[Merge] (DirectGLES, GLState, ShaderTranspiler): land GL43 wave5 with its two new passes inside the L2 boundary

fixed Asio include bug and added the ignored dir item .gradle

.github/workflows/apk.yml

@@ -209,7 +209,7 @@ jobs:
       - name: Load trace cases
         id: trace-cases
         run: |
-          echo "android=$(python3 tools/trace_replay/trace_cases.py --ci --format github-apk)" >> "$GITHUB_OUTPUT"
+          echo "android=$(python3 tools/trace_replay/trace_cases.py --ci --format github-apk-matrix)" >> "$GITHUB_OUTPUT"
           echo "names=$(python3 tools/trace_replay/trace_cases.py --ci --format names)" >> "$GITHUB_OUTPUT"
 
   trace-fixtures:
@@ -337,13 +337,7 @@ jobs:
     strategy:
       fail-fast: false
       max-parallel: 4
-      matrix:
-        backend:
-          - name: DirectGLES
-            gpu: software
-          - name: DirectVulkan
-            gpu: lavapipe
-        case: ${{ fromJSON(needs.trace-cases.outputs.android) }}
+      matrix: ${{ fromJSON(needs.trace-cases.outputs.android) }}
     steps:
       - name: Set Swap Space
         uses: pierotofy/set-swap-space@v1.0
@@ -426,6 +420,9 @@ jobs:
           MOBILEGL_USE_ANGLE: ${{ matrix.backend.name == 'DirectGLES' && '1' || '0' }}
           MOBILEGL_TRACE_ANGLE_VARIANT: ${{ matrix.case.name == 'minecraft-1.21.4-fabric-iris-bliss-in-world' && '90a62123d794' || 'ec889e6ea831' }}
           MOBILEGL_MAGMA_R11G11B10F_FALLBACK: ${{ matrix.backend.name == 'DirectVulkan' && '1' || '0' }}
+          MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_DERIVE_NUM_SUBGROUPS: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_ITERATIONRP_FIX_BARRIER: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
         run: |
           apk_file="android-retrace-apks/MobileGL-plugin-trace-release-${GITHUB_SHA}.apk"
           test -f "${apk_file}"

.github/workflows/test.yml

@@ -265,6 +265,9 @@ jobs:
         # crash stack without burning a CI round on an in-workflow debugger.
         env:
           MOBILEGL_ITEST_REQUIRE_GPU: "1"
+          MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: "1"
+          MOBILEGL_DERIVE_NUM_SUBGROUPS: "1"
+          MOBILEGL_ITERATIONRP_FIX_BARRIER: "1"
         run: |
           ulimit -c unlimited
           sudo sysctl -w kernel.core_pattern='/tmp/core.%e.%p'
@@ -491,6 +494,7 @@ jobs:
       - benchmark
       - integration
     outputs:
+      matrix: ${{ steps.trace-cases.outputs.matrix }}
       names: ${{ steps.trace-cases.outputs.names }}
     steps:
       - name: Checkout repo
@@ -498,7 +502,9 @@ jobs:
 
       - name: Load trace cases
         id: trace-cases
-        run: echo "names=$(python3 tools/trace_replay/trace_cases.py --ci --format names)" >> "$GITHUB_OUTPUT"
+        run: |
+          echo "matrix=$(python3 tools/trace_replay/trace_cases.py --ci --format github-test-matrix)" >> "$GITHUB_OUTPUT"
+          echo "names=$(python3 tools/trace_replay/trace_cases.py --ci --format names)" >> "$GITHUB_OUTPUT"
 
   trace-fixtures:
     name: trace fixture (${{ matrix.case }})
@@ -577,11 +583,7 @@ jobs:
     strategy:
       fail-fast: false
       max-parallel: 4
-      matrix:
-        backend:
-          - DirectGLES
-          - DirectVulkan
-        case: ${{ fromJSON(needs.trace-cases.outputs.names) }}
+      matrix: ${{ fromJSON(needs.trace-cases.outputs.matrix) }}
 
     steps:
       - name: Set Swap Space
@@ -640,6 +642,12 @@ jobs:
           if [ '${{ matrix.backend }}' = 'DirectVulkan' ]; then
             export MOBILEGL_MAGMA_R11G11B10F_FALLBACK=1
           fi
+          if [ '${{ matrix.backend }}' = 'DirectVulkan' ] \
+             && [ '${{ matrix.case }}' = 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' ]; then
+            export MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1
+            export MOBILEGL_DERIVE_NUM_SUBGROUPS=1
+            export MOBILEGL_ITERATIONRP_FIX_BARRIER=1
+          fi
           # The blended depth-write quirk auto-enables only on Qualcomm, which no CI
           # runner has, so force it on for the OIT case it exists to fix. ForceOn
           # bypasses only the vendor gate, so this exercises the real strip on

.gitignore

@@ -27,3 +27,4 @@ MobileGL/MG*/cmake-build*
 tools/trace_replay/work/
 __pycache__/
 *.py[cod]
+/.gradle

CMakeLists.txt

@@ -182,6 +182,7 @@ set(ENABLE_SPVREMAPPER         OFF CACHE BOOL "Enable SPVRemapper" FORCE)
 set(ENABLE_OPT                 ON  CACHE BOOL "Enable SPIRV-Tools opt usage in glslang" FORCE)
 set(BUILD_EXTERNAL             ON  CACHE BOOL "Build external deps in External/" FORCE)
 set(ENABLE_GLSLANG_INSTALL     OFF CACHE BOOL "Install glslang targets" FORCE)
+set(SPIRV_SKIP_EXECUTABLES     ON  CACHE BOOL "Skip building SPIRV-Tools executables" FORCE)
 
 set(SPIRV_CROSS_C_API          ON  CACHE BOOL "Enable C API" FORCE)
 set(SPIRV_CROSS_ENABLE_GLSL    ON  CACHE BOOL "Enable GLSL backend" FORCE)
@@ -269,6 +270,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/ShaderCompiler.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpvcSession.cpp
     MobileGL/MG_Util/ShaderTranspiler/ShaderSourceProcessor.cpp
+    MobileGL/MG_Util/ShaderTranspiler/TranslationCache.cpp
     MobileGL/MG_Util/ShaderTranspiler/glslang/TMglGlslIoResolver.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenInterfaceStructPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/EliminateFloatEqualsZeroPass.cpp
@@ -278,25 +280,35 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DecoratePositionInvariantPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DemoteFloat64Pass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LowerDrawParametersPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LowerViewportIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/PackDoubleVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenXfbInterfaceBlocksPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/UniquifyIoBlockNamesPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/SplitArrayVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RebaseInstanceIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ZeroBaseVertexPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DeriveNumSubgroupsPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FixIterationRPBarrierPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FixIterationRPSubgroupScratchPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/EmulateSubgroupsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/NormalizeRectCoordinatesPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/BakeImageFormatsPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ClampMultisampleFetchPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/PrivateToEntryLocalPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripUniformLocationsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripUboMemberRelaxedPrecisionPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripNoPerspectivePass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/EmulateNoPerspectivePass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeFragmentOutputIndexPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeStorageBlockArrayIndexPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenAtomicCounterBlockPass.cpp
 
     MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.cpp
     MobileGL/MG_Util/BackendLoaders/Vulkan/Loader.cpp
 
     MobileGL/MG_Util/SelfTest/DriverPost.cpp
+    MobileGL/MG_Util/SelfTest/DriverPostIterationRPWitness.cpp
 
     MobileGL/MG_Util/Texture/PixelStoreProcessor.cpp
     MobileGL/MG_Util/Texture/TextureFormatProcessor.cpp
@@ -380,6 +392,7 @@ set(SOURCE_FILES
     MobileGL/MG_State/GLState/TextureState/TextureState.cpp
     MobileGL/MG_State/GLState/ProgramState/ProgramObject.cpp
     MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.cpp
+    MobileGL/MG_State/GLState/ProgramState/ProgramTranslationCache.cpp
     MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.cpp
     MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.cpp
     MobileGL/MG_State/GLState/ProgramState/ShaderObject.cpp
@@ -457,7 +470,7 @@ set(MOBILEGL_INCLUDE_DIR
         # Header-only submodule: no add_subdirectory, no link target. Only
         # MG_Util/Async/ShaderCompilePool.cpp includes it, and it stays behind that file's
         # pimpl so no consumer target needs this path.
-        ${CMAKE_SOURCE_DIR}/3rdparty/asio/asio/include
+        ${CMAKE_SOURCE_DIR}/3rdparty/asio/include
 )
 
 add_library(${CMAKE_PROJECT_NAME} SHARED
@@ -669,3 +682,10 @@ if (NOT ANDROID)
         add_subdirectory(tools/trace_replay)
     endif()
 endif()
+
+# The integration binary is also useful as a standalone adb-shell executable.
+# Android cannot use the desktop-only MobileGL_s target, so its CMake module
+# links libMobileGL.so and creates an AImageReader-backed window instead.
+if (ANDROID AND MOBILEGL_BUILD_INTEGRATION_TEST)
+    add_subdirectory(MobileGL/MG_IntegrationTest)
+endif()

MobileGL/Config.h

@@ -66,22 +66,53 @@ namespace MobileGL::MG_Config {
     //   - DISPLAY: X11 session variable, not MobileGL configuration.
     //   - MOBILEGL_LOG_FILE_PATH: log-file init runs before MG_ConfigLoader::Init
     //     (see MG_Util/Debug/Log.cpp).
-    //   - MOBILEGL_VALIDATE_SPIRV: test suites like SpirvPassTest exercise
-    //     ShaderCompiler without ever running MobileGL::Initialize(), and every
-    //     Initialize() re-runs MG_ConfigLoader::Init, which would clobber a
-    //     programmatic override stored here (see ShaderCompiler.cpp,
-    //     SpirvValidationEnabled).
     struct FeaturesTable {
         // MOBILEGL_DISABLE_TIMERQUERY: do not advertise or use GPU timer queries.
         Bool DisableTimerQuery = false;
+        // MOBILEGL_ENABLE_SPIRV_VALIDATION: validate generated and transformed SPIR-V.
+        // Disabled by default because validation is a diagnostics-only cost.
+        Bool EnableSpirvValidation = false;
         // MOBILEGL_USE_ANGLE: load ANGLE EGL/GLES libraries.
         Bool UseAngle = false;
 #if defined(MOBILEGL_TRACE_ANGLE_VARIANTS)
         // MOBILEGL_TRACE_ANGLE_VARIANT: signed trace-APK ANGLE build short hash.
         String TraceAngleVariant;
 #endif
-        // MOBILEGL_DISABLE_SUBGROUP: force-disable Vulkan shader subgroup support.
+        // MOBILEGL_DISABLE_SUBGROUP: force-disable Vulkan shader subgroup support,
+        // including the opt-in emulated compute path below.
         Bool DisableSubgroup = false;
+        // MOBILEGL_MAGMA_EMULATE_SUBGROUP: implement GL_KHR_shader_subgroup's compute
+        // stage on a 32-lane VIRTUAL subgroup lowered to workgroup-shared memory
+        // (ShaderTranspiler::EmulateSubgroupsPass). Strictly a last resort: it only ever
+        // engages when this flag is set AND the device has no native subgroup support at
+        // all - a device with real subgroup operations always uses them natively,
+        // whatever their width (the known iterationRP defect is patched by
+        // FixIterationRPSubgroupScratch below instead). Off by default.
+        Bool MagmaEmulateSubgroup = false;
+        // MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: patch iterationRP's own bug - the
+        // pack declares `shared vec2 prefixSumCache[32]` for a 512-invocation exposure
+        // reduction and indexes it by gl_SubgroupID, so any device with sub-16-lane
+        // subgroups (8-lane lavapipe -> 64 subgroups) writes shared memory out of
+        // bounds. The pass grows that one array to what the device's topology needs and
+        // touches nothing else; it only rewrites modules positively matching the pack's
+        // reduction fingerprint (ShaderTranspiler::FixIterationRPSubgroupScratchPass),
+        // so every other shader passes through byte-identical - as does iterationRP
+        // itself on >= 16-lane devices. Auto is ON; ForceOff replays the pack's bug
+        // verbatim.
+        QuirkOverride FixIterationRPSubgroupScratch = QuirkOverride::Auto;
+        // MOBILEGL_ITERATIONRP_FIX_BARRIER: repair Program 203's missing workgroup
+        // rendezvous between its two reductions over prefixSumCache. Off by default and
+        // fingerprint-gated by FixIterationRPBarrierPass when enabled.
+        Bool IterationRPFixBarrier = false;
+        // MOBILEGL_DERIVE_NUM_SUBGROUPS: replace compute gl_NumSubgroups loads with
+        // ceil(workgroup invocations / gl_SubgroupSize) on the NATIVE subgroup path
+        // (ShaderTranspiler::DeriveNumSubgroupsPass). Auto is ON: GL requires
+        // gl_SubgroupID < gl_NumSubgroups, Adreno's builtin reports 1 while the same
+        // dispatch emits IDs 0..7, and the derived value is the one Vulkan guarantees
+        // whenever the pipeline can request REQUIRE_FULL_SUBGROUPS (which the renderer
+        // does whenever local_size_x is a multiple of the native width). ForceOff returns
+        // to the raw driver builtin.
+        QuirkOverride DeriveNumSubgroups = QuirkOverride::Auto;
         // MOBILEGL_ADVERTISE_FP64: add GL_ARB_gpu_shader_fp64 to the advertised extension
         // string. `double` in a shader always WORKS - it is narrowed to 32 bits before any
         // module reaches a backend (ShaderTranspiler::DemoteFloat64Pass) - but the extension
@@ -130,10 +161,6 @@ namespace MobileGL::MG_Config {
         // explicitly request a core profile via EGL_CONTEXT_OPENGL_PROFILE_MASK / a >=3.1
         // version request.
         Bool RelaxedSemantics = false;
-        // MOBILEGL_QUIRK_SUBGROUP_PREFIX_SCAN: overrides the shader-source quirk that
-        // rewrites the recognized workgroup prefix-scan template on Qualcomm devices with
-        // subgroups wider than 32 lanes (see ShaderSourceProcessor's quirk registry).
-        QuirkOverride SubgroupPrefixScanQuirk = QuirkOverride::Auto;
         // MOBILEGL_MAGMA_DISABLE_BLENDED_DEPTH_WRITE: overrides the DirectVulkan quirk that
         // strips depth writes from accumulation-blended pipelines (MIN/MAX or additive
         // ONE+ONE - the multi-pass depth-equality signature) on drivers without
@@ -176,6 +203,15 @@ namespace MobileGL::MG_Config {
         // immediately stay serial by their own construction). Off by default; never
         // advertise it.
         QuirkOverride AsyncOptimisticShaderStatus = QuirkOverride::Auto;
+        // MOBILEGL_SHADER_CACHE: the three-level, in-memory shader translation memo
+        // (MG_Util/ShaderTranspiler/TranslationCache.h). The levels follow the GL
+        // entry points - L1c memoizes one glCompileShader's PARSE VERDICT, L1 a
+        // linked program's whole front end, L2 DirectGLES's emitted ESSL. Auto is
+        // ON; ForceOff turns ALL THREE off and makes every translation run from
+        // scratch. The escape hatch exists because a wrong cache hit is a silently
+        // miscompiled shader: if a device ever renders differently with the cache
+        // on, one run with this falsy says so.
+        QuirkOverride ShaderTranslationCache = QuirkOverride::Auto;
     };
     extern FeaturesTable Features;
 } // namespace MobileGL::MG_Config

MobileGL/ConfigLoader.cpp

@@ -162,11 +162,17 @@ namespace MobileGL::MG_ConfigLoader {
     inline void InitFeatures() {
         auto& features = MG_Config::Features;
         features.DisableTimerQuery = QueryEnvFlag("MOBILEGL_DISABLE_TIMERQUERY");
+        features.EnableSpirvValidation = QueryEnvFlag("MOBILEGL_ENABLE_SPIRV_VALIDATION");
         features.UseAngle = QueryEnvFlag("MOBILEGL_USE_ANGLE");
 #if defined(MOBILEGL_TRACE_ANGLE_VARIANTS)
         QueryEnvVariable("MOBILEGL_TRACE_ANGLE_VARIANT", features.TraceAngleVariant, "");
 #endif
         features.DisableSubgroup = QueryEnvFlag("MOBILEGL_DISABLE_SUBGROUP");
+        features.MagmaEmulateSubgroup = QueryEnvFlag("MOBILEGL_MAGMA_EMULATE_SUBGROUP");
+        features.FixIterationRPSubgroupScratch =
+            QueryEnvQuirkOverride("MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH");
+        features.IterationRPFixBarrier = QueryEnvFlag("MOBILEGL_ITERATIONRP_FIX_BARRIER");
+        features.DeriveNumSubgroups = QueryEnvQuirkOverride("MOBILEGL_DERIVE_NUM_SUBGROUPS");
         features.AdvertiseFp64 = QueryEnvFlag("MOBILEGL_ADVERTISE_FP64");
         features.MagmaR11G11B10FFallback = QueryEnvFlag("MOBILEGL_MAGMA_R11G11B10F_FALLBACK");
         features.MagmaFramesInFlight = QueryEnvUint32("MOBILEGL_MAGMA_FRAMESINFLIGHT", 3, 1, 64);
@@ -179,7 +185,6 @@ namespace MobileGL::MG_ConfigLoader {
         features.EsprytForceDepthStencilReadbackEmulation =
             QueryEnvFlag("MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION");
         features.RelaxedSemantics = QueryEnvFlag("MOBILEGL_RELAXED_SEMANTICS");
-        features.SubgroupPrefixScanQuirk = QueryEnvQuirkOverride("MOBILEGL_QUIRK_SUBGROUP_PREFIX_SCAN");
         features.MagmaDisableBlendedDepthWriteQuirk =
             QueryEnvQuirkOverride("MOBILEGL_MAGMA_DISABLE_BLENDED_DEPTH_WRITE");
         features.DisableRobustBufferAccess = QueryEnvFlag("MOBILEGL_DISABLE_ROBUST_BUFFER_ACCESS");
@@ -189,6 +194,7 @@ namespace MobileGL::MG_ConfigLoader {
         features.AsyncShaderCompileThreads = QueryEnvUint32("MOBILEGL_ASYNC_SHADER_COMPILE_THREADS", 0, 0, 64);
         features.AsyncOptimisticShaderStatus =
             QueryEnvQuirkOverride("MOBILEGL_ASYNC_OPTIMISTIC_SHADER_STATUS");
+        features.ShaderTranslationCache = QueryEnvQuirkOverride("MOBILEGL_SHADER_CACHE");
     }
 
     inline void InitBackendType() {

MobileGL/Init.cpp

@@ -15,8 +15,11 @@
 #include <MG_Impl/GLImpl/Texture/ProxyTexture.h>
 #include <MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h>
 #include <MG_Impl/GLImpl/Sync/GL_Sync.h>
+#include <MG_Impl/GLImpl/Query/GL_Query.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
+#include <MG_State/GLState/ProgramState/ProgramTranslationCache.h>
+#include <MG_Util/ShaderTranspiler/TranslationCache.h>
 
 #include <atomic>
 #include <mutex>
@@ -51,6 +54,11 @@ namespace MobileGL {
             // before a re-initialized library could pair them with the wrong
             // backend's DeleteSync).
             MG_Impl::GLImpl::DestroyAllSyncObjects();
+            // Queries die with their contexts for the same reason, and their registry
+            // is the same shape of process-global map: drain it here too, while the
+            // function table can still pair each backend handle with the backend that
+            // minted it.
+            MG_Impl::GLImpl::DestroyAllQueryObjects();
             MG_Backend::pActiveBackendObject.reset();
             MG_State::pGLContext.reset();
             MG_State::pEGLContext.reset();
@@ -66,6 +74,14 @@ namespace MobileGL {
             // built-in symbol tables the prewarm latch stands for, so leaving it set would
             // make the next Initialize() skip a prewarm it genuinely needs.
             MG_Util::ShaderTranspiler::ShaderCompiler::ResetPrewarmLatch();
+            // The two-level translation memo. Nothing in it references a glslang object -
+            // both levels hold plain bytes - so this is RSS hygiene rather than a lifetime
+            // requirement, and it is safe either side of FinalizeProcess. Stats first: an
+            // fordebug build gets one line per level saying how the run went.
+            MG_Util::ShaderTranspiler::LogShaderTranslationCacheStats();
+            MG_Util::ShaderTranspiler::ClearShaderTranslationCaches();
+            MG_State::GLState::LogProgramTranslationCacheStats();
+            MG_State::GLState::ClearProgramTranslationCache();
             MG_Backend::gBackendFunctionsTable = {};
             g_isInitialized = false;
             if (logLifecycle) {

MobileGL/MG_Backend/BackendObject.h

@@ -14,6 +14,7 @@ namespace MobileGL {
     namespace MG_State::GLState {
         class FramebufferObject;
         class ITextureObject;
+        class RenderbufferObject;
     }
 
     enum class BackendType {
@@ -24,6 +25,19 @@ namespace MobileGL {
     };
 
     namespace MG_Backend {
+        // One endpoint of a glCopyImageSubData. GL 4.6 core 18.3.2 accepts GL_RENDERBUFFER
+        // alongside the ten whole-image texture targets, and a renderbuffer name lives in a
+        // namespace of its own - so an endpoint is a sum type, not an ITextureObject. At most
+        // one of the two pointers is set; neither is set when the name named nothing, which is
+        // the INVALID_VALUE the frontend validator reports.
+        struct CopyImageEndpoint {
+            SharedPtr<MG_State::GLState::ITextureObject> Texture;
+            SharedPtr<MG_State::GLState::RenderbufferObject> Renderbuffer;
+
+            Bool IsRenderbuffer() const { return Renderbuffer != nullptr; }
+            Bool Exists() const { return Texture != nullptr || Renderbuffer != nullptr; }
+        };
+
         enum class FormatCapability : Uint64 {
             Creatable = 1ull << 0,
 
@@ -160,9 +174,9 @@ namespace MobileGL {
                                    GLsizei height, GLint border);
             void (*CopyTexSubImage2D)(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y,
                                       GLsizei width, GLsizei height);
-            void (*CopyImageSubData)(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
+            void (*CopyImageSubData)(const CopyImageEndpoint& src,
                                      GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
-                                     const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
+                                     const CopyImageEndpoint& dst,
                                      GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                                      GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth);
             void (*GenerateMipmap)(GLenum target);
@@ -236,6 +250,14 @@ namespace MobileGL {
             // (optional; null = frontend falls back to CPU accounting).
             BackendQueryHandle (*BeginXfbPrimitivesQuery)(Bool generated);
             void (*EndXfbPrimitivesQuery)(BackendQueryHandle query);
+            // Whether GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN should be answered from the
+            // frontend's own accounting wherever that accounting is exact - a capture with no
+            // geometry stage - instead of from the query above. Set by DirectGLES, whose result
+            // is whatever the ES driver's PRIMITIVES_WRITTEN counter says: Adreno reports twice
+            // the written count for a vertex-only capture that follows a large render pass,
+            // where the desktop-exact answer is the one the frontend already computed. Defaults
+            // to false, so a backend that never sets it keeps using its GPU result.
+            Bool PrefersCpuXfbPrimitiveAccounting = false;
             // Transform feedback capture spans, for backends whose own GL/ES driver
             // performs the capture (DirectGLES). Both optional; null means the backend
             // drives capture from its draw recording instead (DirectVulkan). End is
@@ -318,6 +340,22 @@ namespace MobileGL {
             Int MaxVertexAttribs = 16;
             Int MaxComputeShaderStorageBlocks = 8;
             Int MaxCombinedShaderStorageBlocks = 32;
+            // Per-stage GL_MAX_*_SHADER_STORAGE_BLOCKS. Zero is a legal answer for the four
+            // non-compute, non-fragment stages and these defaults are the spec minimums, not
+            // placeholders: GL 4.6 table 23.64 and ES 3.2 table 21.44 both set the minimum for
+            // vertex, tessellation control, tessellation evaluation and geometry at 0, and only
+            // fragment (8 in GL, 4 in ES) and compute are guaranteed to have any. Every real ARM
+            // GLES driver takes that allowance - a Mali-G925 reports 0 for all four - so a
+            // backend that cannot honour a graphics-stage storage block MUST report 0 here
+            // rather than a hopeful number. Advertising a non-zero count the driver will refuse
+            // does not make the block work; it only moves the failure from an honest
+            // "unsupported" at query time to a backend link error the frontend never surfaces,
+            // after which every draw with that program silently renders nothing.
+            Int MaxVertexShaderStorageBlocks = 0;
+            Int MaxTessControlShaderStorageBlocks = 0;
+            Int MaxTessEvaluationShaderStorageBlocks = 0;
+            Int MaxGeometryShaderStorageBlocks = 0;
+            Int MaxFragmentShaderStorageBlocks = 8;
             Int MaxComputeUniformBlocks = 12;
             Int MaxComputeWorkGroupInvocations = 128;
             Int MaxShaderStorageBufferBindings = 8;
@@ -334,8 +372,32 @@ namespace MobileGL {
             Int MaxComputeImageUniforms = 8;
             Int MaxDrawBuffers = 8;
             Int MaxColorAttachments = 8;
+            // GL_MAX_CLIP_DISTANCES. Zero is a legal answer here, not a placeholder, and a
+            // backend that cannot host a clip distance MUST report it: advertising eight the
+            // backend will refuse does not make gl_ClipDistance work, it only moves the failure
+            // from an honest "unsupported" at query time to a backend shader-compile error the
+            // frontend never surfaces, after which every draw with that program silently renders
+            // nothing. DirectGLES fills it from GL_EXT_clip_cull_distance, DirectVulkan from the
+            // shaderClipDistance device feature. The DEFAULT stays at the GL 4.3 core minimum
+            // because it describes the no-backend case (standalone shader compiles, unit tests),
+            // where there is no device to be honest about and BuildTBuiltInResource still has to
+            // hand glslang a workable gl_MaxClipDistances.
             Int MaxClipDistances = 8;
             Int MaxViewports = 16;
+            // GL_LAYER_PROVOKING_VERTEX / GL_VIEWPORT_INDEX_PROVOKING_VERTEX: which vertex of a
+            // primitive supplies gl_Layer and gl_ViewportIndex. GL 4.6 table 23.65 makes
+            // GL_UNDEFINED_VERTEX a legal answer for both, and it is the honest default - naming
+            // a convention is a statement about behaviour, so a backend that does not pin one
+            // must not claim it does. DirectGLES fills the layer one from the ES 3.2 query and
+            // the viewport one from GL_OES_viewport_array, and leaves UNDEFINED where the
+            // capability is absent: without the viewport array extension only viewport 0 is ever
+            // rasterized, so no convention selects anything. DirectVulkan keeps UNDEFINED for
+            // both - which vertex provokes is decided per pipeline by
+            // VulkanRenderer::SelectProvokingVertexMode out of VK_EXT_provoking_vertex,
+            // provokingVertexModePerPipeline and the topology, so no single convention is true
+            // of the backend.
+            GLenum LayerProvokingVertex = GL_UNDEFINED_VERTEX;
+            GLenum ViewportIndexProvokingVertex = GL_UNDEFINED_VERTEX;
             Int MaxViewportWidth = 16384;
             Int MaxViewportHeight = 16384;
             Float ViewportBoundsRangeMin = 0.0f;

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -8,6 +8,7 @@
 
 #include "BackendObject_DirectGLES.h"
 #include "MG_Backend/BackendObject.h"
+#include "MG_Backend/BackendObjects.h"
 #include <MG_Backend/DirectGLES/DirectGLES.h>
 #include <MG_Backend/DirectGLES/Managers.h>
 #include <MG_Backend/DirectGLES/Utils.h>
@@ -212,7 +213,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
             if (options & PixelFormatNormalizeOptionBit::NoThreeChannelRenderTarget) {
                 reasons.push_back("no colour-renderable three-channel format on OpenGL ES");
             }
-            if (options & PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget) {
+            // A format is either 8- or 16-bit signed normalized, so at most one of the two ever
+            // survives GetApplicablePixelFormatNormalizeOptions and the reason is not duplicated.
+            if ((options & PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget) ||
+                (options & PixelFormatNormalizeOptionBit::NoSnorm8RenderTarget)) {
                 reasons.push_back("EXT_render_snorm not supported");
             }
 
@@ -406,9 +410,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return complete;
         }
 
+        // `samples` only reaches the multisample targets; every other target ignores it. The
+        // descending sample walk (ProbeTextureSampleCounts) reuses this whole routine rather than
+        // repeating the gen/bind/completeness/delete dance.
         Bool ProbeTexture(const MG_External::GLESFunctionsTable& gl, TextureTarget target, GLenum internalFormat,
                           GLenum imageFormat, GLenum imageType, TextureInternalFormat logicalFormat,
-                          Bool* outRenderable) {
+                          Bool* outRenderable, Int samples = 1) {
             if (!IsGLESProbeTextureTarget(target) || !gl.glGenTextures || !gl.glBindTexture || !gl.glDeleteTextures) {
                 return false;
             }
@@ -428,10 +435,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
             const Bool isMultisample = IsGLESProbeMultisampleTarget(target);
             if (isMultisample) {
+                const auto probeSamples = static_cast<GLsizei>(std::max(samples, 1));
                 if (target == TextureTarget::Texture2DMultisample && gl.glTexStorage2DMultisample) {
-                    gl.glTexStorage2DMultisample(glTarget, 1, internalFormat, 1, 1, GL_TRUE);
+                    gl.glTexStorage2DMultisample(glTarget, probeSamples, internalFormat, 1, 1, GL_TRUE);
                 } else if (target == TextureTarget::Texture2DMultisampleArray && gl.glTexStorage3DMultisample) {
-                    gl.glTexStorage3DMultisample(glTarget, 1, internalFormat, 1, 1, 1, GL_TRUE);
+                    gl.glTexStorage3DMultisample(glTarget, probeSamples, internalFormat, 1, 1, 1, GL_TRUE);
                 } else {
                     gl.glBindTexture(glTarget, static_cast<GLuint>(previousBinding));
                     gl.glDeleteTextures(1, &texture);
@@ -527,6 +535,29 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return sampleCounts;
         }
 
+        // The multisample TEXTURE twin of ProbeRenderbufferSampleCounts. It used to be a
+        // hardcoded {1}, which made glGetInternalformativ(GL_SAMPLES) claim a one-sample maximum
+        // for every format on the multisample targets even where glTexImage2DMultisample happily
+        // accepts four - GL 4.6 core 8.8 makes that query the definition of the maximum, so the
+        // two answers cannot both be right. Completeness is required at every count, exactly as
+        // the renderbuffer walk requires it; the caller only reaches here once the one-sample
+        // probe has already succeeded, so 1 terminates the list without being re-probed.
+        Vector<Int> ProbeTextureSampleCounts(const MG_External::GLESFunctionsTable& gl, TextureTarget target,
+                                             GLenum internalFormat, GLenum imageFormat, GLenum imageType,
+                                             TextureInternalFormat logicalFormat, Int maxSamples) {
+            Vector<Int> sampleCounts;
+            for (Int samples = std::max(maxSamples, 1); samples > 1; samples >>= 1) {
+                Bool renderable = false;
+                const Bool created = ProbeTexture(gl, target, internalFormat, imageFormat, imageType, logicalFormat,
+                                                  &renderable, samples);
+                if (created && renderable) {
+                    sampleCounts.push_back(samples);
+                }
+            }
+            sampleCounts.push_back(1);
+            return sampleCounts;
+        }
+
         void PopulateFormatCapabilitiesImpl(const MG_External::GLESFunctionsTable& gl,
                                             const MG_External::GLESCapabilities& capabilities,
                                             FormatCapabilityCache& cache) {
@@ -627,7 +658,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                             AddFullFormatCaps(cache, targetIndex, formatIndex,
                                               BuildTextureCapsFromProbe(logicalFormat, target, nativeRenderable));
                             if (IsGLESProbeMultisampleTarget(target)) {
-                                cache.SampleCounts[targetIndex][formatIndex] = {1};
+                                const Int maxSamples =
+                                    GetGLESFormatMaxSamples(capabilities, logicalFormat, nativeInfo.ImageFormat);
+                                cache.SampleCounts[targetIndex][formatIndex] = ProbeTextureSampleCounts(
+                                    gl, probeTarget, nativeInfo.InternalFormat, nativeInfo.ImageFormat,
+                                    nativeInfo.ImageType, logicalFormat, maxSamples);
                             }
                         }
                         shouldProbeFallback = !nativeCreated || !nativeRenderable;
@@ -645,7 +680,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                 LogGLESFormatCaveat(logicalFormat, targetIndex, fallbackInfo);
                             }
                             if (IsGLESProbeMultisampleTarget(target)) {
-                                cache.SampleCounts[targetIndex][formatIndex] = {1};
+                                const Int maxSamples =
+                                    GetGLESFormatMaxSamples(capabilities, logicalFormat, fallbackInfo.ImageFormat);
+                                cache.SampleCounts[targetIndex][formatIndex] = ProbeTextureSampleCounts(
+                                    gl, probeTarget, fallbackInfo.InternalFormat, fallbackInfo.ImageFormat,
+                                    fallbackInfo.ImageType, logicalFormat, maxSamples);
                             }
                         }
                     }
@@ -712,9 +751,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     {
                         .TargetGLVersion = {4, 0, 0},   // GL target version
                         .TargetGLSLVersion = {4, 6, 0}, // Target Shading Language Version
-                        // Baseline advertisement (no timer queries / anisotropy yet); reconciled
-                        // once the ES capabilities exist, see UpdateAdvertisedCapabilityExtensions.
-                        .Extensions = BuildAdvertisedExtensions(false, false),
+                        // Baseline advertisement (no runtime capabilities yet); reconciled once
+                        // the ES capabilities exist, see UpdateAdvertisedCapabilityExtensions.
+                        .Extensions = BuildAdvertisedExtensions(false, false, false, false),
                         .IsCompatibilityProfile = false // Is Compatibility Profile
                     },
                 .StaticBackendCapability = {.AllowVSOnlyPrograms = false} // Backend Capability
@@ -734,9 +773,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // thread can only observe the extension string after the
         // advertisement for its context has settled; rebuilding the whole
         // list keeps the re-run after a context recreation idempotent.
-        void UpdateAdvertisedCapabilityExtensions(Bool anisotropicFilteringSupported) {
-            MutableRendererInfo().RendererGLInfo.Extensions =
-                BuildAdvertisedExtensions(AreTimerQueriesSupported(), anisotropicFilteringSupported);
+        void UpdateAdvertisedCapabilityExtensions(const MG_External::GLESCapabilities& capabilities) {
+            MutableRendererInfo().RendererGLInfo.Extensions = BuildAdvertisedExtensions(
+                AreTimerQueriesSupported(), capabilities.SupportsTextureFilterAnisotropy,
+                capabilities.SupportsDrawIndirect,
+                capabilities.SupportsDrawIndirect && capabilities.SupportsBaseInstance);
         }
     } // namespace
 
@@ -745,6 +786,29 @@ namespace MobileGL::MG_Backend::DirectGLES {
         PopulateFormatCapabilitiesImpl(gl, capabilities, cache);
     }
 
+    Int ClampSamplesToBackendSupport(SizeT targetIndex, TextureInternalFormat logicalFormat, GLenum imageFormat,
+                                     Int samples) {
+        if (samples <= 1) {
+            return samples;
+        }
+
+        Int maxSamples = 0;
+        const SizeT formatIndex = static_cast<SizeT>(logicalFormat);
+        if (pActiveBackendObject && targetIndex < kFormatCapabilityTargetCount &&
+            formatIndex < kFormatCapabilityFormatCount) {
+            // Descending, so the head is the largest count this device actually allocated.
+            const Vector<Int>& probedCounts =
+                pActiveBackendObject->GetFormatCapabilities().SampleCounts[targetIndex][formatIndex];
+            if (!probedCounts.empty()) {
+                maxSamples = probedCounts.front();
+            }
+        }
+        if (maxSamples <= 0) {
+            maxSamples = GetGLESFormatMaxSamples(g_GLESCapabilities, logicalFormat, imageFormat);
+        }
+        return std::min(samples, std::max(maxSamples, 1));
+    }
+
     BackendObject_DirectGLES::~BackendObject_DirectGLES() {
         DestroyEGLContext();
     }
@@ -779,11 +843,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return false;
         }
         DirectGLES::SetGLESCapabilities(m_GLESCapabilities);
-        // Now that g_GLESCapabilities knows about GL_EXT_disjoint_timer_query and
-        // GL_EXT_texture_filter_anisotropic, reconcile the advertisement (see the comment on
-        // UpdateAdvertisedCapabilityExtensions for why it cannot happen when the extension
-        // list is first built).
-        UpdateAdvertisedCapabilityExtensions(m_GLESCapabilities.SupportsTextureFilterAnisotropy);
+        // Now that g_GLESCapabilities knows the host extensions, entry points, and ES version,
+        // reconcile every runtime-gated advertisement (see the comment on
+        // UpdateAdvertisedCapabilityExtensions for why this cannot happen when the list is first
+        // built).
+        UpdateAdvertisedCapabilityExtensions(m_GLESCapabilities);
         UpdateDynamicBackendParameters();
         PopulateFormatCapabilities(m_GLESFunctions, m_GLESCapabilities, MutableFormatCapabilities());
         PrintFormatCapabilities(GetFormatCapabilities());
@@ -924,11 +988,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
         return MutableRendererInfo();
     }
 
-    Vector<GLExtension> BuildAdvertisedExtensions(Bool timerQueriesSupported, Bool anisotropicFilteringSupported) {
+    Vector<GLExtension> BuildAdvertisedExtensions(Bool timerQueriesSupported, Bool anisotropicFilteringSupported,
+                                                  Bool drawIndirectSupported,
+                                                  Bool nonZeroIndirectBaseInstanceSupported) {
         Vector<GLExtension> extensions = {
             V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, E_GL_ARB_draw_buffers_blend,
             E_GL_ARB_compute_shader, E_GL_ARB_shader_storage_buffer_object, E_GL_ARB_shader_image_load_store,
-            E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_EXT_framebuffer_object,
+            E_GL_ARB_clear_buffer_object, E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_EXT_framebuffer_object,
             E_GL_ARB_depth_texture, E_GL_ARB_buffer_storage, E_GL_ARB_texture_storage,
             E_GL_ARB_texture_storage_multisample, E_GL_ARB_clear_texture, E_GL_ARB_direct_state_access,
             E_GL_ARB_multi_draw_indirect, E_GL_ARB_indirect_parameters, E_GL_ARB_shader_draw_parameters,
@@ -955,6 +1021,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // extension explicitly permits. It is also the only thing that
             // exposes glProgramParameteri before GL 4.1.
             E_GL_ARB_get_program_binary};
+        // Minecraft 26.3 checks this prerequisite before it even considers
+        // GL_ARB_multi_draw_indirect. ES 3.1 supplies both single-draw entry points; the loader
+        // folds the version and pointer checks into SupportsDrawIndirect.
+        if (drawIndirectSupported) {
+            extensions.push_back(E_GL_ARB_draw_indirect);
+        }
+        // ARB_base_instance also defines the last word of an indirect command. Direct calls are
+        // emulated on every Espryt device, but without host GL_EXT_base_instance a native indirect
+        // draw cannot shift divisor attributes by a GPU-authored non-zero value, so do not promise
+        // that incomplete case.
+        if (drawIndirectSupported && nonZeroIndirectBaseInstanceSupported) {
+            extensions.push_back(E_GL_ARB_base_instance);
+        }
         // GL_KHR_parallel_shader_compile is MobileGL's own capability, not the host ES
         // driver's: the compiler threads are MobileGL's, and glCompileShader/glLinkProgram
         // are serviced entirely inside the frontend. Whether the device driver advertises
@@ -1090,6 +1169,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // geometry shader's amplification.
             funcsTable.GL.BeginXfbPrimitivesQuery = BeginXfbPrimitivesQuery;
             funcsTable.GL.EndXfbPrimitivesQuery = EndXfbPrimitivesQuery;
+            // ...but where it CAN see the whole capture - no geometry stage - the frontend's
+            // own count is the desktop-exact one and the ES driver's is only as good as the
+            // vendor made it (Adreno doubles PRIMITIVES_WRITTEN for a vertex-only capture that
+            // follows a large render pass). The query above stays installed: it is still what
+            // answers an amplifying span, and PRIMITIVES_GENERATED always.
+            funcsTable.GL.PrefersCpuXfbPrimitiveAccounting = true;
             funcsTable.GL.IsQueryResultAvailable = IsQueryResultAvailable;
             funcsTable.GL.GetQueryResult64 = GetQueryResult64;
             funcsTable.GL.DeleteBackendQuery = DeleteBackendQuery;
@@ -1169,9 +1254,31 @@ namespace MobileGL::MG_Backend::DirectGLES {
                      static_cast<Int>(MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS));
         m_dynamicParameters.MaxComputeShaderStorageBlocks = m_GLESCapabilities.MaxComputeShaderStorageBlocks;
         m_dynamicParameters.MaxCombinedShaderStorageBlocks = m_GLESCapabilities.MaxCombinedShaderStorageBlocks;
+        // Per-stage storage-block counts, forwarded from the host driver rather than invented.
+        // A stage the driver cannot serve reports 0, which is a legal answer everywhere these
+        // limits appear (GL 4.6 table 23.64, ES 3.2 table 21.44 - the minimum is 0 for every
+        // graphics stage except fragment) and is the only answer that lets an application take
+        // its own fallback instead of building a program the driver will refuse to link. The
+        // stage limit cannot exceed the combined limit or the number of binding points there
+        // are to bind buffers to, so clamp to both.
+        const auto clampStageStorageBlocks = [this](Int stageLimit) {
+            return std::min({std::max(stageLimit, 0), std::max(m_dynamicParameters.MaxCombinedShaderStorageBlocks, 0),
+                             std::max(m_dynamicParameters.MaxShaderStorageBufferBindings, 0)});
+        };
+        m_dynamicParameters.MaxShaderStorageBufferBindings = m_GLESCapabilities.MaxShaderStorageBufferBindings;
+        m_dynamicParameters.MaxVertexShaderStorageBlocks =
+            clampStageStorageBlocks(m_GLESCapabilities.MaxVertexShaderStorageBlocks);
+        m_dynamicParameters.MaxTessControlShaderStorageBlocks =
+            clampStageStorageBlocks(m_GLESCapabilities.MaxTessControlShaderStorageBlocks);
+        m_dynamicParameters.MaxTessEvaluationShaderStorageBlocks =
+            clampStageStorageBlocks(m_GLESCapabilities.MaxTessEvaluationShaderStorageBlocks);
+        m_dynamicParameters.MaxGeometryShaderStorageBlocks =
+            clampStageStorageBlocks(m_GLESCapabilities.MaxGeometryShaderStorageBlocks);
+        m_dynamicParameters.MaxFragmentShaderStorageBlocks =
+            clampStageStorageBlocks(m_GLESCapabilities.MaxFragmentShaderStorageBlocks);
         m_dynamicParameters.MaxComputeUniformBlocks = m_GLESCapabilities.MaxComputeUniformBlocks;
         m_dynamicParameters.MaxComputeWorkGroupInvocations = m_GLESCapabilities.MaxComputeWorkGroupInvocations;
-        m_dynamicParameters.MaxShaderStorageBufferBindings = m_GLESCapabilities.MaxShaderStorageBufferBindings;
+        // (MaxShaderStorageBufferBindings is assigned above, before the per-stage clamp reads it.)
         // This is the number glGetIntegerv(GL_MAX_TEXTURE_BUFFER_SIZE) hands the application, and
         // on a host without buffer textures it is knowingly a floor MobileGL cannot honour rather
         // than a driver answer (m_GLESCapabilities.MaxTextureBufferSizeIsDriverReported says
@@ -1232,6 +1339,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
         m_dynamicParameters.MaxColorAttachments = m_GLESCapabilities.MaxColorAttachments;
         m_dynamicParameters.MaxClipDistances = m_GLESCapabilities.MaxClipDistances;
         m_dynamicParameters.MaxViewports = m_GLESCapabilities.MaxViewports;
+        // Whatever the driver said about which vertex supplies gl_Layer, and GL_UNDEFINED_VERTEX
+        // for gl_ViewportIndex on every driver without GL_OES_viewport_array - which is both test
+        // devices. That is not a shortfall being hidden: without the extension only viewport 0 is
+        // ever rasterized, so no vertex "selects" a viewport index and naming a convention would
+        // describe behaviour this backend does not implement.
+        m_dynamicParameters.LayerProvokingVertex = m_GLESCapabilities.LayerProvokingVertex;
+        m_dynamicParameters.ViewportIndexProvokingVertex = m_GLESCapabilities.ViewportIndexProvokingVertex;
         m_dynamicParameters.MaxViewportWidth = m_GLESCapabilities.MaxViewportWidth;
         m_dynamicParameters.MaxViewportHeight = m_GLESCapabilities.MaxViewportHeight;
         m_dynamicParameters.ViewportBoundsRangeMin = m_GLESCapabilities.ViewportBoundsRangeMin;

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.h

@@ -18,6 +18,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                     const MG_External::GLESCapabilities& capabilities,
                                     FormatCapabilityCache& cache);
 
+    // Clamps a requested sample count down to what the ES driver can really deliver for this
+    // format on this format-capability target: the probed per-format list when there is one, the
+    // driver's per-class GL_MAX_*_SAMPLES otherwise. The frontend deliberately validates against
+    // the count MobileGL advertises instead (GL_Getter's GetAdvertisedMaxSamples), which on a
+    // driver reporting GL_MAX_INTEGER_SAMPLES 1 is higher than the driver accepts, so every ES
+    // allocation call has to come through here. The shadow state keeps the requested count, so
+    // GL_TEXTURE_SAMPLES and framebuffer completeness still answer what the application asked for.
+    Int ClampSamplesToBackendSupport(SizeT targetIndex, TextureInternalFormat logicalFormat, GLenum imageFormat,
+                                     Int samples);
+
     class BackendObject_DirectGLES : public BackendObject {
     public:
         ~BackendObject_DirectGLES() override;
@@ -67,9 +77,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
     const RendererInfo& GetRendererIdentity();
 
     // The full OpenGL extension list Espryt advertises (glGetString(GL_EXTENSIONS))
-    // for a device whose timer queries / anisotropic filtering are (or are not) usable.
+    // for a device whose timer queries / anisotropic filtering / native indirect draws /
+    // non-zero indirect baseInstance semantics are (or are not) usable.
     // The MOBILEGL_DISABLE_TIMERQUERY escape hatch is applied inside.
-    Vector<GLExtension> BuildAdvertisedExtensions(Bool timerQueriesSupported, Bool anisotropicFilteringSupported);
+    Vector<GLExtension> BuildAdvertisedExtensions(Bool timerQueriesSupported, Bool anisotropicFilteringSupported,
+                                                  Bool drawIndirectSupported,
+                                                  Bool nonZeroIndirectBaseInstanceSupported);
 
     // Format: <OpenGL ES Renderer>, OpenGL ES <Major>.<Minor> — the exact string an
     // initialized backend returns from GetBackendAPIVersionString (and that ends up

MobileGL/MG_Backend/DirectGLES/DirectGLES.h

@@ -76,9 +76,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         GLsizei height, GLint border);
     void CopyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width,
                            GLsizei height);
-    void CopyImageSubData(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
+    void CopyImageSubData(const CopyImageEndpoint& src,
                           GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
-                          const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
+                          const CopyImageEndpoint& dst,
                           GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                           GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth);
     void GenerateMipmap(GLenum target);

MobileGL/MG_Backend/DirectGLES/Managers.h

@@ -21,6 +21,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
     String EmulateBaseInstanceInVertexShader(String source, GLenum shaderType);
     String PromoteDrawParameterGlobalsToUniforms(String source, GLenum shaderType);
 
+    // Whether a vertex shader may declare a storage block at all, given what the host driver
+    // reports for GL_MAX_VERTEX_SHADER_STORAGE_BLOCKS. Pure, and separated from the capability
+    // global purely so the decision can be tested without one.
+    //
+    // The indirect half of the gl_BaseInstance lowering in PromoteDrawParameterGlobalsToUniforms
+    // is the only thing that needs this, and it needs exactly one block. A driver reporting 0 is
+    // conformant - the minimum is 0 in GL 4.6 table 23.64 and ES 3.2 table 21.44 - and ARM's
+    // GLES driver does report 0, so this is a live path, not a defensive one.
+    Bool VertexStageStorageBlockUsable(Int maxVertexShaderStorageBlocks);
+
     // True once the process has entered exit(): past that point the EGL library and
     // the driver may already be unloaded, so a backend twin's destructor must not
     // call into g_GLESFuncs (the observed crash is a jump through an unmapped driver
@@ -129,7 +139,28 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // Twin creation is the moment a driver-owned id starts needing a guarded
             // destructor; cold path, so the once-guard costs nothing per draw.
             EnsureProcessTeardownSentinel();
+            // Sweep BEFORE the entry reference below exists: the map is open-addressed and an
+            // erase relocates the rest of the probe cluster, so collecting once that reference
+            // is taken would invalidate it. The sweep is therefore owed from an earlier call
+            // rather than triggered by this one.
+            if (m_creationTick >= kCreationGCInterval) {
+                m_creationTick = 0;
+                CollectGarbage();
+            }
+            const SizeT entryCountBeforeInsert = m_entries.size();
             auto& entry = m_entries[stateObj.get()];
+            if (m_entries.size() != entryCountBeforeInsert) {
+                // A key the registry has never held. Nothing tells the backend that a texture or
+                // renderbuffer was DELETED - the twin, and the driver storage it owns, lives
+                // until a collection - and CollectGarbageIfNeeded is ticked only from the
+                // per-draw sync paths, which a CTS-shaped workload runs about ten times per
+                // case. 1024 of those ticks then span ~100 cases, so ~100 cases' worth of dead
+                // (and, for this suite, gigabyte-sized) objects stay allocated at once. Object
+                // CHURN rather than draw count is what makes the sweep urgent, so a twin the
+                // registry has never seen ticks it too - and it does so on the path that is
+                // about to allocate, which is exactly when the memory is needed.
+                ++m_creationTick;
+            }
             if (entry.stateRef.expired()) {
                 // The previous owner of this address is gone and the allocator handed it
                 // to a new object: its twin describes ids the new state object never made.
@@ -203,8 +234,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
     private:
         static constexpr Uint32 kGCInterval = 1024;
+        // Creations are far rarer than draws, so this counts in a much smaller unit than
+        // kGCInterval does.
+        static constexpr Uint32 kCreationGCInterval = 64;
         BackendMap m_entries;
         Uint32 m_gcTick = 0;
+        Uint32 m_creationTick = 0;
         Bool m_isCollecting = false;
     };
 
