_ITEST_VULKAN_ENV})
+    mgl_itest_join_environment(MGL_ITEST_GLES_POISON_OMIT_ENVIRONMENT ${MGL_ITEST_GLES_VERIFY_BASE_ENV}
+        "MGITEST_POISON_OMIT=ReadPixels:GetPixelStoreParameters"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-DirectGLES.log")
+    mgl_itest_join_environment(MGL_ITEST_VULKAN_POISON_OMIT_ENVIRONMENT ${MGL_ITEST_VULKAN_VERIFY_BASE_ENV}
+        "MGITEST_POISON_OMIT=ReadPixels:GetPixelStoreParameters"
+        "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-DirectVulkan.log")
 
     # The whole suite again, per backend, with the comparator armed. Same scenarios, same
     # assertions, but every backend read of frontend state is now checked against a snapshot taken
     # from the live context at the verb boundary - which is what "the 742 integration entries
     # prove push equals pull" means. Labelled integration-gpu as well so a verify build's
     # `ctest -L integration-gpu` still describes the whole registration set.
-    mgl_itest_lane("DirectGLES.Verify." "-${MGL_ITEST_GLES_VIEW_FILTER}"
+    mgl_itest_lane("DirectGLES.Verify." "-${MGL_ITEST_GLES_VIEW_FILTER}:${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
         LABELS "integration-gpu\;integration-verify\;integration-monolith-control" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} ENV "${MGL_ITEST_GLES_VERIFY_ENVIRONMENT}")
     mgl_itest_lane("DirectGLES.Verify." "${MGL_ITEST_GLES_VIEW_FILTER}"
         LABELS "integration-verify\;integration-monolith-control" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} ENV "${MGL_ITEST_GLES_VERIFY_ENVIRONMENT}\;MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW=1")
     gtest_discover_tests(MobileGLIntegrationTest
         TEST_PREFIX "DirectVulkan.Verify."
+        TEST_FILTER "-${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
         DISCOVERY_TIMEOUT 30
         PROPERTIES
             LABELS "integration-gpu\;integration-verify\;integration-monolith-control"
@@ -1342,9 +1343,9 @@ if (MOBILEGL_PIPE_VERIFY)
     )
 
     # The arming assertion, one entry per backend. This is the entry that fails a lane whose library
-    # never armed: it runs the same library and the same MOBILEGL_PIPE_VERIFY=1 as the ambient
-    # entries above, but unlike them it cannot be green against a library with no comparator
-    # compiled in. Its log is its own, so `-j 4` cannot make it flake.
+    # never armed: it runs the same library and the same base list as the ambient entries above,
+    # but unlike them it cannot be green against a library with no comparator compiled in, or with
+    # one that only logs a divergence. Its log is its own, so `-j 4` cannot make it flake.
     mgl_itest_lane("DirectGLES.VerifyArming." "PipeVerifyArmingScenario.Armed"
         LABELS "integration-gpu\;integration-verify\;integration-monolith-control" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} ENV "${MGL_ITEST_GLES_VERIFY_ARMING_ENVIRONMENT}")
     mgl_itest_lane("DirectVulkan.VerifyArming." "PipeVerifyArmingScenario.Armed"
@@ -2410,7 +2411,7 @@ if (MOBILEGL_BUILD_DISAGGREGATED)
     # running it here captured only the calls made ABOVE this line and silently dropped the F1
     # and Ct blocks below it. SplitLogPaths.PrivateAndDistinct is what caught that, naming
     # F1WireScenario.ClearBufferfiPixels; the generated file now sees every call.
-    # Python is mandatory for this split integration gate (also used by the CI controls).
+    # Python is mandatory for this split integration gate.
     # Do not silently omit the ownership check when the interpreter is unavailable.
     find_package(Python3 REQUIRED COMPONENTS Interpreter)
     add_test(NAME SplitLogPaths.PrivateAndDistinct
@@ -3214,10 +3215,10 @@ if (MOBILEGL_BUILD_DISAGGREGATED)
 endif()
 
 # P5c ct (docs/archive/contracts/CONTRACT-P5C.md §5): the two control records, split-only source for the
-# same reason as f1's - the scenario reads the SERVER sink's tallies, which a monolith build
-# has no symbol for. One block per case with a LOG PATH OF ITS OWN, the F1 pattern:
-# SplitLogPaths.PrivateAndDistinct fails a lane whose cases share one file, and the death
-# case's child truncates whatever path it inherits.
+# same reason as f1's - the scenario reads the server's control-record counters (`ar`, `od` on the
+# server role's PipeStats line), which only a build with a server role produces. One block per case
+# with a LOG PATH OF ITS OWN, the F1 pattern: SplitLogPaths.PrivateAndDistinct fails a lane whose
+# cases share one file, and the death case's child truncates whatever path it inherits.
 if (MOBILEGL_BUILD_DISAGGREGATED)
     target_sources(MobileGLIntegrationTest PRIVATE Scenarios/CtWireScenario.cpp)
     # P7 wave 2 package C adds the fifth: the OQ-10 capability read. It belongs in THIS list
@@ -3546,8 +3547,9 @@ endif()
 # Whole integration binary on Magma split (informational, no CI gate)
 # =====================================================================================
 # The set the monolith `DirectVulkan.` arm runs (all but MGL_ITEST_MONOLITH_MECHANISM_FILTER,
-# oracles that must not inherit a transport), minus DualBlockScenario (its own lane). No
-# MGITEST_SPLIT_LANE: query-only cases emit no record (ARCHITECTURE.md §16.1). Private log paths
+# oracles that must not inherit a transport, and MGL_ITEST_SPLIT_ARM_ONLY_FILTER), minus
+# DualBlockScenario (its own lane). No MGITEST_SPLIT_LANE: query-only cases emit no record
+# (ARCHITECTURE.md §16.1). Private log paths
 # come through MGL_MAGMA_FULL_TEST_LISTS, not MGL_SPLIT_ARM_TEST_LISTS, whose entries also get
 # lane markers that would arm unrelated oracles here; SplitLogPaths.cmake.in walks both.
 if (MOBILEGL_BUILD_DISAGGREGATED)
@@ -3558,7 +3560,7 @@ if (MOBILEGL_BUILD_DISAGGREGATED)
         mgl_itest_join_environment(mglItestMagmaFullEnvironment
             "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_ITEST_REQUIRE_GPU=1"
             ${MGL_ITEST_CAPABILITY_ENV} ${MGL_ITEST_VULKAN_ENV} ${mglItestArmTransportEnv})
-        mgl_itest_lane("DirectVulkan.${mglItestArm}.Full." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:DualBlockScenario.*"
+        mgl_itest_lane("DirectVulkan.${mglItestArm}.Full." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:DualBlockScenario.*:${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
             LABELS "integration-magma-full-${mglItestArmLower}" TEST_LIST "MGL_MAGMA_FULL_TESTS_${mglItestArmUpper}" PROPERTIES ${mglItestArmProperties} ENV "${mglItestMagmaFullEnvironment}")
         list(APPEND MGL_MAGMA_FULL_TEST_LISTS "MGL_MAGMA_FULL_TESTS_${mglItestArmUpper}")
     endforeach()
@@ -3602,11 +3604,11 @@ if (MOBILEGL_BUILD_DISAGGREGATED AND MOBILEGL_PIPE_VERIFY)
     # MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW=1 or DirectGLES withholds GL_ARB_texture_view and they
     # green-skip, so they are subtracted from the first registration and re-registered with the
     # knob. "Every existing verify case on the split arm" is false without the second block.
-    mgl_itest_lane("DirectGLES.VerifySplit." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:${MGL_ITEST_GLES_VIEW_FILTER}:DualBlockScenario.*:${MGL_ITEST_VERIFY_SPLIT_GLES_MAGMA_DECLINE_FILTER}"
+    mgl_itest_lane("DirectGLES.VerifySplit." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:${MGL_ITEST_GLES_VIEW_FILTER}:DualBlockScenario.*:${MGL_ITEST_VERIFY_SPLIT_GLES_MAGMA_DECLINE_FILTER}:${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
         LABELS "integration-verify-split" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} TEST_LIST MGL_VERIFY_SPLIT_TESTS_GLES ENV "${MGL_ITEST_GLES_VERIFY_SPLIT_ENVIRONMENT}")
     mgl_itest_lane("DirectGLES.VerifySplit." "${MGL_ITEST_GLES_VIEW_FILTER}"
         LABELS "integration-verify-split" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} TEST_LIST MGL_VERIFY_SPLIT_TESTS_GLES_VIEW ENV "${MGL_ITEST_GLES_VERIFY_SPLIT_ENVIRONMENT}\;MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW=1")
-    mgl_itest_lane("DirectVulkan.VerifySplit." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:DualBlockScenario.*"
+    mgl_itest_lane("DirectVulkan.VerifySplit." "-${MGL_ITEST_MONOLITH_MECHANISM_FILTER}:DualBlockScenario.*:${MGL_ITEST_SPLIT_ARM_ONLY_FILTER}"
         LABELS "integration-verify-split" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} TEST_LIST MGL_VERIFY_SPLIT_TESTS_VULKAN ENV "${MGL_ITEST_VULKAN_VERIFY_SPLIT_ENVIRONMENT}")
     list(APPEND MGL_VERIFY_SPLIT_TEST_LISTS MGL_VERIFY_SPLIT_TESTS_GLES
          MGL_VERIFY_SPLIT_TESTS_GLES_VIEW MGL_VERIFY_SPLIT_TESTS_VULKAN)
@@ -3632,9 +3634,8 @@ if (MOBILEGL_BUILD_DISAGGREGATED AND MOBILEGL_PIPE_VERIFY)
         # THE TWO NEGATIVE CONTROLS ON THIS ARM (CONTRACT-P7 §6), the monolith verify block's
         # four entries with the split environment underneath and nothing else changed: each is
         # green when its control REPORTS, so each goes red the day the comparator or the poison
-        # stops reaching the split arm. Their CI halves - the same knob exported against the
-        # ambient VerifySplit. entries, where ctest has to FAIL - live in test.yml's
-        # integration-verify-split job.
+        # stops reaching the split arm. test.yml's integration-verify-split job requires each of
+        # them to pass by name.
         #
         # A (G4): the corruption perturbs the snapshot arm at the CLIENT's entry compare, so the
         # report lands in the client role's log, which is the half LibraryLog() reads.
@@ -3658,20 +3659,17 @@ if (MOBILEGL_BUILD_DISAGGREGATED AND MOBILEGL_PIPE_VERIFY)
         # PoisonOmissionScenario's ReadChildLog reads BOTH role halves of the child's log, because
         # under a transport the poisoned read can fire on either side of the seam.
         #
-        # A DIFFERENT PAIR FROM THE MONOLITH ENTRIES', and the monolith pair is not "also fine
-        # here": GenerateMipmap:GetActiveTextureUnit is inert on this arm - the split backend's
-        # generate_mipmap resolves its texture from the verb's handle and never reads the active
-        # unit, so the child exited 0 with that stamp withheld (measured, both backends).
-        # ReadPixels:GetPixelStoreParameters is read on the server under the server's stamp,
-        # which is the stamp the knob has to withhold on this arm (PipeInputs.cpp's
-        # ServerPoisonOmission). PoisonOmissionScenario.cpp's kOmittedPairs carries both.
+        # THE MONOLITH ENTRIES' PAIR. ReadPixels:GetPixelStoreParameters is read on the server under
+        # the server's stamp, which is the stamp the omission has to withhold on this arm
+        # (PipeInputs.cpp's MGPipeServerSetPoisonOmission). GenerateMipmap:GetActiveTextureUnit is
+        # inert here: generate_mipmap resolves its texture from the verb's handle and never reads
+        # the active unit, so the child exited 0 with that stamp withheld (measured, both backends).
         mgl_itest_lane("${mglItestVerifyBackend}.VerifySplitPoisonOmitted." "PoisonOmissionScenario.OmittedFieldAbortsOnThatVerb"
-            LABELS "integration-verify-split" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} LOCK "pipe-poison-omit-split-${mglItestVerifyBackend}.log" ENV "${mglItestVerifyArmEnv}\;MOBILEGL_PIPE_POISON_OMIT=ReadPixels:GetPixelStoreParameters\;MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-split-${mglItestVerifyBackend}.log")
-        # B's AMBIENT TARGET. The monolith verify lane's control-B step aims its knob at
-        # `Verify.PoisonOmissionScenario.WithoutOmissionCompletes`, the one integration entry that
-        # calls glGenerateMipmap at all - and the mechanism filter took that entry out of the
-        # ambient set above along with the rest of the scenario. Registered back by hand, with no
-        # knob, so the CI step has an entry on THIS arm to turn red.
+            LABELS "integration-verify-split" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} LOCK "pipe-poison-omit-split-${mglItestVerifyBackend}.log" ENV "${mglItestVerifyArmEnv}\;MGITEST_POISON_OMIT=ReadPixels:GetPixelStoreParameters\;MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/pipe-poison-omit-split-${mglItestVerifyBackend}.log")
+        # B's AMBIENT HALF. `Verify.PoisonOmissionScenario.WithoutOmissionCompletes` runs the
+        # scenario with nothing withheld, and the mechanism filter took it out of the ambient set
+        # above along with the rest of the scenario. Registered back by hand, with no knob, so
+        # this arm's ambient lane still runs it.
         mgl_itest_lane("${mglItestVerifyBackend}.VerifySplit." "PoisonOmissionScenario.WithoutOmissionCompletes"
             LABELS "integration-verify-split" TIMEOUT ${MGL_ITEST_VERIFY_TIMEOUT} TEST_LIST "MGL_VERIFY_SPLIT_TESTS_POISON_${mglItestVerifyBackend}" ENV "${mglItestVerifyArmEnv}")
         list(APPEND MGL_VERIFY_SPLIT_TEST_LISTS "MGL_VERIFY_SPLIT_TESTS_POISON_${mglItestVerifyBackend}")
@@ -3698,4 +3696,11 @@ if (MOBILEGL_BUILD_DISAGGREGATED)
     add_test(NAME SplitLogPaths.ResultAccountingControls
         COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/Harness/test_split_log_paths.py)
     set_tests_properties(SplitLogPaths.ResultAccountingControls PROPERTIES LABELS "unit")
+
+    # The split fixture's transport-claim rule on canned inputs, so the rule itself can go red
+    # off a GPU: no GL, no library, just the pure function the fixture calls.
+    add_executable(SplitLaneHarnessTest Harness/SplitLaneHarnessTest.cpp)
+    target_link_libraries(SplitLaneHarnessTest PRIVATE GTest::gtest_main)
+    add_test(NAME SplitLaneHarness.TransportClaimRule COMMAND SplitLaneHarnessTest)
+    set_tests_properties(SplitLaneHarness.TransportClaimRule PROPERTIES LABELS "unit")
 endif()

MobileGL/MG_IntegrationTest/Harness/IntegerAttributeTypePeek.cpp

@@ -0,0 +1,279 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/IntegerAttributeTypePeek.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "IntegerAttributeTypePeek.h"
+
+#include <cstdio>
+#include <cstring>
+#include <vector>
+
+#if !defined(__ANDROID__)
+#include <Config.h>
+#include <MG_Backend/DirectGLES/DirectGLES.h>
+#if MOBILEGL_BUILD_DISAGGREGATED
+#include <MG_Remote/Client/ClientSession.h>
+#include <MG_Remote/Server/ServerLoop.h>
+#endif
+#define MGITEST_INTEGER_ATTRIBUTE_TYPE_PEEK_LIVE 1
+#endif
+
+namespace MGITest {
+
+    bool IntegerAttributeTypeFitsInput(unsigned inputType, bool arrayInteger, unsigned arrayType) {
+        switch (inputType) {
+        case 0x1404: // GL_INT
+        case 0x8B53: // GL_INT_VEC2
+        case 0x8B54: // GL_INT_VEC3
+        case 0x8B55: // GL_INT_VEC4
+            return arrayInteger && (arrayType == 0x1400 || arrayType == 0x1402 || arrayType == 0x1404);
+        case 0x1405: // GL_UNSIGNED_INT
+        case 0x8DC6: // GL_UNSIGNED_INT_VEC2
+        case 0x8DC7: // GL_UNSIGNED_INT_VEC3
+        case 0x8DC8: // GL_UNSIGNED_INT_VEC4
+            return arrayInteger && (arrayType == 0x1401 || arrayType == 0x1403 || arrayType == 0x1405);
+        default:
+            return !arrayInteger;
+        }
+    }
+
+#if defined(MGITEST_INTEGER_ATTRIBUTE_TYPE_PEEK_LIVE)
+    namespace {
+        namespace MGB = MobileGL::MG_Backend::DirectGLES;
+
+        // Written and read only on the thread that issues Espryt's driver calls: the test thread
+        // in monolith, the apply thread under the in-process transport (every access there goes
+        // through a probe on that thread).
+        IntegerAttributeTypeTally g_tally;
+        bool g_watching = false;
+
+        void NoteViolation(GLint program, const char* name, GLint location, GLenum inputType, GLint arrayInteger,
+                           GLint arrayType) {
+            ++g_tally.violations;
+            if (!g_tally.firstViolation.empty()) return;
+            char text[256];
+            std::snprintf(text, sizeof(text),
+                          "draw %u: driver program %d input '%s' (type 0x%04x) at location %d reads an array "
+                          "declared %s with type 0x%04x",
+                          g_tally.draws, static_cast<int>(program), name, static_cast<unsigned>(inputType),
+                          static_cast<int>(location), arrayInteger ? "integer" : "float",
+                          static_cast<unsigned>(arrayType));
+            g_tally.firstViolation = text;
+        }
+
+        // Every enabled array an active input of the current driver program reads.
+        void InspectDraw() {
+            ++g_tally.draws;
+            auto& gl = MGB::g_GLESFuncs;
+            GLint program = 0;
+            gl.glGetIntegerv(GL_CURRENT_PROGRAM, &program);
+            if (program == 0) return;
+            GLint count = 0;
+            GLint maxLength = 0;
+            gl.glGetProgramiv(static_cast<GLuint>(program), GL_ACTIVE_ATTRIBUTES, &count);
+            gl.glGetProgramiv(static_cast<GLuint>(program), GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxLength);
+            std::vector<char> name(static_cast<std::size_t>(maxLength > 0 ? maxLength : 0) + 1, '\0');
+            bool violated = false;
+            for (GLint index = 0; index < count && !violated; ++index) {
+                GLint size = 0;
+                GLenum type = 0;
+                gl.glGetActiveAttrib(static_cast<GLuint>(program), static_cast<GLuint>(index),
+                                     static_cast<GLsizei>(name.size()), nullptr, &size, &type, name.data());
+                if (std::strncmp(name.data(), "gl_", 3) == 0) continue;
+                const GLint location = gl.glGetAttribLocation(static_cast<GLuint>(program), name.data());
+                if (location < 0) continue;
+                GLint enabled = 0;
+                GLint arrayInteger = 0;
+                GLint arrayType = 0;
+                gl.glGetVertexAttribiv(static_cast<GLuint>(location), GL_VERTEX_ATTRIB_ARRAY_ENABLED, &enabled);
+                if (!enabled) continue;
+                gl.glGetVertexAttribiv(static_cast<GLuint>(location), GL_VERTEX_ATTRIB_ARRAY_INTEGER, &arrayInteger);
+                gl.glGetVertexAttribiv(static_cast<GLuint>(location), GL_VERTEX_ATTRIB_ARRAY_TYPE, &arrayType);
+                if (IntegerAttributeTypeFitsInput(type, arrayInteger != 0, static_cast<unsigned>(arrayType))) continue;
+                NoteViolation(program, name.data(), location, type, arrayInteger, arrayType);
+                violated = true;
+            }
+        }
+
+        // One hook per driver entry point: the original is kept beside it and called after the
+        // inspection, with the arguments untouched.
+#define MGITEST_HOOK(name, before)                                                                                     \
+    struct Hook_##name {                                                                                               \
+        static inline decltype(MGB::g_GLESFuncs.name) original = nullptr;                                              \
+        template <typename... Args>                                                                                    \
+        static void Call(Args... args) {                                                                               \
+            before();                                                                                                  \
+            original(args...);                                                                                         \
+        }                                                                                                              \
+        static void Install() {                                                                                        \
+            if (original != nullptr || MGB::g_GLESFuncs.name == nullptr) return;                                       \
+            original = MGB::g_GLESFuncs.name;                                                                          \
+            MGB::g_GLESFuncs.name = &Call;                                                                             \
+        }                                                                                                              \
+        static void Remove() {                                                                                         \
+            if (original == nullptr) return;                                                                           \
+            MGB::g_GLESFuncs.name = original;                                                                          \
+            original = nullptr;                                                                                        \
+        }                                                                                                              \
+    };
+
+        void CountLink() {
+            ++g_tally.links;
+        }
+
+        MGITEST_HOOK(glDrawArrays, InspectDraw)
+        MGITEST_HOOK(glDrawElements, InspectDraw)
+        MGITEST_HOOK(glDrawRangeElements, InspectDraw)
+        MGITEST_HOOK(glDrawArraysInstanced, InspectDraw)
+        MGITEST_HOOK(glDrawElementsInstanced, InspectDraw)
+        MGITEST_HOOK(glDrawArraysIndirect, InspectDraw)
+        MGITEST_HOOK(glDrawElementsIndirect, InspectDraw)
+        MGITEST_HOOK(glDrawElementsBaseVertex, InspectDraw)
+        MGITEST_HOOK(glDrawRangeElementsBaseVertex, InspectDraw)
+        MGITEST_HOOK(glDrawElementsInstancedBaseVertex, InspectDraw)
+        MGITEST_HOOK(glMultiDrawArraysIndirectEXT, InspectDraw)
+        MGITEST_HOOK(glMultiDrawElementsIndirectEXT, InspectDraw)
+        MGITEST_HOOK(glMultiDrawElementsBaseVertexEXT, InspectDraw)
+        MGITEST_HOOK(glDrawArraysInstancedBaseInstanceEXT, InspectDraw)
+        MGITEST_HOOK(glDrawElementsInstancedBaseInstanceEXT, InspectDraw)
+        MGITEST_HOOK(glDrawElementsInstancedBaseVertexBaseInstanceEXT, InspectDraw)
+        MGITEST_HOOK(glLinkProgram, CountLink)
+#undef MGITEST_HOOK
+
+#define MGITEST_EACH_HOOK(action)                                                                                      \
+    Hook_glDrawArrays::action();                                                                                       \
+    Hook_glDrawElements::action();                                                                                     \
+    Hook_glDrawRangeElements::action();                                                                                \
+    Hook_glDrawArraysInstanced::action();                                                                              \
+    Hook_glDrawElementsInstanced::action();                                                                            \
+    Hook_glDrawArraysIndirect::action();                                                                               \
+    Hook_glDrawElementsIndirect::action();                                                                             \
+    Hook_glDrawElementsBaseVertex::action();                                                                           \
+    Hook_glDrawRangeElementsBaseVertex::action();                                                                      \
+    Hook_glDrawElementsInstancedBaseVertex::action();                                                                  \
+    Hook_glMultiDrawArraysIndirectEXT::action();                                                                       \
+    Hook_glMultiDrawElementsIndirectEXT::action();                                                                     \
+    Hook_glMultiDrawElementsBaseVertexEXT::action();                                                                   \
+    Hook_glDrawArraysInstancedBaseInstanceEXT::action();                                                               \
+    Hook_glDrawElementsInstancedBaseInstanceEXT::action();                                                             \
+    Hook_glDrawElementsInstancedBaseVertexBaseInstanceEXT::action();                                                   \
+    Hook_glLinkProgram::action();
+
+        void StartOnDriverThread() {
+            g_tally = {};
+            if (!g_watching) {
+                MGITEST_EACH_HOOK(Install)
+            }
+            g_watching = true;
+        }
+
+        void StopOnDriverThread() {
+            if (g_watching) {
+                MGITEST_EACH_HOOK(Remove)
+            }
+            g_watching = false;
+        }
+#undef MGITEST_EACH_HOOK
+
+        // "Is Espryt the backend running": on any other backend no ES entry point was resolved.
+        bool EsprytIsRunning() {
+            return MGB::g_GLESFuncs.glDrawArrays != nullptr || Hook_glDrawArrays::original != nullptr;
+        }
+
+#if MOBILEGL_BUILD_DISAGGREGATED
+        bool InProcess() {
+            return MobileGL::MG_Config::Transport == MobileGL::MG_Config::TransportMode::InProcess;
+        }
+
+        // Runs `body` on the apply thread once every record published so far has been applied.
+        template <typename Body>
+        bool OnApplyThread(Body body) {
+            auto* session = MobileGL::MG_Remote::Client::ClientSession::Active();
+            if (session == nullptr) return false;
+            if (session->WaitForApplied(session->LastPublishedSeq(), 30000) !=
+                MobileGL::MG_Remote::Transport::SessionWait::Reached)
+                return false;
+            const auto result = MobileGL::MG_Remote::Server::ServerLoopInstance().RunProbeOnApplyThreadForTesting(
+                +[](void* opaque) -> MobileGLResult {
+                    (*static_cast<Body*>(opaque))();
+                    return MOBILEGL_OK;
+                },
+                &body);
+            return result == MOBILEGL_OK;
+        }
+#endif
+    } // namespace
+
+    bool StartIntegerAttributeTypeWatch(std::string* whyNot) {
+        std::string reason;
+        bool started = false;
+        if (MobileGL::MG_Config::Transport == MobileGL::MG_Config::TransportMode::Monolith) {
+            if (EsprytIsRunning()) {
+                StartOnDriverThread();
+                started = true;
+            } else {
+                reason = "the backend running is not DirectGLES";
+            }
+        }
+#if MOBILEGL_BUILD_DISAGGREGATED
+        else if (InProcess()) {
+            bool espryt = false;
+            const bool reached = OnApplyThread([&]() {
+                espryt = EsprytIsRunning();
+                if (espryt) StartOnDriverThread();
+            });
+            started = reached && espryt;
+            if (!started)
+                reason = reached ? "the backend running is not DirectGLES" : "the apply thread did not answer";
+        }
+#endif
+        else {
+            reason = "the server runs in another process";
+        }
+        if (!started && whyNot != nullptr) *whyNot = reason;
+        return started;
+    }
+
+    bool ReadIntegerAttributeTypeWatch(IntegerAttributeTypeTally* out) {
+        if (out == nullptr) return false;
+#if MOBILEGL_BUILD_DISAGGREGATED
+        if (InProcess()) {
+            bool watching = false;
+            if (!OnApplyThread([&]() {
+                    watching = g_watching;
+                    *out = g_tally;
+                }))
+                return false;
+            return watching;
+        }
+#endif
+        if (MobileGL::MG_Config::Transport != MobileGL::MG_Config::TransportMode::Monolith || !g_watching) return false;
+        *out = g_tally;
+        return true;
+    }
+
+    void StopIntegerAttributeTypeWatch() {
+#if MOBILEGL_BUILD_DISAGGREGATED
+        if (InProcess()) {
+            OnApplyThread([]() { StopOnDriverThread(); });
+            return;
+        }
+#endif
+        if (MobileGL::MG_Config::Transport == MobileGL::MG_Config::TransportMode::Monolith) StopOnDriverThread();
+    }
+#else
+    bool StartIntegerAttributeTypeWatch(std::string* whyNot) {
+        if (whyNot != nullptr) *whyNot = "Espryt's driver table is not reachable in this build";
+        return false;
+    }
+    bool ReadIntegerAttributeTypeWatch(IntegerAttributeTypeTally*) {
+        return false;
+    }
+    void StopIntegerAttributeTypeWatch() {}
+#endif
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/IntegerAttributeTypePeek.h

@@ -0,0 +1,49 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/IntegerAttributeTypePeek.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// What Espryt hands the ES driver for each integer vertex input, checked at every draw the driver
+// receives. ES defines an integer attribute's value only when the array's type has the input's
+// signedness (BYTE/SHORT/INT for int, the unsigned three for uint) and a float input only from a
+// float array; anything else is undefined, and a driver that sign-extends GL_UNSIGNED_BYTE data
+// into an ivec4 input is within its rights. Values alone cannot show this on a driver that happens
+// to zero-extend, so the watch reads the driver's own vertex array state at each draw.
+//
+// A SEPARATE TRANSLATION UNIT for PipeApplyPeek.h's reason: it includes Espryt's own headers,
+// which may not meet a scenario's GL headers. Every entry point returns false where it cannot
+// look - Android, a backend other than DirectGLES, and a server in another process - and a caller
+// that gets false has learned nothing.
+
+#pragma once
+
+#include <string>
+
+namespace MGITest {
+
+    struct IntegerAttributeTypeTally {
+        // Draws the driver received while the watch was on, and how many of them had at least one
+        // enabled array whose type the program's input cannot read with a defined value.
+        unsigned draws = 0;
+        unsigned violations = 0;
+        // glLinkProgram calls the driver received, for the cases that bound relinks.
+        unsigned links = 0;
+        // The first violation, spelled out for the failure message.
+        std::string firstViolation;
+    };
+
+    // Starts a fresh tally. False where the watch cannot run; `whyNot` then names the reason.
+    bool StartIntegerAttributeTypeWatch(std::string* whyNot);
+    // The tally so far, once every draw issued before the call has reached the driver.
+    bool ReadIntegerAttributeTypeWatch(IntegerAttributeTypeTally* out);
+    // Puts the driver's entry points back. Harmless when no watch is running.
+    void StopIntegerAttributeTypeWatch();
+
+    // The rule the watch applies to one enabled array: whether an input of GL type `inputType`
+    // reads an array declared (`arrayInteger`, `arrayType`) with a value ES defines.
+    bool IntegerAttributeTypeFitsInput(unsigned inputType, bool arrayInteger, unsigned arrayType);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PersistentMapPeek.cpp

@@ -103,4 +103,28 @@ namespace MGITest {
 #endif
     }
 
+    bool ForgetLivePersistentMap(unsigned int bufferName) {
+#if defined(MGITEST_PERSISTENT_MAP_TRACKER_LIVE)
+        MobileGL::MG_State::GLState::BufferObject* buffer = FrontendBuffer(bufferName);
+        if (buffer == nullptr) return false;
+        MobileGL::MG_Record::PersistentMapTracker::Instance().Forget(*buffer);
+        return true;
+#else
+        (void)bufferName;
+        return false;
+#endif
+    }
+
+    bool ReannounceLivePersistentMap(unsigned int bufferName) {
+#if defined(MGITEST_PERSISTENT_MAP_TRACKER_LIVE)
+        MobileGL::MG_State::GLState::BufferObject* buffer = FrontendBuffer(bufferName);
+        if (buffer == nullptr) return false;
+        buffer->NotePersistentMapStateChanged();
+        return true;
+#else
+        (void)bufferName;
+        return false;
+#endif
+    }
+
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PersistentMapPeek.h

@@ -58,6 +58,15 @@ namespace MGITest {
     // Same contract as above: false means "could not look".
     bool PeekBufferIsLivePersistentMap(unsigned int bufferName, bool* outLive);
 
+    // The two production calls that take a buffer out of the tracker's set and put it back:
+    // PersistentMapTracker::Forget, which an unmap or a destroy reaches, and
+    // BufferObject::NotePersistentMapStateChanged, which every map-state change makes. They let
+    // a scenario show the push is the only route a coherent write takes to the server.
+    //
+    // Same contract: false means "could not reach the tracker", and nothing was changed.
+    bool ForgetLivePersistentMap(unsigned int bufferName);
+    bool ReannounceLivePersistentMap(unsigned int bufferName);
+
     // Separate-process clients own these counters; the remote Present window
     // belongs to the server and cannot report client map acquisitions or bytes.
     bool PeekSeparateClientMapStats(unsigned long long* acquisitions, unsigned long long* pushedBytes);

MobileGL/MG_IntegrationTest/Harness/PoisonOmissionArm.cpp

@@ -0,0 +1,39 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/PoisonOmissionArm.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "PoisonOmissionArm.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Impl/Pipe/PipeFill.h>
+#if MOBILEGL_PIPE_VERIFY
+#define MGITEST_POISON_OMISSION_ARM_LIVE 1
+#endif
+#endif
+
+namespace MGITest {
+
+#if defined(MGITEST_POISON_OMISSION_ARM_LIVE)
+    bool PoisonOmissionArmAvailable() {
+        return true;
+    }
+
+    bool ArmPoisonOmission(const char* verb, const char* field) {
+        return MobileGL::MG_Pipe::MGPipeSetPoisonOmission(verb, field);
+    }
+#else
+    bool PoisonOmissionArmAvailable() {
+        return false;
+    }
+
+    bool ArmPoisonOmission(const char*, const char*) {
+        return false;
+    }
+#endif
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PoisonOmissionArm.h

@@ -0,0 +1,34 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/PoisonOmissionArm.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// NEGATIVE CONTROL B'S OMISSION, ARMED FROM THE HARNESS. PoisonOmissionScenario's re-executed
+// child withholds the stamp of one (verb, field) pair before it runs the sequence, so that verb's
+// read of the field must be Fatal{UnmigratedPipeInput, "<Field>@<Verb>"}. The library has no knob
+// for it: only a -DMOBILEGL_PIPE_VERIFY=ON build compiles the setter (MG_Impl/Pipe/PipeFill.h,
+// MGPipeSetPoisonOmission), and this file is the one place that calls it.
+//
+// A SEPARATE TRANSLATION UNIT for PipeApplyPeek's reason, verbatim: the scenario sources include
+// the GL headers with prototypes and the pipe headers are not meant to meet them in one file.
+//
+// Both entry points return false, touching nothing, where the setter is out of reach: a build
+// without MOBILEGL_PIPE_VERIFY, or Android, where this module links the shipping libMobileGL.so
+// built -fvisibility=hidden.
+
+#pragma once
+
+namespace MGITest {
+
+    // True when this build can arm the omission at all.
+    bool PoisonOmissionArmAvailable();
+
+    // Withholds the stamp of `field` at `verb` (kMGPipeVerbNames / kMGPipeInputFieldNames spellings)
+    // for the rest of this process, in the client's fill and in the server's verb stamp. Call it on
+    // the thread that issues the GL calls. False when the build cannot, or a name is unknown.
+    bool ArmPoisonOmission(const char* verb, const char* field);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/ScenarioFixture.h

@@ -158,11 +158,21 @@ namespace MGITest {
                 // entries had no runtime evidence of anything, and their green meant only "the
                 // same GL workload passed").
                 const SplitRuntimeState state = PeekSplitRuntime();
+                // The transport the registration claims must be the one this process resolved,
+                // served where it says: a thread here for inproc, a process of its own for spawn
+                // and tcp. A lane that ran some other transport fails here, by name.
+                const std::string claimMismatch = SplitLane::TransportClaimMismatch(
+                    SplitLane::MarkerValue("MOBILEGL_TRANSPORT"), SplitLane::MarkerValue("MOBILEGL_IPC_CONTROL"),
+                    state.transportName, state.peerServerPid, state.selfPid);
+                if (!claimMismatch.empty()) {
+                    FAIL() << claimMismatch;
+                }
                 m_splitAssertionsArmed = true;
                 m_emitSeqAtSetUp = state.emitSeq;
                 RecordProperty("split_transport", state.transportName);
                 RecordProperty("split_implemented_verbs", static_cast<int>(state.implementedVerbs));
                 RecordProperty("split_emit_seq_at_setup", static_cast<int>(state.emitSeq));
+                RecordProperty("split_peer_server_pid", std::to_string(state.peerServerPid));
 #if defined(__linux__)
                 if (std::getenv("MGITEST_TCP_LANE")) {
                     // Connect must never silently launch a local server. The

MobileGL/MG_IntegrationTest/Harness/SplitLane.h

@@ -84,6 +84,36 @@ namespace MGITest::SplitLane {
         return SplitRuntimeSkipReason();
     }
 
+    // The transport a registration claims, against what this process resolved and which process
+    // serves it; empty when they agree. claimedTransport and claimedControl are the entry's own
+    // MOBILEGL_TRANSPORT and MOBILEGL_IPC_CONTROL; the rest comes from PeekSplitRuntime(). In
+    // process, the server role is a thread here and states this process's pid; spawn and tcp
+    // need a server process of their own. A registration that claims no transport is not judged,
+    // and an unknown own pid (0) leaves only the comparison with it unjudged.
+    inline std::string TransportClaimMismatch(const std::string& claimedTransport, const std::string& claimedControl,
+                                              const std::string& resolvedName, unsigned long long peerPid,
+                                              unsigned long long selfPid) {
+        const bool tcp = claimedControl.rfind("tcp://", 0) == 0;
+        const bool selfKnown = selfPid != 0;
+        const std::string pids =
+            " (server pid " + std::to_string(peerPid) + ", this process " + std::to_string(selfPid) + ")";
+        if (claimedTransport == "inproc" && !tcp) {
+            if (resolvedName != "inproc" || peerPid == 0 || (selfKnown && peerPid != selfPid)) {
+                return "this registration claims MOBILEGL_TRANSPORT=inproc, but the process resolved '" + resolvedName +
+                       "' with its server role in another process or none" + pids;
+            }
+            return {};
+        }
+        if (claimedTransport == "spawn" || tcp) {
+            const std::string claim = tcp ? "tcp (MOBILEGL_IPC_CONTROL=" + claimedControl + ")" : "spawn";
+            if (resolvedName != "spawn" || peerPid == 0 || (selfKnown && peerPid == selfPid)) {
+                return "this registration claims " + claim + ", but the process resolved '" + resolvedName +
+                       "' without a server process of its own" + pids;
+            }
+        }
+        return {};
+    }
+
     // "adopted", "emulated", or empty when the lane declared nothing.
     inline std::string DeclaredPersistentMapArm() {
         return MarkerValue("MGITEST_PERSISTENT_MAP_ARM");

MobileGL/MG_IntegrationTest/Harness/SplitLaneHarnessTest.cpp

@@ -0,0 +1,64 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/SplitLaneHarnessTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// SplitLane::TransportClaimMismatch on canned inputs: each claim must be refused when the process
+// resolved another transport or the wrong process serves it, and accepted when both agree.
+
+#include "SplitLane.h"
+
+#include <gtest/gtest.h>
+
+namespace {
+
+    using MGITest::SplitLane::TransportClaimMismatch;
+
+    constexpr unsigned long long kSelf = 4242;
+    constexpr unsigned long long kServer = 4343;
+
+    TEST(SplitLaneHarness, AnInprocClaimNeedsTheServerThreadHere) {
+        EXPECT_EQ(TransportClaimMismatch("inproc", "", "inproc", kSelf, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "", "spawn", kServer, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "", "inproc", kServer, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "", "inproc", 0, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "", "monolith", 0, kSelf), "");
+    }
+
+    TEST(SplitLaneHarness, ASpawnClaimNeedsAServerProcessOfItsOwn) {
+        EXPECT_EQ(TransportClaimMismatch("spawn", "", "spawn", kServer, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("spawn", "", "inproc", kSelf, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("spawn", "", "spawn", kSelf, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("spawn", "", "spawn", 0, kSelf), "");
+    }
+
+    TEST(SplitLaneHarness, ATcpClaimIsASpawnSessionToAnotherProcess) {
+        EXPECT_EQ(TransportClaimMismatch("spawn", "tcp://127.0.0.1:30613", "spawn", kServer, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("spawn", "tcp://127.0.0.1:30613", "spawn", kSelf, kSelf), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "tcp://127.0.0.1:30613", "inproc", kSelf, kSelf), "");
+    }
+
+    TEST(SplitLaneHarness, NoClaimIsNotJudged) {
+        EXPECT_EQ(TransportClaimMismatch("", "", "monolith", 0, kSelf), "");
+        EXPECT_EQ(TransportClaimMismatch("monolith", "", "monolith", 0, kSelf), "");
+    }
+
+    TEST(SplitLaneHarness, AnUnknownOwnPidStillJudgesTheTransportAndTheServer) {
+        EXPECT_EQ(TransportClaimMismatch("inproc", "", "inproc", kSelf, 0), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "", "spawn", kServer, 0), "");
+        EXPECT_NE(TransportClaimMismatch("inproc", "", "inproc", 0, 0), "");
+        EXPECT_EQ(TransportClaimMismatch("spawn", "", "spawn", kServer, 0), "");
+        EXPECT_NE(TransportClaimMismatch("spawn", "", "inproc", kSelf, 0), "");
+        EXPECT_NE(TransportClaimMismatch("spawn", "", "spawn", 0, 0), "");
+    }
+
+    TEST(SplitLaneHarness, TheRefusalNamesBothPids) {
+        const std::string message = TransportClaimMismatch("spawn", "", "spawn", kSelf, kSelf);
+        EXPECT_NE(message.find("server pid 4242"), std::string::npos) << message;
+        EXPECT_NE(message.find("this process 4242"), std::string::npos) << message;
+    }
+
+} // namespace

MobileGL/MG_IntegrationTest/Harness/SplitLogPaths.cmake.in

@@ -2,6 +2,9 @@
 # CTest appends ENVIRONMENT here; keep all previously discovered lane settings.
 file(MAKE_DIRECTORY "@CMAKE_CURRENT_BINARY_DIR@/split-logs")
 file(MAKE_DIRECTORY "@CMAKE_CURRENT_BINARY_DIR@/verify-split-logs")
+# CtWireScenario reads the server's control-record counters (`ar`, `od`) off the server role's
+# PipeStats line, so its entries turn the counters on with one line per frame.
+set(mglCtWireStatsEnvironment "MOBILEGL_PIPE_STATS=1;MOBILEGL_PIPE_STATS_PERIOD=1")
 # P5b t2's two lanes ride the same rule: one private log path per entry, or
 # SplitLogPaths.PrivateAndDistinct is red for them (ID-53).
 # P5e vi's client-array lane joins the same list for the same reason: its two entries are the
@@ -25,41 +28,46 @@ foreach(listName IN ITEMS @MGL_SPLIT_ARM_TEST_LISTS@)
         elseif(entry MATCHES "PersistentCoherentMapScenario.TheMapLandsInTheArmItsLaneDeclares$")
             set_tests_properties("${entry}" PROPERTIES ENVIRONMENT
                 "MGITEST_PMAP_LANE=1;MGITEST_PERSISTENT_MAP_ARM=emulated;MOBILEGL_PIPE_STATS=1;MOBILEGL_PIPE_STATS_PERIOD=1")
+        elseif(entry MATCHES "PersistentCoherentMapScenario.ThePushIsTheOnlyRouteAWriteTakesToTheServer$")
+            # The case takes the push away, which only the emulated arm has. Every split arm
+            # emulates by default except Magma in process, which is granted T0 and adopts, so
+            # that entry asks for T2 by name, as the Magma buffer lanes do.
+            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "MGITEST_PERSISTENT_MAP_ARM=emulated")
+            if(entry MATCHES "^DirectVulkan\\.Split\\.")
+                set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "MOBILEGL_IPC_ADOPT_TIER=2")
+            endif()
         elseif(entry MATCHES "LargeArenaAdoptionScenario.TheArenaLandsInTheTierItsLaneDeclares$")
             # P11 A2: every split arm runs T2, so the arena is declared emulated.
             set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "MGITEST_PERSISTENT_MAP_ARM=emulated")
         elseif(entry MATCHES "CtWireScenario\\.")
-            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "MOBILEGL_TEST_SERVER_COUNTERS=1")
+            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "${mglCtWireStatsEnvironment}")
         endif()
     endforeach()
 endforeach()
 # P7 package L tier 3: the whole-suite Magma census. A LIST OF ITS OWN, and the log path is the
-# ONLY property it gets - the loop above also arms the strict-arming, pmap and server-counter
+# ONLY property it gets - the loop above also arms the strict-arming, pmap and persistent-map-arm
 # lane markers by entry name, and a census is here to be READ, not to assert three unrelated
 # oracles it never opted into. The path itself is not optional: these entries are
 # DirectVulkan.{Split,Spawn,Tcp}. names, so split_log_paths.py's ownership gate requires exactly
 # one absolute private path each, and on the spawn and tcp arms two processes append to it.
 #
-# ONE EXCEPTION, AND IT IS TELEMETRY RATHER THAN AN ORACLE: CtWireScenario reads the server's
-# own control-record tallies, and without MOBILEGL_TEST_SERVER_COUNTERS=1 they are not published
-# at all - the case then reds on `server control-record telemetry missing`, which says nothing
-# about Magma. Measured: that is exactly what the spawn arm's ApplierReset case did on this
-# tier's first run. A switch that makes a counter readable is not the same kind of thing as the
-# strict-arming, pmap or persistent-map-arm markers above, which make a case ASSERT something it
-# never opted into, and those stay out of the census.
+# One exception, telemetry rather than an oracle: CtWireScenario's counters. Without them the case
+# reds on `server control-record telemetry missing`, which says nothing about Magma, and a switch
+# that makes a counter readable does not make a case assert anything it never opted into, unlike
+# the markers above.
 foreach(listName IN ITEMS @MGL_MAGMA_FULL_TEST_LISTS@)
     foreach(entry IN LISTS ${listName})
         set_tests_properties("${entry}" PROPERTIES ENVIRONMENT
             "MOBILEGL_LOG_FILE_PATH=@CMAKE_CURRENT_BINARY_DIR@/split-logs/${entry}.log")
         if(entry MATCHES "CtWireScenario\\.")
-            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "MOBILEGL_TEST_SERVER_COUNTERS=1")
+            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "${mglCtWireStatsEnvironment}")
         endif()
     endforeach()
 endforeach()
 # P7 wave 3 (V1): the verify comparator on the split arm. A LIST OF ITS OWN, like tier 3's and
-# for tier 3's reason - the first loop also arms the strict-arming, pmap and server-counter lane
+# for tier 3's reason - the first loop also arms the strict-arming, pmap and persistent-map-arm lane
 # markers by entry name, and this lane is here to compare fields, not to opt three unrelated
-# oracles into a whole-binary set.
+# oracles into a whole-binary set. CtWireScenario's counters are the same exception as tier 3's.
 #
 # THE PATH IS WHAT MAKES THE LANE ARMED RATHER THAN MERELY GREEN. These entries carry no
 # MGITEST_SPLIT_LANE marker (MG_IntegrationTest/CMakeLists.txt says why: it reds 13 query-only
@@ -72,8 +80,22 @@ foreach(listName IN ITEMS @MGL_VERIFY_SPLIT_TEST_LISTS@)
     foreach(entry IN LISTS ${listName})
         set_tests_properties("${entry}" PROPERTIES ENVIRONMENT
             "MOBILEGL_LOG_FILE_PATH=@CMAKE_CURRENT_BINARY_DIR@/verify-split-logs/${entry}.log")
+        if(entry MATCHES "CtWireScenario\\.")
+            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "${mglCtWireStatsEnvironment}")
+        endif()
     endforeach()
 endforeach()
+# The ambient CtWireScenario cases that count control records take the counters and a log of their
+# own as well: the integration job's inproc leg runs them on the inproc transport it exports (under
+# monolith they skip). Only those three: a log would also arm the RoleViolation case's check of the
+# guard's line, which the ambient entries never ran. The log is outside split-logs/, which holds
+# the split arms' entries.
+foreach(entry IN LISTS MGL_AMBIENT_TESTS_GLES MGL_AMBIENT_TESTS_VULKAN)
+    if(entry MATCHES "CtWireScenario\\.(ApplierReset|TextureDeath|FramebufferDeath)")
+        set_tests_properties("${entry}" PROPERTIES ENVIRONMENT
+            "MOBILEGL_LOG_FILE_PATH=@CMAKE_CURRENT_BINARY_DIR@/ct-wire-${entry}.log;${mglCtWireStatsEnvironment}")
+    endif()
+endforeach()
 
 foreach(entry IN LISTS MGL_SPLIT_PA_STRICT_DRAW_TESTS MGL_SPLIT_PA_STRICT_DISPATCH_TESTS)
     set_tests_properties("${entry}" PROPERTIES ENVIRONMENT
@@ -89,6 +111,8 @@ foreach(scenario @MGL_SPLIT_SMALL_RING_SCENARIOS@)
         elseif(entry MATCHES "PersistentCoherentMapScenario.TheMapLandsInTheArmItsLaneDeclares$")
             set_tests_properties("${entry}" PROPERTIES ENVIRONMENT
                 "MGITEST_PMAP_LANE=1;MGITEST_PERSISTENT_MAP_ARM=emulated;MOBILEGL_PIPE_STATS=1;MOBILEGL_PIPE_STATS_PERIOD=1")
+        elseif(entry MATCHES "PersistentCoherentMapScenario.ThePushIsTheOnlyRouteAWriteTakesToTheServer$")
+            set_tests_properties("${entry}" PROPERTIES ENVIRONMENT "MGITEST_PERSISTENT_MAP_ARM=emulated")
         endif()
     endforeach()
 endforeach()

MobileGL/MG_IntegrationTest/Harness/SplitRuntimePeek.cpp

@@ -25,6 +25,11 @@
 #include <chrono>
 #include <atomic>
 #include <thread>
+#if defined(_WIN32)
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
 #define MGITEST_SPLIT_RUNTIME_PEEK_LIVE 1
 #endif
 // P13 W5: THE RECORD-ARM HALF OF THE PEEK, which needs no transport. A library built with the
@@ -141,6 +146,9 @@ namespace MGITest {
         case TransportMode::InProcess:
             state.transportName = "inproc";
             break;
+        case TransportMode::Spawn:
+            state.transportName = "spawn";
+            break;
         default:
             state.transportName = "non-monolith";
             break;
@@ -154,11 +162,17 @@ namespace MGITest {
         MobileGL::MG_Remote::Client::ClientSession* session = MobileGL::MG_Remote::Client::ClientSession::Active();
         state.sessionActive = session != nullptr;
         state.implementedVerbs = MobileGL::MG_Remote::Client::ImplementedVerbCount();
+#if defined(_WIN32)
+        state.selfPid = static_cast<unsigned long long>(::_getpid());
+#else
+        state.selfPid = static_cast<unsigned long long>(::getpid());
+#endif
         if (session != nullptr) {
             // Encoder() returns the member; EmitSeq() returns m_emitSeq. Neither is a stub, and
             // neither emits anything - this is a read.
             const MobileGL::MG_Remote::Wire::PipeWireEncoder& encoder = session->Encoder();
             state.emitSeq = encoder.EmitSeq();
+            state.peerServerPid = session->PeerServerPid();
             state.runAheadArmed = session->RunAheadArmed();
             // P7 wave 2 package C, OQ-10: read through the SAME accessor the frontend's own
             // MGPipeResourceOpsHaveSubDataResident reads (MG_Impl/Pipe/PipeFill.cpp), so a

MobileGL/MG_IntegrationTest/Harness/SplitRuntimePeek.h

@@ -74,6 +74,11 @@ namespace MGITest {
         unsigned int totalVerbSlots = 0;
         // The encoder's highest produced record ordinal, or 0 when there is no session.
         unsigned long long emitSeq = 0;
+        // ClientSession::PeerServerPid(), the pid the server stated in its Welcome (0 without a
+        // session), and this process's own (0 when unknown), so a lane can tell a server thread
+        // here from a server process elsewhere.
+        unsigned long long peerServerPid = 0;
+        unsigned long long selfPid = 0;
         // Real session state/watermarks. Only the client thread reads this snapshot;
         // the scheduling observer below reads producerParked separately.
         bool runAheadArmed = false;

MobileGL/MG_IntegrationTest/Harness/split_log_paths.py

@@ -7,8 +7,7 @@
 # SPDX-License-Identifier: LGPL-3.0-only
 # End of Source File Header
 
-"""Validate discovered Split log ownership; read only freshly reset control logs."""
-import os
+"""Validate discovered Split log ownership and read the entries' private logs."""
 import json
 from pathlib import Path
 import re
@@ -306,6 +305,72 @@ def require_green(document, junit_path, required):
     print(f"SplitLogPaths require-green: {len(by_name)} PASS, 0 skip, 0 failed, complete discovery")
 
 
+# The client's one-line IPC configuration (ConfigLoader, every non-monolith transport, INFO) and
+# the knobs an entry may pin in its own ENVIRONMENT instead of inheriting the lane's.
+IPC_LINE = "Config: IPC "
+IPC_PINS = {"strict": "MOBILEGL_IPC_STRICT_ERRORS", "role-split-state": "MOBILEGL_IPC_ROLE_SPLIT_STATE",
+            "run-ahead": "MOBILEGL_IPC_RUN_AHEAD"}
+
+
+def entry_environment(test):
+    env = {}
+    for prop in test.get("properties", []):
+        if prop.get("name") == "ENVIRONMENT":
+            for item in prop.get("value") or []:
+                key, _, value = item.partition("=")
+                env[key] = value
+    return env
+
+
+def ipc_config(document, junit_path, expected, assumed=()):
+    """Prove, from each passed entry's own client log, the IPC knobs the run resolved.
+
+    Every entry that passed and has a private log must show `key=value` on its last "Config: IPC"
+    line, where value is the entry's own ENVIRONMENT pin when it has one and the expected value
+    otherwise; monolith-pinned entries have no such line and are left out. Returns (code, summary):
+    0 proven; 3 when the only mismatches are on `assumed` keys of entries that do not pin them (a
+    default that changed); 1 for anything else, including no evidence at all."""
+    passed = set()
+    for case in ET.parse(junit_path).getroot().iter("testcase"):
+        failed = case.find("failure") is not None or case.find("error") is not None
+        skipped = case.find("skipped") is not None or case.get("status") in ("notrun", "disabled")
+        if not failed and not skipped:
+            passed.add(case.get("name"))
+    problems, defaults, checked = [], [], []
+    for test in document.get("tests", []):
+        name = test["name"]
+        env = entry_environment(test)
+        transport = env.get("MOBILEGL_TRANSPORT", "")
+        base = env.get("MOBILEGL_LOG_FILE_PATH", "")
+        if name not in passed or transport == "monolith" or not base:
+            continue
+        client = Path(role_paths(base)[0])
+        lines = [line for line in (client.read_text(errors="replace") if client.is_file() else "").splitlines()
+                 if IPC_LINE in line]
+        if not lines:
+            if transport == "inproc":
+                problems.append(f"{name}: passed under inproc but {client} carries no '{IPC_LINE.strip()}' line")
+            continue
+        checked.append(name)
+        for key, value in expected.items():
+            want = env.get(IPC_PINS.get(key, ""), value)
+            found = re.search(r"(?:^| )" + re.escape(key) + r"=(\S*)", lines[-1])
+            got = found.group(1) if found else "<absent>"
+            if got == want:
+                continue
+            row = f"{name}: {key}={got}, expected {want}"
+            if key in assumed and IPC_PINS.get(key) not in env:
+                defaults.append(row)
+            else:
+                problems.append(row)
+    if not checked:
+        problems.append("no passed entry left a 'Config: IPC' line, so nothing proves the configuration")
+    summary = {"checked": len(checked), "expected": expected, "assumed": sorted(assumed),
+               "problems": problems, "default_mismatches": defaults}
+    code = 1 if problems else 3 if defaults else 0
+    return code, summary
+
+
 VERIFY_ARMED_LINE = "MGPipe: verify armed"
 
 
@@ -616,66 +681,24 @@ def main():
     if mode == "require-green":
         require_green(json.loads(Path(sys.argv[2]).read_text()), sys.argv[3], sys.argv[4:])
         return
-    selected = paths(json.loads(Path(sys.argv[2]).read_text()))
-    selected = {name: path for name, path in selected.items() if re.search(sys.argv[3], name)}
-    # The SAME exclusion run_control hands ctest -E. Without it this helper and ctest disagree
-    # about the subject set, and the helper reports an entry ctest never ran as "did not run"
-    # (P5e, ID-122). ctest -R is POSIX ERE and cannot express the exclusion inline.
-    _excl = os.environ.get("SPLIT_LOG_EXCLUDE", "")
-    if _excl:
-        selected = {n: q for n, q in selected.items() if not re.search(_excl, n)}
-    if not selected:
-        raise ValueError(f"integration-split: empty selection for {sys.argv[3]}")
-    if mode == "reset":
-        for path in selected.values():
-            Path(path).unlink(missing_ok=True)
-    elif mode == "results":
-        cases = ET.parse(sys.argv[4]).getroot().findall(".//testcase")
-        label = sys.argv[5]
-        by_name = {}
-        for case in cases:
-            by_name.setdefault(case.get("name"), []).append(case)
-        skipped = sum(any(c.find("skipped") is not None for c in by_name.get(n, []))
-                      for n in selected)
-        # ID-62: pre-flight Fatal is not evidence that a selected entry ran.
-        if skipped:
-            raise ValueError(f"{label} control: the knob killed the pre-flight, not the entry - "
-                             f"{skipped} selected entries skipped")
-        missing = sum(len(by_name.get(n, [])) != 1 or
-                      by_name[n][0].get("status") in ("notrun", "disabled") for n in selected)
-        if missing:
-            raise ValueError(f"{label} control: {missing} selected entries did not run")
-        not_failed = sum(c.find("failure") is None or c.get("status") != "fail"
-                         for n in selected for c in by_name[n])
-        if not_failed:
-            raise ValueError(f"{label} control: {not_failed} selected entries did not fail")
-    elif mode == "assertion":
-        cases = ET.parse(sys.argv[4]).getroot().findall(".//testcase")
-        by_name = {case.get("name"): case for case in cases}
-        for name in selected:
-            case = by_name.get(name)
-            output = "" if case is None else " ".join(" ".join(case.itertext()).split())
-            if not re.search(sys.argv[5], output):
-                raise ValueError(f"E3(a) FAILED: {name} red lacks its persistent-map push diagnostic")
-    elif mode == "evidence":
-        missing = []
-        label = sys.argv[5] if len(sys.argv) > 5 else ""
-        for name, path in selected.items():
-            if any_role_file(path) and re.search(sys.argv[4], read_role_logs(path)):
-                print(f"private-log evidence: {name}: {path}")
-            else:
-                missing.append(f"{name} ({path})")
-        if missing:
-            if label:
-                raise ValueError(f"{label} FAILED: no selected private log carries /{sys.argv[4]}/. "
-                                 "The library's own line is the only channel for this: ctest's "
-                                 "transcript is a FALSE ZERO for library output, because the console "
-                                 "sink is compiled out of the configurations these lanes run. "
-                                 + ", ".join(missing))
-            raise ValueError("E1 FAILED: selected private logs lack expected Fatal{BarrierViolation, \"<slot>\"} line: "
-                             + ", ".join(missing))
-    else:
-        raise ValueError(f"unknown mode: {mode}")
+    if mode == "ipc-config":
+        # <lane.json> <junit> <summary.json> key=value... [--assumed k1,k2]
+        args = sys.argv[5:]
+        assumed = set()
+        if "--assumed" in args:
+            at = args.index("--assumed")
+            assumed = {key for key in args[at + 1].split(",") if key}
+            args = args[:at] + args[at + 2:]
+        expected = dict(arg.split("=", 1) for arg in args)
+        code, summary = ipc_config(json.loads(Path(sys.argv[2]).read_text()), sys.argv[3], expected, assumed)
+        Path(sys.argv[4]).write_text(json.dumps(summary, indent=1) + "\n")
+        for row in summary["problems"] + summary["default_mismatches"]:
+            print(f"SplitLogPaths ipc-config: {row}")
+        print(f"SplitLogPaths ipc-config: {summary['checked']} entr(ies) checked against "
+              f"{' '.join(f'{k}={v}' for k, v in expected.items())}: "
+              f"{['proven', '', '', 'a default differs'][code] if code != 1 else 'FAILED'}")
+        sys.exit(code)
+    raise ValueError(f"unknown mode: {mode}")
 
 
 if __name__ == "__main__":

MobileGL/MG_IntegrationTest/Harness/test_split_log_paths.py

@@ -262,5 +262,79 @@ class VerifySplitArmProofTest(unittest.TestCase):
             self.proof()
 
 
+class IpcConfigProofTest(unittest.TestCase):
+    """ipc-config reads each passed entry's own client log for the knobs the run resolved."""
+
+    LINE = "Config: IPC ring=8MiB run-ahead={ra} present-credit=2 strict={st} audit=0 role-split-state={rs} surface=x"
+
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.root = Path(self.temp.name)
+        self.xml = self.root / "run.xml"
+
+    def tearDown(self):
+        self.temp.cleanup()
+
+    def lane(self, rows):
+        """rows: (name, status, pins, log line or None)."""
+        tests, suite = [], ET.Element("testsuite")
+        for i, (name, status, pins, line) in enumerate(rows):
+            base = self.root / f"{i}.log"
+            if line is not None:
+                (self.root / f"{i}.client.log").write_text("Config: MOBILEGL_TRANSPORT=inproc\n" + line + "\n")
+            env = ["MOBILEGL_LOG_FILE_PATH=" + str(base)] + pins
+            tests.append({"name": name, "properties": [{"name": "ENVIRONMENT", "value": env}]})
+            case = ET.SubElement(suite, "testcase", name=name, status="run")
+            if status == "skip":
+                ET.SubElement(case, "skipped")
+            if status == "fail":
+                ET.SubElement(case, "failure")
+        ET.ElementTree(suite).write(self.xml)
+        return {"tests": tests}
+
+    def check(self, rows, expected=None, assumed=("role-split-state", "run-ahead")):
+        expected = expected or {"strict": "0", "role-split-state": "1", "run-ahead": "1"}
+        with contextlib.redirect_stdout(io.StringIO()):
+            return helper.ipc_config(self.lane(rows), self.xml, expected, set(assumed))[0]
+
+    def inproc(self, ra="1", st="0", rs="1"):
+        return ["MOBILEGL_TRANSPORT=inproc"], self.LINE.format(ra=ra, st=st, rs=rs)
+
+    def test_the_defaults_are_proven(self):
+        pins, line = self.inproc()
+        self.assertEqual(self.check([("A", "pass", pins, line), ("B", "skip", pins, None)]), 0)
+
+    def test_a_changed_default_is_exit_three(self):
+        pins, line = self.inproc(rs="0")
+        self.assertEqual(self.check([("A", "pass", pins, line)]), 3)
+
+    def test_an_unassumed_key_that_differs_is_red(self):
+        pins, line = self.inproc(st="1")
+        self.assertEqual(self.check([("A", "pass", pins, line)]), 1)
+
+    def test_a_passed_inproc_entry_without_the_line_is_red(self):
+        pins, line = self.inproc()
+        self.assertEqual(self.check([("A", "pass", pins, line), ("B", "pass", pins, None)]), 1)
+
+    def test_no_evidence_is_red(self):
+        pins, _ = self.inproc()
+        self.assertEqual(self.check([("A", "skip", pins, None)]), 1)
+
+    def test_an_entry_pin_overrides_the_expectation(self):
+        pins, line = self.inproc(ra="0")
+        self.assertEqual(self.check([("A", "pass", pins + ["MOBILEGL_IPC_RUN_AHEAD=0"], line)]), 0)
+        self.assertEqual(self.check([("A", "pass", pins + ["MOBILEGL_IPC_RUN_AHEAD=1"], line)]), 1,
+                         "a pinned value the run did not honour is red, not a changed default")
+
+    def test_the_value_is_matched_whole(self):
+        pins, line = self.inproc(ra="10")
+        self.assertEqual(self.check([("A", "pass", pins, line)]), 3)
+
+    def test_monolith_pinned_entries_are_left_out(self):
+        pins, line = self.inproc()
+        rows = [("A", "pass", pins, line), ("M", "pass", ["MOBILEGL_TRANSPORT=monolith"], None)]
+        self.assertEqual(self.check(rows), 0)
+
+
 if __name__ == "__main__":
     unittest.main()

MobileGL/MG_IntegrationTest/Harness/verify-split-unarmed-expected.txt

@@ -151,3 +151,12 @@ DirectGLES.VerifySplit.ScenarioIsolationScenario.ACaseLeavesItsDeletedProgramCur
 DirectGLES.VerifySplit.ScenarioIsolationScenario.TheNextCaseStartsWithNoProgramCurrentAndNoErrorPending
 DirectVulkan.VerifySplit.ScenarioIsolationScenario.ACaseLeavesItsDeletedProgramCurrentAndAnErrorUnread
 DirectVulkan.VerifySplit.ScenarioIsolationScenario.TheNextCaseStartsWithNoProgramCurrentAndNoErrorPending
+
+# --------------------------------------------------------------------------------------------
+# CANNED-INPUT CHECKS OF A HARNESS RULE - no GL call at all (2)
+# NarrowIntegerAttributeScenario's driver-watch control feeds the array-type rule fixed type
+# pairs and checks its verdicts. It makes no GL call, so no fill point is reached and the
+# arming line is honestly absent.
+# --------------------------------------------------------------------------------------------
+DirectGLES.VerifySplit.NarrowIntegerAttributeScenario.TheDriverWatchRuleRejectsAnArrayOfTheOtherSignedness
+DirectVulkan.VerifySplit.NarrowIntegerAttributeScenario.TheDriverWatchRuleRejectsAnArrayOfTheOtherSignedness

MobileGL/MG_IntegrationTest/P8Coverage.cmake

@@ -90,6 +90,7 @@ set(MGL_P8A_AMBIENT_CASES
     IterationRPScratchFixScenario.*
     LayeredAttachmentBarrierScenario.*
     LayeredAttachmentShapeScenario.*
+    NarrowIntegerAttributeScenario.*
     NonCoreImageFormatScenario.*
     OrientationScenario.*
     P4aFinalFixScenario.*

MobileGL/MG_IntegrationTest/Scenarios/CtWireScenario.cpp

@@ -10,9 +10,10 @@
 //
 // applier_reset (§5.1): this process's first validate primes the pipe tracker, and the
 // FreshlyPrimed edge is the record's producer (MG_Impl/Pipe/PipeFill.cpp). What the scenario
-// asserts is the SERVER sink's own counters - moved by nobody else - plus the pixels, so a
-// reset that never crossed is red by the tally and a client that fell through to the driver
-// is red by ScenarioFixture's emit-ordinal rule.
+// asserts is the server's own count of the control records it applied (`ar` and `od` on the
+// server role's PipeStats line, moved by nobody else) plus the pixels, so a reset that never
+// crossed is red by the count and a client that fell through to the driver is red by
+// ScenarioFixture's emit-ordinal rule.
 //
 // object_death (§5.2): a texture and a framebuffer die, the deaths cross, and the slots
 // recycle. The picture after recycling is the behavioural half: a stale twin answering for
@@ -31,8 +32,6 @@
 #include "../Harness/SplitRuntimePeek.h"
 
 #include <MG_Pipe/PipeApply.h>
-#include <Config.h> // `t6`: the spawn arm cannot observe the server process's counters
-#include <MG_Remote/Server/ServerSession.h>
 
 #if !defined(_WIN32)
 #include <csignal>
@@ -52,36 +51,6 @@
 namespace MGITest {
     namespace {
 
-        MobileGL::MG_Remote::Server::ServerVerbSink& ServerVerbs() {
-            return MobileGL::MG_Remote::Server::ServerSessionInstance().Applier().Verbs();
-        }
-
-        // Inproc reads its local sink. A separate-process session snapshots that
-        // same sink on LogFlush, after the client fences its complete command prefix.
-        // TCP forwards the server log; unix+shm reads the server's local role file.
-        struct CounterSnapshot {
-            bool valid = false;
-            MobileGL::Uint64 resets = 0, serial = 0, deaths = 0;
-        };
-
-        CounterSnapshot ServerCounters() {
-            if (MobileGL::MG_Config::Transport != MobileGL::MG_Config::TransportMode::Spawn) {
-                return {true, ServerVerbs().ApplierResets(), ServerVerbs().ExpectedApplierResetSerial(),
-                        ServerVerbs().ObjectDeaths()};
-            }
-            MGPipeSyncPeerLog();
-            const std::string log = PipeStatsWindow::ReadWholeFile(PipeStatsWindow::ServerLibraryLogPath());
-            const auto at = log.rfind("MGPipe server counters:");
-            if (at == std::string::npos) return {};
-            const PipeStatsWindow::Window window{true, log.substr(at, log.find('\n', at) - at)};
-            const auto resets = PipeStatsWindow::CounterOrAbsent(window, "resets");
-            const auto serial = PipeStatsWindow::CounterOrAbsent(window, "reset-serial");
-            const auto deaths = PipeStatsWindow::CounterOrAbsent(window, "deaths");
-            if (resets < 0 || serial < 0 || deaths < 0) return {};
-            return {true, static_cast<MobileGL::Uint64>(resets), static_cast<MobileGL::Uint64>(serial),
-                    static_cast<MobileGL::Uint64>(deaths)};
-        }
-
         class CtWireScenario : public ScenarioTest {
         protected:
             void SetUp() override {
@@ -109,8 +78,8 @@ namespace MGITest {
             }
 
             // The texture's level-0 content, read back through a throwaway FBO, as four bytes.
-            // The FBO is bound AND deleted here, so it never leaks a framebuffer death into the
-            // tally a case is watching.
+            // The FBO is bound AND deleted here, so its death lands in whichever window is open
+            // and a case that counts deaths reads it outside the window it counts.
             void ReadTextureLevel(GLuint texture, GLubyte out[4]) {
                 GLuint fbo = 0;
                 glGenFramebuffers(1, &fbo);
@@ -120,6 +89,47 @@ namespace MGITest {
                 glBindFramebuffer(GL_FRAMEBUFFER, 0);
                 glDeleteFramebuffers(1, &fbo);
             }
+
+            // The control records the server applied in one window: `ar` (applier_reset records
+            // accepted) and `od` (object_death records dispatched) on the server role's PipeStats
+            // line. The entries set MOBILEGL_PIPE_STATS=1 and MOBILEGL_PIPE_STATS_PERIOD=1, so every
+            // swap ends a window and writes one line: under inproc the apply thread writes it to the
+            // server role's log, under spawn and tcp the server process writes or forwards it there.
+            struct ControlRecords {
+                bool valid = false;
+                long long applierResets = -1;
+                long long objectDeaths = -1;
+            };
+
+            // Ends the current window. The records and the present that ends it are kWaitNone, so
+            // the client moves on and the server counts them when it applies them. A readback is
+            // kWaitReply on every arm, and its answer is posted only after its record and every
+            // earlier one were applied, the present and the line it writes included. The harness's
+            // applied-seq wait is not that boundary off inproc: there the client's progress page
+            // moves with frames rather than with the peer's apply.
+            void EndWindow() {
+                Gl().EndFrame();
+                GLubyte fence[4]{};
+                glReadPixels(0, 0, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, fence);
+                EXPECT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << "the window's fence readback left a GL error behind";
+            }
+
+            // Ends the setup's window, so that the next one counts only what follows the mark.
+            PipeStatsWindow::LogMark StartWindow() {
+                EndWindow();
+                return PipeStatsWindow::MarkLaneLog();
+            }
+
+            ControlRecords EndWindowAndReadControlRecords(const PipeStatsWindow::LogMark& mark) {
+                EndWindow();
+                const PipeStatsWindow::Window window = PipeStatsWindow::LastFromServerLogSince(mark);
+                if (window.found) RecordProperty("stats_line_server", window.line);
+                ControlRecords records;
+                records.applierResets = PipeStatsWindow::CounterOrAbsent(window, "ar");
+                records.objectDeaths = PipeStatsWindow::CounterOrAbsent(window, "od");
+                records.valid = records.applierResets >= 0 && records.objectDeaths >= 0;
+                return records;
+            }
         };
 
         TEST_F(CtWireScenario, ApplierResetCrossesAtThePrimedEdgeInSerialOrder) {
@@ -127,25 +137,25 @@ namespace MGITest {
             // The first verb of the process primes the tracker; the edge is the producer. The
             // clear also gives the case its pixels, so a lane that emitted nothing is red twice
             // (here and in the fixture's emit-ordinal rule).
+            const PipeStatsWindow::LogMark mark = PipeStatsWindow::MarkLaneLog();
             glClearColor(0.2f, 0.4f, 0.6f, 1.0f);
             glClear(GL_COLOR_BUFFER_BIT);
-            const auto counters = ServerCounters();
-            ASSERT_TRUE(counters.valid) << "server control-record telemetry missing";
-            EXPECT_GE(counters.resets, 1u)
-                << "the FreshlyPrimed edge emitted no applier_reset; the server's g_applier was "
-                   "never reset for this session";
-            // The serial sequence is the session's own count (§1: asserted, never dispatched
-            // on): every record the sink accepted carried the serial it expected, or the counter
-            // and the accepted tally would disagree.
-            EXPECT_EQ(counters.serial, counters.resets)
-                << "an applier_reset record was dropped or replayed on the wire";
-
             GLubyte pixel[4]{};
             glReadPixels(1, 1, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, pixel);
             ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << "Ct.ApplierReset.error";
             const int expected[4] = {51, 102, 153, 255};
             for (int i = 0; i < 4; ++i)
                 EXPECT_NEAR(pixel[i], expected[i], 1) << "Ct.ApplierReset.pixels";
+
+            // No swap precedes this one in the process, so its window holds the edge wherever the
+            // first validate ran (this clear or the fixture's state reset). The serial needs no
+            // check of its own: OnApplierReset counts only a record whose serial it accepted, and
+            // any other latches Fatal{ProtocolCorruption, "ApplierReset.ContextSerial"}.
+            const ControlRecords counters = EndWindowAndReadControlRecords(mark);
+            ASSERT_TRUE(counters.valid) << "server control-record telemetry missing";
+            EXPECT_GE(counters.applierResets, 1)
+                << "the FreshlyPrimed edge emitted no applier_reset; the server's g_applier was "
+                   "never reset for this session";
         }
 
         TEST_F(CtWireScenario, TextureDeathCrossesAndTheRecycledSlotAnswersTheNewObject) {
@@ -159,7 +169,7 @@ namespace MGITest {
             // went backend-agnostic and that the INPROC arm failed here with `deaths` 0 vs 0
             // (docs/archive/notes/p7/magma-two-process-first-run.md §6); the table is what closes the inproc
             // half, and this case is the gate on it. It is also the RED-ONCE for that table: with
-            // the install site short-circuited, both cases red on the two EXPECT_GT below.
+            // the install site short-circuited, both cases red on their `od` assertions below.
             const GLubyte red[4] = {255, 0, 0, 255};
             const GLubyte green[4] = {0, 255, 0, 255};
 
@@ -176,45 +186,14 @@ namespace MGITest {
                 ASSERT_NEAR(before[i], redExpected[i], 1) << "Ct.TextureDeath.before";
 
             // The object dies unbound so the destructor - and the death record - fire at the
-            // delete, and the tally is read AFTER the EmitAndWait the delete blocked on.
+            // delete. The counted window holds the delete alone: the FBO ReadTextureLevel deleted
+            // died in the setup's window, which StartWindow ends.
             glBindTexture(GL_TEXTURE_2D, 0);
-            const auto beforeCounters = ServerCounters();
-            ASSERT_TRUE(beforeCounters.valid) << "server object-death telemetry missing";
-            const MobileGL::Uint64 deathsBefore = beforeCounters.deaths;
+            const PipeStatsWindow::LogMark mark = StartWindow();
             glDeleteTextures(1, &texture);
-            // THE FENCE, AND WHY IT IS NO LONGER A CLEAR.
-            //
-            // object_death is a kCtxObject value-class record whose wait class is kWaitNone, so
-            // under run-ahead the client publishes it and moves on, and the server-side tally below
-            // only moves at APPLY time. The clear this case used to fence on is kWaitNone TOO -
-            // PipeCalls.def's Clear row - so once the wait column governed (P5e's run-ahead), it
-            // waited for nothing and the read below raced the apply thread. Nothing had hidden that
-            // for a while except the per-record barriers the converted rows still took; P12 took
-            // those away on the wire arm (set_texture_params, respecify and the texture sub-data
-            // stop owning an answer), the client now runs further ahead, and the race stopped being
-            // a rarity. MEASURED on this entry under llvmpipe: 2 red of 5 runs (`deaths` 1 vs 1,
-            // the record applied a moment later) and 3 green of 3 with MOBILEGL_IPC_RUN_AHEAD=0. A
-            // timing race, never a lost record: the notice is emitted and applied either way.
-            //
-            // WHAT IS A REAL BOUNDARY, MEASURED ON ALL THREE ARMS RATHER THAN ASSUMED. The
-            // harness's applied-seq fence (WaitForSplitAppliedForTesting) is the right shape for
-            // inproc - and it is NOT usable here: this case is registered on the spawn and tcp arms
-            // too, the client's progress page there is advanced by frames rather than by the
-            // peer's own apply, and the wait times out. MEASURED with that fence in place: this
-            // case red at 5.0 s on DirectGLES.Tcp.Ct.
-            //
-            // A READBACK IS THE ONE BOUNDARY THAT HOLDS ON EVERY ARM. ReadPixels is
-            // kReplySlot|kWaitReply, so the client blocks on its answer, and an answer is posted
-            // only after its record has been APPLIED - and the ring applies in order, so the death
-            // published before it is applied too. (On the spawn and tcp arms the counter below
-            // comes from the peer's log, which ServerCounters() syncs before it reads - and that
-            // sync is itself a round trip the death has already crossed.)
-            GLubyte fencePixel[4]{};
-            glReadPixels(0, 0, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, fencePixel);
-            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << "the fence readback left a GL error behind";
-            const auto afterCounters = ServerCounters();
-            ASSERT_TRUE(afterCounters.valid) << "server object-death telemetry missing";
-            EXPECT_GT(afterCounters.deaths, deathsBefore)
+            const ControlRecords counters = EndWindowAndReadControlRecords(mark);
+            ASSERT_TRUE(counters.valid) << "server object-death telemetry missing";
+            EXPECT_GE(counters.objectDeaths, 1)
                 << "the texture's death produced no object_death record; the server's twin was "
                    "never told to let go";
 
@@ -323,17 +302,15 @@ namespace MGITest {
             // Die unbound, framebuffer first so the attachment's own death is a separate record.
             glBindFramebuffer(GL_FRAMEBUFFER, 0);
             glBindRenderbuffer(GL_RENDERBUFFER, 0);
-            const auto beforeCounters = ServerCounters();
-            ASSERT_TRUE(beforeCounters.valid) << "server object-death telemetry missing";
-            const MobileGL::Uint64 deathsBefore = beforeCounters.deaths;
+            const PipeStatsWindow::LogMark mark = StartWindow();
             // THE CLIENT'S OWN ACCOUNTING, read beside the server's (P7 wave 2 package C,
             // CONTRACT-P7 §5.5's PipeSlotPeek clause). The two numbers answer DIFFERENT halves of
             // one death and neither implies the other, which is exactly why both are read here:
-            //   * `deaths` below says the SERVER was told - the half the missing Magma table
+            //   * `od` below says the SERVER was told - the half the missing Magma table
             //     broke, and the only delivery a framebuffer has (no wire delete opcode at all);
             //   * this one says the CLIENT returned the slot. That half has been backend-neutral
             //     since P4a (PipeFill.cpp's NotifyAndFree frees whatever the notice does), so it
-            //     is a CONTROL rather than the subject: if it ever regressed, a green `deaths`
+            //     is a CONTROL rather than the subject: if it ever regressed, a green `od`
             //     would be measuring an object that never let go of its handle.
             // `false` means the allocator is out of reach (a pull build, or Android's hidden
             // symbols), and the peek is then simply not asserted - "could not look" is not
@@ -341,20 +318,9 @@ namespace MGITest {
             unsigned fboSlotsBefore = 0;
             const bool slotsReadable = PeekPipeSlotLiveCount(PipeSlotKind::Framebuffer, &fboSlotsBefore);
             glDeleteFramebuffers(1, &fbo);
-            // THE FENCE, the texture case's exactly: object_death is a kCtxObject value-class
-            // record with wait class kWaitNone, so under run-ahead it is published WITHOUT waiting
-            // for its own apply (production-safe: the in-order ring applies it before any record
-            // that recycles the slot), and the server-side counter this assertion reads only moves
-            // at apply time. A clear cannot be that boundary - its own class is kWaitNone too - so
-            // this waits on a READBACK, which is kWaitReply on every arm. The texture case carries
-            // the measurements, including the boundary that is right for inproc and wrong for
-            // spawn/tcp.
-            GLubyte fencePixel[4]{};
-            glReadPixels(0, 0, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, fencePixel);
-            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << "the fence readback left a GL error behind";
-            const auto afterCounters = ServerCounters();
-            ASSERT_TRUE(afterCounters.valid) << "server object-death telemetry missing";
-            EXPECT_GT(afterCounters.deaths, deathsBefore)
+            const ControlRecords counters = EndWindowAndReadControlRecords(mark);
+            ASSERT_TRUE(counters.valid) << "server object-death telemetry missing";
+            EXPECT_GE(counters.objectDeaths, 1)
                 << "the framebuffer's death produced no object_death record - and no other "
                    "opcode can carry it. Backend "
                 << Gl().BackendName();