@@ -346,6 +381,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // client-attribute staging buffers): scrub every buffer-binding shadow that
         // could false-skip when the name is recycled.
         void NoteBufferIdDeleted(Uint id);
+        // Bumped whenever a live GLESBufferResource's driver id is retired and re-minted
+        // while its frontend buffer stays alive (persistent-map adoption, immutable-store
+        // retire). The VAO twins' baked glVertexAttribPointer / element-array bindings
+        // key on FRONTEND versions, which a backend-side re-mint does not move - without
+        // this generation the driver VAO would keep fetching through the deleted id (or
+        // its retained store) forever. Compared and stamped by
+        // BackendVertexArrayObject::SyncToBackend.
+        extern Uint64 g_bufferBackendIdGeneration;
         // Redundant-bind cache for INDEXED buffer bindings (glBindBufferBase/Range on
         // GL_UNIFORM_BUFFER / GL_SHADER_STORAGE_BUFFER): skips the GL call when the
         // (id, range) already at that index matches, like the array-buffer/texture/
@@ -353,6 +396,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
         void BindBufferBaseCached(GLenum glTarget, Uint index, Uint id);
         void BindBufferRangeCached(GLenum glTarget, Uint index, Uint id, GLintptr offset, GLsizeiptr size);
         void InvalidateIndexedBufferBindingCache();
+        // Re-issues the GL_ATOMIC_COUNTER_BUFFER binding points a program's shaders declare as
+        // GL_SHADER_STORAGE_BUFFER bindings at the reserved slots the transpiled ESSL was built
+        // against (BackendProgramObjectImpl::GetAtomicCounterBindings /
+        // GetAtomicCounterEsslBindingTop). ES has no counter-buffer target at all, so without
+        // this the shader reads a storage block nobody ever bound a buffer to and the buffer the
+        // application bound never reaches the driver.
+        void SyncAtomicCounterBuffers(const Vector<Int>& glBindings, Int esslBindingTop);
         // Buffer-storage pool maintenance. TrimBufferPool evicts over-budget entries
         // (called once per frame from Present); ClearBufferPool drops all pooled ids
         // without glDeleteBuffers (called when the ES context is going away).
@@ -459,12 +509,51 @@ namespace MobileGL::MG_Backend::DirectGLES {
             PendingAttribValueMask& GetPendingAttribValueMaskMemo() { return m_pendingAttribValueMask; }
 
         private:
+            // Narrows one enabled GL_DOUBLE array into a tightly packed float32 stream held in
+            // this VAO's own scratch buffer and declares the attribute against it. ES has no
+            // 64-bit vertex format, but the source bytes are ordinary IEEE-754 doubles and every
+            // fp64 value in every shader is already narrowed to 32 bits (DemoteFloat64Pass), so
+            // narrowing the ARRAY is the coherent completion of that decision rather than
+            // dropping it. Returns false when the stream cannot be built, in which case the
+            // caller must DISABLE the array - leaving a 64-bit array enabled with no pointer is
+            // what the Adreno driver turns into a SIGSEGV at the next draw.
+            Bool SyncFloat64AttributeAsFloat32(Uint attribIndex, const MG_State::GLState::VertexAttribute& attrib,
+                                               Uint32 fetchBaseInstance);
+
+            // What the converted float32 stream in m_convertedAttributeBufferIds[i] was built
+            // from. A hit skips the CPU conversion and the re-upload; the buffer's change serial
+            // is part of the key, so a glBufferSubData into the source invalidates it.
+            struct ConvertedFloat64Stream {
+                Bool valid = false;
+                Uint64 sourceLifetimeId = 0;
+                Uint64 sourceChangeSerial = 0;
+                SizeT sourceOffset = 0;
+                SizeT sourceStride = 0;
+                SizeT componentCount = 0;
+                SizeT elementCount = 0;
+            };
+
             ResolvedDrawBuffers m_resolvedDrawBuffers;
             PendingAttribValueMask m_pendingAttribValueMask;
             Uint m_backendVAOId = 0;
             Array<Uint, MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS> m_clientAttributeBufferIds;
+            // Scratch stores for the buffer-backed GL_DOUBLE narrowing. Deliberately separate
+            // from m_clientAttributeBufferIds: that one holds the per-draw upload of a
+            // CLIENT-MEMORY array, and an attribute index can carry both shapes over its life.
+            Array<Uint, MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS> m_convertedAttributeBufferIds;
+            Array<ConvertedFloat64Stream, MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS>
+                m_convertedAttributeStreams;
+            // True while at least one attribute of this VAO is fed by a converted stream. Such a
+            // stream is derived from buffer CONTENT, which no VAO version covers, so the config
+            // version early-out in SyncToBackend must not be trusted while it is set.
+            Bool m_hasConvertedFloat64Attribute = false;
             Bool m_isInitialized = false;
             Uint16 m_syncedIndexBufferVersion = 0;
+            // Identity of the buffer the version above was stamped against. Raw and never
+            // dereferenced: the slot version is a wrapping Uint16 (see the ResolvedDrawBuffers
+            // IBO memo and the packed_pixels postmortem at BindCurrentFBO), so the version
+            // alone would read a wrapped-back count with a different buffer bound as clean.
+            const MG_State::GLState::BufferObject* m_syncedIndexBufferObject = nullptr;
             // Aggregate gate over the per-attribute walk below: the frontend bumps its config
             // version on every per-attribute version bump (the three Bump*Version functions are
             // its only writers), so an unchanged config version proves every per-attribute
@@ -480,6 +569,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // Kept here because it describes what was last EMITTED, which is what the next sync
             // has to correct.
             Uint32 m_syncedFetchBaseInstance = 0;
+            // BufferImpl::g_bufferBackendIdGeneration as of this twin's last emit. A
+            // mismatch means some live buffer's driver id was re-minted since; the ids
+            // baked into the driver VAO's attribute/element bindings may be dead even
+            // though every frontend version matches, so the next sync re-emits them all.
+            Uint64 m_syncedBufferIdGeneration = 0;
         };
 
         extern StateBackendObjectRegistry<MG_State::GLState::VertexArrayObject, BackendVertexArrayObject>
@@ -799,6 +893,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
             using FramebufferObject = MG_State::GLState::FramebufferObject;
             FramebufferObject::FramebufferAttachmentVersionArray m_syncedFrontendAttachmentVersions = {0};
+            // g_attachmentBackendIdGeneration as of this twin's last attachment walk. A
+            // mismatch means some backend texture id was re-minted since, and any of this
+            // twin's attachment points may still hold the dead id even though the frontend
+            // attachment versions match - so the walk re-attaches everything first.
+            Uint64 m_syncedBackendIdGeneration = 0;
         };
 
         extern StateBackendObjectRegistry<MG_State::GLState::FramebufferObject, BackendFramebufferObject>
@@ -888,6 +987,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
         extern Array<MG_State::GLState::FramebufferObject*, SizeT(FramebufferTarget::FramebufferTargetCount)>
             g_fboSyncedObjects;
 
+        // Bumped whenever a live backend texture's driver id is re-minted while its
+        // frontend texture may still be attached to application FBOs
+        // (BackendTextureObject::RecreateBackendTexture - e.g. a respecify of a texture
+        // whose backend storage went immutable). The FBO twins' attachment memos key on
+        // FRONTEND attachment versions, which a backend-side re-mint does not move, so
+        // the driver FBO would keep the deleted texture name attached forever. The
+        // SyncCurrentFBO gate compares this generation (below) to re-enter the sync,
+        // and each twin re-arms its per-attachment memo on a mismatch (SyncToBackend).
+        extern Uint64 g_attachmentBackendIdGeneration;
+        // What g_attachmentBackendIdGeneration was when SyncCurrentFBO last stamped each
+        // target; part of the synced tuple above.
+        extern Array<Uint64, SizeT(FramebufferTarget::FramebufferTargetCount)> g_fboSyncedBackendIdGenerations;
+
         // Driver-level READ/DRAW framebuffer-binding shadow. Every backend
         // glBindFramebuffer routes through BindFramebufferId so scoped helpers can
         // save/restore the current binding without a glGetIntegerv round-trip (that
@@ -1015,6 +1127,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
     }
 
     namespace PrgramImpl {
+        // Defined further down, next to CollectImageFormatBakeInputs; only referenced here.
+        struct ImageFormatBakeInputs;
+
         class BackendProgramObjectImpl {
         public:
             // Per-link cache of a sampler-style uniform's backend location: built once in
@@ -1100,6 +1215,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // qualifier, so the overrides are baked into the source). A mismatch means the
             // program is stale exactly like the clamp masks above.
             Uint64 GetShaderStorageBlockBindingSignature() const { return m_shaderStorageBlockBindingSignature; }
+            // GL atomic-counter binding points the transpiled stages declare (sorted, unique),
+            // and the top of the reserved shader-storage range their counter blocks were
+            // transpiled against - the slot for GL binding N is `top - N`. Empty for every
+            // program that uses no atomic counter, which is what keeps the per-draw cost of the
+            // counter sync at one empty-vector test.
+            const Vector<Int>& GetAtomicCounterBindings() const { return m_atomicCounterGlBindings; }
+            Int GetAtomicCounterEsslBindingTop() const { return m_atomicCounterEsslBindingTop; }
 
             Bool HasGlobalUboBlock() const { return m_globalUboBackendBlockIndex >= 0; }
             const Vector<Int>& GetUniformBlockBackendIndices() const { return m_uniformBlockBackendIndices; }
@@ -1148,6 +1270,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
         private:
             void CacheResourceLocations(const SharedPtr<MG_State::GLState::ProgramObject>& stateProgramObject);
 
+            // One stage's SPIR-V through the DirectGLES pass chain and SPIRV-Cross, producing
+            // the raw emitted ESSL and the interface blocks this stage's XFB flattening
+            // rewrote. This is the segment the L2 shader-translation memo keys on, so every
+            // input it reads must appear in EsslTranslationKeyInputs - see the definition's
+            // header comment in Managers.cpp and MG_Util/ShaderTranspiler/TranslationCache.h.
+            // False means SPIRV-Cross refused the module; `outError` then carries its message.
+            Bool TranspileSpirvToEssl(const Vector<unsigned int>& spirvCode, GLenum glShaderType,
+                                      const std::set<String>& xfbCaptureBlockNames,
+                                      const ImageFormatBakeInputs& imageFormatBake,
+                                      const UnorderedMap<String, Int>& storageBlockBindingOverrides,
+                                      const std::map<String, String>& inputBlockRenames,
+                                      const std::map<String, String>& outputBlockRenames,
+                                      Int atomicCounterEsslBindingTop, Bool enableSpirvValidation,
+                                      String& outSource,
+                                      std::set<String>& outFlattenedXfbBlockNames,
+                                      Vector<Int>& outAtomicCounterGlBindings, String& outError) const;
+
             Uint m_backendProgramId = 0;
             // GL name of the frontend program this was last synced from; diagnostics only, so
             // an unusable backend program can be traced back to the glCreateProgram id the app
@@ -1166,6 +1305,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             Uint m_fragColorBroadcastCount = 1;
             // 0 is the signature of an empty override set, i.e. what almost every program has.
             Uint64 m_shaderStorageBlockBindingSignature = 0;
+            Vector<Int> m_atomicCounterGlBindings;
+            Int m_atomicCounterEsslBindingTop = -1;
             Bool m_isInitialized = false;
             Bool m_backendProgramUsable = false;
 

MobileGL/MG_Backend/DirectGLES/Utils.cpp

@@ -171,6 +171,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
             if (!capabilities.SupportsRenderSnorm || !capabilities.SupportsNorm16Texture) {
                 options |= PixelFormatNormalizeOptionBit::NoSnorm16RenderTarget;
             }
+            // 8-bit signed-normalized storage is core ES, so only the rendering half is in
+            // question here; the 16-bit bit above additionally needs EXT_texture_norm16 for the
+            // encoding to exist at all.
+            if (!capabilities.SupportsRenderSnorm) {
+                options |= PixelFormatNormalizeOptionBit::NoSnorm8RenderTarget;
+            }
             return options;
         }
 
@@ -569,6 +575,43 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return glslCode;
         }
 
+        String RequestViewportArrayExtension(String glslCode, Bool needed) {
+#ifdef TRACY_ENABLE
+            ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
+#endif
+            // gl_ViewportIndex is desktop GL 4.1 core and is in ESSL only under
+            // GL_OES_viewport_array. SPIRV-Cross prints the identifier as-is and requests no
+            // extension for it - three lines away from the BuiltInLayer case, which DOES ask for
+            // one on ES - so an untouched decompile reaches the driver naming a builtin its core
+            // language has never heard of. The stage then fails to compile, the program is marked
+            // unusable and every draw made with it renders nothing while raising no GL error.
+            //
+            // Same `needed` contract as RequestExtendedImageFormats, and the same hard rule:
+            // `#extension` on a name the driver does not advertise is itself a compile error
+            // (ARM's compiler is strict about it), so this must never be emitted speculatively.
+            // A driver without the extension does not come through here at all - its module took
+            // the LowerViewportIndexPass fallback and the emitted source no longer names the
+            // builtin.
+            static constexpr const char* kDirective = "#extension GL_OES_viewport_array : require\n";
+            static constexpr const char* kExtName = "GL_OES_viewport_array";
+            if (!needed || glslCode.find(kExtName) != String::npos) {
+                return glslCode;
+            }
+            // Right after the #version line, for the reason spelled out above: it is the only
+            // position that must stay first, and ForceSupporterOutput's scan for the LAST
+            // #extension directive still finds whichever one that ends up being.
+            const SizeT versionPos = glslCode.find("#version");
+            if (versionPos == String::npos) {
+                return kDirective + glslCode;
+            }
+            const SizeT lineEnd = glslCode.find('\n', versionPos);
+            if (lineEnd == String::npos) {
+                return glslCode + "\n" + kDirective;
+            }
+            glslCode.insert(lineEnd + 1, kDirective);
+            return glslCode;
+        }
+
         String BakeImageFormatQualifiers(String glslCode,
                                          const UnorderedMap<String, String>& esslFormatByUniformName) {
 #ifdef TRACY_ENABLE
@@ -785,9 +828,19 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // A rebuilt declaration. Keeps SPIRV-Cross's own word order (`uniform readonly
             // highp image2D`) so the image-rebinding regex in Managers.cpp still matches what
             // comes out of here, whichever order the two passes end up running in.
+            //
+            // `forceCoherent` is for the SPLIT pair only. GLSL guarantees that a write through
+            // one image variable is visible to a read through a DIFFERENT one only when both are
+            // declared coherent, and the split turns a same-variable read-after-write - which
+            // desktop GLSL orders by construction, so the source almost never says `coherent` -
+            // into exactly that cross-variable shape. Without it the driver may serve the load
+            // from a cache that never saw the store through the writeonly half.
             String BuildImageDeclaration(const ImageUniformDecl& decl, const char* memoryQualifier,
-                                         const String& variableName) {
+                                         const String& variableName, Bool forceCoherent = false) {
                 String out = "layout(" + decl.layout + ") uniform ";
+                if (forceCoherent && !ContainsIdentifier(decl.qualifiers, "coherent")) {
+                    out += "coherent ";
+                }
                 out += memoryQualifier;
                 out += ' ';
                 if (!decl.qualifiers.empty()) {
@@ -829,12 +882,35 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 SizeT length;
                 String text;
             };
+
+            // The offset just past the `;` that terminates the call whose argument list opens at
+            // `openParen`, or npos when what follows is not a plain statement. Parentheses alone
+            // are counted: every other bracket a GLSL argument list can contain is balanced
+            // inside them, and imageStore returns void, so a well-formed call site is always
+            // `imageStore(...);` and anything else is a shape this pass declines to edit.
+            SizeT FindEndOfCallStatement(const String& code, SizeT openParen) {
+                Int depth = 0;
+                SizeT scan = openParen;
+                for (; scan < code.size(); ++scan) {
+                    if (code[scan] == '(') {
+                        ++depth;
+                    } else if (code[scan] == ')' && --depth == 0) {
+                        break;
+                    }
+                }
+                if (scan >= code.size()) return String::npos;
+                const SizeT after = code.find_first_not_of(" \t\r\n", scan + 1);
+                if (after == String::npos || code[after] != ';') return String::npos;
+                return after + 1;
+            }
         } // namespace
 
-        String SplitReadWriteImageUniforms(const String& glslCode) {
+        String SplitReadWriteImageUniforms(const String& glslCode, Uint* outSplitCount) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+            // Written before any early return, so the caller never reads a stale count.
+            if (outSplitCount != nullptr) *outSplitCount = 0;
             if (glslCode.find("image") == String::npos) {
                 return glslCode;
             }
@@ -896,6 +972,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 SizeT declIndex;
                 SizeT start;
                 SizeT length;
+                SizeT callOpen; // the '(' of the call this argument belongs to
             };
             Vector<StoreSite> storeSites;
             for (SizeT pos = glslCode.find("image"); pos != String::npos; pos = glslCode.find("image", pos + 1)) {
@@ -945,7 +1022,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     break;
                 case ImageBuiltinAccess::Store:
                     decl.stored = true;
-                    storeSites.push_back({declIndex, argStart, argEnd - argStart});
+                    storeSites.push_back({declIndex, argStart, argEnd - argStart, openParen});
                     break;
                 case ImageBuiltinAccess::None:
                     break;
@@ -971,9 +1048,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     decl.writeName = MakeImageWriteAliasName(decl.name, glslCode, takenAliases);
                     takenAliases.push_back(decl.writeName);
                     decl.split = true;
+                    if (outSplitCount != nullptr) ++*outSplitCount;
+                    // Both halves carry `coherent`; see BuildImageDeclaration. The
+                    // single-declaration cases below stay as they were - nothing aliases them, so
+                    // there is no visibility to restore and no reason to pay for the cache
+                    // behaviour.
                     edits.push_back({decl.declStart, decl.declLength,
-                                     BuildImageDeclaration(decl, "readonly", decl.name) + "\n" +
-                                         BuildImageDeclaration(decl, "writeonly", decl.writeName)});
+                                     BuildImageDeclaration(decl, "readonly", decl.name, /*forceCoherent=*/true) +
+                                         "\n" +
+                                         BuildImageDeclaration(decl, "writeonly", decl.writeName,
+                                                               /*forceCoherent=*/true)});
                 } else if (decl.stored) {
                     edits.push_back({decl.declStart, decl.declLength,
                                      BuildImageDeclaration(decl, "writeonly", decl.name)});
@@ -988,6 +1072,24 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 const ImageUniformDecl& decl = decls[site.declIndex];
                 if (!decl.split) continue;
                 edits.push_back({site.start, site.length, decl.writeName});
+                // ...and an explicit barrier behind it. `coherent` on both halves is what makes
+                // the store VISIBLE to a load through the other variable, but it says nothing
+                // about ORDER within one invocation - and the whole reason a declaration is split
+                // is that the shader both stores and loads through it, which on the ES side is now
+                // a write to one variable followed by a read of another the compiler has no reason
+                // to believe alias. Adreno duly serves the load from before the store
+                // (KHR-GL4x.shader_image_load_store.advanced-memory-order's store/load/compare
+                // loop reads back the previous iteration's value). memoryBarrierImage() is the
+                // GLSL primitive for exactly that ordering, is core GLSL ES 3.10 in every stage,
+                // and is not an execution barrier, so it is legal in non-uniform control flow too.
+                //
+                // Confined to the split pair: a single-declaration repair has nothing aliasing it
+                // and must not pay for this, and a shader that never got split never sees it at
+                // all.
+                const SizeT statementEnd = FindEndOfCallStatement(glslCode, site.callOpen);
+                if (statementEnd != String::npos) {
+                    edits.push_back({statementEnd, 0, " memoryBarrierImage();"});
+                }
             }
             if (edits.empty()) {
                 return glslCode;

MobileGL/MG_Backend/DirectGLES/Utils.h

@@ -154,6 +154,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // extension - requesting an unadvertised extension is itself a compile error, so this is
         // never emitted speculatively. A no-op when not needed or already present.
         String RequestExtendedImageFormats(String glslCode, Bool needed);
+        // Adds `#extension GL_OES_viewport_array : require` when the emitted ESSL names
+        // gl_ViewportIndex. SPIRV-Cross prints that identifier and asks for nothing (unlike
+        // gl_Layer, which it backs with GL_NV_viewport_array2 on ES) and ESSL has no core
+        // spelling for it at any version, so the request has to be made here or the stage does
+        // not compile - which loses the whole program, not just the multi-viewport routing.
+        // `needed` is the caller's answer for the same reason as above: only it knows whether the
+        // driver advertises the extension, and requesting an unadvertised one is itself a compile
+        // error, so this is never emitted speculatively. A no-op when not needed or already
+        // present.
+        String RequestViewportArrayExtension(String glslCode, Bool needed);
         // Writes a format layout qualifier into the image declarations named in
         // `esslFormatByUniformName` that still have none. The completion half of the image-format
         // bake, and ONLY that: the SPIR-V pass (BakeImageFormatsPass) is what normally puts the
@@ -186,11 +196,28 @@ namespace MobileGL::MG_Backend::DirectGLES {
         //  * loaded only            -> add `readonly`
         //  * stored only            -> add `writeonly`
         //  * both                   -> emit TWO declarations on the same binding and of the
-        //                              same type, `readonly <name>` and `writeonly
-        //                              <IMAGE_WRITE_ALIAS_PREFIX><name>`, and point every
-        //                              imageStore at the second one. Several image variables
-        //                              may share an image unit as long as they have the same
-        //                              type and format, which is exactly what the pair is.
+        //                              same type, `coherent readonly <name>` and `coherent
+        //                              writeonly <IMAGE_WRITE_ALIAS_PREFIX><name>`, point
+        //                              every imageStore at the second one, and follow each of
+        //                              those stores with `memoryBarrierImage();`. Several image
+        //                              variables may share an image unit as long as they have
+        //                              the same type and format, which is exactly what the pair
+        //                              is.
+        //
+        // The `coherent` on both halves of the pair is load-bearing, not decoration: GLSL only
+        // guarantees a write through one image variable is visible to a read through a DIFFERENT
+        // one when both are coherent, and the split is what makes a same-variable
+        // read-after-write cross-variable. The single-declaration repairs above do not get it -
+        // nothing aliases them.
+        //
+        // The barrier is the other half of the same problem, and coherent alone did not cover it:
+        // visibility is not ORDER. Within one invocation the ES compiler sees a write to one
+        // variable and a read of another it has no reason to believe alias, and is free to serve
+        // the read from before the write - which is what advanced-memory-order's store/load/
+        // compare loop measured on Adreno. memoryBarrierImage() orders exactly those two, is core
+        // GLSL ES 3.10 in every stage, and is not an execution barrier, so it is legal in
+        // non-uniform control flow. It costs something in a shader that stores to a read+write
+        // image in a loop, which is why it is confined to the split pair.
         //
         // Budget note: the split DOUBLES the image-uniform count of the stage it fires in, so
         // a driver advertising a tight GL_MAX_{FRAGMENT,VERTEX,...}_IMAGE_UNIFORMS can turn a
@@ -201,7 +228,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // Runs on the transpiled ESSL, so it must see the bindings the frontend units were
         // already rewritten to and must run before those bindings are stripped - see the call
         // site in Managers.cpp.
-        String SplitReadWriteImageUniforms(const String& glslCode);
+        //
+        // `outSplitCount`, when given, receives the number of declarations that were actually
+        // doubled - i.e. exactly how many image uniforms this stage gained over what the
+        // application declared. Zero for every shader but a handful, and the only number the
+        // budget note above can be reported with.
+        String SplitReadWriteImageUniforms(const String& glslCode, Uint* outSplitCount = nullptr);
         // Prefix of the per-sampler float uniform that carries GL_TEXTURE_LOD_BIAS into
         // the shader (see EmulateTextureLodBias); the suffix is the sampler's own name.
         constexpr const char* LOD_BIAS_UNIFORM_PREFIX = "mg_lodBias_";

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

@@ -9,7 +9,9 @@
 #include "BackendObject_DirectVulkan.h"
 #include "MG_Backend/BackendObject.h"
 #include "DirectVulkan.h"
+#include "SubgroupSupportPolicy.h"
 #include "MG_State/GLState/FramebufferState/FramebufferObject.h"
+#include "MG_State/GLState/Core.h"
 #include "MG_State/GLState/TextureState/TextureState.h"
 #include "MG_Util/Classifiers/TextureEnumClassifier.h"
 #include "MG_Util/Converters/MGToGL/TextureEnumConverter.h"
@@ -383,6 +385,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
         UpdateDynamicBackendParameters();
         UpdateAdvertisedExtensions();
+        if (MG_State::pGLContext) {
+            MG_State::pGLContext->InvalidateCompileEnv();
+        }
         PopulateFormatCapabilities(physicalDevice.handle, vkGetPhysicalDeviceFormatProperties, m_vulkanCaps,
                                    MutableFormatCapabilities());
         PrintFormatCapabilities(GetFormatCapabilities());
@@ -497,20 +502,22 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             .ExtraVendor = Nullopt,
             .RendererGLInfo = {.TargetGLVersion = {4, 0, 0},
                                .TargetGLSLVersion = {4, 6, 0},
-                               // Baseline advertisement (no shader subgroup, no timer queries); a
-                               // live backend reconciles its copy in UpdateAdvertisedExtensions.
-                               .Extensions = BuildAdvertisedExtensions(false, false, false),
+                               // Baseline advertisement (no runtime-gated capabilities); a live
+                               // backend reconciles its copy in UpdateAdvertisedExtensions.
+                               .Extensions = BuildAdvertisedExtensions(false, false, false, false),
                                .IsCompatibilityProfile = false},
             .StaticBackendCapability = {.AllowVSOnlyPrograms = false}};
         return rendererInfo;
     }
 
     Vector<GLExtension> BuildAdvertisedExtensions(Bool shaderSubgroupSupported, Bool timerQueriesSupported,
-                                                  Bool anisotropicFilteringSupported) {
+                                                  Bool anisotropicFilteringSupported,
+                                                  Bool nonZeroIndirectBaseInstanceSupported) {
         Vector<GLExtension> extensions = {
             V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, E_GL_ARB_draw_buffers_blend,
             E_GL_ARB_compute_shader, E_GL_ARB_shader_storage_buffer_object, E_GL_ARB_shader_image_load_store,
-            E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_ARB_multi_draw_indirect,
+            E_GL_ARB_clear_buffer_object, E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_ARB_draw_indirect,
+            E_GL_ARB_multi_draw_indirect,
             E_GL_ARB_indirect_parameters, E_GL_EXT_framebuffer_object, E_GL_ARB_depth_texture, E_GL_ARB_buffer_storage,
             E_GL_ARB_texture_storage, E_GL_ARB_texture_storage_multisample, E_GL_ARB_texture_multisample,
             E_GL_ARB_clear_texture, E_GL_ARB_direct_state_access, E_GL_ARB_shader_draw_parameters,
@@ -530,6 +537,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // extension explicitly permits. It is also the only thing that
             // exposes glProgramParameteri before GL 4.1.
             E_GL_ARB_get_program_binary};
+        // Vulkan's drawIndirectFirstInstance feature is optional. Direct base-instance calls work
+        // without it, but ARB_base_instance also promises non-zero firstInstance in GPU indirect
+        // commands; the renderer supplies true only when that word is legal and gl_InstanceID can
+        // be rebased to OpenGL's zero-based semantics.
+        if (nonZeroIndirectBaseInstanceSupported) {
+            extensions.push_back(E_GL_ARB_base_instance);
+        }
         if (shaderSubgroupSupported && !MG_Config::Features.DisableSubgroup) {
             extensions.push_back(E_GL_KHR_shader_subgroup);
         }
@@ -678,6 +692,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_vulkanCaps = capabilities;
         UpdateDynamicBackendParameters();
         UpdateAdvertisedExtensions();
+        if (MG_State::pGLContext) {
+            MG_State::pGLContext->InvalidateCompileEnv();
+        }
         MutableFormatCapabilities().Clear();
     }
 
@@ -688,9 +705,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // real device timestamp support. ApplyVulkanCapabilitiesForTesting may
         // run without a renderer; no timer query is advertised then. Rebuilding
         // the whole list keeps re-runs idempotent.
+        // The opt-in emulated compute path (SubgroupSupportPolicy.h) carries the
+        // extension by itself on devices with no native subgroup support at all; a
+        // device with native subgroups always advertises - and uses - those.
+        const Bool subgroupSupportAdvertised =
+            m_vulkanCaps.SupportsShaderSubgroup ||
+            ShouldEmulateSubgroups(m_vulkanCaps.SupportsShaderSubgroup);
         m_rendererInfo.RendererGLInfo.Extensions = BuildAdvertisedExtensions(
-            m_vulkanCaps.SupportsShaderSubgroup, pVulkanRenderer && pVulkanRenderer->IsTimerQuerySupported(),
-            pVulkanRenderer && pVulkanRenderer->IsSamplerAnisotropySupported());
+            subgroupSupportAdvertised, pVulkanRenderer && pVulkanRenderer->IsTimerQuerySupported(),
+            pVulkanRenderer && pVulkanRenderer->IsSamplerAnisotropySupported(),
+            pVulkanRenderer && pVulkanRenderer->IsNonZeroIndirectBaseInstanceSupported());
     }
 
     void BackendObject_DirectVulkan::UpdateDynamicBackendParameters() {
@@ -823,6 +847,38 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_dynamicParameters.MaxShaderStorageBufferBindings =
             clampLimit("GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS", m_vulkanCaps.MaxShaderStorageBufferBindings,
                        kMaxAdvertisedBufferBlocks);
+        // Per-stage GL_MAX_*_SHADER_STORAGE_BLOCKS. Vulkan has one descriptor limit for every
+        // stage (maxPerStageDescriptorStorageBuffers, which is what MaxComputeShaderStorageBlocks
+        // carries), so the stage limits differ only by whether the stage can have blocks at all.
+        //
+        // Deliberately NOT gated on vertexPipelineStoresAndAtomics, unlike the per-stage image
+        // uniforms below. That gate reads as the obvious one and is wrong here in practice: a
+        // Mali-G925-Immortalis reports vertexPipelineStoresAndAtomics=false (supported AND
+        // enabled) and yet runs all 433 KHR-GL43.constant_expressions.*_tess_* cases correctly
+        // through this backend - those write their result through a storage block declared in a
+        // tessellation stage. Gating would report 0 and turn 433 passing cases into
+        // "unsupported", removing function that demonstrably works.
+        //
+        // The asymmetry with DirectGLES is real and is the point. There, 0 prevents a program
+        // the driver refuses outright at link time; the honest limit converts a silent
+        // wrong-render into a capability an application can route around. Here there is no such
+        // failure to prevent, so the limit stays at what the device can address. If a Vulkan
+        // device is ever found that genuinely rejects such a pipeline, the gate belongs at
+        // pipeline creation where the rejection is observable, not on a feature bit this driver
+        // reports inaccurately.
+        {
+            const Int maxPerStageStorageBlocks =
+                std::min(std::max(m_dynamicParameters.MaxComputeShaderStorageBlocks, 0),
+                         std::min(std::max(m_dynamicParameters.MaxCombinedShaderStorageBlocks, 0),
+                                  std::max(m_dynamicParameters.MaxShaderStorageBufferBindings, 0)));
+            m_dynamicParameters.MaxVertexShaderStorageBlocks = maxPerStageStorageBlocks;
+            m_dynamicParameters.MaxTessControlShaderStorageBlocks = maxPerStageStorageBlocks;
+            m_dynamicParameters.MaxTessEvaluationShaderStorageBlocks = maxPerStageStorageBlocks;
+            // The one hard capability in the set: no geometry stage means no blocks in it.
+            m_dynamicParameters.MaxGeometryShaderStorageBlocks =
+                m_vulkanCaps.SupportsGeometryShader ? maxPerStageStorageBlocks : 0;
+            m_dynamicParameters.MaxFragmentShaderStorageBlocks = maxPerStageStorageBlocks;
+        }
         m_dynamicParameters.MaxTextureBufferSize = clampLimit(
             "GL_MAX_TEXTURE_BUFFER_SIZE", m_vulkanCaps.MaxTextureBufferSize, kMaxAdvertisedTextureBufferSize);
         m_dynamicParameters.TextureBufferOffsetAlignment = m_vulkanCaps.TextureBufferOffsetAlignment;
@@ -849,8 +905,22 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Int maxSupportedDrawBuffers = static_cast<Int>(MG_State::GLState::FramebufferObject::MAX_DRAW_BUFFERS);
         m_dynamicParameters.MaxDrawBuffers = std::min(m_vulkanCaps.MaxDrawBuffers, maxSupportedDrawBuffers);
         m_dynamicParameters.MaxColorAttachments = std::min(m_vulkanCaps.MaxColorAttachments, maxSupportedDrawBuffers);
-        m_dynamicParameters.MaxClipDistances = m_vulkanCaps.MaxClipDistances;
+        // Same shape as the image-uniform limits three lines above: maxClipDistances is reported
+        // by every device, but declaring ClipDistance in a module needs the shaderClipDistance
+        // FEATURE, which VulkanRenderer enables exactly where the physical device has it. Without
+        // it the limit describes a capacity no shader may use, so report none.
+        m_dynamicParameters.MaxClipDistances =
+            m_vulkanCaps.SupportsShaderClipDistance ? std::max(m_vulkanCaps.MaxClipDistances, 0) : 0;
         m_dynamicParameters.MaxViewports = m_vulkanCaps.MaxViewports;
+        // Assigned explicitly rather than left to the struct's defaults, like every other
+        // parameter here, so a second fill cannot inherit a stale value. GL_UNDEFINED_VERTEX is
+        // the truthful answer for DirectVulkan and a legal one (GL 4.6 table 23.65): which vertex
+        // provokes is chosen per pipeline by VulkanRenderer::SelectProvokingVertexMode out of
+        // VK_EXT_provoking_vertex, provokingVertexModePerPipeline and the topology, so there is no
+        // one convention to name. Vulkan's own default is FIRST, which is the opposite of the
+        // GL_LAST_VERTEX_CONVENTION this used to claim unconditionally.
+        m_dynamicParameters.LayerProvokingVertex = GL_UNDEFINED_VERTEX;
+        m_dynamicParameters.ViewportIndexProvokingVertex = GL_UNDEFINED_VERTEX;
         m_dynamicParameters.MaxViewportWidth = m_vulkanCaps.MaxViewportWidth;
         m_dynamicParameters.MaxViewportHeight = m_vulkanCaps.MaxViewportHeight;
         m_dynamicParameters.ViewportBoundsRangeMin = m_vulkanCaps.ViewportBoundsRangeMin;
@@ -924,6 +994,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             m_dynamicParameters.SubgroupSupportedFeatures =
                 mapSubgroupFeatures(m_vulkanCaps.SubgroupSupportedOperations);
             m_dynamicParameters.SubgroupQuadOperationsInAllStages = m_vulkanCaps.SubgroupQuadOperationsInAllStages;
+        } else if (ShouldEmulateSubgroups(m_vulkanCaps.SupportsShaderSubgroup)) {
+            // MOBILEGL_MAGMA_EMULATE_SUBGROUP on a device with no native subgroups: the
+            // advertised values describe the 32-lane virtual subgroup the compute
+            // lowering implements (SubgroupSupportPolicy.h / EmulateSubgroupsPass).
+            // GL requires the advertisement and the execution to agree, and on this
+            // path the emulation is what executes; only the compute stage is offered.
+            m_dynamicParameters.SubgroupSize = kEmulatedSubgroupSize;
+            m_dynamicParameters.SubgroupSupportedStages = kEmulatedSubgroupStages;
+            m_dynamicParameters.SubgroupSupportedFeatures = kEmulatedSubgroupFeatures;
+            m_dynamicParameters.SubgroupQuadOperationsInAllStages = false;
+            MGLOG_I("DirectVulkan: emulating 32-lane compute subgroups "
+                    "(MOBILEGL_MAGMA_EMULATE_SUBGROUP, no native subgroup support)");
         } else {
             m_dynamicParameters.SubgroupSize = 0;
             m_dynamicParameters.SubgroupSupportedStages = 0;

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.h

@@ -62,8 +62,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     // POST screen shows.
 
     // Static identity of the Magma renderer (renderer/backend names, target GL/GLSL
-    // versions, ExtraVendor) with the baseline extension advertisement (no shader
-    // subgroup, no timer queries). A live backend copies this in its constructor and
+    // versions, ExtraVendor) with the baseline extension advertisement (no runtime-gated
+    // capabilities). A live backend copies this in its constructor and
     // reconciles the Extensions in UpdateAdvertisedExtensions once real capabilities
     // exist; callers that need the advertised list for a known capability set must
     // use BuildAdvertisedExtensions instead.
@@ -74,7 +74,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     // MOBILEGL_DISABLE_TIMERQUERY escape hatches are applied inside, so callers pass
     // the detected device support (passing an already-gated value is harmless).
     Vector<GLExtension> BuildAdvertisedExtensions(Bool shaderSubgroupSupported, Bool timerQueriesSupported,
-                                                  Bool anisotropicFilteringSupported);
+                                                  Bool anisotropicFilteringSupported,
+                                                  Bool nonZeroIndirectBaseInstanceSupported);
 
     // Format: <GPU Name>, Vulkan <Vulkan Version>, Driver <Driver Version> — the exact
     // string an initialized backend returns from GetBackendAPIVersionString (and that

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.cpp

@@ -69,6 +69,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // slot's ownership unambiguous.
             Uint64 programLifetimeId = 0;
             Uint32 backendStateVersion = 0;
+            // glShaderStorageBlockBinding deliberately does NOT bump the backend state
+            // version, and the pipeline composite is unnamed so the in-place patch in
+            // DirectVulkan::ShaderStorageBlockBinding can never reach its slot - the
+            // mirror replay bumps only the program's block-binding version. Without this
+            // key the composite's slot kept serving the pre-rebind block.binding.
+            Uint32 blockBindingVersion = 0;
             Vector<StorageBlockResource> storageBlocks;
             Vector<BufferVariableResource> bufferVariables;
             GLint computeWorkGroupSize[3] = {1, 1, 1};
@@ -156,18 +162,33 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             auto& cache = g_programResourceCaches[program.GetExternalIndex()];
             const Uint64 programLifetimeId = program.GetLifetimeId();
             const Uint32 backendStateVersion = program.GetBackendStateVersion();
+            const Uint32 blockBindingVersion = program.GetBlockBindingVersion();
             // The lifetime id must match too: a new program that reuses a deleted
             // program's name and happens to land on the same backendStateVersion (both
             // count from zero) would otherwise be served the dead program's reflection.
             if (cache.programLifetimeId == programLifetimeId &&
                 cache.backendStateVersion == backendStateVersion &&
                 (!cache.storageBlocks.empty() || !cache.bufferVariables.empty())) {
+                if (cache.blockBindingVersion != blockBindingVersion) {
+                    // Only the block bindings moved (glShaderStorageBlockBinding, or the
+                    // pipeline composite's mirror replay - neither touches the backend
+                    // state version): the reflection itself is unchanged, so re-apply the
+                    // overrides by name instead of re-running spirv-reflect. Overrides
+                    // only ever accumulate, so a block without one still holds its
+                    // declared binding.
+                    for (auto& block : cache.storageBlocks) {
+                        const Int rebound = program.GetShaderStorageBlockBindingOverride(block.name);
+                        if (rebound >= 0) block.binding = static_cast<Uint32>(rebound);
+                    }
+                    cache.blockBindingVersion = blockBindingVersion;
+                }
                 return cache;
             }
 
             cache = {};
             cache.programLifetimeId = programLifetimeId;
             cache.backendStateVersion = backendStateVersion;
+            cache.blockBindingVersion = blockBindingVersion;
 
             Vector<SpvReflectShaderModule> modules;
             Vector<Bool> validModules;
@@ -611,15 +632,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyTexSubImage2D called with null GL context");
         pVulkanRenderer->CopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     }
-    void CopyImageSubData(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
+    void CopyImageSubData(const CopyImageEndpoint& src,
                           GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
-                          const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
+                          const CopyImageEndpoint& dst,
                           GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                           GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyImageSubData called with null VulkanRenderer");
         MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyImageSubData called with null GL context");
-        pVulkanRenderer->CopyImageSubData(srcTexture, srcTarget, srcLevel, srcX, srcY, srcZ,
-                                          dstTexture, dstTarget, dstLevel, dstX, dstY, dstZ,
+        pVulkanRenderer->CopyImageSubData(src, srcTarget, srcLevel, srcX, srcY, srcZ,
+                                          dst, dstTarget, dstLevel, dstX, dstY, dstZ,
                                           srcWidth, srcHeight, srcDepth);
     }
     void GenerateMipmap(GLenum target) {

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.h

@@ -82,9 +82,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         GLsizei height, GLint border);
     void CopyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width,
                            GLsizei height);
-    void CopyImageSubData(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
+    void CopyImageSubData(const CopyImageEndpoint& src,
                           GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
-                          const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
+                          const CopyImageEndpoint& dst,
                           GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                           GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth);
     void GenerateMipmap(GLenum target);

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.cpp

@@ -33,6 +33,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         using SpvcSession = MG_Util::ShaderTranspiler::SpvcSession;
         using SessionUsageBit = MG_Util::ShaderTranspiler::SessionUsageBit;
 
+        // Local size of a compute module, read from OpExecutionMode LocalSize; all-zero
+        // when absent. The compile chain pins SPIR-V 1.3, where a literal local size
+        // always reaches the module as this execution mode (LocalSizeId does not exist
+        // yet).
+        struct ComputeLocalSize {
+            Uint32 x = 0;
+            Uint32 y = 0;
+            Uint32 z = 0;
+            Uint64 Total() const { return static_cast<Uint64>(x) * y * z; }
+        };
+        ComputeLocalSize TryGetComputeLocalSize(const Vector<Uint>& spirv) {
+            constexpr SizeT kHeaderWords = 5;
+            constexpr Uint32 kOpExecutionMode = 16;
+            constexpr Uint32 kModeLocalSize = 17;
+            for (SizeT offset = kHeaderWords; offset < spirv.size();) {
+                const Uint32 wordCount = spirv[offset] >> 16u;
+                const Uint32 opcode = spirv[offset] & 0xffffu;
+                if (wordCount == 0 || offset + wordCount > spirv.size()) break;
+                if (opcode == kOpExecutionMode && wordCount >= 6 && spirv[offset + 2] == kModeLocalSize) {
+                    return {spirv[offset + 3], spirv[offset + 4], spirv[offset + 5]};
+                }
+                offset += wordCount;
+            }
+            return {};
+        }
+
         struct DescriptorKey {
             ProgramFactory::DescriptorBindingKind kind = ProgramFactory::DescriptorBindingKind::None;
             String name;
@@ -2973,8 +2999,73 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             bindings.push_back(layoutBinding);
         }
 
+        // UPDATE_AFTER_BIND is strictly an optional per-layout acceleration. The GL
+        // descriptor model still resolves every sampler uniform element independently
+        // (including its texture-unit sampler-object override); selecting this path
+        // changes neither that resolution nor the set versioning in UniformManager.
+        // A conservative count keeps a layout on ordinary descriptors whenever any
+        // relevant update-after-bind limit is not large enough, rather than asking a
+        // driver to reject it during vkCreateDescriptorSetLayout.
+        Uint32 updateAfterBindSamplers = 0;
+        Uint32 updateAfterBindUniformBuffers = 0;
+        Uint32 updateAfterBindStorageBuffers = 0;
+        Uint32 updateAfterBindSampledImages = 0;
+        Uint32 updateAfterBindStorageImages = 0;
+        for (Uint32 binding = 0; binding < m_maxBindings; ++binding) {
+            const Uint32 count = entry.bindingDescriptorCounts[binding];
+            switch (entry.bindingKinds[binding]) {
+                case DescriptorBindingKind::UniformBufferDynamic:
+                    updateAfterBindUniformBuffers += count;
+                    break;
+                case DescriptorBindingKind::CombinedImageSampler:
+                    updateAfterBindSamplers += count;
+                    updateAfterBindSampledImages += count;
+                    break;
+                case DescriptorBindingKind::UniformTexelBuffer:
+                    updateAfterBindSampledImages += count;
+                    break;
+                case DescriptorBindingKind::StorageBuffer:
+                case DescriptorBindingKind::StorageTexelBuffer:
+                    updateAfterBindStorageBuffers += count;
+                    break;
+                case DescriptorBindingKind::StorageImage:
+                    updateAfterBindStorageImages += count;
+                    break;
+                case DescriptorBindingKind::None:
+                    break;
+            }
+        }
+        const Uint32 updateAfterBindResources = updateAfterBindUniformBuffers + updateAfterBindStorageBuffers +
+                                                updateAfterBindSampledImages + updateAfterBindStorageImages;
+        const auto& uab = m_updateAfterBindLimits;
+        entry.usesUpdateAfterBind =
+            uab.enabled && updateAfterBindSamplers <= uab.maxPerStageSamplers &&
+            updateAfterBindUniformBuffers <= uab.maxPerStageUniformBuffers &&
+            updateAfterBindStorageBuffers <= uab.maxPerStageStorageBuffers &&
+            updateAfterBindSampledImages <= uab.maxPerStageSampledImages &&
+            updateAfterBindStorageImages <= uab.maxPerStageStorageImages &&
+            updateAfterBindResources <= uab.maxPerStageResources &&
+            updateAfterBindSamplers <= uab.maxSetSamplers &&
+            updateAfterBindUniformBuffers <= uab.maxSetUniformBuffers &&
+            updateAfterBindUniformBuffers <= uab.maxSetUniformBuffersDynamic &&
+            updateAfterBindStorageBuffers <= uab.maxSetStorageBuffers &&
+            updateAfterBindStorageBuffers <= uab.maxSetStorageBuffersDynamic &&
+            updateAfterBindSampledImages <= uab.maxSetSampledImages &&
+            updateAfterBindStorageImages <= uab.maxSetStorageImages;
+
+        Vector<VkDescriptorBindingFlags> bindingFlags;
+        VkDescriptorSetLayoutBindingFlagsCreateInfo bindingFlagsInfo{};
+        if (entry.usesUpdateAfterBind) {
+            bindingFlags.assign(bindings.size(), VK_DESCRIPTOR_BINDING_UPDATE_AFTER_BIND_BIT);
+            bindingFlagsInfo.sType = VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_BINDING_FLAGS_CREATE_INFO;
+            bindingFlagsInfo.bindingCount = static_cast<Uint32>(bindingFlags.size());
+            bindingFlagsInfo.pBindingFlags = bindingFlags.data();
+        }
+
         VkDescriptorSetLayoutCreateInfo setLayoutInfo{};
         setLayoutInfo.sType = VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO;
+        setLayoutInfo.flags = entry.usesUpdateAfterBind ? VK_DESCRIPTOR_SET_LAYOUT_CREATE_UPDATE_AFTER_BIND_POOL_BIT : 0;
+        setLayoutInfo.pNext = entry.usesUpdateAfterBind ? &bindingFlagsInfo : nullptr;
         setLayoutInfo.bindingCount = static_cast<Uint32>(bindings.size());
         setLayoutInfo.pBindings = bindings.data();
         VK_VERIFY(vkCreateDescriptorSetLayout(m_device, &setLayoutInfo, nullptr, &entry.descriptorSetLayout),
@@ -3054,6 +3145,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         auto& shaders = program.GetAttachedShaders();
         auto& spirv = program.GetGeneratedSpirv();
         Vector<Vector<Uint>> moduleSpirvs(spirv.size());
+        const Bool enableSpirvValidation = program.GetSpirvValidationEnabled();
+        if (enableSpirvValidation) {
+            MG_Util::ShaderTranspiler::ShaderCompiler::PrepareSpirvValidation();
+        }
 
         const ShaderStage fixupStage = PickClipFixupStage(shaders);
 
@@ -3094,12 +3189,81 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 }
             }
 
+            // GL_KHR_shader_subgroup handling (SubgroupSupportPolicy.h). Native subgroup
+            // operations execute natively; module repairs keep the GL contract intact
+            // around them. The opt-in emulation path replaces them only on devices with no
+            // subgroup support at all (MOBILEGL_MAGMA_EMULATE_SUBGROUP).
+            if (shaders[i] && shaders[i]->GetShaderStage() == ShaderStage::Compute) {
+                // Program 203 broadcasts the first reduction through
+                // prefixSumCache[0], then lets the second reduction overwrite that
+                // scratch without first rendezvousing all readers. Patch that exact
+                // fingerprint before either native or emulated subgroup lowering.
+                if (m_subgroupPolicy.fixIterationRPBarrier) {
+                    Vector<Uint> patchedSpirv;
+                    if (MG_Util::ShaderTranspiler::ShaderCompiler::FixIterationRPBarrierForVulkan(
+                            moduleSpirvs[i], patchedSpirv, enableSpirvValidation)) {
+                        moduleSpirvs[i] = std::move(patchedSpirv);
+                    } else {
+                        MGLOG_E("ProgramFactory: iterationRP barrier patch failed for program %u; "
+                                "Program 203 keeps its shared-scratch race",
+                                program.GetExternalIndex());
+                    }
+                }
+                if (m_subgroupPolicy.emulateSubgroups) {
+                    Vector<Uint> emulatedSpirv;
+                    if (MG_Util::ShaderTranspiler::ShaderCompiler::EmulateSubgroupsForVulkan(
+                            moduleSpirvs[i], emulatedSpirv,
+                            m_subgroupPolicy.maxComputeSharedMemoryBytes, enableSpirvValidation)) {
+                        moduleSpirvs[i] = std::move(emulatedSpirv);
+                    } else {
+                        MGLOG_E("ProgramFactory: subgroup emulation failed for program %u; the "
+                                "module keeps subgroup operations the device cannot execute",
+                                program.GetExternalIndex());
+                    }
+                } else {
+                    // iterationRP under-declares its cross-subgroup scratch
+                    // (prefixSumCache[32] for 512 invocations); on a sub-16-lane device
+                    // grow that one fingerprinted array to what the topology needs.
+                    if (m_subgroupPolicy.fixIterationRPSubgroupScratch) {
+                        Vector<Uint> patchedSpirv;
+                        if (MG_Util::ShaderTranspiler::ShaderCompiler::FixIterationRPSubgroupScratchForVulkan(
+                                moduleSpirvs[i], patchedSpirv, m_subgroupPolicy.nativeSubgroupSize,
+                                m_subgroupPolicy.maxComputeSharedMemoryBytes,
+                                enableSpirvValidation)) {
+                            moduleSpirvs[i] = std::move(patchedSpirv);
+                        } else {
+                            MGLOG_E("ProgramFactory: iterationRP subgroup scratch patch failed for "
+                                    "program %u; the pack's declared array sizes stay in effect",
+                                    program.GetExternalIndex());
+                        }
+                    }
+                    // gl_NumSubgroups must agree with the gl_SubgroupID range GL promises;
+                    // derive it from the workgroup dimensions and gl_SubgroupSize instead of
+                    // trusting a driver builtin that can disagree with the topology the same
+                    // dispatch emits (Adreno reports 1 while emitting IDs 0..7 for a
+                    // 512-invocation, 64-wide workgroup). The ceil() partition this derives
+                    // is pinned by REQUIRE_FULL_SUBGROUPS at pipeline creation whenever the
+                    // workgroup shape makes that flag legal (see the stage setup below).
+                    if (m_subgroupPolicy.deriveNumSubgroups) {
+                        Vector<Uint> derivedNumSubgroupsSpirv;
+                        if (MG_Util::ShaderTranspiler::ShaderCompiler::DeriveNumSubgroupsForVulkan(
+                                moduleSpirvs[i], derivedNumSubgroupsSpirv, enableSpirvValidation)) {
+                            moduleSpirvs[i] = std::move(derivedNumSubgroupsSpirv);
+                        } else {
+                            MGLOG_E("ProgramFactory: failed to derive gl_NumSubgroups for program %u; "
+                                    "compute shaders may observe a driver-inconsistent subgroup count",
+                                    program.GetExternalIndex());
+                        }
+                    }
+                }
+            }
+
             // Vulkan's SPIR-V environment has no rectangle image dimension, so a
             // GL_TEXTURE_RECTANGLE lookup has to become the 2D one the texture is really
             // stored as - which addresses [0,1] where the application addressed texels.
             {
                 Vector<Uint> rectLoweredSpirv;
-                if (MG_Util::ShaderTranspiler::ShaderCompiler::LowerRectImages(moduleSpirvs[i], rectLoweredSpirv) &&
+                if (MG_Util::ShaderTranspiler::ShaderCompiler::LowerRectImages(moduleSpirvs[i], rectLoweredSpirv, enableSpirvValidation) &&
                     !rectLoweredSpirv.empty()) {
                     moduleSpirvs[i] = Move(rectLoweredSpirv);
                 }
@@ -3112,7 +3276,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             {
                 Vector<Uint> invariantSpirv;
                 if (MG_Util::ShaderTranspiler::ShaderCompiler::DecoratePositionInvariantForVulkan(
-                        moduleSpirvs[i], invariantSpirv)) {
+                        moduleSpirvs[i], invariantSpirv, enableSpirvValidation)) {
                     moduleSpirvs[i] = std::move(invariantSpirv);
                 } else {
                     // The pass round-trips through SPIRV-Tools IR, so an unparseable module
@@ -3136,7 +3300,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 m_shaderDrawParametersEnabled) {
                 Vector<Uint> rebasedSpirv;
                 if (MG_Util::ShaderTranspiler::ShaderCompiler::RebaseInstanceIndexForVulkan(moduleSpirvs[i],
-                                                                                            rebasedSpirv)) {
+                                                                                            rebasedSpirv, enableSpirvValidation)) {
                     moduleSpirvs[i] = std::move(rebasedSpirv);
                 } else {
                     MGLOG_E("ProgramFactory: failed to rebase gl_InstanceID for program %u; "
@@ -3154,7 +3318,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 (flags & CompileOptionBit::ZeroBaseVertex)) {
                 Vector<Uint> zeroedSpirv;
                 if (MG_Util::ShaderTranspiler::ShaderCompiler::ZeroBaseVertexForVulkan(moduleSpirvs[i],
-                                                                                       zeroedSpirv)) {
+                                                                                       zeroedSpirv, enableSpirvValidation)) {
                     moduleSpirvs[i] = std::move(zeroedSpirv);
                 } else {
                     // Failing open keeps the native builtin, which is the pre-fix behavior:
@@ -3177,7 +3341,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             if (shaders[i] && shaders[i]->GetShaderStage() == ShaderStage::Vertex) {
                 Vector<Uint> packedSpirv;
                 const Bool packOk = MG_Util::ShaderTranspiler::ShaderCompiler::PackDoubleVertexInputsForVulkan(
-                    moduleSpirvs[i], packedSpirv);
+                    moduleSpirvs[i], packedSpirv, enableSpirvValidation);
                 MOBILEGL_ASSERT(packOk,
                                 "ProgramFactory: 64-bit vertex input packing failed for program %u; the "
                                 "vertex-input format and the shader input type now disagree",
@@ -3201,7 +3365,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             if (m_unformattedFloatStorageImagesEnabled) {
                 Vector<Uint> unformattedSpirv;
                 if (MG_Util::ShaderTranspiler::ShaderCompiler::UseUnformattedFloatStorageImagesForVulkan(
-                        moduleSpirvs[i], unformattedSpirv)) {
+                        moduleSpirvs[i], unformattedSpirv, enableSpirvValidation)) {
                     moduleSpirvs[i] = std::move(unformattedSpirv);
                 } else {
                     MGLOG_E("ProgramFactory: failed to make float storage images unformatted for program %u",
@@ -3222,7 +3386,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 #else
             // Final module the driver receives; also checked in the INFO-level CI/test
             // lanes, where the DEBUG gate above is compiled out.
-            if (MG_Util::ShaderTranspiler::ShaderCompiler::SpirvValidationEnabled()) {
+            if (enableSpirvValidation) {
                 ValidateTransformedSpirv(moduleSpv, shaders[i]->GetShaderStage(), program.GetExternalIndex());
             }
 #endif
@@ -3239,6 +3403,27 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             stage.stage = ToVkStage(shaderStage);
             stage.module = module;
             stage.pName = "main";
+            // Pin the full-subgroup launch the derived gl_NumSubgroups assumes. Legal
+            // exactly when the computeFullSubgroups feature is enabled and local_size_x is
+            // a multiple of the subgroup size (VUID-VkPipelineShaderStageCreateInfo-
+            // flags-02759/-02785), and only worth requesting while the resulting subgroup
+            // count fits the device's maxComputeWorkgroupSubgroups (lavapipe caps it at
+            // 32, below a 512-invocation dispatch's 64). With the bit set, "Full
+            // Subgroups" guarantees every subgroup launches with all invocations active,
+            // making the subgroup count exactly invocations / size. Shapes the flag
+            // cannot cover (e.g. 32x16 on a 64-wide device) fall back to the driver's
+            // own - spec-encouraged - tight partitioning, which the DriverPost witness
+            // verifies per device.
+            if (shaderStage == ShaderStage::Compute && m_subgroupPolicy.requireFullSubgroups &&
+                !m_subgroupPolicy.emulateSubgroups && m_subgroupPolicy.nativeSubgroupSize != 0) {
+                const ComputeLocalSize localSize = TryGetComputeLocalSize(moduleSpv);
+                const Uint64 fullSubgroupCount =
+                    localSize.Total() / m_subgroupPolicy.nativeSubgroupSize;
+                if (localSize.x != 0 && localSize.x % m_subgroupPolicy.nativeSubgroupSize == 0 &&
+                    fullSubgroupCount <= m_subgroupPolicy.maxComputeWorkgroupSubgroups) {
+                    stage.flags |= VK_PIPELINE_SHADER_STAGE_CREATE_REQUIRE_FULL_SUBGROUPS_BIT;
+                }
+            }
 
             entry.modules.push_back(module);
             entry.stages.push_back(stage);
@@ -3299,14 +3484,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 const VkDescriptorSetLayout descriptorSetLayout = it->second.descriptorSetLayout;
                 MGLOG_D("ProgramFactory::OnFrameBoundary: evicting idle program entry hash=0x%llx",
                         static_cast<unsigned long long>(hash));
-                // erase runs ~VkProgramObject (modules/layouts destroyed); notify after
-                // so an observer never observes a half-destroyed entry through a lookup.
-                // Observers only need the handle values to purge their keyed caches.
-                ++m_cacheStructureEpoch; // erase moves/kills entries: memoised pointers die
-                it = m_cache.erase(it);
+                // The observer destroys dependent pipelines and frees descriptor sets while
+                // this entry still owns its layout. Vulkan requires every descriptor set to be
+                // freed before its VkDescriptorSetLayout is destroyed.
                 if (m_evictionObserver != nullptr) {
                     m_evictionObserver->OnProgramEvicted(hash, descriptorSetLayout);
                 }
+                ++m_cacheStructureEpoch; // erase moves/kills entries: memoised pointers die
+                it = m_cache.erase(it);
             } else {
                 ++it;
             }
@@ -3440,7 +3625,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 #if MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG
         ValidateTransformedSpirv(spirv, ShaderStage::TessControl, 0);
 #else
-        if (MG_Util::ShaderTranspiler::ShaderCompiler::SpirvValidationEnabled()) {
+        if (m_enableSpirvValidation) {
+            MG_Util::ShaderTranspiler::ShaderCompiler::PrepareSpirvValidation();
             ValidateTransformedSpirv(spirv, ShaderStage::TessControl, 0);
         }
 #endif