MobileGL/MG_IntegrationTest/Scenarios/NarrowIntegerAttributeScenario.cpp

@@ -0,0 +1,876 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/NarrowIntegerAttributeScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// 8/16-bit integer attribute data read through an int/uint input of the OTHER signedness.
+//
+// Every desktop GL driver hands such an input the source integer converted to 32 bits by the
+// SOURCE type's signedness, then reinterpreted as the declared type: GL_UNSIGNED_BYTE 240 reaches
+// an `int` input as 240, GL_BYTE -1 reaches a `uint` input as 0xFFFFFFFF. Sodium 0.5 relies on it
+// (GL_UNSIGNED_BYTE lightmap data into `in ivec4 a_LightAndData`), and DirectVulkan once lost it:
+// its fetch format has to carry the input's signedness, which re-extends narrow data by the
+// input's rule, and every lightmap value from 128 up came out negative - dark terrain under
+// shaderpacks. The values are captured with transform feedback so every bit is compared.
+//
+// The second case draws one program over two vertex arrays that differ only in the signedness
+// of the data, in both orders and each twice in a row: the correction is chosen per draw from the
+// data, so a pipeline or program cached for one array, or the variant the previous draw settled
+// on, must never be handed to the other.
+
+// On DirectGLES every case also watches the driver itself (IntegerAttributeTypePeek.h): an array
+// whose type has the other signedness from its input reads a value ES leaves undefined, so a case
+// can show the right values on one driver and still render black on another. Where the watch
+// cannot look it says so and the value checks still run.
+
+#include <cstddef>
+#include <cstring>
+#include <functional>
+#include <iostream>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/IntegerAttributeTypePeek.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+        constexpr GLuint kPoison = 0xDEADBEEFu;
+
+        GLuint CompileShader(GLenum type, const char* source, std::string* log) {
+            const GLuint shader = glCreateShader(type);
+            glShaderSource(shader, 1, &source, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        const char* const kFragmentSource = R"(#version 410 core
+out vec4 color;
+void main()
+{
+    color = vec4(1.0);
+}
+)";
+
+        // A program of `vertexSource` and `fragmentSource` capturing the vertex stage's flat outputs
+        // `varyings` (none: no capture), interleaved; `beforeLink` runs on it just before the link.
+        GLuint BuildProgram(const char* vertexSource, const char* fragmentSource,
+                            const std::vector<const char*>& varyings, std::string* log,
+                            const std::function<void(GLuint)>& beforeLink = {}) {
+            const GLuint vertexShader = CompileShader(GL_VERTEX_SHADER, vertexSource, log);
+            if (vertexShader == 0) return 0;
+            const GLuint fragmentShader = CompileShader(GL_FRAGMENT_SHADER, fragmentSource, log);
+            if (fragmentShader == 0) {
+                glDeleteShader(vertexShader);
+                return 0;
+            }
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, vertexShader);
+            glAttachShader(program, fragmentShader);
+            if (!varyings.empty()) {
+                glTransformFeedbackVaryings(program, static_cast<GLsizei>(varyings.size()), varyings.data(),
+                                            GL_INTERLEAVED_ATTRIBS);
+            }
+            if (beforeLink) beforeLink(program);
+            glLinkProgram(program);
+            glDeleteShader(vertexShader);
+            glDeleteShader(fragmentShader);
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+            return program;
+        }
+
+        // A capture program: the vertex stage's flat outputs `varyings`, interleaved.
+        GLuint BuildCaptureProgram(const char* vertexSource, const std::vector<const char*>& varyings, std::string* log,
+                                   const std::function<void(GLuint)>& beforeLink = {}) {
+            return BuildProgram(vertexSource, kFragmentSource, varyings, log, beforeLink);
+        }
+
+        // Every pairing the correction covers, plus two that must keep their value untouched:
+        // matching signedness (location 2) and 32-bit data (location 6).
+        const char* const kEveryPairingVertexSource = R"(#version 410 core
+layout(location = 0) in ivec4 ubyteAsInt;
+layout(location = 1) in uvec4 byteAsUint;
+layout(location = 2) in uvec2 ushortAsUint;
+layout(location = 3) in ivec2 ushortAsInt;
+layout(location = 4) in uvec2 shortAsUint;
+layout(location = 5) in ivec2 instancedUbyteAsInt;
+layout(location = 6) in uint intAsUint;
+flat out ivec4 capturedA;
+flat out uvec4 capturedB;
+flat out ivec4 capturedC;
+flat out uvec4 capturedD;
+void main()
+{
+    capturedA = ubyteAsInt;
+    capturedB = byteAsUint;
+    capturedC = ivec4(ushortAsInt, instancedUbyteAsInt);
+    capturedD = uvec4(shortAsUint, ushortAsUint.x, intAsUint);
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kSingleInputVertexSource = R"(#version 410 core
+layout(location = 0) in ivec4 value;
+flat out ivec4 captured;
+void main()
+{
+    captured = value;
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kSingleUintInputVertexSource = R"(#version 410 core
+layout(location = 0) in uvec4 value;
+flat out uvec4 captured;
+void main()
+{
+    captured = value;
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        // No layout qualifier: the location comes from glBindAttribLocation.
+        const char* const kUnplacedInputVertexSource = R"(#version 410 core
+in ivec4 value;
+flat out ivec4 captured;
+void main()
+{
+    captured = value;
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kWideAndMatchedVertexSource = R"(#version 410 core
+layout(location = 0) in ivec2 uintAsInt;
+layout(location = 1) in uvec2 ushortAsUint;
+flat out ivec4 captured;
+void main()
+{
+    captured = ivec4(uintAsInt, ivec2(ushortAsUint));
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        // A program without a capture list, read back through a 2x1 RGBA32I target instead, so its
+        // first build is not one that captures. Vertex i lands on pixel i.
+        const char* const kRenderVertexSource = R"(#version 410 core
+layout(location = 0) in ivec4 value;
+flat out ivec4 passed;
+void main()
+{
+    passed = value;
+    gl_Position = vec4(gl_VertexID == 0 ? -0.5 : 0.5, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kRenderFragmentSource = R"(#version 410 core
+flat in ivec4 passed;
+layout(location = 0) out ivec4 color;
+void main()
+{
+    color = passed;
+}
+)";
+
+        const char* const kSeparableVertexSource = R"(#version 410 core
+layout(location = 0) in ivec4 value;
+layout(location = 0) flat out ivec4 passed;
+out gl_PerVertex { vec4 gl_Position; };
+void main()
+{
+    passed = value;
+    gl_Position = vec4(gl_VertexID == 0 ? -0.5 : 0.5, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kSeparableFragmentSource = R"(#version 410 core
+layout(location = 0) flat in ivec4 passed;
+layout(location = 0) out ivec4 color;
+void main()
+{
+    color = passed;
+}
+)";
+
+        // The same four bytes as GL_BYTE and as GL_UNSIGNED_BYTE, and the words each reaches an
+        // input with: sign-extended from GL_BYTE, zero-extended from GL_UNSIGNED_BYTE, whatever the
+        // input's own signedness.
+        const GLubyte kBytes[4] = {0xFF, 0x80, 5, 127};
+        const std::vector<GLuint> kBytesAsSigned = {0xFFFFFFFFu, 0xFFFFFF80u, 5u, 127u};
+        const std::vector<GLuint> kBytesAsUnsigned = {255u, 128u, 5u, 127u};
+        const GLubyte kLightBytes[4] = {240, 200, 128, 7};
+        const std::vector<GLuint> kLightWords = {240u, 200u, 128u, 7u};
+
+        // One vertex of kEveryPairingVertexSource's per-vertex data, tightly packed.
+        struct PerVertex {
+            GLubyte ubyteAsInt[4];
+            GLbyte byteAsUint[4];
+            GLushort ushortAsUint[2];
+            GLushort ushortAsInt[2];
+            GLshort shortAsUint[2];
+            GLint intAsUint;
+        };
+
+        class NarrowIntegerAttributeScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenBuffers(1, &m_capture);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, m_capture);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, kCaptureWords * sizeof(GLuint), nullptr, GL_DYNAMIC_READ);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, m_capture);
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "capture buffer setup";
+                std::string whyNot;
+                m_watching = StartIntegerAttributeTypeWatch(&whyNot);
+                if (!m_watching) {
+                    // A log line and a property, never a skip: the value checks below still run.
+                    std::cout << "[itest] integer attribute type watch off: " << whyNot << std::endl;
+                    RecordProperty("integer_attribute_type_watch", whyNot);
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                if (m_watching) StopIntegerAttributeTypeWatch();
+                if (m_target != 0) glDeleteFramebuffers(1, &m_target);
+                if (m_targetTexture != 0) glDeleteTextures(1, &m_targetTexture);
+                glDisable(GL_RASTERIZER_DISCARD);
+                glUseProgram(0);
+                glBindVertexArray(0);
+                for (const GLuint program : m_programs)
+                    glDeleteProgram(program);
+                for (const GLuint vao : m_vaos)
+                    glDeleteVertexArrays(1, &vao);
+                for (const GLuint buffer : m_buffers)
+                    glDeleteBuffers(1, &buffer);
+                if (m_capture != 0) glDeleteBuffers(1, &m_capture);
+                ScenarioTest::TearDown();
+            }
+
+            GLuint MakeBuffer(const void* data, GLsizeiptr size) {
+                GLuint buffer = 0;
+                glGenBuffers(1, &buffer);
+                glBindBuffer(GL_ARRAY_BUFFER, buffer);
+                glBufferData(GL_ARRAY_BUFFER, size, data, GL_STATIC_DRAW);
+                m_buffers.push_back(buffer);
+                return buffer;
+            }
+
+            GLuint MakeVertexArray() {
+                GLuint vao = 0;
+                glGenVertexArrays(1, &vao);
+                glBindVertexArray(vao);
+                m_vaos.push_back(vao);
+                return vao;
+            }
+
+            // One point drawn under GL_RASTERIZER_DISCARD; the first `words` captured words.
+            std::vector<GLuint> Capture(GLuint program, GLuint vao, std::size_t words,
+                                        const std::function<void()>& draw = {}) {
+                const std::vector<GLuint> poison(kCaptureWords, kPoison);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, m_capture);
+                glBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, kCaptureWords * sizeof(GLuint), poison.data());
+                glUseProgram(program);
+                glBindVertexArray(vao);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(GL_POINTS);
+                if (draw)
+                    draw();
+                else
+                    glDrawArraysInstanced(GL_POINTS, 0, 1, 1);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+                std::vector<GLuint> result(words, kPoison);
+                const void* mapped =
+                    glMapBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, words * sizeof(GLuint), GL_MAP_READ_BIT);
+                if (mapped == nullptr) {
+                    ADD_FAILURE() << "glMapBufferRange returned null";
+                    return result;
+                }
+                std::memcpy(result.data(), mapped, words * sizeof(GLuint));
+                glUnmapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER);
+                return result;
+            }
+
+            // `points` points drawn into a 2x1 RGBA32I target with `program` (0: the bound pipeline),
+            // by `draw` or one glDrawArrays; the four words its fragment stage wrote for each.
+            std::vector<GLuint> Render(GLuint program, GLuint vao, int points = 1,
+                                       const std::function<void()>& draw = {}) {
+                if (m_target == 0) {
+                    glGenTextures(1, &m_targetTexture);
+                    glBindTexture(GL_TEXTURE_2D, m_targetTexture);
+                    glTexStorage2D(GL_TEXTURE_2D, 1, GL_RGBA32I, 2, 1);
+                    glBindTexture(GL_TEXTURE_2D, 0);
+                    glGenFramebuffers(1, &m_target);
+                    glBindFramebuffer(GL_FRAMEBUFFER, m_target);
+                    glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_targetTexture, 0);
+                    EXPECT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+                }
+                glBindFramebuffer(GL_FRAMEBUFFER, m_target);
+                glViewport(0, 0, 2, 1);
+                const GLint poison[4] = {static_cast<GLint>(kPoison), static_cast<GLint>(kPoison),
+                                         static_cast<GLint>(kPoison), static_cast<GLint>(kPoison)};
+                glClearBufferiv(GL_COLOR, 0, poison);
+                glUseProgram(program);
+                glBindVertexArray(vao);
+                if (draw)
+                    draw();
+                else
+                    glDrawArrays(GL_POINTS, 0, 1);
+                GLint pixels[8] = {};
+                glReadPixels(0, 0, 2, 1, GL_RGBA_INTEGER, GL_INT, pixels);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                return std::vector<GLuint>(pixels, pixels + 4 * points);
+            }
+
+            // A vertex array whose location 0 reads `bytes` as four `type` components.
+            GLuint MakeByteArray(const GLubyte (&bytes)[4], GLenum type) {
+                const GLuint vao = MakeVertexArray();
+                MakeBuffer(bytes, sizeof(bytes));
+                glVertexAttribIPointer(0, 4, type, 0, nullptr);
+                glEnableVertexAttribArray(0);
+                return vao;
+            }
+
+            // The driver's view of every draw so far; null where the watch is off.
+            bool ReadWatch(IntegerAttributeTypeTally* tally) {
+                if (!m_watching) return false;
+                glFinish();
+                const bool read = ReadIntegerAttributeTypeWatch(tally);
+                EXPECT_TRUE(read) << "the integer attribute type watch started but could not be read";
+                return read;
+            }
+
+            // Every array a draw so far handed the driver has the signedness of the input it feeds.
+            void ExpectDriverArraysFitTheirInputs() {
+                IntegerAttributeTypeTally tally;
+                if (!ReadWatch(&tally)) return;
+                RecordProperty("integer_attribute_type_watch_draws", static_cast<int>(tally.draws));
+                EXPECT_GT(tally.draws, 0u) << "the watch saw no draw, so it checked nothing";
+                EXPECT_EQ(tally.violations, 0u) << tally.firstViolation;
+            }
+
+            // Driver links so far, or -1 where the watch is off.
+            long LinksSoFar() {
+                IntegerAttributeTypeTally tally;
+                return ReadWatch(&tally) ? static_cast<long>(tally.links) : -1;
+            }
+
+            static constexpr std::size_t kCaptureWords = 16;
+            bool m_watching = false;
+            GLuint m_target = 0;
+            GLuint m_targetTexture = 0;
+            GLuint m_capture = 0;
+            std::vector<GLuint> m_programs;
+            std::vector<GLuint> m_vaos;
+            std::vector<GLuint> m_buffers;
+        };
+
+        TEST_F(NarrowIntegerAttributeScenario, EveryNarrowTypeKeepsItsOwnValueInAnInputOfTheOtherSignedness) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kEveryPairingVertexSource,
+                                                       {"capturedA", "capturedB", "capturedC", "capturedD"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+
+            const PerVertex vertex{{240, 200, 128, 7}, {-1, 5, -128, 127}, {65000, 300},
+                                   {65000, 40000},     {-2, 1000},         -1};
+            const GLubyte instance[4] = {250, 129, 0, 0};
+            const GLuint vao = MakeVertexArray();
+            MakeBuffer(&vertex, sizeof(vertex));
+            const auto offset = [](std::size_t bytes) { return reinterpret_cast<const void*>(bytes); };
+            constexpr GLsizei stride = sizeof(PerVertex);
+            glVertexAttribIPointer(0, 4, GL_UNSIGNED_BYTE, stride, offset(offsetof(PerVertex, ubyteAsInt)));
+            glVertexAttribIPointer(1, 4, GL_BYTE, stride, offset(offsetof(PerVertex, byteAsUint)));
+            glVertexAttribIPointer(2, 2, GL_UNSIGNED_SHORT, stride, offset(offsetof(PerVertex, ushortAsUint)));
+            glVertexAttribIPointer(3, 2, GL_UNSIGNED_SHORT, stride, offset(offsetof(PerVertex, ushortAsInt)));
+            glVertexAttribIPointer(4, 2, GL_SHORT, stride, offset(offsetof(PerVertex, shortAsUint)));
+            glVertexAttribIPointer(6, 1, GL_INT, stride, offset(offsetof(PerVertex, intAsUint)));
+            MakeBuffer(instance, sizeof(instance));
+            glVertexAttribIPointer(5, 2, GL_UNSIGNED_BYTE, 4, nullptr);
+            glVertexAttribDivisor(5, 1);
+            for (GLuint location = 0; location <= 6; ++location)
+                glEnableVertexAttribArray(location);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            const std::vector<GLuint> captured = Capture(program, vao, 16);
+            const std::vector<GLuint> expected = {
+                240u,        200u,   128u,        7u,   // GL_UNSIGNED_BYTE -> ivec4: zero-extended
+                0xFFFFFFFFu, 5u,     0xFFFFFF80u, 127u, // GL_BYTE -> uvec4: sign-extended
+                65000u,      40000u,                    // GL_UNSIGNED_SHORT -> ivec2: zero-extended
+                250u,        129u,                      // instanced GL_UNSIGNED_BYTE -> ivec2
+                0xFFFFFFFEu, 1000u,                     // GL_SHORT -> uvec2: sign-extended
+                65000u,                                 // GL_UNSIGNED_SHORT -> uvec2: already right
+                0xFFFFFFFFu,                            // 32-bit GL_INT -> uint: the same bits
+            };
+            EXPECT_EQ(captured, expected);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        TEST_F(NarrowIntegerAttributeScenario, OneProgramFollowsTheSignednessOfEachVertexArray) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+
+            // The same four bytes, once as GL_BYTE and once as GL_UNSIGNED_BYTE.
+            const GLubyte bytes[4] = {0xFF, 0x80, 5, 127};
+            const GLuint signedArray = MakeVertexArray();
+            MakeBuffer(bytes, sizeof(bytes));
+            glVertexAttribIPointer(0, 4, GL_BYTE, 0, nullptr);
+            glEnableVertexAttribArray(0);
+            const GLuint unsignedArray = MakeVertexArray();
+            MakeBuffer(bytes, sizeof(bytes));
+            glVertexAttribIPointer(0, 4, GL_UNSIGNED_BYTE, 0, nullptr);
+            glEnableVertexAttribArray(0);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            const std::vector<GLuint> asSigned = {0xFFFFFFFFu, 0xFFFFFF80u, 5u, 127u};
+            const std::vector<GLuint> asUnsigned = {255u, 128u, 5u, 127u};
+            EXPECT_EQ(Capture(program, signedArray, 4), asSigned) << "GL_BYTE first";
+            EXPECT_EQ(Capture(program, signedArray, 4), asSigned) << "GL_BYTE twice in a row";
+            EXPECT_EQ(Capture(program, unsignedArray, 4), asUnsigned) << "then GL_UNSIGNED_BYTE";
+            EXPECT_EQ(Capture(program, unsignedArray, 4), asUnsigned) << "GL_UNSIGNED_BYTE twice in a row";
+            EXPECT_EQ(Capture(program, signedArray, 4), asSigned) << "GL_BYTE again";
+            EXPECT_EQ(Capture(program, unsignedArray, 4), asUnsigned) << "GL_UNSIGNED_BYTE again";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // The negative control for the driver watch, on canned input: the rule must call an
+        // unsigned array into an int input wrong, and every matching pairing right.
+        TEST_F(NarrowIntegerAttributeScenario, TheDriverWatchRuleRejectsAnArrayOfTheOtherSignedness) {
+            EXPECT_FALSE(IntegerAttributeTypeFitsInput(GL_INT_VEC4, true, GL_UNSIGNED_BYTE));
+            EXPECT_FALSE(IntegerAttributeTypeFitsInput(GL_UNSIGNED_INT_VEC2, true, GL_SHORT));
+            EXPECT_FALSE(IntegerAttributeTypeFitsInput(GL_INT, true, GL_UNSIGNED_INT));
+            EXPECT_FALSE(IntegerAttributeTypeFitsInput(GL_INT_VEC4, false, GL_FLOAT));
+            EXPECT_FALSE(IntegerAttributeTypeFitsInput(GL_FLOAT_VEC4, true, GL_BYTE));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_INT_VEC4, true, GL_BYTE));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_INT_VEC2, true, GL_SHORT));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_INT, true, GL_INT));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_UNSIGNED_INT_VEC4, true, GL_UNSIGNED_BYTE));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_UNSIGNED_INT_VEC3, true, GL_UNSIGNED_SHORT));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_UNSIGNED_INT, true, GL_UNSIGNED_INT));
+            EXPECT_TRUE(IntegerAttributeTypeFitsInput(GL_FLOAT_VEC4, false, GL_UNSIGNED_BYTE));
+        }
+
+        // One array read in turn by an int and a uint program: each switch changes which of the two
+        // signednesses the array has to be issued with, and the second round must need no relink.
+        TEST_F(NarrowIntegerAttributeScenario, AnIntAndAUintProgramTakeTurnsOnOneArray) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint intProgram = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(intProgram, 0u) << log;
+            m_programs.push_back(intProgram);
+            const GLuint uintProgram = BuildCaptureProgram(kSingleUintInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(uintProgram, 0u) << log;
+            m_programs.push_back(uintProgram);
+            const GLuint signedArray = MakeByteArray(kBytes, GL_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Capture(intProgram, signedArray, 4), kBytesAsSigned) << "int first";
+            EXPECT_EQ(Capture(uintProgram, signedArray, 4), kBytesAsSigned) << "then uint";
+            const long linksAfterFirstRound = LinksSoFar();
+            for (int round = 0; round < 2; ++round) {
+                EXPECT_EQ(Capture(intProgram, signedArray, 4), kBytesAsSigned) << "int, round " << round;
+                EXPECT_EQ(Capture(uintProgram, signedArray, 4), kBytesAsSigned) << "uint, round " << round;
+            }
+            EXPECT_EQ(LinksSoFar(), linksAfterFirstRound) << "switching programs relinked one";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // A program that never captures is built for the data it first meets. Fed data of the other
+        // signedness afterwards it may be rebuilt once, and every value - before, during and after
+        // the switch - is still GL's.
+        TEST_F(NarrowIntegerAttributeScenario, AProgramFirstDrawnWithMatchingDataKeepsEveryValue) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildProgram(kRenderVertexSource, kRenderFragmentSource, {}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint signedArray = MakeByteArray(kBytes, GL_BYTE);
+            const GLuint unsignedArray = MakeByteArray(kBytes, GL_UNSIGNED_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Render(program, signedArray), kBytesAsSigned) << "matching data first";
+            const long linksAfterFirstDraw = LinksSoFar();
+            EXPECT_EQ(Render(program, unsignedArray), kBytesAsUnsigned) << "then the other signedness";
+            EXPECT_EQ(Render(program, signedArray), kBytesAsSigned) << "matching data again";
+            EXPECT_EQ(Render(program, unsignedArray), kBytesAsUnsigned) << "the other signedness again";
+            if (linksAfterFirstDraw >= 0) EXPECT_LE(LinksSoFar(), linksAfterFirstDraw + 1) << "rebuilt more than once";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // Two programs from one source, the first built for matching data only and the second for
+        // data of the other signedness. Whatever the backend shares between the two builds must not
+        // hand the second one the first one's shader.
+        TEST_F(NarrowIntegerAttributeScenario, TwoProgramsFromOneSourceKeepTheirOwnBuilds) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint first = BuildProgram(kRenderVertexSource, kRenderFragmentSource, {}, &log);
+            ASSERT_NE(first, 0u) << log;
+            m_programs.push_back(first);
+            const GLuint second = BuildProgram(kRenderVertexSource, kRenderFragmentSource, {}, &log);
+            ASSERT_NE(second, 0u) << log;
+            m_programs.push_back(second);
+            const GLuint signedArray = MakeByteArray(kBytes, GL_BYTE);
+            const GLuint unsignedArray = MakeByteArray(kBytes, GL_UNSIGNED_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Render(first, signedArray), kBytesAsSigned) << "the first program, matching data";
+            EXPECT_EQ(Render(second, unsignedArray), kBytesAsUnsigned) << "the second, the other signedness";
+            EXPECT_EQ(Render(first, signedArray), kBytesAsSigned) << "the first again";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // A relink between two draws of the same data: whatever per-program state the correction
+        // keeps has to survive the program being rebuilt underneath it.
+        TEST_F(NarrowIntegerAttributeScenario, ARelinkBetweenDrawsKeepsTheValues) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint unsignedArray = MakeByteArray(kLightBytes, GL_UNSIGNED_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Capture(program, unsignedArray, 4), kLightWords) << "before the relink";
+            glLinkProgram(program);
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            ASSERT_EQ(status, GL_TRUE);
+            EXPECT_EQ(Capture(program, unsignedArray, 4), kLightWords) << "after the relink";
+            EXPECT_EQ(Capture(program, unsignedArray, 4), kLightWords) << "and once more";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // A program and a vertex array deleted and created again, most likely under the same names,
+        // with the signedness of input and data swapped: nothing learned about the first pair may
+        // be believed for the second.
+        TEST_F(NarrowIntegerAttributeScenario, AProgramAndAnArrayCreatedAgainStartOver) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint intProgram = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(intProgram, 0u) << log;
+            GLuint unsignedArray = 0;
+            glGenVertexArrays(1, &unsignedArray);
+            glBindVertexArray(unsignedArray);
+            MakeBuffer(kLightBytes, sizeof(kLightBytes));
+            glVertexAttribIPointer(0, 4, GL_UNSIGNED_BYTE, 0, nullptr);
+            glEnableVertexAttribArray(0);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "first pair setup";
+            EXPECT_EQ(Capture(intProgram, unsignedArray, 4), kLightWords) << "the first pair";
+            glUseProgram(0);
+            glBindVertexArray(0);
+            glDeleteProgram(intProgram);
+            glDeleteVertexArrays(1, &unsignedArray);
+
+            const GLuint uintProgram = BuildCaptureProgram(kSingleUintInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(uintProgram, 0u) << log;
+            m_programs.push_back(uintProgram);
+            const GLuint signedArray = MakeByteArray(kBytes, GL_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "second pair setup";
+            // The case is about the reused names; a fresh name would check nothing it is for.
+            EXPECT_EQ(uintProgram, intProgram) << "the program name was not reused";
+            EXPECT_EQ(signedArray, unsignedArray) << "the vertex array name was not reused";
+            EXPECT_EQ(Capture(uintProgram, signedArray, 4), kBytesAsSigned) << "the second pair";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // The input's location comes from glBindAttribLocation rather than the shader.
+        TEST_F(NarrowIntegerAttributeScenario, ABoundAttributeLocationIsCorrected) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kUnplacedInputVertexSource, {"captured"}, &log,
+                                                       [](GLuint p) { glBindAttribLocation(p, 5, "value"); });
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            ASSERT_EQ(glGetAttribLocation(program, "value"), 5);
+            const GLuint vao = MakeVertexArray();
+            MakeBuffer(kLightBytes, sizeof(kLightBytes));
+            glVertexAttribIPointer(5, 4, GL_UNSIGNED_BYTE, 0, nullptr);
+            glEnableVertexAttribArray(5);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Capture(program, vao, 4), kLightWords);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // The array is described through the direct-state-access entry points.
+        TEST_F(NarrowIntegerAttributeScenario, ADirectStateAccessArrayIsCorrected) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            GLuint vao = 0;
+            glCreateVertexArrays(1, &vao);
+            m_vaos.push_back(vao);
+            GLuint buffer = 0;
+            glCreateBuffers(1, &buffer);
+            m_buffers.push_back(buffer);
+            glNamedBufferData(buffer, sizeof(kLightBytes), kLightBytes, GL_STATIC_DRAW);
+            glVertexArrayVertexBuffer(vao, 0, buffer, 0, 4);
+            glVertexArrayAttribIFormat(vao, 0, 4, GL_UNSIGNED_BYTE, 0);
+            glVertexArrayAttribBinding(vao, 0, 0);
+            glEnableVertexArrayAttrib(vao, 0);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Capture(program, vao, 4), kLightWords);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // A binding of stride zero, which never advances: two points read the same element.
+        TEST_F(NarrowIntegerAttributeScenario, AZeroStrideBindingIsCorrected) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint vao = MakeVertexArray();
+            const GLuint buffer = MakeBuffer(kLightBytes, sizeof(kLightBytes));
+            glVertexAttribIFormat(0, 4, GL_UNSIGNED_BYTE, 0);
+            glVertexAttribBinding(0, 0);
+            glBindVertexBuffer(0, buffer, 0, 0);
+            glEnableVertexAttribArray(0);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            std::vector<GLuint> expected = kLightWords;
+            expected.insert(expected.end(), kLightWords.begin(), kLightWords.end());
+            EXPECT_EQ(Capture(program, vao, 8, [] { glDrawArrays(GL_POINTS, 0, 2); }), expected);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // An array in the application's own memory, as ClientVertexArrayScenario draws one on
+        // every arm.
+        TEST_F(NarrowIntegerAttributeScenario, AClientMemoryArrayIsCorrected) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint vao = MakeVertexArray();
+            glBindBuffer(GL_ARRAY_BUFFER, 0);
+            glVertexAttribIPointer(0, 4, GL_UNSIGNED_BYTE, 0, kLightBytes);
+            glEnableVertexAttribArray(0);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Capture(program, vao, 4, [] { glDrawArrays(GL_POINTS, 0, 1); }), kLightWords);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // 32-bit data of the other signedness is the same bits, and 16-bit data of the input's own
+        // signedness is untouched; both still reach the driver with the input's signedness.
+        TEST_F(NarrowIntegerAttributeScenario, WideDataAndMatchingDataKeepTheirBits) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kWideAndMatchedVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint wide[2] = {0xFFFFFFF0u, 7u};
+            const GLushort matched[2] = {65000, 300};
+            const GLuint vao = MakeVertexArray();
+            MakeBuffer(wide, sizeof(wide));
+            glVertexAttribIPointer(0, 2, GL_UNSIGNED_INT, 0, nullptr);
+            MakeBuffer(matched, sizeof(matched));
+            glVertexAttribIPointer(1, 2, GL_UNSIGNED_SHORT, 0, nullptr);
+            glEnableVertexAttribArray(0);
+            glEnableVertexAttribArray(1);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            const std::vector<GLuint> expected = {0xFFFFFFF0u, 7u, 65000u, 300u};
+            EXPECT_EQ(Capture(program, vao, 4), expected);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // Two points through one glMultiDrawArrays, read back rather than captured.
+        TEST_F(NarrowIntegerAttributeScenario, AMultiDrawIsCorrected) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildProgram(kRenderVertexSource, kRenderFragmentSource, {}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLubyte points[8] = {240, 200, 128, 7, 250, 129, 1, 255};
+            const GLuint vao = MakeVertexArray();
+            MakeBuffer(points, sizeof(points));
+            glVertexAttribIPointer(0, 4, GL_UNSIGNED_BYTE, 0, nullptr);
+            glEnableVertexAttribArray(0);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            const std::vector<GLuint> expected = {240u, 200u, 128u, 7u, 250u, 129u, 1u, 255u};
+            EXPECT_EQ(Render(program, vao, 2,
+                             [] {
+                                 const GLint firsts[2] = {0, 1};
+                                 const GLsizei counts[2] = {1, 1};
+                                 glMultiDrawArrays(GL_POINTS, firsts, counts, 2);
+                             }),
+                      expected);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // The integer input belongs to a separable vertex program bound through a pipeline.
+        TEST_F(NarrowIntegerAttributeScenario, AProgramPipelineVertexStageIsCorrected) {
+            if (!Ready()) GTEST_SKIP();
+            const GLuint vertexStage = glCreateShaderProgramv(GL_VERTEX_SHADER, 1, &kSeparableVertexSource);
+            const GLuint fragmentStage = glCreateShaderProgramv(GL_FRAGMENT_SHADER, 1, &kSeparableFragmentSource);
+            ASSERT_NE(vertexStage, 0u);
+            ASSERT_NE(fragmentStage, 0u);
+            m_programs.push_back(vertexStage);
+            m_programs.push_back(fragmentStage);
+            GLint linked = GL_FALSE;
+            glGetProgramiv(vertexStage, GL_LINK_STATUS, &linked);
+            ASSERT_EQ(linked, GL_TRUE);
+            glGetProgramiv(fragmentStage, GL_LINK_STATUS, &linked);
+            ASSERT_EQ(linked, GL_TRUE);
+            GLuint pipeline = 0;
+            glGenProgramPipelines(1, &pipeline);
+            glUseProgramStages(pipeline, GL_VERTEX_SHADER_BIT, vertexStage);
+            glUseProgramStages(pipeline, GL_FRAGMENT_SHADER_BIT, fragmentStage);
+            const GLuint unsignedArray = MakeByteArray(kLightBytes, GL_UNSIGNED_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "pipeline setup";
+
+            glUseProgram(0);
+            glBindProgramPipeline(pipeline);
+            EXPECT_EQ(Render(0, unsignedArray), kLightWords);
+            glBindProgramPipeline(0);
+            glDeleteProgramPipelines(1, &pipeline);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // Whatever the driver is handed, the application still reads back the type it declared.
+        TEST_F(NarrowIntegerAttributeScenario, TheArrayTypeQueryStillReportsTheDeclaredType) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint unsignedArray = MakeByteArray(kLightBytes, GL_UNSIGNED_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            EXPECT_EQ(Capture(program, unsignedArray, 4), kLightWords);
+            glBindVertexArray(unsignedArray);
+            GLint type = 0;
+            GLint integer = 0;
+            glGetVertexAttribiv(0, GL_VERTEX_ATTRIB_ARRAY_TYPE, &type);
+            glGetVertexAttribiv(0, GL_VERTEX_ATTRIB_ARRAY_INTEGER, &integer);
+            EXPECT_EQ(type, GL_UNSIGNED_BYTE);
+            EXPECT_EQ(integer, GL_TRUE);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // A capture program's first draws, matching data then the other signedness, inside one
+        // capture: the program has to be built for both before the capture opens, since nothing
+        // may relink it while it captures.
+        TEST_F(NarrowIntegerAttributeScenario, ACaptureProgramMeetsBothSignednessesInOneCapture) {
+            if (!Ready()) GTEST_SKIP();
+            const long linksBefore = LinksSoFar();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint signedArray = MakeByteArray(kBytes, GL_BYTE);
+            const GLuint unsignedArray = MakeByteArray(kLightBytes, GL_UNSIGNED_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+
+            std::vector<GLuint> expected = kBytesAsSigned;
+            expected.insert(expected.end(), kLightWords.begin(), kLightWords.end());
+            EXPECT_EQ(Capture(program, signedArray, 8,
+                              [unsignedArray] {
+                                  glDrawArrays(GL_POINTS, 0, 1);
+                                  glBindVertexArray(unsignedArray);
+                                  glDrawArrays(GL_POINTS, 0, 1);
+                              }),
+                      expected);
+            if (linksBefore >= 0) EXPECT_LE(LinksSoFar(), linksBefore + 1) << "the program was relinked";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+
+        // The application relinks the same program object with its input at location 0 turned
+        // from ivec4 into uvec4: what was known about the old link's inputs no longer holds.
+        TEST_F(NarrowIntegerAttributeScenario, ARelinkThatChangesTheInputsSignednessStartsOver) {
+            if (!Ready()) GTEST_SKIP();
+            std::string log;
+            const GLuint program = BuildCaptureProgram(kSingleInputVertexSource, {"captured"}, &log);
+            ASSERT_NE(program, 0u) << log;
+            m_programs.push_back(program);
+            const GLuint unsignedArray = MakeByteArray(kLightBytes, GL_UNSIGNED_BYTE);
+            const GLuint signedArray = MakeByteArray(kBytes, GL_BYTE);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "vertex array setup";
+            EXPECT_EQ(Capture(program, unsignedArray, 4), kLightWords) << "the ivec4 link";
+
+            GLuint attached[4] = {};
+            GLsizei attachedCount = 0;
+            glGetAttachedShaders(program, 4, &attachedCount, attached);
+            for (GLsizei i = 0; i < attachedCount; ++i)
+                glDetachShader(program, attached[i]);
+            const GLuint vertexShader = CompileShader(GL_VERTEX_SHADER, kSingleUintInputVertexSource, &log);
+            ASSERT_NE(vertexShader, 0u) << log;
+            const GLuint fragmentShader = CompileShader(GL_FRAGMENT_SHADER, kFragmentSource, &log);
+            ASSERT_NE(fragmentShader, 0u) << log;
+            glAttachShader(program, vertexShader);
+            glAttachShader(program, fragmentShader);
+            glLinkProgram(program);
+            glDeleteShader(vertexShader);
+            glDeleteShader(fragmentShader);
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            ASSERT_EQ(status, GL_TRUE);
+
+            EXPECT_EQ(Capture(program, signedArray, 4), kBytesAsSigned) << "the uvec4 link, GL_BYTE data";
+            EXPECT_EQ(Capture(program, unsignedArray, 4), kLightWords) << "the uvec4 link, matching data";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+            ExpectDriverArraysFitTheirInputs();
+        }
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PersistentCoherentMapScenario.cpp

@@ -445,6 +445,61 @@ void main() { oColor = vec4(vColor, 1.0); }
         Gl().EndFrame();
     }
 
+    // E3(a): the push is the ONLY route a coherent write takes to the server. The cases above go
+    // green just as well if something else delivered the bytes - an unmap or flush record, a
+    // whole-buffer re-sync, the live-host-writes state record, an inproc server reading client
+    // memory - so this one takes the push away and requires the draws to miss the write, within
+    // one frame and across a Present (the two shapes the cases above draw). Forget is what an
+    // unmap or a destroy calls and leaves the mapping itself alone; the re-announce is the call
+    // every map-state change makes, and the next draw must see the latest write.
+    TEST_F(PersistentCoherentMapScenario, ThePushIsTheOnlyRouteAWriteTakesToTheServer) {
+        if (!Ready() || IsSkipped()) return;
+        if (!SplitLane::IsSplitLane() || SplitLane::DeclaredPersistentMapArm() != "emulated") {
+            GTEST_SKIP() << "the push exists only on the emulated arm of a split transport, and this lane "
+                            "declares no such arm (MGITEST_PERSISTENT_MAP_ARM=emulated, set per entry by "
+                            "Harness/SplitLogPaths.cmake.in); monolith adopts the store and has no push";
+        }
+        if (!PersistentMapTrackerAvailable()) {
+            GTEST_SKIP() << "Harness/PersistentMapPeek cannot reach the tracker in this build, so the push "
+                            "cannot be taken away";
+        }
+        ArmTheDrawState();
+
+        WriteThroughTheMapThenDraw(m_map, 0.0f, 1.0f, 0.0f);
+        const Image pushed = ReadPixels(Gl().Width(), Gl().Height());
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_TRUE(WholeSurfaceIs(pushed, "green", "the write the push carries, before it is taken away"));
+
+        ASSERT_TRUE(ForgetLivePersistentMap(m_vbo)) << "no frontend BufferObject behind GL buffer " << m_vbo;
+        WriteThroughTheMapThenDraw(m_map, 1.0f, 0.0f, 0.0f);
+        const Image unpushed = ReadPixels(Gl().Width(), Gl().Height());
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_TRUE(WholeSurfaceIs(unpushed, "green",
+                                   "a write through a mapping the tracker has forgotten: red here means "
+                                   "something other than the persistent-map push delivered it, and the "
+                                   "two cases above would stay green without the push"));
+        Gl().EndFrame();
+
+        ArmTheDrawState();
+        WriteThroughTheMapThenDraw(m_map, 0.0f, 0.0f, 1.0f);
+        const Image nextFrame = ReadPixels(Gl().Width(), Gl().Height());
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_TRUE(WholeSurfaceIs(nextFrame, "green",
+                                   "the next frame's write through the forgotten mapping, after a Present: "
+                                   "red or blue here means the frame boundary delivered a write the push "
+                                   "did not carry"));
+
+        ASSERT_TRUE(ReannounceLivePersistentMap(m_vbo)) << "no frontend BufferObject behind GL buffer " << m_vbo;
+        glDrawArrays(GL_TRIANGLES, 0, 6);
+        const Image repushed = ReadPixels(Gl().Width(), Gl().Height());
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_TRUE(WholeSurfaceIs(repushed, "blue",
+                                   "the latest write after the map is announced again: the tracker must "
+                                   "push the whole mapping once, or the green above proves nothing"));
+        AssertOrRecordArm(m_vbo, "after the push was taken away and given back");
+        Gl().EndFrame();
+    }
+
     // E3(c) and the black-box half of E3(d). ONE reading case, in a lane of its own, for the
     // reason PipeStatsWindow.h gives: the library truncates its log per process, so two readers
     // in one lane race under `ctest -j`.
@@ -549,11 +604,9 @@ void main() { oColor = vec4(vColor, 1.0); }
                    "a window with "
                 << kDrawsInTheWindow
                 << " writes and as many draws through a live coherent mapping cannot have pushed "
-                   "zero bytes. Zero here with MOBILEGL_IPC_PERSISTENT_BLOCK_KB at its default "
-                   "means the push is not reaching this buffer - which is a DIFFERENT defect from "
-                   "the store having been adopted, and the arm assertion above has already ruled "
-                   "that one out. Zero with the knob set to 0 is exit gate E3(a)'s negative control "
-                   "working as intended. Line: "
+                   "zero bytes. Zero here means the push is not reaching this buffer - which is a "
+                   "DIFFERENT defect from the store having been adopted, and the arm assertion "
+                   "above has already ruled that one out. Line: "
                 << window.line;
         } else {
             // Recorded, not asserted: on this arm the number is whatever the driver's adoption

MobileGL/MG_IntegrationTest/Scenarios/PipeVerifyArmingScenario.cpp

@@ -16,10 +16,11 @@
 // clean pass. That is the failure mode this scenario exists to make impossible:
 //
 //   Armed                    - the environment says the comparator is on for this process, so the
-//                              library must SAY it armed. It asserts a library observable against
-//                              the environment, the same shape UnlocatedIoBlockScenario's arming
-//                              case and AsyncCompileScenario::ExtensionStringMatchesTheConfiguration
-//                              use. A lane whose library never armed FAILS here; it never passes.
+//                              library must SAY it armed, with fatal=1. It asserts a library
+//                              observable against the environment, the same shape
+//                              UnlocatedIoBlockScenario's arming case and
+//                              AsyncCompileScenario::ExtensionStringMatchesTheConfiguration use. A
+//                              lane whose library never armed FAILS here; it never passes.
 //   CorruptedFieldIsReported - the negative control for the comparator itself (gate G4). With
 //                              MOBILEGL_PIPE_VERIFY_CORRUPT naming a field, the snapshot arm is
 //                              perturbed before the entry compare, so a comparator that works must
@@ -221,11 +222,6 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
                                 "set, so the library has nowhere to record that it armed; the Verify. "
                                 "ctest entries set both";
             }
-            if (StringKnobIsSet("MOBILEGL_PIPE_VERIFY_CORRUPT")) {
-                GTEST_SKIP() << "MOBILEGL_PIPE_VERIFY_CORRUPT is armed in this process, so a divergence "
-                                "is the EXPECTED outcome and asserting on its absence here would be "
-                                "backwards; the VerifyCorrupted. lane owns that half";
-            }
 
             const MGITest::PipeStatsWindow::LogMark before = LibraryLogMark();
             ASSERT_NO_FATAL_FAILURE(DrawOneFrame());
@@ -235,13 +231,28 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
             // of the process, which may already have happened during the harness bring-up. The file
             // is truncated at this process's first log write, so it still carries nothing else.
             const std::string whole = LibraryLog();
-            EXPECT_NE(whole.find(kArmedLine), std::string::npos)
+            const std::size_t armedAt = whole.find(kArmedLine);
+            EXPECT_NE(armedAt, std::string::npos)
                 << "MOBILEGL_PIPE_VERIFY=1 is set for this process and a frame was cleared, drawn and "
                    "read back, and the library never reported arming the comparator. Either this "
                    "library was not built with -DMOBILEGL_PIPE_VERIFY=ON (in which case the whole lane "
                    "is verifying nothing), or the arming MGLOG_I is gone. Log:\n"
                 << whole;
 