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -76,6 +76,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         using CompileOptionFlags = Flags<CompileOptionBit>;
         using HashType = Uint64;
 
+        struct UpdateAfterBindLimits {
+            Bool enabled = false;
+            Uint32 maxPerStageSamplers = 0;
+            Uint32 maxPerStageUniformBuffers = 0;
+            Uint32 maxPerStageStorageBuffers = 0;
+            Uint32 maxPerStageSampledImages = 0;
+            Uint32 maxPerStageStorageImages = 0;
+            Uint32 maxPerStageResources = 0;
+            Uint32 maxSetSamplers = 0;
+            Uint32 maxSetUniformBuffers = 0;
+            Uint32 maxSetUniformBuffersDynamic = 0;
+            Uint32 maxSetStorageBuffers = 0;
+            Uint32 maxSetStorageBuffersDynamic = 0;
+            Uint32 maxSetSampledImages = 0;
+            Uint32 maxSetStorageImages = 0;
+        };
+
         struct VkProgramObject {
             static constexpr Uint32 kMaxVertexInputLocations = 32;
 
@@ -88,6 +105,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
             // Layout data (previously in separate VkProgramLayout)
             VkDescriptorSetLayout descriptorSetLayout = VK_NULL_HANDLE;
+            // True only when this layout passed every descriptor-indexing feature and
+            // update-after-bind limit gate at reflection time. It controls both the
+            // layout/binding flags and the pool class used by UniformManager.
+            Bool usesUpdateAfterBind = false;
             VkPipelineLayout pipelineLayout = VK_NULL_HANDLE;
             Vector<DescriptorBindingKind> bindingKinds;
             // The bindings this program actually declares, ascending. bindingKinds is sized to the
@@ -196,6 +217,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 // a pipeline failure would be reported against the wrong SPIR-V.
                 stageSpirvDigests = std::move(other.stageSpirvDigests);
                 descriptorSetLayout = other.descriptorSetLayout;
+                usesUpdateAfterBind = other.usesUpdateAfterBind;
                 pipelineLayout = other.pipelineLayout;
                 bindingKinds = std::move(other.bindingKinds);
                 activeBindings = std::move(other.activeBindings);
@@ -224,11 +246,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 fragmentInputComponentCount = other.fragmentInputComponentCount;
                 fragmentReplacesDepth = other.fragmentReplacesDepth;
                 readsBaseVertexBuiltin = other.readsBaseVertexBuiltin;
+                writesViewportIndexBuiltin = other.writesViewportIndexBuiltin;
                 needsPassthroughTessControl = other.needsPassthroughTessControl;
                 passthroughTessControlEmulatable = other.passthroughTessControlEmulatable;
                 lastUsedFrame = other.lastUsedFrame;
                 other.hash = 0;
                 other.descriptorSetLayout = VK_NULL_HANDLE;
+                other.usesUpdateAfterBind = false;
                 other.pipelineLayout = VK_NULL_HANDLE;
                 other.hasStorageImages = false;
                 other.declinedDescriptors = false;
@@ -240,6 +264,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.fragmentInputComponentCount = 0;
                 other.fragmentReplacesDepth = false;
                 other.readsBaseVertexBuiltin = false;
+                other.writesViewportIndexBuiltin = false;
                 other.needsPassthroughTessControl = false;
                 other.passthroughTessControlEmulatable = false;
                 other.lastUsedFrame = 0;
@@ -254,6 +279,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 modules = std::move(other.modules);
                 stageSpirvDigests = std::move(other.stageSpirvDigests); // travels with `modules` - see the move ctor
                 descriptorSetLayout = other.descriptorSetLayout;
+                usesUpdateAfterBind = other.usesUpdateAfterBind;
                 pipelineLayout = other.pipelineLayout;
                 bindingKinds = std::move(other.bindingKinds);
                 activeBindings = std::move(other.activeBindings);
@@ -282,11 +308,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 fragmentInputComponentCount = other.fragmentInputComponentCount;
                 fragmentReplacesDepth = other.fragmentReplacesDepth;
                 readsBaseVertexBuiltin = other.readsBaseVertexBuiltin;
+                writesViewportIndexBuiltin = other.writesViewportIndexBuiltin;
                 needsPassthroughTessControl = other.needsPassthroughTessControl;
                 passthroughTessControlEmulatable = other.passthroughTessControlEmulatable;
                 lastUsedFrame = other.lastUsedFrame;
                 other.hash = 0;
                 other.descriptorSetLayout = VK_NULL_HANDLE;
+                other.usesUpdateAfterBind = false;
                 other.pipelineLayout = VK_NULL_HANDLE;
                 other.hasStorageImages = false;
                 other.declinedDescriptors = false;
@@ -298,6 +326,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.fragmentInputComponentCount = 0;
                 other.fragmentReplacesDepth = false;
                 other.readsBaseVertexBuiltin = false;
+                other.writesViewportIndexBuiltin = false;
                 other.needsPassthroughTessControl = false;
                 other.passthroughTessControlEmulatable = false;
                 other.lastUsedFrame = 0;
@@ -343,12 +372,39 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             virtual void OnProgramEvicted(HashType programHash, VkDescriptorSetLayout descriptorSetLayout) = 0;
         };
 
-        explicit ProgramFactory(VkDevice device, const VulkanRendererConfig& config, Uint32 maxBindings = 16,
-                                Bool shaderDrawParametersEnabled = false,
-                                Bool unformattedFloatStorageImagesEnabled = false)
+        // How this factory's compute modules implement GL_KHR_shader_subgroup. Computed
+        // once at renderer initialization (SubgroupSupportPolicy.h + the device's
+        // subgroup properties) so lowering can never disagree with the advertised
+        // capabilities. Native subgroup operations always execute natively; the two
+        // repair passes patch modules AROUND them, and the emulation only replaces them
+        // on opted-in devices with no subgroup support at all.
+        struct SubgroupLoweringPolicy {
+            Bool emulateSubgroups = false;      // MOBILEGL_MAGMA_EMULATE_SUBGROUP, no-native-support devices
+            Bool fixIterationRPSubgroupScratch = false; // patch iterationRP's under-declared scratch
+            Bool fixIterationRPBarrier = false; // repair Program 203's shared-scratch race
+            Bool deriveNumSubgroups = false;    // repair the NumSubgroups builtin
+            Bool requireFullSubgroups = false;  // computeFullSubgroups enabled on the device
+            Uint32 nativeSubgroupSize = 0;
+            // Full-subgroup launches are bounded by this device limit; a dispatch whose
+            // workgroup needs more subgroups than this cannot request the flag.
+            Uint32 maxComputeWorkgroupSubgroups = 0;
+            // VkPhysicalDeviceLimits::maxComputeSharedMemorySize; bounds the scratch the
+            // emulation pass may add (0 falls back to the Vulkan minimum, 16384).
+            Uint32 maxComputeSharedMemoryBytes = 0;
+        };
+
+        explicit ProgramFactory(VkDevice device, const VulkanRendererConfig& config, Uint32 maxBindings,
+                                Bool shaderDrawParametersEnabled,
+                                Bool unformattedFloatStorageImagesEnabled,
+                                Bool enableSpirvValidation,
+                                UpdateAfterBindLimits updateAfterBindLimits,
+                                SubgroupLoweringPolicy subgroupPolicy)
             : m_device(device), m_maxBindings(maxBindings), m_config(config),
               m_shaderDrawParametersEnabled(shaderDrawParametersEnabled),
-              m_unformattedFloatStorageImagesEnabled(unformattedFloatStorageImagesEnabled) {
+              m_unformattedFloatStorageImagesEnabled(unformattedFloatStorageImagesEnabled),
+              m_enableSpirvValidation(enableSpirvValidation),
+              m_updateAfterBindLimits(updateAfterBindLimits),
+              m_subgroupPolicy(subgroupPolicy) {
             VkProgramObject::s_device = device;
         }
         // Destroys the pass-through tessellation control modules. Runs while the device is
@@ -471,6 +527,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // True only when the logical device enabled both
         // shaderStorageImageReadWithoutFormat and shaderStorageImageWriteWithoutFormat.
         Bool m_unformattedFloatStorageImagesEnabled = false;
+        // Startup snapshot used only by internally synthesized shader modules, which do not
+        // originate from a ProgramLinkTask.
+        Bool m_enableSpirvValidation = false;
+        // Device feature and limit gate resolved before vkCreateDevice. Keeping it in
+        // the factory lets each reflected layout choose ordinary descriptors when its
+        // own counts would exceed the update-after-bind budget.
+        UpdateAfterBindLimits m_updateAfterBindLimits{};
+        SubgroupLoweringPolicy m_subgroupPolicy{};
         // See SetDefaultFramebufferHeight. 0 means "not known yet"; the FragCoordYFlip bit is
         // never set before the swapchain exists, so no variant can be compiled against it.
         Uint32 m_defaultFramebufferHeight = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp

@@ -156,13 +156,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             frame.descriptorPools.clear();
 
             VkDescriptorPool initialPool = VK_NULL_HANDLE;
-            if (!CreateDescriptorPool(m_setsPerFrame, initialPool)) {
+            if (!CreateDescriptorPool(m_setsPerFrame, false, initialPool)) {
                 MGLOG_E_ONCE("UniformDescriptorBinder::Initialize failed: cannot create frame descriptor pool %u",
                         frameIndex);
                 Shutdown();
                 return false;
             }
-            frame.descriptorPools.push_back({initialPool, m_setsPerFrame, 0});
+            frame.descriptorPools.push_back({initialPool, m_setsPerFrame, 0, false});
             MGLOG_D("UniformDescriptorBinder: frame %u descriptor pool created (maxSets=%u)", frameIndex,
                     m_setsPerFrame);
         }
@@ -305,7 +305,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // texture/sampler resolution, completeness probe, sync, layout handling, sampler
         // and view lookups - would recompute the identical descriptor.
         if (trustUnchangedHint && descriptorMemoUsable && binding < m_samplerResolveMemo.size() &&
-            m_samplerResolveMemo[binding].infoValid) {
+            m_samplerResolveMemo[binding].infoValid &&
+            m_samplerResolveMemo[binding].infoProgramLifetimeId == program.GetLifetimeId()) {
             outImageInfo = m_samplerResolveMemo[binding].info;
             return true;
         }
@@ -504,6 +505,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (binding < m_samplerResolveMemo.size()) {
             if (descriptorMemoUsable) {
                 m_samplerResolveMemo[binding].info = outImageInfo;
+                m_samplerResolveMemo[binding].infoProgramLifetimeId = program.GetLifetimeId();
                 m_samplerResolveMemo[binding].infoValid = true;
             } else {
                 // An arrayed binding publishes nothing here, and clears what a previous program
@@ -540,11 +542,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         outImageInfo = {
             .sampler = m_samplerManager->GetOrCreateSampler(*samplerBindingOverride.sampler,
-                                                            *samplerBindingOverride.texture),
+                                                            *samplerBindingOverride.texture,
+                                                            samplerBindingOverride.forceNearestFiltering,
+                                                            resource->sampledLevelCount),
             .imageView = samplerBindingOverride.imageView != VK_NULL_HANDLE ?
                 samplerBindingOverride.imageView :
                 (resource->sampledView != VK_NULL_HANDLE ? resource->sampledView : resource->fullView),
-            .imageLayout = resource->layout,
+            .imageLayout = samplerBindingOverride.imageLayout != VK_IMAGE_LAYOUT_UNDEFINED ?
+                samplerBindingOverride.imageLayout : resource->layout,
         };
         return outImageInfo.sampler != VK_NULL_HANDLE;
     }
@@ -1267,6 +1272,87 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return true;
     }
 
+    Bool UniformManager::SamplerOverlapsWritableImageSubresource(Int samplerBaseLevel, Int samplerMaxLevel,
+                                                                 GLint imageLevel, GLenum imageAccess) {
+        return imageAccess != GL_READ_ONLY && imageLevel >= samplerBaseLevel && imageLevel <= samplerMaxLevel;
+    }
+
+    Bool UniformManager::CollectSamplerImageFeedback(
+        const MG_State::GLState::ProgramObject& program,
+        const ProgramFactory::VkProgramObject& programObj,
+        Vector<SamplerImageFeedbackBinding>& outBindings) const {
+        outBindings.clear();
+        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr,
+                        "CollectSamplerImageFeedback: GL context is null");
+        if (programObj.declinedDescriptors) return true;
+
+        for (const Uint32 samplerBinding : programObj.activeBindings) {
+            if (samplerBinding >= m_maxBindings ||
+                programObj.bindingKinds[samplerBinding] != ProgramFactory::DescriptorBindingKind::CombinedImageSampler) {
+                continue;
+            }
+            const Uint32 samplerCount = BindingDescriptorCount(programObj, samplerBinding);
+            for (Uint32 samplerElement = 0; samplerElement < samplerCount; ++samplerElement) {
+                MG_State::GLState::ITextureObject* sampledTexture = nullptr;
+                const MG_State::GLState::SamplerObject* sampledSampler = nullptr;
+                if (!ResolveSampledBinding(program, programObj, samplerBinding, samplerElement,
+                                           sampledTexture, sampledSampler) ||
+                    sampledTexture == nullptr || sampledSampler == nullptr ||
+                    MG_State::GLState::SamplesAsIncompleteTexture(sampledTexture, sampledSampler)) {
+                    // ResolveSamplerDescriptor uses a fallback in these cases, which cannot
+                    // alias the image-unit binding of the original texture.
+                    continue;
+                }
+                // Multisample source images intentionally omit TRANSFER_SRC usage. Keep their existing
+                // direct binding instead of turning otherwise valid sampler2DMS/image2DMS dispatches
+                // into failed dispatches; a correct snapshot for them needs a same-sample-count path.
+                const TextureTarget sampledTarget = sampledTexture->GetTarget();
+                if (sampledTarget == TextureTarget::Texture2DMultisample ||
+                    sampledTarget == TextureTarget::Texture2DMultisampleArray) {
+                    continue;
+                }
+                const auto& levelRange = sampledTexture->GetLevelRange();
+                Bool aliasesWritableImage = false;
+                for (const Uint32 imageBinding : programObj.activeBindings) {
+                    if (imageBinding >= m_maxBindings ||
+                        programObj.bindingKinds[imageBinding] != ProgramFactory::DescriptorBindingKind::StorageImage) {
+                        continue;
+                    }
+                    if (imageBinding >= programObj.samplerUniformLocationByBinding.size()) return false;
+                    const Int baseLocation = programObj.samplerUniformLocationByBinding[imageBinding];
+                    if (baseLocation < 0) return false;
+                    const Uint32 imageCount = BindingDescriptorCount(programObj, imageBinding);
+                    for (Uint32 imageElement = 0; imageElement < imageCount; ++imageElement) {
+                        const Int location = ResolveDescriptorElementLocation(program, baseLocation, imageElement);
+                        if (location < 0) return false;
+                        const Int imageUnit = program.GetUniformSamplerOrImageUnitIndex(static_cast<Uint>(location));
+                        if (imageUnit < 0 || imageUnit >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
+                            return false;
+                        }
+                        const auto& image = MG_State::pGLContext->GetImageTextureBinding(imageUnit);
+                        // A sampler view exposes all layers of its target; equal texture plus an
+                        // overlapping mip therefore aliases the writable image subresource.
+                        if (image.Texture.get() == sampledTexture &&
+                            SamplerOverlapsWritableImageSubresource(levelRange.x(), levelRange.y(),
+                                                                     image.Level, image.Access)) {
+                            aliasesWritableImage = true;
+                            break;
+                        }
+                    }
+                    if (aliasesWritableImage) break;
+                }
+                if (aliasesWritableImage) {
+                    outBindings.push_back({.samplerBinding = samplerBinding,
+                                           .samplerElement = samplerElement,
+                                           .texture = sampledTexture,
+                                           .sampler = sampledSampler,
+                                           .numericDomain = programObj.samplerNumericDomainByBinding[samplerBinding]});
+                }
+            }
+        }
+        return true;
+    }
+
     Bool UniformManager::ResolveUniformBufferPayload(const MG_State::GLState::ProgramObject& program,
                                                      const ProgramFactory::VkProgramObject& programObj, Uint32 binding,
                                                      Uint32 arrayElement, UboBindResult& out) const {
@@ -1388,7 +1474,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return true;
     }
 
-    Bool UniformManager::CreateDescriptorPool(Uint32 maxSets, VkDescriptorPool& outPool) const {
+    Bool UniformManager::CreateDescriptorPool(Uint32 maxSets, Bool updateAfterBind, VkDescriptorPool& outPool) const {
         outPool = VK_NULL_HANDLE;
         if (m_device == VK_NULL_HANDLE || maxSets == 0 || m_maxBindings == 0) {
             return false;
@@ -1431,7 +1517,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // (OnDescriptorSetLayoutDestroyed) so program churn recycles pool capacity.
         // The cost is on set allocation only, which happens when a layout's per-frame
         // cache grows - never on the per-draw reuse path.
-        poolInfo.flags = VK_DESCRIPTOR_POOL_CREATE_FREE_DESCRIPTOR_SET_BIT;
+        poolInfo.flags = VK_DESCRIPTOR_POOL_CREATE_FREE_DESCRIPTOR_SET_BIT |
+                         (updateAfterBind ? VK_DESCRIPTOR_POOL_CREATE_UPDATE_AFTER_BIND_BIT : 0);
         poolInfo.maxSets = maxSets;
         poolInfo.poolSizeCount = static_cast<Uint32>(std::size(poolSizes));
         poolInfo.pPoolSizes = poolSizes;
@@ -1445,24 +1532,28 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return true;
     }
 
-    Bool UniformManager::GrowFrameDescriptorPool(FrameResources& frame, Uint32 frameIndex) {
+    Bool UniformManager::GrowFrameDescriptorPool(FrameResources& frame, Uint32 frameIndex, Bool updateAfterBind) {
         if (frame.descriptorPools.empty()) {
             return false;
         }
 
-        const auto& currentBucket = frame.descriptorPools[frame.activeDescriptorPoolIndex];
-        const Uint32 currentMaxSets = std::max<Uint32>(1, currentBucket.maxSets);
+        const auto matchingBucket = std::find_if(
+            frame.descriptorPools.begin(), frame.descriptorPools.end(),
+            [updateAfterBind](const DescriptorPoolBucket& candidate) { return candidate.updateAfterBind == updateAfterBind; });
+        const Uint32 currentMaxSets = matchingBucket != frame.descriptorPools.end()
+                                          ? std::max<Uint32>(1, matchingBucket->maxSets)
+                                          : m_setsPerFrame;
         const Uint32 grownMaxSets = currentMaxSets <= (std::numeric_limits<Uint32>::max() / 2) ? (currentMaxSets * 2)
                                                                                                  : currentMaxSets;
 
         VkDescriptorPool grownPool = VK_NULL_HANDLE;
-        if (!CreateDescriptorPool(grownMaxSets, grownPool)) {
+        if (!CreateDescriptorPool(grownMaxSets, updateAfterBind, grownPool)) {
             MGLOG_E_ONCE("UniformDescriptorBinder::GrowFrameDescriptorPool failed: cannot create grown pool (%u -> %u sets)",
                     currentMaxSets, grownMaxSets);
             return false;
         }
 
-        frame.descriptorPools.push_back({grownPool, grownMaxSets, 0});
+        frame.descriptorPools.push_back({grownPool, grownMaxSets, 0, updateAfterBind});
         frame.activeDescriptorPoolIndex = static_cast<Uint32>(frame.descriptorPools.size() - 1);
         MGLOG_D(
             "UniformDescriptorBinder: frame %u descriptor pool exhausted, grew pool (%u -> %u sets), poolCount=%zu",
@@ -1472,14 +1563,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     VkResult UniformManager::AllocateDescriptorSetsFromActivePool(Uint32 frameIndex, const ProgramFactory::VkProgramObject& programObj, VkDescriptorSet& outDescriptorSet) {
         auto& frame = m_frames[frameIndex];
-        if (frame.activeDescriptorPoolIndex >= frame.descriptorPools.size()) {
-            frame.activeDescriptorPoolIndex = 0;
-        }
-        if (frame.descriptorPools[frame.activeDescriptorPoolIndex].allocatedSets >=
-            frame.descriptorPools[frame.activeDescriptorPoolIndex].maxSets) {
+        const Bool updateAfterBind = programObj.usesUpdateAfterBind;
+        if (frame.activeDescriptorPoolIndex >= frame.descriptorPools.size() ||
+            frame.descriptorPools[frame.activeDescriptorPoolIndex].updateAfterBind != updateAfterBind ||
+            frame.descriptorPools[frame.activeDescriptorPoolIndex].allocatedSets >=
+                frame.descriptorPools[frame.activeDescriptorPoolIndex].maxSets) {
             const auto availableBucket = std::find_if(
                 frame.descriptorPools.begin(), frame.descriptorPools.end(),
-                [](const DescriptorPoolBucket& candidate) { return candidate.allocatedSets < candidate.maxSets; });
+                [updateAfterBind](const DescriptorPoolBucket& candidate) {
+                    return candidate.updateAfterBind == updateAfterBind && candidate.allocatedSets < candidate.maxSets;
+                });
             if (availableBucket == frame.descriptorPools.end()) {
                 outDescriptorSet = VK_NULL_HANDLE;
                 return VK_ERROR_OUT_OF_POOL_MEMORY;
@@ -1515,7 +1608,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         } else {
             VkResult allocResult = AllocateDescriptorSetsFromActivePool(frameIndex, programObj, outDescriptorSet);
             if (allocResult == VK_ERROR_OUT_OF_POOL_MEMORY || allocResult == VK_ERROR_FRAGMENTED_POOL) {
-                if (!GrowFrameDescriptorPool(frame, frameIndex)) {
+                if (!GrowFrameDescriptorPool(frame, frameIndex, programObj.usesUpdateAfterBind)) {
                     MGLOG_E_ONCE("UniformDescriptorBinder::AcquireDescriptorSet failed: descriptor pool growth failed");
                     return allocResult;
                 }
@@ -1633,7 +1726,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                              Uint32 frameIndex,
                                                              VkPipelineBindPoint bindPoint,
                                                              const SamplerBindingOverride* samplerBindingOverride,
-                                                             Bool samplerDescriptorsUnchangedHint) {
+                                                             Bool samplerDescriptorsUnchangedHint,
+                                                             const Vector<SamplerBindingOverride>* samplerBindingOverrides) {
         // This program has a descriptor MobileGL could not resolve (see
         // VkProgramObject::declinedDescriptors). Refusing here is the whole of the decline: the
         // binding is still declared in the layout, so the pipeline is consistent with the shader
@@ -1660,7 +1754,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // sampler binding, and an unchanged (buffer, range) for the single
         // dynamic UBO covers the rest - except the dynamic offset, which rebinding
         // the SAME set delivers without any descriptor write.
-        const Bool cacheable = (samplerBindingOverride == nullptr);
+        const Bool cacheable = samplerBindingOverride == nullptr &&
+                               (samplerBindingOverrides == nullptr || samplerBindingOverrides->empty());
         if (cacheable && samplerDescriptorsUnchangedHint && m_fastRebindMemo.valid &&
             m_fastRebindMemo.frameIndex == frameIndex &&
             m_fastRebindMemo.programLifetimeId == program.GetLifetimeId() &&
@@ -1884,13 +1979,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 const SizeT firstImageInfoIndex = imageInfos.size();
                 for (Uint32 element = 0; element < descriptorCount; ++element) {
                     VkDescriptorImageInfo imageInfo{};
-                    Bool hasImage = false;
-                    if (overrideThisBinding && element == 0) {
-                        hasImage = ResolveSamplerDescriptorOverride(*samplerBindingOverride, imageInfo);
-                    } else {
-                        hasImage = ResolveSamplerDescriptor(commandBuffer, program, programObj, binding, element,
-                                                            imageInfo, samplerDescriptorsUnchangedHint);
+                    const SamplerBindingOverride* overrideForElement =
+                        overrideThisBinding && element == 0 ? samplerBindingOverride : nullptr;
+                    if (overrideForElement == nullptr && samplerBindingOverrides != nullptr) {
+                        const auto overrideIt = std::find_if(
+                            samplerBindingOverrides->begin(), samplerBindingOverrides->end(),
+                            [binding, element](const SamplerBindingOverride& candidate) {
+                                return candidate.binding == binding && candidate.element == element;
+                            });
+                        if (overrideIt != samplerBindingOverrides->end()) {
+                            overrideForElement = &*overrideIt;
+                        }
                     }
+                    const Bool hasImage = overrideForElement != nullptr
+                                              ? ResolveSamplerDescriptorOverride(*overrideForElement, imageInfo)
+                                              : ResolveSamplerDescriptor(commandBuffer, program, programObj, binding,
+                                                                         element, imageInfo,
+                                                                         samplerDescriptorsUnchangedHint);
                     if (!hasImage) {
                         MGLOG_E_ONCE(
                             "UniformDescriptorBinder::BindProgramUniformBuffers failed: sampler binding %u element %u "

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.h

@@ -26,9 +26,20 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     public:
         struct SamplerBindingOverride {
             Uint32 binding = 0;
+            Uint32 element = 0;
             MG_State::GLState::ITextureObject* texture = nullptr;
             const MG_State::GLState::SamplerObject* sampler = nullptr;
             VkImageView imageView = VK_NULL_HANDLE;
+            VkImageLayout imageLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+            Bool forceNearestFiltering = false;
+        };
+
+        struct SamplerImageFeedbackBinding {
+            Uint32 samplerBinding = 0;
+            Uint32 samplerElement = 0;
+            MG_State::GLState::ITextureObject* texture = nullptr;
+            const MG_State::GLState::SamplerObject* sampler = nullptr;
+            SamplerNumericDomain numericDomain = SamplerNumericDomain::Unknown;
         };
 
         Bool Initialize(VkDevice device, VkBufferManager* bufferManager,
@@ -79,6 +90,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Bool CollectStorageImageTextures(const MG_State::GLState::ProgramObject& program,
                                          const ProgramFactory::VkProgramObject& programObj,
                                          Vector<MG_State::GLState::ITextureObject*>& outTextures) const;
+        Bool CollectSamplerImageFeedback(
+            const MG_State::GLState::ProgramObject& program,
+            const ProgramFactory::VkProgramObject& programObj,
+            Vector<SamplerImageFeedbackBinding>& outBindings) const;
+        static Bool SamplerOverlapsWritableImageSubresource(Int samplerBaseLevel, Int samplerMaxLevel,
+                                                             GLint imageLevel, GLenum imageAccess);
         // samplerDescriptorsUnchangedHint: the caller (SetupDraw fast path) proved that
         // every input of every combined-image-sampler resolution is unchanged since the
         // previous draw's resolve - same (texture, sampler) per binding, texture params
@@ -91,7 +108,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                        Uint32 frameIndex,
                                        VkPipelineBindPoint bindPoint = VK_PIPELINE_BIND_POINT_GRAPHICS,
                                        const SamplerBindingOverride* samplerBindingOverride = nullptr,
-                                       Bool samplerDescriptorsUnchangedHint = false);
+                                       Bool samplerDescriptorsUnchangedHint = false,
+                                       const Vector<SamplerBindingOverride>* samplerBindingOverrides = nullptr);
 
         // Pure format-policy helper kept public for host regression tests. Formatted storage
         // images use their shader qualifier; transformed float images use glBindImageTexture's
@@ -114,6 +132,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             VkDescriptorPool handle = VK_NULL_HANDLE;
             Uint32 maxSets = 0;
             Uint32 allocatedSets = 0;
+            Bool updateAfterBind = false;
         };
 
         // A cached descriptor set together with the pool it was allocated from, so a
@@ -223,8 +242,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         void BindDescriptorSetDeduped(VkCommandBuffer commandBuffer, VkPipelineBindPoint bindPoint,
                                       VkPipelineLayout pipelineLayout, VkDescriptorSet descriptorSet,
                                       const Vector<Uint32>& dynamicOffsets);
-        Bool CreateDescriptorPool(Uint32 maxSets, VkDescriptorPool& outPool) const;
-        Bool GrowFrameDescriptorPool(FrameResources& frame, Uint32 frameIndex);
+        Bool CreateDescriptorPool(Uint32 maxSets, Bool updateAfterBind, VkDescriptorPool& outPool) const;
+        Bool GrowFrameDescriptorPool(FrameResources& frame, Uint32 frameIndex, Bool updateAfterBind);
         VkResult AllocateDescriptorSetsFromActivePool(
             Uint32 frameIndex, const ProgramFactory::VkProgramObject& programObj, VkDescriptorSet& outDescriptorSet);
         VkResult AcquireDescriptorSet(Uint32 frameIndex,
@@ -341,8 +360,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // lifetime id, so a freed-and-reallocated sampler or texture at the same heap address
         // always gets a fresh id and misses (a raw pointer would false-hit that ABA) - so a
         // stale guess can only miss and fall through to the hash, never resolve wrong. Still
-        // reset each frame alongside the descriptor-set cache. Indexed by binding.
+        // reset each frame alongside the descriptor-set cache. Indexed by binding, but the
+        // whole-descriptor entry is additionally keyed by program lifetime: Vulkan binding
+        // numbers are layout-local and unrelated programs routinely reuse binding 0/1.
         struct SamplerResolveMemo {
+            Uint64 infoProgramLifetimeId = 0;
             Uint64 samplerLifetimeId = 0;
             Uint64 textureLifetimeId = 0;
             VkSampler sampler = VK_NULL_HANDLE;

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.cpp

@@ -8,6 +8,7 @@
 
 #include "VertexInputStateFactory.h"
 #include "MG_Util/Converters/MGToStr/DataTypeConverter.h"
+#include <MG_Backend/BackendObjects.h>
 #include <utility>
 
 namespace MobileGL::MG_Backend::DirectVulkan {
@@ -107,8 +108,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 continue;
             }
 
-            const VkFormat sourceVkFormat =
+            VkFormat sourceVkFormat =
                 ToVkVertexFormat(attr.Type, attr.Size, attr.Normalized, attr.IsInteger, attr.IsBgra, attr.IsLong);
+            VertexStreamConversion conversion = VertexStreamConversion::None;
+            // Gated on the SAME flag ToVkVertexFormat gates its 64-bit path on, and that is
+            // load-bearing rather than belt-and-braces: the narrowing is only correct because
+            // DemoteFloat64Pass already turned the shader's `dvec` input into a `vec`, and that
+            // pass runs precisely when the backend declares no 64-bit vertex support. With the
+            // flag set, a dvec3/dvec4 is declined by ToVkVertexFormat AND left 64-bit in the
+            // module, so a float32 stream would be fed to a Float64 input.
+            const Bool narrowFloat64Arrays =
+                MG_Backend::pActiveBackendObject == nullptr ||
+                !MG_Backend::pActiveBackendObject->GetDynamicParameters().SupportsFloat64VertexAttributes;
+            if (sourceVkFormat == VK_FORMAT_UNDEFINED && attr.Type == DataType::Float64 && narrowFloat64Arrays) {
+                // No native 64-bit fetch here (see ToVkVertexFormat's Float64 case), but the
+                // source bytes are ordinary IEEE-754 doubles and DemoteFloat64Pass has already
+                // narrowed every dvec input to a vec, so the array is narrowed to match rather
+                // than dropped. Mirrors what DirectGLES does for the same state.
+                const VkFormat narrowedFormat = ToFloat32VertexFormat(attr.Size);
+                if (narrowedFormat != VK_FORMAT_UNDEFINED && SupportsVertexBufferFormat(narrowedFormat)) {
+                    sourceVkFormat = narrowedFormat;
+                    conversion = VertexStreamConversion::Float64ToFloat32;
+                    MGLOG_W_ONCE("Vertex attribute location=%u is a 64-bit (GL_DOUBLE) array; fetching it at "
+                            "float32 precision through format=%d (size=%d long=%s)",
+                            location, static_cast<Int>(narrowedFormat), attr.Size, attr.IsLong ? "true" : "false");
+                }
+            }
             if (sourceVkFormat == VK_FORMAT_UNDEFINED) {
                 MGLOG_E_ONCE("Unsupported vertex attribute layout (location=%u, type=%s, size=%d): the array is "
                         "enabled but cannot be mapped to a VkFormat",
@@ -118,8 +143,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
 
             VkFormat vkFormat = sourceVkFormat;
-            VertexStreamConversion conversion = VertexStreamConversion::None;
-            if (!SupportsVertexBufferFormat(vkFormat)) {
+            if (conversion == VertexStreamConversion::None && !SupportsVertexBufferFormat(vkFormat)) {
                 if (IsScaledIntegerVertexFormat(vkFormat)) {
                     const VkFormat fallbackFormat = ToFloat32VertexFormat(attr.Size);
                     if (fallbackFormat != VK_FORMAT_UNDEFINED && SupportsVertexBufferFormat(fallbackFormat)) {
@@ -188,7 +212,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             if (sourceStride != 0) {
                 if (conversion == VertexStreamConversion::Repack) {
                     stride = static_cast<Uint32>(attribByteSize);
-                } else if (conversion == VertexStreamConversion::ScaledIntegerToFloat32) {
+                } else if (conversion == VertexStreamConversion::ScaledIntegerToFloat32 ||
+                           conversion == VertexStreamConversion::Float64ToFloat32) {
                     stride = static_cast<Uint32>(attr.Size * static_cast<Int>(sizeof(Float)));
                 }
             }
@@ -287,8 +312,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             if (m_frameBoundaryCounter - it->second->lastUsedFrameBoundary > kRetireAgeBoundaries) {
                 it = m_cache.erase(it);
                 // Invalidate every VAO's state-pointer memo: the erased node's
-                // address may be reused by a future insert.
-                ++m_evictionEpoch;
+                // address may be reused by a future insert. Advance through the
+                // process-wide source so the value stays unique across factory
+                // instances (see the member comment).
+                m_evictionEpoch = ++s_evictionEpochSource;
             } else {
                 ++it;
             }
@@ -328,6 +355,20 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // for every R64 float format, so a native 64-bit vertex fetch is simply unavailable there
             // while shaderFloat64 is not. Both halves key off nothing but the attribute being long,
             // so they always agree without extra plumbing.
+            //
+            // ... as long as the shader half still runs. It does not when the backend has declared
+            // no 64-bit vertex attribute support: DemoteFloat64Pass has already narrowed every
+            // `dvec` input to a `vec` by then, so PackDoubleVertexInputsPass finds nothing to pack
+            // and a UINT-formatted attribute would be fed to a float input - garbage with no
+            // diagnostic anywhere. Declining here hands the attribute to the caller's
+            // Float64ToFloat32 fallback instead, which narrows the source doubles to match the
+            // demoted `vec` input - the same thing DirectGLES does for the same state. The
+            // frontend RECORDS the format either way, so this gate is the only thing standing
+            // between a legal glVertexAttribLFormat and a mismatched pipeline.
+            if (MG_Backend::pActiveBackendObject == nullptr ||
+                !MG_Backend::pActiveBackendObject->GetDynamicParameters().SupportsFloat64VertexAttributes) {
+                return VK_FORMAT_UNDEFINED;
+            }
             if (!isLong || isInteger || normalized) return VK_FORMAT_UNDEFINED;
             switch (size) {
             case 1: return VK_FORMAT_R32G32_UINT;

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.h

@@ -23,6 +23,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             None = 0,
             Repack,
             ScaledIntegerToFloat32,
+            // GL_DOUBLE source data narrowed to a tightly packed float32 stream: the fetch half
+            // of the fp64 demotion the shader side already does unconditionally.
+            Float64ToFloat32,
         };
 
         struct BackendVertexInputState {
@@ -125,7 +128,17 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // construction); a memo is honored only while its recorded epoch
         // matches, so an evicted entry can never be dereferenced through a
         // stale memo.
-        Uint64 m_evictionEpoch = 1;
+        //
+        // Drawn from a process-wide source, never a per-instance counter: the VAO
+        // memos outlive this factory (they live on pGLContext's VAOs, the renderer
+        // is destroyed and recreated on EGL surface release/re-create), so a fresh
+        // factory restarting at a dead factory's epoch value would honor its
+        // dangling entry pointers. The constructor takes a value strictly greater
+        // than anything a predecessor ever stamped, so a dead factory's memo can
+        // never compare equal here - the same never-reused idiom as the lifetime ids.
+        // Single-threaded like the rest of the factory (renderer-thread only).
+        static inline Uint64 s_evictionEpochSource = 0;
+        Uint64 m_evictionEpoch = ++s_evictionEpochSource;
         static inline XXH64_state_t* m_hashState = XXH64_createState();
     };
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/VkClearManager.cpp

@@ -166,7 +166,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void VkClearManager::MergeClearPayload(ClearAttachmentPayload& dst, const ClearAttachmentPayload& src) {
         dst.mask |= src.mask;
         if ((src.mask & GL_COLOR_BUFFER_BIT) != 0) {
+            // The whole colour story travels together (same rule as
+            // VkRenderPassManager::QueueRenderbufferClear): a glClearBufferiv/uiv
+            // payload carries its value in colorInt/colorUint and its branch selector
+            // in colorEncoding - dropping them here would leave the pending clear
+            // reading as an all-zero float one.
             dst.color = src.color;
+            dst.colorEncoding = src.colorEncoding;
+            dst.colorInt = src.colorInt;
+            dst.colorUint = src.colorUint;
         }
         if ((src.mask & GL_DEPTH_BUFFER_BIT) != 0) {
             dst.depth = src.depth;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.cpp

@@ -831,6 +831,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // recreated since (texture + renderbuffer image epochs), and no pending clear (which alters
         // load ops). Any of these differing forces the full recompute below. Portable to VK 1.1.
         if (activeRenderPass != nullptr && m_rpFastValid && m_rpFastFbo == &fbo &&
+            m_rpFastFboLifetimeId == fbo.GetLifetimeId() &&
             m_rpFastFboVersion == fbo.GetObjectVersion() && m_rpFastSwapchainIndex == swapchainImageIndex &&
             m_rpFastTexEpoch == m_textureManager.GetTextureImageEpoch() &&
             m_rpFastRbEpoch == m_renderbufferImageEpoch &&
@@ -855,6 +856,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // epochs AFTER ComputeHash: its attachment SyncTexture can create an image (bump the epoch).
             m_rpFastValid = true;
             m_rpFastFbo = &fbo;
+            m_rpFastFboLifetimeId = fbo.GetLifetimeId();
             m_rpFastFboVersion = fbo.GetObjectVersion();
             m_rpFastSwapchainIndex = swapchainImageIndex;
             m_rpFastTexEpoch = m_textureManager.GetTextureImageEpoch();
@@ -1507,7 +1509,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             ClearAttachmentPayload clearPayload{};
             SharedPtr<MG_State::GLState::ITextureObject> liveTexture;
             if (pending.hasInlinePayload) {
-                clearPayload = pending.inlinePayload;
+                // The inline payload was snapshotted when the entry was CREATED, but the
+                // clear VALUE is not part of the entry's hash - a cache hit with a newer
+                // glClear would replay the creation-time value and drop the new one (the
+                // texture path below is immune because it re-reads the live payload).
+                // Same defense as ClearAttachmentsOnActiveRenderPass: prefer the live
+                // pending clear, fall back to the snapshot only when none is queued.
+                if (s_renderPassManager != nullptr &&
+                    s_renderPassManager->GetPendingRenderbufferClear(pending.renderbuffer, clearPayload)) {
+                    if ((clearPayload.mask & GL_COLOR_BUFFER_BIT) != 0 && pending.renderbuffer != nullptr &&
+                        MG_Util::GetBaseInternalFormatComponentCount(pending.renderbuffer->GetInternalFormat()) ==
+                            3) {
+                        // RGB renderbuffers are backed by an RGBA image; the missing alpha reads as 1.
+                        ForceOpaqueClearAlpha(clearPayload);
+                    }
+                } else {
+                    clearPayload = pending.inlinePayload;
+                }
             } else {
                 if (pending.key.texture == nullptr ||
                     !s_clearManager->GetPendingClear(pending.key, clearPayload, liveTexture)) {

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.h

@@ -289,6 +289,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // or a pending clear. Portable to Vulkan 1.1 (no dynamic_rendering / imageless FB needed).
         Bool m_rpFastValid = false;
         const MG_State::GLState::FramebufferObject* m_rpFastFbo = nullptr;
+        // The FBO's never-reused lifetime id joins the raw pointer + Uint16 version:
+        // a deleted FBO reallocated at the same address whose fresh setup performed
+        // the same number of version bumps would otherwise compare equal (both count
+        // from 0), serving the dead framebuffer's pass to the new object.
+        Uint64 m_rpFastFboLifetimeId = 0;
         Uint16 m_rpFastFboVersion = 0;
         Uint32 m_rpFastSwapchainIndex = 0;
         Uint64 m_rpFastTexEpoch = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp

@@ -1291,6 +1291,158 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return ok;
     }
 
+    Bool VkTextureManager::SnapshotTextureForSampling(VkCommandBuffer commandBuffer,
+                                                      MG_State::GLState::ITextureObject& texture,
+                                                      SamplerNumericDomain numericDomain,
+                                                      VkPipelineStageFlags consumerShaderStageMask,
+                                                      SampledTextureSnapshot& outSnapshot) {
+        outSnapshot = {};
+        TextureResource* source = SyncTextureAndGetDescriptor(texture);
+        if (source == nullptr || source->image == VK_NULL_HANDLE || source->sampleCount != VK_SAMPLE_COUNT_1_BIT ||
+            source->sampledLevelCount == 0) {
+            return false;
+        }
+
+        const VkFormat sampledFormat = ResolveSampledImageViewFormat(source->format, numericDomain);
+        if (sampledFormat == VK_FORMAT_UNDEFINED ||
+            !AreSampledImageViewFormatsCompatible(source->format, sampledFormat)) {
+            MGLOG_E_ONCE("SnapshotTextureForSampling: textureId=%d cannot create sampled view format=%d from image format=%d",
+                         texture.GetExternalIndex(), static_cast<Int>(sampledFormat), static_cast<Int>(source->format));
+            return false;
+        }
+        if (sampledFormat != source->format &&
+            (source->imageCreateFlags & VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT) == 0) {
+            MGLOG_E_ONCE("SnapshotTextureForSampling: textureId=%d needs unavailable mutable image format=%d for sampled view=%d",
+                         texture.GetExternalIndex(), static_cast<Int>(source->format), static_cast<Int>(sampledFormat));
+            return false;
+        }
+
+        VkImageType imageType = VK_IMAGE_TYPE_2D;
+        switch (source->viewType) {
+        case VK_IMAGE_VIEW_TYPE_1D:
+        case VK_IMAGE_VIEW_TYPE_1D_ARRAY:
+            imageType = VK_IMAGE_TYPE_1D;
+            break;
+        case VK_IMAGE_VIEW_TYPE_3D:
+            imageType = VK_IMAGE_TYPE_3D;
+            break;
+        default:
+            break;
+        }
+
+        TextureResource snapshot{};
+        VkImageCreateInfo imageInfo{};
+        imageInfo.sType = VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO;
+        imageInfo.flags = source->imageCreateFlags;
+        imageInfo.imageType = imageType;
+        imageInfo.extent = {source->extent.width, source->extent.height, source->depth};
+        imageInfo.mipLevels = source->mipLevels;
+        imageInfo.arrayLayers = source->arrayLayers;
+        imageInfo.format = source->format;
+        imageInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+        imageInfo.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+        imageInfo.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_SAMPLED_BIT;
+        imageInfo.samples = VK_SAMPLE_COUNT_1_BIT;
+        imageInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
+
+        // Keep the temporary's view-format list just as narrow as the source's sampler use. This
+        // has no storage-image usage, so unlike an app image binding the exact list is knowable.
+        Vector<VkFormat> viewFormats;
+        VkImageFormatListCreateInfo formatListInfo{};
+        if (m_imageFormatListSupported && (imageInfo.flags & VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT) != 0) {
+            viewFormats.push_back(source->format);
+            if (sampledFormat != source->format) {
+                viewFormats.push_back(sampledFormat);
+            }
+            formatListInfo.sType = VK_STRUCTURE_TYPE_IMAGE_FORMAT_LIST_CREATE_INFO;
+            formatListInfo.viewFormatCount = static_cast<Uint32>(viewFormats.size());
+            formatListInfo.pViewFormats = viewFormats.data();
+            imageInfo.pNext = &formatListInfo;
+        }
+
+        VmaAllocationCreateInfo allocationInfo{};
+        allocationInfo.usage = VMA_MEMORY_USAGE_AUTO_PREFER_DEVICE;
+        allocationInfo.requiredFlags = VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT;
+        const VkResult createResult =
+            vmaCreateImage(m_allocator, &imageInfo, &allocationInfo, &snapshot.image, &snapshot.allocation, nullptr);
+        if (createResult != VK_SUCCESS) {
+            MGLOG_E_ONCE("SnapshotTextureForSampling: vmaCreateImage failed result=%d textureId=%d", createResult,
+                         texture.GetExternalIndex());
+            return false;
+        }
+
+        snapshot.extent = source->extent;
+        snapshot.depth = source->depth;
+        snapshot.arrayLayers = source->arrayLayers;
+        snapshot.mipLevels = source->mipLevels;
+        snapshot.sampledBaseMipLevel = source->sampledBaseMipLevel;
+        snapshot.sampledLevelCount = source->sampledLevelCount;
+        snapshot.format = source->format;
+        snapshot.aspect = source->aspect;
+        snapshot.viewType = source->viewType;
+        snapshot.sampleCount = VK_SAMPLE_COUNT_1_BIT;
+        snapshot.imageCreateFlags = imageInfo.flags;
+        snapshot.usageFlags = imageInfo.usage;
+
+        const TextureFormatInfo formatInfo = ResolveTextureFormatInfo(texture.GetFormat());
+        const VkComponentMapping sampledComponents = ResolveSampledViewComponents(texture, formatInfo);
+        const VkImageAspectFlags sampledAspect =
+            ResolveSampledImageViewAspectMask(snapshot.aspect, texture.GetDepthStencilTextureMode());
+        snapshot.sampledView = CreateImageView(snapshot.image, sampledFormat, sampledAspect, snapshot.viewType,
+                                               snapshot.sampledBaseMipLevel, snapshot.sampledLevelCount, 0,
+                                               snapshot.arrayLayers, &sampledComponents);
+        if (snapshot.sampledView == VK_NULL_HANDLE) {
+            MGLOG_E_ONCE("SnapshotTextureForSampling: failed to create sampled view textureId=%d", texture.GetExternalIndex());
+            return false;
+        }
+
+        VkPipelineStageFlags sourceStageMask = VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT;
+        VkAccessFlags sourceAccessMask = 0;
+        const VkImageLayout sourceLayout = source->layout;
+        GetImageTransitionSourceState(sourceLayout, sourceStageMask, sourceAccessMask);
+        if (!TransitionImageLayout(commandBuffer, source->image, source->layout, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL,
+                                   sourceStageMask, VK_PIPELINE_STAGE_TRANSFER_BIT, sourceAccessMask,
+                                   VK_ACCESS_TRANSFER_READ_BIT, source->aspect, 0, source->mipLevels) ||
+            !TransitionImageLayout(commandBuffer, snapshot.image, snapshot.layout, VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL,
+                                   VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0,
+                                   VK_ACCESS_TRANSFER_WRITE_BIT, snapshot.aspect, snapshot.sampledBaseMipLevel,
+                                   snapshot.sampledLevelCount)) {
+            return false;
+        }
+
+        Vector<VkImageCopy> copyRegions;
+        copyRegions.reserve(snapshot.sampledLevelCount);
+        for (Uint32 level = snapshot.sampledBaseMipLevel;
+             level < snapshot.sampledBaseMipLevel + snapshot.sampledLevelCount; ++level) {
+            VkImageCopy copy{};
+            copy.srcSubresource = {source->aspect, level, 0, source->arrayLayers};
+            copy.dstSubresource = {snapshot.aspect, level, 0, snapshot.arrayLayers};
+            copy.extent = {std::max(source->extent.width >> level, 1u),
+                           std::max(source->extent.height >> level, 1u),
+                           std::max(source->depth >> level, 1u)};
+            copyRegions.push_back(copy);
+        }
+        vkCmdCopyImage(commandBuffer, source->image, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, snapshot.image,
+                       VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL, static_cast<Uint32>(copyRegions.size()), copyRegions.data());
+
+        if (!TransitionImageLayout(commandBuffer, snapshot.image, snapshot.layout,
+                                   ResolveSampledReadOnlyLayout(snapshot.aspect), VK_PIPELINE_STAGE_TRANSFER_BIT,
+                                   consumerShaderStageMask, VK_ACCESS_TRANSFER_WRITE_BIT,
+                                   VK_ACCESS_SHADER_READ_BIT, snapshot.aspect, snapshot.sampledBaseMipLevel,
+                                   snapshot.sampledLevelCount) ||
+            !TransitionImageLayout(commandBuffer, source->image, source->layout, sourceLayout,
+                                   VK_PIPELINE_STAGE_TRANSFER_BIT, consumerShaderStageMask,
+                                   VK_ACCESS_TRANSFER_READ_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT,
+                                   source->aspect, 0, source->mipLevels)) {
+            return false;
+        }
+
+        StampResourceRecordingUse(*source);
+        outSnapshot = {.imageView = snapshot.sampledView, .layout = snapshot.layout};
+        DeferResourceRelease(Move(snapshot));
+        return true;
+    }
+
     void VkTextureManager::MarkStorageImageTexture(MG_State::GLState::ITextureObject& texture) {
         m_storageImageTextures.insert(MakeTextureIdentity(&texture));
     }
@@ -1342,6 +1494,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const auto* mipTexture = MG_State::GLState::AsMipmapTexture(&texture);
         const Uint32 mipLevelCount = mipTexture != nullptr ? mipTexture->GetMipmapLevelCount() : 0u;
         return resource.syncedContentVersion != texture.GetContentVersion() ||
+               resource.syncedShapeVersion != texture.GetShapeVersion() ||
                resource.syncedTextureParamsVersion != texture.GetTextureParamsVersion() ||
                resource.syncedMipLevelCount != mipLevelCount;
     }
@@ -1441,11 +1594,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     Bool VkTextureManager::SyncTexture(MG_State::GLState::ITextureObject &texture,
                                        TextureResource &outResource) {
         // Cross-draw fast path: if the resource is already built and neither the texture's
-        // pixel content (bumped in MarkStorageDirty) nor its params changed since the last
-        // sync, there is nothing to re-check or re-upload - skip CheckMipmapCompleteness,
-        // SyncTextureResource, SyncTextureViews and the per-level dirty scan. Layout is
-        // maintained separately by the transition path, so the resource still reflects truth.
+        // pixel content (bumped in MarkStorageDirty), its SHAPE (bumped in BumpShapeVersion)
+        // nor its params changed since the last sync, there is nothing to re-check or
+        // re-upload - skip CheckMipmapCompleteness, SyncTextureResource, SyncTextureViews and
+        // the per-level dirty scan. Layout is maintained separately by the transition path, so
+        // the resource still reflects truth. The shape version is NOT redundant with the
+        // content one: glTexImage2D(..., nullptr) re-specifies a level's size or format
+        // without dirtying a texel, which is exactly how a re-specified image-unit texture used
+        // to keep reporting its old imageSize().
         const Uint64 syncingContentVersion = texture.GetContentVersion();
+        const Uint64 syncingShapeVersion = texture.GetShapeVersion();
         const auto* syncingMipTexture = MG_State::GLState::AsMipmapTexture(&texture);
         const Uint32 syncingMipLevelCount =
             syncingMipTexture != nullptr ? syncingMipTexture->GetMipmapLevelCount() : 0u;
@@ -1457,6 +1615,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             m_storageImageTextures.find(MakeTextureIdentity(&texture)) != m_storageImageTextures.end();
         if (outResource.image != VK_NULL_HANDLE && !storageUpgradePending &&
             outResource.syncedContentVersion == syncingContentVersion &&
+            outResource.syncedShapeVersion == syncingShapeVersion &&
             outResource.syncedTextureParamsVersion == texture.GetTextureParamsVersion() &&
             outResource.syncedMipLevelCount == syncingMipLevelCount) {
             return true;
@@ -1477,6 +1636,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
 