+            // Fatal as well as armed: an ambient entry fails on a divergence only through the abort,
+            // so a lane armed non-fatal logs every divergence and stays green. This entry is the
+            // ambient entries' environment plus its marker and log (CMakeLists.txt builds both from
+            // one list), so its arming line answers for theirs.
+            if (armedAt != std::string::npos) {
+                const std::size_t eol = whole.find('\n', armedAt);
+                const std::string line =
+                    whole.substr(armedAt, eol == std::string::npos ? std::string::npos : eol - armedAt);
+                EXPECT_NE(line.find("fatal=1"), std::string::npos)
+                    << "the comparator armed, but not fatal, so a divergence in any entry of this lane "
+                       "is logged and the entry stays green. Arming line:\n"
+                    << line;
+            }
+
             const std::string appended = LibraryLogSince(before);
             EXPECT_EQ(appended.find(kDifferPrefix), std::string::npos)
                 << "the comparator reported a push/pull divergence on an ordinary frame:\n"
@@ -257,9 +268,8 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
         //
         // It runs in its own lane (VerifyCorrupted.) because the knob is process-wide, and with
         // MOBILEGL_PIPE_VERIFY_FATAL=0 so the process survives its own divergence and this case can
-        // read the report back out of the log. The CI step that runs the SAME knob against the
-        // ambient lane - where FATAL keeps its default - asserts the other half: there, the
-        // divergence must abort and ctest must go red.
+        // read the report back out of the log. With FATAL at its default the divergence aborts
+        // instead, which PipeInputsTest.VerifyCorruptKnobNamesTheFieldAtEntry asserts.
         TEST_F(PipeVerifyArmingScenario, CorruptedFieldIsReported) {
             if (!Ready()) return;
 

MobileGL/MG_IntegrationTest/Scenarios/PoisonOmissionScenario.cpp

@@ -11,22 +11,26 @@
 // The per-verb poison is the half of P1 that makes a forgotten fill row loud instead of silent: the
 // filler stamps a generation on every field it copies for a verb, and an accessor whose stamp is not
 // this verb's aborts with Fatal{UnmigratedPipeInput, "<Field>@<Verb>"}. A mechanism that can only be
-// observed when someone forgets a row is a mechanism nobody can trust, so MOBILEGL_PIPE_POISON_OMIT
-// forges the mistake on purpose: it names one (verb, field) pair whose STAMP the filler skips while
-// still copying the value, which is indistinguishable from a row that was never written.
+// observed when someone forgets a row is a mechanism nobody can trust, so the control forges the
+// mistake on purpose: the harness marker MGITEST_POISON_OMIT names one (verb, field) pair, and the
+// child arms it through the verify build's setter (Harness/PoisonOmissionArm.h), so the filler skips
+// that pair's STAMP while still copying the value - indistinguishable from a row never written.
 //
 // The scenario asserts both halves of "on THAT verb, and only there":
 //
-//   OmittedFieldAbortsOnThatVerb - with MOBILEGL_PIPE_POISON_OMIT=GenerateMipmap:GetActiveTextureUnit,
-//                                  a draw must still complete (GetActiveTextureUnit is not in kDraw's
-//                                  mask, and the draw's own fields are stamped normally) and the
-//                                  following glGenerateMipmap must abort naming exactly that pair.
-//   WithoutOmissionCompletes     - the identical sequence with the knob unset runs to completion with
-//                                  no Fatal at all. Without this half, "it aborted" would say nothing
-//                                  about WHY: a poison that fired on every verb would look just as red.
+//   OmittedFieldAbortsOnThatVerb - with MGITEST_POISON_OMIT=ReadPixels:GetPixelStoreParameters, the
+//                                  draw and the glGenerateMipmap must still complete (the stamp is
+//                                  withheld at ReadPixels alone, and their own fields are stamped
+//                                  normally) and the following glReadPixels must abort naming
+//                                  exactly that pair.
+//   WithoutOmissionCompletes     - the identical sequence with the marker unset runs to completion
+//                                  with no Fatal at all. Without this half, "it aborted" would say
+//                                  nothing about WHY: a poison that fired on every verb would look
+//                                  just as red.
 //
-// The knob is process-wide, so the two cases cannot share a lane: the first runs in the PoisonOmitted.
-// entries, the second in the ambient Verify. entries (it skips when the knob IS set).
+// The omission is process-wide, so the two cases cannot share a lane: the first runs in the
+// PoisonOmitted. entries, the second in the ambient Verify. entries (the first skips when the marker
+// is unset).
 //
 // WHY THE SEQUENCE RUNS IN A SEPARATE PROCESS, AND WHY THAT PROCESS IS fork()+execve() AND NOT fork()
 // ALONE. The poison reports with MGLOG_F and then std::abort(), in the middle of a GL command - so the
@@ -56,6 +60,7 @@
 
 #include "../Harness/PipeStatsWindow.h"
 #include "../Harness/HeadlessGL.h"
+#include "../Harness/PoisonOmissionArm.h"
 #include "../Harness/ScenarioFixture.h"
 
 #if !defined(_WIN32) && !defined(__APPLE__) && !defined(__ANDROID__) && __has_include(<sys/wait.h>)
@@ -81,28 +86,23 @@ extern char** environ;
 namespace MGITest {
     namespace {
 
-        // What the PoisonOmitted. ctest entries and the CI negative-control steps name. Each pair is
-        // spelled here so the assertion below is about the exact string the poison contracts to
-        // print (ARCHITECTURE.md 9.2: Fatal{UnmigratedPipeInput, "<Field>@<Verb>"}).
+        // What the PoisonOmitted. and VerifySplitPoisonOmitted. ctest entries put in
+        // MGITEST_POISON_OMIT, and CI requires both to pass by name. The pair is spelled here so the
+        // assertion below is about the exact string the poison contracts to print (ARCHITECTURE.md
+        // 9.2: Fatal{UnmigratedPipeInput, "<Field>@<Verb>"}).
         //
-        // TWO PAIRS SINCE P7 WAVE 3, ONE PER ARM, because the first one is structurally inert on
-        // the split arm. GenerateMipmap:GetActiveTextureUnit is the monolith control: the monolith
-        // backend resolves the texture to mip through the active unit. Under a transport it does
-        // not - since P5c hd the server's generate_mipmap resolves the texture from the verb's own
-        // handle (MGPipeApplier().VerbMipRes) and never reads the active unit - so omitting that
-        // stamp is omitting a stamp nobody reads, and the child exits 0 (measured on
-        // integration-verify-split, both backends). ReadPixels:GetPixelStoreParameters is the
-        // split control: the server's read_pixels backend call DOES read the pack half through the
-        // accessor, under the server's own stamp, which honours the knob in a verify build
-        // (MG_Backend/MGPipe/PipeInputs.cpp's ServerPoisonOmission).
+        // ONE PAIR FOR BOTH ARMS SINCE P13 W5. The record arm resolves glGenerateMipmap's texture
+        // from the verb's own handle and never reads the active unit, so the old monolith pair,
+        // GenerateMipmap:GetActiveTextureUnit, withheld a stamp nobody reads. ReadPixels' pack
+        // state is read on both arms: by the monolith record arm around its neutral-pack readback,
+        // and by the server's read_pixels under the server's own stamp, which withholds the pair
+        // too (MG_Backend/MGPipe/PipeInputs.cpp, MGPipeServerSetPoisonOmission).
         //
-        // AND EACH PAIR SAYS WHICH ROLE HAS TO FIRE (`FiresOnTheServer`), which is the whole point
-        // of the split pair and was not checked at all until P7 wave 3's V1 fix round. The reader
-        // below concatenates the child's two role halves and the assertion searched the union, so
-        // `VerifySplitPoisonOmitted.` would have been just as green if the stamp the knob withheld
-        // had been the CLIENT's - which is the case it exists to rule out, because the mechanism
-        // under test is MG_Backend/MGPipe/PipeInputs.cpp's server-side stamp honouring the knob.
-        // The monolith pair has one role and one log half, so it keeps the union.
+        // AND THE PAIR SAYS WHICH ROLE HAS TO FIRE (`FiresOnTheServer`, P7 wave 3's V1 fix round).
+        // The reader below concatenates the child's two role halves, so `VerifySplitPoisonOmitted.`
+        // would be just as green if the withheld stamp had been the CLIENT's - the case it exists to
+        // rule out. A build without MOBILEGL_BUILD_DISAGGREGATED has one role and one log half, so
+        // there the union is all there is.
         struct OmittedPair {
             const char* Verb;
             const char* Field;
@@ -110,7 +110,6 @@ namespace MGITest {
             bool FiresOnTheServer;       // the Fatal must be in the child's SERVER half, not merely present
         };
         constexpr OmittedPair kOmittedPairs[] = {
-            {"GenerateMipmap", "GetActiveTextureUnit", {"@DrawArrays", "@DrawArrays"}, false},
             {"ReadPixels", "GetPixelStoreParameters", {"@DrawArrays", "@GenerateMipmap"}, true},
         };
         constexpr const char* kFatalPrefix = "Fatal{UnmigratedPipeInput";
@@ -120,6 +119,11 @@ namespace MGITest {
         constexpr const char* kChildMarker = "MGITEST_POISON_OMISSION_CHILD";
         constexpr const char* kWorkerFilter = "--gtest_filter=PoisonOmissionScenario.TheSequenceThePoisonControlsRun";
 
+        // The pair to withhold, as <Verb>:<Field>, set by the PoisonOmitted. ctest entries and
+        // inherited by the child. A HARNESS marker (hence MGITEST_): the library never reads it,
+        // and the worker arms the omission itself (Harness/PoisonOmissionArm.h).
+        constexpr const char* kOmissionMarker = "MGITEST_POISON_OMIT";
+
         constexpr const char* kVS = R"(#version 330 core
 in vec2 aPos;
 void main() { gl_Position = vec4(aPos, 0.0, 1.0); }
@@ -265,14 +269,14 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
                 glFinish();
                 std::fprintf(stderr, "[itest] poison worker: the draw completed\n");
 
-                // The verb the omission names. Under MOBILEGL_PIPE_POISON_OMIT this must abort.
+                // A texture verb between the draw and the readback; the omission does not name it.
                 glBindTexture(GL_TEXTURE_2D, texture);
                 glGenerateMipmap(GL_TEXTURE_2D);
                 glFinish();
                 std::fprintf(stderr, "[itest] poison worker: glGenerateMipmap returned\n");
 
-                // The split arm's verb (kOmittedPairs[1]): a readback, which is a round trip, so
-                // the server has applied it - and read the pack state - before this returns.
+                // The verb the omission names (kOmittedPairs): a readback, which is a round trip,
+                // so the server has applied it - and read the pack state - before this returns.
                 unsigned char centre[4] = {};
                 glReadPixels(gl.Width() / 2, gl.Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, centre);
                 std::fprintf(stderr, "[itest] poison worker: glReadPixels returned\n");
@@ -382,6 +386,18 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
             }
             if (!Ready()) return;
 
+            // The omission the marker names, armed on this thread - the one that issues the GL calls
+            // - before the sequence's first verb. Without the marker nothing is armed, which is
+            // WithoutOmissionCompletes' half.
+            if (const char* marker = std::getenv(kOmissionMarker); marker != nullptr && *marker != '\0') {
+                const std::string pair(marker);
+                const std::string::size_type colon = pair.find(':');
+                ASSERT_NE(colon, std::string::npos) << kOmissionMarker << "=" << pair << " is not <Verb>:<Field>";
+                ASSERT_TRUE(ArmPoisonOmission(pair.substr(0, colon).c_str(), pair.substr(colon + 1).c_str()))
+                    << "could not arm the omission " << kOmissionMarker << "=" << pair
+                    << ": the build has no setter (-DMOBILEGL_PIPE_VERIFY=ON compiles it) or a name is unknown";
+            }
+
             RunSequence();
 
 #if MGITEST_POISON_HAVE_FORK
@@ -404,21 +420,22 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
         TEST_F(PoisonOmissionScenario, OmittedFieldAbortsOnThatVerb) {
             if (!Ready()) return;
 
-            if (!StringKnobIsSet("MOBILEGL_PIPE_POISON_OMIT")) {
-                GTEST_SKIP() << "this case is the poison's negative control and needs "
-                                "MOBILEGL_PIPE_POISON_OMIT=<Verb>:<Field> for the whole process, which "
-                                "is what the PoisonOmitted. ctest entries set";
+            if (!StringKnobIsSet(kOmissionMarker)) {
+                GTEST_SKIP() << "this case is the poison's negative control and needs " << kOmissionMarker
+                             << "=<Verb>:<Field>, which is what the PoisonOmitted. ctest entries set";
             }
-            const std::string knob = std::getenv("MOBILEGL_PIPE_POISON_OMIT");
+            const std::string marker = std::getenv(kOmissionMarker);
             const OmittedPair* pair = nullptr;
             for (const OmittedPair& candidate : kOmittedPairs) {
-                if (knob == std::string(candidate.Verb) + ":" + candidate.Field) pair = &candidate;
+                if (marker == std::string(candidate.Verb) + ":" + candidate.Field) pair = &candidate;
             }
             if (pair == nullptr) {
-                GTEST_SKIP() << "MOBILEGL_PIPE_POISON_OMIT is " << knob << ", but this case only knows "
-                             << "how to provoke " << kOmittedPairs[0].Verb << ":" << kOmittedPairs[0].Field << " and "
-                             << kOmittedPairs[1].Verb << ":" << kOmittedPairs[1].Field;
+                GTEST_SKIP() << kOmissionMarker << " is " << marker << ", but this case only knows how to provoke "
+                             << kOmittedPairs[0].Verb << ":" << kOmittedPairs[0].Field;
             }
+            ASSERT_TRUE(PoisonOmissionArmAvailable())
+                << kOmissionMarker << " is set, but only a -DMOBILEGL_PIPE_VERIFY=ON build compiles the setter "
+                << "the child arms the omission with (Harness/PoisonOmissionArm.h), so this control cannot run here";
             const std::string expectedPair = std::string(pair->Field) + "@" + pair->Verb;
 
             int status = 0;
@@ -452,10 +469,10 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
                 << childLog;
 #if MOBILEGL_BUILD_DISAGGREGATED
             // WHICH ROLE, for the split pair (P7 wave 3, V1). The union above answers "did the
-            // poison fire", which is all the monolith pair can be asked; this pair exists to prove
-            // that the SERVER'S OWN verb stamp honours MOBILEGL_PIPE_POISON_OMIT
-            // (MG_Backend/MGPipe/PipeInputs.cpp's ServerPoisonOmission) - the thing that was NOT
-            // true before wave 3 and made the control silently green. A client-side firing would
+            // poison fire", which is all a one-role build can be asked; this pair exists to prove
+            // that the SERVER'S OWN verb stamp honours the omission
+            // (MG_Backend/MGPipe/PipeInputs.cpp's MGPipeServerSetPoisonOmission) - the thing that was
+            // NOT true before wave 3 and made the control silently green. A client-side firing would
             // satisfy the union and prove the opposite of what the entry claims, so the half is
             // named here.
             if (pair->FiresOnTheServer) {
@@ -480,14 +497,12 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
             }
         }
 
-        // The sibling control, in the ambient Verify. lanes: the same sequence with the knob UNSET
-        // must run to completion and log no Fatal at all.
+        // The ambient half of the pair, in the ambient Verify. lanes: the same sequence with the
+        // marker UNSET must run to completion and log no Fatal at all. The PoisonOmitted. entries are
+        // the armed half (marker set, the verb must abort), and CI requires those entries by name.
         //
-        // It deliberately does NOT skip when MOBILEGL_PIPE_POISON_OMIT is set. This is the entry
-        // CI's always-on negative control B exports the knob at: a green entry that the omission
-        // turns red is the whole proof that the poison is armed, and an entry that politely skipped
-        // itself would report that green either way. Nothing else in the integration suite calls
-        // glGenerateMipmap, so this case is also the only possible target for that control.
+        // It does not skip when MGITEST_POISON_OMIT is set: run by hand with the marker exported,
+        // it goes red, and the note in its failure says that is the poison firing.
         TEST_F(PoisonOmissionScenario, WithoutOmissionCompletes) {
             if (!Ready()) return;
 
@@ -495,7 +510,7 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
                 GTEST_SKIP() << "the poison is only compiled into the push/verify builds; in an ordinary "
                                 "build there is nothing for this control to be a control OF";
             }
-            const bool omissionArmed = StringKnobIsSet("MOBILEGL_PIPE_POISON_OMIT");
+            const bool omissionArmed = StringKnobIsSet(kOmissionMarker);
 
             int status = 0;
             std::string reason;
@@ -503,11 +518,10 @@ void main() { o_color = vec4(0.25, 0.5, 0.75, 1.0); }
 
             const std::string childLog = ReadChildLog();
             const std::string note =
-                omissionArmed
-                    ? std::string(" NOTE: MOBILEGL_PIPE_POISON_OMIT is set in this process, so this failure is "
-                                  "what CI's negative control B is asking for - the poison IS armed, and this "
-                                  "entry going red is the proof.")
-                    : std::string();
+                omissionArmed ? std::string(" NOTE: ") + kOmissionMarker +
+                                    " is set in this process, so this failure is expected: the poison IS armed, and "
+                                    "this entry going red is the proof."
+                              : std::string();
             ASSERT_TRUE(WIFEXITED(status))
                 << "with no omission armed, a draw followed by glGenerateMipmap must complete; the child "
                 << DescribeStatus(status)

MobileGL/MG_Pipe/FatalFamilies.def

@@ -31,7 +31,7 @@
     X(UnnamedIdentity,               ProtocolCorruption, "a per-context memo was consulted with a null context identity") \
     X(PipeLegacyMemosDisabled,       ProtocolCorruption, "a subsystem bit is clear and this build compiles no legacy arm to fall back to (unreachable since P13 W3b fixed bits 0-13 on)") \
     X(PipeSubsystemsFixedOn,         ProtocolCorruption, "MOBILEGL_PIPE_PUSH cleared one of subsystem bits 0-13, which P13 fixed on") \
-    X(PipeVerifyBadKnob,             ProtocolCorruption, "a MOBILEGL_PIPE_VERIFY/POISON knob named a verb or field that does not exist") \
+    X(PipeVerifyBadKnob,             ProtocolCorruption, "MOBILEGL_PIPE_VERIFY_CORRUPT named a field that does not exist") \
     X(PipeVerifyDiffer,              ProtocolCorruption, "the verify comparator found a pushed field differing from the live one") \
     X(UnexpectedMapAccept,           ProtocolCorruption, "a persistent-map accept arrived where the protocol permits none") \
     X(UncarriedInitialBytes,         ProtocolCorruption, "a producer's initial bytes were required on the wire and absent") \

MobileGL/MG_Pipe/FillPoints.def

@@ -10,8 +10,8 @@
 // MGP_FILL_VERB_LIST: every GLFunctionsTable function pointer in declaration order, with its
 // class (gen_pipe.py refuses any other set). MGP_FILL_FIELD_LIST: the fields a class may read;
 // sticky fields (MGP_COVERAGE_STICKY_LIST) are implicit. Fix Fatal{UnmigratedPipeInput} by
-// adding a row, never by making it sticky. A row is removed only on a MOBILEGL_PIPE_POISON_OMIT
-// run of the full CTS caselist on both devices; a corpus that never reaches a path proves nothing.
+// adding a row, never by making it sticky. A row is removed only after a poison build without it
+// ran the full CTS caselist on both devices; a corpus that never reaches a path proves nothing.
 // gen_pipe.py's block regexes end at a blank line: keep the empty line after each macro.
 // clang-format off
 

MobileGL/MG_Pipe/PipeApply.h

@@ -396,11 +396,25 @@ namespace MobileGL::MG_Pipe {
             Uint64 Serial = 0;
             Uint64 BindingsSerial = 0;
             Uint64 Hash = 0;
+            // The hash of the variant of this program the factory last handed out for this key:
+            // Hash itself, or a variant keyed on draw-time vertex data. Derived from Hash, so it
+            // is valid exactly as long.
+            Uint64 LastVariantHash = 0;
             Uint32 Key = 0;
             Bool Valid = false;
         };
         mutable Array<BackendHashMemoEntry, 4> BackendHashMemo{};
         mutable Uint32 BackendHashMemoNext = 0;
+        // A backend's own derivation from the archive: the locations of its 32-bit int and uint
+        // vertex inputs, valid while Serial holds the value it was taken at. It dies with the
+        // record like the memo above, and nothing in MG_Pipe reads it.
+        struct BackendIntegerInputsMemo {
+            Uint64 Serial = 0;
+            Uint32 SignedInputs = 0;
+            Uint32 UnsignedInputs = 0;
+            Bool Valid = false;
+        };
+        mutable BackendIntegerInputsMemo BackendIntegerInputs{};
     };
 
     // The vertex-elements CSO as the applier holds it: the unpacked blob, both views, plus

MobileGL/MG_Pipe/PipeMutation.h

@@ -15,7 +15,7 @@
 // materialising a queued clear, overriding a sampler's filter) would leave the copy stale, so
 // the mutator calls MGP_NOTE_MUTATION(Field) where it moves the value. The notice refreshes
 // that one field when it belongs to the verb in flight. It never touches the poison stamp, so a
-// stamp withheld by MOBILEGL_PIPE_POISON_OMIT stays withheld.
+// stamp the fill withheld (negative control B) stays withheld.
 #include <MG_Pipe/MGPipe.h>
 namespace MobileGL::MG_Pipe {
     // MG_Impl/Pipe/PipeFill.cpp (the client side, the only place that may spell pGLContext).

MobileGL/MG_Remote/Client/ClientSession.cpp

@@ -236,14 +236,6 @@ namespace MobileGL::MG_Remote::Client {
 #endif
         }
 
-        Bool VerbBarrierFromConfig() {
-#if MOBILEGL_BUILD_DISAGGREGATED
-            return MG_Config::Ipc.VerbBarrier != 0;
-#else
-            return true;
-#endif
-        }
-
         // ---- c1: the barrier's two flags ------------------------------------------------
         //
         // thread_local for the client's own "am I waiting", a shared atomic for "is the apply
@@ -1810,14 +1802,6 @@ namespace MobileGL::MG_Remote::Client {
             return MOBILEGL_ERR_INVALID_ARGUMENT;
         }
 
-        m_barrierArmed = VerbBarrierFromConfig();
-        if (!m_barrierArmed) {
-            MGLOG_W("MG_Remote client: MOBILEGL_IPC_VERB_BARRIER=0 - this is R-1's NEGATIVE "
-                    "CONTROL and is EXPECTED to be red. 31 of the 63 PipeInputs fields are still "
-                    "pulled from a live GLContext by the client's residual fill, so a free-running "
-                    "queue lets the server read a FUTURE value of them");
-        }
-
         // ---- 6. the client's segment table. IT MUST NOT INSTALL THE PROCESS RESOLVER: there is
         // exactly one gMGPipeSegmentResolver per process, the SERVER role owns it (table 3), and
         // the client never resolves a span at all - it only ever writes Ptr = nullptr (R-2's
@@ -1989,9 +1973,8 @@ namespace MobileGL::MG_Remote::Client {
             // permits submittedSeq to be published lazily and RingProducer::Publish encourages batching
             // the publish, so the shared watermark is allowed to lag the emitter - and a drain
             // that waited for `appliedSeq >= submittedSeq` would then under-wait and free an
-            // emitter-owned var-tail while a record still names it. With the verb barrier armed
-            // the two are equal; under MOBILEGL_IPC_VERB_BARRIER=0, R-1's negative control that
-            // the phase has to run once, they are not.
+            // emitter-owned var-tail while a record still names it. Run-ahead and the batched
+            // waits return before the apply, so the two may differ when Stop() runs.
             const Uint64 submitted = m_producer.LastPublishedSeq();
             m_producer.PublishAndNotify(submitted);
             if (submitted != 0 &&
@@ -2338,14 +2321,6 @@ namespace MobileGL::MG_Remote::Client {
             }
         }
 
-        if (!m_barrierArmed && !ownsReplySlot) {
-            // R-1's NEGATIVE CONTROL ARM, and the only thing it turns off is the barrier. A
-            // reply-slot row still waits: the answer is not derivable here and R-5 forbids
-            // inventing one, so MOBILEGL_IPC_VERB_BARRIER=0 makes the queue free-running, not
-            // the client clairvoyant.
-            return seq;
-        }
-
         ++m_recordWaits;
         if (MG_Config::Ipc.WaitStats && RunAheadArmed()) ++g_waitCensus.recordWaits[static_cast<SizeT>(op)];
         const BarrierWaitScope waiting;
@@ -2441,10 +2416,6 @@ namespace MobileGL::MG_Remote::Client {
         return seq;
     }
 
-    Bool ClientSession::BarrierArmed() const {
-        return m_barrierArmed;
-    }
-
     // ---- P5e (ra): the run-ahead latch and the waits it leaves behind ---------------------
 
     Bool ClientSession::RunAheadArmed() const {
@@ -2465,8 +2436,8 @@ namespace MobileGL::MG_Remote::Client {
 #if MOBILEGL_BUILD_DISAGGREGATED
         // THE CONJUNCTION, IN THE CONTRACT'S OWN ORDER (§1). The caps read is last because it
         // is the only one that costs a mirror load, and because it is the only one whose answer
-        // can change: the other two are process configuration.
-        const Bool armed = m_barrierArmed && MG_Config::Ipc.RunAhead != 0 && Caps().HasCap(MG_Pipe::kCapRunAheadApply);
+        // can change: the other one is process configuration.
+        const Bool armed = MG_Config::Ipc.RunAhead != 0 && Caps().HasCap(MG_Pipe::kCapRunAheadApply);
         if (!m_runAheadLatched) {
             m_runAheadLatched = true;
             m_runAheadArmed = armed;
@@ -2475,7 +2446,7 @@ namespace MobileGL::MG_Remote::Client {
                         "kCapRunAheadApply, so an unbarriered record is published and not "
                         "waited for (CONTRACT-P5E §2.3), paced by a present credit of %u",
                         MG_Config::Ipc.PresentCredit);
-            } else if (MG_Config::Ipc.RunAhead != 0 && m_barrierArmed) {
+            } else if (MG_Config::Ipc.RunAhead != 0) {
                 // THE KNOB IS NOT A SWITCH ON ITS OWN, and an operator who set it has to be
                 // told that, or an A/B arm that measured nothing looks like an A/B arm that
                 // measured no difference (Config.h's own argument for parsing it everywhere).
@@ -2747,10 +2718,6 @@ namespace MobileGL::MG_Remote::Client {
         if (MG_Config::Ipc.BatchWaits != 0) return;
         if (Server::ServerLoop::OnApplyThread()) return; // the applier owns the block inside a verb
         if (!ClientSessionInstance().Started()) return;  // the bring-up window pre-dates the roles
-        // MOBILEGL_IPC_VERB_BARRIER=0 is R-1's NEGATIVE CONTROL: the single-writer rule is off
-        // by the operator's own hand there, and EmitAndWait's Fatal{BarrierViolation} owns the
-        // red. Firing here instead would pre-empt the control's evidence line.
-        if (!ClientSessionInstance().BarrierArmed()) return;
         if (!ApplyThreadIsInsideApplier()) return;
         // LAST, because it is the only thread_local left in the chain: an emutls call per
         // access in a shared library, and it must stay thread-local (see InBarrierWait's note

MobileGL/MG_Remote/Client/ClientSession.h

@@ -193,7 +193,7 @@ namespace MobileGL::MG_Remote::Client {
         Wire::PipeWireEncoder& Encoder();
         CapsMirror& Caps();
 
-        // Emit one record and, if the barrier is armed, wait for it. `replyOut`/`replyBytes`
+        // Emit one record and wait for it unless the wait rule lets it go. `replyOut`/`replyBytes`
         // name where a kReplySlot answer lands; pass {nullptr, 0} for a call that has none.
         // Returns the record's seq, which is also its reply-slot id.
         //
@@ -280,18 +280,13 @@ namespace MobileGL::MG_Remote::Client {
         // !willReadReply, and !willReadReply on a row with no reply slot, are Fatal by name: the
         // first would wait for an answer never sent, the second discards one never posted.
 
-        // MOBILEGL_IPC_VERB_BARRIER. False is the R-1 negative control and is EXPECTED to be
-        // red; it must be run once and the way it goes red recorded.
-        Bool BarrierArmed() const;
-
         // ---- P5e (ra): the wait rule (CONTRACT-P5E §1, §2.3, §2.4, §2.5) -------------------
 
-        // A CONJUNCTION OF THREE, LATCHED ONCE: `m_barrierArmed && Ipc.RunAhead &&
-        // Caps().HasCap(kCapRunAheadApply)`. The third conjunct is the server's own statement
-        // that it applies an unbarriered record without reading client memory, so run-ahead is
-        // never something the client can turn on by itself - on Magma, and on Espryt until the
-        // integration commit publishes bit 10, this answers false and EmitAndWaitTails runs
-        // today's lockstep path byte for byte.
+        // A CONJUNCTION OF TWO, LATCHED ONCE: `Ipc.RunAhead && Caps().HasCap(kCapRunAheadApply)`.
+        // The second conjunct is the server's own statement that it applies an unbarriered record
+        // without reading client memory, so run-ahead is never something the client can turn on
+        // by itself - on Magma, and on Espryt until the integration commit publishes bit 10,
+        // this answers false and EmitAndWaitTails runs today's lockstep path byte for byte.
         //
         // LATCHED AT THE FIRST CAPS ADOPTION AFTER Start, AND A LATER SNAPSHOT MAY ONLY TURN IT
         // OFF. A caps re-run cannot promote a lockstep server to a run-ahead one mid-frame:
@@ -540,7 +535,6 @@ namespace MobileGL::MG_Remote::Client {
 
         Wire::PipeWireEncoder m_encoder;
         Wire::SegmentTable m_segments;
-        Bool m_barrierArmed = true;
         // P5e (ra): the latch of RunAheadArmed() and the fact that it has been taken once.
         Bool m_runAheadArmed = false;
         Bool m_runAheadLatched = false;

MobileGL/MG_Remote/Client/EmitTables.cpp

@@ -62,9 +62,8 @@
 
 namespace MobileGL::MG_Remote::Client {
 
-    // P13 W5: the pre-verb hook and the E2 evidence line are the verb port's (VerbPort.h).
+    // The pre-verb hook is the verb port's (VerbPort.h).
     using MG_Record::BeforeReadOnlyVerb;
-    using MG_Record::LogE2ControlLine;
 
     // The slot arithmetic, asserted rather than commented. GlobalBackendFunctionsTable is
     // GLFunctionsTable plus Present plus SetSwapInterval; GLFunctionsTable is 71 function
@@ -80,7 +79,6 @@ namespace MobileGL::MG_Remote::Client {
 
     namespace {
 
-        Uint64 g_presentOrdinal = 0;
         Uint64 g_publishedMaxRecordBytes = 0;
 
         // ---- the session, demanded rather than assumed --------------------------------
@@ -216,9 +214,6 @@ namespace MobileGL::MG_Remote::Client {
             // keyed on pActiveBackendObject.get() (Core.cpp:34) and that pointer never changes
             // under split.
             session.PumpControlPlane();
-
-            ++g_presentOrdinal;
-            LogE2ControlLine(g_presentOrdinal);
         }
 
         // =============================================================================
@@ -583,7 +578,6 @@ namespace MobileGL::MG_Remote::Client {
                       "the three classes no longer partition the 73 slots");
 
         MG_Backend::GlobalBackendFunctionsTable BuildRemoteEmitTable() {
-            MG_Record::ArmVerbControlKnobs();
             MG_Backend::GlobalBackendFunctionsTable table{};
 
             // ---- class C first, so that a slot forgotten below stays Fatal rather than null.

MobileGL/MG_Remote/Client/EmitTables.h

@@ -43,12 +43,10 @@ namespace MobileGL::MG_Remote::Client {
     // A reference to a never-destroyed block, like every other MG_Remote singleton (ID-8).
     const MG_Backend::GlobalBackendFunctionsTable& RemoteEmitTable();
 
-    // P13 W5: the verb emitters, the monolith verb port, the E2 controls and the readback / draw
-    // planners are MG_Record's (MG_Impl/Pipe/Verb/VerbPort.h) - the record arm runs them in a
+    // The verb emitters, the monolith verb port and the readback / draw planners are
+    // MG_Record's (MG_Impl/Pipe/Verb/VerbPort.h) - the record arm runs them in a
     // library without a transport. Re-exported here under the names the remote table's users
     // and its unit cases already spell.
-    using MG_Record::DroppedClearEmissions;
-    using MG_Record::DroppedDrawEmissions;
     using MG_Record::ForEachReadbackBand;
     using MG_Record::InstallMonolithVerbPort;
     using MG_Record::MonolithVerbPortInstalled;
@@ -64,8 +62,6 @@ namespace MobileGL::MG_Remote::Client {
     using MG_Record::RemoteIndexSizeFor;
     using MG_Record::ScatterReadbackBandIntoPackState;
     using MG_Record::ScatterTightReadbackIntoPackState;
-    using MG_Record::SetDropClearEmissionForNegativeControl;
-    using MG_Record::SetDropDrawEmissionForNegativeControl;
     using MG_Record::TightReadbackByteCount;
     using MG_Record::UnmigratedVerbFatal;
 

MobileGL/MG_Remote/Server/PipeApplier.cpp

@@ -28,6 +28,7 @@
 #include <MG_Pipe/PipeApply.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Debug/Log.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <MG_Util/Metrics/TextureMetrics.h>
 
 #include <cstdlib>
@@ -274,10 +275,10 @@ namespace MobileGL::MG_Remote::Server {
         // backend->SwapEGLBuffers -> BackendObject::SwapEGLBuffers -> eglSwapBuffers, and never
         // Present() - so the two paths do NOT both end here. The frame count staying in step with
         // the swap count rests entirely on c1 emitting exactly one present record per swap;
-        // nothing here compares Presents() to a swap count. If that drifts, the frame fence and
+        // nothing here compares the present count to a swap count. If that drifts, the frame fence and
         // TrimBufferPool's recycle watermark stop tracking frames - which is the reason the 1:1
         // was wanted, recorded here so a future swap-without-present is looked for rather than
-        // assumed impossible. Presents() is exposed for a lane that wants to make the comparison.
+        // assumed impossible.
         // The frame's damage rides to the native present for the length of this call.
         MG_Backend::SetCurrentPresentDamage(DamageOfRecord(present.DamageCount, present.Damage));
         table->Present();
@@ -302,7 +303,7 @@ namespace MobileGL::MG_Remote::Server {
                                 "waits on it for its credit (CONTRACT-P5E §2.4); returning a credit for "
                                 "serial 0 would release a wait that is asking about frame N");
         }
-        m_lastPresentSerial = present.FrameSerial != 0 ? present.FrameSerial : m_presents;
+        const Uint64 serial = present.FrameSerial != 0 ? present.FrameSerial : m_presents;
         // §2.4's other half, and the reason ServerSession::ReturnPresentCredit has had no
         // production caller since v1 wrote it: ONE CREDIT PER SWAP, returned after Present()
         // has returned rather than before it, because what the client is waiting for is the
@@ -314,7 +315,7 @@ namespace MobileGL::MG_Remote::Server {
             // or two ago at once, and a report posted only after this batch would race it. A
             // status query, no submit: the swap has just submitted.
             if (session->EventRingHasRoom()) ReportSignaledFences(/*flush=*/false);
-            session->ReturnPresentCredit(m_lastPresentSerial);
+            session->ReturnPresentCredit(serial);
         }
         return true;
     }
@@ -350,7 +351,8 @@ namespace MobileGL::MG_Remote::Server {
         // MGPipeApplierReset passes because this IS the apply thread; the GL-thread direct
         // call it replaced is the Fatal arm.
         MG_Pipe::MGPipeApplierReset();
-        ++m_applierResets;
+        if (MG_Util::PipeStats::Enabled())
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::ApplierResets, 1);
         return true;
     }
 
@@ -608,7 +610,6 @@ namespace MobileGL::MG_Remote::Server {
                                 "release) is the only token that needs no entry",
                                 static_cast<unsigned long long>(bind.ClientContextToken));
         }
-        ++m_bindContexts;
 #if MOBILEGL_BUILD_DISAGGREGATED
         // P14 S4 (docs/Disaggregated/design/11-state-ownership.md). THE NATIVE HALF OF THE SWITCH.
         //
@@ -658,7 +659,7 @@ namespace MobileGL::MG_Remote::Server {
         // to nothing.
         MG_Backend::DirectGLES::ReleaseTwinsForWireObjectDeath(death.Handle,
                                                                static_cast<MG_Pipe::MGPipeKind>(death.Kind));
-        ++m_objectDeaths;
+        if (MG_Util::PipeStats::Enabled()) MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::ObjectDeaths, 1);
         return true;
     }
 

MobileGL/MG_Remote/Server/PipeApplier.h

@@ -183,20 +183,6 @@ namespace MobileGL::MG_Remote::Server {
         Bool OnSharedImage(const MG_Pipe::MGPSharedImageOp& op, Uint64 seq,
                            MG_Pipe::MGPSharedImageReply& reply) override;
 
-        // P5c ct's tallies, for the same reason every other row's tally exists (R-16: a probe
-        // may not arm against a stub). ApplierResets counts the records ACCEPTED (serial
-        // checked, reset run); ObjectDeaths counts every record the sink dispatched.
-        Uint64 ApplierResets() const { return m_applierResets; }
-        Uint64 ObjectDeaths() const { return m_objectDeaths; }
-        Uint64 BindContexts() const { return m_bindContexts; }
-        // The ContextSerial the NEXT applier_reset record must carry. Exposed so a case can
-        // assert the sequence rather than only the count.
-        Uint64 ExpectedApplierResetSerial() const { return m_applierResetSerial; }
-
-        // The session's per-verb tallies; the record verbs' are RecordVerbSink's.
-        Uint64 Presents() const { return m_presents; }
-        Uint64 LastPresentSerial() const { return m_lastPresentSerial; }
-
     private:
         // A backend change ends every fence and query this sink holds (they are the old
         // backend's natives).
@@ -231,20 +217,10 @@ namespace MobileGL::MG_Remote::Server {
         Bool QueryGpuComplete(QueryEntry& entry, Bool wait);
         UnorderedMap<Uint32, QueryEntry> m_queries;
         Uint64 m_presents = 0;
-        Uint64 m_lastPresentSerial = 0;
-        // P5c ct. m_applierResetSerial is BOTH the expected ContextSerial of the next record
-        // and the count of accepted resets: the two are one number because the serial is the
-        // session's own count of applier_reset records (CONTRACT-P5C.md §1: asserted, never
-        // dispatched on). m_objectDeaths counts records dispatched, released twin or not -
-        // the idempotent second path answering "nothing held it" is a legal record.
+        // m_applierResetSerial is both the expected ContextSerial of the next record and the
+        // count of accepted resets: the serial is the session's own count of applier_reset
+        // records (CONTRACT-P5C.md §1: asserted, never dispatched on).
         Uint64 m_applierResetSerial = 0;
-        Uint64 m_applierResets = 0;
-        Uint64 m_objectDeaths = 0;
-        // P14 S1. BindContexts counts the records the sink dispatched and bound on the session;
-        // the token itself lives on the session (ServerSession::CurrentContextToken), which is
-        // the object the control plane's CreateContext/DestroyContext also own - one table, one
-        // owner, and the sink is only the ring's door into it.
-        Uint64 m_bindContexts = 0;
         // The newest native fence (shared_image NativeFence) this session handed out, kept so a
         // later fence with nothing left to export still answers with a descriptor: by then this
         // one has signaled (the backend waited the work out), and a signaled sync_file stays so.

MobileGL/MG_Remote/Server/ServerMain.cpp

@@ -765,19 +765,6 @@ namespace {
             const auto* envelope = Protocol::GetCtrlEnvelope(buffer.data());
             if (const auto* flush = envelope->msg_as_LogFlush()) {
                 if (flush->ack()) break;
-                if (const char* inspect = std::getenv("MOBILEGL_TEST_SERVER_COUNTERS");
-                    inspect && std::strcmp(inspect, "1") == 0) {
-                    // SyncPeerLog has fenced the client's complete command prefix.
-                    // Acquire the applier's publication before reading its counters;
-                    // this serial client sends no more records until this ack.
-                    const auto applied = session.DataLink()->Progress()->appliedSeq.load(std::memory_order_acquire);
-                    const auto& verbs = session.Applier().Verbs();
-                    MGLOG_I("MGPipe server counters: applied=%llu resets=%llu reset-serial=%llu deaths=%llu",
-                            static_cast<unsigned long long>(applied),
-                            static_cast<unsigned long long>(verbs.ApplierResets()),
-                            static_cast<unsigned long long>(verbs.ExpectedApplierResetSerial()),
-                            static_cast<unsigned long long>(verbs.ObjectDeaths()));
-                }
                 FlushAck ack{control.get(), logForward.get(), flush->seq()};
                 MobileGL::MG_Util::Debug::WithLogBarrier(&SendLogAck, &ack);
                 continue;

MobileGL/MG_Remote/Transport/SessionRings.h

@@ -267,9 +267,8 @@ namespace MobileGL::MG_Remote::Transport {
         // encourages batching the publish, so the shared watermark may lag the
         // emitter - and a drain that waits for `appliedSeq >= submittedSeq` would
         // then under-wait and free an emitter's var-tail while a record still
-        // names it. With the verb barrier armed the two are equal; with
-        // MOBILEGL_IPC_VERB_BARRIER=0, R-1's negative control which the phase has
-        // to run once, they are not.
+        // names it. Run-ahead and the batched waits publish without waiting, so
+        // at teardown the two may differ.
         std::uint64_t LastPublishedSeq() const { return m_lastPublishedSeq; }
 
         // The verb barrier's wait, AND the reply's wait: they are the same wait

MobileGL/MG_State/GLState/BufferState/BufferObject.cpp

@@ -501,14 +501,7 @@ namespace MobileGL::MG_State::GLState {
         // carries are real, current and the cheapest honest ones there are. A zero-length
         // record would have been the alternative and it is illegal by contract rule A.
         if (m_size == 0) return;
-        const Uint64 blockBytes = MG_Record::PersistentMapTracker::BlockBytes();
-        // MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0 TURNS THE WHOLE MECHANISM OFF, STATE RECORD
-        // INCLUDED (E3(a)). An earlier cut skipped the blocks and still shipped a whole buffer
-        // here, which meant an unmap delivered the bytes the control exists to withhold - and
-        // a negative control that still delivers them is not a control. With the knob at 0
-        // nothing is published and nothing is pushed, so the probe answers clean, the frame
-        // draws the last uploaded bytes, and PersistentCoherentMapScenario goes red.
-        if (blockBytes == 0) return;
+        constexpr Uint64 blockBytes = MG_Record::PersistentMapTracker::BlockBytes();
         const SizeT length = blockBytes >= static_cast<Uint64>(m_size) ? m_size : static_cast<SizeT>(blockBytes);
         NotifySubData(0, length);
     }

MobileGL/MG_State/GLState/BufferState/BufferObject.h

@@ -150,7 +150,7 @@ namespace MobileGL {
             // behaviour and D-J forbids it. The pull build compiles none of it, which is also
             // how G1 holds over a file this central.
 
-            // ONE MOBILEGL_IPC_PERSISTENT_BLOCK_KB BLOCK of the mapped span, emitted through
+            // ONE BLOCK of the mapped span (PersistentMapTracker::BlockBytes), emitted through
             // the private NotifySubData - the same serial, the same defined-content flag, the
             // same record - so the split arm and the monolith arm differ in HOW the span is
             // cut and in nothing else. Called only by

MobileGL/MG_State/GLState/BufferState/PersistentMapTracker.cpp

@@ -724,10 +724,6 @@ namespace MobileGL::MG_Record {
         return *instance;
     }
 
-    Uint64 PersistentMapTracker::BlockBytes() {
-        return static_cast<Uint64>(MG_Config::RecordArm.PersistentBlockKb) * 1024ull;
-    }
-
     Bool PersistentMapTracker::PushIsArmed() {
         // P13 W4a: the record arm's buffer reads never ask the frontend object to sync a map, so
         // the client pushes the mapped span wherever that arm runs - monolith's included.
@@ -908,33 +904,7 @@ namespace MobileGL::MG_Record {
             Forget(buffer);
             return;
         }
-        const Uint64 blockBytes = BlockBytes();
-        // 0 IS THE NEGATIVE CONTROL, NOT "unlimited" (E3(a)). Pushing one whole-span block
-        // here would make the control green for the wrong reason - it has to disable the
-        // push, so that PersistentCoherentMapScenario draws the last uploaded bytes and goes
-        // red exactly the way an unpushed map does.
-        //
-        // AND IT SAYS SO, ONCE. Until now this was a silent `return`, so E3(a)'s red could
-        // only ever be the scenario's pixel assertion and the control had no way to tell "the
-        // push was disabled" apart from "the push was never armed, or never reached, or the
-        // knob never got here" (joint-v1.md §3: "There is no Fatal for block size zero";
-        // ID-65 assigns the line to x2). The control now requires BOTH: the pixel red AND
-        // this line in the entry's own private log. It is MGLOG_W and not a Fatal because 0
-        // is a legal configured value whose whole purpose is to keep running with the push
-        // off; aborting here would turn every E3(a) entry into a subprocess abort and take
-        // the pixel evidence with it.
-        if (blockBytes == 0) {
-            if (!m_blockZeroAnnounced) {
-                m_blockZeroAnnounced = true;
-                MGLOG_W("MGPipe: persistent-map push disabled - MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0 "
-                        "is exit gate E3(a)'s NEGATIVE CONTROL, not 'unlimited': a live "
-                        "persistent WRITE mapping's dirty blocks are NOT being pushed, so the "
-                        "server draws whatever bytes last crossed by some other route. A lane "
-                        "that stays green with this set is not getting its pixels from the push");
-            }
-            return;
-        }
-
+        constexpr Uint64 blockBytes = BlockBytes();
         const auto range = buffer.GetMappedRange();
         const Uint64 begin = static_cast<Uint64>(range.start);
         const Uint64 end = static_cast<Uint64>(range.end);
@@ -1077,15 +1047,12 @@ namespace MobileGL::MG_Record {
             if (shadow != nullptr) {
                 state = &m_blockHashes[buffer.GetLifetimeId()];
                 const Uint64 blockCount = (end - begin + blockBytes - 1) / blockBytes;
-                // A remap, a resize or a block-size change invalidates the layout the
-                // hashes were taken against: reset, which forces one full push - the
-                // conservative answer for a new layout.
-                if (state->begin != begin || state->end != end || state->blockBytes != blockBytes ||
-                    state->hashes.size() != blockCount) {
+                // A remap or a resize invalidates the layout the hashes were taken against:
+                // reset, which forces one full push - the conservative answer for a new layout.
+                if (state->begin != begin || state->end != end || state->hashes.size() != blockCount) {
                     *state = {};
                     state->begin = begin;
                     state->end = end;
-                    state->blockBytes = blockBytes;
                     state->hashes.assign(static_cast<SizeT>(blockCount), 0);
                 }
             }

MobileGL/MG_State/GLState/BufferState/PersistentMapTracker.h

@@ -28,14 +28,11 @@
 // pushing, and the two arms diverge with no test able to say so. IsLivePersistentMap() is the
 // single spelling; BufferObject::SyncPersistentMappedRange is held to it by a unit case.
 //
-// THE GRANULARITY. MOBILEGL_IPC_PERSISTENT_BLOCK_KB (default 64) blocks, keyed
-// {MGPipeHandle, blockIndex} - the key is implicit, because a block ships as an ORDINARY
-// resource_subdata record whose destination range is [blockIndex * blockBytes, + blockBytes).
-// NO NEW RECORD KIND: the existing record is already chunked by
-// MGPipeForEachSubDataRecordRange and already acceptance-gated, and a second way to say
-// "these bytes go there" is a second way to get it wrong. A block size of 0 is E3(a)'s
-// NEGATIVE CONTROL and means "push nothing" - not "one unlimited block" - so
-// PersistentCoherentMapScenario must go red under it.
+// THE GRANULARITY. 64 KiB blocks (BlockBytes()), keyed {MGPipeHandle, blockIndex} - the key
+// is implicit, because a block ships as an ORDINARY resource_subdata record whose destination
+// range is [blockIndex * blockBytes, + blockBytes). NO NEW RECORD KIND: the existing record is
+// already chunked by MGPipeForEachSubDataRecordRange and already acceptance-gated, and a second
+// way to say "these bytes go there" is a second way to get it wrong.
 //
 // Only changed blocks ship. At each validate point a member pushes just the blocks written
 // since its last push. A map the mprotect write-fault tracker holds (MOBILEGL_PIPE_PERSISTENT_MPROTECT;
@@ -101,8 +98,8 @@ namespace MobileGL::MG_Record {
         // client-exclusive). Leaks at exit for ID-8's reason, once per role-local singleton.
         static PersistentMapTracker& Instance();
 
-        // MOBILEGL_IPC_PERSISTENT_BLOCK_KB * 1024. Zero means the push is OFF (E3(a)).
-        static Uint64 BlockBytes();
+        // The push's block size (THE GRANULARITY above).
+        static constexpr Uint64 BlockBytes() { return 64ull * 1024ull; }
         // Transport != Monolith. The whole module is inert on the monolith path: an extra
         // resource_subdata record there would be new behaviour, which D-J forbids.
         static Bool PushIsArmed();
@@ -154,7 +151,6 @@ namespace MobileGL::MG_Record {
         void ResetCountersForTest() {
             m_blocksPushed = 0;
             m_bytesPushed = 0;
-            m_blockZeroAnnounced = false;
         }
         // Unit tests only: clears the membership, the hash cache and the mprotect tracked
         // slots (restoring every tracked page writable first), and resets the counters.
@@ -225,7 +221,6 @@ namespace MobileGL::MG_Record {
         struct BlockHashState {
             Uint64 begin = 0;
             Uint64 end = 0;
-            Uint64 blockBytes = 0;
             Vector<Uint64> hashes;
         };
         UnorderedMap<Uint64, BlockHashState> m_blockHashes;
@@ -252,11 +247,6 @@ namespace MobileGL::MG_Record {
         // ran them once (the two Members hooks) - the guard's thread-local read was a
         // measurable per-buffer-per-draw cost on the emutls path.
         void PushBlocksForChecked(MG_State::GLState::BufferObject& buffer);
-        // E3(a)'s diagnostic is emitted ONCE per process. PushBlocksFor runs at every validate
-        // point of every member, so an unlatched MGLOG_W would be one line per draw per mapping
-        // - and a control that has to grep a log cannot tell a message that fired from a
-        // message that flooded.
-        Bool m_blockZeroAnnounced = false;
     };
 
     // What the client's emit table calls immediately BEFORE emitting any verb that can read a

MobileGL/MG_Test/Backend/DirectGLES/CMakeLists.txt

@@ -57,6 +57,11 @@ target_link_libraries(
 )
 
 include(GoogleTest)
+add_executable(CapabilityLimitsTest CapabilityLimitsTest.cpp)
+target_include_directories(CapabilityLimitsTest PRIVATE ${MGL_ROOT}/include ${MGL_ROOT}/MobileGL)
+target_link_libraries(CapabilityLimitsTest PRIVATE MobileGLTestMain ${LINK_LIBRARIES})
+gtest_discover_tests(CapabilityLimitsTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
+
 add_executable(ContextEpochTest ContextEpochTest.cpp)
 target_include_directories(ContextEpochTest PRIVATE ${MGL_ROOT}/include ${MGL_ROOT}/MobileGL)
 target_link_libraries(ContextEpochTest PRIVATE MobileGLTestMain ${LINK_LIBRARIES})
@@ -69,6 +74,17 @@ add_executable(SubsystemDepsTest SubsystemDepsTest.cpp)
 target_include_directories(SubsystemDepsTest PRIVATE ${MGL_ROOT}/include ${MGL_ROOT}/MobileGL)
 target_link_libraries(SubsystemDepsTest PRIVATE MobileGLTestMain ${LINK_LIBRARIES})
 gtest_discover_tests(SubsystemDepsTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
+
+# DirectGLES's narrow integer attributes: the per-draw plan, and an armed vertex stage's ESSL.
+add_executable(IntegerAttributePlanTest IntegerAttributePlanTest.cpp)
+target_include_directories(IntegerAttributePlanTest PRIVATE ${MGL_ROOT}/include ${MGL_ROOT}/MobileGL)
+target_link_libraries(IntegerAttributePlanTest PRIVATE MobileGLTestMain ${LINK_LIBRARIES})
+gtest_discover_tests(IntegerAttributePlanTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
+
+add_executable(NarrowIntegerEsslTest NarrowIntegerEsslTest.cpp)
+target_include_directories(NarrowIntegerEsslTest PRIVATE ${MGL_ROOT}/include ${MGL_ROOT}/MobileGL)
+target_link_libraries(NarrowIntegerEsslTest PRIVATE MobileGLTestMain glslang-default-resource-limits ${LINK_LIBRARIES})
+gtest_discover_tests(NarrowIntegerEsslTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
 gtest_discover_tests(EsslShaderPassTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
 gtest_discover_tests(BaseInstanceInjectionTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)
 gtest_discover_tests(ViewportIndexRoutingTest DISCOVERY_TIMEOUT 30 PROPERTIES LABELS unit)

MobileGL/MG_Test/Backend/DirectGLES/CapabilityLimitsTest.cpp

@@ -0,0 +1,43 @@
+// MobileGL - MobileGL/MG_Test/Backend/DirectGLES/CapabilityLimitsTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include <gtest/gtest.h>
+#include <MG_Backend/DirectGLES/BackendObject_DirectGLES.h>
+#include <MG_State/GLState/TextureState/TextureState.h>
+
+using namespace MobileGL;
+
+// Iris budgets every program's samplers (vertex and fragment together) against
+// GL_MAX_TEXTURE_IMAGE_UNITS, so an ES driver's 16-per-stage answer leaves shader packs without a
+// pipeline. The fragment limit reports the desktop value whenever the driver's combined limit can
+// number that many units, and never more than the combined limit or the per-stage cap.
+TEST(DirectGLESCapabilityLimits, AdvertisesDesktopFragmentTextureUnitsWhenCombinedLimitAllows) {
+    constexpr Int kPerStageCap = MG_State::GLState::TextureState::MAX_PER_STAGE_TEXTURE_IMAGE_UNITS;
+    MG_Backend::DirectGLES::BackendObject_DirectGLES backend;
+
+    MG_External::GLESCapabilities adreno;
+    adreno.MaxTextureImageUnits = 16;
+    adreno.MaxVertexTextureImageUnits = 16;
+    adreno.MaxCombinedTextureImageUnits = 96;
+    backend.ApplyGLESCapabilitiesForTesting(adreno);
+    EXPECT_EQ(backend.GetDynamicParameters().MaxTextureImageUnits, kPerStageCap);
+    EXPECT_EQ(backend.GetDynamicParameters().MaxVertexTextureImageUnits, 16);
+    EXPECT_EQ(backend.GetDynamicParameters().MaxCombinedTextureImageUnits, 96);
+
+    MG_External::GLESCapabilities narrowCombined;
+    narrowCombined.MaxTextureImageUnits = 16;
+    narrowCombined.MaxCombinedTextureImageUnits = 20;
+    backend.ApplyGLESCapabilitiesForTesting(narrowCombined);
+    EXPECT_EQ(backend.GetDynamicParameters().MaxTextureImageUnits, 20);
+
+    MG_External::GLESCapabilities wide;
+    wide.MaxTextureImageUnits = 64;
+    wide.MaxCombinedTextureImageUnits = 192;
+    backend.ApplyGLESCapabilitiesForTesting(wide);
+    EXPECT_EQ(backend.GetDynamicParameters().MaxTextureImageUnits, kPerStageCap);
+}

MobileGL/MG_Test/Backend/DirectGLES/IntegerAttributePlanTest.cpp

@@ -0,0 +1,149 @@
+// MobileGL - MobileGL/MG_Test/Backend/DirectGLES/IntegerAttributePlanTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// What DirectGLES does with each (array data type, shader input type) pair. ES defines an integer
+// attribute only when the array has the input's signedness, so every integer array is issued with
+// it; 8/16-bit data of the other signedness also needs the program's seeds to put GL's value back,
+// and without working seeds such an array keeps the application's type instead.
+
+#include <gtest/gtest.h>
+
+#include <MG_Backend/DirectGLES/IntegerAttributePlan.h>
+#include <MG_Backend/DirectGLES/NarrowIntegerSeeds.h>
+
+using namespace MobileGL;
+using MobileGL::MG_Backend::DirectGLES::HeldIntegerRetype;
+using MobileGL::MG_Backend::DirectGLES::IntegerAttribTypeForInput;
+using MobileGL::MG_Backend::DirectGLES::IntegerAttributeDataMasks;
+using MobileGL::MG_Backend::DirectGLES::IntegerAttributePlan;
+using MobileGL::MG_Backend::DirectGLES::IntegerVertexInputMasks;
+using MobileGL::MG_Backend::DirectGLES::NarrowIntegerSeedState;
+using MobileGL::MG_Backend::DirectGLES::ResolveIntegerAttributePlan;
+
+namespace {
+    struct DataCase {
+        DataType type;
+        GLenum glType;
+        Uint32 bits;
+        Bool isSigned;
+    };
+    constexpr DataCase kData[] = {
+        {DataType::Int8, GL_BYTE, 8, true},    {DataType::Uint8, GL_UNSIGNED_BYTE, 8, false},
+        {DataType::Int16, GL_SHORT, 16, true}, {DataType::Uint16, GL_UNSIGNED_SHORT, 16, false},
+        {DataType::Int32, GL_INT, 32, true},   {DataType::Uint32, GL_UNSIGNED_INT, 32, false},
+    };
+
+    Bool IsSignedGLType(GLenum type) {
+        return type == GL_BYTE || type == GL_SHORT || type == GL_INT;
+    }
+
+    IntegerAttributePlan PlanFor(DataType data, GLenum input, Uint32 location, Bool seedsUsable = true) {
+        IntegerVertexInputMasks inputs;
+        inputs.Note(location, input);
+        IntegerAttributeDataMasks masks;
+        masks.Note(location, data);
+        return ResolveIntegerAttributePlan(inputs, masks, seedsUsable);
+    }
+} // namespace
+
+TEST(IntegerAttributePlan, EveryIntegerArrayIsIssuedWithItsInputsSignedness) {
+    constexpr Uint32 location = 3;
+    constexpr Uint32 bit = 1u << location;
+    for (const DataCase& data : kData) {
+        for (const GLenum input : {GL_INT_VEC4, GL_UNSIGNED_INT_VEC2}) {
+            const Bool signedInput = input == GL_INT_VEC4;
+            const IntegerAttributePlan plan = PlanFor(data.type, input, location);
+            const Bool mismatch = signedInput != data.isSigned;
+            SCOPED_TRACE(testing::Message() << "data 0x" << std::hex << data.glType << " input 0x" << input);
+            EXPECT_EQ(plan.careMask, bit);
+            EXPECT_EQ(plan.retypeMask, mismatch ? bit : 0u);
+            EXPECT_EQ(IsSignedGLType(IntegerAttribTypeForInput(data.glType, (plan.retypeMask & bit) != 0)),
+                      signedInput);
+            // Only 8/16-bit data of the other signedness needs the seeds; 32-bit is the same bits.
+            EXPECT_EQ(plan.widths8, mismatch && data.bits == 8 ? bit : 0u);
+            EXPECT_EQ(plan.widths16, mismatch && data.bits == 16 ? bit : 0u);
+            EXPECT_EQ(plan.widths8 & plan.widths16, 0u);
+        }
+    }
+}
+
+TEST(IntegerAttributePlan, AFloatInputLeavesItsArrayAlone) {
+    for (const DataCase& data : kData) {
+        const IntegerAttributePlan plan = PlanFor(data.type, GL_FLOAT_VEC4, 5);
+        EXPECT_EQ(plan, IntegerAttributePlan{}) << std::hex << data.glType;
+    }
+    // ...and an integer input fed float data has no integer array to issue.
+    EXPECT_EQ(PlanFor(DataType::Float32, GL_INT_VEC4, 5), IntegerAttributePlan{});
+}
+
+TEST(IntegerAttributePlan, WithoutWorkingSeedsANarrowArrayKeepsTheApplicationsType) {
+    for (const DataCase& data : kData) {
+        const GLenum input = data.isSigned ? GL_UNSIGNED_INT : GL_INT;
+        const IntegerAttributePlan plan = PlanFor(data.type, input, 7, false);
+        EXPECT_FALSE(plan.NeedsSeeds()) << std::hex << data.glType;
+        EXPECT_EQ(plan.retypeMask, data.bits == 32 ? (1u << 7) : 0u) << std::hex << data.glType;
+        EXPECT_EQ(plan, PlanFor(data.type, input, 7).WithoutSeeds());
+    }
+}
+
+TEST(IntegerAttributePlan, LocationsStopAt31) {
+    EXPECT_EQ(PlanFor(DataType::Uint8, GL_INT, 31).widths8, 1u << 31);
+    EXPECT_EQ(PlanFor(DataType::Uint8, GL_INT, 32), IntegerAttributePlan{});
+}
+
+TEST(IntegerAttributePlan, AVertexArrayKeepsWhatItHoldsWhereNothingCanSeeIt) {
+    IntegerAttributePlan plan;
+    plan.careMask = 0b0110u;
+    plan.retypeMask = 0b0100u;
+    // Bit 0 is held and unobservable: kept. Bit 1 is observable and wanted plain: cleared.
+    EXPECT_EQ(HeldIntegerRetype(0b0011u, plan), 0b0101u);
+    EXPECT_EQ(HeldIntegerRetype(0u, IntegerAttributePlan{}), 0u);
+}
+
+TEST(IntegerAttributePlan, TheIssuedTypeOnlyEverSwapsSignedness) {
+    for (const DataCase& data : kData) {
+        EXPECT_EQ(IntegerAttribTypeForInput(data.glType, false), data.glType);
+        const GLenum swapped = IntegerAttribTypeForInput(data.glType, true);
+        EXPECT_NE(IsSignedGLType(swapped), data.isSigned);
+        EXPECT_EQ(IntegerAttribTypeForInput(swapped, true), data.glType);
+    }
+    EXPECT_EQ(IntegerAttribTypeForInput(GL_FLOAT, true), static_cast<GLenum>(GL_FLOAT));
+}
+
+// A program's arming across builds: a failed armed build is retried without the seeds for that
+// link only, and an application relink starts over from what the new link declares.
+TEST(NarrowIntegerSeedState, AFailedArmedBuildLastsUntilTheNextLink) {
+    using MobileGL::MG_Backend::DirectGLES::BeginNarrowIntegerSeedBuild;
+    using MobileGL::MG_Backend::DirectGLES::FinishNarrowIntegerSeedBuild;
+    NarrowIntegerSeedState state;
+    state.PrepareBuild(1, true, false);
+    EXPECT_FALSE(state.wanted) << "a program that does not capture is armed by a draw, not a build";
+    state.wanted = true;
+    BeginNarrowIntegerSeedBuild(state);
+    FinishNarrowIntegerSeedBuild(state, 0, false);
+    EXPECT_TRUE(state.RefusedAt(1));
+    EXPECT_TRUE(state.Stale()) << "the failed link is rebuilt without the seeds";
+
+    state.PrepareBuild(1, true, false);
+    BeginNarrowIntegerSeedBuild(state);
+    EXPECT_FALSE(state.built);
+    EXPECT_TRUE(state.RefusedAt(1));
+    EXPECT_FALSE(state.Stale());
+    EXPECT_FALSE(state.RefusedAt(2)) << "a link not built yet is presumed to take the seeds";
+
+    state.PrepareBuild(2, true, false);
+    EXPECT_FALSE(state.RefusedAt(2));
+    EXPECT_TRUE(state.Target()) << "a relink arms again";
+    EXPECT_TRUE(state.Stale());
+
+    state.PrepareBuild(3, false, false);
+    EXPECT_FALSE(state.wanted) << "a link without integer inputs has nothing to arm";
+    EXPECT_FALSE(state.Target());
+    state.PrepareBuild(4, true, true);
+    EXPECT_TRUE(state.Target()) << "a capturing link is armed at its build";
+}

MobileGL/MG_Test/Backend/DirectGLES/NarrowIntegerEsslTest.cpp

@@ -0,0 +1,157 @@
+// MobileGL - MobileGL/MG_Test/Backend/DirectGLES/NarrowIntegerEsslTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// A vertex stage armed with the narrow-integer seeds, through the same steps the DirectGLES build
+// takes: the array-input split, the RuntimeWidths pass, ESSL 3.00 emission and the uniform
+// promotion. The two widths have to come out as `uniform highp uint` (anything else is read
+// uninitialised or at too low a precision) and the result has to be ESSL 3.00 a compiler accepts.
+// The emission here uses plain ESSL 3.00 options, not the build's whole pass chain; the
+// integration lanes run that chain (NarrowIntegerAttributeScenario).
+
+#include <gtest/gtest.h>
+
+#include <MG_Backend/DirectGLES/DirectGLES.h>
+#include <MG_Backend/DirectGLES/Managers.h>
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_Util/ShaderTranspiler/SpvcSession.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+
+#include "Init.h"
+
+#include <glslang/Public/ResourceLimits.h>
+#include <glslang/Public/ShaderLang.h>
+
+using namespace MobileGL;
+using MobileGL::MG_Backend::DirectGLES::PromoteDrawParameterGlobalsToUniforms;
+using MobileGL::MG_Backend::DirectGLES::PromoteNarrowIntegerWidthGlobals;
+using MobileGL::MG_Util::ShaderTranspiler::kNarrowIntegerWidths16GlobalName;
+using MobileGL::MG_Util::ShaderTranspiler::kNarrowIntegerWidths8GlobalName;
+using MobileGL::MG_Util::ShaderTranspiler::SessionUsageBit;
+using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
+using MobileGL::MG_Util::ShaderTranspiler::SpvcSession;
+
+namespace {
+    constexpr const char* kVertex = R"(#version 330 core
+layout(location = 0) in vec2 pos;
+layout(location = 1) in ivec4 lightAndData;
+layout(location = 2) in uvec2 texc;
+layout(location = 3) in int packed[2];
+flat out ivec4 a;
+flat out uvec4 b;
+void main() {
+    a = lightAndData + ivec4(packed[0], packed[1], 0, 0);
+    b = uvec4(texc, 0u, 0u);
+    gl_Position = vec4(pos, 0.0, 1.0);
+}
+)";
+    constexpr const char* kFragment = R"(#version 330 core
+flat in ivec4 a;
+flat in uvec4 b;
+out vec4 color;
+void main() { color = vec4(a) + vec4(b); }
+)";
+
+    Vector<Uint32> CompileVertexModule() {
+        using namespace MG_Util::ShaderTranspiler;
+        Vector<SharedPtr<glslang::TShader>> shaders;
+        for (const auto& [stage, source] :
+             Vector<Pair<GLenum, const char*>>{{GL_VERTEX_SHADER, kVertex}, {GL_FRAGMENT_SHADER, kFragment}}) {
+            ShaderAttrib attrib{.shaderType = stage, .sourceStr = source};
+            auto shader = ShaderCompiler::CompileShader(attrib);
+            EXPECT_TRUE(shader) << (shader ? String{} : shader.error().log);
+            if (!shader) return {};
+            shaders.push_back(shader.value());
+        }
+        ProgramAttrib programAttrib{.shaders = shaders};
+        auto program = ShaderCompiler::LinkProgram(programAttrib);
+        EXPECT_TRUE(program) << (program ? String{} : program.error().log);
+        if (!program) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = {GL_VERTEX_SHADER, GL_FRAGMENT_SHADER},
+                                         .program = *program.value()};
+        auto binary = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        EXPECT_TRUE(binary) << (binary ? String{} : binary.error().log);
+        if (!binary || binary->size() != 2) return {};
+        Vector<Uint32> module = binary.value()[0];
+        EXPECT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(module, module, true, true));
+        return module;
+    }
+
+    String EmitEssl300(const Vector<Uint32>& spirv) {
+        SpvcSession session(spirv, SessionUsageBit::Transpile);
+        spvc_compiler_options options;
+        session.CreateOptions(&options);
+        spvc_compiler_options_set_uint(options, SPVC_COMPILER_OPTION_GLSL_VERSION, 300);
+        spvc_compiler_options_set_bool(options, SPVC_COMPILER_OPTION_GLSL_ES, SPVC_TRUE);
+        spvc_compiler_options_set_bool(options, SPVC_COMPILER_OPTION_GLSL_VULKAN_SEMANTICS, SPVC_FALSE);
+        session.SetOptions(options);
+        const char* result = nullptr;
+        session.Compile(&result);
+        EXPECT_NE(result, nullptr) << (session.GetLastErrorString() ? session.GetLastErrorString() : "");
+        return result != nullptr ? String(result) : String{};
+    }
+
+    // Declarations of `name` as a uint, whatever their qualifiers or initialiser.
+    SizeT CountUintDeclarations(const String& source, const char* name) {
+        SizeT count = 0;
+        for (const char* suffix : {";", " ="}) {
+            const String declaration = String("uint ") + name + suffix;
+            for (SizeT pos = source.find(declaration); pos != String::npos; pos = source.find(declaration, pos + 1))
+                ++count;
+        }
+        return count;
+    }
+
+    String CompileErrorAsEssl300Vertex(const String& source) {
+        glslang::TShader shader(EShLangVertex);
+        const char* strings[] = {source.c_str()};
+        shader.setStrings(strings, 1);
+        if (shader.parse(GetDefaultResources(), 300, EEsProfile, false, false, EShMsgDefault)) return {};
+        return shader.getInfoLog();
+    }
+} // namespace
+
+TEST(NarrowIntegerEssl, ArmedVertexStageDeclaresBothWidthsAsHighpUniformsInValidEssl300) {
+    MobileGL::Initialize();
+    const Vector<Uint32> module = CompileVertexModule();
+    ASSERT_FALSE(module.empty());
+
+    Vector<Uint32> split;
+    ASSERT_TRUE(ShaderCompiler::SplitArrayVertexInputsForEssl(module, split, true));
+    Vector<Uint32> seeded;
+    Bool changed = false;
+    ASSERT_TRUE(
+        ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(split.empty() ? module : split, seeded, changed, true));
+    ASSERT_TRUE(changed);
+
+    const String emitted = EmitEssl300(seeded);
+    ASSERT_FALSE(emitted.empty());
+    const String essl = PromoteDrawParameterGlobalsToUniforms(emitted, GL_VERTEX_SHADER);
+    for (const char* name : {kNarrowIntegerWidths8GlobalName, kNarrowIntegerWidths16GlobalName}) {
+        EXPECT_NE(essl.find(String("uniform highp uint ") + name + ";"), String::npos) << name << "\n" << essl;
+        // Exactly one declaration, and it is the uniform.
+        EXPECT_EQ(CountUintDeclarations(essl, name), 1u) << name << "\n" << essl;
+    }
+    for (const char* bitfield : {"bitfieldExtract", "bitfieldInsert"})
+        EXPECT_EQ(essl.find(bitfield), String::npos) << essl;
+    EXPECT_EQ(CompileErrorAsEssl300Vertex(essl), String{}) << essl;
+}
+
+TEST(NarrowIntegerEssl, OnlyALineStartingDeclarationIsPromoted) {
+    const String promoted = PromoteNarrowIntegerWidthGlobals("#version 300 es\n"
+                                                             "uint mg_NarrowIntegerWidths8 = 0u;\n"
+                                                             "highp uint mg_NarrowIntegerWidths16;\n"
+                                                             "void main() { uint x = mg_NarrowIntegerWidths8; }\n");
+    EXPECT_EQ(promoted, "#version 300 es\n"
+                        "uniform highp uint mg_NarrowIntegerWidths8;\n"
+                        "uniform highp uint mg_NarrowIntegerWidths16;\n"
+                        "void main() { uint x = mg_NarrowIntegerWidths8; }\n");
+    // Already a uniform: untouched, and a mediump spelling is promoted to highp all the same.
+    EXPECT_EQ(PromoteNarrowIntegerWidthGlobals(promoted), promoted);
+    EXPECT_EQ(PromoteNarrowIntegerWidthGlobals("mediump uint mg_NarrowIntegerWidths16;\n"),
+              "uniform highp uint mg_NarrowIntegerWidths16;\n");
+}

MobileGL/MG_Test/Buffer/SplitBufferTest.cpp

@@ -86,13 +86,11 @@ namespace {
     protected:
         void SetUp() override {
             m_transport = MG_Config::Transport;
-            m_blockKb = MG_Config::RecordArm.PersistentBlockKb;
             m_adoptTier = MG_Config::Ipc.AdoptTier;
             m_pipeStats = MG_Config::Features.PipeStats;
             m_context = MG_State::pGLContext.Take();
             MG_State::pGLContext = MakeUnique<MG_State::GLState::GLContext>();
             MG_Config::Transport = MG_Config::TransportMode::InProcess;
-            MG_Config::RecordArm.PersistentBlockKb = 64;
             MG_Config::Ipc.AdoptTier = 2;
             MG_Config::Features.PipeStats = true;
             MG_Util::PipeStats::Init();
@@ -108,7 +106,6 @@ namespace {
             PersistentMapTracker::Instance().ClearForTest();
             MG_State::pGLContext = Move(m_context);
             MG_Config::Transport = m_transport;
-            MG_Config::RecordArm.PersistentBlockKb = m_blockKb;
             MG_Config::Ipc.AdoptTier = m_adoptTier;
             MG_Config::Features.PipeStats = m_pipeStats;
             MG_Util::PipeStats::Init();
@@ -121,7 +118,6 @@ namespace {
         }
 
         MG_Config::TransportMode m_transport = MG_Config::TransportMode::Monolith;
-        Uint32 m_blockKb = 64;
         Uint32 m_adoptTier = 2;
         Bool m_pipeStats = false;
         SharedPtr<MG_State::GLState::GLContext> m_context;
@@ -463,35 +459,6 @@ TEST_F(SplitBufferSet, BothEdgesOfAWriteMapPublishOneStateRecord) {
            "the second the record stays dirty for the buffer's life";
 }
 
-// E3(a)'s NEGATIVE CONTROL: 0 disables the push, it does not mean "one unlimited block" - and
-// it disables the STATE RECORDS with it. An earlier cut skipped the blocks and still shipped a
-// whole buffer at unmap, so a scenario that unmapped before reading back went green and the
-// control was dead.
-TEST_F(SplitBufferSet, AZeroBlockSizeTurnsThePushOffRatherThanMakingItUnlimited) {
-    MG_Config::RecordArm.PersistentBlockKb = 0;
-    constexpr SizeT kSize = 128u * 1024u;
-    auto buffer = MakeBuffer(23u, kSize);
-
-    const Uint64 beforeMap = buffer->GetChangeSerial();
-    buffer->AcquireMemoryRange(Range1D{0, kSize}, BufferMappingAccessBit::Write | BufferMappingAccessBit::Persistent);
-    ASSERT_TRUE(PersistentMapTracker::IsLivePersistentMap(*buffer));
-    EXPECT_EQ(buffer->GetChangeSerial(), beforeMap) << "the rising-edge state record went out with the push disabled";
-
-    const Uint64 before = MG_Util::PipeStats::TotalBytes(MG_Util::PipeStats::ByteClass::PersistentMapPush);
-    MG_Record::PushPersistentMapsBeforeVerb();
-    EXPECT_EQ(PersistentMapTracker::Instance().BlocksPushed(), 0u);
-    EXPECT_EQ(MG_Util::PipeStats::TotalBytes(MG_Util::PipeStats::ByteClass::PersistentMapPush), before)
-        << "MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0 must ship nothing, so that "
-           "PersistentCoherentMapScenario goes red under it";
-
-    const Uint64 beforeUnmap = buffer->GetChangeSerial();
-    buffer->ReleaseMemory(/*landStagedWrites=*/true);
-    EXPECT_EQ(buffer->GetChangeSerial(), beforeUnmap + 1)
-        << "with the push off the unmap must emit only its own NotifyFlushMappedRange - a "
-           "falling-edge record here delivers a whole buffer the control exists to withhold, "
-           "and a negative control that still delivers the bytes is not a control";
-}
-
 // The set does not keep a pointer to a dead buffer.
 TEST_F(SplitBufferSet, ADestroyedBufferLeavesTheSet) {
     {
@@ -871,9 +838,6 @@ TEST(SplitBufferSet, TheLastBlockIsTheRemainderAndNotAWholeBlock) {
 TEST(SplitBufferSet, BothEdgesOfAWriteMapPublishOneStateRecord) {
     MGL_SPLIT_ONLY_OR_SKIP();
 }
-TEST(SplitBufferSet, AZeroBlockSizeTurnsThePushOffRatherThanMakingItUnlimited) {
-    MGL_SPLIT_ONLY_OR_SKIP();
-}
 TEST(SplitBufferSet, ADestroyedBufferLeavesTheSet) {
     MGL_SPLIT_ONLY_OR_SKIP();
 }

MobileGL/MG_Test/Pipe/FramebufferEmitTest.cpp

@@ -248,8 +248,8 @@ namespace {
                                             kMGPipeSubsystemTextureResources | kMGPipeSubsystemSamplers;
             m_previousContext = MG_State::pGLContext.Take();
             MG_State::pGLContext = MakeUnique<GLContext>();
-            MGPipeFramebufferEmitterInstance().ResetForTest();
-            MGPipeTextureEmitterInstance().ResetForTest();
+            MGPipeFramebufferEmitterInstance().ForgetSession();
+            MGPipeTextureEmitterInstance().ForgetSession();
             MGPipeSetHashSuppressorInstance().InvalidateAll();
             // The applier is a process singleton and its object records outlive a case; with both
             // families' wired constants set the emissions actually land, so a case must start
@@ -259,8 +259,8 @@ namespace {
             MGPipeApplierReleaseObjectRecords();
         }
         ~FramebufferScope() {
-            MGPipeFramebufferEmitterInstance().ResetForTest();
-            MGPipeTextureEmitterInstance().ResetForTest();
+            MGPipeFramebufferEmitterInstance().ForgetSession();
+            MGPipeTextureEmitterInstance().ForgetSession();
             MGPipeSetHashSuppressorInstance().InvalidateAll();
             MGPipeApplierReset();
             MGPipeApplierReleaseObjectRecords();
@@ -1345,7 +1345,7 @@ TEST(FramebufferEmit, TheBuildMemoReNotesBindBitsAfterTheTextureTableIsDropped)
         << "the attachment's RENDER_TARGET bit was never noted";
 
     // A dropped table (a replaced session) forgets the sticky bits; the next build must note them again.
-    MGPipeTextureEmitterInstance().ResetForTest();
+    MGPipeTextureEmitterInstance().ForgetSession();
     MGPipeSetHashSuppressorInstance().InvalidateAll();
     Framebuffers().EmitFramebufferState(Ctx());
     EXPECT_NE(MGPipeTextureEmitterInstance().TextureBindMask(handle) & kMGPipeBindRenderTarget, 0)

MobileGL/MG_Test/Pipe/ImageEmitTest.cpp

@@ -581,7 +581,7 @@ void main() { imageStore(img, ivec2(0), vec4(1.0)); }
     // Nothing produced the bit before the fix round.
     TEST(ImageEmit, AnImageBoundTextureIsMarkedShaderImageBoundAtTheBind) {
         EmitterScope scope;
-        MGPipeTextureEmitterInstance().ResetForTest();
+        MGPipeTextureEmitterInstance().ForgetSession();
         const GLuint name = MakeImageTexture();
         const auto& texture = Ctx().GetTextureObject(name);
         ASSERT_TRUE(texture);

MobileGL/MG_Test/Pipe/PipeInputsTest.cpp

@@ -75,10 +75,8 @@ namespace {
         void SetUp() override {
             m_previous = MG_State::pGLContext.Take();
             MG_State::pGLContext = MakeUnique<GLContext>();
-            MGPipeSetPoisonOmission(nullptr, nullptr);
         }
         void TearDown() override {
-            MGPipeSetPoisonOmission(nullptr, nullptr);
             MG_State::pGLContext = Move(m_previous);
         }
         SharedPtr<GLContext> m_previous;
@@ -88,11 +86,20 @@ namespace {
     Bool Fresh(MGPipeInputField field) {
         return MGPipeInputFieldIsFresh(gPipeInputs->FilledState(), field);
     }
+
+    // Negative control B's omission, made here rather than by the library: fill `verb`, then put
+    // the stamp of `field` back to what it held before the fill. The value is copied and only the
+    // stamp is withheld, which is what a FillPoints.def row nobody wrote leaves behind.
+    void FillWithholdingTheStamp(MGPipeVerb verb, MGPipeInputField field) {
+        auto& filled = const_cast<MGPipeFilledState&>(gPipeInputs->FilledState());
+        const Uint64 before = filled.FilledGen[static_cast<SizeT>(field)];
+        MGPipeValidateForVerb(verb);
+        filled.FilledGen[static_cast<SizeT>(field)] = before;
+    }
 #endif
 
     [[maybe_unused]] constexpr const char* kOmittedFatal =
         "Fatal{UnmigratedPipeInput, \"GetActiveTextureUnit@GenerateMipmap\"}";
-    [[maybe_unused]] constexpr const char* kOmissionKnob = "GenerateMipmap:GetActiveTextureUnit";
 
 #if MGTEST_HAVE_FORK
     struct ChildResult {
@@ -139,7 +146,8 @@ namespace {
 // Negative control B, layer 1 (P1 brief D6 / G5): the omitted (verb, field) pair is the
 // ONLY thing that goes stale - every other bit of the verb class's mask is fresh, every
 // field outside it is not, and the verb after it neither heals the field (not in kDraw's
-// mask) nor loses one of its own.
+// mask) nor loses one of its own. The omission is the test's own (FillWithholdingTheStamp); a
+// verify build also checks the scope of the library's (MGPipeSetPoisonOmission).
 TEST_F(PipeInputsTest, OmittingOneFieldForOneVerbLeavesExactlyThatFieldStale) {
 #if !MOBILEGL_PIPE_POISON
     GTEST_SKIP() << "poison not compiled in (MOBILEGL_PIPE_POISON=0)";
@@ -148,8 +156,7 @@ TEST_F(PipeInputsTest, OmittingOneFieldForOneVerbLeavesExactlyThatFieldStale) {
     EXPECT_TRUE(Fresh(MGPipeInputField::GetActiveTextureUnit));
     EXPECT_TRUE(Fresh(MGPipeInputField::GetTextureUnitObject));
 
-    MGPipeSetPoisonOmission("GenerateMipmap", "GetActiveTextureUnit");
-    MGPipeValidateForVerb(MGPipeVerb::GenerateMipmap);
+    FillWithholdingTheStamp(MGPipeVerb::GenerateMipmap, MGPipeInputField::GetActiveTextureUnit);
     EXPECT_TRUE(Fresh(MGPipeInputField::GetTextureUnitObject));
     EXPECT_FALSE(Fresh(MGPipeInputField::GetActiveTextureUnit));
     // The value was still copied: only the stamp is withheld.
@@ -173,15 +180,33 @@ TEST_F(PipeInputsTest, OmittingOneFieldForOneVerbLeavesExactlyThatFieldStale) {
     // A sticky field stays fresh across every verb.
     EXPECT_TRUE(Fresh(MGPipeInputField::RecordError));
 