+        // From here down the size is VULKAN geometry, not GL's: a 1D array's layer count moves
+        // out of the height it occupies GL-side and into z, which is the slot
+        // TryResolveTextureShapeInfo reads arrayLayers from and the only one that leaves
+        // extent.height at the 1 a VK_IMAGE_TYPE_1D image is required to have.
+        texelSize = ToVulkanLevelExtent(texture.GetTarget(), texelSize);
+
         if (!SyncTextureResource(texture, uploadTarget, texelSize, byteSize, mipLevelCount, outResource)) {
             MGLOG_D("%s: SyncTextureResource failed", __func__);
             return false;
@@ -1508,6 +1673,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (!hasDirtyMipLevel) {
             outResource.syncedContentVersion = syncingContentVersion;
             outResource.syncedMipLevelCount = syncingMipLevelCount;
+            outResource.syncedShapeVersion = syncingShapeVersion;
             return true;
         }
 
@@ -1517,6 +1683,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
         outResource.syncedContentVersion = syncingContentVersion;
         outResource.syncedMipLevelCount = syncingMipLevelCount;
+        outResource.syncedShapeVersion = syncingShapeVersion;
         return true;
     }
 
@@ -1696,6 +1863,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         }
                     }
                 }
+                if (rounded == 0 && (supported & VK_SAMPLE_COUNT_1_BIT) != 0) {
+                    // Nothing at two samples or above. Reachable because the frontend validates
+                    // multisample allocations against the count MobileGL ADVERTISES (GL requires
+                    // GL_MAX_SAMPLES >= 4) rather than against the device's per-format support, so
+                    // a format this device cannot multisample at all now gets here instead of
+                    // being refused up front. Keeping the unsupported count would hand
+                    // vkCreateImage an invalid VkImageCreateInfo; one sample is at least a legal
+                    // image, and the samples-08726 hazard above is the lesser of the two.
+                    MGLOG_W_ONCE("Multisample texture format %d supports no count above one on this device; "
+                                 "backing it with a single sample",
+                                 static_cast<Int>(format));
+                    rounded = static_cast<Uint32>(VK_SAMPLE_COUNT_1_BIT);
+                }
                 if (rounded != 0) {
                     resolvedSampleCount = static_cast<VkSampleCountFlagBits>(rounded);
                 }
@@ -1841,6 +2021,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         texture.GetExternalIndex(),
                         MG_Util::ConvertTextureUploadTargetToString(uploadTarget).c_str(),
                         static_cast<Int>(format), static_cast<Uint32>(imageInfo.usage));
+                // The preserved image was written by GPU work that may still be in flight
+                // (preserve requires layout != UNDEFINED); park it on the deferred ring
+                // like every other destruction path instead of letting the unique_ptr
+                // destroy it synchronously under the GPU.
+                if (preservedResource) {
+                    DeferResourceRelease(Move(*preservedResource));
+                }
                 return false;
             }
         }
@@ -1863,6 +2050,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     static_cast<Int>(imageInfo.samples), static_cast<Int>(imageInfo.format));
             resource.image = VK_NULL_HANDLE;
             resource.allocation = nullptr;
+            // Same as the probe failure above: the preserved live image must go through
+            // the deferred ring, never a synchronous destructor while frames that
+            // reference it are still in flight.
+            if (preservedResource) {
+                DeferResourceRelease(Move(*preservedResource));
+            }
             return false;
         }
         ++m_textureImageEpoch; // a new attachment image invalidates cached render passes
@@ -2358,7 +2551,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 uploadItem.target = target;
                 uploadItem.level = level;
                 uploadItem.baseArrayLayer = ResolveUploadArrayLayer(target);
-                uploadItem.texelSize = texelSize;
+                // Vulkan geometry, like the image this stages into (see SyncTexture): a 1D
+                // array's layers move from y to z, where the copy loop's depthSelectsArrayLayer
+                // branch turns them into layerCount. The shadow needs no repacking to follow -
+                // one layer of a 1D array IS one row of `width` texels, so the tight-packed
+                // per-layer copy the swapped size describes reads the same bytes in the same
+                // order as the row-major level it replaces.
+                uploadItem.texelSize = ToVulkanLevelExtent(mipmapTexture.GetTarget(), texelSize);
                 uploadItem.source = source;
                 uploadItem.offset = stagingSize;
                 uploadItem.uploadByteSize = byteSize;
@@ -2396,6 +2595,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                             }
                             uploadItem.uploadByteSize = rectTexels * uploadItem.texelBytes;
                         }
+                        // The boxes came out of the shadow in GL coordinates, where a 1D
+                        // array's layer is the y. They have to follow texelSize across to z or
+                        // they would address rows of an image that now has exactly one, and
+                        // the staging walk would read the wrong bytes for them. Every byte
+                        // count computed above is a product of the three extents, so moving
+                        // the axes leaves all of them alone - and an OFFSET lands on a zero y,
+                        // not on the extent's one, which is why this is spelled out rather than
+                        // handed to ToVulkanLevelExtent.
+                        if (mipmapTexture.GetTarget() == TextureTarget::Texture1DArray) {
+                            uploadItem.regionLo = {uploadItem.regionLo.x(), 0, uploadItem.regionLo.y()};
+                            uploadItem.regionSize = {uploadItem.regionSize.x(), 1,
+                                                     uploadItem.regionSize.y()};
+                            for (auto& rect : uploadItem.rects) {
+                                rect.lo = {rect.lo.x(), 0, rect.lo.y()};
+                                rect.hi = {rect.hi.x(), 1, rect.hi.y()};
+                            }
+                        }
                     }
                 }
                 if (formatInfo.expandRgbToRgba) {

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.h

@@ -22,6 +22,25 @@ class ITextureObject;
 namespace MobileGL::MG_Backend::DirectVulkan {
 enum class SamplerNumericDomain : Uint8;
 
+// A GL 1D-ARRAY level keeps its LAYER COUNT in the state-side HEIGHT: that is what
+// glTexImage2D(GL_TEXTURE_1D_ARRAY, width, layers) means, and the frontend records the level
+// as {width, layers, 1} (see GL_Texture.cpp's AllocateStorage and the completeness walk in
+// TextureObject.cpp, which shrinks only x down the chain). Vulkan packs it the other way: a
+// 1D array is a VK_IMAGE_TYPE_1D image whose extent.height MUST be 1 and whose layers live in
+// arrayLayers - i.e. in the slot this backend reads out of z. So every place that turns a GL
+// level size into Vulkan image geometry has to move the count across first, and every GL-space
+// sub-box that rides along with it has to move its y the same way. DirectGLES performs the
+// identical remap onto the ES 2D array it maps 1D arrays to (GetBackendUploadSize).
+//
+// Applied to nothing else: a 2D array, a cube array and a 3D texture all already carry their
+// depth/layer count in z, which is where the Vulkan side expects it.
+inline IntVec3 ToVulkanLevelExtent(TextureTarget stateTarget, const IntVec3& glTexelSize) {
+    if (stateTarget == TextureTarget::Texture1DArray) {
+        return {glTexelSize.x(), 1, glTexelSize.y()};
+    }
+    return glTexelSize;
+}
+
 class VkTextureManager {
 public:
     // Monotonic epoch bumped whenever a texture VkImage is (re)created. The render-pass
@@ -206,6 +225,12 @@ public:
         // as defense-in-depth: any path that grows the level set (which resizes the sampled view)
         // busts the skip even if it failed to bump the content version.
         Uint32 syncedMipLevelCount = 0;
+        // Snapshot of ITextureObject::GetShapeVersion() at the last successful sync. The content
+        // version alone does NOT cover a re-specification: glTexImage2D(..., nullptr) on an
+        // already-defined level changes its size or format and dirties no texel, so it moves the
+        // shape version and nothing else. Without this in the early-out key the image, its views
+        // and therefore imageSize() all keep answering with the texture's PREVIOUS shape.
+        Uint64 syncedShapeVersion = 0;
 
         TextureResource() = default;
         TextureResource(const TextureResource&) = delete;
@@ -237,6 +262,7 @@ public:
             std::swap(this->lastRecordingGeneration, that.lastRecordingGeneration);
             std::swap(this->syncedContentVersion, that.syncedContentVersion);
             std::swap(this->syncedMipLevelCount, that.syncedMipLevelCount);
+            std::swap(this->syncedShapeVersion, that.syncedShapeVersion);
         }
 
         void Reset() {
@@ -300,6 +326,7 @@ public:
             syncedTextureParamsVersion = 0;
             syncedContentVersion = 0;
             syncedMipLevelCount = 0;
+            syncedShapeVersion = 0;
         }
 
         ~TextureResource() {
@@ -310,6 +337,11 @@ public:
         static inline VmaAllocator s_allocator = VK_NULL_HANDLE;
     };
 
+    struct SampledTextureSnapshot {
+        VkImageView imageView = VK_NULL_HANDLE;
+        VkImageLayout layout = VK_IMAGE_LAYOUT_UNDEFINED;
+    };
+
     Bool Initialize(const InitInfo& initInfo);
     void Shutdown();
     void BeginFrame(Uint32 frameIndex);
@@ -343,6 +375,13 @@ public:
                                                       VkImageLayout newLayout);
     Bool TransitionTextureForSampling(VkCommandBuffer commandBuffer, MG_State::GLState::ITextureObject& texture);
     Bool TransitionTextureForStorageImage(VkCommandBuffer commandBuffer, MG_State::GLState::ITextureObject& texture);
+    // Copies the complete sampler-visible mip range into a transient sampled image. The source is
+    // restored to its prior layout, so image-store descriptors continue to name the original image.
+    // The transient ownership is tied to the current frame slot and is safe through its submission.
+    Bool SnapshotTextureForSampling(VkCommandBuffer commandBuffer, MG_State::GLState::ITextureObject& texture,
+                                    SamplerNumericDomain numericDomain,
+                                    VkPipelineStageFlags consumerShaderStageMask,
+                                    SampledTextureSnapshot& outSnapshot);
 
     // Recording-generation bookkeeping for the pre-pass command stream. The
     // generation advances every time the frame command buffer (re)begins

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.h

@@ -23,6 +23,7 @@
 #include "VkTimerQueryManager.h"
 #include "MG_Util/Math/VectorTypes.h"
 #include <Includes.h>
+#include <MG_Backend/BackendObject.h>
 #include <vk_mem_alloc.h>
 
 #include "../VkIncludes.h"
@@ -197,9 +198,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                   GLbitfield mask, GLenum filter);
         void CopyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset,
                        GLint x, GLint y, GLsizei width, GLsizei height);
-        void CopyImageSubData(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
+        void CopyImageSubData(const CopyImageEndpoint& srcEndpoint,
                               GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
-                              const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
+                              const CopyImageEndpoint& dstEndpoint,
                               GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                               GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth);
         void GenerateMipmap(GLenum target);
@@ -216,10 +217,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // depth/stencil image, which this renderer stores display-side-up: the copy rect then
         // has to be mapped out of GL's bottom-origin space and the copied rows re-oriented on
         // the way back, exactly as the colour ReadPixels path does.
+        // `sourceLayerCount` above 1 says the `height` rows the client is owed are stored as that
+        // many ARRAY LAYERS of a one-row image rather than as rows of one layer - the shape a GL
+        // 1D array has in Vulkan. The two produce byte-identical tightly-packed readbacks, so
+        // only the copy region differs; everything after it is written against `height`.
         void ReadDepthStencilImageToClient(VkImage image, VkFormat vkFormat, VkImageLayout* trackedLayout,
                                            VkImageAspectFlags imageAspect, Uint32 mipLevel, Uint32 baseArrayLayer,
                                            GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type,
-                                           void* pixels, Bool defaultFramebufferOrientation = false);
+                                           void* pixels, Bool defaultFramebufferOrientation = false,
+                                           Uint32 sourceLayerCount = 1);
         // Same-extent depth blit between images of different depth formats: host
         // round-trip with a per-texel re-encode (see BlitNamedFramebuffer).
         Bool BlitDepthAcrossFormats(FrameContext::FrameData& frame, VkImage srcImage, VkFormat srcFormat,
@@ -229,6 +235,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                     GLint dstY, GLint width, GLint height, VkImageLayout srcRestoreLayout,
                                     VkImageLayout dstRestoreLayout, Bool stencilAspect);
         static SizeT GetReadbackTexelSize(VkFormat sourceFormat);
+        // Map a GL bottom-left-origin rectangle into the display-oriented swapchain image.
+        // Quarter-turn surface transforms swap the copy extent's axes.
+        static Bool MapDefaultFramebufferReadbackRect(GLint x, GLint y, GLsizei width, GLsizei height,
+                                                      VkExtent2D imageExtent,
+                                                      VkSurfaceTransformFlagBitsKHR preTransform,
+                                                      VkOffset2D* imageOffset, VkExtent2D* imageCopyExtent);
+        // Reorder a tightly packed block copied with MapDefaultFramebufferReadbackRect back into
+        // GL row order. The input block has swapped dimensions for 90/270 degree transforms.
+        static Bool RemapDefaultFramebufferReadback(const Uint8* rawPixels, Uint32 logicalWidth,
+                                                    Uint32 logicalHeight,
+                                                    VkSurfaceTransformFlagBitsKHR preTransform,
+                                                    SizeT texelSize, Uint8* outPixels);
         static Bool ConvertReadbackPixels(const Uint8* sourcePixels, VkFormat sourceFormat,
                                           GLsizei width, GLsizei height, GLenum destinationFormat,
                                           GLenum destinationType, SizeT destinationRowStride,
@@ -298,6 +316,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // The samplerAnisotropy device feature was granted, so GL_TEXTURE_MAX_ANISOTROPY_EXT is
         // honored rather than accepted-and-ignored.
         Bool IsSamplerAnisotropySupported() const { return m_samplerAnisotropyFeatureEnabled; }
+        // ARB_base_instance extends indirect command records with a non-zero firstInstance and
+        // requires gl_InstanceID to remain zero-based. Vulkan needs both features to honor that
+        // complete contract: one legalizes the command word, the other enables the shader rebase.
+        Bool IsNonZeroIndirectBaseInstanceSupported() const {
+            return m_drawIndirectFirstInstanceFeatureEnabled && m_shaderDrawParametersFeatureEnabled;
+        }
         // Ensures the frame command buffer is recording (same lazy pattern as
         // SetupDraw) and writes a bottom-of-pipe timestamp into the current
         // frame's pool. Null when unsupported or the pool is exhausted.
@@ -536,7 +560,20 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Bool m_samplerAnisotropyFeatureEnabled = false;
         Bool m_shaderDrawParametersExtensionEnabled = false;
         Bool m_shaderDrawParametersFeatureEnabled = false;
+        // Native subgroup topology, queried at device creation for the compute-module
+        // subgroup repairs (SubgroupSupportPolicy.h) and the REQUIRE_FULL_SUBGROUPS
+        // stage flag; 0 / false when the device has no usable compute subgroups or
+        // MOBILEGL_DISABLE_SUBGROUP forced them off.
+        Uint32 m_nativeSubgroupSize = 0;
+        Bool m_nativeSubgroupSupported = false;
+        Bool m_computeFullSubgroupsFeatureEnabled = false;
+        // VkPhysicalDeviceSubgroupSizeControlProperties::maxComputeWorkgroupSubgroups;
+        // 0 when the extension (and therefore the full-subgroups flag) is unavailable.
+        Uint32 m_maxComputeWorkgroupSubgroups = 0;
         Bool m_unformattedFloatStorageImagesEnabled = false;
+        // Set only after descriptor-indexing feature AND property queries prove that
+        // update-after-bind is legal for every descriptor category this renderer emits.
+        ProgramFactory::UpdateAfterBindLimits m_updateAfterBindLimits{};
         // fillModeNonSolid gates VK_POLYGON_MODE_LINE/_POINT (glPolygonMode); independentBlend gates
         // per-draw-buffer color write masks (glColorMaski). Both are cached at device creation and
         // drive a runtime fallback when the device lacks them.
@@ -776,6 +813,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Uint32 m_lastLodProgramVersion = 0;
         Uint64 m_lastLodBindGeneration = 0;
         Uint64 m_lastLodParamsSum = 0;
+        // Sampling-resolution generation at probe time. The probe reads the effective
+        // sampler's filters/aniso/LOD range, whose setters bump only this counter -
+        // the params-version sum above never moves for them.
+        Uint64 m_lastLodSamplingGeneration = 0;
         ProgramFactory::CompileOptionFlags m_lastLodBaseFlags = {};
         ProgramFactory::CompileOptionFlags m_lastLodResultFlags = {};
 
@@ -813,6 +854,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint64 vaoLifetimeId = 0;
             Uint32 vaoConfigVersion = 0;
             const void* drawFbo = nullptr;
+            // Never-reused lifetime id beside the raw pointer + Uint16 version: a
+            // deleted FBO recycled at the same address with the same fresh version
+            // count would otherwise compare equal (same ABA as the render-pass
+            // manager's fast-path memo).
+            Uint64 drawFboLifetimeId = 0;
             Uint16 fboVersion = 0;
             Bool drawFboIsDefault = false;
             Uint renderStateVersion = 0;
@@ -908,6 +954,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // already sampleable.
         Vector<VkTextureManager::TextureResource*> m_sampledResourcesScratch;
         Vector<MG_State::GLState::ITextureObject*> m_storageImageTexturesScratch;
+        Vector<UniformManager::SamplerImageFeedbackBinding> m_samplerImageFeedbackScratch;
+        Vector<UniformManager::SamplerBindingOverride> m_samplerImageBindingOverridesScratch;
         Vector<VkBuffer> m_vertexBuffersScratch;
         Vector<VkDeviceSize> m_vertexOffsetsScratch;
         Vector<VkVertexInputAttributeDescription> m_patchedAttributesScratch;
@@ -1034,6 +1082,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             VkBuffer indexVkBuffer = VK_NULL_HANDLE;
             VkDeviceSize indexSliceOffset = 0;
             Uint64 indexFrameSerial = 0;
+            // The EBO carried a host map when the slice was recorded - the mirror of
+            // anyBufferMapped on the vertex half. A shadow-backed (non-adopted)
+            // persistent map mutates its shadow with no API call and no epoch bump, so
+            // the one-compare rescue must decline and re-run the acquire, whose
+            // SyncPersistentMappedRange is the push-down. A map taken AFTER the record
+            // is already covered: AcquirePersistentMap bumps the slice epoch for the
+            // request itself, adopted or declined.
+            Bool indexBufferMapped = false;
 
             // Bound per draw (first bindingCount elements).
             VkBuffer vkBuffers[kMaxBindings] = {};
@@ -1127,6 +1183,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             FrameContext::FrameData& frame,
             const MG_State::GLState::ProgramObject& program,
             const ProgramFactory::VkProgramObject& programObj);
+        // Vulkan forbids a sampled descriptor and writable storage descriptor from naming the
+        // same image subresource in one shader operation. Snapshot only the sampler side; the
+        // storage descriptor continues to name the application texture.
+        Bool PrepareSamplerImageFeedbackSnapshots(
+            FrameContext::FrameData& frame,
+            const MG_State::GLState::ProgramObject& program,
+            const ProgramFactory::VkProgramObject& programObj,
+            VkPipelineStageFlags consumerShaderStageMask);
 
         // The per-draw dynamic-state tail (viewport, scissor, blend constants, depth
         // bias, line width, stencil), gated behind one render-state-parameters-version

MobileGL/MG_Backend/DirectVulkan/SubgroupSupportPolicy.h

@@ -0,0 +1,63 @@
+// MobileGL - MobileGL/MG_Backend/DirectVulkan/SubgroupSupportPolicy.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+
+#include <Config.h>
+#include <Includes.h>
+
+namespace MobileGL::MG_Backend::DirectVulkan {
+    // The single decision point for how DirectVulkan implements GL_KHR_shader_subgroup,
+    // shared by capability advertisement (BackendObject) and module lowering
+    // (VulkanRenderer / ProgramFactory) so the two can never disagree.
+    //
+    // Native subgroups are the implementation whenever the device has them, whatever
+    // their width - subgroup operations execute on the hardware paths they were made
+    // for. Module-level repairs keep the GL contract intact around them:
+    //   - FixIterationRPSubgroupScratchPass patches the one known pack bug: iterationRP's
+    //     prefixSumCache[32], under-declared for sub-16-lane devices (8-lane lavapipe);
+    //   - FixIterationRPBarrierPass repairs Program 203's race between two reductions
+    //     reusing that scratch, when explicitly enabled;
+    //   - DeriveNumSubgroupsPass replaces the one builtin drivers get wrong
+    //     (gl_NumSubgroups) with the value the rest of the topology implies.
+    // The 32-lane shared-memory emulation (EmulateSubgroupsPass) is a LAST RESORT for
+    // devices with no subgroup support at all, and only when the user opts in with
+    // MOBILEGL_MAGMA_EMULATE_SUBGROUP=1; it never replaces available native operations.
+
+    inline constexpr Uint32 kEmulatedSubgroupSize = 32u;
+    inline constexpr Uint32 kEmulatedSubgroupStages = GL_COMPUTE_SHADER_BIT;
+    inline constexpr Uint32 kEmulatedSubgroupFeatures =
+        GL_SUBGROUP_FEATURE_BASIC_BIT_KHR | GL_SUBGROUP_FEATURE_VOTE_BIT_KHR |
+        GL_SUBGROUP_FEATURE_ARITHMETIC_BIT_KHR | GL_SUBGROUP_FEATURE_BALLOT_BIT_KHR |
+        GL_SUBGROUP_FEATURE_SHUFFLE_BIT_KHR | GL_SUBGROUP_FEATURE_SHUFFLE_RELATIVE_BIT_KHR |
+        GL_SUBGROUP_FEATURE_CLUSTERED_BIT_KHR | GL_SUBGROUP_FEATURE_QUAD_BIT_KHR;
+
+    inline Bool ShouldEmulateSubgroups(const Bool nativeSubgroupSupported) {
+        return MG_Config::Features.MagmaEmulateSubgroup && !nativeSubgroupSupported &&
+               !MG_Config::Features.DisableSubgroup;
+    }
+
+    inline Bool ShouldFixIterationRPSubgroupScratch() {
+        // Auto is ON: the patch is fingerprint-gated to iterationRP's reduction and
+        // grows one under-declared array; every other module passes through untouched.
+        return MG_Config::Features.FixIterationRPSubgroupScratch !=
+               MG_Config::QuirkOverride::ForceOff;
+    }
+
+    inline Bool ShouldFixIterationRPBarrier() {
+        return MG_Config::Features.IterationRPFixBarrier;
+    }
+
+    inline Bool ShouldDeriveNumSubgroups() {
+        // Auto is ON: gl_NumSubgroups must agree with the gl_SubgroupID range for the GL
+        // contract to hold, and the derived ceil() value is the one the renderer can pin
+        // with REQUIRE_FULL_SUBGROUPS - the driver builtin is the value with no
+        // cross-driver guarantee (Adreno returns 1 for an 8-subgroup dispatch).
+        return MG_Config::Features.DeriveNumSubgroups != MG_Config::QuirkOverride::ForceOff;
+    }
+} // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Benchmark/CMakeLists.txt

@@ -43,4 +43,6 @@ set_tests_properties(SanityBench PROPERTIES LABELS benchmark)
 add_subdirectory(Program)
 add_subdirectory(Buffer)
 add_subdirectory(Driver)
-add_subdirectory(Container)
+add_subdirectory(Container)
+add_subdirectory(ShaderCache)
+add_subdirectory(Transpile)

MobileGL/MG_Benchmark/ShaderCache/CMakeLists.txt

@@ -0,0 +1,21 @@
+cmake_minimum_required(VERSION 3.24)
+
+add_executable(
+        TranslationCacheBench
+        TranslationCacheBench.cpp
+)
+
+target_include_directories(TranslationCacheBench PRIVATE
+        ${MGL_ROOT}/include
+        ${MGL_ROOT}/MobileGL
+        ${MGL_ROOT}/3rdparty/SPIRV-Reflect
+)
+
+target_link_libraries(
+        TranslationCacheBench PRIVATE
+        benchmark::benchmark
+        ${LINK_LIBRARIES}
+)
+
+add_test(NAME TranslationCacheBench COMMAND TranslationCacheBench --benchmark_counters_tabular=true)
+set_tests_properties(TranslationCacheBench PROPERTIES LABELS benchmark)

MobileGL/MG_Benchmark/ShaderCache/TranslationCacheBench.cpp

@@ -0,0 +1,457 @@
+// MobileGL - MobileGL/MG_Benchmark/ShaderCache/TranslationCacheBench.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// What the two-level shader translation memo is worth, measured on the workload that
+// motivated it: the KHR-GL33.texture_swizzle.smoke_* shape, where one case builds 2592
+// programs out of a handful of distinct sources.
+//
+// Four pairs of cases, each Off/On:
+//
+//   ProgramLink      - the whole glCompileShader + glLinkProgram path for one program, with
+//                      FRESH SHADER OBJECTS every iteration. This is the CTS shape exactly,
+//                      and it is the headline case now. It used to be the PESSIMISTIC one:
+//                      a hit still paid for both glslang parses, because the parse happens
+//                      at glCompileShader - a different entry point from the one L1
+//                      memoizes - and fresh shader objects meant ShaderCompileAdoptionMap
+//                      could not hand the earlier parse over either. L1c is what closed
+//                      that: the compile half of the memo recognises each stage's source
+//                      and publishes its verdict without parsing, so on a hit this case now
+//                      constructs no glslang object at all.
+//
+//   SharedShaderLink - the same program population with the shader objects KEPT ALIVE, so
+//                      the parses happen once outside the measured loop whatever the cache
+//                      does. That makes it the CONTROL for L1c rather than a target: its
+//                      numbers should not move, and if they do, L1c has added cost to a
+//                      path it was supposed to leave alone.
+//
+//   DeferredParseLink - the shape where L1c could LOSE: a constant vertex source (which
+//                      hits L1c and therefore skips its parse) against a fresh fragment
+//                      source every iteration (which makes the PROGRAM key miss, so the
+//                      skipped parse has to happen inside the link after all). Same parse
+//                      count either way, so the pair should land within noise; see its own
+//                      header below.
+//
+//   EsslTranspile    - the DirectGLES backend segment: the SPIR-V pass chain plus
+//                      SPIRV-Cross. Runs the driver-INDEPENDENT half of the real chain (the
+//                      passes SyncToBackend runs unconditionally, plus the two stage-gated
+//                      ones a fragment module reaches) so the miss path costs what
+//                      production costs; the capability-gated passes need a live ES driver
+//                      and are not reachable from a benchmark process.
+//
+// Every On case runs with a warm cache: the first iteration misses and every one after it
+// hits, which is exactly the steady state of a 2592-program smoke case.
+
+#include <benchmark/benchmark.h>
+
+#include <string>
+
+#include "Config.h"
+#include "Includes.h"
+#include "Init.h"
+#include "MG_Impl/GLImpl/Program/GL_Program.h"
+#include "MG_State/GLState/Core.h"
+#include "MG_State/GLState/ProgramState/ProgramTranslationCache.h"
+#include "MG_Util/ShaderTranspiler/ShaderCompiler.h"
+#include "MG_Util/ShaderTranspiler/SpvcSession.h"
+#include "MG_Util/ShaderTranspiler/TranslationCache.h"
+#include "MG_Util/ShaderTranspiler/Types.h"
+
+using namespace MobileGL;
+using namespace MobileGL::MG_Util::ShaderTranspiler;
+
+namespace {
+    const char* kVertexSource = R"(#version 460
+layout(location = 0) in vec3 aPos;
+out vec3 vPos;
+out vec2 vUv;
+void main() {
+    vPos = aPos;
+    vUv = aPos.xy * 0.5 + 0.5;
+    gl_Position = vec4(aPos, 1.0);
+}
+)";
+
+    // Shaped after gl3cTextureSwizzleTests.cpp's template: a sampler of one type, one
+    // TEXTURE_ACCESS, one CHANNEL, and an output whose BASIC_TYPE is the only thing that
+    // varies within a case. Padded with enough real arithmetic that the translation chain
+    // is doing work rather than measuring fixed overheads.
+    // `padLines` = 0 is the honest CTS size: gl3cTextureSwizzleTests' smoke template is a
+    // handful of lines, and that is the workload the memo exists for. The padded variant is
+    // kept alongside it because a shaderpack stage is orders of magnitude bigger, and the
+    // two bracket the ratio the cache is worth in practice.
+    String SwizzleLikeFragment(const String& prefix, const int padLines) {
+        String source = "#version 460\n";
+        source += "in vec3 vPos;\n";
+        source += "in vec2 vUv;\n";
+        source += "layout(location = 0) out " + prefix + "vec4 fragColor;\n";
+        source += "uniform sampler2D uTex;\n";
+        source += "uniform vec4 uTint;\n";
+        source += "uniform mat4 uModel;\n";
+        source += "uniform float uArr[8];\n";
+        source += "void main() {\n";
+        source += "    vec4 s = texture(uTex, vUv);\n";
+        source += "    float acc = s.r;\n";
+        for (int i = 0; i < padLines; ++i) {
+            source += "    acc = acc * 1.0001 + sin(acc + " + std::to_string(i) + ".0) * cos(acc);\n";
+        }
+        source += "    for (int i = 0; i < 8; ++i) acc += uArr[i];\n";
+        source += "    vec4 p = uModel * vec4(vPos, 1.0);\n";
+        source += "    fragColor = " + prefix + "vec4((s + uTint) * acc + p);\n";
+        source += "}\n";
+        return source;
+    }
+
+    class CacheModeScope {
+    public:
+        explicit CacheModeScope(const Bool enabled)
+            : m_saved(MG_Config::Features.ShaderTranslationCache) {
+            MG_Config::Features.ShaderTranslationCache =
+                enabled ? MG_Config::QuirkOverride::ForceOn : MG_Config::QuirkOverride::ForceOff;
+        }
+        ~CacheModeScope() { MG_Config::Features.ShaderTranslationCache = m_saved; }
+
+    private:
+        const MG_Config::QuirkOverride m_saved;
+    };
+
+    class SyncCompileScope {
+    public:
+        SyncCompileScope() : m_saved(MG_Config::Features.AsyncShaderCompile) {
+            MG_Config::Features.AsyncShaderCompile = MG_Config::QuirkOverride::ForceOff;
+        }
+        ~SyncCompileScope() { MG_Config::Features.AsyncShaderCompile = m_saved; }
+
+    private:
+        const MG_Config::QuirkOverride m_saved;
+    };
+
+    // One program, built the way the CTS builds one: fresh shader objects every time.
+    void LinkOneProgram(const String& vertexSource, const String& fragmentSource) {
+        using namespace MG_Impl::GLImpl;
+        const GLuint vs = CreateShader(GL_VERTEX_SHADER);
+        const char* vsText = vertexSource.c_str();
+        ShaderSource(vs, 1, &vsText, nullptr);
+        CompileShader(vs);
+
+        const GLuint fs = CreateShader(GL_FRAGMENT_SHADER);
+        const char* fsText = fragmentSource.c_str();
+        ShaderSource(fs, 1, &fsText, nullptr);
+        CompileShader(fs);
+
+        const GLuint program = CreateProgram();
+        AttachShader(program, vs);
+        AttachShader(program, fs);
+        LinkProgram(program);
+        benchmark::DoNotOptimize(program);
+
+        DeleteProgram(program);
+        DeleteShader(vs);
+        DeleteShader(fs);
+    }
+
+    Vector<Uint32> BuildSanitizedFragmentSpirv(const String& fragmentSource) {
+        ShaderAttrib attrib{.shaderType = GL_FRAGMENT_SHADER, .sourceStr = fragmentSource};
+        auto shader = ShaderCompiler::CompileShader(attrib);
+        if (!shader) return {};
+        ProgramAttrib programAttrib{.shaders = {shader.value()}};
+        auto program = ShaderCompiler::LinkProgram(programAttrib);
+        if (!program) return {};
+        ProgramBinaryAttrib binaryAttrib{.shaderTypes = {GL_FRAGMENT_SHADER}, .program = *program.value()};
+        auto binary = ShaderCompiler::GetSpirvBinaryFromProgram(binaryAttrib);
+        if (!binary || binary->empty()) return {};
+        Vector<Uint32> sanitized;
+        if (!ShaderCompiler::SanitizeAndOptimizeBinary(binary->front(), sanitized)) return {};
+        return sanitized;
+    }
+
+    // The driver-independent part of BackendProgramObjectImpl::TranspileSpirvToEssl, in the
+    // same order. What is missing is only the capability-gated passes (viewport lowering,
+    // multisample clamping, noperspective emulation, the image-format bake), which cannot
+    // fire without a live ES driver to arm them.
+    Bool TranspileLikeDirectGles(const Vector<Uint32>& spirv, const Uint esslVersion, String& outEssl) {
+        Vector<Uint32> a;
+        const Vector<Uint32>* effective = &spirv;
+        if (ShaderCompiler::StripUboMemberRelaxedPrecisionForEssl(*effective, a, false) && !a.empty()) {
+            effective = &a;
+        }
+        Vector<Uint32> b;
+        if (ShaderCompiler::LowerRectImages(*effective, b, false) && !b.empty()) effective = &b;
+        Vector<Uint32> c;
+        if (ShaderCompiler::Lower1DArrayImagesForEssl(*effective, c, false) && !c.empty()) effective = &c;
+        Vector<Uint32> d;
+        if (ShaderCompiler::LegalizeFragmentOutputIndexingForEssl(*effective, d, false) && !d.empty()) {
+            effective = &d;
+        }
+
+        SpvcSession session(*effective, SessionUsageBit::Transpile);
+        spvc_compiler_options options;
+        if (session.CreateOptions(&options) != SPVC_SUCCESS) return false;
+        spvc_compiler_options_set_uint(options, SPVC_COMPILER_OPTION_GLSL_VERSION, esslVersion);
+        spvc_compiler_options_set_bool(options, SPVC_COMPILER_OPTION_GLSL_ES, SPVC_TRUE);
+        spvc_compiler_options_set_bool(options, SPVC_COMPILER_OPTION_GLSL_VULKAN_SEMANTICS, SPVC_FALSE);
+        session.SetOptions(options);
+        const char* result = nullptr;
+        session.Compile(&result);
+        if (!result) return false;
+        outEssl = result;
+        return true;
+    }
+
+    EsslTranslationKeyInputs EsslInputsFor(const Vector<Uint32>& spirv) {
+        EsslTranslationKeyInputs inputs;
+        inputs.spirv = &spirv;
+        inputs.shaderType = GL_FRAGMENT_SHADER;
+        inputs.maxColorTextureSamples = 4;
+        inputs.maxIntegerSamples = 1;
+        inputs.maxDepthTextureSamples = 4;
+        inputs.advertisedMaxSamples = 4;
+        inputs.esslVersion = 320;
+        return inputs;
+    }
+} // namespace
+
+// ---------------------------------------------------------------------------------------
+// L1, in situ: the full glCompileShader + glLinkProgram path for a repeated program.
+// ---------------------------------------------------------------------------------------
+// Arg(0) = the CTS smoke size; Arg(120) = a heavy stage, bracketing the ratio.
+static void BM_ProgramLink_CacheOff(benchmark::State& state) {
+    MobileGL::Initialize();
+    const SyncCompileScope sync;
+    const CacheModeScope cache(false);
+    const String vs = kVertexSource;
+    const String fs = SwizzleLikeFragment("", static_cast<int>(state.range(0)));
+    for (auto _ : state) {
+        LinkOneProgram(vs, fs);
+    }
+    state.SetLabel("MOBILEGL_SHADER_CACHE=0");
+}
+BENCHMARK(BM_ProgramLink_CacheOff)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+static void BM_ProgramLink_CacheOn(benchmark::State& state) {
+    MobileGL::Initialize();
+    const SyncCompileScope sync;
+    const CacheModeScope cache(true);
+    const String vs = kVertexSource;
+    const String fs = SwizzleLikeFragment("", static_cast<int>(state.range(0)));
+    LinkOneProgram(vs, fs); // prime, so the measured loop is the steady state
+    const TranslationCacheStats before = MG_State::GLState::GetProgramTranslationCache().Stats();
+    const TranslationCacheStats parseBefore = GetShaderParseVerdictCache().Stats();
+    for (auto _ : state) {
+        LinkOneProgram(vs, fs);
+    }
+    const TranslationCacheStats stats = MG_State::GLState::GetProgramTranslationCache().Stats();
+    const TranslationCacheStats parseStats = GetShaderParseVerdictCache().Stats();
+    state.counters["L1_hits"] = static_cast<double>(stats.hits - before.hits);
+    state.counters["L1_misses"] = static_cast<double>(stats.misses - before.misses);
+    // Two stages per iteration, so a clean run shows L1c_hits == 2 * iterations and zero
+    // misses: every glCompileShader in the loop skipped its parse.
+    state.counters["L1c_hits"] = static_cast<double>(parseStats.hits - parseBefore.hits);
+    state.counters["L1c_misses"] = static_cast<double>(parseStats.misses - parseBefore.misses);
+}
+BENCHMARK(BM_ProgramLink_CacheOn)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+// ---------------------------------------------------------------------------------------
+// L1, the shape the memo actually exists for: MANY PROGRAMS OUT OF THE SAME SHADERS.
+//
+// The pair above deletes its shader objects every iteration, which forces a fresh glslang
+// parse per iteration no matter what the link does - glCompileShader parses, and that is a
+// DIFFERENT entry point from the one L1 memoizes. It is a real workload (what an application
+// that never reuses a shader object pays) but it is the pessimistic one, and the residual it
+// leaves is the parse, not the link.
+//
+// This pair keeps the shader objects alive, so the parses happen once before the measured
+// loop and the L1 hit then skips the link, mapIO, the SPIR-V, the reflection and the routing
+// outright.
+//
+// SINCE L1c THIS IS THE CONTROL, NOT THE TARGET. Nothing inside the measured loop calls
+// glCompileShader, so L1c cannot fire here at all - which is exactly what makes the pair
+// useful: it is the shape that says whether the compile-side memo has slowed the LINK path
+// down. Its numbers should be indistinguishable from the pre-L1c ones.
+// ---------------------------------------------------------------------------------------
+namespace {
+    struct SharedShaders {
+        GLuint vs = 0;
+        GLuint fs = 0;
+    };
+
+    SharedShaders MakeSharedShaders(const String& vertexSource, const String& fragmentSource) {
+        using namespace MG_Impl::GLImpl;
+        SharedShaders shaders;
+        shaders.vs = CreateShader(GL_VERTEX_SHADER);
+        const char* vsText = vertexSource.c_str();
+        ShaderSource(shaders.vs, 1, &vsText, nullptr);
+        CompileShader(shaders.vs);
+        shaders.fs = CreateShader(GL_FRAGMENT_SHADER);
+        const char* fsText = fragmentSource.c_str();
+        ShaderSource(shaders.fs, 1, &fsText, nullptr);
+        CompileShader(shaders.fs);
+        return shaders;
+    }
+
+    void LinkFromSharedShaders(const SharedShaders& shaders) {
+        using namespace MG_Impl::GLImpl;
+        const GLuint program = CreateProgram();
+        AttachShader(program, shaders.vs);
+        AttachShader(program, shaders.fs);
+        LinkProgram(program);
+        benchmark::DoNotOptimize(program);
+        DeleteProgram(program);
+    }
+} // namespace
+
+static void BM_SharedShaderLink_CacheOff(benchmark::State& state) {
+    MobileGL::Initialize();
+    const SyncCompileScope sync;
+    const CacheModeScope cache(false);
+    const SharedShaders shaders =
+        MakeSharedShaders(kVertexSource, SwizzleLikeFragment("", static_cast<int>(state.range(0))));
+    for (auto _ : state) {
+        LinkFromSharedShaders(shaders);
+    }
+    state.SetLabel("MOBILEGL_SHADER_CACHE=0");
+}
+BENCHMARK(BM_SharedShaderLink_CacheOff)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+static void BM_SharedShaderLink_CacheOn(benchmark::State& state) {
+    MobileGL::Initialize();
+    const SyncCompileScope sync;
+    const CacheModeScope cache(true);
+    const SharedShaders shaders =
+        MakeSharedShaders(kVertexSource, SwizzleLikeFragment("", static_cast<int>(state.range(0))));
+    LinkFromSharedShaders(shaders); // prime, so the measured loop is the steady state
+    const TranslationCacheStats before = MG_State::GLState::GetProgramTranslationCache().Stats();
+    for (auto _ : state) {
+        LinkFromSharedShaders(shaders);
+    }
+    const TranslationCacheStats stats = MG_State::GLState::GetProgramTranslationCache().Stats();
+    state.counters["L1_hits"] = static_cast<double>(stats.hits - before.hits);
+    state.counters["L1_misses"] = static_cast<double>(stats.misses - before.misses);
+}
+BENCHMARK(BM_SharedShaderLink_CacheOn)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+// ---------------------------------------------------------------------------------------
+// L2, component: the DirectGLES SPIR-V pass chain plus SPIRV-Cross for one stage.
+// ---------------------------------------------------------------------------------------
+static void BM_EsslTranspile_CacheOff(benchmark::State& state) {
+    MobileGL::Initialize();
+    const Vector<Uint32> spirv =
+        BuildSanitizedFragmentSpirv(SwizzleLikeFragment("", static_cast<int>(state.range(0))));
+    if (spirv.empty()) {
+        state.SkipWithError("could not build the fragment module");
+        return;
+    }
+    String essl;
+    for (auto _ : state) {
+        if (!TranspileLikeDirectGles(spirv, 320, essl)) {
+            state.SkipWithError("transpile failed");
+            break;
+        }
+        benchmark::DoNotOptimize(essl.data());
+    }
+    state.SetLabel("MOBILEGL_SHADER_CACHE=0");
+}
+BENCHMARK(BM_EsslTranspile_CacheOff)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+static void BM_EsslTranspile_CacheOn(benchmark::State& state) {
+    MobileGL::Initialize();
+    const Vector<Uint32> spirv =
+        BuildSanitizedFragmentSpirv(SwizzleLikeFragment("", static_cast<int>(state.range(0))));
+    if (spirv.empty()) {
+        state.SkipWithError("could not build the fragment module");
+        return;
+    }
+    BoundedTranslationCache<EsslTranslationResult> cache("bench L2", 64, 8u << 20);
+    const EsslTranslationKeyInputs inputs = EsslInputsFor(spirv);
+    for (auto _ : state) {
+        const TranslationCacheKey key = BuildEsslTranslationKey(inputs);
+        EsslTranslationResultPtr hit = cache.Find(key);
+        if (!hit) {
+            auto payload = MakeShared<EsslTranslationResult>();
+            if (!TranspileLikeDirectGles(spirv, inputs.esslVersion, payload->essl)) {
+                state.SkipWithError("transpile failed");
+                break;
+            }
+            cache.Insert(key, EsslTranslationResultPtr(payload), EsslTranslationResultBytes(*payload));
+            hit = payload;
+        }
+        benchmark::DoNotOptimize(hit->essl.data());
+    }
+    const TranslationCacheStats stats = cache.Stats();
+    state.counters["L2_hits"] = static_cast<double>(stats.hits);
+    state.counters["L2_misses"] = static_cast<double>(stats.misses);
+}
+BENCHMARK(BM_EsslTranspile_CacheOn)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+// ---------------------------------------------------------------------------------------
+// L1c, the shape where it could LOSE rather than win: the DEFERRED PARSE.
+// ---------------------------------------------------------------------------------------
+// A stage whose compile hits L1c holds no AST, so if the program-level key then MISSES, the
+// parse it skipped has to happen anyway - inside the link, via ClaimParsedShader. The parse
+// is moved, not removed, and this pair is what says whether moving it costs anything.
+//
+// The shape forces exactly that, every iteration: one CONSTANT vertex source (hits L1c after
+// the first iteration) linked against a FRESH fragment source each time (misses L1c, and
+// makes the program key miss too). So:
+//
+//   cache off - two parses at glCompileShader, then the link.
+//   cache on  - one parse at glCompileShader (the fragment), one deferred parse inside the
+//               link (the vertex), then the link.
+//
+// The parse count is identical, so these two should land within noise of each other. If the
+// On arm is materially SLOWER, L1c is charging for something - the per-compile key build and
+// hash over the full preprocessed source, or the loss of the claim-CAS reuse - and that cost
+// shows up here and nowhere else.
+//
+// The distinct fragment sources also churn both front-end levels through their FIFO caps,
+// which is the eviction behaviour a real shaderpack load produces; over a long run the
+// constant vertex entry is occasionally evicted by that churn and re-inserted, so the L1c
+// hit rate reported below is high but not exactly 1.0 per iteration.
+namespace {
+    String UniqueFragmentSource(const Uint64 serial, const int padLines) {
+        return SwizzleLikeFragment("", padLines) +
+               "\n// unique-" + std::to_string(serial) + "\n";
+    }
+} // namespace
+
+static void BM_DeferredParseLink_CacheOff(benchmark::State& state) {
+    MobileGL::Initialize();
+    const SyncCompileScope sync;
+    const CacheModeScope cache(false);
+    const String vs = kVertexSource;
+    Uint64 serial = 0;
+    for (auto _ : state) {
+        LinkOneProgram(vs, UniqueFragmentSource(serial++, static_cast<int>(state.range(0))));
+    }
+    state.SetLabel("MOBILEGL_SHADER_CACHE=0");
+}
+BENCHMARK(BM_DeferredParseLink_CacheOff)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+static void BM_DeferredParseLink_CacheOn(benchmark::State& state) {
+    MobileGL::Initialize();
+    const SyncCompileScope sync;
+    const CacheModeScope cache(true);
+    const String vs = kVertexSource;
+    Uint64 serial = 0;
+    LinkOneProgram(vs, UniqueFragmentSource(~0ull, static_cast<int>(state.range(0)))); // prime the vertex entry
+    const TranslationCacheStats before = MG_State::GLState::GetProgramTranslationCache().Stats();
+    const TranslationCacheStats parseBefore = GetShaderParseVerdictCache().Stats();
+    for (auto _ : state) {
+        LinkOneProgram(vs, UniqueFragmentSource(serial++, static_cast<int>(state.range(0))));
+    }
+    const TranslationCacheStats stats = MG_State::GLState::GetProgramTranslationCache().Stats();
+    const TranslationCacheStats parseStats = GetShaderParseVerdictCache().Stats();
+    // Expected shape: L1 all misses (every program is new), L1c one hit (vertex) and one miss
+    // (fragment) per iteration.
+    state.counters["L1_hits"] = static_cast<double>(stats.hits - before.hits);
+    state.counters["L1_misses"] = static_cast<double>(stats.misses - before.misses);
+    state.counters["L1c_hits"] = static_cast<double>(parseStats.hits - parseBefore.hits);
+    state.counters["L1c_misses"] = static_cast<double>(parseStats.misses - parseBefore.misses);
+}
+BENCHMARK(BM_DeferredParseLink_CacheOn)->Arg(0)->Arg(120)->Unit(benchmark::kMicrosecond);
+
+BENCHMARK_MAIN();

MobileGL/MG_Benchmark/Transpile/CMakeLists.txt

@@ -0,0 +1,20 @@
+cmake_minimum_required(VERSION 3.24)
+
+# Deliberately NOT a google-benchmark target: the interesting quantity is a per-stage
+# breakdown of one program build, which needs its own clock around sub-steps that share
+# set-up, and a plain main() keeps the output a table this can be read straight out of.
+add_executable(
+        TranspileProfile
+        TranspileProfile.cpp
+)
+
+target_include_directories(TranspileProfile PRIVATE
+        ${MGL_ROOT}/include
+        ${MGL_ROOT}/MobileGL
+        ${MGL_ROOT}/3rdparty/SPIRV-Reflect
+)
+
+target_link_libraries(
+        TranspileProfile PRIVATE
+        ${LINK_LIBRARIES}
+)

MobileGL/MG_Impl/GLImpl/Buffer/GL_Buffer.cpp

@@ -18,6 +18,7 @@
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/GLToMG/BufferEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/BufferEnumConverter.h>
+#include <MG_Util/Texture/PixelStoreProcessor.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -31,6 +32,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             NamedBufferData,
             NamedBufferSubData,
             CopyNamedBufferSubData,
+            ClearBufferData,
+            ClearBufferSubData,
             ClearNamedBufferData,
             ClearNamedBufferSubData,
             MapBufferRange,
@@ -65,6 +68,10 @@ namespace MobileGL::MG_Impl::GLImpl {
                 return "NamedBufferSubData";
             case BufferOp::CopyNamedBufferSubData:
                 return "CopyNamedBufferSubData";
+            case BufferOp::ClearBufferData:
+                return "ClearBufferData";
+            case BufferOp::ClearBufferSubData:
+                return "ClearBufferSubData";
             case BufferOp::ClearNamedBufferData:
                 return "ClearNamedBufferData";
             case BufferOp::ClearNamedBufferSubData:
@@ -143,16 +150,6 @@ namespace MobileGL::MG_Impl::GLImpl {
                 return 0;
             }
 
-            // The pattern is replicated verbatim, which is only the whole story while the client
-            // layout already matches the internal format - the case every entry point in practice
-            // uses, and the only one the conversion machinery here can express. Say so rather than
-            // quietly writing a differently-sized pattern.
-            const SizeT sourceSize = MG_Util::GetInputBytesPerPixel(inputFormat, pixelType);
-            if (sourceSize != elementSize) {
-                MGLOG_W_ONCE("%s: clear pattern is %zu bytes but internalformat 0x%X stores %zu; "
-                        "converting between them is not implemented",
-                        GetBufferOpName(op), sourceSize, internalformat, elementSize);
-            }
             return elementSize;
         }
 
@@ -194,27 +191,59 @@ namespace MobileGL::MG_Impl::GLImpl {
             return true;
         }
 
-        void ClearNamedBufferRange_State(GLuint buffer, GLenum internalformat, GLintptr offset, GLsizeiptr size,
-                                         GLenum format, GLenum type, const void* data, BufferOp op) {
+        Bool BuildClearPattern(GLenum internalformat, GLenum format, GLenum type, const void* data,
+                               SizeT patternSize, BufferOp op, Vector<Uint8>& pattern) {
+            const TextureInternalFormat internal = MG_Util::ConvertGLEnumToTextureInternalFormat(internalformat);
+            const TextureInputFormat inputFormat = MG_Util::ConvertGLEnumToTextureInputFormat(format);
+            const TexturePixelDataType inputType = MG_Util::ConvertGLEnumToTexturePixelDataType(type);
+
+            Vector<Uint8> zeroInput;
+            const void* inputPixel = data;
+            if (inputPixel == nullptr) {
+                const SizeT inputSize = MG_Util::GetInputBytesPerPixel(inputFormat, inputType);
+                if (inputSize == 0) {
+                    MG_State::pGLContext->RecordError(
+                        ErrorCode::InvalidValue,
+                        MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", GetBufferOpName(op),
+                                                     "format and type do not describe a source pixel."));
+                    return false;
+                }
+                zeroInput.resize(inputSize);
+                inputPixel = zeroInput.data();
+            }
+
+            if (!MG_Util::PixelStoreProcessor::ConvertOnePixelToInternal(
+                    internal, inputFormat, inputType, inputPixel, pattern)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", GetBufferOpName(op),
+                        std::format("Cannot convert one ({}, {}) pixel into internalformat 0x{:X}.",
+                                    MG_Util::ConvertGLEnumToString(format), MG_Util::ConvertGLEnumToString(type),
+                                    internalformat)));
+                return false;
+            }
+
+            if (data == nullptr) {
+                // GL defines a null clear value as all zero bits in the destination store, while
+                // retaining the format/type validation above.
+                pattern.assign(patternSize, 0);
+            }
+            return true;
+        }
+
+        void ClearBufferRange_State(const SharedPtr<MG_State::GLState::BufferObject>& bufferObject,
+                                    GLenum internalformat, GLintptr offset, GLsizeiptr size,
+                                    GLenum format, GLenum type, const void* data, BufferOp op) {
             const SizeT patternSize = GetClearPatternSize(internalformat, format, type, op);
             if (patternSize == 0) return;
-
-            auto bufferObject = GetNamedBufferObject(buffer, op);
-            if (!bufferObject) return;
             if (!ValidateBufferClearRange(bufferObject, offset, size, patternSize, op)) return;
             if (size == 0) return;
 