-    // And the omission is scoped to its verb: a different verb of the same class keeps it.
+    // And the omission is scoped to its fill: the next verb of the same class stamps it again.
     MGPipeValidateForVerb(MGPipeVerb::BindImageTexture);
     EXPECT_TRUE(Fresh(MGPipeInputField::GetActiveTextureUnit));
+
+#if MOBILEGL_PIPE_VERIFY && MGTEST_HAVE_FORK
+    // The library's own omission, the one the PoisonOmitted entries arm, stays armed across fills
+    // and is scoped to its VERB: a different verb of the same class keeps the stamp. In a child,
+    // because nothing disarms it.
+    const ChildResult r = RunInChild([] {
+        if (!MGPipeSetPoisonOmission("GenerateMipmap", "GetActiveTextureUnit")) ::_exit(3);
+        MGPipeValidateForVerb(MGPipeVerb::GenerateMipmap);
+        if (Fresh(MGPipeInputField::GetActiveTextureUnit)) ::_exit(4);
+        MGPipeValidateForVerb(MGPipeVerb::BindImageTexture);
+        if (!Fresh(MGPipeInputField::GetActiveTextureUnit)) ::_exit(5);
+    });
+    EXPECT_TRUE(ExitedWith(r, 0)) << DescribeStatus(r)
+                                  << " (3: the setter refused the names; 4: GenerateMipmap stamped the omitted "
+                                     "field; 5: BindImageTexture did not stamp it, so the omission matched the "
+                                     "class rather than the verb)\n"
+                                  << r.Log;
+#endif
 #endif
 }
 
 // Negative control B, layer 2 (G5): the read itself. The child fills GenerateMipmap with the
-// omission and reads gPipeInputs->GetActiveTextureUnit(); the parent expects SIGABRT and the
-// exact Fatal line, and that nothing else was fatal.
+// stamp of GetActiveTextureUnit withheld and reads gPipeInputs->GetActiveTextureUnit(); the
+// parent expects SIGABRT and the exact Fatal line, and that nothing else was fatal.
 TEST_F(PipeInputsTest, ReadingAnOmittedFieldAbortsNamingTheVerb) {
 #if !MOBILEGL_PIPE_POISON
     GTEST_SKIP() << "poison not compiled in (MOBILEGL_PIPE_POISON=0)";
@@ -190,10 +215,9 @@ TEST_F(PipeInputsTest, ReadingAnOmittedFieldAbortsNamingTheVerb) {
 #else
     ASSERT_FALSE(g_logPath.empty()) << "main() did not set MOBILEGL_LOG_FILE_PATH";
     const ChildResult r = RunInChild([] {
-        MGPipeSetPoisonOmission("GenerateMipmap", "GetActiveTextureUnit");
         MGPipeValidateForVerb(MGPipeVerb::DrawArrays);
         (void)gPipeInputs->GetRenderStateParameters(); // a filled field of the preceding draw: must not abort
-        MGPipeValidateForVerb(MGPipeVerb::GenerateMipmap);
+        FillWithholdingTheStamp(MGPipeVerb::GenerateMipmap, MGPipeInputField::GetActiveTextureUnit);
         (void)gPipeInputs->GetTextureUnitObject(0); // the sibling field: filled, must not abort
         (void)gPipeInputs->GetActiveTextureUnit();  // the omitted field: Fatal
         ::_exit(3);                                 // reached only if the poison failed
@@ -253,53 +277,6 @@ TEST_F(PipeInputsTest, ReadingBeforeAnyFillAbortsNamingNoVerb) {
 #endif
 }
 
-// The MOBILEGL_PIPE_POISON_OMIT parser, through the Features field the loader fills: the
-// child sets the knob after its parent filled without it, and the first fill after that
-// parses it, logs the arming line and withholds the stamp exactly as the programmatic form.
-TEST_F(PipeInputsTest, PoisonOmitKnobArmsTheOmission) {
-#if !MOBILEGL_PIPE_POISON
-    GTEST_SKIP() << "poison not compiled in (MOBILEGL_PIPE_POISON=0)";
-#elif !MGTEST_HAVE_FORK
-    GTEST_SKIP() << "no fork() on this platform";
-#else
-    ASSERT_FALSE(g_logPath.empty()) << "main() did not set MOBILEGL_LOG_FILE_PATH";
-    MGPipeValidateForVerb(MGPipeVerb::DrawArrays); // the parent's parse saw an empty knob
-    const ChildResult r = RunInChild([] {
-        MG_Config::Features.PipePoisonOmit = kOmissionKnob;
-        MGPipeValidateForVerb(MGPipeVerb::GenerateMipmap);
-        (void)gPipeInputs->GetTextureUnitObject(0); // the sibling field: filled, must not abort
-        (void)gPipeInputs->GetActiveTextureUnit();  // the omitted field: Fatal
-        ::_exit(3);
-    });
-    ASSERT_TRUE(DiedOfAbort(r)) << DescribeStatus(r) << "\n" << r.Log;
-    EXPECT_NE(r.Log.find("MGPipe: poison omission armed - GetActiveTextureUnit@GenerateMipmap"), std::string::npos)
-        << r.Log;
-    EXPECT_NE(r.Log.find(kOmittedFatal), std::string::npos) << r.Log;
-    EXPECT_EQ(r.Log.find("GetTextureUnitObject@"), std::string::npos) << r.Log;
-#endif
-}
-
-// An unknown verb in the knob is Fatal{PipeVerifyBadKnob} naming the knob and the value,
-// before any stamp is withheld.
-TEST_F(PipeInputsTest, BadPoisonOmitKnobIsFatalNamingTheKnob) {
-#if !MGTEST_HAVE_FORK
-    GTEST_SKIP() << "no fork() on this platform";
-#else
-    ASSERT_FALSE(g_logPath.empty()) << "main() did not set MOBILEGL_LOG_FILE_PATH";
-    const ChildResult r = RunInChild([] {
-        MG_Config::Features.PipePoisonOmit = "NoSuchVerb:GetActiveTextureUnit";
-        MGPipeValidateForVerb(MGPipeVerb::GenerateMipmap);
-        ::_exit(3);
-    });
-    ASSERT_TRUE(DiedOfAbort(r)) << DescribeStatus(r) << "\n" << r.Log;
-    EXPECT_NE(r.Log.find("Fatal{PipeVerifyBadKnob, \"MOBILEGL_PIPE_POISON_OMIT=NoSuchVerb:GetActiveTextureUnit\": "
-                         "no such verb in kMGPipeVerbNames}"),
-              std::string::npos)
-        << r.Log;
-    EXPECT_EQ(r.Log.find("poison omission armed"), std::string::npos) << r.Log;
-#endif
-}
-
 // Negative control A at the block level (G4): a clean snapshot compares equal to the pushed
 // block over the verb's mask; corrupting one field of the snapshot makes the compare name
 // exactly that field, at the serial of the fill it belongs to.
@@ -336,6 +313,78 @@ TEST_F(PipeInputsTest, CorruptedSnapshotFieldIsNamedWithItsSerial) {
 #endif
 }
 
+// The same control for EVERY field, which is where P13 W3c moved the capability cross-check the
+// residual block used to carry: two snapshots of one live context compare equal over all fields,
+// and corrupting any one field that has storage makes the compare name exactly that field. The
+// seven forwarded fields have no storage, so there is nothing to corrupt and nothing to compare.
+TEST_F(PipeInputsTest, EveryCorruptedFieldIsNamedByTheComparator) {
+#if !MOBILEGL_PIPE_VERIFY
+    GTEST_SKIP() << "verify not compiled in (MOBILEGL_PIPE_VERIFY=OFF)";
+#else
+    constexpr MGPipeFieldMask kEveryField{{~Uint64{0}, ~Uint64{0}}};
+    const auto name = [](MGPipeInputField field) {
+        return field == MGPipeInputField::kFieldCount ? "<none>" : kMGPipeInputFieldNames[static_cast<SizeT>(field)];
+    };
+    // A fresh block per snapshot: the snapshot copies only what the context holds (the binding
+    // points past the touched count keep their storage), so a reused block would carry one
+    // field's corruption into the next field's compare.
+    const auto snapshot = [&] {
+        auto block = MakeUnique<PipeInputs>();
+        SnapshotFromGLContext(*block, kEveryField);
+        return block;
+    };
+    const auto reference = snapshot();
+    MGPipeInputField named = MGPipeInputField::kFieldCount;
+    ASSERT_TRUE(MGPipeVerifyInputs(*reference, *snapshot(), kEveryField, &named))
+        << "two snapshots of one context differ at " << name(named);
+
+    SizeT corruptedFields = 0;
+    for (SizeT f = 0; f < kMGPipeInputFieldCount; ++f) {
+        const auto field = static_cast<MGPipeInputField>(f);
+        const auto corrupted = snapshot();
+        if (kMGPipeInputFieldSticky[f]) {
+            EXPECT_FALSE(MGPipeApplyVerifyCorruption(*corrupted, field)) << name(field) << " is forwarded";
+            continue;
+        }
+        ASSERT_TRUE(MGPipeApplyVerifyCorruption(*corrupted, field)) << name(field) << " has no storage to corrupt";
+        ++corruptedFields;
+        named = MGPipeInputField::kFieldCount;
+        EXPECT_FALSE(MGPipeVerifyInputs(*reference, *corrupted, kEveryField, &named))
+            << "the comparator does not see a corrupted " << name(field);
+        EXPECT_EQ(named, field) << "a corrupted " << name(field) << " was reported as " << name(named);
+    }
+    EXPECT_EQ(corruptedFields, kMGPipeInputFieldCount - kMGPipeForwardedFieldCount);
+
+#if MGTEST_HAVE_FORK
+    // And the capability field through the knob and each verb's own mask, at the verbs a clear,
+    // draw and readback frame crosses: every one whose class fills the field must report it at
+    // entry, and at least one must fill it.
+    ASSERT_FALSE(g_logPath.empty()) << "main() did not set MOBILEGL_LOG_FILE_PATH";
+    static constexpr MGPipeVerb kFrameVerbs[] = {MGPipeVerb::Clear, MGPipeVerb::DrawArrays, MGPipeVerb::ReadPixels};
+    const ChildResult r = RunInChild([] {
+        MG_Config::Features.PipeVerify = true;
+        MG_Config::Features.PipeVerifyFatal = false;
+        ::setenv("MOBILEGL_PIPE_VERIFY_CORRUPT", "IsCapabilityEnabled", 1);
+        for (const MGPipeVerb verb : kFrameVerbs)
+            MGPipeValidateForVerb(verb);
+    });
+    ASSERT_TRUE(ExitedWith(r, 0)) << DescribeStatus(r) << "\n" << r.Log;
+    SizeT filling = 0;
+    for (const MGPipeVerb verb : kFrameVerbs) {
+        const auto cls = static_cast<SizeT>(kMGPipeVerbClass[static_cast<SizeT>(verb)]);
+        const Bool fills = MGPipeFieldMaskHas(kMGPipeClassFieldMask[cls], MGPipeInputField::IsCapabilityEnabled);
+        filling += fills ? 1 : 0;
+        const std::string report = std::string("Fatal{PipeVerifyDiffer, \"IsCapabilityEnabled@") +
+                                   kMGPipeVerbNames[static_cast<SizeT>(verb)] + "\"";
+        EXPECT_EQ(r.Log.find(report) != std::string::npos, fills)
+            << report << (fills ? " missing" : " unexpected") << " in\n"
+            << r.Log;
+    }
+    EXPECT_GT(filling, 0u) << "no verb of a clear, draw and readback frame fills IsCapabilityEnabled";
+#endif
+#endif
+}
+
 // The compare-at-read arm (P1 brief D8, the arm that is real in P1): a value that changes in
 // the live context between the verb boundary and the read is Fatal{PipeVerifyDiffer,
 // "Field@Verb", verb=<serial>, where=read}; the same read before the mutation completes.
@@ -370,9 +419,9 @@ TEST_F(PipeInputsTest, MutatedFieldIsNamedAtRead) {
 #endif
 }
 
-// The MOBILEGL_PIPE_VERIFY_CORRUPT parser through Features: the fill after the child arms it
-// logs both arming lines and the entry compare names the corrupted field at that fill's
-// serial, where=entry.
+// The MOBILEGL_PIPE_VERIFY_CORRUPT knob through the environment, where the lanes set it: the
+// fill after the child sets it logs both arming lines and the entry compare names the
+// corrupted field at that fill's serial, where=entry.
 TEST_F(PipeInputsTest, VerifyCorruptKnobNamesTheFieldAtEntry) {
 #if !MOBILEGL_PIPE_VERIFY
     GTEST_SKIP() << "verify not compiled in (MOBILEGL_PIPE_VERIFY=OFF)";
@@ -384,7 +433,7 @@ TEST_F(PipeInputsTest, VerifyCorruptKnobNamesTheFieldAtEntry) {
     const Uint64 serial = gPipeInputs->FilledState().CurrentVerbSerial + 1;
     const ChildResult r = RunInChild([] {
         MG_Config::Features.PipeVerify = true;
-        MG_Config::Features.PipeVerifyCorrupt = "GetRenderStateParameters";
+        ::setenv("MOBILEGL_PIPE_VERIFY_CORRUPT", "GetRenderStateParameters", 1);
         MGPipeValidateForVerb(MGPipeVerb::DrawArrays);
         ::_exit(3);
     });
@@ -409,7 +458,7 @@ TEST_F(PipeInputsTest, BadVerifyCorruptKnobIsFatalNamingTheKnob) {
     ASSERT_FALSE(g_logPath.empty()) << "main() did not set MOBILEGL_LOG_FILE_PATH";
     const ChildResult r = RunInChild([] {
         MG_Config::Features.PipeVerify = true;
-        MG_Config::Features.PipeVerifyCorrupt = "NoSuchField";
+        ::setenv("MOBILEGL_PIPE_VERIFY_CORRUPT", "NoSuchField", 1);
         MGPipeValidateForVerb(MGPipeVerb::DrawArrays);
         ::_exit(3);
     });
@@ -439,7 +488,7 @@ TEST_F(PipeInputsTest, VerifyFatalOffLogsTheDivergenceAndContinues) {
     const ChildResult r = RunInChild([] {
         MG_Config::Features.PipeVerify = true;
         MG_Config::Features.PipeVerifyFatal = false;
-        MG_Config::Features.PipeVerifyCorrupt = "GetRenderStateParameters";
+        ::setenv("MOBILEGL_PIPE_VERIFY_CORRUPT", "GetRenderStateParameters", 1);
         MGPipeValidateForVerb(MGPipeVerb::DrawArrays);
         MGPipeValidateForVerb(MGPipeVerb::DrawElements);
         std::exit(0);
@@ -522,8 +571,7 @@ TEST_F(PipeInputsTest, TheMutationNoticeRefreshesTheValueButNotTheStamp) {
     GTEST_SKIP() << "poison not compiled in (MOBILEGL_PIPE_POISON=0)";
 #else
     auto& ctx = *MG_State::pGLContext;
-    MGPipeSetPoisonOmission("DrawArrays", "GetSamplingResolutionGeneration");
-    MGPipeValidateForVerb(MGPipeVerb::DrawArrays);
+    FillWithholdingTheStamp(MGPipeVerb::DrawArrays, MGPipeInputField::GetSamplingResolutionGeneration);
     ASSERT_FALSE(Fresh(MGPipeInputField::GetSamplingResolutionGeneration));
     ctx.BumpSamplingResolutionGeneration();
     EXPECT_FALSE(Fresh(MGPipeInputField::GetSamplingResolutionGeneration))
@@ -531,7 +579,6 @@ TEST_F(PipeInputsTest, TheMutationNoticeRefreshesTheValueButNotTheStamp) {
 
     // FenceSync is a kQuery verb: its mask holds no texture field at all, so the notice must
     // leave the generation unfilled and a read of it Fatal{UnmigratedPipeInput}.
-    MGPipeSetPoisonOmission(nullptr, nullptr);
     MGPipeValidateForVerb(MGPipeVerb::FenceSync);
     ASSERT_FALSE(Fresh(MGPipeInputField::GetSamplingResolutionGeneration));
     ctx.BumpSamplingResolutionGeneration();

MobileGL/MG_Test/Pipe/SamplerEmitTest.cpp

@@ -543,7 +543,7 @@ namespace {
         static void Clear() {
             MGPipeSamplerEmitterInstance().Reset();
             MGPipeSamplerEmitterInstance().ResetCounters();
-            MGPipeSamplerCsoCacheInstance().ResetForTest();
+            MGPipeSamplerCsoCacheInstance().ForgetSession();
             MGPipeSamplerCsoCacheInstance().ResetCounters();
             MGPipeSetHashSuppressorInstance().InvalidateAll();
         }
@@ -729,7 +729,7 @@ namespace {
 
         // The ordinary path, for completeness: two states that differ in ONE field never share
         // a handle and never reach the confirm at all.
-        Cache().ResetForTest();
+        Cache().ForgetSession();
         Cache().ResetCounters();
         const MGPipeHandle plainFirst = Cache().Acquire(first, payload);
         const MGPipeHandle plainSecond = Cache().Acquire(second, payload);
@@ -1193,7 +1193,7 @@ namespace {
     // Nothing produced the bit before the fix round.
     TEST(SamplerEmit, AResolvedSamplerViewMarksItsTextureAsSamplerBound) {
         EmitterScope scope;
-        MGPipeTextureEmitterInstance().ResetForTest();
+        MGPipeTextureEmitterInstance().ForgetSession();
         namespace GL = MobileGL::MG_Impl::GLImpl;
         const Uint program = MakeSamplerProgram();
         GLint linked = 0;

MobileGL/MG_Test/Pipe/TextureEmitTest.cpp

@@ -233,7 +233,7 @@ namespace {
                 kMGPipeSubsystemResources | kMGPipeSubsystemTextureResources | kMGPipeSubsystemSamplers;
             m_previousContext = MG_State::pGLContext.Take();
             MG_State::pGLContext = MakeUnique<GLContext>();
-            MGPipeTextureEmitterInstance().ResetForTest();
+            MGPipeTextureEmitterInstance().ForgetSession();
             // AND THE APPLIER IS A PROCESS SINGLETON, so its object records outlive a case. With
             // kMGPipeWiredTextureSubsystem flipped the emitter's calls actually LAND, and a case
             // that inherited the previous one's records would assert against state it did not
@@ -245,7 +245,7 @@ namespace {
             MGPipeApplierReleaseObjectRecords();
         }
         ~TextureScope() {
-            MGPipeTextureEmitterInstance().ResetForTest();
+            MGPipeTextureEmitterInstance().ForgetSession();
             MGPipeApplierReset();
             MGPipeApplierReleaseObjectRecords();
             MG_State::pGLContext.reset();

MobileGL/MG_Test/Pipeline/CMakeLists.txt

@@ -14,6 +14,7 @@ add_executable(
         PassthroughTessControlTest.cpp
         ViewportIndexReflectionTest.cpp
         DriverModuleScreenTest.cpp
+        NarrowIntegerVertexFormatsTest.cpp
 )
 
 target_include_directories(PipelineQuirkTest PRIVATE

MobileGL/MG_Test/Pipeline/NarrowIntegerVertexFormatsTest.cpp

@@ -0,0 +1,196 @@
+// MobileGL - MobileGL/MG_Test/Pipeline/NarrowIntegerVertexFormatsTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Which vertex inputs take Magma's narrow-integer program variant. The pipeline fetches an integer
+// attribute with the format of the shader input's signedness, which re-extends 8/16-bit data by the
+// wrong rule exactly when the data and the input disagree in signedness; every other pairing -
+// 32-bit data, matching signedness, float data or float inputs - must keep today's program.
+
+#include <gtest/gtest.h>
+
+#include <MG_Backend/DirectVulkan/Renderer/NarrowIntegerVertexFormats.h>
+#include <MG_Backend/DirectVulkan/Renderer/ProgramFactory.h>
+
+using namespace MobileGL;
+using MobileGL::MG_Backend::DirectVulkan::ClassifyNarrowIntegerVertexFormat;
+using MobileGL::MG_Backend::DirectVulkan::IntegerVertexInputMasks;
+using MobileGL::MG_Backend::DirectVulkan::MagmaProgramSource;
+using MobileGL::MG_Backend::DirectVulkan::NarrowIntegerAttributeMasks;
+using MobileGL::MG_Backend::DirectVulkan::NarrowIntegerVertexFormat;
+using MobileGL::MG_Backend::DirectVulkan::NarrowIntegerVertexInputs;
+using MobileGL::MG_Backend::DirectVulkan::ProgramFactory;
+using MobileGL::MG_Backend::DirectVulkan::ResolveNarrowIntegerVertexInputs;
+
+namespace {
+    // The correction one (data format, shader input type) pair gets, alone at `location`.
+    NarrowIntegerVertexInputs Resolve(VkFormat format, GLenum inputType, Uint32 location = 3) {
+        IntegerVertexInputMasks inputs;
+        inputs.Note(location, inputType);
+        NarrowIntegerAttributeMasks data;
+        data.Note(location, format);
+        return ResolveNarrowIntegerVertexInputs(inputs, data);
+    }
+
+    NarrowIntegerVertexInputs Only(Uint32 NarrowIntegerVertexInputs::* field, Uint32 location = 3) {
+        NarrowIntegerVertexInputs expected;
+        expected.*field = 1u << location;
+        return expected;
+    }
+} // namespace
+
+TEST(NarrowIntegerVertexFormats, ClassifiesExactlyThe8And16BitIntegerFormats) {
+    for (const VkFormat format :
+         {VK_FORMAT_R8_UINT, VK_FORMAT_R8G8_UINT, VK_FORMAT_R8G8B8_UINT, VK_FORMAT_R8G8B8A8_UINT})
+        EXPECT_EQ(ClassifyNarrowIntegerVertexFormat(format), NarrowIntegerVertexFormat::Unsigned8) << format;
+    for (const VkFormat format :
+         {VK_FORMAT_R16_UINT, VK_FORMAT_R16G16_UINT, VK_FORMAT_R16G16B16_UINT, VK_FORMAT_R16G16B16A16_UINT})
+        EXPECT_EQ(ClassifyNarrowIntegerVertexFormat(format), NarrowIntegerVertexFormat::Unsigned16) << format;
+    for (const VkFormat format :
+         {VK_FORMAT_R8_SINT, VK_FORMAT_R8G8_SINT, VK_FORMAT_R8G8B8_SINT, VK_FORMAT_R8G8B8A8_SINT})
+        EXPECT_EQ(ClassifyNarrowIntegerVertexFormat(format), NarrowIntegerVertexFormat::Signed8) << format;
+    for (const VkFormat format :
+         {VK_FORMAT_R16_SINT, VK_FORMAT_R16G16_SINT, VK_FORMAT_R16G16B16_SINT, VK_FORMAT_R16G16B16A16_SINT})
+        EXPECT_EQ(ClassifyNarrowIntegerVertexFormat(format), NarrowIntegerVertexFormat::Signed16) << format;
+    // 32-bit integers, float/normalized/scaled data and packed or reversed formats never qualify.
+    for (const VkFormat format :
+         {VK_FORMAT_R32_UINT, VK_FORMAT_R32G32B32A32_UINT, VK_FORMAT_R32_SINT, VK_FORMAT_R32G32B32A32_SINT,
+          VK_FORMAT_R8G8B8A8_UNORM, VK_FORMAT_R8G8B8A8_SNORM, VK_FORMAT_R8G8B8A8_USCALED, VK_FORMAT_R16G16_SSCALED,
+          VK_FORMAT_R16_SFLOAT, VK_FORMAT_R32G32_SFLOAT, VK_FORMAT_B8G8R8A8_UNORM, VK_FORMAT_A2B10G10R10_UINT_PACK32,
+          VK_FORMAT_A2B10G10R10_SNORM_PACK32, VK_FORMAT_UNDEFINED})
+        EXPECT_EQ(ClassifyNarrowIntegerVertexFormat(format), NarrowIntegerVertexFormat::None) << format;
+}
+
+TEST(NarrowIntegerVertexFormats, CorrectsOnlyTheSignednessMismatches) {
+    // Sodium 0.5's a_LightAndData: GL_UNSIGNED_BYTE x4 into `in ivec4`.
+    EXPECT_EQ(Resolve(VK_FORMAT_R8G8B8A8_UINT, GL_INT_VEC4), Only(&NarrowIntegerVertexInputs::zeroExtend8));
+    EXPECT_EQ(Resolve(VK_FORMAT_R8_UINT, GL_INT), Only(&NarrowIntegerVertexInputs::zeroExtend8));
+    EXPECT_EQ(Resolve(VK_FORMAT_R16G16_UINT, GL_INT_VEC2), Only(&NarrowIntegerVertexInputs::zeroExtend16));
+    EXPECT_EQ(Resolve(VK_FORMAT_R16G16B16_UINT, GL_INT_VEC3), Only(&NarrowIntegerVertexInputs::zeroExtend16));
+    EXPECT_EQ(Resolve(VK_FORMAT_R8G8B8A8_SINT, GL_UNSIGNED_INT_VEC4), Only(&NarrowIntegerVertexInputs::signExtend8));
+    EXPECT_EQ(Resolve(VK_FORMAT_R8G8_SINT, GL_UNSIGNED_INT_VEC2), Only(&NarrowIntegerVertexInputs::signExtend8));
+    EXPECT_EQ(Resolve(VK_FORMAT_R16_SINT, GL_UNSIGNED_INT), Only(&NarrowIntegerVertexInputs::signExtend16));
+
+    // Matching signedness: the fetch already extends by the data's rule.
+    EXPECT_FALSE(Resolve(VK_FORMAT_R8G8B8A8_UINT, GL_UNSIGNED_INT_VEC4).Any());
+    EXPECT_FALSE(Resolve(VK_FORMAT_R16_SINT, GL_INT).Any());
+    // 32-bit data: the format swap renames bits, which is GL's reinterpretation already.
+    EXPECT_FALSE(Resolve(VK_FORMAT_R32_UINT, GL_INT).Any());
+    EXPECT_FALSE(Resolve(VK_FORMAT_R32G32B32A32_SINT, GL_UNSIGNED_INT_VEC4).Any());
+    // Float data into an integer input and integer data into a float input are not this rule.
+    EXPECT_FALSE(Resolve(VK_FORMAT_R8G8B8A8_USCALED, GL_INT_VEC4).Any());
+    EXPECT_FALSE(Resolve(VK_FORMAT_R8_UNORM, GL_UNSIGNED_INT).Any());
+    EXPECT_FALSE(Resolve(VK_FORMAT_R8G8B8A8_UINT, GL_FLOAT_VEC4).Any());
+    EXPECT_FALSE(Resolve(VK_FORMAT_R16_SINT, GL_FLOAT).Any());
+}
+
+// Locations are independent bits, a location the program does not read as an integer is ignored
+// even when its data is narrow, and the top location still fits.
+TEST(NarrowIntegerVertexFormats, KeepsLocationsApart) {
+    IntegerVertexInputMasks inputs;
+    inputs.Note(0, GL_FLOAT_VEC3);
+    inputs.Note(1, GL_INT_VEC4);
+    inputs.Note(2, GL_UNSIGNED_INT_VEC2);
+    inputs.Note(5, GL_UNSIGNED_INT_VEC4);
+    inputs.Note(31, GL_INT);
+    inputs.Note(32, GL_INT); // beyond the masks: ignored, not wrapped
+    EXPECT_EQ(inputs.signedInputs, (1u << 1) | (1u << 31));
+    EXPECT_EQ(inputs.unsignedInputs, (1u << 2) | (1u << 5));
+
+    NarrowIntegerAttributeMasks data;
+    data.Note(0, VK_FORMAT_R8G8B8A8_UINT); // a float input: not corrected
+    data.Note(1, VK_FORMAT_R8G8B8A8_UINT);
+    data.Note(2, VK_FORMAT_R16G16_UINT); // matching signedness
+    data.Note(5, VK_FORMAT_R8G8B8A8_SINT);
+    data.Note(7, VK_FORMAT_R16_SINT); // no shader input
+    data.Note(31, VK_FORMAT_R16_UINT);
+    data.Note(40, VK_FORMAT_R8_UINT);
+
+    const NarrowIntegerVertexInputs resolved = ResolveNarrowIntegerVertexInputs(inputs, data);
+    EXPECT_EQ(resolved.zeroExtend8, 1u << 1);
+    EXPECT_EQ(resolved.zeroExtend16, 1u << 31);
+    EXPECT_EQ(resolved.signExtend8, 1u << 5);
+    EXPECT_EQ(resolved.signExtend16, 0u);
+
+    // A program without integer inputs resolves to nothing whatever the data is.
+    EXPECT_FALSE(ResolveNarrowIntegerVertexInputs(IntegerVertexInputMasks{}, data).Any());
+}
+
+// The variant's program-cache identity: distinct from the plain program and from every other
+// correction set, and a pure function of its inputs.
+TEST(NarrowIntegerVertexFormats, VariantHashKeysEveryCorrectionApart) {
+    constexpr ProgramFactory::HashType kBase = 0x0123456789abcdefull;
+    const NarrowIntegerVertexInputs sodium = Only(&NarrowIntegerVertexInputs::zeroExtend8, 3);
+    const auto hash = ProgramFactory::MixNarrowIntegerVertexInputs(kBase, sodium);
+    EXPECT_NE(hash, kBase);
+    EXPECT_EQ(ProgramFactory::MixNarrowIntegerVertexInputs(kBase, sodium), hash);
+    EXPECT_NE(ProgramFactory::MixNarrowIntegerVertexInputs(kBase + 1, sodium), hash);
+    for (const auto field : {&NarrowIntegerVertexInputs::zeroExtend16, &NarrowIntegerVertexInputs::signExtend8,
+                             &NarrowIntegerVertexInputs::signExtend16})
+        EXPECT_NE(ProgramFactory::MixNarrowIntegerVertexInputs(kBase, Only(field, 3)), hash);
+    EXPECT_NE(ProgramFactory::MixNarrowIntegerVertexInputs(kBase, Only(&NarrowIntegerVertexInputs::zeroExtend8, 4)),
+              hash);
+}
+
+// The program half and the entry's own correction live on the cache entry, and the cache's
+// robin-hood insert moves entries around: a mask left behind by a move would pick another
+// program's variant, and a correction left behind would make a draw take a variant for the plain
+// program or the reverse.
+TEST(NarrowIntegerVertexFormats, IntegerInputMasksTravelWithTheProgramEntry) {
+    const NarrowIntegerVertexInputs sodium = Only(&NarrowIntegerVertexInputs::zeroExtend8, 3);
+    ProgramFactory::VkProgramObject source;
+    source.integerVertexInputs.signedInputs = 1u << 3;
+    source.integerVertexInputs.unsignedInputs = 1u << 7;
+    source.narrowIntegerInputs = sodium;
+
+    ProgramFactory::VkProgramObject moved(std::move(source));
+    EXPECT_EQ(moved.integerVertexInputs.signedInputs, 1u << 3);
+    EXPECT_EQ(moved.integerVertexInputs.unsignedInputs, 1u << 7);
+    EXPECT_EQ(moved.narrowIntegerInputs, sodium);
+    EXPECT_EQ(source.integerVertexInputs.signedInputs, 0u);
+    EXPECT_EQ(source.integerVertexInputs.unsignedInputs, 0u);
+    EXPECT_FALSE(source.narrowIntegerInputs.Any());
+
+    ProgramFactory::VkProgramObject assigned;
+    assigned = std::move(moved);
+    EXPECT_EQ(assigned.integerVertexInputs.signedInputs, 1u << 3);
+    EXPECT_EQ(assigned.integerVertexInputs.unsignedInputs, 1u << 7);
+    EXPECT_EQ(assigned.narrowIntegerInputs, sodium);
+    EXPECT_EQ(moved.integerVertexInputs.signedInputs, 0u);
+    EXPECT_EQ(moved.integerVertexInputs.unsignedInputs, 0u);
+    EXPECT_FALSE(moved.narrowIntegerInputs.Any());
+}
+
+// A draw starts from the variant the program's last lookup with the same flags returned, which
+// the program record keeps beside the plain hash it derives from. A fresh slot must point at the
+// plain program, and the variant must be forgotten with the hash: after a relink or a binding
+// change the same flags answer from a fresh slot.
+TEST(NarrowIntegerVertexFormats, TheLastVariantIsRememberedOnlyWithItsPlainHash) {
+    MG_Pipe::MGPipeShaderCsoRecord record{};
+    record.Archive = MakeShared<MG_State::GLState::ProgramArchive>();
+    record.Serial = 4;
+    record.BindingsSerial = 9;
+    const MagmaProgramSource source({5, 1}, record);
+    constexpr Uint kFlags = 0x21;
+
+    EXPECT_EQ(source.FindBackendHashMemo(kFlags), nullptr);
+    auto& slot = source.SetBackendHashMemo(kFlags, 0xabcull);
+    EXPECT_EQ(slot.LastVariantHash, 0xabcull) << "a fresh slot starts at the plain program";
+    slot.LastVariantHash = 0xdefull;
+    const auto* found = source.FindBackendHashMemo(kFlags);
+    ASSERT_EQ(found, &slot);
+    EXPECT_EQ(found->Hash, 0xabcull);
+    EXPECT_EQ(found->LastVariantHash, 0xdefull);
+    EXPECT_EQ(source.FindBackendHashMemo(kFlags + 1), nullptr) << "other flags have their own slot";
+
+    record.Serial = 5; // a relink
+    EXPECT_EQ(source.FindBackendHashMemo(kFlags), nullptr);
+    EXPECT_EQ(source.SetBackendHashMemo(kFlags, 0x123ull).LastVariantHash, 0x123ull);
+    ASSERT_NE(source.FindBackendHashMemo(kFlags), nullptr);
+    record.BindingsSerial = 10; // glUniformBlockBinding and friends
+    EXPECT_EQ(source.FindBackendHashMemo(kFlags), nullptr);
+}

MobileGL/MG_Test/Program/ShaderPrewarmTest.cpp

@@ -7,14 +7,18 @@
 // End of Source File Header
 
 // MOBILEGL_DISABLE_SHADER_PREWARM. Initialize() builds glslang's built-in tables ahead of the
-// first compile unless the variable is truthy; the CI test lanes set it, so these cases set or
-// clear it themselves. MG_ConfigLoader::Init() rereads the environment on every Initialize(),
-// so the variable, not the feature block, is the input. Its own binary: every case calls
-// Destroy(), and ShaderCompilePool's stop is a one-way latch (see AsyncTeardownTest).
+// first compile unless the variable is truthy, and logs which way it went; these cases read that
+// line back. The CI test lanes set the variable, so every case sets or clears it itself:
+// MG_ConfigLoader::Init() rereads the environment on every Initialize(). The log file is
+// truncated by each Initialize() and closed by Destroy(), so each case reads it after Destroy().
+// Its own binary: every case calls Destroy(), and ShaderCompilePool's stop is a one-way latch.
 
 #include <gtest/gtest.h>
 
 #include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <sstream>
 #include <string>
 
 #include "Config.h"
@@ -22,15 +26,22 @@
 #include "Init.h"
 #include "MG_Impl/GLImpl/Getter/GL_Getter.h"
 #include "MG_Impl/GLImpl/Program/GL_Program.h"
-#include "MG_Util/ShaderTranspiler/ShaderCompiler.h"
+#include "MG_Util/Debug/Log.h"
+
+#if defined(_WIN32)
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
 
 using namespace MobileGL;
 using namespace MobileGL::MG_Impl::GLImpl;
-using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
 
 namespace {
     constexpr const char* kPrewarmKnob = "MOBILEGL_DISABLE_SHADER_PREWARM";
     constexpr const char* kAsyncKnob = "MOBILEGL_ASYNC_SHADER_COMPILE";
+    constexpr const char* kPrewarmedLine = "prewarmed the glslang built-in tables";
+    constexpr const char* kSkippedLine = "built-in table prewarm skipped";
 
     // Sets (or, with nullptr, clears) one environment variable for a scope.
     class ScopedEnv {
@@ -62,6 +73,54 @@ namespace {
         bool m_had = false;
     };
 
+    int ProcessId() {
+#if defined(_WIN32)
+        return _getpid();
+#else
+        return static_cast<int>(getpid());
+#endif
+    }
+
+    // Points the library's log at a private file for the case; Log() reads what the client role
+    // wrote, by the library's own naming rule.
+    class PrivateLog {
+    public:
+        PrivateLog()
+            : m_base((std::filesystem::temp_directory_path() /
+                      ("mobilegl-shaderprewarm-test-" + std::to_string(ProcessId()) + ".log"))
+                         .string()),
+              m_env("MOBILEGL_LOG_FILE_PATH", m_base.c_str()) {}
+        ~PrivateLog() {
+            std::error_code ignored;
+            std::filesystem::remove(Path(), ignored);
+            std::filesystem::remove(m_base, ignored);
+        }
+        PrivateLog(const PrivateLog&) = delete;
+        PrivateLog& operator=(const PrivateLog&) = delete;
+
+        std::string Path() const {
+            return MG_Util::Debug::RoleLogPath(m_base.c_str(), MG_Util::Debug::LogRole::Client);
+        }
+
+        std::string Log() const {
+            std::ifstream in(Path());
+            std::stringstream text;
+            text << in.rdbuf();
+            return text.str();
+        }
+
+    private:
+        std::string m_base;
+        ScopedEnv m_env;
+    };
+
+    int Count(const std::string& text, const char* line) {
+        int count = 0;
+        for (auto at = text.find(line); at != std::string::npos; at = text.find(line, at + 1))
+            ++count;
+        return count;
+    }
+
     GLint CompileStatusOf(const GLenum type, const char* source) {
         const GLuint shader = CreateShader(type);
         ShaderSource(shader, 1, &source, nullptr);
@@ -77,35 +136,37 @@ namespace {
 } // namespace
 
 TEST(ShaderPrewarm, InitializePrewarmsByDefaultAndAgainAfterDestroy) {
+    const PrivateLog log;
     const ScopedEnv knob(kPrewarmKnob, nullptr);
     const ScopedEnv async(kAsyncKnob, "1");
     MobileGL::Initialize();
-    EXPECT_FALSE(MG_Config::Features.DisableShaderPrewarm);
-    EXPECT_TRUE(ShaderCompiler::BuiltinsPrewarmed());
     MobileGL::Destroy();
-    // Destroy finalizes glslang, which frees the tables the latch stands for.
-    EXPECT_FALSE(ShaderCompiler::BuiltinsPrewarmed());
+    EXPECT_EQ(Count(log.Log(), kPrewarmedLine), 1) << log.Log();
+    // Destroy finalizes glslang, which frees the tables, so the next Initialize warms again.
     MobileGL::Initialize();
-    EXPECT_TRUE(ShaderCompiler::BuiltinsPrewarmed());
     MobileGL::Destroy();
+    EXPECT_EQ(Count(log.Log(), kPrewarmedLine), 1) << log.Log();
 }
 
 TEST(ShaderPrewarm, ATruthyKnobSkipsThePrewarmAndCompilesStillWork) {
+    const PrivateLog log;
     const ScopedEnv knob(kPrewarmKnob, "1");
     const ScopedEnv async(kAsyncKnob, "1");
     MobileGL::Initialize();
-    EXPECT_TRUE(MG_Config::Features.DisableShaderPrewarm);
-    EXPECT_FALSE(ShaderCompiler::BuiltinsPrewarmed());
     EXPECT_EQ(CompileStatusOf(GL_FRAGMENT_SHADER, kFragment460), GL_TRUE);
-    EXPECT_FALSE(ShaderCompiler::BuiltinsPrewarmed());
     MobileGL::Destroy();
+    const std::string text = log.Log();
+    EXPECT_EQ(Count(text, kPrewarmedLine), 0) << text;
+    EXPECT_EQ(Count(text, kSkippedLine), 1) << text;
 }
 
 TEST(ShaderPrewarm, AFalsyKnobKeepsThePrewarm) {
+    const PrivateLog log;
     const ScopedEnv knob(kPrewarmKnob, "0");
     const ScopedEnv async(kAsyncKnob, "1");
     MobileGL::Initialize();
-    EXPECT_FALSE(MG_Config::Features.DisableShaderPrewarm);
-    EXPECT_TRUE(ShaderCompiler::BuiltinsPrewarmed());
     MobileGL::Destroy();
+    const std::string text = log.Log();
+    EXPECT_EQ(Count(text, kPrewarmedLine), 1) << text;
+    EXPECT_EQ(Count(text, kSkippedLine), 0) << text;
 }

MobileGL/MG_Test/SanityTest.cpp

@@ -4326,12 +4326,10 @@ TEST(DirectGLESBufferDrawProbe, UnderSplitTheRecordAloneAnswersTheLiveHostMapQue
     // case reaches is optional.
     const Uint64 previousPush = MG_Config::Features.PipePush;
     const auto previousTransport = MG_Config::Transport;
-    const Uint32 previousBlockKb = MG_Config::RecordArm.PersistentBlockKb;
     MG_Pipe::MGPipeResourceOps ops{};
     MG_Config::Features.PipePush |= MG_Pipe::kMGPipeSubsystemResources;
     MG_Pipe::MGPipeSetResourceOps(&ops);
     MG_Config::Transport = MG_Config::TransportMode::InProcess;
-    MG_Config::RecordArm.PersistentBlockKb = 64;
     // P5 c1 / R-8: UNDER SPLIT THE OP TABLE IS NO LONGER THE ARMING CONDITION, and this case is
     // the first place that shows. `MGPipeSetResourceOps(&ops)` is the SERVER's registration; the
     // client's liveness gate now reads the caps mirror's consumer mask instead, because under a
@@ -4424,7 +4422,6 @@ TEST(DirectGLESBufferDrawProbe, UnderSplitTheRecordAloneAnswersTheLiveHostMapQue
         BufferImpl::g_backendBufferResources.ReleaseByHandle(res);
     }
 