-            Vector<Uint8> clearData(static_cast<SizeT>(size));
-            if (data) {
-                const auto* pattern = static_cast<const Uint8*>(data);
-                for (SizeT at = 0; at < clearData.size(); at += patternSize) {
-                    Memcpy(clearData.data() + at, pattern, patternSize);
-                }
-            } else {
-                Memset(clearData.data(), 0, clearData.size());
-            }
-
-            bufferObject->UploadSubData({clearData.data(), clearData.size()}, static_cast<SizeT>(offset));
+            Vector<Uint8> pattern;
+            if (!BuildClearPattern(internalformat, format, type, data, patternSize, op, pattern)) return;
+            bufferObject->FillSubData({pattern.data(), pattern.size()}, static_cast<SizeT>(offset),
+                                      static_cast<SizeT>(size));
         }
 
         auto& GetBufferBindingSlot(BufferTarget target) {
@@ -1197,17 +1226,34 @@ namespace MobileGL::MG_Impl::GLImpl {
                                         static_cast<SizeT>(writeOffset), static_cast<SizeT>(size));
     }
 
+    void ClearBufferData_State(GLenum target, GLenum internalformat, GLenum format, GLenum type, const void* data) {
+        auto bufferObject = GetBoundBufferObject(target, BufferOp::ClearBufferData);
+        if (!bufferObject) return;
+        ClearBufferRange_State(bufferObject, internalformat, 0, static_cast<GLsizeiptr>(bufferObject->GetSize()), format,
+                               type, data, BufferOp::ClearBufferData);
+    }
+
+    void ClearBufferSubData_State(GLenum target, GLenum internalformat, GLintptr offset, GLsizeiptr size,
+                                  GLenum format, GLenum type, const void* data) {
+        auto bufferObject = GetBoundBufferObject(target, BufferOp::ClearBufferSubData);
+        if (!bufferObject) return;
+        ClearBufferRange_State(bufferObject, internalformat, offset, size, format, type, data,
+                               BufferOp::ClearBufferSubData);
+    }
+
     void ClearNamedBufferData_State(GLuint buffer, GLenum internalformat, GLenum format, GLenum type, const void* data) {
         auto bufferObject = GetNamedBufferObject(buffer, BufferOp::ClearNamedBufferData);
         if (!bufferObject) return;
-        ClearNamedBufferRange_State(buffer, internalformat, 0, static_cast<GLsizeiptr>(bufferObject->GetSize()), format,
-                                    type, data, BufferOp::ClearNamedBufferData);
+        ClearBufferRange_State(bufferObject, internalformat, 0, static_cast<GLsizeiptr>(bufferObject->GetSize()), format,
+                               type, data, BufferOp::ClearNamedBufferData);
     }
 
     void ClearNamedBufferSubData_State(GLuint buffer, GLenum internalformat, GLintptr offset, GLsizeiptr size,
                                        GLenum format, GLenum type, const void* data) {
-        ClearNamedBufferRange_State(buffer, internalformat, offset, size, format, type, data,
-                                    BufferOp::ClearNamedBufferSubData);
+        auto bufferObject = GetNamedBufferObject(buffer, BufferOp::ClearNamedBufferSubData);
+        if (!bufferObject) return;
+        ClearBufferRange_State(bufferObject, internalformat, offset, size, format, type, data,
+                               BufferOp::ClearNamedBufferSubData);
     }
 
     void* MapNamedBuffer_State(GLuint buffer, GLenum access) {
@@ -1662,6 +1708,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         CopyNamedBufferSubData_State(readBuffer, writeBuffer, readOffset, writeOffset, size);
     }
 
+    void ClearBufferData(GLenum target, GLenum internalformat, GLenum format, GLenum type, const void* data) {
+        ClearBufferData_State(target, internalformat, format, type, data);
+    }
+
+    void ClearBufferSubData(GLenum target, GLenum internalformat, GLintptr offset, GLsizeiptr size, GLenum format,
+                            GLenum type, const void* data) {
+        ClearBufferSubData_State(target, internalformat, offset, size, format, type, data);
+    }
+
     void ClearNamedBufferData(GLuint buffer, GLenum internalformat, GLenum format, GLenum type, const void* data) {
         ClearNamedBufferData_State(buffer, internalformat, format, type, data);
     }

MobileGL/MG_Impl/GLImpl/Buffer/GL_Buffer.h

@@ -27,6 +27,9 @@ namespace MobileGL::MG_Impl::GLImpl {
     void NamedBufferSubData(GLuint buffer, GLintptr offset, GLsizeiptr size, const void* data);
     void CopyNamedBufferSubData(GLuint readBuffer, GLuint writeBuffer, GLintptr readOffset, GLintptr writeOffset,
                                 GLsizeiptr size);
+    void ClearBufferData(GLenum target, GLenum internalformat, GLenum format, GLenum type, const void* data);
+    void ClearBufferSubData(GLenum target, GLenum internalformat, GLintptr offset, GLsizeiptr size, GLenum format,
+                            GLenum type, const void* data);
     void ClearNamedBufferData(GLuint buffer, GLenum internalformat, GLenum format, GLenum type, const void* data);
     void ClearNamedBufferSubData(GLuint buffer, GLenum internalformat, GLintptr offset, GLsizeiptr size, GLenum format,
                                  GLenum type, const void* data);

MobileGL/MG_Impl/GLImpl/Buffer/Validators.cpp

@@ -13,6 +13,7 @@
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/BufferEnumConverter.h>
 #include <MG_Util/Converters/MGToStr/BufferEnumConverter.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
 
 namespace MobileGL::MG_Impl::GLImpl::BufferImpl {
     Bool ValidateBufferTarget(BufferTarget target) {
@@ -67,6 +68,13 @@ namespace MobileGL::MG_Impl::GLImpl::BufferImpl {
                 // binding points in GL 3.3 (no ARB_transform_feedback3).
                 pointCount = std::min<SizeT>(pointCount, 4);
             }
+            if (target == BufferTarget::AtomicCounter) {
+                // GL_MAX_ATOMIC_COUNTER_BUFFER_BINDINGS, which is NOT the state layer's array
+                // size: a counter buffer reaches a shader only as a lowered storage block, so the
+                // reserved range is the ceiling, and glGetIntegerv advertises the same number.
+                pointCount = std::min<SizeT>(
+                    pointCount, static_cast<SizeT>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTER_BUFFER_BINDINGS));
+            }
             return pointCount;
         }
     } // namespace

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.cpp

@@ -108,6 +108,12 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         const auto& program = MG_State::pGLContext->GetTransformFeedbackProgram();
         if (program != nullptr) {
+            // A geometry stage writes what it emits, not what the draw assembled, and the
+            // amplification factor lives in the shader. Record that this span contained such
+            // a draw so the transform feedback queries keep their backend result for it.
+            if (program->GetShaderIndexByStage(ShaderStage::Geometry) >= 0) {
+                MG_State::pGLContext->AddTransformFeedbackGeometryCaptureDraw();
+            }
             // Capacity in captured vertices = the tightest bound buffer.
             Uint64 capacityVertices = ~0ull;
             for (SizeT i = 0; i < program->GetTransformFeedbackBufferCount(); ++i) {
@@ -127,6 +133,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->AddTransformFeedbackPrimitives(primitives);
         MG_State::pGLContext->AddTransformFeedbackCapturedVertices(primitives * verticesPerPrimitive);
+        // Only draws that get this far are in the written counter at all. The instanced and
+        // indirect entry points never call this function, so a span that contains one is NOT
+        // fully accounted, and the queries must be able to tell: they compare this counter's
+        // delta against zero before standing in for the backend's own result.
+        MG_State::pGLContext->AddTransformFeedbackAccountedCaptureDraw();
     }
 
     // Every primitive mode a draw command accepts (GL 4.6 core table 10.1, plus
@@ -151,11 +162,23 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
+    // The `mode` INVALID_ENUM in isolation, so a draw entry point can raise it BEFORE any of the
+    // state-dependent INVALID_OPERATIONs below. GL 4.6 core 10.4 makes a bad mode INVALID_ENUM
+    // unconditionally, while "no current program" is not even a spec-listed draw error - it is
+    // MobileGL's own null-dereference guard - so it must never shadow the enum check
+    // (KHR-GL31.api.coverage calls glDrawArraysInstanced/glDrawElementsInstanced with mode
+    // GL_POINTS-1 against a bare context and pins GL_INVALID_ENUM).
+    static Bool ValidatePrimitiveModeEnum(const char* functionName, GLenum mode) {
+        if (IsAcceptedPrimitiveMode(mode)) return true;
+
+        MG_State::pGLContext->RecordError(
+            ErrorCode::InvalidEnum,
+            MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName, "mode is not an accepted primitive type."));
+        return false;
+    }
+
     static Bool ValidatePrimitiveModeForBackend(const char* functionName, GLenum mode) {
-        if (!IsAcceptedPrimitiveMode(mode)) {
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidEnum,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName, "mode is not an accepted primitive type."));
+        if (!ValidatePrimitiveModeEnum(functionName, mode)) {
             return false;
         }
 
@@ -176,11 +199,37 @@ namespace MobileGL::MG_Impl::GLImpl {
             return false;
         }
 
+        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
+
+        // GL 4.6 core 10.1: the tessellation pipeline's only input primitive is GL_PATCHES, and
+        // GL_PATCHES has no meaning without it. Both directions are INVALID_OPERATION, and
+        // neither was implemented - which is two of the four sites
+        // KHR-GL43.transform_feedback.api_errors_test checks with one shared message string.
+        // The EVALUATION stage is what decides: a control stage cannot run without one, and a
+        // program carrying only an evaluation stage still tessellates, through GL's
+        // fixed-function pass-through control stage (11.2.2).
+        const Bool tessellationActive =
+            currentProgram && currentProgram->GetShaderIndexByStage(ShaderStage::TessEval) >= 0;
+        if (tessellationActive && mode != GL_PATCHES) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", functionName,
+                    "A program with a tessellation evaluation shader can only be drawn with GL_PATCHES."));
+            return false;
+        }
+        if (!tessellationActive && mode == GL_PATCHES) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                             "GL_PATCHES requires an active tessellation evaluation shader."));
+            return false;
+        }
+
         // A geometry stage only accepts the primitive types that decompose into its declared
         // input primitive (GL 4.6 core 11.3.1); anything else is INVALID_OPERATION. GL_PATCHES
         // is the tessellation pipeline's input and reaches the geometry stage already
         // converted, so it is not constrained here.
-        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
         const GLenum gsInput = currentProgram ? currentProgram->GetGeometryInputType() : GL_NONE;
         if (gsInput != GL_NONE && mode != GL_PATCHES) {
             Bool compatible = false;
@@ -216,13 +265,17 @@ namespace MobileGL::MG_Impl::GLImpl {
         // While transform feedback is active the draw's primitive type must match
         // the feedback primitive mode (GL 3.3 core 13.2.2). With a geometry shader
         // the constraint moves to the shader's output primitive type instead, so
-        // the draw mode itself is unconstrained here. A paused span is exempt: it
-        // captures nothing, so there is nothing for the mode to be incompatible with
-        // (GL 4.6 core 13.2.3).
+        // the draw mode itself is unconstrained here - and a TESSELLATION EVALUATION
+        // stage relocates it exactly the same way (GL 4.6 core 13.2.2 names both):
+        // what is captured is the tessellator's output primitive, and the draw mode
+        // can only ever be GL_PATCHES. A paused span is exempt: it captures nothing,
+        // so there is nothing for the mode to be incompatible with (GL 4.6 core 13.2.3).
+        const auto& feedbackProgram = MG_State::pGLContext->GetTransformFeedbackProgram();
+        const Bool feedbackModeIsProgramDriven =
+            feedbackProgram && (feedbackProgram->GetShaderIndexByStage(ShaderStage::Geometry) >= 0 ||
+                                feedbackProgram->GetShaderIndexByStage(ShaderStage::TessEval) >= 0);
         if (MG_State::pGLContext->IsTransformFeedbackActive() &&
-            !MG_State::pGLContext->IsTransformFeedbackPaused() &&
-            !(MG_State::pGLContext->GetTransformFeedbackProgram() &&
-              MG_State::pGLContext->GetTransformFeedbackProgram()->GetShaderIndexByStage(ShaderStage::Geometry) >= 0)) {
+            !MG_State::pGLContext->IsTransformFeedbackPaused() && !feedbackModeIsProgramDriven) {
             const GLenum feedbackMode = MG_State::pGLContext->GetTransformFeedbackPrimitiveMode();
             Bool compatible = false;
             switch (feedbackMode) {
@@ -303,10 +356,23 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
+    // GL 4.6 core 10.9: inside a conditional block whose predicate did not pass, the drawing
+    // commands, Clear, ClearBuffer* and the compute dispatches are DISCARDED. The gate sits on the
+    // wrappers that ISSUE the backend call rather than at the top of each entry point, so that
+    // everything a real driver would still do inside the block - argument validation and the
+    // errors it raises - happens exactly as it does outside one, and only the command itself is
+    // dropped. It is deliberately not on the frontend's transform-feedback accounting either:
+    // that mirrors what the capture stage would have written, and a conditional block around a
+    // capturing draw has no test coverage in either direction.
+    static Bool ConditionalRenderDiscardsCommand() {
+        return MG_State::pGLContext->ConditionalRenderDiscardsCommands();
+    }
+
     void Clear_Backend(GLbitfield mask) {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.Clear(mask);
     }
 
@@ -314,6 +380,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElements(mode, count, type, indices);
     }
 
@@ -322,6 +389,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElements(mode, count, type, indices, drawcount);
     }
 
@@ -330,6 +398,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsBaseVertex(mode, count, type, indices, drawcount,
                                                                           basevertex);
     }
@@ -338,6 +407,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawArrays(mode, first, count);
     }
 
@@ -345,6 +415,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArrays(mode, first, count, drawcount);
     }
 
@@ -353,6 +424,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsBaseVertex(mode, count, type, indices, basevertex);
     }
 
@@ -361,6 +433,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirect(mode, type, indirect, drawcount, stride);
     }
 
@@ -368,6 +441,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirect(mode, indirect, drawcount, stride);
     }
 
@@ -376,6 +450,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirectCount(mode, type, indirect, drawcount,
                                                                              maxdrawcount, stride);
     }
@@ -385,6 +460,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirectCount(mode, indirect, drawcount, maxdrawcount,
                                                                            stride);
     }
@@ -394,6 +470,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawRangeElementsBaseVertex(mode, start, end, count, type, indices,
                                                                           basevertex);
     }
@@ -403,6 +480,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawRangeElements(mode, start, end, count, type, indices);
     }
 
@@ -412,6 +490,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseVertexBaseInstance(
             mode, count, type, indices, instancecount, basevertex, baseinstance);
     }
@@ -421,6 +500,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseVertex(mode, count, type, indices, instancecount,
                                                                               basevertex);
     }
@@ -430,6 +510,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseInstance(mode, count, type, indices,
                                                                                 instancecount, baseinstance);
     }
@@ -439,6 +520,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstanced(mode, count, type, indices, instancecount);
     }
 
@@ -446,6 +528,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsIndirect(mode, type, indirect);
     }
     void DrawArraysInstancedBaseInstance_Backend(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
@@ -453,6 +536,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysInstancedBaseInstance(mode, first, count, instancecount,
                                                                               baseinstance);
     }
@@ -461,6 +545,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysInstanced(mode, first, count, instancecount);
     }
 
@@ -468,6 +553,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 #ifdef TRACY_ENABLE
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
+        if (ConditionalRenderDiscardsCommand()) return;
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysIndirect(mode, indirect);
     }
 
@@ -496,6 +582,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                 return;
             }
         }
+        // GL 4.3 added both dispatches to the conditional-render set (GL 4.6 core 10.9), which is
+        // exactly what KHR-GL43.compute_shader.conditional-dispatching checks.
+        if (ConditionalRenderDiscardsCommand()) return;
         dispatchCompute(numGroupsX, numGroupsY, numGroupsZ);
     }
 
@@ -547,6 +636,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         if (!ValidateCurrentProgramForCompute(__func__)) return;
+        if (ConditionalRenderDiscardsCommand()) return;
         dispatchComputeIndirect(indirect);
     }
 
@@ -596,12 +686,14 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElementsIndirect_Backend(mode, type, indirect, drawcount, stride);
     }
 
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawArraysIndirect_Backend(mode, indirect, drawcount, stride);
@@ -715,12 +807,14 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawRangeElementsBaseVertex(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type,
                                      const void* indices, GLint basevertex) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawRangeElementsBaseVertex_Backend(mode, start, end, count, type, indices, basevertex);
     }
 
     void DrawRangeElements(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type, const void* indices) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawRangeElements_Backend(mode, start, end, count, type, indices);
@@ -728,6 +822,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElementsInstancedBaseVertexBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                                      GLsizei instancecount, GLint basevertex, GLuint baseinstance) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseVertexBaseInstance_Backend(mode, count, type, indices, instancecount, basevertex,
@@ -736,6 +831,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElementsInstancedBaseVertex(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                          GLsizei instancecount, GLint basevertex) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseVertex_Backend(mode, count, type, indices, instancecount, basevertex);
@@ -743,18 +839,21 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElementsInstancedBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                            GLsizei instancecount, GLuint baseinstance) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseInstance_Backend(mode, count, type, indices, instancecount, baseinstance);
     }
 
     void DrawElementsInstanced(GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstanced_Backend(mode, count, type, indices, instancecount);
     }
 
     void DrawElementsIndirect(GLenum mode, GLenum type, const void* indirect) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
@@ -764,18 +863,21 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawArraysInstancedBaseInstance(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
                                          GLuint baseinstance) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawArraysInstancedBaseInstance_Backend(mode, first, count, instancecount, baseinstance);
     }
 
     void DrawArraysInstanced(GLenum mode, GLint first, GLsizei count, GLsizei instancecount) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawArraysInstanced_Backend(mode, first, count, instancecount);
     }
 
     void DrawArraysIndirect(GLenum mode, const void* indirect) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateIndirectDrawSource(__func__, indirect, kDrawArraysIndirectCommandBytes)) return;
@@ -783,6 +885,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void DrawElementsBaseVertex(GLenum mode, GLsizei count, GLenum type, const void* indices, GLint basevertex) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);
@@ -790,6 +893,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void DrawArrays(GLenum mode, GLint first, GLsizei count) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);
@@ -797,6 +901,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void MultiDrawArrays(GLenum mode, const GLint* first, const GLsizei* count, GLsizei drawcount) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (drawcount < 0) {
@@ -810,6 +915,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void MultiDrawElements(GLenum mode, const GLsizei* count, GLenum type, const void* const* indices,
                            GLsizei drawcount) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElements_Backend(mode, count, type, indices, drawcount);
@@ -817,6 +923,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void MultiDrawElementsBaseVertex(GLenum mode, const GLsizei* count, GLenum type, const void* const* indices,
                                      GLsizei drawcount, const GLint* basevertex) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElementsBaseVertex_Backend(mode, count, type, indices, drawcount, basevertex);
@@ -827,6 +934,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void DrawElements(GLenum mode, GLsizei count, GLenum type, const void* indices) {
+        if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
         if (!ValidateCurrentProgramForExecution(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);

MobileGL/MG_Impl/GLImpl/Exporting/Definitions.cpp

@@ -725,8 +725,8 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, LoadName, GLuint name) DECLARE_GL_FUNCTION_S
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PushName, GLuint name) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PushName, name)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PopName) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PopName)
 DECLARE_GL_FUNCTION_HEAD(void, ClampColor, GLenum target, GLenum clamp) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ClampColor, target, clamp)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, BeginConditionalRender, GLuint id, GLenum mode) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, BeginConditionalRender, id, mode)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, EndConditionalRender, void) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, EndConditionalRender)
+DECLARE_GL_FUNCTION_HEAD(void, BeginConditionalRender, GLuint id, GLenum mode) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BeginConditionalRender, id, mode)
+DECLARE_GL_FUNCTION_HEAD(void, EndConditionalRender) DECLARE_GL_FUNCTION_END_NO_RETURN(void, EndConditionalRender)
 DECLARE_GL_FUNCTION_HEAD(void, VertexAttribI1i, GLuint index, GLint x) DECLARE_GL_FUNCTION_END_NO_RETURN(void, VertexAttribI1i, index, x)
 DECLARE_GL_FUNCTION_HEAD(void, VertexAttribI2i, GLuint index, GLint x, GLint y) DECLARE_GL_FUNCTION_END_NO_RETURN(void, VertexAttribI2i, index, x, y)
 DECLARE_GL_FUNCTION_HEAD(void, VertexAttribI3i, GLuint index, GLint x, GLint y, GLint z) DECLARE_GL_FUNCTION_END_NO_RETURN(void, VertexAttribI3i, index, x, y, z)
@@ -982,11 +982,11 @@ DECLARE_GL_FUNCTION_HEAD(void, GetDoublei_v, GLenum target, GLuint index, GLdoub
 DECLARE_GL_FUNCTION_HEAD(void, DrawArraysInstancedBaseInstance, GLenum mode, GLint first, GLsizei count, GLsizei instancecount, GLuint baseinstance) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawArraysInstancedBaseInstance, mode, first, count, instancecount, baseinstance)
 DECLARE_GL_FUNCTION_HEAD(void, DrawElementsInstancedBaseInstance, GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount, GLuint baseinstance) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawElementsInstancedBaseInstance, mode, count, type, indices, instancecount, baseinstance)
 DECLARE_GL_FUNCTION_HEAD(void, DrawElementsInstancedBaseVertexBaseInstance, GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount, GLint basevertex, GLuint baseinstance) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawElementsInstancedBaseVertexBaseInstance, mode, count, type, indices, instancecount, basevertex, baseinstance)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, GetActiveAtomicCounterBufferiv, GLuint program, GLuint bufferIndex, GLenum pname, GLint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetActiveAtomicCounterBufferiv, program, bufferIndex, pname, params)
+DECLARE_GL_FUNCTION_HEAD(void, GetActiveAtomicCounterBufferiv, GLuint program, GLuint bufferIndex, GLenum pname, GLint* params) DECLARE_GL_FUNCTION_END_NO_RETURN(void, GetActiveAtomicCounterBufferiv, program, bufferIndex, pname, params)
 DECLARE_GL_FUNCTION_HEAD(void, DrawTransformFeedbackInstanced, GLenum mode, GLuint id, GLsizei instancecount) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawTransformFeedbackInstanced, mode, id, instancecount)
 DECLARE_GL_FUNCTION_HEAD(void, DrawTransformFeedbackStreamInstanced, GLenum mode, GLuint id, GLuint stream, GLsizei instancecount) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawTransformFeedbackStreamInstanced, mode, id, stream, instancecount)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, ClearBufferData, GLenum target, GLenum internalformat, GLenum format, GLenum type, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ClearBufferData, target, internalformat, format, type, data)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, ClearBufferSubData, GLenum target, GLenum internalformat, GLintptr offset, GLsizeiptr size, GLenum format, GLenum type, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ClearBufferSubData, target, internalformat, offset, size, format, type, data)
+DECLARE_GL_FUNCTION_HEAD(void, ClearBufferData, GLenum target, GLenum internalformat, GLenum format, GLenum type, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ClearBufferData, target, internalformat, format, type, data)
+DECLARE_GL_FUNCTION_HEAD(void, ClearBufferSubData, GLenum target, GLenum internalformat, GLintptr offset, GLsizeiptr size, GLenum format, GLenum type, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ClearBufferSubData, target, internalformat, offset, size, format, type, data)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetInternalformati64v, GLenum target, GLenum internalformat, GLenum pname, GLsizei count, GLint64* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetInternalformati64v, target, internalformat, pname, count, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, InvalidateTexSubImage, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, InvalidateTexSubImage, texture, level, xoffset, yoffset, zoffset, width, height, depth)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, InvalidateTexImage, GLuint texture, GLint level) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, InvalidateTexImage, texture, level)

MobileGL/MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.cpp

@@ -13,6 +13,7 @@
 #include <MG_Backend/BackendObjects.h>
 #include <MG_Util/Metrics/TextureMetrics.h>
 #include <MG_Impl/GLImpl/Texture/Validators.h>
+#include <MG_Impl/GLImpl/Getter/GL_Getter.h>
 #include <MG_State/GLState/ErrorState/Error.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
@@ -617,16 +618,17 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (MG_Backend::pActiveBackendObject == nullptr) {
             return std::numeric_limits<Int>::max();
         }
-        return std::max(MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxSamples, 1);
+        return GetAdvertisedMaxSamples();
     }
 
-    // GL_MAX_SAMPLES is the ceiling over all formats; an integer format has its own, lower
-    // one (GL_MAX_INTEGER_SAMPLES) and GL 4.6 core 9.2.4 makes exceeding it INVALID_OPERATION.
-    // The multisample TEXTURE path already resolves the limit per format
-    // (GL_Texture.cpp, GetMaxTextureSamplesForFormat); renderbuffers only ever compared
-    // against GL_MAX_SAMPLES, so on a driver where the two differ - Adreno reports
-    // GL_MAX_SAMPLES 4 and GL_MAX_INTEGER_SAMPLES 1 - an integer renderbuffer accepted a
-    // sample count the format cannot deliver, and said GL_NO_ERROR about it.
+    // GL_MAX_SAMPLES is the ceiling over all formats; an integer format has its own
+    // (GL_MAX_INTEGER_SAMPLES) and GL 4.6 core 9.2.4 makes exceeding it INVALID_OPERATION.
+    // The multisample TEXTURE path resolves the limit per format the same way
+    // (GL_Texture.cpp, GetMaxSupportedTextureSamples). Both are floored to the value MobileGL
+    // advertises: on a driver where the two differ - Adreno reports GL_MAX_SAMPLES 4 and
+    // GL_MAX_INTEGER_SAMPLES 1 - rejecting the advertised count here only moves the failure
+    // from the driver into MobileGL, so the frontend accepts it and the backend clamps the
+    // count it actually hands the driver.
     Int GetMaxRenderbufferSamplesForFormat_State(TextureInternalFormat format) {
         if (MG_Backend::pActiveBackendObject == nullptr) {
             return std::numeric_limits<Int>::max();
@@ -645,7 +647,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!isIntegerFormat) {
             return GetMaxRenderbufferSamples_State();
         }
-        return std::max(dynamicParameters.MaxIntegerSamples, 1);
+        // Per-format still, but never below the ceiling glGetIntegerv(GL_MAX_SAMPLES) promised:
+        // the driver's raw GL_MAX_INTEGER_SAMPLES stays the *backend* limit and the backend
+        // clamps to it, while the frontend honours what it advertised.
+        return std::max(dynamicParameters.MaxIntegerSamples, GetAdvertisedMaxSamples());
     }
 
     Bool ValidateRenderbufferStorageSize_State(GLsizei width, GLsizei height, const char* caller) {
@@ -2608,18 +2613,26 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void ClearBufferfi_Backend(GLenum buffer, GLint drawbuffer, GLfloat depth, GLint stencil) {
+        // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
+        if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferfi(buffer, drawbuffer, depth, stencil);
     }
 
     void ClearBufferfv_Backend(GLenum buffer, GLint drawbuffer, const GLfloat* value) {
+        // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
+        if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferfv(buffer, drawbuffer, value);
     }
 
     void ClearBufferuiv_Backend(GLenum buffer, GLint drawbuffer, const GLuint* value) {
+        // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
+        if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferuiv(buffer, drawbuffer, value);
     }
 
     void ClearBufferiv_Backend(GLenum buffer, GLint drawbuffer, const GLint* value) {
+        // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
+        if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferiv(buffer, drawbuffer, value);
     }
 
@@ -3148,15 +3161,55 @@ namespace MobileGL::MG_Impl::GLImpl {
         GetNamedFramebufferAttachmentParameteriv_State(framebuffer, attachment, pname, params);
     }
 
+    // The three argument errors GL 4.6 core 18.3.1 asks a blit for. They have to be raised here,
+    // in the backend-independent frontend: DirectGLES drains the driver's error queue around the
+    // blit on purpose (that is how the resolve fallback probes the driver), so an ES-side
+    // rejection never reaches the application and glGetError() answered GL_NO_ERROR for a call
+    // the spec requires to fail (KHR-GL30.api.coverage's glBlitFramebuffer sub-check). DirectVulkan
+    // already dropped the bad-filter and LINEAR-with-depth/stencil calls on the floor with a log
+    // line (VulkanRenderer::BlitFramebuffer), so the only thing that changes for it is that the
+    // error is now visible where the spec says it should be.
+    static Bool ValidateBlitMaskAndFilter(const char* functionName, GLbitfield mask, GLenum filter) {
+        constexpr GLbitfield kBlitMaskBits = GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT;
+        if ((mask & ~kBlitMaskBits) != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                             "mask contains bits other than GL_COLOR_BUFFER_BIT, "
+                                             "GL_DEPTH_BUFFER_BIT and GL_STENCIL_BUFFER_BIT."));
+            return false;
+        }
+        if (filter != GL_NEAREST && filter != GL_LINEAR) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                             "filter must be GL_NEAREST or GL_LINEAR."));
+            return false;
+        }
+        // Depth and stencil have no meaningful interpolation, so GL_LINEAR is rejected outright
+        // rather than downgraded - even when the mask also carries the colour bit.
+        if (filter == GL_LINEAR && (mask & (GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT)) != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                             "GL_LINEAR filtering is not allowed when mask includes "
+                                             "GL_DEPTH_BUFFER_BIT or GL_STENCIL_BUFFER_BIT."));
+            return false;
+        }
+        return true;
+    }
+
     void BlitNamedFramebuffer(GLuint readFramebuffer, GLuint drawFramebuffer, GLint srcX0, GLint srcY0, GLint srcX1,
                               GLint srcY1, GLint dstX0, GLint dstY0, GLint dstX1, GLint dstY1, GLbitfield mask,
                               GLenum filter) {
+        if (!ValidateBlitMaskAndFilter(__func__, mask, filter)) return;
         BlitNamedFramebuffer_State(readFramebuffer, drawFramebuffer, srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1,
                                    dstY1, mask, filter);
     }
 
     void BlitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0, GLint dstX1,
                          GLint dstY1, GLbitfield mask, GLenum filter) {
+        if (!ValidateBlitMaskAndFilter(__func__, mask, filter)) return;
         BlitFramebuffer_Backend(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask, filter);
     }
 

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.cpp

@@ -25,6 +25,7 @@
 #include <MG_State/GLState/FramebufferState/FramebufferObject.h>
 #include <MG_Util/Texture/TextureFormatProcessor.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
 #include <MG_Backend/BackendObjects.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
@@ -46,13 +47,29 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
         }
 
-        constexpr GLint kFrontendMaxComputeUniformComponents = 1024;
-        constexpr GLint kFrontendMaxComputeAtomicCounters = 8;
-        constexpr GLint kFrontendMaxComputeAtomicCounterBuffers = 8;
+        // Shared with the glslang resource table for the same reason as the atomic-counter
+        // limits below: gl_MaxComputeUniformComponents expands from BuildTBuiltInResource.
+        constexpr GLint kFrontendMaxComputeUniformComponents =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_COMPUTE_UNIFORM_COMPONENTS);
+        // Every atomic-counter limit is shared with the glslang resource table
+        // (BuildTBuiltInResource) through MG_Util/ShaderTranspiler/Types.h: GL 4.6 requires
+        // glGetIntegerv and the gl_MaxAtomicCounter* built-in constants to agree, and the two
+        // used to be independent tables that disagreed on both the binding count and the buffer
+        // size. Never move one of these without the other.
+        constexpr GLint kFrontendMaxComputeAtomicCounters =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTERS_PER_STAGE);
+        constexpr GLint kFrontendMaxComputeAtomicCounterBuffers =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTER_BUFFERS_PER_STAGE);
         constexpr GLint kFrontendMaxComputeSharedMemorySize = 32768;
         constexpr GLint kFrontendMaxComputeWorkGroupInvocations = 1024;
-        constexpr GLint kFrontendMaxCombinedAtomicCounters = 8;
-        constexpr GLint kFrontendMaxFragmentAtomicCounters = 8;
+        constexpr GLint kFrontendMaxCombinedAtomicCounters =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTERS_PER_STAGE);
+        constexpr GLint kFrontendMaxCombinedAtomicCounterBuffers =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTER_BUFFERS_PER_STAGE);
+        constexpr GLint kFrontendMaxFragmentAtomicCounters =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTERS_PER_STAGE);
+        constexpr GLint kFrontendMaxFragmentAtomicCounterBuffers =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTER_BUFFERS_PER_STAGE);
         constexpr GLint kFrontendMaxGeometryAtomicCounters = 0;
         constexpr GLint kFrontendMaxTessControlAtomicCounters = 0;
         constexpr GLint kFrontendMaxTessEvaluationAtomicCounters = 0;
@@ -66,10 +83,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         constexpr GLint kFrontendMaxTessControlAtomicCounterBuffers = 0;
         constexpr GLint kFrontendMaxTessEvaluationAtomicCounterBuffers = 0;
         constexpr GLint kFrontendMaxVertexAtomicCounterBuffers = 0;
-        // One atomic counter is a uint, and a buffer never has to hold more counters than the
-        // combined limit the frontend advertises. GL 4.6 table 23.63 floors this at 32 bytes.
+        // GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE: the byte offset ceiling a counter may be declared
+        // at. The matching binding count is applied in GetIndexedBufferQueryPointCount, so that
+        // the getter, the indexed queries and glBindBufferBase all share one ceiling.
         constexpr GLint kFrontendMaxAtomicCounterBufferSize =
-            kFrontendMaxCombinedAtomicCounters * static_cast<GLint>(sizeof(GLuint));
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTER_BUFFER_SIZE);
         // KHR_debug minima (GL 4.6 table 23.66); the debug entry points are stubs, but the
         // limits they advertise still have to be legal.
         constexpr GLint kFrontendMaxDebugGroupStackDepth = 64;
@@ -103,12 +121,16 @@ namespace MobileGL::MG_Impl::GLImpl {
         constexpr GLint kFrontendSubpixelBits = 4;
         constexpr GLint kFrontendMaxSamples = 4;
 
+        // The floors under GL_MAX_COMPUTE_WORK_GROUP_COUNT / _SIZE. Shared with the compile
+        // pipeline (CaptureCompileEnv floors the same driver answers at them, and
+        // BuildTBuiltInResource expands gl_MaxComputeWorkGroup* from the result), because a
+        // shader is allowed to compare the built-in constant against this query.
         constexpr GLint GetMinComputeWorkGroupCount(GLuint index) {
-            return index < 3 ? 65535 : 0;
+            return index < 3 ? static_cast<GLint>(MG_Util::ShaderTranspiler::MIN_COMPUTE_WORK_GROUP_COUNT[index]) : 0;
         }
 
         constexpr GLint GetMinComputeWorkGroupSize(GLuint index) {
-            return index < 2 ? 1024 : (index == 2 ? 64 : 0);
+            return index < 3 ? static_cast<GLint>(MG_Util::ShaderTranspiler::MIN_COMPUTE_WORK_GROUP_SIZE[index]) : 0;
         }
 
         GLint GetMaxCombinedUniformComponents(GLint maxDefaultUniformComponents, GLint maxUniformBlocks,
@@ -186,6 +208,16 @@ namespace MobileGL::MG_Impl::GLImpl {
                     MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxShaderStorageBufferBindings;
                 return std::min(frontendCount, static_cast<SizeT>(std::max(backendCount, 0)));
             }
+            if (bufferTarget == BufferTarget::AtomicCounter) {
+                // The counter family's binding count is NOT the state layer's array size: a
+                // counter buffer only reaches a shader as a lowered storage block, so what an
+                // implementation can serve is the reserved range, and that number is also what
+                // glslang compiles a layout(binding = N) atomic_uint against. Clamped here so
+                // GL_MAX_ATOMIC_COUNTER_BUFFER_BINDINGS, the indexed getters' index check and
+                // glBindBufferBase's all report the same ceiling.
+                return std::min(frontendCount,
+                                static_cast<SizeT>(MG_Util::ShaderTranspiler::MAX_ATOMIC_COUNTER_BUFFER_BINDINGS));
+            }
             return frontendCount;
         }
 
@@ -213,6 +245,23 @@ namespace MobileGL::MG_Impl::GLImpl {
             return ClampBlockCountToBindingPoints(blockCount, BufferTarget::ShaderStorage);
         }
 
+        // The per-stage GL_MAX_*_SHADER_STORAGE_BLOCKS answers. Backend-derived, and NOT a
+        // constant to be "restored" - these used to return a flat 16 for vertex, geometry and
+        // both tessellation stages, which is wrong on any host that does not serve storage
+        // blocks in those stages. Zero is a legal answer: GL 4.6 table 23.64 and ES 3.2 table
+        // 21.44 both set the minimum at 0 for every graphics stage except fragment, which is
+        // why the conformance suite gates each such test on the query instead of assuming it.
+        // ARM's GLES driver reports 0 for all four (a Mali-G925 does), and advertising 16 there
+        // bought nothing: the program still failed to link inside the backend, the frontend
+        // still reported LINK_STATUS as true, and every draw with it silently rendered nothing.
+        GLint StageStorageBlockCount(Int MG_Backend::DynamicBackendParameters::*stageLimit) {
+            static const MG_Backend::DynamicBackendParameters kBackendlessDefaults{};
+            const MG_Backend::DynamicBackendParameters& parameters =
+                MG_Backend::pActiveBackendObject ? MG_Backend::pActiveBackendObject->GetDynamicParameters()
+                                                 : kBackendlessDefaults;
+            return ClampStorageBlockCount(static_cast<GLint>(parameters.*stageLimit));
+        }
+
         bool TryDecodeDrawBufferQuery(GLenum pname, SizeT& drawBufferIndex) {
             if (pname == GL_DRAW_BUFFER) {
                 drawBufferIndex = 0;
@@ -422,6 +471,18 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     } // namespace
 
+    // GL 4.6 core table 23.53 requires GL_MAX_SAMPLES >= 4, so the driver's value is floored
+    // before it is advertised. Every other multisample ceiling MobileGL advertises has to be
+    // floored the same way: promising 4 samples globally while answering GL_MAX_INTEGER_SAMPLES
+    // 1 - which is exactly what Adreno reports - makes the frontend reject the very count it
+    // just told the application to use. The backends clamp the realised count instead.
+    GLint GetAdvertisedMaxSamples() {
+        if (MG_Backend::pActiveBackendObject == nullptr) {
+            return kFrontendMaxSamples;
+        }
+        return std::max(MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxSamples, kFrontendMaxSamples);
+    }
+
     /* @INSERTION_POINT:FUNCTION_IMPLEMENTATION@ */
     const GLubyte* GetString(GLenum name) {
         static String vendorString;
@@ -1511,15 +1572,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_LINE_WIDTH:
             *params = static_cast<GLint>(MG_State::pGLContext->GetLineWidth());
             return;
-        case GL_LAYER_PROVOKING_VERTEX:
-            *params = GL_LAST_VERTEX_CONVENTION;
-            return;
         case GL_LOGIC_OP_MODE:
             *params = static_cast<GLint>(MG_Util::ConvertLogicOperationToGLEnum(MG_State::pGLContext->GetLogicOp()));
             return;
         case GL_MAX_COMBINED_ATOMIC_COUNTERS:
             *params = kFrontendMaxCombinedAtomicCounters;
             return;
+        case GL_MAX_COMBINED_ATOMIC_COUNTER_BUFFERS:
+            *params = kFrontendMaxCombinedAtomicCounterBuffers;
+            return;
         case GL_MAX_COMBINED_UNIFORM_BLOCKS:
             *params = ClampUniformBlockCount(kFrontendMaxCombinedUniformBlocks);
             return;
@@ -1535,8 +1596,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_FRAGMENT_ATOMIC_COUNTERS:
             *params = kFrontendMaxFragmentAtomicCounters;
             return;
+        case GL_MAX_FRAGMENT_ATOMIC_COUNTER_BUFFERS:
+            *params = kFrontendMaxFragmentAtomicCounterBuffers;
+            return;
         case GL_MAX_FRAGMENT_SHADER_STORAGE_BLOCKS:
-            *params = ClampStorageBlockCount(16); // TODO
+            *params = StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxFragmentShaderStorageBlocks);
             return;
         case GL_MAX_FRAGMENT_INPUT_COMPONENTS:
             *params = kFrontendMaxFragmentInputComponents;
@@ -1562,7 +1626,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = kFrontendMaxGeometryAtomicCounterBuffers;
             return;
         case GL_MAX_GEOMETRY_SHADER_STORAGE_BLOCKS:
-            *params = ClampStorageBlockCount(16); // TODO
+            *params = StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxGeometryShaderStorageBlocks);
             return;
         case GL_MAX_GEOMETRY_INPUT_COMPONENTS:
             *params = kFrontendMaxGeometryInputComponents;
@@ -1597,7 +1661,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::Multisample) ? GL_TRUE : GL_FALSE;
             return;
         case GL_MIN_MAP_BUFFER_ALIGNMENT:
-            *params = 64; // TODO
+            // The same constant the map paths align to (MG_State/GLState/BufferState/
+            // PipeResource.h), never a literal: this number is a PROMISE about the pointers
+            // glMapBuffer and glMapBufferRange return, and the two used to be unrelated - the
+            // query said 64 while the pointers came out of a std::vector aligned to 16.
+            *params = static_cast<GLint>(MG_State::GLState::MIN_MAP_BUFFER_ALIGNMENT);
             return;
         case GL_MAX_LABEL_LENGTH:
             *params = 256; // TODO
@@ -1633,16 +1701,18 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = 0;
             return;
         case GL_MAX_TESS_CONTROL_SHADER_STORAGE_BLOCKS:
-            *params = ClampStorageBlockCount(16); // TODO
+            *params = StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxTessControlShaderStorageBlocks);
             return;
         case GL_MAX_TESS_EVALUATION_SHADER_STORAGE_BLOCKS:
-            *params = ClampStorageBlockCount(16); // TODO
+            *params =
+                StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxTessEvaluationShaderStorageBlocks);
             return;
         case GL_MAX_TEXTURE_LOD_BIAS:
             *params = 15; // TODO
             return;
         case GL_MAX_UNIFORM_LOCATIONS:
-            *params = 1024 * 4; // TODO
+            // The same constant the link's location allocator enforces - see ProgramObject.
+            *params = MG_State::GLState::ProgramObject::MAX_UNIFORM_LOCATIONS;
             return;
         case GL_MAX_VARYING_COMPONENTS:
             *params = kFrontendMaxVaryingComponents;
@@ -1662,7 +1732,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                           : MG_Backend::DynamicBackendParameters{}.MaxVertexImageUniforms;
             return;
         case GL_MAX_VERTEX_SHADER_STORAGE_BLOCKS:
-            *params = ClampStorageBlockCount(16); // TODO
+            *params = StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxVertexShaderStorageBlocks);
             return;
         case GL_MAX_VERTEX_UNIFORM_COMPONENTS:
             *params = kFrontendMaxVertexUniformComponents;
@@ -1972,6 +2042,24 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_UNIFORM_BUFFER_START:
             RecordIndexedOnlyGetterError(__func__, pname);
             return;
+        // glBindBufferBase/Range set the GENERIC binding point too (GL 4.6 core 6.1.1), and this
+        // is the one indexed-buffer family whose non-indexed query was never answered - so it
+        // fell through to INVALID_ENUM and left the caller's variable holding whatever was in its
+        // stack slot. _START/_SIZE stay indexed-only, exactly like their uniform-buffer siblings.
+        case GL_ATOMIC_COUNTER_BUFFER_BINDING:
+            if (const auto& obj =
+                    MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::AtomicCounter).GetBoundObject()) {
+                *params = static_cast<GLint>(obj->GetExternalIndex());
+            } else {
+                *params = 0;
+            }
+            return;
+        case GL_ATOMIC_COUNTER_BUFFER_START:
+            RecordIndexedOnlyGetterError(__func__, pname);
+            return;
+        case GL_ATOMIC_COUNTER_BUFFER_SIZE:
+            RecordIndexedOnlyGetterError(__func__, pname);
+            return;
         case GL_UNPACK_ALIGNMENT:
             *params = MG_State::pGLContext->GetPixelStoreParam(PixelStoreParam::UnpackAlignment);
             return;
@@ -2026,9 +2114,6 @@ namespace MobileGL::MG_Impl::GLImpl {
             params[3] = vp.w();
             return;
         }
-        case GL_VIEWPORT_INDEX_PROVOKING_VERTEX:
-            *params = GL_LAST_VERTEX_CONVENTION;
-            return;
         case GL_MAX_ELEMENT_INDEX:
             *params = 1024 * 1024; // TODO
             return;
@@ -2116,8 +2201,22 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_CLIP_DISTANCES:
             *params = dynamicParameters.MaxClipDistances;
             break;
+        // Both were a hard-coded GL_LAST_VERTEX_CONVENTION, derived from nothing. GL 4.6 table
+        // 23.65 permits GL_UNDEFINED_VERTEX for either, and that is what the backends report
+        // wherever they do not actually pin a convention - claiming one is a statement about
+        // which vertex of a primitive supplies gl_Layer / gl_ViewportIndex, and DirectGLES
+        // rasterizes only viewport 0 on a driver without GL_OES_viewport_array while
+        // DirectVulkan picks its provoking mode per pipeline. KHR-GLxx.viewport_array.query
+        // accepts all four values, and .provoking_vertex - which failed on both devices, in
+        // OPPOSITE directions - stops verifying as soon as either answer is undefined.
+        case GL_LAYER_PROVOKING_VERTEX:
+            *params = static_cast<GLint>(dynamicParameters.LayerProvokingVertex);
+            break;
+        case GL_VIEWPORT_INDEX_PROVOKING_VERTEX:
+            *params = static_cast<GLint>(dynamicParameters.ViewportIndexProvokingVertex);
+            break;
         case GL_MAX_COLOR_TEXTURE_SAMPLES:
-            *params = dynamicParameters.MaxColorTextureSamples;
+            *params = std::max(dynamicParameters.MaxColorTextureSamples, GetAdvertisedMaxSamples());
             break;
         case GL_MAX_COMBINED_FRAGMENT_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxFragmentUniformComponents,
@@ -2147,7 +2246,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = dynamicParameters.MaxCubeMapTextureSize;
             break;
         case GL_MAX_DEPTH_TEXTURE_SAMPLES:
-            *params = dynamicParameters.MaxDepthTextureSamples;
+            *params = std::max(dynamicParameters.MaxDepthTextureSamples, GetAdvertisedMaxSamples());
             break;
         case GL_MAX_FRAMEBUFFER_WIDTH:
             *params = dynamicParameters.MaxFramebufferWidth;
@@ -2174,7 +2273,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = dynamicParameters.MaxComputeImageUniforms;
             break;
         case GL_MAX_INTEGER_SAMPLES:
-            *params = dynamicParameters.MaxIntegerSamples;
+            *params = std::max(dynamicParameters.MaxIntegerSamples, GetAdvertisedMaxSamples());
             break;
         case GL_MAX_RENDERBUFFER_SIZE:
             *params = dynamicParameters.MaxRenderbufferSize;
@@ -2207,18 +2306,19 @@ namespace MobileGL::MG_Impl::GLImpl {
                                                           static_cast<Uint64>(INT32_MAX)));
             break;
         case GL_MAX_ATOMIC_COUNTER_BUFFER_BINDINGS:
+            // NOT the frontend's binding-point array size: GetIndexedBufferQueryPointCount
+            // clamps this family to the range a lowered counter block can actually be served
+            // from, which is the same number glslang compiles a layout(binding = N) atomic_uint
+            // against and the same one glBindBufferBase validates an index against.
             *params = static_cast<GLint>(GetIndexedBufferQueryPointCount(BufferTarget::AtomicCounter));
             break;
         case GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE:
             // The conformance suite splits this evenly across every advertised binding point and
             // binds all of them in one glBindBuffersRange
-            // (KHR-GL44.multi_bind.functional_bind_buffers_range), so the pair has to divide:
-            // 32 bytes over 36 binding points is a zero-sized range, which BindBufferRange
-            // rejects with INVALID_VALUE before it binds anything. Floor the advertised size at
-            // one counter per binding point.
-            *params = std::max<GLint>(
-                kFrontendMaxAtomicCounterBufferSize,
-                static_cast<GLint>(GetIndexedBufferQueryPointCount(BufferTarget::AtomicCounter) * sizeof(GLuint)));
+            // (KHR-GL44.multi_bind.functional_bind_buffers_range), so the pair has to divide -
+            // a zero-sized range is INVALID_VALUE before BindBufferRange binds anything. The
+            // shared constant is 16384 over 8 binding points, which divides.
+            *params = kFrontendMaxAtomicCounterBufferSize;
             break;
         case GL_MAX_TEXTURE_BUFFER_SIZE:
             *params = dynamicParameters.MaxTextureBufferSize;
@@ -2340,7 +2440,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                                         : dynamicParameters.MaxDrawBuffers;
             break;
         case GL_MAX_SAMPLES:
-            *params = std::max(dynamicParameters.MaxSamples, kFrontendMaxSamples);
+            *params = GetAdvertisedMaxSamples();
             break;
         case GL_MAX_TEXTURE_MAX_ANISOTROPY_EXT:
             // Float state (see GetFloatv); rounded to nearest for the integer query per GL 3.3 6.1.2.

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.h

@@ -24,4 +24,8 @@ namespace MobileGL::MG_Impl::GLImpl {
     void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
     GLenum GetError();
     GLenum GetGraphicsResetStatus();
+    // The GL_MAX_SAMPLES value MobileGL advertises, i.e. the driver's value floored to the GL
+    // core minimum. Frontend multisample validators have to honour this ceiling for every
+    // format, otherwise MobileGL rejects a sample count it advertised itself.
+    GLint GetAdvertisedMaxSamples();
 } // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Program/GL_Program.cpp

@@ -21,6 +21,9 @@
 #include <MG_Backend/BackendObjects.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
+    // The flattened uniform type these helpers used to take as a raw glslang::TType*
+    // pointing into the TProgram's pool allocator. See ProgramObject::TypeFacts.
+    using TypeFactsRef = const MG_State::GLState::ProgramObject::TypeFacts&;
     static GLint BoolToGLInt(bool value) {
         return value ? GL_TRUE : GL_FALSE;
     }
@@ -223,14 +226,14 @@ namespace MobileGL::MG_Impl::GLImpl {
         return false;
     }
 
-    GLint GetOpaqueUniformUnitLimit(const glslang::TType* type) {
+    GLint GetOpaqueUniformUnitLimit(const TypeFactsRef type) {
         const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
-        if (type && type->isImage()) return dynamicParameters.MaxImageUnits;
-        if (type && type->isTexture()) return dynamicParameters.MaxCombinedTextureImageUnits;
+        if (type.isImage) return dynamicParameters.MaxImageUnits;
+        if (type.isTexture) return dynamicParameters.MaxCombinedTextureImageUnits;
         return 0;
     }
 
-    bool ValidateOpaqueUniformUnit(const char* functionName, const glslang::TType* type, GLint unit) {
+    bool ValidateOpaqueUniformUnit(const char* functionName, const TypeFactsRef type, GLint unit) {
         const GLint limit = GetOpaqueUniformUnitLimit(type);
         if (unit < 0 || unit >= limit) {
             MG_State::pGLContext->RecordError(
@@ -525,6 +528,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_UNIFORM_ARRAY_STRIDE:
         case GL_UNIFORM_MATRIX_STRIDE:
         case GL_UNIFORM_IS_ROW_MAJOR:
+        // GL 4.2 / ARB_shader_atomic_counters adds this one to the accepted set. Leaving it
+        // out did not merely lose the answer: the leftover GL_INVALID_ENUM is what made
+        // KHR-GL43.shader_atomic_counters.basic-program-query force a FAIL.
+        case GL_UNIFORM_ATOMIC_COUNTER_BUFFER_INDEX:
             break;
         default:
             MG_State::pGLContext->RecordError(
@@ -580,6 +587,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             case GL_UNIFORM_IS_ROW_MAJOR:
                 params[i] = programObject->GetActiveUniformIsRowMajor(idx);
                 break;
+            case GL_UNIFORM_ATOMIC_COUNTER_BUFFER_INDEX:
+                // Index into the GL_ACTIVE_ATOMIC_COUNTER_BUFFERS list, -1 for every uniform
+                // that is not an atomic counter (GL 4.6 core table 7.6).
+                params[i] = programObject->GetActiveUniformAtomicCounterBufferIndex(idx);
+                break;
             default:
                 break;
             }
@@ -642,7 +654,13 @@ namespace MobileGL::MG_Impl::GLImpl {
             break;
         }
         case GL_ACTIVE_ATOMIC_COUNTER_BUFFERS:
-            *params = programObject->GetActiveAtomicCounterCount();
+            // Counter BUFFERS, not counters, and glslang's own getNumAtomicCounters() answers
+            // neither: the relaxed parse has already turned every atomic_uint into a plain uint
+            // member of a synthesized storage block by the time it builds its reflection, so it
+            // reports zero. The interface-query model recovers the buffers from those blocks and
+            // is what glGetProgramInterfaceiv(GL_ATOMIC_COUNTER_BUFFER, GL_ACTIVE_RESOURCES)
+            // already answers - the two queries are required to agree.
+            *params = ProgramInterface::GetActiveResourceCount(*programObject, GL_ATOMIC_COUNTER_BUFFER);
             MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
             break;
         case GL_ACTIVE_ATTRIBUTES:
@@ -856,10 +874,10 @@ namespace MobileGL::MG_Impl::GLImpl {
     // demotion makes a dmat4 a mat4 in the shader and a mat4-shaped slot here - but because it
     // is ROUTED differently: the caller's component-by-component EbtDouble branch has to widen
     // each float back to the queried type, and it undoes the same padding itself.
-    Bool TryGatherFloatMatrixColumns(const glslang::TType* ttype, const char* pBase, void* params) {
-        if (ttype == nullptr || !ttype->isMatrix() || ttype->getBasicType() == glslang::EbtDouble) return false;
-        const Int columns = ttype->getMatrixCols();
-        const Int rows = ttype->getMatrixRows();
+    Bool TryGatherFloatMatrixColumns(const TypeFactsRef ttype, const char* pBase, void* params) {
+        if (!ttype.isMatrix || ttype.isDouble) return false;
+        const Int columns = ttype.matrixCols;
+        const Int rows = ttype.matrixRows;
         for (Int column = 0; column < columns; ++column) {
             Memcpy(static_cast<char*>(params) + static_cast<SizeT>(column) * rows * sizeof(GLfloat),
                    pBase + static_cast<SizeT>(column) * 4 * sizeof(GLfloat), rows * sizeof(GLfloat));
@@ -871,7 +889,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     // everything except a float matrix, whose padded columns make it wider. The rule itself
     // lives on ProgramObject, because the pipeline composite's uniform refresh needs the same
     // one and two copies of a layout rule is one too many.
-    SizeT UniformStorageSpanInBytes(const glslang::TType* ttype, SizeT tightSize) {
+    SizeT UniformStorageSpanInBytes(const TypeFactsRef ttype, SizeT tightSize) {
         return MG_State::GLState::ProgramObject::UniformStorageSpanInBytes(ttype, tightSize);
     }
 
@@ -904,7 +922,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             auto offset = programObject->GetUniformOffset(location);
             auto size = programObject->GetUniformSizesInBytes(location);
             char* pUBO = (char*)programObject->MapUBO();
-            auto* ttype = programObject->GetUniformTType(location);
+            const auto& ttype = programObject->GetUniformTypeFacts(location);
             const SizeT span = UniformStorageSpanInBytes(ttype, size);
             if (pUBO == nullptr || offset == MG_State::GLState::ProgramObject::kInvalidUniformOffset ||
                 offset + span > programObject->GetUBOSize()) {
@@ -958,7 +976,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         auto offset = programObject->GetUniformOffset(location);
         auto size = programObject->GetUniformSizesInBytes(location);
         char* pUBO = static_cast<char*>(programObject->MapUBO());
-        auto* ttype = programObject->GetUniformTType(location);
+        const auto& ttype = programObject->GetUniformTypeFacts(location);
         const SizeT span = UniformStorageSpanInBytes(ttype, size);
         if (pUBO == nullptr || offset == MG_State::GLState::ProgramObject::kInvalidUniformOffset ||
             offset + span > programObject->GetUBOSize()) {
@@ -981,10 +999,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         // conversion rules (7.6: round to nearest for the integer queries) apply; the value
         // widens back to the queried type, having lost precision at the glUniform*d that
         // stored it and not here.
-        if (ttype->getBasicType() == glslang::EbtDouble) {
-            const Int columns = ttype->isMatrix() ? ttype->getMatrixCols() : 1;
-            const Int rows = ttype->isMatrix() ? ttype->getMatrixRows()
-                                               : (ttype->isVector() ? ttype->getVectorSize() : 1);
+        if (ttype.isDouble) {
+            const Int columns = ttype.isMatrix ? ttype.matrixCols : 1;
+            const Int rows = ttype.isMatrix ? ttype.matrixRows
+                                               : (ttype.isVector ? ttype.vectorSize : 1);
             // std140 gives every matrix column its own 16-byte slot; a non-matrix is one
             // tightly packed run and never reaches the stride at all.
             const SizeT columnStride = 4 * sizeof(GLfloat);
@@ -1057,21 +1075,20 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
-        static Bool allowVSOnlyPrograms;
-        static Bool initialized = false;
-        if (!initialized) {
-            const auto& activeBackendObject = MG_Backend::pActiveBackendObject;
-            if (!activeBackendObject) {
-                MGLOG_E_ONCE("activeBackendObject is not initialized!");
-                return;
-            }
-            const auto& rendererInfo = activeBackendObject->GetRendererInfo();
-            allowVSOnlyPrograms = (Int)rendererInfo.StaticBackendCapability.AllowVSOnlyPrograms;
-        }
+        // Read fresh every link, never latched in a static: the capability is
+        // per-backend, and a latch would freeze it across a backend teardown +
+        // re-initialization (the previous function-static memo here never even set
+        // its own initialized flag, so it re-read every call anyway - this makes
+        // the always-fresh behavior the stated one). A struct-field read per
+        // glLinkProgram costs nothing.
         const auto& activeBackendObject = MG_Backend::pActiveBackendObject;
-        if (activeBackendObject) {
-            programObject->SetMaxFragmentOutputColorNumber(activeBackendObject->GetDynamicParameters().MaxDrawBuffers);
+        if (!activeBackendObject) {
+            MGLOG_E_ONCE("activeBackendObject is not initialized!");
+            return;
         }
+        const Bool allowVSOnlyPrograms =
+            activeBackendObject->GetRendererInfo().StaticBackendCapability.AllowVSOnlyPrograms;
+        programObject->SetMaxFragmentOutputColorNumber(activeBackendObject->GetDynamicParameters().MaxDrawBuffers);
         programObject->Link(!allowVSOnlyPrograms);
     }
 
@@ -1192,8 +1209,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             Memcpy(pUBO + offset + byteOffsetInsideUniform, value, writeSize);
             programObject.MarkUBOContentDirty();
         } else {
-            auto* ttype = programObject.GetUniformTType(location);
-            if (!ttype->isTexture() && !ttype->isImage()) return;
+            const auto& ttype = programObject.GetUniformTypeFacts(location);
+            if (!ttype.isTexture && !ttype.isImage) return;
             if constexpr (!std::is_same_v<std::remove_cv_t<T>, GLint> || ItemCount != 1) {
                 MG_State::pGLContext->RecordError(
                     ErrorCode::InvalidOperation,
@@ -2836,6 +2853,73 @@ namespace MobileGL::MG_Impl::GLImpl {
         return ProgramInterface::GetResourceLocationIndex(*programObject, programInterface, name);
     }
 
+    // GL 4.6 §7.7. Every property this reports is one the GL_ATOMIC_COUNTER_BUFFER interface
+    // already carries, so this is a rename of glGetProgramResourceiv's props onto the older
+    // entry point's - and the two are required to agree, which is only true while both read the
+    // same model. It was a silent stub: it wrote nothing, raised nothing, and left every probe
+    // reading its own uninitialised output.
+    static Bool TryMapActiveAtomicCounterBufferProp(GLenum pname, GLenum& outProp) {
+        switch (pname) {
+        case GL_ATOMIC_COUNTER_BUFFER_BINDING:
+            outProp = GL_BUFFER_BINDING;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_DATA_SIZE:
+            outProp = GL_BUFFER_DATA_SIZE;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_ACTIVE_ATOMIC_COUNTERS:
+            outProp = GL_NUM_ACTIVE_VARIABLES;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_ACTIVE_ATOMIC_COUNTER_INDICES:
+            outProp = GL_ACTIVE_VARIABLES;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_REFERENCED_BY_VERTEX_SHADER:
+            outProp = GL_REFERENCED_BY_VERTEX_SHADER;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_REFERENCED_BY_TESS_CONTROL_SHADER:
+            outProp = GL_REFERENCED_BY_TESS_CONTROL_SHADER;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_REFERENCED_BY_TESS_EVALUATION_SHADER:
+            outProp = GL_REFERENCED_BY_TESS_EVALUATION_SHADER;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_REFERENCED_BY_GEOMETRY_SHADER:
+            outProp = GL_REFERENCED_BY_GEOMETRY_SHADER;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_REFERENCED_BY_FRAGMENT_SHADER:
+            outProp = GL_REFERENCED_BY_FRAGMENT_SHADER;
+            return true;
+        case GL_ATOMIC_COUNTER_BUFFER_REFERENCED_BY_COMPUTE_SHADER:
+            outProp = GL_REFERENCED_BY_COMPUTE_SHADER;
+            return true;
+        default:
+            return false;
+        }
+    }
+
+    void GetActiveAtomicCounterBufferiv(GLuint program, GLuint bufferIndex, GLenum pname, GLint* params) {
+        auto& programObject = TryToGetProgramForInterfaceQuery(program, __func__);
+        if (!programObject) return;
+        GLenum prop = GL_NONE;
+        if (!TryMapActiveAtomicCounterBufferProp(pname, prop)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "pname is not an active atomic counter buffer property."));
+            return;
+        }
+        Vector<GLint> values;
+        if (!ProgramInterface::GetResourceProp(*programObject, GL_ATOMIC_COUNTER_BUFFER, bufferIndex, prop, values)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "bufferIndex is not an active atomic counter buffer index."));
+            return;
+        }
+        if (params == nullptr) return;
+        // GL_ATOMIC_COUNTER_BUFFER_ACTIVE_ATOMIC_COUNTER_INDICES is the only multi-value property
+        // here, and the caller sized its array from _ACTIVE_ATOMIC_COUNTERS.
+        for (SizeT i = 0; i < values.size(); ++i) params[i] = values[i];
+    }
+
     // GL 4.6 §7.6.2: <storageBlockIndex> is an active shader storage block index of <program>
     // - that is, exactly what glGetProgramResourceIndex(GL_SHADER_STORAGE_BLOCK) returned.
     // Since wave 2 that index is the interface-query layer's, so this is where the one index

MobileGL/MG_Impl/GLImpl/Program/GL_Program.h

@@ -140,6 +140,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                               const GLenum* props, GLsizei bufSize, GLsizei* length, GLint* params);
     GLint GetProgramResourceLocation(GLuint program, GLenum programInterface, const GLchar* name);
     GLint GetProgramResourceLocationIndex(GLuint program, GLenum programInterface, const GLchar* name);
+    void GetActiveAtomicCounterBufferiv(GLuint program, GLuint bufferIndex, GLenum pname, GLint* params);
     void ShaderStorageBlockBinding(GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding);
     void Uniform1d(GLint location, GLdouble v0);
     void Uniform1dv(GLint location, GLsizei count, const GLdouble* value);

MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.cpp

@@ -19,7 +19,7 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
         // "<getAtomicCounterBlockName()>_<binding>" (ParseContextBase.cpp), one per GL
         // atomic-counter binding point. That block IS the GL_ATOMIC_COUNTER_BUFFER resource
         // and its trailing number IS GL_BUFFER_BINDING; its members stay GL_UNIFORMs.
-        constexpr const char* kAtomicCounterBlockPrefix = "gl_AtomicCounterBlock";
+        constexpr const char* kAtomicCounterBlockPrefix = MG_Util::ShaderTranspiler::ATOMIC_COUNTER_BLOCK_PREFIX;
 
         enum class BlockKind {
             Uniform,       // a real GL uniform block
@@ -81,19 +81,18 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
         // The enumerated spelling of an array resource is "name[0]". glslang already applies
         // that to uniforms and buffer variables (EShReflectionBasicArraySuffix), but never to
         // stage inputs/outputs, so those get it here.
-        String WithArraySuffix(const String& name, const glslang::TType* type) {
-            if (type == nullptr || !type->isArray() || EndsWithZeroSubscript(name)) return name;
+        String WithArraySuffix(const String& name, const ProgramObject::TypeFacts& type) {
+            if (!type.isArray || EndsWithZeroSubscript(name)) return name;
             return name + "[0]";
         }
 
         // GL_ARRAY_SIZE: element count for a sized array, 0 for a runtime-sized one
         // (a shader storage block's unsized trailing member), 1 for a non-array.
-        GLint ArraySizeOf(const glslang::TType* type, GLint reflectedSize) {
-            if (type != nullptr && type->isArray()) {
-                if (!type->isSizedArray()) return 0;
-                return type->getOuterArraySize();
-            }
-            return reflectedSize < 1 ? 1 : reflectedSize;
+        // `record.arraySize` is already the sized-array/reflected-size resolution; the only
+        // extra rule here is GL's 0 for a runtime-sized array.
+        GLint ArraySizeOf(const ProgramObject::ResourceReflection& record) {
+            if (record.type.isArray && !record.type.isSizedArray) return 0;
+            return record.arraySize;
         }
 
         // Two spellings name the same resource when they are equal, or differ only by the
@@ -174,22 +173,21 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
             return static_cast<GLint>(element);
         }
 
-        BlockKind ClassifyBlock(const glslang::TObjectReflection& block) {
+        BlockKind ClassifyBlock(const ProgramObject::BlockReflection& block) {
             if (std::strstr(block.name.c_str(), MG_Util::ShaderTranspiler::GLOBAL_UBO_NAME) != nullptr) {
                 return BlockKind::GlobalUbo;
             }
             if (IsAtomicCounterBlockName(block.name)) return BlockKind::AtomicCounter;
-            const glslang::TType* type = block.getType();
-            if (type != nullptr && type->getQualifier().storage == glslang::EvqBuffer) return BlockKind::Storage;
+            if (block.type.isBuffer) return BlockKind::Storage;
             return BlockKind::Uniform;
         }
 
         // std140/std430 column stride, the same vec4-rounded rule ProgramObject applies to
         // uniform matrices. 0 for a non-matrix.
-        GLint MatrixStrideOf(const glslang::TType* type) {
-            if (type == nullptr || !type->isMatrix()) return 0;
-            const bool rowMajor = type->getQualifier().layoutMatrix == glslang::ElmRowMajor;
-            const int strideVectorComponents = rowMajor ? type->getMatrixCols() : type->getMatrixRows();
+        GLint MatrixStrideOf(const ProgramObject::TypeFacts& type) {
+            if (!type.isMatrix) return 0;
+            const bool rowMajor = type.layoutMatrix == static_cast<Int>(glslang::ElmRowMajor);
+            const int strideVectorComponents = rowMajor ? type.matrixCols : type.matrixRows;
             constexpr int scalarSize = 4;
             const int vectorAlignment = (strideVectorComponents <= 1)    ? scalarSize
                                         : (strideVectorComponents == 2) ? 2 * scalarSize
@@ -197,9 +195,9 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
             return (vectorAlignment + 15) & ~15;
         }
 
-        GLint IsRowMajorOf(const glslang::TType* type) {
-            if (type == nullptr || !type->isMatrix()) return 0;
-            return type->getQualifier().layoutMatrix == glslang::ElmRowMajor ? 1 : 0;
+        GLint IsRowMajorOf(const ProgramObject::TypeFacts& type) {
+            if (!type.isMatrix) return 0;
+            return type.layoutMatrix == static_cast<Int>(glslang::ElmRowMajor) ? 1 : 0;
         }
 
         GLint MappedLocation(Int rawLocation) {
@@ -227,12 +225,12 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
         // Note the union is used even when it is empty: an array element nobody dereferenced has
         // no member bits and is genuinely referenced by nobody, which is the whole point - falling
         // back to the block's own mask there would restore the over-approximation.
-        Vector<Uint32> BuildBlockStagesFromMembers(const glslang::TProgram& reflection, Int blockCount) {
-            auto& mutableReflection = const_cast<glslang::TProgram&>(reflection);
+        Vector<Uint32> BuildBlockStagesFromMembers(const ProgramObject::LinkArtifacts& reflection,
+                                                    Int blockCount) {
             Vector<Uint32> stagesByBlock(static_cast<SizeT>(blockCount < 0 ? 0 : blockCount), 0u);
-            const Int uniformCount = mutableReflection.getNumUniformVariables();
+            const Int uniformCount = static_cast<Int>(reflection.uniformReflection.size());
             for (Int index = 0; index < uniformCount; ++index) {
-                const auto& uniform = mutableReflection.getUniform(index);
+                const auto& uniform = reflection.uniformReflection[index];
                 const Int owner = uniform.index;
                 if (owner < 0 || owner >= blockCount) continue;
                 stagesByBlock[static_cast<SizeT>(owner)] |= static_cast<Uint32>(uniform.stages);
@@ -250,7 +248,7 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
         // ss[1] and requires both to report the fragment stage, which only glslang's own
         // (deliberately over-approximating) block mask gets right. Storage and atomic-counter
         // blocks therefore keep that mask untouched.
-        Uint32 UniformBlockStages(const glslang::TObjectReflection& block, const Vector<Uint32>& stagesFromMembers,
+        Uint32 UniformBlockStages(const ProgramObject::BlockReflection& block, const Vector<Uint32>& stagesFromMembers,
                                   Int tIndex) {
             String arrayBase;
             Uint element = 0;
@@ -264,15 +262,15 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
             return stagesFromMembers[static_cast<SizeT>(tIndex)];
         }
 
-        void BuildBlocks(ProgramObject& program, const glslang::TProgram& reflection, Model& model,
+        void BuildBlocks(ProgramObject& program, const ProgramObject::LinkArtifacts& reflection, Model& model,
                          Vector<BlockKind>& blockKind, Vector<Int>& blockInterfaceIndex) {
-            const Int blockCount = const_cast<glslang::TProgram&>(reflection).getNumUniformBlocks();
+            const Int blockCount = static_cast<Int>(reflection.blockReflection.size());
             blockKind.assign(blockCount, BlockKind::Uniform);
             blockInterfaceIndex.assign(blockCount, -1);
             const Vector<Uint32> stagesFromMembers = BuildBlockStagesFromMembers(reflection, blockCount);
 
             for (Int tIndex = 0; tIndex < blockCount; ++tIndex) {
-                const auto& block = const_cast<glslang::TProgram&>(reflection).getUniformBlock(tIndex);
+                const auto& block = reflection.blockReflection[tIndex];
                 const BlockKind kind = ClassifyBlock(block);
                 blockKind[tIndex] = kind;
                 if (kind == BlockKind::AtomicCounter) {
@@ -293,7 +291,7 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
                     // glShaderStorageBlockBinding wins over the declaration (GL 4.6 §7.6.2 -
                     // exactly the same rule GL_UNIFORM_BLOCK follows through
                     // GetUniformBlockBinding below).
-                    const GLint declared = block.getBinding();
+                    const GLint declared = block.binding;
                     resource.bufferBinding = declared < 0 ? 0 : declared + BlockArrayElement(block.name);
                     const Int rebound = program.GetShaderStorageBlockBindingOverride(block.name);
                     if (rebound >= 0) resource.bufferBinding = static_cast<GLint>(rebound);
@@ -315,21 +313,22 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
                 resource.bufferDataSize = static_cast<GLint>(program.GetUBOSizeAt(glIndex));
                 const Int tIndex = program.TProgramBlockIndex(static_cast<Uint>(glIndex));
                 if (tIndex >= 0 && tIndex < blockCount) {
-                    resource.stages = UniformBlockStages(const_cast<glslang::TProgram&>(reflection).getUniformBlock(tIndex),
+                    resource.stages = UniformBlockStages(reflection.blockReflection[tIndex],
                                                       stagesFromMembers, tIndex);
                 }
                 model.uniformBlocks.push_back(Move(resource));
             }
         }
 
-        void BuildUniformsAndBufferVariables(ProgramObject& program, const glslang::TProgram& reflection, Model& model,
+        void BuildUniformsAndBufferVariables(ProgramObject& program,
+                                             const ProgramObject::LinkArtifacts& reflection, Model& model,
                                              const Vector<BlockKind>& blockKind,
                                              const Vector<Int>& blockInterfaceIndex) {
             const Uint uniformCount = program.GetUniformCount();
             for (Uint glIndex = 0; glIndex < uniformCount; ++glIndex) {
                 const Int tIndex = program.TProgramUniformIndex(glIndex);
-                const auto& refl = const_cast<glslang::TProgram&>(reflection).getUniform(tIndex);
-                const glslang::TType* type = refl.getType();
+                const auto& refl = ProgramObject::UniformAtIn(reflection, tIndex);
+                const auto& type = refl.type;
                 const Int owner = refl.index;
                 const BlockKind kind = (owner >= 0 && owner < static_cast<Int>(blockKind.size()))
                                            ? blockKind[owner]
@@ -338,7 +337,7 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
                 Resource resource;
                 resource.name = refl.name;
                 resource.type = static_cast<GLenum>(refl.glDefineType);
-                resource.arraySize = ArraySizeOf(type, refl.size);
+                resource.arraySize = ArraySizeOf(refl);
                 resource.stages = static_cast<Uint32>(refl.stages);
 
                 if (kind == BlockKind::Storage) {
@@ -414,17 +413,13 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
         // program that redeclares `out gl_PerVertex { vec4 gl_Position; }` still carries
         // gl_PointSize and gl_ClipDistance through the block-unwrapping reflection, and they
         // are not part of its output interface.
-        Bool IsHiddenBlockMember(const glslang::TType* type) {
-            return type != nullptr && type->getBasicType() == glslang::EbtVoid;
-        }
+        Bool IsHiddenBlockMember(const ProgramObject::TypeFacts& type) { return type.isVoid; }
 
-        void BuildStageIO(ProgramObject& program, const glslang::TProgram& reflection, Model& model) {
-            auto& mutableReflection = const_cast<glslang::TProgram&>(reflection);
-
-            const Int inputCount = mutableReflection.getNumPipeInputs();
+        void BuildStageIO(ProgramObject& program, const ProgramObject::LinkArtifacts& reflection, Model& model) {
+            const Int inputCount = static_cast<Int>(reflection.pipeInputReflection.size());
             for (Int index = 0; index < inputCount; ++index) {
-                const auto& refl = mutableReflection.getPipeInput(index);
-                const glslang::TType* type = refl.getType();
+                const auto& refl = reflection.pipeInputReflection[index];
+                const auto& type = refl.type;
                 if (IsHiddenBlockMember(type)) continue;
                 Resource resource;
                 // The Vulkan-semantics parse reflects the vertex builtins under their SPIR-V
@@ -432,10 +427,10 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
                 const String& glName = ProgramObject::NormalizeBuiltinPipeInputName(refl.name);
                 resource.name = WithArraySuffix(glName, type);
                 resource.type = static_cast<GLenum>(refl.glDefineType);
-                resource.arraySize = ArraySizeOf(type, refl.size);
+                resource.arraySize = ArraySizeOf(refl);
                 resource.location = program.GetAttributeLocation(refl.name);
-                if (resource.location < 0) resource.location = MappedLocation(static_cast<Int>(refl.layoutLocation()));
-                resource.isPerPatch = (type != nullptr && type->getQualifier().patch) ? 1 : 0;
+                if (resource.location < 0) resource.location = MappedLocation(refl.location);
+                resource.isPerPatch = type.isPatch ? 1 : 0;
                 resource.stages = static_cast<Uint32>(refl.stages);
                 model.programInputs.push_back(Move(resource));
             }
@@ -447,16 +442,16 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
             // carries its own layout(location=N)), and a location then manufactures a color
             // index of 0 where GL requires -1
             // (KHR-GL43.program_interface_query.separate-programs-tess-control).
-            const Bool lastStageIsFragment = mutableReflection.getIntermediate(EShLangFragment) != nullptr;
-            const Int outputCount = mutableReflection.getNumPipeOutputs();
+            const Bool lastStageIsFragment = reflection.lastStageIsFragment;
+            const Int outputCount = static_cast<Int>(reflection.pipeOutputReflection.size());
             for (Int index = 0; index < outputCount; ++index) {
-                const auto& refl = mutableReflection.getPipeOutput(index);
-                const glslang::TType* type = refl.getType();
+                const auto& refl = reflection.pipeOutputReflection[index];
+                const auto& type = refl.type;
                 if (IsHiddenBlockMember(type)) continue;
                 Resource resource;
                 resource.name = WithArraySuffix(refl.name, type);
                 resource.type = static_cast<GLenum>(refl.glDefineType);
-                resource.arraySize = ArraySizeOf(type, refl.size);
+                resource.arraySize = ArraySizeOf(refl);
                 resource.location = MappedLocation(program.GetFragmentDataLocation(refl.name.c_str()));
                 if (resource.location < 0 || !lastStageIsFragment) {
                     // A built-in output (gl_FragDepth, gl_SampleMask) has no location, and a
@@ -467,11 +462,11 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
                     resource.locationIndex = program.GetFragmentDataIndex(refl.name.c_str());
                     // glBindFragDataLocationIndexed wins; otherwise the shader's
                     // layout(index = N), which the frag-data maps never saw.
-                    if (resource.locationIndex == 0 && type != nullptr && type->getQualifier().hasIndex()) {
-                        resource.locationIndex = static_cast<GLint>(type->getQualifier().layoutIndex);
+                    if (resource.locationIndex == 0 && type.hasIndex) {
+                        resource.locationIndex = static_cast<GLint>(type.layoutIndex);
                     }
                 }
-                resource.isPerPatch = (type != nullptr && type->getQualifier().patch) ? 1 : 0;
+                resource.isPerPatch = type.isPatch ? 1 : 0;
                 resource.stages = static_cast<Uint32>(refl.stages);
                 model.programOutputs.push_back(Move(resource));
             }
@@ -511,15 +506,14 @@ namespace MobileGL::MG_Impl::GLImpl::ProgramInterface {
         Model BuildModel(ProgramObject& program) {
             Model model;
             if (!program.GetLinkStatus()) return model;
-            const glslang::TProgram* reflection = program.GetReflection();
-            if (reflection == nullptr) return model;
+            const ProgramObject::LinkArtifacts& reflection = program.GetLinkReflection();
             model.valid = true;
 
             Vector<BlockKind> blockKind;
             Vector<Int> blockInterfaceIndex;
-            BuildBlocks(program, *reflection, model, blockKind, blockInterfaceIndex);
-            BuildUniformsAndBufferVariables(program, *reflection, model, blockKind, blockInterfaceIndex);
-            BuildStageIO(program, *reflection, model);
+            BuildBlocks(program, reflection, model, blockKind, blockInterfaceIndex);
+            BuildUniformsAndBufferVariables(program, reflection, model, blockKind, blockInterfaceIndex);
+            BuildStageIO(program, reflection, model);
             BuildXfb(program, model);
             return model;
         }

MobileGL/MG_Impl/GLImpl/Query/GL_Query.cpp

@@ -31,8 +31,15 @@ namespace MobileGL::MG_Impl::GLImpl {
             Bool ended = false;
             Bool resultCached = false;
             Uint64 cachedResult = 0;
-            // Transform feedback primitive counter at BeginQuery time.
+            // The transform feedback primitive counter matching this query's target, at
+            // BeginQuery time.
             Uint64 counterSnapshot = 0;
+            // Capture-draw counters at BeginQuery time: how many capture draws the CPU
+            // accounting had reproduced exactly, and how many of those it could not (a
+            // geometry stage amplifies). Their deltas decide whether the CPU result may
+            // stand in for the backend's.
+            Uint64 accountedCaptureDrawSnapshot = 0;
+            Uint64 geometryCaptureDrawSnapshot = 0;
         };
 
         // Query calls may arrive from any thread (launchers migrate the context
@@ -122,6 +129,46 @@ namespace MobileGL::MG_Impl::GLImpl {
             g_activeTimeElapsedQueryId = 0;
         }
 
+        // The CPU accounting counter a transform feedback query target reads: what the capture
+        // buffers took for GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN, and everything the capture
+        // stage assembled - a paused span included - for GL_PRIMITIVES_GENERATED. One counter
+        // for both targets would report the clamped written count as the generated one.
+        Uint64 TransformFeedbackCounterForTarget(GLenum target) {
+            return target == GL_PRIMITIVES_GENERATED
+                       ? MG_State::pGLContext->GetTransformFeedbackGeneratedCounter()
+                       : MG_State::pGLContext->GetTransformFeedbackPrimitiveCounter();
+        }
+
+        // The span's CPU accounting delta. Saturating: a snapshot left above its counter (a
+        // context switch between Begin and End, a counter that never moved) would otherwise
+        // wrap to 2^64-1, which GetQueryObjectuiv hands the app as 4294967295.
+        Uint64 TransformFeedbackCpuResult(const QueryObject* queryObject) {
+            const Uint64 counter = TransformFeedbackCounterForTarget(queryObject->target);
+            return counter > queryObject->counterSnapshot ? counter - queryObject->counterSnapshot : 0;
+        }
+
+        // Whether this ended span's result should come from the CPU accounting rather than from
+        // the backend query it also ran. Three conditions, all necessary:
+        //   * the backend asked for it (DirectGLES, whose ES driver counter is the unreliable
+        //     one; DirectVulkan never sets the bit and so is untouched by any of this);
+        //   * the target is PRIMITIVES_WRITTEN. GL_PRIMITIVES_GENERATED counts primitives
+        //     whether or not a capture is active, and the accounting only ever sees capture
+        //     draws, so the backend's counter is the more complete answer there;
+        //   * the span was fully accounted: at least one capture draw reached the accounting
+        //     (the instanced, indirect and multi-draw entry points do not call it at all, so a
+        //     span made of those is invisible to it) and none of them amplified through a
+        //     geometry stage, which the CPU cannot model.
+        Bool PrefersCpuTransformFeedbackResult(const QueryObject* queryObject) {
+            if (!MG_Backend::gBackendFunctionsTable.GL.PrefersCpuXfbPrimitiveAccounting) return false;
+            if (queryObject->target != GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN) return false;
+            if (MG_State::pGLContext->GetTransformFeedbackGeometryCaptureDraws() !=
+                queryObject->geometryCaptureDrawSnapshot) {
+                return false;
+            }
+            return MG_State::pGLContext->GetTransformFeedbackAccountedCaptureDraws() !=
+                   queryObject->accountedCaptureDrawSnapshot;
+        }
+
         // Shared GetQueryObject* implementation. Returns false when an error
         // was recorded and no value should be written back. `outValueProduced`, when given,
         // additionally distinguishes "succeeded with a value" from "succeeded but the result is not
@@ -407,7 +454,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             const auto beginXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.BeginXfbPrimitivesQuery;
             queryObject->backendHandle =
                 beginXfbPrimitivesQuery ? beginXfbPrimitivesQuery(target == GL_PRIMITIVES_GENERATED) : nullptr;
-            queryObject->counterSnapshot = MG_State::pGLContext->GetTransformFeedbackPrimitiveCounter();
+            queryObject->counterSnapshot = TransformFeedbackCounterForTarget(target);
+            queryObject->accountedCaptureDrawSnapshot =
+                MG_State::pGLContext->GetTransformFeedbackAccountedCaptureDraws();
+            queryObject->geometryCaptureDrawSnapshot =
+                MG_State::pGLContext->GetTransformFeedbackGeometryCaptureDraws();
         } else if (isOcclusionQuery) {
             queryObject->backendHandle = MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery();
         } else {
@@ -448,12 +499,21 @@ namespace MobileGL::MG_Impl::GLImpl {
                 if (const auto endXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.EndXfbPrimitivesQuery) {
                     endXfbPrimitivesQuery(queryObject->backendHandle);
                 }
-                // Result comes from the GPU query at read time.
-            } else {
-                queryObject->cachedResult =
-                    MG_State::pGLContext->GetTransformFeedbackPrimitiveCounter() - queryObject->counterSnapshot;
+            }
+            // A backend query that is not going to be read is released here, not left to be
+            // collected later: the span is over, the driver object has nothing left to say.
+            // Ending it first is what makes that legal.
+            if (!queryObject->backendHandle || PrefersCpuTransformFeedbackResult(queryObject)) {
+                if (queryObject->backendHandle) {
+                    if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        deleteBackendQuery(queryObject->backendHandle);
+                    }
+                    queryObject->backendHandle = nullptr;
+                }
+                queryObject->cachedResult = TransformFeedbackCpuResult(queryObject);
                 queryObject->resultCached = true;
             }
+            // Otherwise the result comes from the GPU query at read time.
             queryObject->active = false;
             queryObject->ended = true;
             activeQueryId = 0;
@@ -505,6 +565,75 @@ namespace MobileGL::MG_Impl::GLImpl {
         queryObject->ended = true;
     }
 
+    void BeginConditionalRender(GLuint id, GLenum mode) {
+        // GL 4.6 core 10.9's eight modes. The _INVERTED half flips the sense of the predicate;
+        // the BY_REGION half only narrows WHERE an implementation is permitted to discard, so
+        // treating it as its whole-framebuffer sibling is what an implementation without region
+        // granularity does. The _NO_WAIT half is a permission to render rather than stall, not an
+        // obligation - see the resolve below.
+        Bool inverted = false;
+        switch (mode) {
+        case GL_QUERY_WAIT:
+        case GL_QUERY_NO_WAIT:
+        case GL_QUERY_BY_REGION_WAIT:
+        case GL_QUERY_BY_REGION_NO_WAIT:
+            inverted = false;
+            break;
+        case GL_QUERY_WAIT_INVERTED:
+        case GL_QUERY_NO_WAIT_INVERTED:
+        case GL_QUERY_BY_REGION_WAIT_INVERTED:
+        case GL_QUERY_BY_REGION_NO_WAIT_INVERTED:
+            inverted = true;
+            break;
+        default:
+            RecordQueryError(ErrorCode::InvalidEnum, __FUNCTION__, "mode is not a conditional render mode.");
+            return;
+        }
+
+        if (MG_State::pGLContext->IsConditionalRenderActive()) {
+            RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "Conditional rendering is already active.");
+            return;
+        }
+
+        {
+            const std::lock_guard<std::mutex> lock(g_queryObjectsMutex);
+            const auto* queryObject = FindQueryObjectLocked(id);
+            // A generated NAME is not yet a query object; it becomes one at its first use with a
+            // target (the same rule glIsQuery answers by).
+            if (!queryObject || (!queryObject->created && queryObject->target == 0)) {
+                RecordQueryError(ErrorCode::InvalidValue, __FUNCTION__, "id is not the name of a query object.");
+                return;
+            }
+            if (queryObject->active) {
+                RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "The query object is still active.");
+                return;
+            }
+            if (queryObject->target != GL_SAMPLES_PASSED && queryObject->target != GL_ANY_SAMPLES_PASSED &&
+                queryObject->target != GL_ANY_SAMPLES_PASSED_CONSERVATIVE) {
+                RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__,
+                                 "Conditional rendering requires an occlusion query object.");
+                return;
+            }
+        }
+
+        // Resolved ONCE, here, and by WAITING even for the _NO_WAIT modes: the spec lets those
+        // render instead of stalling, so always waiting is conforming and is the only choice that
+        // gives the whole block one deterministic verdict. Reading it per command instead would
+        // let a result that lands mid-block change the answer half way through.
+        Uint64 samplesPassed = 0;
+        if (!GetQueryObjectValue(id, GL_QUERY_RESULT, __FUNCTION__, samplesPassed)) return;
+        const Bool passed = samplesPassed != 0;
+        MG_State::pGLContext->BeginConditionalRender(id, mode, inverted ? passed : !passed);
+    }
+
+    void EndConditionalRender() {
+        if (!MG_State::pGLContext->IsConditionalRenderActive()) {
+            RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "Conditional rendering is not active.");
+            return;
+        }
+        MG_State::pGLContext->EndConditionalRender();
+    }
+
     void GetQueryiv(GLenum target, GLenum pname, GLint* params) {
         if (!params) {
             return;
@@ -648,4 +777,39 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!ValidateQueryStreamIndex(__FUNCTION__, target, index)) return;
         GetQueryiv(target, pname, params);
     }
+
+    void DestroyAllQueryObjects() {
+        // Detach the registry under the lock, release outside it - same discipline
+        // (and the same accepted teardown race) as DestroyAllSyncObjects. Without
+        // this drain, every query the app left undeleted survived full library
+        // teardown in the process-global registry: the objects and their backend
+        // wrappers leaked across Destroy/Initialize cycles, stale ids kept
+        // answering IsQuery == GL_TRUE in the re-initialized library, and a later
+        // glDeleteQueries could hand the OLD backend's handle to a DIFFERENT
+        // backend's DeleteBackendQuery, which casts it to the wrong wrapper type.
+        UnorderedMap<GLuint, QueryObject*> orphans;
+        {
+            const std::lock_guard<std::mutex> lock(g_queryObjectsMutex);
+            orphans.swap(g_liveQueryObjects);
+            g_activeTimeElapsedQueryId = 0;
+            g_activePrimitivesWrittenQueryId = 0;
+            g_activePrimitivesGeneratedQueryId = 0;
+            g_activeSamplesPassedQueryId = 0;
+        }
+        if (orphans.empty()) {
+            return;
+        }
+        // Backend handles must be released by the backend that created them, so
+        // this runs while the function table is still populated. Both backends'
+        // DeleteBackendQuery are generation-guarded, so a handle whose renderer
+        // or ES context is already gone frees only the wrapper.
+        const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery;
+        for (const auto& [_, queryObject] : orphans) {
+            if (deleteBackendQuery && queryObject->backendHandle) {
+                deleteBackendQuery(queryObject->backendHandle);
+            }
+            delete queryObject;
+        }
+        MGLOG_D("DestroyAllQueryObjects: reclaimed %zu query object(s) the app left undeleted", orphans.size());
+    }
 } // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Query/GL_Query.h

@@ -29,4 +29,18 @@ namespace MobileGL::MG_Impl::GLImpl {
     void GetQueryBufferObjecti64v(GLuint id, GLuint buffer, GLenum pname, GLintptr offset);
     void GetQueryBufferObjectui64v(GLuint id, GLuint buffer, GLenum pname, GLintptr offset);
     void QueryCounter(GLuint id, GLenum target);
+    // Conditional rendering (GL 4.6 core 10.9). Implemented here rather than beside the drawing
+    // entry points because the predicate is a QUERY OBJECT's result, and the object registry -
+    // with the lock that guards it - lives in this file.
+    void BeginConditionalRender(GLuint id, GLenum mode);
+    void EndConditionalRender();
+    // Destroys every still-registered query object exactly as DeleteQueries would.
+    // GL requires queries to die with their context; called only from full library
+    // teardown (DestroyImpl), where no context survives on any thread, so the
+    // process-global registry can be drained wholesale. Must run while the backend
+    // function table is still populated: each backend handle has to be released by
+    // the backend that created it, never by a later re-initialized one (whose
+    // DeleteBackendQuery would cast the wrapper to the wrong backend's type).
+    // Same contract as DestroyAllSyncObjects.
+    void DestroyAllQueryObjects();
 } // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Sync/GL_Sync.cpp

@@ -8,6 +8,7 @@
 
 #include "GL_Sync.h"
 #include <MG_Backend/BackendObjects.h>
+#include <MG_State/GLState/Core.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -35,6 +36,22 @@ namespace MobileGL::MG_Impl::GLImpl {
     } // namespace
 
     GLsync FenceSync(GLenum condition, GLbitfield flags) {
+        // GL 4.6 core 4.1.2: GL_SYNC_GPU_COMMANDS_COMPLETE is the only condition and the only
+        // legal flags value is zero; both violations return 0 rather than a handle. A caller that
+        // then hands the 0 back to glDeleteSync hits the glDeleteSync(0) no-op below.
+        if (condition != GL_SYNC_GPU_COMMANDS_COMPLETE) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "condition must be GL_SYNC_GPU_COMMANDS_COMPLETE."));
+            return nullptr;
+        }
+        if (flags != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "flags must be zero."));
+            return nullptr;
+        }
         auto* syncObject = new SyncObject;
         syncObject->condition = condition;
         syncObject->flags = flags;
@@ -64,6 +81,18 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void WaitSync(GLsync sync, GLbitfield flags, GLuint64 timeout) {
+        // GL 4.6 core 4.1.2: the server-side wait takes no flags and no finite timeout - both
+        // arguments exist only to be forward-compatible, and anything else is INVALID_VALUE.
+        // Neither backend ever honored a nonzero timeout (DirectGLES hard-codes
+        // 0/GL_TIMEOUT_IGNORED, DirectVulkan's queue ordering makes the wait implicit), so
+        // rejecting the call loses no wait that used to happen.
+        if (flags != 0 || timeout != GL_TIMEOUT_IGNORED) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "flags must be zero and timeout must be GL_TIMEOUT_IGNORED."));
+            return;
+        }
         const auto* syncObject = FindSyncObject(sync);
         if (!syncObject) {
             return;

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp

@@ -474,15 +474,48 @@ namespace MobileGL::MG_Impl::GLImpl {
                    target == TextureTarget::Texture2DMultisampleArray;
         }
 
-        Int GetMaxSupportedTextureSamples(TextureInternalFormat textureInternalFormat) {
+        // The largest count the backend actually probed for this format on this target, or 0 when
+        // it has no answer for the pair. Both backends build the list in descending order.
+        Int GetProbedMaxTextureSamples(TextureTarget textureTarget, TextureInternalFormat textureInternalFormat) {
+            if (MG_Backend::pActiveBackendObject == nullptr) {
+                return 0;
+            }
+            const SizeT targetIndex = MG_Backend::GetFormatCapabilityTargetIndex(textureTarget);
+            const SizeT formatIndex = static_cast<SizeT>(textureInternalFormat);
+            if (targetIndex >= MG_Backend::kFormatCapabilityTargetCount ||
+                formatIndex >= MG_Backend::kFormatCapabilityFormatCount) {
+                return 0;
+            }
+            const auto& sampleCounts =
+                MG_Backend::pActiveBackendObject->GetFormatCapabilities().SampleCounts[targetIndex][formatIndex];
+            return sampleCounts.empty() ? 0 : sampleCounts.front();
+        }
+
+        // The ceiling the frontend enforces, which must never be lower than the one MobileGL
+        // advertises: the CTS - and real applications - read GL_MAX_SAMPLES once and hand that
+        // exact count to glTexImage*Multisample for every format. Answering 4 there and then
+        // rejecting 4 here because the ES driver reports GL_MAX_INTEGER_SAMPLES 1 (Adreno) is a
+        // self-inconsistency, not a spec-mandated error. The backends clamp the count they hand
+        // the driver; the shadow state keeps reporting what the application asked for.
+        Int GetMaxSupportedTextureSamples(TextureTarget textureTarget,
+                                          TextureInternalFormat textureInternalFormat) {
             if (MG_Backend::pActiveBackendObject == nullptr) {
                 return std::numeric_limits<Int>::max();
             }
 
+            const Int advertisedMaxSamples = GetAdvertisedMaxSamples();
+            // glGetInternalformativ(GL_SAMPLES) is answered from this very list (GetInternalformativ
+            // below), and GL 4.6 core 8.8 makes that query the definition of the per-format
+            // maximum - validating against anything else is how the two answers drifted apart.
+            const Int probedMaxSamples = GetProbedMaxTextureSamples(textureTarget, textureInternalFormat);
+            if (probedMaxSamples > 0) {
+                return std::max(probedMaxSamples, advertisedMaxSamples);
+            }
+
             const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
             if (MG_Util::IsDepthFormatInternalFormat(textureInternalFormat) ||
                 MG_Util::IsStencilFormatInternalFormat(textureInternalFormat)) {
-                return std::max(dynamicParameters.MaxDepthTextureSamples, 1);
+                return std::max(dynamicParameters.MaxDepthTextureSamples, advertisedMaxSamples);
             }
 
             GLenum normalizedInternalFormat = MG_Util::ConvertTextureInternalFormatToGLEnum(textureInternalFormat);
@@ -495,7 +528,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                          normalizedFormat == GL_RGB_INTEGER || normalizedFormat == GL_RGBA_INTEGER;
             return std::max(isIntegerFormat ? dynamicParameters.MaxIntegerSamples
                                             : dynamicParameters.MaxColorTextureSamples,
-                            1);
+                            advertisedMaxSamples);
         }
 
         Bool ValidateTextureMultisampleStorage(TextureTarget textureTarget, GLsizei samples, GLsizei width,
@@ -532,7 +565,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             // dimensions, and GL CTS's per-case state reset (gluStateReset) clears the default
             // GL_TEXTURE_2D_MULTISAMPLE_ARRAY texture with glTexImage3DMultisample(..., 0, 0, 0).
 
-            const Int maxSamples = GetMaxSupportedTextureSamples(textureInternalFormat);
+            const Int maxSamples = GetMaxSupportedTextureSamples(textureTarget, textureInternalFormat);
             if (samples > maxSamples) {
                 // GL specifies INVALID_OPERATION - not INVALID_VALUE - when the sample count
                 // exceeds what the format supports, and the native Adreno driver agrees.
@@ -557,6 +590,20 @@ namespace MobileGL::MG_Impl::GLImpl {
                             "AllocateMultisampleTextureStorage requires mipmap-backed storage");
 
             auto* textureMipmapObject = static_cast<MG_State::GLState::TextureObjectMipmap*>(textureObject.get());
+            // GL 4.6 core 8.8: a zero-sized image DEALLOCATES the image rather than defining an
+            // empty one. Only the multisample pair cares, and it cares a great deal: the CTS's
+            // per-case state reset clears both DEFAULT multisample textures this way on every
+            // texture unit, and a "defined" 0x0 default texture stops being skipped by
+            // IsUndefinedDefaultTexture - it then joins the per-draw sync and bind passes on
+            // every unit the reset touched, and reaches an ES glTexStorage*Multisample(..., 0, 0)
+            // that ES 3.1 8.19 makes INVALID_VALUE on every driver there is. A proxy target holds
+            // no image at all, only the query result, so it keeps recording what was asked for.
+            if ((width <= 0 || height <= 0 || depth <= 0) &&
+                !TextureImpl::IsProxyTextureTarget(textureUploadTarget)) {
+                textureObject->SetInternalFormat(TextureInternalFormat::Unknown);
+                textureMipmapObject->TruncateMipmapLevels(textureUploadTarget, 0);
+                return;
+            }
             textureObject->SetInternalFormat(textureInternalFormat);
             textureObject->SetSamples(samples);
             textureObject->SetFixedSampleLocations(fixedsamplelocations == GL_TRUE);
@@ -614,21 +661,42 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Compressed texture formats are not supported."));
         }
 
-        // glGetTexLevelParameter{i,f}v answers WIDTH/HEIGHT/DEPTH out of the mipmap chain. The only
-        // other storage type the state layer knows is GL_TEXTURE_BUFFER (TextureStorageType is
-        // {Mipmap, Buffer}), whose level geometry this stack does not track yet. Report that instead
-        // of throwing: THROW_UNIMPL_EXCEPTION unwinds a C++ exception through the C GL ABI and takes
-        // the process down, which is never an acceptable answer to a query - see the same reasoning
-        // above for the compressed-format path.
+        // GL_TEXTURE_WIDTH of a buffer texture: how many texels of the texture's internal format fit
+        // in the buffer range it addresses, CLAMPED to GL_MAX_TEXTURE_BUFFER_SIZE. Attaching a larger
+        // buffer is legal (GL 4.6 core 8.9) - the texture simply addresses the first
+        // MAX_TEXTURE_BUFFER_SIZE texels of it, and that clamped count is what WIDTH reports.
+        //
+        // GL_TEXTURE_BUFFER_SIZE is deliberately NOT clamped the same way: it reports the range in
+        // basic machine units exactly as glTexBuffer/glTexBufferRange were given it. Swapping the two
+        // fails KHR-GL43.texture_buffer.texture_buffer_max_size in the opposite direction.
+        GLint GetBufferTextureTexelWidth(const MG_State::GLState::ITextureObject* textureObject) {
+            const SizeT texelByteSize = MG_Util::GetSizedInternalFormatSizeInBytes(textureObject->GetFormat());
+            // A format with no known footprint has no texel count to report; answering 0 beats
+            // dividing by it.
+            if (texelByteSize == 0) return 0;
+            const auto* bufferTextureObject =
+                static_cast<const MG_State::GLState::TextureObjectBuffer*>(textureObject);
+            const SizeT texelCount = bufferTextureObject->GetBufferRangeSizeInBytes() / texelByteSize;
+            const SizeT maxTexelCount = static_cast<SizeT>(
+                std::max(0, MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxTextureBufferSize));
+            return static_cast<GLint>(std::min(texelCount, maxTexelCount));
+        }
+
+        // glGetTexLevelParameter{i,f}v answers WIDTH/HEIGHT/DEPTH out of the mipmap chain, and (since
+        // the buffer-texture arms above) out of the attached buffer range for GL_TEXTURE_BUFFER. This
+        // is what is left: a storage class with no level geometry at all. Report it instead of
+        // throwing - THROW_UNIMPL_EXCEPTION unwinds a C++ exception through the C GL ABI and takes the
+        // process down, which is never an acceptable answer to a query - see the same reasoning above
+        // for the compressed-format path.
         void RecordUnsupportedLevelQueryStorage(const char* caller, GLenum pname) {
-            MGLOG_W_ONCE("%s: glGetTexLevelParameter(pname=%s) is not implemented for texture-buffer "
-                    "storage; recording GL_INVALID_OPERATION instead of terminating",
+            MGLOG_W_ONCE("%s: glGetTexLevelParameter(pname=%s) is not implemented for this texture's "
+                    "storage class; recording GL_INVALID_OPERATION instead of terminating",
                     caller, MG_Util::ConvertGLEnumToString(pname).c_str());
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
                 MakeUnique<GenericErrorInfo>(
                     "MG_Impl/GLImpl", caller,
-                    "Level queries are not supported for texture-buffer storage."));
+                    "Level queries are not supported for this texture's storage class."));
         }
     } // namespace
 
@@ -644,6 +712,34 @@ namespace MobileGL::MG_Impl::GLImpl {
         return textureObject;
     }
 
+    // Whether a raw internalformat enum names a compressed format - the question GL asks whenever an
+    // entry point is forbidden on a compressed image: glTexStorage3D on TEXTURE_3D (no
+    // block-compressed format is defined for a three-dimensional image, so it is INVALID_OPERATION
+    // rather than the INVALID_ENUM an unknown sized format gets - GL 4.6 core 8.19 / Khronos bug
+    // 11239, KHR-GLxx.texture_storage.compressed_data) and the clear-texture pair (8.19 again).
+    // Written against the enum ranges rather than a name list because the families are contiguous
+    // and MobileGL's own internal-format enum drops the ones it cannot carry, which would make this
+    // check silently narrower than the API surface.
+    static Bool IsCompressedGLInternalFormat(GLenum internalformat) {
+        switch (internalformat) {
+        case 0x8225: // GL_COMPRESSED_RED
+        case 0x8226: // GL_COMPRESSED_RG
+        case 0x84ED: // GL_COMPRESSED_RGB
+        case 0x84EE: // GL_COMPRESSED_RGBA
+        case 0x8C48: // GL_COMPRESSED_SRGB
+        case 0x8C49: // GL_COMPRESSED_SRGB_ALPHA
+            return true;
+        default:
+            break;
+        }
+        return (internalformat >= 0x83F0 && internalformat <= 0x83F3) || // S3TC / DXT
+               (internalformat >= 0x8DBB && internalformat <= 0x8DBE) || // RGTC
+               (internalformat >= 0x8E8C && internalformat <= 0x8E8F) || // BPTC
+               (internalformat >= 0x9270 && internalformat <= 0x9279) || // ETC2 / EAC
+               (internalformat >= 0x93B0 && internalformat <= 0x93BD) || // ASTC LDR
+               (internalformat >= 0x93D0 && internalformat <= 0x93DD);   // ASTC sRGB
+    }
+
     namespace {
         void RecordClearTextureError(const char* caller, ErrorCode code, const String& message) {
             MG_State::pGLContext->RecordError(
@@ -679,6 +775,21 @@ namespace MobileGL::MG_Impl::GLImpl {
                                         std::format("Texture level {} is not defined.", level));
                 return nullptr;
             }
+            // GL 4.6 core 8.19: a compressed internal format is INVALID_OPERATION for both clear
+            // entry points. Two tags to ask, because they answer different questions: the stored
+            // one covers a level glCompressedTexImage* or a SPECIFIC compressed internalformat
+            // defined, the requested one covers the six generic GL_COMPRESSED_* enums that MobileGL
+            // deliberately backs with uncompressed storage (see MipmapStorage) and that would
+            // otherwise look like an ordinary RGBA8 image by the time the clear runs.
+            const auto& uploadTargets = mipmapTexture->GetUploadTargets();
+            if (!uploadTargets.empty() &&
+                (mipmapTexture->GetMipmapCompressedFormat(uploadTargets[0], static_cast<Uint>(level)) != GL_NONE ||
+                 mipmapTexture->GetMipmapRequestedCompressedFormat(uploadTargets[0], static_cast<Uint>(level)) !=
+                     GL_NONE)) {
+                RecordClearTextureError(caller, ErrorCode::InvalidOperation,
+                                        "Compressed textures cannot be cleared.");
+                return nullptr;
+            }
             return mipmapTexture;
         }
 