-    MG_Config::RecordArm.PersistentBlockKb = previousBlockKb;
     MG_Config::Transport = previousTransport;
     MG_Pipe::MGPipeSetResourceOps(nullptr);
     MG_Config::Features.PipePush = previousPush;

MobileGL/MG_Test/ShaderTranspiler/CMakeLists.txt

@@ -20,8 +20,11 @@ add_executable(
         FlattenXfbInterfaceBlocksTest.cpp
         UniquifyIoBlockNamesTest.cpp
         StripIoBlockLocationsTest.cpp
+        StripCompatPerVertexMembersTest.cpp
         LowerViewportIndexTest.cpp
         DeferGeometryEmitsTest.cpp
+        RetainGeometryOutputsTest.cpp
+        PositionFixupSitesTest.cpp
         ClampMultisampleFetchTest.cpp
         LegalizeResourceArrayIndexTest.cpp
         FlattenAtomicCounterBlockTest.cpp
@@ -32,6 +35,8 @@ add_executable(
         PixelCenterIntegerTest.cpp
         ZeroLayerOutputTest.cpp
         FullCoverageSampleMaskTest.cpp
+        ExtendNarrowIntegerVertexInputsTest.cpp
+        ExtendNarrowIntegerVertexInputsRuntimeTest.cpp
         RelaxedOpaqueStructTest.cpp
         ShadingRateEsslTest.cpp
 )
@@ -45,6 +50,7 @@ target_include_directories(SpirvPassTest PRIVATE
 target_link_libraries(
         SpirvPassTest PRIVATE
         MobileGLTestMain
+        glslang-default-resource-limits
         ${LINK_LIBRARIES}
 )
 

MobileGL/MG_Test/ShaderTranspiler/ExtendNarrowIntegerVertexInputsRuntimeTest.cpp

@@ -0,0 +1,274 @@
+// MobileGL - MobileGL/MG_Test/ShaderTranspiler/ExtendNarrowIntegerVertexInputsRuntimeTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// ExtendNarrowIntegerVertexInputsPass's RuntimeWidths mode, the one a backend uses when it cannot
+// vary the program per draw. Every 32-bit integer input below location 32 is seeded from the two
+// width globals, with shifts only - no bitfield instruction, which ESSL 3.00 cannot spell - and the
+// module must stay valid, keep its reflected inputs and leave a module without integer inputs alone.
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <tuple>
+
+#include "Includes.h"
+#include "Init.h"
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+
+#include <spirv-tools/libspirv.hpp>
+#include <spirv_reflect.h>
+
+using namespace MobileGL;
+using MobileGL::MG_Util::ShaderTranspiler::kNarrowIntegerWidths16GlobalName;
+using MobileGL::MG_Util::ShaderTranspiler::kNarrowIntegerWidths8GlobalName;
+using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
+
+namespace {
+    constexpr const char* kVertex = R"(#version 330 core
+layout(location = 0) in vec2 pos;
+layout(location = 1) in ivec4 lightAndData;
+layout(location = 2) in uvec2 texc;
+layout(location = 3) in int single;
+layout(location = 4) in uint other;
+layout(location = 5) in int packed[2];
+flat out ivec4 a;
+flat out uvec4 b;
+void main() {
+    a = lightAndData + ivec4(single, packed[0], packed[1], 0);
+    b = uvec4(texc, other, 0u);
+    gl_Position = vec4(pos, 0.0, 1.0);
+}
+)";
+    constexpr const char* kFloatOnlyVertex = R"(#version 330 core
+layout(location = 0) in vec2 pos;
+void main() { gl_Position = vec4(pos, 0.0, 1.0); }
+)";
+    constexpr const char* kFragment = R"(#version 330 core
+flat in ivec4 a;
+flat in uvec4 b;
+out vec4 color;
+void main() { color = vec4(a) + vec4(b); }
+)";
+    constexpr const char* kPlainFragment = R"(#version 330 core
+out vec4 color;
+void main() { color = vec4(1.0); }
+)";
+
+    // Index 0 is the vertex module, 1 the fragment module.
+    Vector<Vector<Uint32>> CompileProgram(const char* vertex, const char* fragment) {
+        using namespace MG_Util::ShaderTranspiler;
+        Vector<SharedPtr<glslang::TShader>> shaders;
+        for (const auto& [stage, source] :
+             Vector<Pair<GLenum, const char*>>{{GL_VERTEX_SHADER, vertex}, {GL_FRAGMENT_SHADER, fragment}}) {
+            ShaderAttrib attrib{.shaderType = stage, .sourceStr = source};
+            auto shader = ShaderCompiler::CompileShader(attrib);
+            EXPECT_TRUE(shader) << (shader ? String{} : shader.error().log);
+            if (!shader) return {};
+            shaders.push_back(shader.value());
+        }
+        ProgramAttrib programAttrib{.shaders = shaders};
+        auto program = ShaderCompiler::LinkProgram(programAttrib);
+        EXPECT_TRUE(program) << (program ? String{} : program.error().log);
+        if (!program) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = {GL_VERTEX_SHADER, GL_FRAGMENT_SHADER},
+                                         .program = *program.value()};
+        auto binary = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        EXPECT_TRUE(binary) << (binary ? String{} : binary.error().log);
+        if (!binary || binary->size() != 2) return {};
+        Vector<Vector<Uint32>> modules = binary.value();
+        for (auto& module : modules)
+            EXPECT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(module, module, true, true));
+        return modules;
+    }
+
+    String Disassemble(const Vector<Uint32>& spirv) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        String text;
+        EXPECT_TRUE(tools.Disassemble(spirv, &text));
+        return text;
+    }
+
+    String ValidationError(const Vector<Uint32>& spirv, spv_target_env env = SPV_ENV_VULKAN_1_1) {
+        spvtools::SpirvTools tools(env);
+        String error;
+        tools.SetMessageConsumer([&](spv_message_level_t, const char*, const spv_position_t&, const char* message) {
+            error += message != nullptr ? message : "";
+        });
+        return tools.Validate(spirv) ? String{} : (error.empty() ? String{"invalid"} : error);
+    }
+
+    SizeT CountOccurrences(const String& text, const String& needle) {
+        SizeT count = 0;
+        for (SizeT at = text.find(needle); at != String::npos; at = text.find(needle, at + needle.size()))
+            ++count;
+        return count;
+    }
+
+    Vector<String> LinesWith(const String& text, const String& needle) {
+        Vector<String> lines;
+        SizeT begin = 0;
+        while (begin < text.size()) {
+            SizeT end = text.find('\n', begin);
+            if (end == String::npos) end = text.size();
+            String line = text.substr(begin, end - begin);
+            if (line.find(needle) != String::npos) lines.push_back(line);
+            begin = end + 1;
+        }
+        return lines;
+    }
+
+    Vector<std::tuple<Uint32, Uint32, Uint32>> ReflectInputs(const Vector<Uint32>& spirv) {
+        SpvReflectShaderModule module{};
+        EXPECT_EQ(spvReflectCreateShaderModule(spirv.size() * sizeof(Uint32), spirv.data(), &module),
+                  SPV_REFLECT_RESULT_SUCCESS);
+        Uint32 count = 0;
+        EXPECT_EQ(spvReflectEnumerateInputVariables(&module, &count, nullptr), SPV_REFLECT_RESULT_SUCCESS);
+        Vector<SpvReflectInterfaceVariable*> inputs(count);
+        EXPECT_EQ(spvReflectEnumerateInputVariables(&module, &count, inputs.data()), SPV_REFLECT_RESULT_SUCCESS);
+        Vector<std::tuple<Uint32, Uint32, Uint32>> result;
+        for (const auto* input : inputs) {
+            if (input->decoration_flags & SPV_REFLECT_DECORATION_BUILT_IN) continue;
+            result.emplace_back(input->location, input->numeric.vector.component_count,
+                                static_cast<Uint32>(input->type_description->type_flags));
+        }
+        spvReflectDestroyShaderModule(&module);
+        std::sort(result.begin(), result.end());
+        return result;
+    }
+
+    // Moves every `OpDecorate %id Location from` to `to`, in the binary itself.
+    void MoveLocation(Vector<Uint32>& spirv, Uint32 from, Uint32 to) {
+        for (SizeT word = 5; word < spirv.size();) {
+            const Uint32 count = spirv[word] >> 16;
+            const Uint32 opcode = spirv[word] & 0xFFFFu;
+            if (count == 0) break;
+            if (opcode == 71u /* OpDecorate */ && count == 4 && spirv[word + 2] == 30u /* Location */ &&
+                spirv[word + 3] == from)
+                spirv[word + 3] = to;
+            word += count;
+        }
+    }
+} // namespace
+
+TEST(ExtendNarrowIntegerVertexInputsRuntimeWidths, SeedsEveryIntegerInputFromTheTwoWidths) {
+    MobileGL::Initialize();
+    const auto modules = CompileProgram(kVertex, kFragment);
+    ASSERT_EQ(modules.size(), 2u);
+    const String original = Disassemble(modules[0]);
+
+    Vector<Uint32> output;
+    Bool changed = false;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(modules[0], output, changed, true));
+    EXPECT_TRUE(changed);
+    EXPECT_EQ(ValidationError(output), String{});
+    const String text = Disassemble(output);
+
+    // The two globals: named, Private, initialised to 0 and never stored.
+    for (const char* name : {kNarrowIntegerWidths8GlobalName, kNarrowIntegerWidths16GlobalName}) {
+        const String id = String("%") + name;
+        EXPECT_NE(text.find(id + " = OpVariable %_ptr_Private_uint Private %uint_0"), String::npos) << name << "\n"
+                                                                                                    << text;
+        EXPECT_EQ(CountOccurrences(text, String("OpStore ") + id + " "), 0u) << text;
+        EXPECT_EQ(CountOccurrences(text, String("OpLoad %uint ") + id), 1u) << text;
+    }
+
+    // Every integer input is a seeded Private copy now; the float input is untouched.
+    for (const char* name : {"%lightAndData", "%texc", "%single", "%other", "%packed"}) {
+        EXPECT_NE(text.find(String(name) + " = OpVariable %_ptr_Private_"), String::npos) << name << "\n" << text;
+        EXPECT_EQ(CountOccurrences(text, String("OpStore ") + name + " "), 1u) << name << "\n" << text;
+    }
+    EXPECT_NE(text.find("%pos = OpVariable %_ptr_Input_v2float Input"), String::npos) << text;
+
+    // Six seeded values (the ivec4, the uvec2, the int, the uint and two array elements): a left
+    // shift each, an arithmetic right shift for the two uint ones, a logical one for the four int
+    // ones, and the shift amount splatted for the two vectors. No bitfield instruction at all.
+    EXPECT_EQ(CountOccurrences(text, "OpShiftLeftLogical") - CountOccurrences(original, "OpShiftLeftLogical"), 6u)
+        << text;
+    EXPECT_EQ(CountOccurrences(text, "OpShiftRightArithmetic %v2uint") +
+                  CountOccurrences(text, "OpShiftRightArithmetic %uint"),
+              2u)
+        << text;
+    EXPECT_EQ(CountOccurrences(text, "OpShiftLeftLogical %v4int"), 1u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpShiftRightLogical %v4int"), 1u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpShiftRightLogical %int"), 3u) << text;
+    for (const char* splat : {"OpCompositeConstruct %v4uint", "OpCompositeConstruct %v2uint"})
+        EXPECT_EQ(CountOccurrences(text, splat) - CountOccurrences(original, splat), 1u) << splat << "\n" << text;
+    EXPECT_EQ(CountOccurrences(text, "OpBitFieldSExtract"), 0u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpBitFieldUExtract"), 0u) << text;
+    EXPECT_NE(text.find("%uint_24"), String::npos) << text;
+    EXPECT_NE(text.find("%uint_16"), String::npos) << text;
+
+    EXPECT_EQ(ReflectInputs(output), ReflectInputs(modules[0]));
+}
+
+// A width bit exists only for locations 0-31, and shifting a 32-bit value by 32 or more is
+// undefined, so an input from location 32 up keeps its fetched value and its Input variable.
+TEST(ExtendNarrowIntegerVertexInputsRuntimeWidths, LeavesLocationsFrom32UpAlone) {
+    MobileGL::Initialize();
+    auto modules = CompileProgram(kVertex, kFragment);
+    ASSERT_EQ(modules.size(), 2u);
+    Vector<Uint32> input = modules[0];
+    MoveLocation(input, 1, 40); // lightAndData
+    MoveLocation(input, 3, 33); // single
+
+    Vector<Uint32> output;
+    Bool changed = false;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(input, output, changed, true));
+    EXPECT_TRUE(changed);
+    const String text = Disassemble(output);
+    EXPECT_NE(text.find("%lightAndData = OpVariable %_ptr_Input_v4int Input"), String::npos) << text;
+    EXPECT_NE(text.find("%single = OpVariable %_ptr_Input_int Input"), String::npos) << text;
+    EXPECT_NE(text.find("%texc = OpVariable %_ptr_Private_"), String::npos) << text;
+
+    // Every integer input above the bits: nothing to seed, so nothing changes.
+    for (const Uint32 location : {2u, 4u, 5u, 6u})
+        MoveLocation(input, location, 50 + location);
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(input, output, changed, true));
+    EXPECT_FALSE(changed);
+    EXPECT_EQ(output, input);
+}
+
+TEST(ExtendNarrowIntegerVertexInputsRuntimeWidths, LeavesAModuleWithoutIntegerInputsAlone) {
+    MobileGL::Initialize();
+    const auto plain = CompileProgram(kFloatOnlyVertex, kPlainFragment);
+    ASSERT_EQ(plain.size(), 2u);
+    Vector<Uint32> output;
+    Bool changed = true;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(plain[0], output, changed, true));
+    EXPECT_FALSE(changed);
+    EXPECT_EQ(output, plain[0]);
+
+    const auto modules = CompileProgram(kVertex, kFragment);
+    ASSERT_EQ(modules.size(), 2u);
+    changed = true;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(modules[1], output, changed, true));
+    EXPECT_FALSE(changed) << "a fragment module has no vertex inputs";
+    EXPECT_EQ(output, modules[1]);
+}
+
+// From SPIR-V 1.4 an entry point lists every global it uses, so the two width globals have to
+// join the interface beside the new Inputs and the Private copies.
+TEST(ExtendNarrowIntegerVertexInputsRuntimeWidths, ListsTheWidthGlobalsInASpirv14Interface) {
+    MobileGL::Initialize();
+    const auto modules = CompileProgram(kVertex, kFragment);
+    ASSERT_EQ(modules.size(), 2u);
+    Vector<Uint32> input = modules[0];
+    input[1] = 0x00010400u;
+    ASSERT_EQ(ValidationError(input, SPV_ENV_VULKAN_1_2), String{});
+
+    Vector<Uint32> output;
+    Bool changed = false;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForEssl(input, output, changed, false));
+    EXPECT_TRUE(changed);
+    EXPECT_EQ(ValidationError(output, SPV_ENV_VULKAN_1_2), String{});
+    const auto entryPoint = LinesWith(Disassemble(output), "OpEntryPoint");
+    ASSERT_EQ(entryPoint.size(), 1u);
+    for (const char* name : {kNarrowIntegerWidths8GlobalName, kNarrowIntegerWidths16GlobalName, "lightAndData", "texc"})
+        EXPECT_NE(entryPoint[0].find(String("%") + name), String::npos) << name << "\n" << entryPoint[0];
+}

MobileGL/MG_Test/ShaderTranspiler/ExtendNarrowIntegerVertexInputsTest.cpp

@@ -0,0 +1,248 @@
+// MobileGL - MobileGL/MG_Test/ShaderTranspiler/ExtendNarrowIntegerVertexInputsTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Magma fetches an integer attribute with the format of the shader input's signedness, so 8/16-bit
+// data reaches an input of the other signedness extended by the wrong rule (Sodium's UNSIGNED_BYTE
+// a_LightAndData read as `ivec4` turned 240 into -16). ExtendNarrowIntegerVertexInputsPass puts
+// GL's value back. What has to hold: the module stays valid, exactly the listed locations get a
+// zero-extension mask or a sign-extension, an array input is corrected element by element, the
+// reflected vertex inputs do not move, and everything else is left byte-for-byte alone.
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <tuple>
+
+#include "Includes.h"
+#include "Init.h"
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+
+#include <spirv-tools/libspirv.hpp>
+#include <spirv_reflect.h>
+
+using namespace MobileGL;
+using MobileGL::MG_Util::ShaderTranspiler::NarrowIntegerVertexInputs;
+using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
+
+namespace {
+    constexpr const char* kVertex = R"(#version 330 core
+layout(location = 0) in vec2 pos;
+layout(location = 1) in ivec4 lightAndData;
+layout(location = 2) in uvec2 texc;
+layout(location = 3) in uvec4 sbyte;
+layout(location = 4) in int shortAsInt;
+layout(location = 5) in int packed[3];
+layout(location = 8) in uint sshort;
+flat out ivec4 a;
+flat out uvec4 b;
+void main() {
+    a = lightAndData + ivec4(shortAsInt) + ivec4(packed[0], packed[1], packed[2], 0);
+    b = uvec4(texc, sshort, 0u) + sbyte;
+    gl_Position = vec4(pos, 0.0, 1.0);
+}
+)";
+    constexpr const char* kFragment = R"(#version 330 core
+flat in ivec4 a;
+flat in uvec4 b;
+out vec4 color;
+void main() { color = vec4(a) + vec4(b); }
+)";
+
+    // Index 0 is the vertex module, 1 the fragment module (stages come back sorted).
+    Vector<Vector<Uint32>> CompileProgram() {
+        using namespace MG_Util::ShaderTranspiler;
+        Vector<SharedPtr<glslang::TShader>> shaders;
+        for (const auto& [stage, source] :
+             Vector<Pair<GLenum, const char*>>{{GL_VERTEX_SHADER, kVertex}, {GL_FRAGMENT_SHADER, kFragment}}) {
+            ShaderAttrib attrib{.shaderType = stage, .sourceStr = source};
+            auto shader = ShaderCompiler::CompileShader(attrib);
+            EXPECT_TRUE(shader) << (shader ? String{} : shader.error().log);
+            if (!shader) return {};
+            shaders.push_back(shader.value());
+        }
+        ProgramAttrib programAttrib{.shaders = shaders};
+        auto program = ShaderCompiler::LinkProgram(programAttrib);
+        EXPECT_TRUE(program) << (program ? String{} : program.error().log);
+        if (!program) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = {GL_VERTEX_SHADER, GL_FRAGMENT_SHADER},
+                                         .program = *program.value()};
+        auto binary = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        EXPECT_TRUE(binary) << (binary ? String{} : binary.error().log);
+        if (!binary || binary->size() != 2) return {};
+        Vector<Vector<Uint32>> modules = binary.value();
+        for (auto& module : modules)
+            EXPECT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(module, module, true, true));
+        return modules;
+    }
+
+    String Disassemble(const Vector<Uint32>& spirv) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        String text;
+        EXPECT_TRUE(tools.Disassemble(spirv, &text));
+        return text;
+    }
+
+    String ValidationError(const Vector<Uint32>& spirv, spv_target_env env = SPV_ENV_VULKAN_1_1) {
+        spvtools::SpirvTools tools(env);
+        String error;
+        tools.SetMessageConsumer([&](spv_message_level_t, const char*, const spv_position_t&, const char* message) {
+            error += message != nullptr ? message : "";
+        });
+        return tools.Validate(spirv) ? String{} : (error.empty() ? String{"invalid"} : error);
+    }
+
+    SizeT CountOccurrences(const String& text, const String& needle) {
+        SizeT count = 0;
+        for (SizeT at = text.find(needle); at != String::npos; at = text.find(needle, at + needle.size()))
+            ++count;
+        return count;
+    }
+
+    // The lines of `text` holding `opcode`, for checking an instruction's operands.
+    Vector<String> LinesWith(const String& text, const String& opcode) {
+        Vector<String> lines;
+        SizeT begin = 0;
+        while (begin < text.size()) {
+            SizeT end = text.find('\n', begin);
+            if (end == String::npos) end = text.size();
+            String line = text.substr(begin, end - begin);
+            if (line.find(opcode) != String::npos) lines.push_back(line);
+            begin = end + 1;
+        }
+        return lines;
+    }
+
+    // (location, component count, numeric flags) of every non-builtin input, sorted: what the
+    // program factory reflects the vertex inputs from.
+    Vector<std::tuple<Uint32, Uint32, Uint32>> ReflectInputs(const Vector<Uint32>& spirv) {
+        SpvReflectShaderModule module{};
+        EXPECT_EQ(spvReflectCreateShaderModule(spirv.size() * sizeof(Uint32), spirv.data(), &module),
+                  SPV_REFLECT_RESULT_SUCCESS);
+        Uint32 count = 0;
+        EXPECT_EQ(spvReflectEnumerateInputVariables(&module, &count, nullptr), SPV_REFLECT_RESULT_SUCCESS);
+        Vector<SpvReflectInterfaceVariable*> inputs(count);
+        EXPECT_EQ(spvReflectEnumerateInputVariables(&module, &count, inputs.data()), SPV_REFLECT_RESULT_SUCCESS);
+        Vector<std::tuple<Uint32, Uint32, Uint32>> result;
+        for (const auto* input : inputs) {
+            if (input->decoration_flags & SPV_REFLECT_DECORATION_BUILT_IN) continue;
+            result.emplace_back(input->location, input->numeric.vector.component_count,
+                                static_cast<Uint32>(input->type_description->type_flags));
+        }
+        spvReflectDestroyShaderModule(&module);
+        std::sort(result.begin(), result.end());
+        return result;
+    }
+
+    // Sodium's shape plus one of each other kind: UNSIGNED_BYTE into ivec4 (1), BYTE into uvec4 (3),
+    // UNSIGNED_SHORT into int (4), SHORT into uint (8), and UNSIGNED_BYTE into the middle element
+    // of an int array (location 6 = packed[1]).
+    NarrowIntegerVertexInputs SodiumLikeInputs() {
+        NarrowIntegerVertexInputs inputs;
+        inputs.zeroExtend8 = (1u << 1) | (1u << 6);
+        inputs.signExtend8 = 1u << 3;
+        inputs.zeroExtend16 = 1u << 4;
+        inputs.signExtend16 = 1u << 8;
+        return inputs;
+    }
+} // namespace
+
+TEST(ExtendNarrowIntegerVertexInputs, ExtendsExactlyTheListedLocations) {
+    MobileGL::Initialize();
+    const auto modules = CompileProgram();
+    ASSERT_EQ(modules.size(), 2u);
+    const Vector<Uint32>& input = modules[0];
+    const String original = Disassemble(input);
+    ASSERT_EQ(CountOccurrences(original, "OpBitwiseAnd"), 0u) << original;
+    ASSERT_EQ(CountOccurrences(original, "OpBitFieldSExtract"), 0u) << original;
+
+    Vector<Uint32> output;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForVulkan(input, output, SodiumLikeInputs(), true));
+    EXPECT_EQ(ValidationError(output), String{});
+    const String text = Disassemble(output);
+
+    // Zero-extensions: the ivec4 by 0xff, the int by 0xffff, and packed[1] (one element) by 0xff.
+    const auto ands = LinesWith(text, "OpBitwiseAnd");
+    ASSERT_EQ(ands.size(), 3u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpBitwiseAnd %v4int"), 1u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpBitwiseAnd %int"), 2u) << text;
+    EXPECT_EQ(CountOccurrences(text, "%int_65535"), 2u) << text; // declaration + the one use
+    EXPECT_NE(text.find("%int_255"), String::npos) << text;
+
+    // Sign-extensions: the uvec4 from 8 bits, the uint from 16, both at bit offset 0.
+    const auto extracts = LinesWith(text, "OpBitFieldSExtract");
+    ASSERT_EQ(extracts.size(), 2u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpBitFieldSExtract %v4uint"), 1u) << text;
+    EXPECT_EQ(CountOccurrences(text, "OpBitFieldSExtract %uint"), 1u) << text;
+    for (const auto& line : extracts)
+        EXPECT_NE(line.find(" %uint_0 %uint_"), String::npos) << line;
+    EXPECT_EQ(CountOccurrences(text, " %uint_0 %uint_8"), 1u) << text;
+    EXPECT_EQ(CountOccurrences(text, " %uint_0 %uint_16"), 1u) << text;
+
+    // The corrected inputs are now Private copies seeded once; the untouched ones stay Inputs.
+    for (const char* name : {"%lightAndData", "%sbyte", "%shortAsInt", "%packed", "%sshort"}) {
+        EXPECT_NE(text.find(String(name) + " = OpVariable %_ptr_Private_"), String::npos) << name << "\n" << text;
+        EXPECT_EQ(CountOccurrences(text, String("OpStore ") + name + " "), 1u) << name << "\n" << text;
+    }
+    EXPECT_NE(text.find("%pos = OpVariable %_ptr_Input_v2float Input"), String::npos) << text;
+    EXPECT_NE(text.find("%texc = OpVariable %_ptr_Input_v2uint Input"), String::npos) << text;
+
+    // The array is split into its three elements and rebuilt, one element corrected.
+    EXPECT_EQ(CountOccurrences(text, "OpCompositeExtract %int") - CountOccurrences(original, "OpCompositeExtract %int"),
+              3u)
+        << text;
+    EXPECT_EQ(CountOccurrences(text, "OpCompositeConstruct %_arr_int_uint_3") -
+                  CountOccurrences(original, "OpCompositeConstruct %_arr_int_uint_3"),
+              1u)
+        << text;
+
+    // Same interface: every location, width and type the program factory reflects is unchanged.
+    EXPECT_EQ(ReflectInputs(output), ReflectInputs(input));
+}
+
+// A list that names no integer input of the module - a float input, an empty location, a fragment
+// module - leaves the bytes alone, so a mis-keyed variant cannot change what the shader computes.
+TEST(ExtendNarrowIntegerVertexInputs, LeavesEverythingElseUnchanged) {
+    MobileGL::Initialize();
+    const auto modules = CompileProgram();
+    ASSERT_EQ(modules.size(), 2u);
+
+    NarrowIntegerVertexInputs floatOrEmpty;
+    floatOrEmpty.zeroExtend8 = (1u << 0) | (1u << 12);
+    floatOrEmpty.signExtend16 = 1u << 31;
+    Vector<Uint32> output;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForVulkan(modules[0], output, floatOrEmpty, true));
+    EXPECT_EQ(output, modules[0]);
+
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForVulkan(modules[1], output, SodiumLikeInputs(), true));
+    EXPECT_EQ(output, modules[1]);
+
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForVulkan(modules[0], output, {}, true));
+    EXPECT_EQ(output, modules[0]);
+}
+
+// From SPIR-V 1.4 an entry point lists every global it uses, so the Private copies have to join
+// the new Inputs in the interface. Checked by re-labelling the module 1.4 and validating it for an
+// environment that accepts 1.4.
+TEST(ExtendNarrowIntegerVertexInputs, ListsPrivateCopiesInASpirv14Interface) {
+    MobileGL::Initialize();
+    const auto modules = CompileProgram();
+    ASSERT_EQ(modules.size(), 2u);
+    Vector<Uint32> input = modules[0];
+    ASSERT_GT(input.size(), 1u);
+    input[1] = 0x00010400u;
+    ASSERT_EQ(ValidationError(input, SPV_ENV_VULKAN_1_2), String{});
+
+    Vector<Uint32> output;
+    ASSERT_TRUE(ShaderCompiler::ExtendNarrowIntegerVertexInputsForVulkan(input, output, SodiumLikeInputs(), false));
+    EXPECT_EQ(ValidationError(output, SPV_ENV_VULKAN_1_2), String{});
+    const auto entryPoint = LinesWith(Disassemble(output), "OpEntryPoint");
+    ASSERT_EQ(entryPoint.size(), 1u);
+    for (const char* name : {"%lightAndData", "%sbyte", "%shortAsInt", "%packed", "%sshort", "%texc"})
+        EXPECT_NE(entryPoint[0].find(name), String::npos) << name << "\n" << entryPoint[0];
+}

MobileGL/MG_Test/ShaderTranspiler/PositionFixupSitesTest.cpp

@@ -0,0 +1,283 @@
+// MobileGL - MobileGL/MG_Test/ShaderTranspiler/PositionFixupSitesTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Magma's clip-space fix-up rewrites gl_Position in front of every vertex the last
+// pre-rasterization stage produces. A geometry shader produces one at every emit it can execute,
+// and the front end leaves helper functions in place, so an EmitVertex() inside a helper needs the
+// fix-up too: without it those vertices reach the rasterizer un-remapped, and a GL depth below
+// zero is clipped away. A vertex shader's helper return, on the other hand, does not end the
+// invocation and must stay untouched.
+
+#include <gtest/gtest.h>
+
+#include <memory>
+
+#include "Includes.h"
+#include "Init.h"
+#include <MG_Backend/DirectVulkan/Renderer/ProgramFactory.h>
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+
+#include <spirv-tools/libspirv.hpp>
+
+#include "source/opt/build_module.h"
+#include "source/opt/ir_context.h"
+#include "spirv.hpp"
+
+using namespace MobileGL;
+using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
+using spvtools::opt::Instruction;
+using spvtools::opt::IRContext;
+
+namespace {
+    using Bit = MG_Backend::DirectVulkan::ProgramFactory::CompileOptionBit;
+    using CompileOptionFlags = MG_Backend::DirectVulkan::ProgramFactory::CompileOptionFlags;
+
+    // One stage, linked and sanitized the way production hands it to the backend.
+    Vector<Uint32> CompileStage(GLenum stage, const String& source) {
+        using namespace MG_Util::ShaderTranspiler;
+        MobileGL::Initialize();
+        ShaderAttrib shaderAttrib{.shaderType = stage, .sourceStr = source};
+        auto shaderResult = ShaderCompiler::CompileShader(shaderAttrib);
+        EXPECT_TRUE(shaderResult) << (shaderResult ? String{} : shaderResult.error().log);
+        if (!shaderResult) return {};
+        ProgramAttrib programAttrib{.shaders = {shaderResult.value()}};
+        auto programResult = ShaderCompiler::LinkProgram(programAttrib);
+        EXPECT_TRUE(programResult) << (programResult ? String{} : programResult.error().log);
+        if (!programResult) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = {stage}, .program = *programResult.value()};
+        auto binaryResult = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        EXPECT_TRUE(binaryResult) << (binaryResult ? String{} : binaryResult.error().log);
+        if (!binaryResult || binaryResult->empty()) return {};
+        Vector<Uint32> module = binaryResult->front();
+        EXPECT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(module, module, true, true));
+        return module;
+    }
+
+    Vector<Uint32> FixUp(const Vector<Uint32>& spirv) {
+        Vector<Uint32> out;
+        EXPECT_TRUE(MG_Backend::DirectVulkan::TransformSpirvForVulkanPositionFix(
+            spirv, out, CompileOptionFlags(Bit::PositionYFlip) | Bit::PositionZRemap));
+        return out;
+    }
+
+    String ValidationError(const Vector<Uint32>& spirv) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        String error;
+        tools.SetMessageConsumer([&](spv_message_level_t, const char*, const spv_position_t&, const char* message) {
+            error += message != nullptr ? message : "";
+        });
+        return tools.Validate(spirv) ? String{} : (error.empty() ? String{"invalid"} : error);
+    }
+
+    String Disassemble(const Vector<Uint32>& spirv) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        String text;
+        EXPECT_TRUE(tools.Disassemble(spirv, &text));
+        return text;
+    }
+
+    // Whether `pointerId` is an access chain to gl_PerVertex's Position member.
+    Bool IsPositionPointer(IRContext* context, Uint32 pointerId) {
+        auto* defUse = context->get_def_use_mgr();
+        const Instruction* chain = defUse->GetDef(pointerId);
+        if (chain == nullptr || chain->opcode() != spv::Op::OpAccessChain || chain->NumInOperands() != 2) return false;
+        const Instruction* base = defUse->GetDef(chain->GetSingleWordInOperand(0));
+        const Instruction* index = defUse->GetDef(chain->GetSingleWordInOperand(1));
+        if (base == nullptr || base->opcode() != spv::Op::OpVariable || index == nullptr ||
+            index->opcode() != spv::Op::OpConstant)
+            return false;
+        const Uint32 structId = defUse->GetDef(base->type_id())->GetSingleWordInOperand(1);
+        const Uint32 member = index->GetSingleWordInOperand(0);
+        for (const Instruction& annotation : context->annotations()) {
+            if (annotation.opcode() == spv::Op::OpMemberDecorate && annotation.GetSingleWordInOperand(0) == structId &&
+                annotation.GetSingleWordInOperand(1) == member &&
+                annotation.GetSingleWordInOperand(2) == Uint32(spv::Decoration::BuiltIn) &&
+                annotation.GetSingleWordInOperand(3) == Uint32(spv::BuiltIn::Position))
+                return true;
+        }
+        return false;
+    }
+
+    // Whether `inst` is the fix-up's closing store: Position stored back with its y negated, the
+    // y taken from a load of Position itself. The shader's own stores never have that shape.
+    Bool IsFixupStore(IRContext* context, const Instruction& inst) {
+        if (inst.opcode() != spv::Op::OpStore || !IsPositionPointer(context, inst.GetSingleWordInOperand(0)))
+            return false;
+        auto* defUse = context->get_def_use_mgr();
+        const Instruction* value = defUse->GetDef(inst.GetSingleWordInOperand(1));
+        if (value == nullptr || value->opcode() != spv::Op::OpCompositeConstruct || value->NumInOperands() != 4)
+            return false;
+        const Instruction* negatedY = defUse->GetDef(value->GetSingleWordInOperand(1));
+        if (negatedY == nullptr || negatedY->opcode() != spv::Op::OpFNegate) return false;
+        const Instruction* y = defUse->GetDef(negatedY->GetSingleWordInOperand(0));
+        if (y == nullptr || y->opcode() != spv::Op::OpCompositeExtract) return false;
+        const Instruction* loaded = defUse->GetDef(y->GetSingleWordInOperand(0));
+        return loaded != nullptr && loaded->opcode() == spv::Op::OpLoad &&
+               IsPositionPointer(context, loaded->GetSingleWordInOperand(0));
+    }
+
+    struct Sites {
+        SizeT sites = 0;
+        SizeT sitesInHelpers = 0;
+        // Sites whose immediately preceding instruction is the fix-up's store.
+        SizeT fixedSites = 0;
+        SizeT fixupStores = 0;
+        SizeT fixupStoresInHelpers = 0;
+    };
+
+    // Emits for a geometry shader, returns for any other stage.
+    Sites Inspect(const Vector<Uint32>& spirv) {
+        Sites sites;
+        std::unique_ptr<IRContext> context =
+            spvtools::BuildModule(SPV_ENV_VULKAN_1_1, nullptr, spirv.data(), spirv.size());
+        EXPECT_NE(context, nullptr);
+        if (context == nullptr) return sites;
+        const Instruction& entryPoint = *context->module()->entry_points().begin();
+        const Bool geometry =
+            static_cast<spv::ExecutionModel>(entryPoint.GetSingleWordInOperand(0)) == spv::ExecutionModel::Geometry;
+        const Uint32 entryFunctionId = entryPoint.GetSingleWordInOperand(1);
+        for (auto& function : *context->module()) {
+            const Bool helper = function.result_id() != entryFunctionId;
+            for (auto& block : function) {
+                const Instruction* previous = nullptr;
+                for (const Instruction& inst : block) {
+                    const Bool isSite = geometry ? (inst.opcode() == spv::Op::OpEmitVertex ||
+                                                    inst.opcode() == spv::Op::OpEmitStreamVertex)
+                                                 : inst.opcode() == spv::Op::OpReturn;
+                    if (isSite) {
+                        ++sites.sites;
+                        if (helper) ++sites.sitesInHelpers;
+                        if (previous != nullptr && IsFixupStore(context.get(), *previous)) ++sites.fixedSites;
+                    }
+                    if (IsFixupStore(context.get(), inst)) {
+                        ++sites.fixupStores;
+                        if (helper) ++sites.fixupStoresInHelpers;
+                    }
+                    previous = &inst;
+                }
+            }
+        }
+        return sites;
+    }
+} // namespace
+
+// gsprobe's helper case: each corner is written and emitted inside the helper.
+TEST(PositionFixupSitesTest, AnEmitInsideAHelperGetsTheFixup) {
+    const auto spirv = CompileStage(GL_GEOMETRY_SHADER, R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+void corner(int i) { gl_Position = vec4(gl_in[i].gl_Position.xy, -0.5, 1.0); EmitVertex(); }
+void main() { corner(0); corner(1); corner(2); EndPrimitive(); }
+)");
+    ASSERT_FALSE(spirv.empty());
+    const Sites before = Inspect(spirv);
+    ASSERT_EQ(before.sites, 1u) << "the helper is expected to survive to the backend";
+    ASSERT_EQ(before.sitesInHelpers, 1u);
+    ASSERT_EQ(before.fixupStores, 0u);
+
+    const auto fixed = FixUp(spirv);
+    EXPECT_EQ(ValidationError(fixed), String{}) << Disassemble(fixed);
+    const Sites after = Inspect(fixed);
+    EXPECT_EQ(after.sites, 1u);
+    EXPECT_EQ(after.fixedSites, 1u) << Disassemble(fixed);
+    EXPECT_EQ(after.fixupStores, 1u);
+}
+
+// The value is written in main and only the emit sits in a helper.
+TEST(PositionFixupSitesTest, AHelperThatOnlyEmitsGetsTheFixup) {
+    const auto spirv = CompileStage(GL_GEOMETRY_SHADER, R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+void emitIt() { EmitVertex(); }
+void main() {
+    for (int i = 0; i < 3; i++) { gl_Position = vec4(gl_in[i].gl_Position.xy, -0.5, 1.0); emitIt(); }
+    EndPrimitive();
+}
+)");
+    ASSERT_FALSE(spirv.empty());
+    ASSERT_EQ(Inspect(spirv).sitesInHelpers, 1u);
+
+    const auto fixed = FixUp(spirv);
+    EXPECT_EQ(ValidationError(fixed), String{}) << Disassemble(fixed);
+    const Sites after = Inspect(fixed);
+    EXPECT_EQ(after.sites, 1u);
+    EXPECT_EQ(after.fixedSites, 1u) << Disassemble(fixed);
+    EXPECT_EQ(after.fixupStores, 1u);
+}
+
+// Emits in main and in a helper side by side: each one is fixed exactly once.
+TEST(PositionFixupSitesTest, EmitsInMainAndInAHelperAreEachFixedOnce) {
+    const auto spirv = CompileStage(GL_GEOMETRY_SHADER, R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+void corner(int i) { gl_Position = gl_in[i].gl_Position; EmitVertex(); }
+void main() {
+    gl_Position = gl_in[0].gl_Position;
+    EmitVertex();
+    corner(1);
+    corner(2);
+    EndPrimitive();
+}
+)");
+    ASSERT_FALSE(spirv.empty());
+    const Sites before = Inspect(spirv);
+    ASSERT_EQ(before.sites, 2u);
+    ASSERT_EQ(before.sitesInHelpers, 1u);
+
+    const auto fixed = FixUp(spirv);
+    EXPECT_EQ(ValidationError(fixed), String{}) << Disassemble(fixed);
+    const Sites after = Inspect(fixed);
+    EXPECT_EQ(after.fixedSites, 2u) << Disassemble(fixed);
+    EXPECT_EQ(after.fixupStores, 2u);
+    EXPECT_EQ(after.fixupStoresInHelpers, 1u);
+}
+
+// The shape that always worked: every emit in main, each one still fixed.
+TEST(PositionFixupSitesTest, EmitsInMainKeepTheirFixup) {
+    const auto spirv = CompileStage(GL_GEOMETRY_SHADER, R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 4) out;
+void main() {
+    for (int i = 0; i < 3; i++) { gl_Position = gl_in[i].gl_Position; EmitVertex(); }
+    gl_Position = gl_in[0].gl_Position;
+    EmitVertex();
+    EndPrimitive();
+}
+)");
+    ASSERT_FALSE(spirv.empty());
+    const Sites before = Inspect(spirv);
+    ASSERT_EQ(before.sites, 2u);
+    ASSERT_EQ(before.sitesInHelpers, 0u);
+
+    const auto fixed = FixUp(spirv);
+    EXPECT_EQ(ValidationError(fixed), String{}) << Disassemble(fixed);
+    const Sites after = Inspect(fixed);
+    EXPECT_EQ(after.fixedSites, 2u) << Disassemble(fixed);
+    EXPECT_EQ(after.fixupStores, 2u);
+}
+
+// A vertex shader that writes gl_Position in a helper: only main's return ends the invocation,
+// so that is the only place the fix-up goes.
+TEST(PositionFixupSitesTest, AVertexShaderHelperReturnIsNotAFixupSite) {
+    const auto spirv = CompileStage(GL_VERTEX_SHADER, R"(#version 410 core
+layout(location = 0) in vec2 pos;
+void place(vec2 p) { gl_Position = vec4(p, -0.5, 1.0); }
+void main() { place(pos); }
+)");
+    ASSERT_FALSE(spirv.empty());
+    const Sites before = Inspect(spirv);
+    ASSERT_EQ(before.sitesInHelpers, 1u) << "the helper is expected to survive to the backend";
+
+    const auto fixed = FixUp(spirv);
+    EXPECT_EQ(ValidationError(fixed), String{}) << Disassemble(fixed);
+    const Sites after = Inspect(fixed);
+    EXPECT_EQ(after.fixupStores, 1u) << Disassemble(fixed);
+    EXPECT_EQ(after.fixupStoresInHelpers, 0u);
+    EXPECT_EQ(after.fixedSites, 1u);
+}