@@ -2150,6 +2261,26 @@ namespace MobileGL::MG_Impl::GLImpl {
         } else {
             DiscardMipmapChainOnBaseRespecification(textureMipmapObject, textureUploadTarget, level);
             textureMipmapObject->AllocateStorage(textureUploadTarget, level, {{width, height, depth}, internalBytes});
+            // The same specific-compressed-format tag glTexImage2D records (see TexImage2D_State):
+            // GL 4.6 core 8.5 commits the level to that format, so GL_TEXTURE_COMPRESSED and
+            // GL_TEXTURE_INTERNAL_FORMAT must report it - and, less obviously, glCopyImageSubData
+            // sizes the level's texel BLOCK from it. Without the tag a GL_COMPRESSED_RG_RGTC2
+            // array level measured as the RG8 storage it resolved to, 2 bytes instead of 16, and
+            // the copy-compatibility rule refused a pairing 18.3.2 requires. AllocateStorage above
+            // clears the tag, so this has to follow it.
+            const auto compressedInfo = MG_Util::GetCompressedFormatInfo(static_cast<GLenum>(internalformat));
+            if (compressedInfo.blockWidth != 0) {
+                textureMipmapObject->SetMipmapCompressedImage(
+                    textureUploadTarget, level, static_cast<GLenum>(internalformat), nullptr,
+                    MG_Util::CalculateCompressedTextureImageSize(compressedInfo, {width, height, depth}));
+            }
+            // Also after AllocateStorage, which clears it. Records the generic GL_COMPRESSED_*
+            // enums too, which the tag above deliberately skips - glClearTexImage has to refuse
+            // them all (GL 4.6 core 8.19).
+            if (IsCompressedGLInternalFormat(static_cast<GLenum>(internalformat))) {
+                textureMipmapObject->SetMipmapRequestedCompressedFormat(textureUploadTarget, level,
+                                                                        static_cast<GLenum>(internalformat));
+            }
         }
 
         if (!originalPixels) {
@@ -2296,6 +2427,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                     textureUploadTarget, level, static_cast<GLenum>(internalformat), nullptr,
                     MG_Util::CalculateCompressedTextureImageSize(compressedInfo, {width, height, 1}));
             }
+            // Also after AllocateStorage, which clears it. Records the generic GL_COMPRESSED_*
+            // enums too, which the tag above deliberately skips - glClearTexImage has to refuse
+            // them all (GL 4.6 core 8.19).
+            if (IsCompressedGLInternalFormat(static_cast<GLenum>(internalformat))) {
+                textureMipmapObject->SetMipmapRequestedCompressedFormat(textureUploadTarget, level,
+                                                                        static_cast<GLenum>(internalformat));
+            }
         }
 
         if (!originalPixels) {
@@ -2384,6 +2522,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!isProxy) {
             DiscardMipmapChainOnBaseRespecification(textureMipmapObject, textureUploadTarget, level);
             textureMipmapObject->AllocateStorage(textureUploadTarget, level, {{width, 1, 1}, internalBytes});
+            // After AllocateStorage, which clears the tag. No block-compressed format has a 1D
+            // layout, so only the specific-format tag the 2D/3D paths record is skipped here - the
+            // request itself still has to be remembered for glClearTexImage (GL 4.6 core 8.19).
+            if (IsCompressedGLInternalFormat(static_cast<GLenum>(internalFormat))) {
+                textureMipmapObject->SetMipmapRequestedCompressedFormat(textureUploadTarget, level,
+                                                                        static_cast<GLenum>(internalFormat));
+            }
         }
 
         if (!originalPixels) {
@@ -2935,6 +3080,15 @@ namespace MobileGL::MG_Impl::GLImpl {
                 *params = textureObject->GetSamplerObject()->GetMaxAnisotropy();
             }
             break;
+        // GL 4.6 core 8.11 lists this among the parameters EVERY GetTexParameter form answers.
+        // It was handled by the iv/Iiv/Iuiv getters and missed by this one, so the float query
+        // raised GL_INVALID_ENUM and left the caller's float untouched - which is what
+        // KHR-GL4x.shader_image_load_store.basic-api-texParam reads back.
+        case GL_IMAGE_FORMAT_COMPATIBILITY_TYPE:
+            if (params) {
+                *params = static_cast<GLfloat>(GL_IMAGE_FORMAT_COMPATIBILITY_BY_SIZE);
+            }
+            break;
         case GL_DEPTH_STENCIL_TEXTURE_MODE:
             if (params) {
                 *params = static_cast<GLfloat>(textureObject->GetDepthStencilTextureMode());
@@ -2984,6 +3138,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     *params = textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, level).x();
                     break;
                 }
+                case TextureStorageType::Buffer:
+                    *params = GetBufferTextureTexelWidth(textureObject.get());
+                    break;
                 default:
                     RecordUnsupportedLevelQueryStorage("GetTexLevelParameteriv_State", pname);
                     break;
@@ -2999,6 +3156,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     *params = textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, level).y();
                     break;
                 }
+                case TextureStorageType::Buffer:
+                    *params = 1; // a buffer texture is one-dimensional
+                    break;
                 default:
                     RecordUnsupportedLevelQueryStorage("GetTexLevelParameteriv_State", pname);
                     break;
@@ -3014,6 +3174,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     *params = textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, level).z();
                     break;
                 }
+                case TextureStorageType::Buffer:
+                    *params = 1; // a buffer texture is one-dimensional
+                    break;
                 default:
                     RecordUnsupportedLevelQueryStorage("GetTexLevelParameteriv_State", pname);
                     break;
@@ -3083,6 +3246,31 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             break;
         }
+        case GL_TEXTURE_BUFFER_SIZE:
+        case GL_TEXTURE_BUFFER_OFFSET: {
+            // GL 4.6 core 8.9: both describe the window of the attached buffer a GL_TEXTURE_BUFFER
+            // texture addresses, so there is nothing to report for any other storage - which is
+            // INVALID_OPERATION, the same shape GL_TEXTURE_COMPRESSED_IMAGE_SIZE guards itself with
+            // above.
+            if (textureObject->GetStorageType() != TextureStorageType::Buffer) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", "GetTexLevelParameteriv_State",
+                        "GL_TEXTURE_BUFFER_SIZE / GL_TEXTURE_BUFFER_OFFSET need a buffer texture."));
+                return;
+            }
+            if (params) {
+                const auto* bufferTextureObject =
+                    static_cast<MG_State::GLState::TextureObjectBuffer*>(textureObject.get());
+                // Basic machine units, and UNCLAMPED - see GetBufferTextureTexelWidth for why this
+                // half does not take the GL_MAX_TEXTURE_BUFFER_SIZE clamp that WIDTH does.
+                *params = static_cast<GLint>(pname == GL_TEXTURE_BUFFER_SIZE
+                                                 ? bufferTextureObject->GetBufferRangeSizeInBytes()
+                                                 : bufferTextureObject->GetBufferRangeOffset());
+            }
+            break;
+        }
         default:
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "GetTexLevelParameteriv_State",
@@ -3122,6 +3310,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     *params = (GLfloat)textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, level).x();
                     break;
                 }
+                case TextureStorageType::Buffer:
+                    *params = (GLfloat)GetBufferTextureTexelWidth(textureObject.get());
+                    break;
                 default:
                     RecordUnsupportedLevelQueryStorage("GetTexLevelParameterfv_State", pname);
                     break;
@@ -3137,6 +3328,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     *params = (GLfloat)textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, level).y();
                     break;
                 }
+                case TextureStorageType::Buffer:
+                    *params = 1.0f; // a buffer texture is one-dimensional
+                    break;
                 default:
                     RecordUnsupportedLevelQueryStorage("GetTexLevelParameterfv_State", pname);
                     break;
@@ -3152,6 +3346,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     *params = (GLfloat)textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, level).z();
                     break;
                 }
+                case TextureStorageType::Buffer:
+                    *params = 1.0f; // a buffer texture is one-dimensional
+                    break;
                 default:
                     RecordUnsupportedLevelQueryStorage("GetTexLevelParameterfv_State", pname);
                     break;
@@ -3219,6 +3416,27 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             break;
         }
+        case GL_TEXTURE_BUFFER_SIZE:
+        case GL_TEXTURE_BUFFER_OFFSET: {
+            // See GetTexLevelParameteriv_State: both describe the attached buffer range of a
+            // GL_TEXTURE_BUFFER texture, so any other storage makes the query INVALID_OPERATION.
+            if (textureObject->GetStorageType() != TextureStorageType::Buffer) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", "GetTexLevelParameterfv_State",
+                        "GL_TEXTURE_BUFFER_SIZE / GL_TEXTURE_BUFFER_OFFSET need a buffer texture."));
+                return;
+            }
+            if (params) {
+                const auto* bufferTextureObject =
+                    static_cast<MG_State::GLState::TextureObjectBuffer*>(textureObject.get());
+                *params = static_cast<GLfloat>(pname == GL_TEXTURE_BUFFER_SIZE
+                                                   ? bufferTextureObject->GetBufferRangeSizeInBytes()
+                                                   : bufferTextureObject->GetBufferRangeOffset());
+            }
+            break;
+        }
         default:
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "GetTexLevelParameterfv_State",
@@ -3365,9 +3583,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         MG_Backend::gBackendFunctionsTable.GL.CopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     }
 
-    void CopyImageSubData_Backend(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
+    void CopyImageSubData_Backend(const MG_Backend::CopyImageEndpoint& src,
                                   GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
-                                  const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
+                                  const MG_Backend::CopyImageEndpoint& dst,
                                   GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                                   GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
         auto copyImageSubData = MG_Backend::gBackendFunctionsTable.GL.CopyImageSubData;
@@ -3378,7 +3596,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support image-to-image copies."));
             return;
         }
-        copyImageSubData(srcTexture, srcTarget, srcLevel, srcX, srcY, srcZ, dstTexture, dstTarget, dstLevel, dstX,
+        copyImageSubData(src, srcTarget, srcLevel, srcX, srcY, srcZ, dst, dstTarget, dstLevel, dstX,
                          dstY, dstZ, srcWidth, srcHeight, srcDepth);
     }
 
@@ -3425,9 +3643,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         // the ~30 entry points that reach it through a BOUND object (where the name was never
         // in question and the fault is the binding), so this is a local rule rather than a
         // change to the helper.
-        Bool ValidateCopyImageObjectExists(const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
+        Bool ValidateCopyImageObjectExists(const MG_Backend::CopyImageEndpoint& endpoint,
                                            const char* endpointName) {
-            if (textureObject) return true;
+            if (endpoint.Exists()) return true;
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>(
@@ -3451,21 +3669,166 @@ namespace MobileGL::MG_Impl::GLImpl {
                                 MG_Util::ConvertTextureTargetToString(textureObject->GetTarget()))));
             return false;
         }
-    } // namespace
 
-    Bool ValidateCopyImageSubData_State(const SharedPtr<MG_State::GLState::ITextureObject>& srcTexture,
-                                        GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY,
-                                        const SharedPtr<MG_State::GLState::ITextureObject>& dstTexture,
-                                        GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY,
-                                        GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
-        if (!ValidateCopyImageObjectExists(srcTexture, "source") ||
-            !ValidateCopyImageObjectExists(dstTexture, "destination")) {
+        // ---- The questions ValidateCopyImageSubData_State asks of one endpoint. ---------------
+        // A renderbuffer answers all of them directly: it has exactly one image, no mip chain and
+        // no sampler state, and it carries its own internal format and extent.
+
+        Int GetCopyImageEndpointSamples(const MG_Backend::CopyImageEndpoint& endpoint) {
+            if (endpoint.IsRenderbuffer()) return endpoint.Renderbuffer->GetSamples();
+            return endpoint.Texture->GetSamples();
+        }
+
+        TextureInternalFormat GetCopyImageEndpointFormat(const MG_Backend::CopyImageEndpoint& endpoint) {
+            if (endpoint.IsRenderbuffer()) return endpoint.Renderbuffer->GetInternalFormat();
+            return endpoint.Texture->GetFormat();
+        }
+
+        // A renderbuffer has level 0 and nothing else, and the failure is the same INVALID_VALUE
+        // ValidateTextureLevelExists records for a level a texture does not have.
+        Bool ValidateCopyImageEndpointLevelExists(const MG_Backend::CopyImageEndpoint& endpoint, GLint level,
+                                                  const char* caller) {
+            if (!endpoint.IsRenderbuffer()) {
+                return TextureImpl::ValidateTextureLevelExists(endpoint.Texture, level, caller);
+            }
+            if (level == 0) return true;
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "A renderbuffer has only level 0."));
             return false;
         }
-        const auto srcTextureTarget = MG_Util::ConvertGLEnumToTextureTarget(srcTarget);
-        const auto dstTextureTarget = MG_Util::ConvertGLEnumToTextureTarget(dstTarget);
-        if (!TextureImpl::ValidateTextureTarget(srcTextureTarget) ||
-            !TextureImpl::ValidateTextureTarget(dstTextureTarget)) {
+
+        // Targets with no mip chain have q == level_base by definition (GL 4.6 core 8.17), so no
+        // minification filter can make them mipmap incomplete - while the shared predicate derives
+        // q from the base level's size alone and would call a 16x16 multisample image incomplete.
+        Bool CopyImageTargetHasMipmapChain(TextureTarget target) {
+            switch (target) {
+            case TextureTarget::TextureRectangle:
+            case TextureTarget::TextureBuffer:
+            case TextureTarget::Texture2DMultisample:
+            case TextureTarget::Texture2DMultisampleArray:
+                return false;
+            default:
+                return true;
+            }
+        }
+
+        Bool IsCopyImageEndpointComplete(const MG_Backend::CopyImageEndpoint& endpoint) {
+            // A renderbuffer is complete exactly when it has storage - there is nothing else it
+            // could be missing.
+            if (endpoint.IsRenderbuffer()) return endpoint.Renderbuffer->IsAllocated();
+            const auto* texture = endpoint.Texture.get();
+            if (!texture) return false;
+            // 18.3.2 asks for TEXTURE completeness, which GL 4.6 core 8.17 defines to include the
+            // MIP CHAIN whenever the minification filter samples it - and ITextureObject::
+            // IsComplete() only answers the storage half (an internal format, and no zero-size
+            // level in the middle of the chain). A texture with level 0 alone and the default
+            // NEAREST_MIPMAP_LINEAR filter is incomplete, which is exactly how
+            // KHR-GL43.copy_image.incomplete_tex builds its subject.
+            //
+            // The filter is the texture's OWN: copy-image never goes through a texture unit, so no
+            // sampler object is in play. An immutable texture is unaffected - glTexStorage clamps
+            // TEXTURE_MAX_LEVEL to levels-1, which is what makes a single-level immutable texture
+            // mipmap complete under any filter.
+            const auto& sampler = texture->GetSamplerObject();
+            const Bool mipmapped = CopyImageTargetHasMipmapChain(texture->GetTarget()) && sampler &&
+                                   sampler->GetMipmapMode() != SamplerMipmapMode::None;
+            return MG_State::GLState::IsMipmapCompleteForFilter(texture, mipmapped);
+        }
+
+        GLenum GetCopyImageEndpointCompressedFormat(const MG_Backend::CopyImageEndpoint& endpoint,
+                                                    TextureUploadTarget uploadTarget, GLint level) {
+            if (endpoint.IsRenderbuffer()) return GL_NONE;
+            return GetCompressedLevelFormat(endpoint.Texture, uploadTarget, level);
+        }
+
+        IntVec3 GetCopyImageEndpointLevelSize(const MG_Backend::CopyImageEndpoint& endpoint,
+                                              TextureUploadTarget uploadTarget, GLint level) {
+            if (endpoint.IsRenderbuffer()) {
+                return {endpoint.Renderbuffer->GetWidth(), endpoint.Renderbuffer->GetHeight(), 1};
+            }
+            return GetCopyImageLevelSize(endpoint.Texture, uploadTarget, level);
+        }
+
+        // The per-axis extent of one endpoint's image AS THIS ENTRY POINT ADDRESSES IT, which is
+        // not always the level extent this frontend stores.
+        //
+        // GL 4.6 core 18.3.2 treats EVERY array texture as a stack of slices addressed by z, and
+        // gives a 1D array an image height of 1. This frontend stores a 1D array the way
+        // glTexImage2D(GL_TEXTURE_1D_ARRAY, w, layers) writes it instead - layers on y - so the
+        // two views have to be told apart here. Measuring y against the LAYER count is what let
+        // srcY = 14 on a 16-wide, 16-layer 1D array come back GL_NO_ERROR
+        // (KHR-GL43.copy_image.exceeding_boundaries, the src_test_case y variants); the CTS is
+        // unambiguous about the convention, forcing height = 1 for 1D and 1D_ARRAY and listing
+        // 1D_ARRAY as multilayer.
+        //
+        // A CUBE MAP is the other target whose z bound is not the level extent: this frontend
+        // keeps its six faces as six separate one-slice upload targets, so the level says 1 and
+        // the real bound is 6. A cube-map ARRAY is one upload target whose depth already counts
+        // layer-faces, and every remaining target is answered by the level extent verbatim.
+        IntVec3 GetCopyImageEndpointRegionBounds(const MG_Backend::CopyImageEndpoint& endpoint,
+                                                 const IntVec3& levelSize) {
+            const TextureTarget target = (!endpoint.IsRenderbuffer() && endpoint.Texture)
+                                             ? endpoint.Texture->GetTarget()
+                                             : TextureTarget::Unknown;
+            if (target == TextureTarget::TextureCubeMap) {
+                return {levelSize.x(), levelSize.y(), 6};
+            }
+            if (target == TextureTarget::Texture1DArray) {
+                return {levelSize.x(), 1, std::max(levelSize.y(), 1)};
+            }
+            return {levelSize.x(), levelSize.y(), std::max(levelSize.z(), 1)};
+        }
+
+        // GL 4.6 core 18.3.2 requires INVALID_VALUE when the region exceeds either image's
+        // boundaries. The only bounds-shaped call this validator used to make was
+        // ValidateCopyImageBlockAlignment, whose first line returns true for every UNCOMPRESSED
+        // format - so no uncompressed copy was bounded at all, and the z extent could not be
+        // bounded even in principle because srcZ/dstZ never reached the validator. Texture
+        // endpoints were covered only by accident, through the ES driver's own error, which the
+        // DirectGLES backend logs and swallows rather than reporting; a GL_RENDERBUFFER endpoint
+        // got neither (KHR-GL43.copy_image.exceeding_boundaries).
+        Bool ValidateCopyImageRegionBounds(const MG_Backend::CopyImageEndpoint& endpoint, const IntVec3& levelSize,
+                                           GLint x, GLint y, GLint z, GLsizei width, GLsizei height, GLsizei depth,
+                                           const char* endpointName) {
+            // An extent this frontend does not know cannot bound anything, and guessing would
+            // reject a copy GL allows. Every caller has already established that the level
+            // exists and that the image is complete, so this is a belt-and-braces guard.
+            if (levelSize.x() <= 0 || levelSize.y() <= 0) return true;
+            const IntVec3 bounds = GetCopyImageEndpointRegionBounds(endpoint, levelSize);
+            if (x >= 0 && y >= 0 && z >= 0 && static_cast<Int64>(x) + width <= bounds.x() &&
+                static_cast<Int64>(y) + height <= bounds.y() && static_cast<Int64>(z) + depth <= bounds.z()) {
+                return true;
+            }
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", "ValidateCopyImageSubData_State",
+                    std::format("The {} region [{}, {}, {}] + [{} x {} x {}] does not fit inside the {} x {} x {} "
+                                "image.",
+                                endpointName, x, y, z, width, height, depth, bounds.x(), bounds.y(), bounds.z())));
+            return false;
+        }
+    } // namespace
+
+    Bool ValidateCopyImageSubData_State(const MG_Backend::CopyImageEndpoint& src,
+                                        GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ,
+                                        const MG_Backend::CopyImageEndpoint& dst,
+                                        GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
+                                        GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
+        if (!ValidateCopyImageObjectExists(src, "source") ||
+            !ValidateCopyImageObjectExists(dst, "destination")) {
+            return false;
+        }
+        // GL_RENDERBUFFER has no TextureTarget to convert to, and it needs none: it is its own
+        // whole-image target, and the endpoint that carries it was resolved from the renderbuffer
+        // namespace, so it matches its object by construction.
+        const auto srcTextureTarget =
+            src.IsRenderbuffer() ? TextureTarget::Unknown : MG_Util::ConvertGLEnumToTextureTarget(srcTarget);
+        const auto dstTextureTarget =
+            dst.IsRenderbuffer() ? TextureTarget::Unknown : MG_Util::ConvertGLEnumToTextureTarget(dstTarget);
+        if ((!src.IsRenderbuffer() && !TextureImpl::ValidateTextureTarget(srcTextureTarget)) ||
+            (!dst.IsRenderbuffer() && !TextureImpl::ValidateTextureTarget(dstTextureTarget))) {
             return false;
         }
         // GL_TEXTURE_BUFFER and the cube FACE enums convert to a target this frontend knows, but
@@ -3473,8 +3836,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!ValidateCopyImageTarget(srcTarget, "source") || !ValidateCopyImageTarget(dstTarget, "destination")) {
             return false;
         }
-        if (!ValidateCopyImageTargetMatchesObject(srcTexture, srcTextureTarget, "source") ||
-            !ValidateCopyImageTargetMatchesObject(dstTexture, dstTextureTarget, "destination")) {
+        if (!ValidateCopyImageTargetMatchesObject(src.Texture, srcTextureTarget, "source") ||
+            !ValidateCopyImageTargetMatchesObject(dst.Texture, dstTextureTarget, "destination")) {
             return false;
         }
         if (!TextureImpl::ValidateTextureLevelNumber(srcLevel) ||
@@ -3488,8 +3851,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         // driver as an out-of-range mip index - on Adreno that is a SIGSEGV inside
         // vkCmdCopyImage, which is what KHR-GL43.copy_image.non_existent_mipmap used to do to
         // the whole glcts process. The answer the spec asks for is GL_INVALID_VALUE.
-        if (!TextureImpl::ValidateTextureLevelExists(srcTexture, srcLevel, __func__) ||
-            !TextureImpl::ValidateTextureLevelExists(dstTexture, dstLevel, __func__)) {
+        if (!ValidateCopyImageEndpointLevelExists(src, srcLevel, __func__) ||
+            !ValidateCopyImageEndpointLevelExists(dst, dstLevel, __func__)) {
             return false;
         }
         if (srcWidth < 0 || srcHeight < 0 || srcDepth < 0) {
@@ -3505,43 +3868,55 @@ namespace MobileGL::MG_Impl::GLImpl {
         // A multisample image can only be copied to one with the same sample count, and a
         // single-sample image reports zero - so this one comparison is also what rejects
         // copying between a multisample target and a non-multisample one.
-        if (srcTexture->GetSamples() != dstTexture->GetSamples()) {
+        const Int srcSamples = GetCopyImageEndpointSamples(src);
+        const Int dstSamples = GetCopyImageEndpointSamples(dst);
+        if (srcSamples != dstSamples) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
                 MakeUnique<GenericErrorInfo>(
                     "MG_Impl/GLImpl", __func__,
                     std::format("The two images have different sample counts ({} vs. {}).",
-                                srcTexture->GetSamples(), dstTexture->GetSamples())));
+                                srcSamples, dstSamples)));
             return false;
         }
         // 18.3.2: both images must be complete. An incomplete one has no defined texels to copy
         // and no defined storage to copy into.
-        if (!srcTexture->IsComplete() || !dstTexture->IsComplete()) {
+        const Bool srcComplete = IsCopyImageEndpointComplete(src);
+        const Bool dstComplete = IsCopyImageEndpointComplete(dst);
+        if (!srcComplete || !dstComplete) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
                 MakeUnique<GenericErrorInfo>(
                     "MG_Impl/GLImpl", __func__,
                     std::format("A copied image is incomplete (source complete: {}, destination complete: {}).",
-                                srcTexture->IsComplete(), dstTexture->IsComplete())));
+                                srcComplete, dstComplete)));
             return false;
         }
-        const auto srcUploadTarget = GetPrimaryUploadTarget(srcTexture);
-        const auto dstUploadTarget = GetPrimaryUploadTarget(dstTexture);
+        const auto srcUploadTarget = GetPrimaryUploadTarget(src.Texture);
+        const auto dstUploadTarget = GetPrimaryUploadTarget(dst.Texture);
         const auto srcBlock = TextureImpl::ResolveCopyImageTexelBlock(
-            srcTexture->GetFormat(), GetCompressedLevelFormat(srcTexture, srcUploadTarget, srcLevel));
+            GetCopyImageEndpointFormat(src), GetCopyImageEndpointCompressedFormat(src, srcUploadTarget, srcLevel));
         const auto dstBlock = TextureImpl::ResolveCopyImageTexelBlock(
-            dstTexture->GetFormat(), GetCompressedLevelFormat(dstTexture, dstUploadTarget, dstLevel));
+            GetCopyImageEndpointFormat(dst), GetCopyImageEndpointCompressedFormat(dst, dstUploadTarget, dstLevel));
         if (!TextureImpl::ValidateCopyImageFormatCompatibility(srcBlock, dstBlock)) {
             return false;
         }
-        const IntVec3 srcLevelSize = GetCopyImageLevelSize(srcTexture, srcUploadTarget, srcLevel);
-        const IntVec3 dstLevelSize = GetCopyImageLevelSize(dstTexture, dstUploadTarget, dstLevel);
+        const IntVec3 srcLevelSize = GetCopyImageEndpointLevelSize(src, srcUploadTarget, srcLevel);
+        const IntVec3 dstLevelSize = GetCopyImageEndpointLevelSize(dst, dstUploadTarget, dstLevel);
         if (!TextureImpl::ValidateCopyImageBlockAlignment(srcBlock, srcX, srcY, srcWidth, srcHeight,
                                                           srcLevelSize.x(), srcLevelSize.y(), "source") ||
             !TextureImpl::ValidateCopyImageBlockAlignment(dstBlock, dstX, dstY, srcWidth, srcHeight,
                                                           dstLevelSize.x(), dstLevelSize.y(), "destination")) {
             return false;
         }
+        // One region extent, measured against both images: GL 4.6 core 18.3.2 gives the copy a
+        // single width/height/depth and requires it to fit in the source AND the destination.
+        if (!ValidateCopyImageRegionBounds(src, srcLevelSize, srcX, srcY, srcZ, srcWidth, srcHeight, srcDepth,
+                                           "source") ||
+            !ValidateCopyImageRegionBounds(dst, dstLevelSize, dstX, dstY, dstZ, srcWidth, srcHeight, srcDepth,
+                                           "destination")) {
+            return false;
+        }
         return true;
     }
 
@@ -4051,8 +4426,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             return false;
         }
 
-        // For a cube map this is exactly cube completeness: IsComplete() wants all six faces.
-        if (!textureObject->IsComplete()) {
+        // GL 4.6 core 8.11.4 names cube completeness as the only completeness a readback requires,
+        // and for a cube map that is exactly what IsComplete() answers (all six faces defined at
+        // every level). It must not speak for any other target: on a mip chain it also rejects
+        // "level N defined, the levels below it not", which is a perfectly readable texture at
+        // level N - and the shape glClearTexImage's conformance cases build, since they define
+        // only the level they clear. The requested level's own existence is checked below.
+        if ((target == TextureTarget::TextureCubeMap || target == TextureTarget::TextureCubeMapArray) &&
+            !textureObject->IsComplete()) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Texture is incomplete"));
@@ -4084,8 +4465,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
 
         // Shared format/type/internal-format matrix (packed-type pairing, depth-vs-color mismatch,
-        // integer-ness). Also rejects STENCIL_INDEX readback, which needs GL_ARB_texture_stencil8
-        // (not advertised by MobileGL).
+        // integer-ness). Also rejects a STENCIL_INDEX readback of anything but stencil-only
+        // storage, which is the only pairing GL 4.4 / ARB_texture_stencil8 ever made legal.
         if (!TextureImpl::ValidateTextureInternalFormatCompatibleWithInput(
                 textureInputFormat, textureObject->GetFormat(), texturePixelDataType)) {
             return false;
@@ -4111,33 +4492,48 @@ namespace MobileGL::MG_Impl::GLImpl {
             const auto* textureMipmapObject =
                 static_cast<const MG_State::GLState::TextureObjectMipmap*>(textureObject.get());
             const auto& uploadTargets = textureObject->GetUploadTargets();
-            if (!uploadTargets.empty() && static_cast<Uint>(level) < textureMipmapObject->GetMipmapLevelCount()) {
-                // Tightly packed, and summed over every face because a cube map query returns all
-                // six. Pack pixel-store state only ever grows this, so a request rejected here
-                // could not have fit under any packing.
-                const auto texelSize = textureMipmapObject->GetMipmapTexelSize(uploadTargets[0], level);
-                const SizeT required = MG_Util::CalculateInputTextureImageSize(textureInputFormat,
-                                                                               texturePixelDataType, texelSize) *
-                                       uploadTargets.size();
+            // The half of the completeness gate above that GL does keep: the REQUESTED level has
+            // to hold an image. A name that was never given one carries no levels at all (which is
+            // also what an Unknown internal format answers), and a chain grown to reach level N
+            // leaves every level below it at {0, 0, 0}.
+            if (uploadTargets.empty() || static_cast<Uint>(level) >= textureMipmapObject->GetMipmapLevelCount()) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Texture level has no image to read back."));
+                return false;
+            }
+            const auto texelSize = textureMipmapObject->GetMipmapTexelSize(uploadTargets[0], level);
+            if (texelSize.x() <= 0 || texelSize.y() <= 0 || texelSize.z() <= 0) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Texture level has no image to read back."));
+                return false;
+            }
 
-                if (bufSize >= 0 && static_cast<SizeT>(bufSize) < required) {
+            // Tightly packed, and summed over every face because a cube map query returns all
+            // six. Pack pixel-store state only ever grows this, so a request rejected here
+            // could not have fit under any packing.
+            const SizeT required = MG_Util::CalculateInputTextureImageSize(textureInputFormat,
+                                                                           texturePixelDataType, texelSize) *
+                                   uploadTargets.size();
+
+            if (bufSize >= 0 && static_cast<SizeT>(bufSize) < required) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Destination buffer is too small."));
+                return false;
+            }
+
+            if (pixelPackBufferObject) {
+                const SizeT bufferSize = pixelPackBufferObject->GetSize();
+                const SizeT offset = reinterpret_cast<SizeT>(pixels);
+                if (offset > bufferSize || required > bufferSize - offset) {
                     MG_State::pGLContext->RecordError(
                         ErrorCode::InvalidOperation,
-                        MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Destination buffer is too small."));
+                        MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                                     "Packing would write past the end of the pixel pack buffer."));
                     return false;
                 }
-
-                if (pixelPackBufferObject) {
-                    const SizeT bufferSize = pixelPackBufferObject->GetSize();
-                    const SizeT offset = reinterpret_cast<SizeT>(pixels);
-                    if (offset > bufferSize || required > bufferSize - offset) {
-                        MG_State::pGLContext->RecordError(
-                            ErrorCode::InvalidOperation,
-                            MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
-                                                         "Packing would write past the end of the pixel pack buffer."));
-                        return false;
-                    }
-                }
             }
         }
 
@@ -4372,6 +4768,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             const SizeT byteSize = ComputeTextureStorageByteSize(textureInternalFormat, levelWidth, 1, 1);
             textureMipmapObject->AllocateStorage(textureUploadTarget, level, {{levelWidth, 1, 1}, byteSize});
             textureMipmapObject->MarkStorageDirty(textureUploadTarget, level, false);
+            if (IsCompressedGLInternalFormat(internalformat)) {
+                // After AllocateStorage, which clears the tag. See TexImage1D_State: no compressed
+                // format has a 1D block layout, but glClearTexImage still has to refuse the request.
+                textureMipmapObject->SetMipmapRequestedCompressedFormat(textureUploadTarget,
+                                                                        static_cast<Uint>(level), internalformat);
+            }
         }
         // Immutable storage defines exactly `levels` levels; AllocateStorage only grows, so a
         // longer pre-existing chain has to be dropped explicitly.
@@ -4440,6 +4842,12 @@ namespace MobileGL::MG_Impl::GLImpl {
                         MG_Util::CalculateCompressedTextureImageSize(compressedInfo,
                                                                      {levelWidth, levelHeight, 1}));
                 }
+                if (IsCompressedGLInternalFormat(internalformat)) {
+                    // Also after AllocateStorage. The generic enums land here and nowhere above,
+                    // and glClearTexImage has to refuse them too (GL 4.6 core 8.19).
+                    textureMipmapObject->SetMipmapRequestedCompressedFormat(uploadTarget,
+                                                                            static_cast<Uint>(level), internalformat);
+                }
             }
             // See TextureStorage1D.
             textureMipmapObject->TruncateMipmapLevels(uploadTarget, static_cast<Uint>(levels));
@@ -4447,32 +4855,6 @@ namespace MobileGL::MG_Impl::GLImpl {
         textureObject->SetImmutableLevels(static_cast<Uint>(levels));
     }
 
-    // No block-compressed format is defined for a three-dimensional image, so glTexStorage3D on
-    // TEXTURE_3D must reject one - and with INVALID_OPERATION, not the INVALID_ENUM an unknown
-    // sized format gets (GL 4.6 core 8.19 / Khronos bug 11239, KHR-GLxx.texture_storage
-    // .compressed_data). Written against the enum ranges rather than a name list because the
-    // families are contiguous and MobileGL's own internal-format enum drops the ones it cannot
-    // carry, which would make this check silently narrower than the API surface.
-    static Bool IsCompressedGLInternalFormat(GLenum internalformat) {
-        switch (internalformat) {
-        case 0x8225: // GL_COMPRESSED_RED
-        case 0x8226: // GL_COMPRESSED_RG
-        case 0x84ED: // GL_COMPRESSED_RGB
-        case 0x84EE: // GL_COMPRESSED_RGBA
-        case 0x8C48: // GL_COMPRESSED_SRGB
-        case 0x8C49: // GL_COMPRESSED_SRGB_ALPHA
-            return true;
-        default:
-            break;
-        }
-        return (internalformat >= 0x83F0 && internalformat <= 0x83F3) || // S3TC / DXT
-               (internalformat >= 0x8DBB && internalformat <= 0x8DBE) || // RGTC
-               (internalformat >= 0x8E8C && internalformat <= 0x8E8F) || // BPTC
-               (internalformat >= 0x9270 && internalformat <= 0x9279) || // ETC2 / EAC
-               (internalformat >= 0x93B0 && internalformat <= 0x93BD) || // ASTC LDR
-               (internalformat >= 0x93D0 && internalformat <= 0x93DD);   // ASTC sRGB
-    }
-
     void TextureStorage3D(GLuint texture, GLsizei levels, GLenum internalformat, GLsizei width, GLsizei height,
                           GLsizei depth) {
         auto textureObject = GetTextureObjectByName(texture, __func__);
@@ -4515,6 +4897,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         // Array targets keep their layer count constant across levels; only true 3D
         // textures halve depth per level (GL 3.3 §3.9 glTexStorage3D).
         const Bool depthMips = DepthParticipatesInMipmapping(textureObject->GetTarget());
+        // The same specific-compressed-format tag glTexStorage2D records, for the array targets a
+        // compressed glTexStorage3D is legal on (GL_TEXTURE_3D was refused above). Zero width means
+        // a generic format, which MobileGL answers with uncompressed storage, so it is not tagged.
+        const auto compressedInfo = MG_Util::GetCompressedFormatInfo(internalformat);
         for (GLsizei level = 0; level < levels; ++level) {
             const GLsizei levelWidth = std::max<GLsizei>(1, width >> level);
             const GLsizei levelHeight = std::max<GLsizei>(1, height >> level);
@@ -4524,6 +4910,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             textureMipmapObject->AllocateStorage(textureUploadTarget, level,
                                                  {{levelWidth, levelHeight, levelDepth}, byteSize});
             textureMipmapObject->MarkStorageDirty(textureUploadTarget, level, false);
+            if (compressedInfo.blockWidth != 0) {
+                // After AllocateStorage, which clears the tag.
+                textureMipmapObject->SetMipmapCompressedImage(
+                    textureUploadTarget, static_cast<Uint>(level), internalformat, nullptr,
+                    MG_Util::CalculateCompressedTextureImageSize(compressedInfo,
+                                                                 {levelWidth, levelHeight, levelDepth}));
+            }
+            if (IsCompressedGLInternalFormat(internalformat)) {
+                // Also after AllocateStorage. The generic enums land here and nowhere above,
+                // and glClearTexImage has to refuse them too (GL 4.6 core 8.19).
+                textureMipmapObject->SetMipmapRequestedCompressedFormat(textureUploadTarget,
+                                                                        static_cast<Uint>(level), internalformat);
+            }
         }
         // See TextureStorage1D.
         textureMipmapObject->TruncateMipmapLevels(textureUploadTarget, static_cast<Uint>(levels));
@@ -4684,6 +5083,22 @@ namespace MobileGL::MG_Impl::GLImpl {
         TextureStorage3D(textureObject->GetExternalIndex(), levels, internalformat, width, height, depth);
     }
 
+    // Unlike glTexImage*Multisample, where a zero-sized image is a legal deallocation (see
+    // AllocateMultisampleTextureStorage), the immutable forms take a strictly positive size: GL
+    // 4.6 core 8.19 makes width, height or depth < 1 INVALID_VALUE. Without this the shared
+    // _State helper would deallocate the image and TexStorageMultisample_State would then freeze
+    // the now-imageless texture as immutable.
+    static Bool ValidateTexStorageMultisampleSize(GLsizei width, GLsizei height, GLsizei depth, const char* caller) {
+        if (width >= 1 && height >= 1 && depth >= 1) {
+            return true;
+        }
+        MG_State::pGLContext->RecordError(
+            ErrorCode::InvalidValue,
+            MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                         "Immutable multisample storage requires width, height and depth >= 1."));
+        return false;
+    }
+
     // The multisample storage forms allocate exactly what the glTexImage*Multisample ones do, and
     // then freeze it: TEXTURE_IMMUTABLE_FORMAT becomes TRUE and a second call is INVALID_OPERATION
     // (GL 4.6 core 8.19). Only the allocation was shared before, so a multisample texture stayed
@@ -4704,6 +5119,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         const TextureTarget textureTarget = MG_Util::ConvertGLEnumToTextureTarget(target);
         auto& activeUnit = MG_State::pGLContext->GetTextureUnitObject(MG_State::pGLContext->GetActiveTextureUnit());
         if (!ValidateTextureMutable(activeUnit.GetBindingSlot(textureTarget).GetBoundObject(), __func__)) return;
+        if (!ValidateTexStorageMultisampleSize(width, height, 1, __func__)) return;
         TexStorageMultisample_State(
             target, TexImage2DMultisample_State(target, samples, internalformat, width, height, fixedsamplelocations),
             __func__);
@@ -4714,6 +5130,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         const TextureTarget textureTarget = MG_Util::ConvertGLEnumToTextureTarget(target);
         auto& activeUnit = MG_State::pGLContext->GetTextureUnitObject(MG_State::pGLContext->GetActiveTextureUnit());
         if (!ValidateTextureMutable(activeUnit.GetBindingSlot(textureTarget).GetBoundObject(), __func__)) return;
+        if (!ValidateTexStorageMultisampleSize(width, height, depth, __func__)) return;
         TexStorageMultisample_State(target,
                                     TexImage3DMultisample_State(target, samples, internalformat, width, height, depth,
                                                                 fixedsamplelocations),
@@ -5715,17 +6132,29 @@ namespace MobileGL::MG_Impl::GLImpl {
                           GLuint dstName, GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                           GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
         // A missing name is INVALID_VALUE here, where GetTextureObjectByName's own diagnostic is
-        // INVALID_OPERATION - so resolve through the plain lookup, which answers a null
+        // INVALID_OPERATION - so resolve through the plain lookups, which answer a null
         // SharedPtr, and let the validator record the error this entry point owes.
-        const SharedPtr<MG_State::GLState::ITextureObject> srcTexture =
-            MG_State::pGLContext->GetTextureObject(srcName);
-        const SharedPtr<MG_State::GLState::ITextureObject> dstTexture =
-            MG_State::pGLContext->GetTextureObject(dstName);
-        if (!ValidateCopyImageSubData_State(srcTexture, srcTarget, srcLevel, srcX, srcY, dstTexture, dstTarget,
-                                            dstLevel, dstX, dstY, srcWidth, srcHeight, srcDepth)) {
+        //
+        // The TARGET picks the namespace: GL 4.6 core 18.3.2 accepts GL_RENDERBUFFER, and a
+        // renderbuffer name has nothing to do with a texture name. Resolving both through
+        // GetTextureObject made every renderbuffer endpoint INVALID_VALUE - or, when the number
+        // happened to collide with a live texture, INVALID_ENUM from the target check.
+        const auto resolveEndpoint = [](GLuint name, GLenum target) {
+            MG_Backend::CopyImageEndpoint endpoint{};
+            if (target == GL_RENDERBUFFER) {
+                endpoint.Renderbuffer = MG_State::pGLContext->GetRenderbufferObject(name);
+            } else {
+                endpoint.Texture = MG_State::pGLContext->GetTextureObject(name);
+            }
+            return endpoint;
+        };
+        const MG_Backend::CopyImageEndpoint src = resolveEndpoint(srcName, srcTarget);
+        const MG_Backend::CopyImageEndpoint dst = resolveEndpoint(dstName, dstTarget);
+        if (!ValidateCopyImageSubData_State(src, srcTarget, srcLevel, srcX, srcY, srcZ, dst, dstTarget,
+                                            dstLevel, dstX, dstY, dstZ, srcWidth, srcHeight, srcDepth)) {
             return;
         }
-        CopyImageSubData_Backend(srcTexture, srcTarget, srcLevel, srcX, srcY, srcZ, dstTexture, dstTarget, dstLevel,
+        CopyImageSubData_Backend(src, srcTarget, srcLevel, srcX, srcY, srcZ, dst, dstTarget, dstLevel,
                                  dstX, dstY, dstZ, srcWidth, srcHeight, srcDepth);
     }
 

MobileGL/MG_Impl/GLImpl/Texture/Validators.cpp

@@ -313,9 +313,13 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
             return false;
         }
 
-        // TexImage in core 3.3 has no stencil-only upload path (that arrived with GL 4.4).
-        if (format == TextureInputFormat::StencilIndex) {
-            return recordInvalidOperation("STENCIL_INDEX is not a valid texture upload format");
+        // The stencil-only transfer path arrived with GL 4.4 / ARB_texture_stencil8, and only ever
+        // pairs with stencil-only storage: against a depth, depth-stencil or colour internal format
+        // STENCIL_INDEX keeps the pre-4.4 answer (GL CTS packed_pixels feeds exactly that pairing
+        // and expects INVALID_OPERATION).
+        if (format == TextureInputFormat::StencilIndex &&
+            internalFormat != TextureInternalFormat::StencilIndex8) {
+            return recordInvalidOperation("STENCIL_INDEX requires a stencil-only internal format");
         }
 
         if (IsDepthLikeInputFormat(format) != IsDepthLikeInternalFormat(internalFormat)) {

MobileGL/MG_Impl/GLImpl/VertexArray/GL_VertexArray.cpp

@@ -514,10 +514,17 @@ namespace MobileGL::MG_Impl::GLImpl {
     // recorded DataType is always Float64 - what IsLong adds is that this is the *unconverted* form,
     // as opposed to VertexAttribFormat(GL_DOUBLE), which asks for a float conversion.
     //
-    // Whether the backend can feed it is detected, not assumed: DirectVulkan needs shaderFloat64,
-    // and DirectGLES can never have it at all. A backend without it declines here, loudly - GL error
-    // plus a log line naming the reason - rather than accepting state no draw could honour and
-    // rendering garbage. The matching startup POST row is in MG_Util/SelfTest/DriverPost.cpp.
+    // Whether the backend can FEED it at full precision is detected, not assumed: DirectVulkan
+    // needs shaderFloat64, and DirectGLES can never have it at all. What that costs is PRECISION,
+    // not the call and no longer the array: GL 4.6 core 10.3.2 defines no error for a well-formed
+    // glVertexAttribLFormat, and a GL 4.3 context has 64-bit attributes in core, so declining the
+    // call would be non-conformant and would make the four pure state queries
+    // (VERTEX_ATTRIB_ARRAY_SIZE / _TYPE / _LONG / _RELATIVE_OFFSET) unanswerable
+    // (KHR-GL43.vertex_attrib_binding.basic-state1/3). The format is therefore RECORDED here and
+    // the array is NARROWED to float32 at draw, matching the fp64 demotion every shader already
+    // gets (DemoteFloat64Pass) - loudly, once, naming the cost. The matching startup POST row is in
+    // MG_Util/SelfTest/DriverPost.cpp; the draw-side narrowing is DirectGLES/Managers.cpp and, on
+    // DirectVulkan, VertexInputStateFactory's Float64 case.
     static void VertexAttribLFormatSeparate_State(const SharedPtr<MG_State::GLState::VertexArrayObject>& vao,
                                                   GLuint attribindex, GLint size, GLenum type,
                                                   GLuint relativeoffset) {
@@ -528,14 +535,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!MG_Backend::pActiveBackendObject ||
             !MG_Backend::pActiveBackendObject->GetDynamicParameters().SupportsFloat64VertexAttributes) {
             MGLOG_W_ONCE("VertexAttribLFormat: attribute %u asked for a 64-bit (GL_DOUBLE) format, but this "
-                    "backend has no double-precision vertex attribute support - see the "
-                    "\"64-bit vertex attributes\" / \"shaderFloat64\" POST row for what that costs",
+                    "backend has no double-precision vertex attribute support - the format is recorded "
+                    "and queryable, and the array is FETCHED AT FLOAT32 PRECISION at draw (the same "
+                    "narrowing the shader's dvec inputs already get); see the \"64-bit vertex "
+                    "attributes\" / \"shaderFloat64\" POST row for what that costs",
                     attribindex);
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidOperation,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "VertexAttribLFormat",
-                                             "64-bit vertex attributes are not supported by this backend."));
-            return;
         }
 
         vao->SetAttributeFormatSeparate(attribindex, size, MG_Util::ConvertGLEnumToDataType(type),

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -24,9 +24,14 @@ set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(MGL_ITEST_ROOT ${CMAKE_CURRENT_LIST_DIR}/../..)
 
-# Only meaningful where MobileGL_s exists (i.e. not Android).
-if (NOT TARGET MobileGL_s)
-    message(STATUS "MobileGL_s is not available; skipping the integration test module")
+# Desktop links the static implementation directly. Android runs the same
+# executable from adb shell and links the shipping shared library instead.
+if (ANDROID)
+    set(MGL_ITEST_MOBILEGL_TARGET MobileGL)
+elseif (TARGET MobileGL_s)
+    set(MGL_ITEST_MOBILEGL_TARGET MobileGL_s)
+else()
+    message(STATUS "No MobileGL library target is available; skipping the integration test module")
     return()
 endif()
 
@@ -54,6 +59,7 @@ add_executable(MobileGLIntegrationTest
     Scenarios/AsyncCompileScenario.cpp
     Scenarios/XfbAfterClipDistanceScenario.cpp
     Scenarios/ThreeChannelAttachmentScenario.cpp
+    Scenarios/SnormAttachmentScenario.cpp
     Scenarios/PipelineFailureScenario.cpp
     Scenarios/AdvertisedLimitsScenario.cpp
     Scenarios/PixelStoreSweepScenario.cpp
@@ -68,20 +74,32 @@ add_executable(MobileGLIntegrationTest
     Scenarios/DoublePrecisionScenario.cpp
     Scenarios/UniformInitializerScenario.cpp
     Scenarios/SwizzleAccessRoutineScenario.cpp
+    Scenarios/IterationRPFirstReductionScenario.cpp
+    Scenarios/IterationRPProgram203Scenario.cpp
+    Scenarios/IterationRPScratchFixScenario.cpp
     Scenarios/ProgramPipelineScenario.cpp
     Scenarios/ImageLoadStoreSsoScenario.cpp
     Scenarios/ImageTargetKindScenario.cpp
     Scenarios/ImageFormatQualifierScenario.cpp
+    Scenarios/ImageSizeAfterRespecScenario.cpp
     Scenarios/SsboDeclarationFormScenario.cpp
     Scenarios/Glsl420DeclarationScenario.cpp
+    Scenarios/IoBlockNameCollisionScenario.cpp
+    Scenarios/TessellationDrawModeScenario.cpp
     Scenarios/FragmentOutputArrayIndexScenario.cpp
     Scenarios/BufferTextureScenario.cpp
     Scenarios/VertexAttribBindingScenario.cpp
     Scenarios/XfbCaptureBufferReuseScenario.cpp
+    Scenarios/XfbPrimitiveQueryScenario.cpp
     Scenarios/VertexArrayEnableDisableScenario.cpp
     Scenarios/CopyImageLevelRangeScenario.cpp
     Scenarios/CopyImageLayeredScenario.cpp
+    Scenarios/PackedWordReadbackScenario.cpp
     Scenarios/LayeredAttachmentBarrierScenario.cpp
+    Scenarios/LayeredTextureReadbackScenario.cpp
+    Scenarios/AtomicCounterScenario.cpp
+    Scenarios/SsboArrayDynamicIndexScenario.cpp
+    Scenarios/StorageBufferRegrowScenario.cpp
 )
 
 target_include_directories(MobileGLIntegrationTest PRIVATE
@@ -92,9 +110,20 @@ target_include_directories(MobileGLIntegrationTest PRIVATE
 # gtest, not gtest_main: Main.cpp installs the harness banner itself.
 target_link_libraries(MobileGLIntegrationTest PRIVATE
     GTest::gtest
-    MobileGL_s
+    ${MGL_ITEST_MOBILEGL_TARGET}
 )
 
+if (ANDROID)
+    find_library(MGL_ITEST_ANDROID_LIBRARY android REQUIRED)
+    find_library(MGL_ITEST_LOG_LIBRARY log REQUIRED)
+    find_library(MGL_ITEST_MEDIANDK_LIBRARY mediandk REQUIRED)
+    target_link_libraries(MobileGLIntegrationTest PRIVATE
+        ${MGL_ITEST_ANDROID_LIBRARY}
+        ${MGL_ITEST_LOG_LIBRARY}
+        ${MGL_ITEST_MEDIANDK_LIBRARY}
+    )
+endif()
+
 if (MSVC)
     # Same reason as MG_Test/Backend/DirectVulkan: the GLES headers declare gl*
     # as dllimport on Windows, so the in-library GL entry-point definitions only
@@ -103,6 +132,10 @@ if (MSVC)
 endif()
 target_compile_definitions(MobileGLIntegrationTest PRIVATE -DNOMINMAX)
 
+if (ANDROID)
+    return()
+endif()
+
 # --- ctest wiring --------------------------------------------------------
 # A bare libEGL on a glvnd box resolves to whatever vendor comes first, which is
 # usually Mesa/llvmpipe - a software rasteriser silently replacing the GPU under
@@ -223,6 +256,19 @@ endif()
 set(MGL_ITEST_VULKAN_ENV ${MGL_ITEST_COMMON_ENV})
 if (MOBILEGL_ITEST_VK_ICD)
     list(APPEND MGL_ITEST_VULKAN_ENV "VK_ICD_FILENAMES=${MOBILEGL_ITEST_VK_ICD}")
+    # The three iterationRP repairs are tri-state quirks that default to device
+    # auto-detection, and lavapipe is not on any auto list - so on lavapipe the
+    # iterationRP scenarios run unrepaired and Program 203 misses its golden
+    # output. CI's integration-gpu job exports these three by hand; pinning them
+    # to the ICD instead means a local `ctest -L integration-gpu` measures the
+    # same thing the gate does, with no environment to remember.
+    if (MOBILEGL_ITEST_VK_ICD MATCHES "lvp_icd|lavapipe")
+        message(STATUS "Integration tests: lavapipe ICD - forcing the iterationRP repairs on")
+        list(APPEND MGL_ITEST_VULKAN_ENV
+            "MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1"
+            "MOBILEGL_DERIVE_NUM_SUBGROUPS=1"
+            "MOBILEGL_ITERATIONRP_FIX_BARRIER=1")
+    endif()
 endif()
 
 # The ENVIRONMENT test property is itself a `;`-list, and gtest_discover_tests

MobileGL/MG_IntegrationTest/Harness/HeadlessGL.cpp

@@ -15,6 +15,16 @@
 #include <ostream>
 #include <sstream>
 
+#if defined(_WIN32)
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#elif defined(__ANDROID__)
+#include <android/hardware_buffer.h>
+#include <android/native_window.h>
+#include <media/NdkImage.h>
+#include <media/NdkImageReader.h>
+#endif
+
 // MobileGL's own headers, in the order MobileGL/Includes.h uses them: GL/gl.h
 // first, then glcorearb.h for the 3.x+ entry points. This binary links
 // MobileGL_s, so every gl*/egl* below binds to MobileGL's implementation, not
@@ -32,7 +42,7 @@
 // the only construction that is actually predictive here: MobileGL ABORTS
 // (MOBILEGL_ASSERT -> SIGTRAP) rather than returning an error on an unusable
 // platform, so nothing the parent can call in-process is allowed to be wrong.
-#if !defined(_WIN32) && !defined(__APPLE__) && __has_include(<sys/wait.h>)
+#if !defined(_WIN32) && !defined(__APPLE__) && !defined(__ANDROID__) && __has_include(<sys/wait.h>)
 #define MGITEST_HAVE_FORK_PREFLIGHT 1
 #include <csignal>
 #include <ctime>
@@ -53,6 +63,83 @@ namespace MGITest {
         constexpr int kSurfaceWidth = 128;
         constexpr int kSurfaceHeight = 96;
 