MobileGL/MG_Test/ShaderTranspiler/RetainGeometryOutputsTest.cpp

@@ -0,0 +1,503 @@
+// MobileGL - MobileGL/MG_Test/ShaderTranspiler/RetainGeometryOutputsTest.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// RetainGeometryOutputsPass makes a geometry output keep its last written value across
+// EmitVertex(), as desktop drivers do. What has to hold: an output written before an earlier emit
+// is copied from its Private shadow into the real output right before every emit and is otherwise
+// never touched directly; outputs written before every emit, and stages that write everything
+// before every emit, stay as they were; unwritten builtin members stay inactive; the module stays
+// valid Vulkan SPIR-V whose ESSL translation compiles; and the sanitize chain both backends consume
+// runs it.
+
+#include <gtest/gtest.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "Includes.h"
+#include "Init.h"
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_Util/ShaderTranspiler/SpirvPasses/RetainGeometryOutputsPass.h>
+#include <MG_Util/ShaderTranspiler/SpvcSession.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+
+#include <glslang/Public/ResourceLimits.h>
+#include <glslang/Public/ShaderLang.h>
+#include <spirv-tools/libspirv.hpp>
+#include <spirv-tools/optimizer.hpp>
+
+#include "source/opt/build_module.h"
+#include "source/opt/ir_context.h"
+#include "spirv.hpp"
+
+using namespace MobileGL;
+using MobileGL::MG_Util::ShaderTranspiler::RetainGeometryOutputsPass;
+using MobileGL::MG_Util::ShaderTranspiler::SessionUsageBit;
+using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
+using MobileGL::MG_Util::ShaderTranspiler::SpvcSession;
+using spvtools::opt::Instruction;
+using spvtools::opt::IRContext;
+
+namespace {
+    Vector<Uint32> CompileStage(GLenum stage, const String& source) {
+        using namespace MG_Util::ShaderTranspiler;
+        ShaderAttrib shaderAttrib{.shaderType = stage, .sourceStr = source};
+        auto shaderResult = ShaderCompiler::CompileShader(shaderAttrib);
+        EXPECT_TRUE(shaderResult) << (shaderResult ? String{} : shaderResult.error().log);
+        if (!shaderResult) return {};
+        ProgramAttrib programAttrib{.shaders = {shaderResult.value()}};
+        auto programResult = ShaderCompiler::LinkProgram(programAttrib);
+        EXPECT_TRUE(programResult) << (programResult ? String{} : programResult.error().log);
+        if (!programResult) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = {stage}, .program = *programResult.value()};
+        auto binaryResult = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        EXPECT_TRUE(binaryResult) << (binaryResult ? String{} : binaryResult.error().log);
+        if (!binaryResult || binaryResult->empty()) return {};
+        return binaryResult->front();
+    }
+
+    Vector<Uint32> CompileGeometry(const String& source) {
+        return CompileStage(GL_GEOMETRY_SHADER, source);
+    }
+
+    Vector<Uint32> Retain(const Vector<Uint32>& spirv) {
+        spvtools::Optimizer optimizer(SPV_ENV_VULKAN_1_1);
+        optimizer.RegisterPass(RetainGeometryOutputsPass::CreateRetainGeometryOutputsPass());
+        spvtools::OptimizerOptions options;
+        options.set_run_validator(false);
+        Vector<Uint32> out;
+        EXPECT_TRUE(optimizer.Run(spirv.data(), spirv.size(), &out, options));
+        return out;
+    }
+
+    Bool Validates(const Vector<Uint32>& spirv, String& messages) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        tools.SetMessageConsumer([&messages](spv_message_level_t, const char*, const spv_position_t&,
+                                             const char* message) { messages += String(message) + "\n"; });
+        return tools.Validate(spirv);
+    }
+
+    String Transpile(const Vector<Uint32>& spirv) {
+        SpvcSession session(spirv, SessionUsageBit::Transpile);
+        auto essl = ShaderCompiler::DecompileShader(session);
+        EXPECT_TRUE(essl) << (essl ? String{} : essl.error().log);
+        return essl ? essl.value() : String{};
+    }
+
+    // Whether the ESSL SPIRV-Cross printed is accepted by an ES front end.
+    Bool EsslCompiles(const String& essl, String& log) {
+        glslang::TShader shader(EShLangGeometry);
+        const char* strings[] = {essl.c_str()};
+        shader.setStrings(strings, 1);
+        const Bool ok = shader.parse(GetDefaultResources(), 320, EEsProfile, false, false, EShMsgDefault);
+        log = shader.getInfoLog();
+        return ok;
+    }
+
+    std::unique_ptr<IRContext> Parse(const Vector<Uint32>& spirv) {
+        return spvtools::BuildModule(SPV_ENV_VULKAN_1_1, nullptr, spirv.data(), spirv.size());
+    }
+
+    // The OpVariable whose OpName is `name`, or 0.
+    Uint32 VariableNamed(IRContext* context, const String& name) {
+        for (const Instruction& debugInst : context->debugs2()) {
+            if (debugInst.opcode() != spv::Op::OpName || debugInst.GetInOperand(1).AsString() != name) continue;
+            const Instruction* def = context->get_def_use_mgr()->GetDef(debugInst.GetSingleWordInOperand(0));
+            if (def != nullptr && def->opcode() == spv::Op::OpVariable) return def->result_id();
+        }
+        return 0;
+    }
+
+    spv::StorageClass StorageClassOf(IRContext* context, Uint32 variableId) {
+        return static_cast<spv::StorageClass>(
+            context->get_def_use_mgr()->GetDef(variableId)->GetSingleWordInOperand(0));
+    }
+
+    // Whether `pointerId` addresses the whole of `variableId` (member < 0) or exactly its member.
+    Bool Addresses(IRContext* context, Uint32 pointerId, Uint32 variableId, Int member) {
+        if (member < 0) return pointerId == variableId;
+        const Instruction* chain = context->get_def_use_mgr()->GetDef(pointerId);
+        if (chain == nullptr || chain->opcode() != spv::Op::OpAccessChain || chain->NumInOperands() != 2 ||
+            chain->GetSingleWordInOperand(0) != variableId)
+            return false;
+        const Instruction* index = context->get_def_use_mgr()->GetDef(chain->GetSingleWordInOperand(1));
+        return index != nullptr && index->opcode() == spv::Op::OpConstant &&
+               index->GetSingleWordInOperand(0) == Uint32(member);
+    }
+
+    struct EmitSites {
+        SizeT emits = 0;
+        // Emits whose own straight-line run (since the previous emit or the block start) stores the output.
+        SizeT emitsPrecededByStore = 0;
+        SizeT storesToOutput = 0;
+        SizeT loadsFromOutput = 0;
+    };
+
+    EmitSites Inspect(IRContext* context, Uint32 variableId, Int member = -1) {
+        EmitSites sites;
+        for (auto& function : *context->module()) {
+            for (auto& block : function) {
+                Bool storedSinceEmit = false;
+                for (Instruction& inst : block) {
+                    if (inst.opcode() == spv::Op::OpEmitVertex || inst.opcode() == spv::Op::OpEmitStreamVertex) {
+                        ++sites.emits;
+                        if (storedSinceEmit) ++sites.emitsPrecededByStore;
+                        storedSinceEmit = false;
+                    } else if (inst.opcode() == spv::Op::OpStore &&
+                               Addresses(context, inst.GetSingleWordInOperand(0), variableId, member)) {
+                        ++sites.storesToOutput;
+                        storedSinceEmit = true;
+                    } else if (inst.opcode() == spv::Op::OpLoad &&
+                               Addresses(context, inst.GetSingleWordInOperand(0), variableId, member)) {
+                        ++sites.loadsFromOutput;
+                    }
+                }
+            }
+        }
+        return sites;
+    }
+
+    Uint32 PerVertexBlock(IRContext* context) {
+        for (const Instruction& global : context->types_values()) {
+            if (global.opcode() != spv::Op::OpVariable ||
+                static_cast<spv::StorageClass>(global.GetSingleWordInOperand(0)) != spv::StorageClass::Output)
+                continue;
+            const Instruction* pointer = context->get_def_use_mgr()->GetDef(global.type_id());
+            const Instruction* pointee = context->get_def_use_mgr()->GetDef(pointer->GetSingleWordInOperand(1));
+            if (pointee->opcode() == spv::Op::OpTypeStruct) return global.result_id();
+        }
+        return 0;
+    }
+
+    void ExpectValidAndCompilable(const Vector<Uint32>& spirv) {
+        String messages;
+        EXPECT_TRUE(Validates(spirv, messages)) << messages;
+        const String essl = Transpile(spirv);
+        ASSERT_FALSE(essl.empty());
+        String log;
+        EXPECT_TRUE(EsslCompiles(essl, log)) << log << "\n" << essl;
+    }
+
+    // gsprobe's case 3 and iterationT's gbuffers_terrain.gsh: a flat output written (and read
+    // back) once, before the loop that emits; the provoking vertex is the third.
+    const char* const kFlatBeforeLoop = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+in vec2 v_pos[];
+flat out float res;
+out vec2 p;
+void main() {
+    res = abs(v_pos[0].x) + 1.0;
+    res = exp2(round(log2(res)));
+    for (int i = 0; i < 3; i++) { gl_Position = gl_in[i].gl_Position; p = v_pos[i]; EmitVertex(); }
+    EndPrimitive();
+}
+)";
+
+    // Everything written before every emit, one output through both arms of a branch.
+    const char* const kWritesEverythingPerEmit = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+in vec2 v_pos[];
+flat out float res;
+out vec2 p;
+void main() {
+    for (int i = 0; i < 3; i++) {
+        if (v_pos[i].x > 0.0) res = 1.0; else res = 2.0;
+        gl_Position = gl_in[i].gl_Position;
+        p = v_pos[i];
+        EmitVertex();
+    }
+    EndPrimitive();
+}
+)";
+
+    // gl_PointSize written once in a gl_PerVertex that also declares gl_ClipDistance, plus the
+    // layered-rendering idiom of a gl_Layer set before the emit loop.
+    const char* const kBuiltinsBeforeLoop = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+void main() {
+    gl_PointSize = 4.0;
+    gl_Layer = 2;
+    for (int i = 0; i < 3; i++) { gl_Position = gl_in[i].gl_Position; EmitVertex(); }
+}
+)";
+
+    // The emit lives in a helper; main writes the flat output once and calls it per vertex.
+    const char* const kEmitInHelper = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+flat out float res;
+void emitCorner(int i) { gl_Position = gl_in[i].gl_Position; EmitVertex(); }
+void main() {
+    res = 42.0;
+    emitCorner(0);
+    emitCorner(1);
+    emitCorner(2);
+}
+)";
+
+    // Fully written before every emit, but from its own value before the previous emit.
+    const char* const kReadBackAfterEmit = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+flat out float res;
+void main() {
+    res = 1.0;
+    for (int i = 0; i < 3; i++) { res = res * 2.0; gl_Position = gl_in[i].gl_Position; EmitVertex(); }
+}
+)";
+
+    // A partially written output: .w once, .xyz per vertex.
+    const char* const kPartialWrites = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+out vec4 c;
+void main() {
+    c.w = 0.25;
+    for (int i = 0; i < 3; i++) { gl_Position = gl_in[i].gl_Position; c.xyz = vec3(float(i)); EmitVertex(); }
+}
+)";
+
+    // A user output block: only the member written before the loop is carried.
+    const char* const kUserBlock = R"(#version 410 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+out Data { flat float res; vec2 p; } vOut;
+void main() {
+    vOut.res = 42.0;
+    for (int i = 0; i < 3; i++) { gl_Position = gl_in[i].gl_Position; vOut.p = vec2(float(i)); EmitVertex(); }
+}
+)";
+
+    const char* const kStreams = R"(#version 410 core
+layout(points) in;
+layout(points, max_vertices = 4) out;
+layout(stream = 0) out float a;
+layout(stream = 1) out float b;
+void main() {
+    a = 1.0;
+    b = 2.0;
+    for (int i = 0; i < 2; i++) {
+        gl_Position = gl_in[0].gl_Position;
+        EmitStreamVertex(0);
+        EmitStreamVertex(1);
+    }
+}
+)";
+
+    // The flat-before-loop shape plus a storage write after the emits, so DeferGeometryEmitsPass
+    // has something to defer.
+    const char* const kFlatBeforeLoopWithMemoryWrite = R"(#version 430 core
+layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+layout(std430, binding = 0) buffer Counter { uint n; };
+flat out float res;
+void main() {
+    res = 42.0;
+    for (int i = 0; i < 3; i++) { gl_Position = gl_in[i].gl_Position; EmitVertex(); }
+    atomicAdd(n, 1u);
+}
+)";
+
+    const char* const kVertex = R"(#version 410 core
+out float res;
+void main() { res = 1.0; gl_Position = vec4(0.0); }
+)";
+} // namespace
+
+TEST(RetainGeometryOutputs, AFlatOutputWrittenBeforeTheLoopIsCopiedBeforeEveryEmit) {
+    const Vector<Uint32> spirv = CompileGeometry(kFlatBeforeLoop);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    ExpectValidAndCompilable(out);
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    const Uint32 res = VariableNamed(context.get(), "res");
+    const Uint32 shadow = VariableNamed(context.get(), "mg_retained_res");
+    ASSERT_NE(res, 0u);
+    ASSERT_NE(shadow, 0u);
+    EXPECT_EQ(StorageClassOf(context.get(), res), spv::StorageClass::Output);
+    EXPECT_EQ(StorageClassOf(context.get(), shadow), spv::StorageClass::Private);
+
+    // The real output is written only by the copy in front of the one emit, and never read.
+    const EmitSites atOutput = Inspect(context.get(), res);
+    EXPECT_EQ(atOutput.emits, 1u);
+    EXPECT_EQ(atOutput.emitsPrecededByStore, 1u);
+    EXPECT_EQ(atOutput.storesToOutput, 1u);
+    EXPECT_EQ(atOutput.loadsFromOutput, 0u);
+    // The shader's own two writes and its read-back moved to the shadow.
+    const EmitSites atShadow = Inspect(context.get(), shadow);
+    EXPECT_EQ(atShadow.storesToOutput, 2u);
+    EXPECT_GE(atShadow.loadsFromOutput, 2u);
+
+    // `p` is written before every emit, so it is not carried.
+    EXPECT_EQ(VariableNamed(context.get(), "mg_retained_p"), 0u);
+    EXPECT_EQ(VariableNamed(context.get(), "mg_retained_Position"), 0u);
+}
+
+TEST(RetainGeometryOutputs, AStageThatWritesEveryOutputBeforeEveryEmitIsLeftAlone) {
+    const Vector<Uint32> spirv = CompileGeometry(kWritesEverythingPerEmit);
+    ASSERT_FALSE(spirv.empty());
+    EXPECT_EQ(Retain(spirv), spirv);
+}
+
+TEST(RetainGeometryOutputs, ANonGeometryStageIsLeftAlone) {
+    const Vector<Uint32> spirv = CompileStage(GL_VERTEX_SHADER, kVertex);
+    ASSERT_FALSE(spirv.empty());
+    EXPECT_EQ(Retain(spirv), spirv);
+}
+
+TEST(RetainGeometryOutputs, OnlyTheWrittenBuiltinMembersAreCarried) {
+    const Vector<Uint32> spirv = CompileGeometry(kBuiltinsBeforeLoop);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    String messages;
+    EXPECT_TRUE(Validates(out, messages)) << messages;
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    EXPECT_NE(VariableNamed(context.get(), "mg_retained_PointSize"), 0u);
+    EXPECT_NE(VariableNamed(context.get(), "mg_retained_Layer"), 0u);
+    EXPECT_EQ(VariableNamed(context.get(), "mg_retained_Position"), 0u);
+    EXPECT_EQ(VariableNamed(context.get(), "mg_retained_ClipDistance"), 0u);
+
+    const Uint32 perVertex = PerVertexBlock(context.get());
+    ASSERT_NE(perVertex, 0u);
+    const EmitSites pointSize = Inspect(context.get(), perVertex, 1);
+    EXPECT_EQ(pointSize.emitsPrecededByStore, pointSize.emits);
+    EXPECT_EQ(pointSize.storesToOutput, pointSize.emits);
+    const EmitSites layer = Inspect(context.get(), VariableNamed(context.get(), "gl_Layer"));
+    EXPECT_EQ(layer.emitsPrecededByStore, layer.emits);
+    EXPECT_EQ(layer.storesToOutput, layer.emits);
+
+    const String essl = Transpile(out);
+    ASSERT_FALSE(essl.empty());
+    EXPECT_EQ(essl.find("gl_ClipDistance"), String::npos) << "an unwritten builtin member became active\n" << essl;
+    EXPECT_NE(essl.find("gl_Layer = "), String::npos) << essl;
+}
+
+TEST(RetainGeometryOutputs, OnlyTheWrittenUserBlockMemberIsCarried) {
+    const Vector<Uint32> spirv = CompileGeometry(kUserBlock);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    ExpectValidAndCompilable(out);
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    EXPECT_NE(VariableNamed(context.get(), "mg_retained_res"), 0u);
+    EXPECT_EQ(VariableNamed(context.get(), "mg_retained_p"), 0u);
+    const Uint32 block = VariableNamed(context.get(), "vOut");
+    ASSERT_NE(block, 0u);
+    const EmitSites res = Inspect(context.get(), block, 0);
+    EXPECT_EQ(res.emitsPrecededByStore, res.emits);
+    EXPECT_EQ(res.storesToOutput, res.emits);
+}
+
+TEST(RetainGeometryOutputs, AnEmitInsideAHelperGetsTheCopyToo) {
+    const Vector<Uint32> spirv = CompileGeometry(kEmitInHelper);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    ExpectValidAndCompilable(out);
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    const EmitSites sites = Inspect(context.get(), VariableNamed(context.get(), "res"));
+    EXPECT_EQ(sites.emits, 1u);
+    EXPECT_EQ(sites.emitsPrecededByStore, 1u);
+    EXPECT_EQ(sites.storesToOutput, 1u);
+}
+
+TEST(RetainGeometryOutputs, AnOutputReadBackAfterAnEmitIsCarried) {
+    const Vector<Uint32> spirv = CompileGeometry(kReadBackAfterEmit);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    ExpectValidAndCompilable(out);
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    const EmitSites sites = Inspect(context.get(), VariableNamed(context.get(), "res"));
+    EXPECT_EQ(sites.storesToOutput, sites.emits);
+    EXPECT_EQ(sites.loadsFromOutput, 0u) << "the read-back must see the shadow, not the emitted output";
+}
+
+TEST(RetainGeometryOutputs, APartiallyWrittenOutputIsCarriedWhole) {
+    const Vector<Uint32> spirv = CompileGeometry(kPartialWrites);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    ExpectValidAndCompilable(out);
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    const EmitSites sites = Inspect(context.get(), VariableNamed(context.get(), "c"));
+    EXPECT_EQ(sites.emitsPrecededByStore, sites.emits);
+    EXPECT_EQ(sites.storesToOutput, sites.emits);
+    EXPECT_NE(VariableNamed(context.get(), "mg_retained_c"), 0u);
+}
+
+TEST(RetainGeometryOutputs, StreamEmitsGetTheCopyToo) {
+    const Vector<Uint32> spirv = CompileGeometry(kStreams);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> out = Retain(spirv);
+    ASSERT_NE(out, spirv);
+    String messages;
+    EXPECT_TRUE(Validates(out, messages)) << messages;
+
+    auto context = Parse(out);
+    ASSERT_NE(context, nullptr);
+    for (const char* name : {"a", "b"}) {
+        const EmitSites sites = Inspect(context.get(), VariableNamed(context.get(), name));
+        EXPECT_EQ(sites.emits, 2u) << name;
+        EXPECT_EQ(sites.emitsPrecededByStore, 2u) << name;
+        EXPECT_EQ(sites.storesToOutput, 2u) << name;
+    }
+}
+
+TEST(RetainGeometryOutputs, TheDeferredEmitReplayCarriesTheRetainedValue) {
+    const Vector<Uint32> spirv = CompileGeometry(kFlatBeforeLoopWithMemoryWrite);
+    ASSERT_FALSE(spirv.empty());
+    const Vector<Uint32> retained = Retain(spirv);
+    ASSERT_NE(retained, spirv);
+    Vector<uint32_t> deferredSpirv;
+    bool deferred = false;
+    ASSERT_TRUE(ShaderCompiler::DeferGeometryEmitsForEssl(retained, deferredSpirv, deferred, true));
+    ASSERT_TRUE(deferred);
+    ExpectValidAndCompilable(deferredSpirv);
+
+    // The snapshot taken at each recorded emit reads `res` after the copy, so the replay restores it.
+    auto context = Parse(deferredSpirv);
+    ASSERT_NE(context, nullptr);
+    const EmitSites sites = Inspect(context.get(), VariableNamed(context.get(), "res"));
+    EXPECT_EQ(sites.emits, 1u);
+    EXPECT_EQ(sites.emitsPrecededByStore, 1u);
+    EXPECT_GE(sites.loadsFromOutput, 1u);
+}
+
+TEST(RetainGeometryOutputs, TheSanitizeChainBothBackendsConsumeRunsIt) {
+    const Vector<Uint32> spirv = CompileGeometry(kFlatBeforeLoop);
+    ASSERT_FALSE(spirv.empty());
+    Vector<uint32_t> sanitized;
+    ASSERT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(spirv, sanitized, true, true));
+    ExpectValidAndCompilable(sanitized);
+
+    auto context = Parse(sanitized);
+    ASSERT_NE(context, nullptr);
+    ASSERT_NE(VariableNamed(context.get(), "mg_retained_res"), 0u);
+    const EmitSites sites = Inspect(context.get(), VariableNamed(context.get(), "res"));
+    EXPECT_EQ(sites.emitsPrecededByStore, sites.emits);
+    EXPECT_EQ(sites.storesToOutput, sites.emits);
+}

MobileGL/MG_Test/ShaderTranspiler/StripCompatPerVertexMembersTest.cpp

@@ -0,0 +1,369 @@
+// MobileGL - MobileGL/MG_Test/ShaderTranspiler/StripCompatPerVertexMembersTest.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// A compatibility-profile stage that only uses core features must reach the backends as the
+// same Vulkan-valid SPIR-V as its core twin. glslang declares the legacy gl_PerVertex members
+// (gl_FrontColor, gl_TexCoord, ...) without a BuiltIn, which leaves a module that writes only
+// gl_Position invalid for Vulkan until the sanitize chain removes them.
+
+#include <gtest/gtest.h>
+
+#include <string>
+#include <vector>
+
+#include "Includes.h"
+#include "Init.h"
+#include <MG_Util/ShaderTranspiler/CompileEnv.h>
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_Util/ShaderTranspiler/ShaderSourceProcessor.h>
+#include <MG_Util/ShaderTranspiler/SpvcSession.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+#include <MG_Util/ShaderTranspiler/SpirvPasses/StripCompatPerVertexMembersPass.h>
+
+#include <spirv-tools/libspirv.hpp>
+#include <spirv-tools/optimizer.hpp>
+
+using namespace MobileGL;
+using MobileGL::MG_Util::ShaderTranspiler::SessionUsageBit;
+using MobileGL::MG_Util::ShaderTranspiler::ShaderCompiler;
+using MobileGL::MG_Util::ShaderTranspiler::SpvcSession;
+using MobileGL::MG_Util::ShaderTranspiler::StripCompatPerVertexMembersPass;
+
+namespace {
+    ShaderStage StageOf(GLenum type) {
+        switch (type) {
+        case GL_VERTEX_SHADER:
+            return ShaderStage::Vertex;
+        case GL_TESS_CONTROL_SHADER:
+            return ShaderStage::TessControl;
+        case GL_TESS_EVALUATION_SHADER:
+            return ShaderStage::TessEval;
+        case GL_GEOMETRY_SHADER:
+            return ShaderStage::Geometry;
+        default:
+            return ShaderStage::Fragment;
+        }
+    }
+
+    // Preprocesses, compiles and links a whole program the way the link task does, and returns
+    // one module per stage: straight out of GlslangToSpv, or after the shared sanitize chain.
+    Vector<Vector<Uint32>> CompileProgram(const Vector<Pair<GLenum, String>>& stages, Bool sanitize = true) {
+        using namespace MG_Util::ShaderTranspiler;
+        const CompileEnv env{};
+        Vector<String> sources;
+        sources.reserve(stages.size());
+        Vector<SharedPtr<glslang::TShader>> shaders;
+        Vector<GLenum> types;
+        for (const auto& [type, text] : stages) {
+            String& source = sources.emplace_back(text);
+            PreprocessShaderSource(StageOf(type), source, env);
+            ShaderAttrib attrib{.shaderType = type, .sourceStr = source};
+            auto shader = ShaderCompiler::CompileShader(attrib);
+            EXPECT_TRUE(shader) << (shader ? String{} : shader.error().log);
+            if (!shader) return {};
+            shaders.push_back(shader.value());
+            types.push_back(type);
+        }
+        ProgramAttrib programAttrib{.shaders = shaders};
+        auto program = ShaderCompiler::LinkProgram(programAttrib);
+        EXPECT_TRUE(program) << (program ? String{} : program.error().log);
+        if (!program) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = types, .program = *program.value()};
+        auto binary = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        EXPECT_TRUE(binary) << (binary ? String{} : binary.error().log);
+        if (!binary) return {};
+        Vector<Vector<Uint32>> modules = Move(binary.value());
+        if (sanitize) {
+            for (auto& module : modules) {
+                EXPECT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(module, module, true, true));
+            }
+        }
+        return modules;
+    }
+
+    String Disassemble(const Vector<Uint32>& spirv) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        String text;
+        EXPECT_TRUE(tools.Disassemble(spirv, &text));
+        return text;
+    }
+
+    String ValidationError(const Vector<Uint32>& spirv) {
+        spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+        String error;
+        tools.SetMessageConsumer([&](spv_message_level_t, const char*, const spv_position_t&, const char* message) {
+            error += message != nullptr ? message : "";
+        });
+        return tools.Validate(spirv) ? String{} : (error.empty() ? String{"invalid"} : error);
+    }
+
+    String Transpile(const Vector<Uint32>& spirv) {
+        SpvcSession session(spirv, SessionUsageBit::Transpile);
+        auto essl = ShaderCompiler::DecompileShader(session);
+        EXPECT_TRUE(essl) << (essl ? String{} : essl.error().log);
+        return essl ? essl.value() : String{};
+    }
+
+    // Runs the pass alone, as the sanitize chain would, on a hand-assembled module.
+    Vector<Uint32> RunPass(const Vector<Uint32>& input) {
+        spvtools::Optimizer optimizer(SPV_ENV_VULKAN_1_1);
+        optimizer.RegisterPass(StripCompatPerVertexMembersPass::CreateStripCompatPerVertexMembersPass());
+        spvtools::OptimizerOptions options;
+        options.set_run_validator(false);
+        Vector<Uint32> output;
+        EXPECT_TRUE(optimizer.Run(input.data(), input.size(), &output, options));
+        return output;
+    }
+
+    // Every compatibility source is compiled as `#version 460 compatibility`
+    // (GetNormalizedVersionDirective), so its core twin is the 460 core source.
+    String Compat(const char* body, const char* version = "410") {
+        return String("#version ") + version + " compatibility\n" + body;
+    }
+
+    String Core(const char* body) {
+        return String("#version 460 core\n") + body;
+    }
+
+    // Disassembly with ids renumbered in order of appearance, so two modules that differ only in
+    // the ids glslang happened to allocate compare equal.
+    String Canonical(const Vector<Uint32>& spirv) {
+        spvtools::Optimizer optimizer(SPV_ENV_VULKAN_1_1);
+        optimizer.RegisterPass(spvtools::CreateCompactIdsPass());
+        Vector<Uint32> compacted;
+        EXPECT_TRUE(optimizer.Run(spirv.data(), spirv.size(), &compacted));
+        return Disassemble(compacted);
+    }
+
+    // Compiles both programs and expects every compatibility module to validate and to equal the
+    // core twin's.
+    void ExpectSameAsCoreTwin(const Vector<Pair<GLenum, String>>& compatStages,
+                              const Vector<Pair<GLenum, String>>& coreStages) {
+        const auto compat = CompileProgram(compatStages);
+        const auto core = CompileProgram(coreStages);
+        ASSERT_EQ(compat.size(), compatStages.size());
+        ASSERT_EQ(core.size(), coreStages.size());
+        for (SizeT i = 0; i < compat.size(); ++i) {
+            EXPECT_EQ(ValidationError(compat[i]), "") << Disassemble(compat[i]);
+            EXPECT_EQ(Canonical(compat[i]), Canonical(core[i])) << "stage " << i;
+        }
+    }
+
+    const char* kVertexBody = R"(in vec2 pos;
+out vec4 c;
+void main() {
+    c = vec4(0.25, 0.5, 0.75, 1.0);
+    gl_Position = vec4(pos, 0.0, 1.0);
+}
+)";
+
+    const char* kFragmentBody = R"(in vec4 c;
+out vec4 o;
+void main() { o = c; }
+)";
+
+    // Writes the core members after the legacy ones, so their indices have to move.
+    const char* kClipCullVertexBody = R"(in vec2 pos;
+void main() {
+    gl_Position = vec4(pos, 0.0, 1.0);
+    gl_PointSize = 2.0;
+    gl_ClipDistance[0] = pos.x;
+    gl_CullDistance[0] = pos.y;
+}
+)";
+
+    const char* kGeometryBody = R"(layout(triangles) in;
+layout(triangle_strip, max_vertices = 3) out;
+in vec4 c[];
+out vec4 gc;
+void main() {
+    for (int i = 0; i < 3; ++i) {
+        gc = c[i];
+        gl_Position = gl_in[i].gl_Position;
+        EmitVertex();
+    }
+    EndPrimitive();
+}
+)";
+
+    const char* kGeometryFragmentBody = R"(in vec4 gc;
+out vec4 o;
+void main() { o = gc; }
+)";
+
+    const char* kTessControlBody = R"(layout(vertices = 3) out;
+void main() {
+    gl_out[gl_InvocationID].gl_Position = gl_in[gl_InvocationID].gl_Position;
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+}
+)";
+
+    const char* kTessEvalBody = R"(layout(triangles) in;
+void main() {
+    gl_Position = gl_TessCoord.x * gl_in[0].gl_Position + gl_TessCoord.y * gl_in[1].gl_Position +
+                  gl_TessCoord.z * gl_in[2].gl_Position;
+}
+)";
+
+    const char* kPositionOnlyVertexBody = R"(in vec2 pos;
+void main() { gl_Position = vec4(pos, 0.0, 1.0); }
+)";
+
+    const char* kWhiteFragmentBody = R"(out vec4 o;
+void main() { o = vec4(1.0); }
+)";
+
+    // A compatibility-only built-in in use: there is no core shape to give this stage.
+    const char* kFrontColorVertexBody = R"(in vec2 pos;
+void main() {
+    gl_FrontColor = vec4(1.0);
+    gl_Position = vec4(pos, 0.0, 1.0);
+}
+)";
+
+    // Reads a legacy member only into dead code, which the sanitize chain removes first.
+    const char* kDeadLegacyReadGeometryBody = R"(layout(points) in;
+layout(points, max_vertices = 1) out;
+void main() {
+    vec4 unused = gl_in[0].gl_FrontColor;
+    gl_Position = gl_in[0].gl_Position;
+    EmitVertex();
+}
+)";
+
+    // A mixed built-in block reached through a whole-block load, which the pass cannot follow.
+    const char* kWholeBlockLoadAsm = R"(
+               OpCapability Geometry
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Geometry %main "main" %gl_in %out_block
+               OpExecutionMode %main InputPoints
+               OpExecutionMode %main Invocations 1
+               OpExecutionMode %main OutputPoints
+               OpExecutionMode %main OutputVertices 1
+               OpMemberDecorate %gl_PerVertex 0 BuiltIn Position
+               OpDecorate %gl_PerVertex Block
+       %void = OpTypeVoid
+      %fn_ty = OpTypeFunction %void
+      %float = OpTypeFloat 32
+    %v4float = OpTypeVector %float 4
+%gl_PerVertex = OpTypeStruct %v4float %v4float
+       %uint = OpTypeInt 32 0
+     %uint_1 = OpConstant %uint 1
+        %arr = OpTypeArray %gl_PerVertex %uint_1
+ %ptr_in_arr = OpTypePointer Input %arr
+      %gl_in = OpVariable %ptr_in_arr Input
+  %ptr_out_s = OpTypePointer Output %gl_PerVertex
+  %out_block = OpVariable %ptr_out_s Output
+   %ptr_in_s = OpTypePointer Input %gl_PerVertex
+        %int = OpTypeInt 32 1
+      %int_0 = OpConstant %int 0
+       %main = OpFunction %void None %fn_ty
+      %entry = OpLabel
+          %p = OpAccessChain %ptr_in_s %gl_in %int_0
+          %v = OpLoad %gl_PerVertex %p
+               OpStore %out_block %v
+               OpEmitVertex
+               OpReturn
+               OpFunctionEnd
+)";
+
+    // The OpTypeStruct line and the member decorations of every per-vertex block, in order.
+    String PerVertexShape(const String& disassembly) {
+        String shape;
+        SizeT lineStart = 0;
+        while (lineStart < disassembly.size()) {
+            SizeT lineEnd = disassembly.find('\n', lineStart);
+            if (lineEnd == String::npos) lineEnd = disassembly.size();
+            const String line = disassembly.substr(lineStart, lineEnd - lineStart);
+            if (line.find("%gl_PerVertex") != String::npos &&
+                (line.find("OpTypeStruct") != String::npos || line.find("OpMemberDecorate") != String::npos)) {
+                shape += line + "\n";
+            }
+            lineStart = lineEnd + 1;
+        }
+        return shape;
+    }
+} // namespace
+
+class StripCompatPerVertexMembersTest : public ::testing::Test {
+protected:
+    void SetUp() override { MobileGL::Initialize(); }
+};
+
+TEST_F(StripCompatPerVertexMembersTest, VertexStageMatchesItsCoreTwin) {
+    const auto raw =
+        CompileProgram({{GL_VERTEX_SHADER, Compat(kVertexBody)}, {GL_FRAGMENT_SHADER, Compat(kFragmentBody)}}, false);
+    ASSERT_EQ(raw.size(), 2u);
+    // The defect, pinned: glslang's own module mixes legacy and built-in members.
+    EXPECT_NE(ValidationError(raw[0]).find("BuiltIn"), String::npos) << Disassemble(raw[0]);
+
+    for (const char* version : {"410", "150"}) {
+        SCOPED_TRACE(version);
+        ExpectSameAsCoreTwin(
+            {{GL_VERTEX_SHADER, Compat(kVertexBody, version)}, {GL_FRAGMENT_SHADER, Compat(kFragmentBody, version)}},
+            {{GL_VERTEX_SHADER, Core(kVertexBody)}, {GL_FRAGMENT_SHADER, Core(kFragmentBody)}});
+    }
+}
+
+TEST_F(StripCompatPerVertexMembersTest, CoreMembersAfterTheLegacyOnesAreRenumbered) {
+    ExpectSameAsCoreTwin(
+        {{GL_VERTEX_SHADER, Compat(kClipCullVertexBody)}, {GL_FRAGMENT_SHADER, Compat(kWhiteFragmentBody)}},
+        {{GL_VERTEX_SHADER, Core(kClipCullVertexBody)}, {GL_FRAGMENT_SHADER, Core(kWhiteFragmentBody)}});
+}
+
+TEST_F(StripCompatPerVertexMembersTest, GeometryStageInputAndOutputBlocks) {
+    ExpectSameAsCoreTwin({{GL_VERTEX_SHADER, Compat(kVertexBody)},
+                          {GL_GEOMETRY_SHADER, Compat(kGeometryBody)},
+                          {GL_FRAGMENT_SHADER, Compat(kGeometryFragmentBody)}},
+                         {{GL_VERTEX_SHADER, Core(kVertexBody)},
+                          {GL_GEOMETRY_SHADER, Core(kGeometryBody)},
+                          {GL_FRAGMENT_SHADER, Core(kGeometryFragmentBody)}});
+}
+
+TEST_F(StripCompatPerVertexMembersTest, TessellationStagesInputAndOutputBlocks) {
+    ExpectSameAsCoreTwin({{GL_VERTEX_SHADER, Compat(kPositionOnlyVertexBody)},
+                          {GL_TESS_CONTROL_SHADER, Compat(kTessControlBody)},
+                          {GL_TESS_EVALUATION_SHADER, Compat(kTessEvalBody)},
+                          {GL_FRAGMENT_SHADER, Compat(kWhiteFragmentBody)}},
+                         {{GL_VERTEX_SHADER, Core(kPositionOnlyVertexBody)},
+                          {GL_TESS_CONTROL_SHADER, Core(kTessControlBody)},
+                          {GL_TESS_EVALUATION_SHADER, Core(kTessEvalBody)},
+                          {GL_FRAGMENT_SHADER, Core(kWhiteFragmentBody)}});
+}
+
+TEST_F(StripCompatPerVertexMembersTest, ALegacyReadThatDiesInTheChainDoesNotPinTheBlock) {
+    const auto compat = CompileProgram({{GL_VERTEX_SHADER, Compat(kPositionOnlyVertexBody)},
+                                        {GL_GEOMETRY_SHADER, Compat(kDeadLegacyReadGeometryBody)},
+                                        {GL_FRAGMENT_SHADER, Compat(kWhiteFragmentBody)}});
+    ASSERT_EQ(compat.size(), 3u);
+    EXPECT_EQ(ValidationError(compat[1]), "") << Disassemble(compat[1]);
+}
+
+TEST_F(StripCompatPerVertexMembersTest, AnAccessedLegacyMemberKeepsTheBlock) {
+    const auto raw = CompileProgram(
+        {{GL_VERTEX_SHADER, Compat(kFrontColorVertexBody)}, {GL_FRAGMENT_SHADER, Compat(kWhiteFragmentBody)}}, false);
+    const auto compat = CompileProgram(
+        {{GL_VERTEX_SHADER, Compat(kFrontColorVertexBody)}, {GL_FRAGMENT_SHADER, Compat(kWhiteFragmentBody)}});
+    ASSERT_EQ(raw.size(), 2u);
+    ASSERT_EQ(compat.size(), 2u);
+    const String shape = PerVertexShape(Disassemble(compat[0]));
+    EXPECT_EQ(shape, PerVertexShape(Disassemble(raw[0])));
+    EXPECT_NE(shape.find("OpTypeStruct %v4float %float %_arr_float_uint_1 %v4float %v4float"), String::npos) << shape;
+    // The ES hop still takes the module as it did before.
+    EXPECT_NE(Transpile(compat[0]).find("gl_Position"), String::npos);
+}
+
+TEST_F(StripCompatPerVertexMembersTest, AWholeBlockLoadLeavesTheModuleUntouched) {
+    spvtools::SpirvTools tools(SPV_ENV_VULKAN_1_1);
+    Vector<Uint32> module;
+    ASSERT_TRUE(tools.Assemble(kWholeBlockLoadAsm, &module));
+    EXPECT_EQ(RunPass(module), module);
+}

MobileGL/MG_Test/ShaderTranspiler/TranslationCacheTest.cpp

@@ -1095,6 +1095,11 @@ TEST_F(TranslationCacheTest, L2KeyMovesWithEveryGateThatSteersTheEsslChain) {
         v.stripOutputBlockLocations = true;
         variants.emplace_back("stripOutputBlockLocations", BuildEsslTranslationKey(v));
     }
+    { // arms the narrow-integer seeds of a vertex stage (ExtendNarrowIntegerVertexInputsForEssl)
+        EsslTranslationKeyInputs v = base;
+        v.narrowIntegerSeedsArmed = true;
+        variants.emplace_back("narrowIntegerSeedsArmed", BuildEsslTranslationKey(v));
+    }
     {
         EsslTranslationKeyInputs v = base;
         v.enableSpirvValidation = true;

MobileGL/MG_Test/Util/PipeStatsTest.cpp

@@ -306,6 +306,9 @@ namespace {
         EXPECT_NE(line.find(" wlivepk="), String::npos) << line;
         EXPECT_NE(line.find(" wdefpk="), String::npos) << line;
         EXPECT_NE(line.find(" wdefsync="), String::npos) << line;
+        // The server's control-record counts, which CtWireScenario reads by these names.
+        EXPECT_NE(line.find(" ar="), String::npos) << line;
+        EXPECT_NE(line.find(" od="), String::npos) << line;
     }
 
     // Per-frame fields carry two decimals for the same reason acc/draw does: they are small
@@ -544,6 +547,8 @@ namespace {
         // MEASUREMENTS.md entry will quote.
         EXPECT_STREQ(PS::NameOf(PS::ByteClass::StageSegmentBytes), "stage-segment-bytes");
         EXPECT_STREQ(PS::NameOf(PS::CallClass::WireRecords), "wire-records");
+        EXPECT_STREQ(PS::NameOf(PS::CallClass::ApplierResets), "applier-resets");
+        EXPECT_STREQ(PS::NameOf(PS::CallClass::ObjectDeaths), "object-deaths");
         EXPECT_STREQ(PS::NameOf(PS::Gate::EsprytRenderState), "espryt-render-state");
         EXPECT_STREQ(PS::NameOf(PS::Gate::EsprytTextureSyncList), "espryt-texture-sync-list");
         EXPECT_STREQ(PS::NameOf(PS::Gate::EsprytUnitBindingsEpoch), "espryt-unit-bindings-epoch");