+#if defined(_WIN32)
+        HWND g_testWindow = nullptr;
+
+        HWND CreateTestWindow() {
+            static const wchar_t* const kClassName = L"MobileGLIntegrationTestWindow";
+            static bool registered = false;
+            if (!registered) {
+                WNDCLASSW windowClass{};
+                windowClass.lpfnWndProc = DefWindowProcW;
+                windowClass.hInstance = GetModuleHandleW(nullptr);
+                windowClass.lpszClassName = kClassName;
+                if (RegisterClassW(&windowClass) == 0 && GetLastError() != ERROR_CLASS_ALREADY_EXISTS) {
+                    return nullptr;
+                }
+                registered = true;
+            }
+            return CreateWindowExW(0, kClassName, L"MobileGL Integration Test", WS_OVERLAPPEDWINDOW,
+                                   CW_USEDEFAULT, CW_USEDEFAULT, kSurfaceWidth, kSurfaceHeight, nullptr, nullptr,
+                                   GetModuleHandleW(nullptr), nullptr);
+        }
+#elif defined(__ANDROID__)
+        AImageReader* g_imageReader = nullptr;
+        ANativeWindow* g_imageReaderWindow = nullptr;
+
+        void DrainImageReader(void*, AImageReader* reader) {
+            AImage* image = nullptr;
+            if (AImageReader_acquireNextImage(reader, &image) == AMEDIA_OK && image != nullptr) {
+                AImage_delete(image);
+            }
+        }
+
+        bool CreateImageReaderWindow() {
+            if (g_imageReaderWindow != nullptr) return true;
+            constexpr int kMaxImages = 4;
+            const media_status_t status = AImageReader_newWithUsage(
+                kSurfaceWidth, kSurfaceHeight, AIMAGE_FORMAT_RGBA_8888,
+                AHARDWAREBUFFER_USAGE_GPU_SAMPLED_IMAGE | AHARDWAREBUFFER_USAGE_GPU_COLOR_OUTPUT,
+                kMaxImages, &g_imageReader);
+            if (status != AMEDIA_OK || g_imageReader == nullptr) return false;
+
+            AImageReader_ImageListener listener = {nullptr, DrainImageReader};
+            AImageReader_setImageListener(g_imageReader, &listener);
+            if (AImageReader_getWindow(g_imageReader, &g_imageReaderWindow) != AMEDIA_OK ||
+                g_imageReaderWindow == nullptr) {
+                AImageReader_setImageListener(g_imageReader, nullptr);
+                AImageReader_delete(g_imageReader);
+                g_imageReader = nullptr;
+                return false;
+            }
+            ANativeWindow_acquire(g_imageReaderWindow);
+            return true;
+        }
+
+        void DestroyImageReaderWindow() {
+            if (g_imageReaderWindow != nullptr) {
+                ANativeWindow_release(g_imageReaderWindow);
+                g_imageReaderWindow = nullptr;
+            }
+            if (g_imageReader != nullptr) {
+                AImageReader_setImageListener(g_imageReader, nullptr);
+                AImageReader_delete(g_imageReader);
+                g_imageReader = nullptr;
+            }
+        }
+#endif
+
+        bool UseWindowSurface() {
+#if defined(_WIN32)
+            const char* value = std::getenv("MOBILEGL_ITEST_WINDOW_SURFACE");
+            return value != nullptr && value[0] != '\0' && std::strcmp(value, "0") != 0;
+#elif defined(__ANDROID__)
+            return true;
+#else
+            return false;
+#endif
+        }
+
         std::string EnvOr(const char* name, const char* fallback) {
             const char* value = std::getenv(name);
             return (value != nullptr && value[0] != '\0') ? std::string(value) : std::string(fallback);
@@ -87,10 +174,10 @@ namespace MGITest {
         // callers). surfaceless is the platform with no window-system dependency at
         // all; the surface this file then creates is still a pbuffer, which every
         // platform supports and which the amendment to this rule requires as the
-        // fallback shape. DISPLAY/WAYLAND_DISPLAY are cleared as well so that a
+        // fallback shape on desktop. Android instead supplies an AImageReader
+        // ANativeWindow. DISPLAY/WAYLAND_DISPLAY are cleared as well so that a
         // driver that consults them directly cannot reintroduce the dependency
-        // behind EGL's back. Desktop-only file: MG_IntegrationTest never builds
-        // for Android, so no device path is affected.
+        // behind EGL's back.
         void EnsureHeadlessPlatform() {
 #if defined(__linux__) && !defined(__ANDROID__)
             static bool done = false;
@@ -134,8 +221,9 @@ namespace MGITest {
                 return 3;
             }
 
+            const bool useWindowSurface = UseWindowSurface();
             const EGLint configAttribs[] = {EGL_SURFACE_TYPE,
-                                            EGL_PBUFFER_BIT,
+                                            useWindowSurface ? EGL_WINDOW_BIT : EGL_PBUFFER_BIT,
                                             EGL_RED_SIZE,
                                             8,
                                             EGL_GREEN_SIZE,
@@ -152,7 +240,9 @@ namespace MGITest {
             EGLConfig config = nullptr;
             EGLint configCount = 0;
             if (eglChooseConfig(display, configAttribs, &config, 1, &configCount) != EGL_TRUE || configCount < 1) {
-                outReason = WithEglError("eglChooseConfig found no pbuffer-capable RGBA8/D24 config");
+                outReason = WithEglError(useWindowSurface
+                                             ? "eglChooseConfig found no window-capable RGBA8/D24 config"
+                                             : "eglChooseConfig found no pbuffer-capable RGBA8/D24 config");
                 return 4;
             }
 
@@ -166,10 +256,32 @@ namespace MGITest {
                 return 5;
             }
 
-            const EGLint pbufferAttribs[] = {EGL_WIDTH, kSurfaceWidth, EGL_HEIGHT, kSurfaceHeight, EGL_NONE};
-            EGLSurface surface = eglCreatePbufferSurface(display, config, pbufferAttribs);
+            EGLSurface surface = EGL_NO_SURFACE;
+            if (useWindowSurface) {
+#if defined(_WIN32)
+                if (g_testWindow == nullptr) g_testWindow = CreateTestWindow();
+                if (g_testWindow == nullptr) {
+                    outReason = "failed to create the Windows integration-test window";
+                    return 6;
+                }
+                surface = eglCreateWindowSurface(display, config, g_testWindow, nullptr);
+#elif defined(__ANDROID__)
+                if (!CreateImageReaderWindow()) {
+                    outReason = "failed to create the Android AImageReader integration-test window";
+                    return 6;
+                }
+                surface = eglCreateWindowSurface(display, config, g_imageReaderWindow, nullptr);
+#endif
+            } else {
+                const EGLint pbufferAttribs[] = {EGL_WIDTH, kSurfaceWidth, EGL_HEIGHT, kSurfaceHeight, EGL_NONE};
+                surface = eglCreatePbufferSurface(display, config, pbufferAttribs);
+            }
             if (surface == EGL_NO_SURFACE) {
-                outReason = WithEglError("eglCreatePbufferSurface failed");
+#if defined(__ANDROID__)
+                DestroyImageReaderWindow();
+#endif
+                outReason = WithEglError(useWindowSurface ? "eglCreateWindowSurface failed"
+                                                         : "eglCreatePbufferSurface failed");
                 return 6;
             }
             // The step that brings the whole backend up (DirectVulkan creates its
@@ -491,6 +603,14 @@ namespace MGITest {
         if (m_context != nullptr) eglDestroyContext(display, static_cast<EGLContext>(m_context));
         if (m_surface != nullptr) eglDestroySurface(display, static_cast<EGLSurface>(m_surface));
         eglTerminate(display);
+#if defined(_WIN32)
+        if (g_testWindow != nullptr) {
+            DestroyWindow(g_testWindow);
+            g_testWindow = nullptr;
+        }
+#elif defined(__ANDROID__)
+        DestroyImageReaderWindow();
+#endif
         m_context = nullptr;
         m_surface = nullptr;
         m_display = nullptr;

MobileGL/MG_IntegrationTest/Harness/HeadlessGL.h

@@ -14,11 +14,11 @@
 // inspects backend state - both bugs this module pins were invisible to
 // state-level assertions and visible only in pixels.
 //
-// Headless by construction, following MG_Benchmark/Driver/DriverBench.c: an EGL
-// context on a PBUFFER surface. No window, no window manager, no human. Unlike
-// DriverBench the scenarios do draw to the DEFAULT framebuffer (that is where
-// the Y-flip lives) and do call eglSwapBuffers (that is the frame boundary the
-// cross-frame scenarios need to be real).
+// Headless by construction: desktop uses an EGL pbuffer and Android uses an
+// AImageReader-backed ANativeWindow that needs no Activity. No window manager,
+// no human. Unlike DriverBench the scenarios do draw to the DEFAULT framebuffer
+// (that is where the Y-flip lives) and do call eglSwapBuffers (that is the frame
+// boundary the cross-frame scenarios need to be real).
 //
 // One process is one backend: MOBILEGL_BACKEND_TYPE is latched at
 // initialization, so the CMake wiring runs this binary once per backend rather

MobileGL/MG_IntegrationTest/Main.cpp

@@ -31,8 +31,14 @@ namespace {
                 // silently bound to a workstation's window system is a different
                 // run from CI's and must be visible as one in the log.
                 const char* eglPlatform = std::getenv("EGL_PLATFORM");
-                std::fprintf(stderr, "  renderer: %s\n  surface:  %dx%d pbuffer (headless, EGL_PLATFORM=%s)\n",
+#if defined(__ANDROID__)
+                constexpr const char* surfaceKind = "AImageReader window";
+#else
+                constexpr const char* surfaceKind = "pbuffer";
+#endif
+                std::fprintf(stderr, "  renderer: %s\n  surface:  %dx%d %s (headless, EGL_PLATFORM=%s)\n",
                              gl.RendererString().c_str(), gl.Width(), gl.Height(),
+                             surfaceKind,
                              eglPlatform != nullptr ? eglPlatform : "<unset>");
             } else if (MGITest::RequireGpu()) {
                 std::fprintf(stderr,

MobileGL/MG_IntegrationTest/Scenarios/AtomicCounterScenario.cpp

@@ -0,0 +1,239 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/AtomicCounterScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - ATOMIC COUNTERS, END TO END.
+//
+// GL_ATOMIC_COUNTER_BUFFER does not exist in ES, and glslang does not hand one to a backend
+// either: its Vulkan-relaxed parse rewrites every atomic_uint into a uint member of a
+// synthesized gl_AtomicCounterBlock_<N> STORAGE block. Making counters work therefore means
+// closing two open ends that used to be missing entirely -
+//
+//   * the block's shader-storage binding, which the IO mapper picked at random and which had no
+//     relation to the GL binding point N the application bound its buffer to (and could alias an
+//     SSBO the application binds itself), is moved to a slot reserved at the top of the driver's
+//     range; and
+//   * the buffer bound at GL_ATOMIC_COUNTER_BUFFER point N, which nothing in the ES backend ever
+//     read, is re-issued as a shader-storage binding at that reserved slot.
+//
+// Neither end alone is observable: with only the first the shader increments a block nobody
+// bound a buffer to, with only the second the buffer lands where the shader does not look. The
+// only thing that proves both is the VALUE, so every assertion here reads the counter back.
+//
+// Compute rather than a draw on purpose: the invocation count is exactly what was dispatched,
+// while a fragment stage's is a property of the rasterizer (helper invocations, early depth).
+// Conformance cases behind this: KHR-GL42/GL43.shader_atomic_counters.basic-usage-cs,
+// .advanced-usage-multi-stage and .advanced-usage-draw-update-draw.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // Two counters share binding 0 at DIFFERENT offsets and a third sits alone on binding 1.
+        // The offsets are what separates "the buffer arrived" from "the buffer arrived and the
+        // block is laid out the way GL says": a lowering that packed the members in declaration
+        // order without honouring `offset` would still pass a single-counter check.
+        constexpr const char* kCounterComputeSource = R"(#version 430 core
+layout(local_size_x = 4) in;
+layout(binding = 0, offset = 0) uniform atomic_uint g_first;
+layout(binding = 0, offset = 4) uniform atomic_uint g_second;
+layout(binding = 1, offset = 0) uniform atomic_uint g_other;
+void main() {
+    atomicCounterIncrement(g_first);
+    atomicCounterIncrement(g_second);
+    atomicCounterIncrement(g_second);
+    atomicCounterIncrement(g_other);
+}
+)";
+
+        constexpr int kLocalSizeX = 4;
+        constexpr int kWorkGroups = 2;
+        constexpr unsigned int kInvocations = kLocalSizeX * kWorkGroups;
+
+        // Deliberately non-zero: the shader adds to whatever the application uploaded, so a seed
+        // that survives is also proof that the buffer's CPU-side contents reached the driver.
+        constexpr unsigned int kSeedFirst = 5;
+        constexpr unsigned int kSeedSecond = 100;
+        constexpr unsigned int kSeedOther = 7;
+
+        class AtomicCounterScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                GLint counters = 0;
+                glGetIntegerv(GL_MAX_COMPUTE_ATOMIC_COUNTERS, &counters);
+                GLint buffers = 0;
+                glGetIntegerv(GL_MAX_COMPUTE_ATOMIC_COUNTER_BUFFERS, &buffers);
+                if (counters < 3 || buffers < 2) {
+                    GTEST_SKIP() << "GL_MAX_COMPUTE_ATOMIC_COUNTERS is " << counters
+                                 << " and GL_MAX_COMPUTE_ATOMIC_COUNTER_BUFFERS is " << buffers
+                                 << "; this needs 3 and 2";
+                }
+                if (!AtomicCountersAreWired()) {
+                    GTEST_SKIP() << "atomic counter buffers are not wired up on " << Gl().BackendName()
+                                 << " yet: glslang lowers them onto a storage block and that block's descriptor "
+                                 << "is still resolved from the shader-storage binding points";
+                }
+                m_program = CompileComputeProgram(kCounterComputeSource);
+                ASSERT_NE(m_program, 0u) << m_buildLog;
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                if (!m_buffers.empty()) glDeleteBuffers(static_cast<GLsizei>(m_buffers.size()), m_buffers.data());
+                if (m_program != 0) glDeleteProgram(m_program);
+                m_buffers.clear();
+                m_program = 0;
+            }
+
+            // Magma binds the lowered block as an ordinary storage-buffer descriptor resolved
+            // from GL_SHADER_STORAGE_BUFFER point N, so the counter buffer never reaches it. The
+            // frontend half (limits, reflection queries, the link-time offset rules) is
+            // backend-agnostic and is covered by the unit suites; only the VALUE is scoped here.
+            bool AtomicCountersAreWired() const { return Gl().BackendName() != "DirectVulkan"; }
+
+            unsigned int CompileComputeProgram(const char* source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            // A counter buffer of `count` uints, seeded and bound to atomic-counter point
+            // `binding`.
+            GLuint MakeCounterBuffer(GLuint binding, const std::vector<unsigned int>& seed) {
+                GLuint buffer = 0;
+                glGenBuffers(1, &buffer);
+                glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, buffer);
+                glBufferData(GL_ATOMIC_COUNTER_BUFFER,
+                             static_cast<GLsizeiptr>(seed.size() * sizeof(unsigned int)), seed.data(),
+                             GL_DYNAMIC_DRAW);
+                glBindBufferBase(GL_ATOMIC_COUNTER_BUFFER, binding, buffer);
+                glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, 0);
+                m_buffers.push_back(buffer);
+                return buffer;
+            }
+
+            std::vector<unsigned int> ReadCounters(GLuint buffer, int count) {
+                std::vector<unsigned int> values(static_cast<std::size_t>(count), 0xDEADBEEFu);
+                glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, buffer);
+                glGetBufferSubData(GL_ATOMIC_COUNTER_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(values.size() * sizeof(unsigned int)), values.data());
+                glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, 0);
+                return values;
+            }
+
+            void Dispatch() {
+                glUseProgram(m_program);
+                glDispatchCompute(kWorkGroups, 1, 1);
+                glMemoryBarrier(GL_ATOMIC_COUNTER_BARRIER_BIT | GL_BUFFER_UPDATE_BARRIER_BIT);
+            }
+
+            unsigned int m_program = 0;
+            std::string m_buildLog;
+            std::vector<GLuint> m_buffers;
+        };
+
+    } // namespace
+
+    // The counter values a dispatch leaves behind, per binding point and per offset within one
+    // binding. Nothing in the ES backend used to touch BufferTarget::AtomicCounter at all, so
+    // before the wiring landed every one of these read back its seed unchanged.
+    TEST_F(AtomicCounterScenario, DispatchIncrementsTheBoundCounterBuffers) {
+        if (!Ready() || IsSkipped()) return;
+
+        const GLuint zero = MakeCounterBuffer(0, {kSeedFirst, kSeedSecond});
+        const GLuint one = MakeCounterBuffer(1, {kSeedOther});
+        ASSERT_EQ(FirstGLError(), 0u) << "binding the counter buffers raised a GL error";
+
+        Dispatch();
+        EXPECT_EQ(FirstGLError(), 0u) << "the dispatch raised a GL error";
+
+        const std::vector<unsigned int> zeroValues = ReadCounters(zero, 2);
+        const std::vector<unsigned int> oneValues = ReadCounters(one, 1);
+        EXPECT_EQ(FirstGLError(), 0u) << "reading the counters back raised a GL error";
+
+        EXPECT_EQ(zeroValues[0], kSeedFirst + kInvocations)
+            << "binding 0 offset 0 read back " << zeroValues[0] << "; " << kSeedFirst
+            << " means the shader's increments never reached the buffer the application bound";
+        EXPECT_EQ(zeroValues[1], kSeedSecond + 2 * kInvocations)
+            << "binding 0 offset 4 read back " << zeroValues[1] << "; the seed means the counter at a NON-ZERO "
+            << "offset was not carried through the lowering, even though offset 0 was";
+        EXPECT_EQ(oneValues[0], kSeedOther + kInvocations)
+            << "binding 1 read back " << oneValues[0] << "; a counter buffer past the first binding point "
+            << "resolves to a different reserved slot and is where an off-by-one shows up";
+    }
+
+    // A second dispatch continues from where the first left off, and a re-seed between them is
+    // visible to the shader. Both halves of the buffer's traffic have to work, in both
+    // directions: the increments are only observable through the readback path, and the re-seed
+    // is only observable if the upload reaches the driver AFTER the buffer has been GPU-written.
+    TEST_F(AtomicCounterScenario, CountersAccumulateAcrossDispatchesAndFollowAReseed) {
+        if (!Ready() || IsSkipped()) return;
+
+        const GLuint zero = MakeCounterBuffer(0, {0u, 0u});
+        MakeCounterBuffer(1, {0u});
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        Dispatch();
+        Dispatch();
+        std::vector<unsigned int> values = ReadCounters(zero, 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(values[0], 2 * kInvocations) << "two dispatches did not accumulate";
+        EXPECT_EQ(values[1], 4 * kInvocations) << "two dispatches did not accumulate at offset 4";
+
+        const unsigned int reseed[2] = {1000u, 2000u};
+        glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, zero);
+        glBufferSubData(GL_ATOMIC_COUNTER_BUFFER, 0, sizeof(reseed), reseed);
+        glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, 0);
+        ASSERT_EQ(FirstGLError(), 0u) << "re-seeding the counter buffer raised a GL error";
+
+        Dispatch();
+        values = ReadCounters(zero, 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(values[0], reseed[0] + kInvocations) << "the re-seeded value did not reach the shader";
+        EXPECT_EQ(values[1], reseed[1] + 2 * kInvocations) << "the re-seeded value at offset 4 did not reach the shader";
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/BufferTextureScenario.cpp

@@ -299,4 +299,99 @@ void main() {
         EXPECT_EQ(FirstGLError(), 0u);
     }
 
+    // glGetTexLevelParameter used to refuse EVERY pname on a buffer texture: WIDTH/HEIGHT/DEPTH
+    // fell out of a mipmap-only switch as GL_INVALID_OPERATION, and GL_TEXTURE_BUFFER_SIZE /
+    // GL_TEXTURE_BUFFER_OFFSET were not in the switch at all, so they came back GL_INVALID_ENUM.
+    // KHR-GL43.texture_buffer wraps both queries in GLU_EXPECT_NO_ERROR, so the error alone fails
+    // the case before any value is compared.
+    //
+    // The two halves report DIFFERENT units and only one of them is clamped, which is the thing
+    // easiest to get backwards: WIDTH is a TEXEL count clamped to GL_MAX_TEXTURE_BUFFER_SIZE,
+    // BUFFER_SIZE is the range in basic machine units exactly as it was given.
+    TEST_F(BufferTextureScenario, LevelQueriesDescribeTheAttachedBufferRange) {
+        if (!Ready()) return;
+        FirstGLError();
+
+        GLint offsetAlignment = 1;
+        glGetIntegerv(GL_TEXTURE_BUFFER_OFFSET_ALIGNMENT, &offsetAlignment);
+        if (offsetAlignment < 1) offsetAlignment = 1;
+        GLint maxTexels = 0;
+        glGetIntegerv(GL_MAX_TEXTURE_BUFFER_SIZE, &maxTexels);
+        ASSERT_EQ(FirstGLError(), 0u);
+        ASSERT_GT(maxTexels, 0) << "an OpenGL 4.x context may not advertise a zero buffer-texture limit";
+
+        constexpr GLint kTexelBytes = 4; // GL_RGBA8
+        const GLsizeiptr rangeOffset = static_cast<GLsizeiptr>(offsetAlignment);
+        const GLsizeiptr rangeBytes = 32 * kTexelBytes;
+        // Deliberately bigger than the range, so a getter that answered out of the BUFFER rather
+        // than out of the texture's window would be caught.
+        const GLsizeiptr bufferBytes = rangeOffset + rangeBytes + 16 * kTexelBytes;
+
+        const std::vector<GLubyte> zeros(static_cast<size_t>(bufferBytes), 0);
+        GLuint buffer = 0;
+        glGenBuffers(1, &buffer);
+        glBindBuffer(GL_TEXTURE_BUFFER, buffer);
+        glBufferData(GL_TEXTURE_BUFFER, bufferBytes, zeros.data(), GL_STATIC_DRAW);
+
+        GLuint texture = 0;
+        glGenTextures(1, &texture);
+        glBindTexture(GL_TEXTURE_BUFFER, texture);
+        glTexBufferRange(GL_TEXTURE_BUFFER, GL_RGBA8, buffer, rangeOffset, rangeBytes);
+        ASSERT_EQ(FirstGLError(), 0u) << "glTexBufferRange(GL_RGBA8) was refused";
+
+        const auto levelQuery = [](GLenum pname) {
+            GLint value = -1;
+            glGetTexLevelParameteriv(GL_TEXTURE_BUFFER, 0, pname, &value);
+            return value;
+        };
+        const auto levelQueryF = [](GLenum pname) {
+            GLfloat value = -1.0f;
+            glGetTexLevelParameterfv(GL_TEXTURE_BUFFER, 0, pname, &value);
+            return value;
+        };
+
+        EXPECT_EQ(levelQuery(GL_TEXTURE_WIDTH), static_cast<GLint>(rangeBytes / kTexelBytes))
+            << "GL_TEXTURE_WIDTH is a texel count over the attached RANGE";
+        EXPECT_EQ(levelQuery(GL_TEXTURE_HEIGHT), 1);
+        EXPECT_EQ(levelQuery(GL_TEXTURE_DEPTH), 1);
+        EXPECT_EQ(levelQuery(GL_TEXTURE_BUFFER_SIZE), static_cast<GLint>(rangeBytes))
+            << "GL_TEXTURE_BUFFER_SIZE reports basic machine units, not texels";
+        EXPECT_EQ(levelQuery(GL_TEXTURE_BUFFER_OFFSET), static_cast<GLint>(rangeOffset));
+        EXPECT_EQ(FirstGLError(), 0u) << "a buffer-texture level query raised an error";
+        EXPECT_LE(levelQuery(GL_TEXTURE_WIDTH), maxTexels)
+            << "GL_TEXTURE_WIDTH must stay clamped to GL_MAX_TEXTURE_BUFFER_SIZE";
+
+        // The float getter is a separate switch and has drifted from the integer one before.
+        EXPECT_FLOAT_EQ(levelQueryF(GL_TEXTURE_WIDTH), static_cast<GLfloat>(rangeBytes / kTexelBytes));
+        EXPECT_FLOAT_EQ(levelQueryF(GL_TEXTURE_HEIGHT), 1.0f);
+        EXPECT_FLOAT_EQ(levelQueryF(GL_TEXTURE_BUFFER_SIZE), static_cast<GLfloat>(rangeBytes));
+        EXPECT_EQ(FirstGLError(), 0u) << "the float form of a buffer-texture level query raised an error";
+
+        // The whole-buffer form follows the buffer's current size instead of freezing a window.
+        glTexBuffer(GL_TEXTURE_BUFFER, GL_RGBA8, buffer);
+        EXPECT_EQ(levelQuery(GL_TEXTURE_BUFFER_OFFSET), 0);
+        EXPECT_EQ(levelQuery(GL_TEXTURE_BUFFER_SIZE), static_cast<GLint>(bufferBytes));
+        EXPECT_EQ(levelQuery(GL_TEXTURE_WIDTH), static_cast<GLint>(bufferBytes / kTexelBytes));
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        // Both buffer pnames belong to buffer textures alone; anything else is INVALID_OPERATION,
+        // the same shape GL_TEXTURE_COMPRESSED_IMAGE_SIZE uses for an uncompressed image.
+        GLuint plainTexture = 0;
+        glGenTextures(1, &plainTexture);
+        glBindTexture(GL_TEXTURE_2D, plainTexture);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 4, 4, 0, GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
+        EXPECT_EQ(FirstGLError(), 0u);
+        GLint unused = -1;
+        glGetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_BUFFER_SIZE, &unused);
+        EXPECT_EQ(FirstGLError(), static_cast<unsigned int>(GL_INVALID_OPERATION));
+
+        glBindTexture(GL_TEXTURE_2D, 0);
+        glBindTexture(GL_TEXTURE_BUFFER, 0);
+        glBindBuffer(GL_TEXTURE_BUFFER, 0);
+        glDeleteTextures(1, &plainTexture);
+        glDeleteTextures(1, &texture);
+        glDeleteBuffers(1, &buffer);
+        EXPECT_EQ(FirstGLError(), 0u);
+    }
+
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ClipDistanceScenario.cpp

@@ -151,6 +151,18 @@ void main() { fragColor = vec4(0.0, 1.0, 0.0, 1.0); }
                 glReadPixels(x, y, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, out);
             }
 
+            // GL_MAX_CLIP_DISTANCES is a real backend answer, not a constant: DirectGLES reports
+            // 0 on a driver without GL_EXT_clip_cull_distance, and DirectVulkan reports 0 without
+            // the shaderClipDistance device feature. On such a stack the shader above cannot
+            // compile - and MUST not, because declaring a clip distance the backend cannot host
+            // is exactly what used to link cleanly and then render nothing. Skip rather than
+            // fail: there is no clipping to assert about.
+            static bool BackendHostsTwoClipDistances() {
+                GLint maxClipDistances = 0;
+                glGetIntegerv(GL_MAX_CLIP_DISTANCES, &maxClipDistances);
+                return maxClipDistances >= 2;
+            }
+
             // Never assume the eight start disabled - see the header note about
             // XfbAfterClipDistanceScenario leaving one on for the rest of the process.
             static void DisableEveryClipDistance() {
@@ -229,6 +241,9 @@ void main() { fragColor = vec4(0.0, 1.0, 0.0, 1.0); }
     // The claim: an enabled clip distance removes the fragments where it is negative.
     TEST_F(ClipDistanceScenario, AnEnabledClipDistanceRemovesTheNegativeHalf) {
         if (!Ready()) return;
+        if (!BackendHostsTwoClipDistances()) {
+            GTEST_SKIP() << "this backend advertises no clip distances, so there is nothing to clip with";
+        }
         HeadlessGL& gl = Gl();
         const int width = gl.Width();
         const int height = gl.Height();
@@ -280,6 +295,9 @@ void main() { fragColor = vec4(0.0, 1.0, 0.0, 1.0); }
     // draw simply failed - would pass the case above.
     TEST_F(ClipDistanceScenario, ADisabledClipDistanceRemovesNothing) {
         if (!Ready()) return;
+        if (!BackendHostsTwoClipDistances()) {
+            GTEST_SKIP() << "this backend advertises no clip distances, so there is nothing to clip with";
+        }
         HeadlessGL& gl = Gl();
         const int width = gl.Width();
         const int height = gl.Height();
@@ -329,6 +347,9 @@ void main() { fragColor = vec4(0.0, 1.0, 0.0, 1.0); }
     // passes both cases above and fails this one.
     TEST_F(ClipDistanceScenario, TheEnablesAreIndependentPerDistance) {
         if (!Ready()) return;
+        if (!BackendHostsTwoClipDistances()) {
+            GTEST_SKIP() << "this backend advertises no clip distances, so there is nothing to clip with";
+        }
         HeadlessGL& gl = Gl();
         const int width = gl.Width();
         const int height = gl.Height();

MobileGL/MG_IntegrationTest/Scenarios/DoublePrecisionScenario.cpp

@@ -697,24 +697,127 @@ void main() {
             EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
         }
 
-        TEST_F(DoublePrecisionScenario, A64BitVertexFormatIsDeclinedOnEveryBackend) {
+        TEST_F(DoublePrecisionScenario, A64BitVertexFormatIsRecordedAndItsArrayIsDroppedAtDraw) {
             if (!Ready()) return;
             // The demotion leaves no 64-bit shader input to feed, so there is nothing a 64-bit
             // vertex FETCH could be fetched into - on either backend, and no longer only on the
-            // ones whose device lacks shaderFloat64. Declined loudly rather than accepted and
-            // drawn as garbage; the matching POST row says the same thing at startup.
+            // ones whose device lacks shaderFloat64.
+            //
+            // What that costs is the ARRAY, not the CALL. GL 4.6 core 10.3.2 defines no error for
+            // a well-formed glVertexAttribLFormat and 64-bit attributes are core in the GL 4.3
+            // context MobileGL advertises, so refusing the call would be non-conformant and would
+            // leave four pure state queries unanswerable
+            // (KHR-GL43.vertex_attrib_binding.basic-state1/3). The format is therefore recorded and
+            // queryable; the enabled array is what gets dropped, and the attribute then reads its
+            // generic current value. The matching POST row says exactly that at startup.
             GLuint vao = 0;
             glGenVertexArrays(1, &vao);
             glBindVertexArray(vao);
             while (glGetError() != GL_NO_ERROR) {}
 
-            glVertexAttribLFormat(0, 3, GL_DOUBLE, 0);
-            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_INVALID_OPERATION));
+            glVertexAttribLFormat(1, 3, GL_DOUBLE, 8);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR))
+                << "glVertexAttribLFormat is a legal call in a GL 4.3 context";
+
+            GLint attribSize = 0;
+            GLint attribType = 0;
+            GLint attribIsLong = 0;
+            GLint attribRelativeOffset = 0;
+            glGetVertexAttribiv(1, GL_VERTEX_ATTRIB_ARRAY_SIZE, &attribSize);
+            glGetVertexAttribiv(1, GL_VERTEX_ATTRIB_ARRAY_TYPE, &attribType);
+            glGetVertexAttribiv(1, GL_VERTEX_ATTRIB_ARRAY_LONG, &attribIsLong);
+            glGetVertexAttribiv(1, GL_VERTEX_ATTRIB_RELATIVE_OFFSET, &attribRelativeOffset);
+            EXPECT_EQ(attribSize, 3);
+            EXPECT_EQ(attribType, static_cast<GLint>(GL_DOUBLE));
+            EXPECT_EQ(attribIsLong, GL_TRUE) << "GL_VERTEX_ATTRIB_ARRAY_LONG is what makes this the "
+                                                "unconverted form; without it the state is a lie";
+            EXPECT_EQ(attribRelativeOffset, 8);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
 
             glBindVertexArray(0);
             glDeleteVertexArrays(1, &vao);
             while (glGetError() != GL_NO_ERROR) {}
         }
 
+        // The consequence of recording the state rather than refusing the call: a 64-bit array can
+        // now be ENABLED in a VAO that a draw uses, which it never could before. That must not
+        // take the draw down. Leaving such an array enabled with no pointer behind it is exactly
+        // the documented Adreno null-deref (SIGSEGV inside the next glDraw*), so DirectGLES
+        // disables it before glVertexAttribPointer can ever see GL_DOUBLE, and DirectVulkan maps
+        // the format to VK_FORMAT_UNDEFINED so it never enters the pipeline's vertex input state.
+        //
+        // The shader deliberately does NOT read location 1: that keeps the two backends on the
+        // same path (DirectVulkan declines a draw whose SHADER reads an unsupported enabled array,
+        // by design and loudly, which is a different assertion from this one) and it is the shape
+        // the crash needed - an enabled array nothing set a pointer for.
+        TEST_F(DoublePrecisionScenario, AnEnabledLongArrayDoesNotBreakADrawThatIgnoresIt) {
+            if (!Ready()) return;
+
+            constexpr const char* kVs = R"(#version 430 core
+layout(location = 0) in vec2 aPos;
+void main() { gl_Position = vec4(aPos, 0.0, 1.0); }
+)";
+            constexpr const char* kFs = R"(#version 430 core
+out vec4 o_color;
+void main() { o_color = vec4(0.0, 1.0, 0.0, 1.0); }
+)";
+            std::string error;
+            const unsigned int program = CompileProgram(kVs, kFs, &error);
+            ASSERT_NE(program, 0u) << error;
+
+            ColorFbo target = MakeColorFbo(32, 32);
+            ASSERT_NE(target.fbo, 0u) << "could not create the render target";
+            BindFbo(target);
+
+            const float positions[8] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+            const double doubles[4] = {1.0, 2.0, 3.0, 4.0};
+
+            GLuint vao = 0;
+            GLuint positionBuffer = 0;
+            GLuint doubleBuffer = 0;
+            glGenVertexArrays(1, &vao);
+            glBindVertexArray(vao);
+            glGenBuffers(1, &positionBuffer);
+            glBindBuffer(GL_ARRAY_BUFFER, positionBuffer);
+            glBufferData(GL_ARRAY_BUFFER, sizeof(positions), positions, GL_STATIC_DRAW);
+            glGenBuffers(1, &doubleBuffer);
+            glBindBuffer(GL_ARRAY_BUFFER, doubleBuffer);
+            glBufferData(GL_ARRAY_BUFFER, sizeof(doubles), doubles, GL_STATIC_DRAW);
+            glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+            glVertexAttribFormat(0, 2, GL_FLOAT, GL_FALSE, 0);
+            glVertexAttribBinding(0, 0);
+            glBindVertexBuffer(0, positionBuffer, 0, static_cast<GLsizei>(2 * sizeof(float)));
+            glEnableVertexAttribArray(0);
+
+            glVertexAttribLFormat(1, 1, GL_DOUBLE, 0);
+            glVertexAttribBinding(1, 1);
+            glBindVertexBuffer(1, doubleBuffer, 0, static_cast<GLsizei>(sizeof(double)));
+            glEnableVertexAttribArray(1);
+            EXPECT_EQ(FirstGLError(), 0u) << "setting up the 64-bit array was refused";
+
+            ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+            glUseProgram(program);
+            glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+            EXPECT_EQ(FirstGLError(), 0u) << "a draw with an enabled 64-bit array must not raise an error";
+
+            const Image image = ReadPixels(target.width, target.height);
+            ASSERT_FALSE(image.Empty());
+            EXPECT_GT(image.At(target.width / 2, target.height / 2).g, 200)
+                << "the draw did not happen; the enabled 64-bit array must be dropped, not fatal";
+
+            glDisableVertexAttribArray(0);
+            glDisableVertexAttribArray(1);
+            glBindVertexArray(0);
+            glDeleteVertexArrays(1, &vao);
+            glDeleteBuffers(1, &positionBuffer);
+            glDeleteBuffers(1, &doubleBuffer);
+            BindDefaultFramebuffer();
+            DestroyColorFbo(target);
+            glUseProgram(0);
+            glDeleteProgram(program);
+            EXPECT_EQ(FirstGLError(), 0u);
+        }
+
     } // namespace
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ImageSizeAfterRespecScenario.cpp

@@ -0,0 +1,234 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/ImageSizeAfterRespecScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - A DRAW READS imageSize() AFTER THE IMAGE TEXTURE IS RE-SPECIFIED.
+//
+// KHR-GL43.shader_image_size.advanced-changeSize reduced to its mechanism. The application binds
+// a texture to an image unit ONCE, draws, then re-specifies that same texture with a new size
+// through glTexImage2D and draws again - without touching the image unit. GL says the unit
+// references the texture OBJECT, so the second draw must see the new dimensions.
+//
+// On Espryt it did not, and the reason is two facts meeting:
+//
+//   1. ES 3.1 only allows IMMUTABLE storage on an image unit, so the backend forces glTexStorage
+//      backing on any texture that reaches one (SyncTextureObjectToBackend's
+//      imageBindableStorageRequired). Immutable storage cannot be redefined, so a glTexImage2D
+//      that changes size or format has to MINT A NEW ES TEXTURE NAME.
+//   2. The draw path never re-issued glBindImageTexture. Image units were established eagerly,
+//      once, when the application called glBindImageTexture, and PrepareForDraw only ever
+//      re-synced SAMPLED textures - so the unit kept pointing at the deleted name and
+//      imageSize() reported whatever that stale binding still meant.
+//
+// A dispatch was never affected: PrepareForCompute has always swept the image units. This is a
+// draw-path scenario for exactly that reason - a compute-shaped case cannot see the defect.
+//
+// Both backends run it. Magma re-derives its image descriptors per draw and so was never wrong
+// here, which makes it the control: the two backends have to agree on what the second draw sees.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kTargetSize = 8;
+
+        constexpr const char* kVS = R"(#version 430 core
+void main()
+{
+    // A single triangle that covers the whole target, with no vertex buffer at all: the
+    // scenario is about the image unit, so nothing else may be able to make it fail.
+    switch (gl_VertexID)
+    {
+      case 0: gl_Position = vec4(-1.0, -1.0, 0.0, 1.0); break;
+      case 1: gl_Position = vec4( 3.0, -1.0, 0.0, 1.0); break;
+      case 2: gl_Position = vec4(-1.0,  3.0, 0.0, 1.0); break;
+    }
+}
+)";
+
+        // Green when the image the unit currently holds has the size the application last gave
+        // it, red otherwise - the conformance case's own comparison, and its own colours.
+        constexpr const char* kFS = R"(#version 430 core
+layout(rgba8) readonly uniform image2D g_image;
+uniform ivec2 g_expected_size;
+layout(location = 0) out vec4 o_color;
+void main()
+{
+    o_color = (imageSize(g_image) == g_expected_size) ? vec4(0.0, 1.0, 0.0, 1.0) : vec4(1.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        class ImageSizeAfterRespecScenario : public ScenarioTest {
+        protected:
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                glBindImageTexture(0, 0, 0, GL_FALSE, 0, GL_READ_ONLY, GL_RGBA8);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_fbo != 0) glDeleteFramebuffers(1, &m_fbo);
+                if (m_color != 0) glDeleteTextures(1, &m_color);
+                if (m_image != 0) glDeleteTextures(1, &m_image);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_program = m_fbo = m_color = m_image = m_vao = 0;
+                while (glGetError() != GL_NO_ERROR) {
+                }
+            }
+
+            // imageSize() needs a fragment-stage image uniform; a driver that serves none should
+            // skip rather than fail.
+            bool FragmentImagesAreUsable() const {
+                GLint maxImageUnits = 0;
+                GLint maxFragmentImageUniforms = 0;
+                glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+                glGetIntegerv(GL_MAX_FRAGMENT_IMAGE_UNIFORMS, &maxFragmentImageUniforms);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxImageUnits >= 1 && maxFragmentImageUniforms >= 1;
+            }
+
+            GLuint MakeProgram() {
+                const GLuint vs = glCreateShader(GL_VERTEX_SHADER);
+                const GLuint fs = glCreateShader(GL_FRAGMENT_SHADER);
+                glShaderSource(vs, 1, &kVS, nullptr);
+                glShaderSource(fs, 1, &kFS, nullptr);
+                glCompileShader(vs);
+                glCompileShader(fs);
+                for (const GLuint shader : {vs, fs}) {
+                    GLint compiled = GL_FALSE;
+                    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                    if (compiled == GL_FALSE) {
+                        char log[4096] = {};
+                        glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                        ADD_FAILURE() << "a shader did not compile: " << log;
+                        glDeleteShader(vs);
+                        glDeleteShader(fs);
+                        return 0;
+                    }
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, vs);
+                glAttachShader(program, fs);
+                glLinkProgram(program);
+                glDeleteShader(vs);
+                glDeleteShader(fs);
+                GLint linked = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the program did not link: " << log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            void MakeRenderTarget() {
+                glGenTextures(1, &m_color);
+                glBindTexture(GL_TEXTURE_2D, m_color);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, kTargetSize, kTargetSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                             nullptr);
+                glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_color, 0);
+            }
+
+            // Draw once with `expected` pushed to the shader and report the centre pixel.
+            void DrawAndReadCentre(int expectedWidth, int expectedHeight, unsigned char (&centre)[4]) {
+                const GLint location = glGetUniformLocation(m_program, "g_expected_size");
+                ASSERT_NE(location, -1) << "the program has no g_expected_size uniform";
+                glUseProgram(m_program);
+                glUniform2i(location, expectedWidth, expectedHeight);
+                glViewport(0, 0, kTargetSize, kTargetSize);
+                glDisable(GL_SCISSOR_TEST);
+                glDisable(GL_DEPTH_TEST);
+                glClearColor(0.0f, 0.0f, 1.0f, 1.0f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glDrawArrays(GL_TRIANGLES, 0, 3);
+                ASSERT_EQ(FirstGLError(), 0u) << "the draw left a GL error";
+
+                std::vector<unsigned char> pixels(static_cast<std::size_t>(kTargetSize) * kTargetSize * 4, 0);
+                glReadPixels(0, 0, kTargetSize, kTargetSize, GL_RGBA, GL_UNSIGNED_BYTE, pixels.data());
+                ASSERT_EQ(FirstGLError(), 0u) << "reading the target back errored";
+                const std::size_t offset =
+                    (static_cast<std::size_t>(kTargetSize / 2) * kTargetSize + kTargetSize / 2) * 4;
+                for (int i = 0; i < 4; ++i) {
+                    centre[i] = pixels[offset + static_cast<std::size_t>(i)];
+                }
+            }
+
+            GLuint m_program = 0;
+            GLuint m_fbo = 0;
+            GLuint m_color = 0;
+            GLuint m_image = 0;
+            GLuint m_vao = 0;
+        };
+
+    } // namespace
+
+    // The whole conformance shape: bind once, draw, re-specify the SAME texture smaller, draw
+    // again. The first draw is the control - it proves the binding and the shader work at all -
+    // and the second is the regression pin. Blue would mean the draw never ran; red means the
+    // image unit answered with the size the texture had BEFORE the re-spec.
+    TEST_F(ImageSizeAfterRespecScenario, ADrawSeesTheNewSizeOfARespecifiedImageTexture) {
+        if (!Ready()) return;
+        if (!FragmentImagesAreUsable()) GTEST_SKIP() << "no fragment-stage image uniform available";
+
+        m_program = MakeProgram();
+        if (m_program == 0) return;
+        glGenVertexArrays(1, &m_vao);
+        glBindVertexArray(m_vao);
+        MakeRenderTarget();
+        ASSERT_EQ(FirstGLError(), 0u) << "setting the render target up errored";
+
+        glGenTextures(1, &m_image);
+        glBindTexture(GL_TEXTURE_2D, m_image);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 32, 32, 0, GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
+        glBindImageTexture(0, m_image, 0, GL_FALSE, 0, GL_READ_ONLY, GL_RGBA8);
+        ASSERT_EQ(FirstGLError(), 0u) << "binding the image texture errored";
+
+        unsigned char centre[4] = {0, 0, 0, 0};
+        DrawAndReadCentre(32, 32, centre);
+        EXPECT_EQ(static_cast<int>(centre[0]), 0) << "the FIRST draw already disagrees about imageSize(): got ("
+                                                  << static_cast<int>(centre[0]) << ", "
+                                                  << static_cast<int>(centre[1]) << ", "
+                                                  << static_cast<int>(centre[2]) << ")";
+        EXPECT_EQ(static_cast<int>(centre[1]), 255);
+
+        // The re-spec. The image unit is deliberately NOT re-bound: GL 4.6 core 8.26 says the
+        // unit references the texture object, so this alone has to be visible to the next draw.
+        glBindTexture(GL_TEXTURE_2D, m_image);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 16, 16, 0, GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
+        ASSERT_EQ(FirstGLError(), 0u) << "re-specifying the image texture errored";
+
+        DrawAndReadCentre(16, 16, centre);
+        EXPECT_EQ(static_cast<int>(centre[0]), 0)
+            << "after the re-spec the draw still sees the OLD image size; centre pixel was ("
+            << static_cast<int>(centre[0]) << ", " << static_cast<int>(centre[1]) << ", "
+            << static_cast<int>(centre[2]) << ")";
+        EXPECT_EQ(static_cast<int>(centre[1]), 255);
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ImageTargetKindScenario.cpp

@@ -66,6 +66,9 @@ namespace MGITest {
         constexpr int kExtent = 6;
         constexpr GLuint kFilledValue = 7u;
         constexpr GLuint kStoredValue = 13u;
+        // What the atomic cases add to a filled texel. Distinct from both values above, so a
+        // wrong answer cannot be read as either the untouched fill or a plain store.
+        constexpr GLuint kAtomicAddend = 5u;
 
         // Everything that differs between the eleven kinds, in one row.
         struct TargetKind {
@@ -129,6 +132,25 @@ namespace MGITest {
                    kind.imageType + " i0;\n\nvoid main()\n{\n    " + StoreStatement(kind, "i0", "13u") + "\n}\n";
         }
 
+        // The third direction, and the one neither of the two above can stand in for: an
+        // imageAtomic* reaches its texel through a SPIR-V operand path of its own
+        // (OpImageTexelPointer), not through OpImageRead or OpImageWrite. SPIRV-Cross's "ES has
+        // no 1D image, address it as 2D" coordinate widening is applied on the read and write
+        // paths and NOT on that one, so a 1D image whose loads and stores are both correct could
+        // still lose its entire stage to a single imageAtomicAdd - which is what
+        // KHR-GL4x.shader_image_load_store.basic-allTargets-atomic measured, with the driver
+        // answering "'imageAtomicAdd' : no matching overloaded function found".
+        //
+        // No readonly/writeonly here: an atomic needs both directions, and r32ui is one of the
+        // three formats GLSL ES exempts from the qualifier rule, so the bare declaration is legal.
+        // Returns the value the texel held BEFORE the add, so one dispatch checks the atomic's
+        // return value and the load case that follows checks its memory effect.
+        std::string SingleAtomicSource(const TargetKind& kind) {
+            return std::string(kComputePrologue) + "layout (location = 0, r32ui) coherent uniform " +
+                   kind.imageType + " i0;\n" + kResultBlock + "void main()\n{\n    ssb.sum = imageAtomicAdd(i0, " +
+                   kind.coord + (kind.multisample ? ", 0, " : ", ") + std::to_string(kAtomicAddend) + "u);\n}\n";
+        }
+
         class ImageTargetKindScenario : public ScenarioTest {
         protected:
             void TearDown() override {
@@ -374,6 +396,119 @@ namespace MGITest {
                 glUseProgram(0);
             }
 
+            // Fill a texture of `kind`, add to texel (0,0,0) atomically, and require BOTH the
+            // value the atomic returned and the value it left behind. The read-back runs as a
+            // second program, for the same reason the store case does: a backend that gets the
+            // atomic's return right and its memory effect wrong cannot cancel itself out.
+            void RunAtomicCase(const TargetKind& kind) {
+                const GLuint atomicProgram = MakeComputeProgram(SingleAtomicSource(kind));
+                const GLuint loadProgram = MakeComputeProgram(SingleLoadSource(kind));
+                if (atomicProgram == 0 || loadProgram == 0) return;
+                const GLuint texture = MakeTexture(kind, true);
+                if (texture == 0) return;
+                const GLuint ssbo = MakeResultBuffer();
+
+                glBindImageTexture(0, texture, 0, GL_TRUE, 0, GL_READ_WRITE, GL_R32UI);
+                ASSERT_EQ(FirstGLError(), 0u) << kind.name << ": glBindImageTexture errored";
+
+                glUseProgram(atomicProgram);
+                glUniform1i(0, 0);
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                EXPECT_EQ(FirstGLError(), 0u) << kind.name << ": the atomic dispatch leaked a GL error";
+                EXPECT_EQ(ReadResult(ssbo), kFilledValue)
+                    << kind.name << ": imageAtomicAdd did not return the value the texel held before it";
+
+                glUseProgram(loadProgram);
+                glUniform1i(0, 0);
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                EXPECT_EQ(FirstGLError(), 0u) << kind.name << ": the loading dispatch leaked a GL error";
+                EXPECT_EQ(ReadResult(ssbo), kFilledValue + kAtomicAddend)
+                    << kind.name << ": imageAtomicAdd did not leave the sum in the texel";
+                glUseProgram(0);
+            }
+
+            // The same texture, bound four times over, varying nothing but `layered` and `layer`.
+            //
+            // GL 4.6 core 8.26 (and ES 3.2 8.22, word for word): "If the texture identified by
+            // texture does not have multiple layers or faces, the entire texture level is bound,
+            // regardless of the values of layered and layer." REGARDLESS means ignored - not
+            // clamped, and not an error - so every one of the four rows has to read the same texel
+            // out of a target that has no layers, including the two rows that name layer 1 on a
+            // texture whose only layer is 0. DirectGLES used to normalize `layered` and forward
+            // `layer` verbatim; Adreno honours the bogus layer by leaving the image unit reading
+            // zero, which is exactly the two rows KHR-GL42.bind_image_texture.single_layer failed.
+            //
+            // The bindings are checked back as well, because the fix depends on WHERE the
+            // normalization happens: the frontend shadow must keep echoing the application's own
+            // values (gl4cShaderImageLoadStoreTests' CheckBinding compares them exactly), and only
+            // the backend's driver call may drop the layer.
+            void RunNonLayerableLayerSweepCase(const TargetKind& kind) {
+                const GLuint program = MakeComputeProgram(SingleLoadSource(kind));
+                if (program == 0) return;
+                const GLuint texture = MakeTexture(kind, true);
+                if (texture == 0) return;
+
+                // A multisample texture has no TexSubImage, so MakeTexture leaves it unwritten and
+                // it is seeded the way the store cases do it - through a dispatch of its own.
+                const GLuint expected = kind.multisample ? kStoredValue : kFilledValue;
+                if (kind.multisample) {
+                    const GLuint storeProgram = MakeComputeProgram(SingleStoreSource(kind));
+                    if (storeProgram == 0) return;
+                    glBindImageTexture(0, texture, 0, GL_TRUE, 0, GL_READ_WRITE, GL_R32UI);
+                    glUseProgram(storeProgram);
+                    glUniform1i(0, 0);
+                    glDispatchCompute(1, 1, 1);
+                    glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                    ASSERT_EQ(FirstGLError(), 0u) << kind.name << ": seeding the multisample texture errored";
+                }
+
+                const GLuint ssbo = MakeResultBuffer();
+                glUseProgram(program);
+                glUniform1i(0, 0);
+                ASSERT_EQ(FirstGLError(), 0u) << kind.name << ": assigning the image unit errored";
+
+                // glcBindImageTextureTests' own four rows, in its own order.
+                struct LayerRow {
+                    GLboolean layered;
+                    GLint layer;
+                };
+                static constexpr LayerRow kRows[] = {{GL_TRUE, 1}, {GL_TRUE, 0}, {GL_FALSE, 1}, {GL_FALSE, 0}};
+
+                for (const LayerRow& row : kRows) {
+                    const std::string where = std::string(kind.name) +
+                                              ": layered=" + (row.layered == GL_TRUE ? "TRUE" : "FALSE") +
+                                              " layer=" + std::to_string(row.layer);
+                    // Re-zeroed per row, so a row whose binding reads nothing cannot pass on the
+                    // previous row's answer.
+                    const GLuint zero = 0u;
+                    glBindBuffer(GL_SHADER_STORAGE_BUFFER, ssbo);
+                    glBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, sizeof(GLuint), &zero);
+
+                    glBindImageTexture(0, texture, 0, row.layered, row.layer, GL_READ_ONLY, GL_R32UI);
+                    EXPECT_EQ(FirstGLError(), 0u) << where << ": glBindImageTexture errored";
+
+                    GLint reportedLayered = -1;
+                    GLint reportedLayer = -1;
+                    glGetIntegeri_v(GL_IMAGE_BINDING_LAYERED, 0, &reportedLayered);
+                    glGetIntegeri_v(GL_IMAGE_BINDING_LAYER, 0, &reportedLayer);
+                    EXPECT_EQ(reportedLayered, row.layered == GL_TRUE ? 1 : 0)
+                        << where << ": GL_IMAGE_BINDING_LAYERED stopped reporting the application's value";
+                    EXPECT_EQ(reportedLayer, row.layer)
+                        << where << ": GL_IMAGE_BINDING_LAYER stopped reporting the application's value";
+
+                    glDispatchCompute(1, 1, 1);
+                    glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                    EXPECT_EQ(FirstGLError(), 0u) << where << ": the dispatch leaked a GL error";
+                    EXPECT_EQ(ReadResult(ssbo), expected)
+                        << where
+                        << ": the texel did not come back, so the binding named a layer the texture "
+                           "does not have instead of the whole level";
+                }
+                glUseProgram(0);
+            }
+
             std::vector<GLuint> m_programs;
             std::vector<GLuint> m_textures;
             std::vector<GLuint> m_buffers;
@@ -435,6 +570,54 @@ namespace MGITest {
 #undef MGL_DEFINE_LOAD_CASE
 #undef MGL_DEFINE_STORE_CASE
 
+    // ---- and the atomic direction, on the two kinds ES has to emulate -------
+    //
+    // Deliberately NOT every kind. imageAtomic* takes its own SPIR-V operand path
+    // (OpImageTexelPointer), and the only kinds whose coordinate that path has to RESHAPE are the
+    // two 1D ones - everything else addresses its ES texture with the coordinate the application
+    // wrote. GL_TEXTURE_1D_ARRAY is the control (its reshape has been in
+    // Lower1DArrayImagesForEssl from the start, and basic-allTargets-atomic passes on it);
+    // GL_TEXTURE_1D is the one that had none, so `imageAtomicAdd(g_image_1d, coord.x, 2)` reached
+    // the driver as a scalar against an iimage2D and took the whole fragment stage - and its six
+    // other images - with it.
+
+#define MGL_DEFINE_ATOMIC_CASE(CaseName, Kind)                                                                  \
+    TEST_F(ImageTargetKindScenario, AtomicallyAddsTo##CaseName) {                                               \
+        if (!Ready()) return;                                                                                   \
+        if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";                                    \
+        RunAtomicCase(Kind);                                                                                    \
+    }
+
+    MGL_DEFINE_ATOMIC_CASE(Texture1D, kKind1D)
+    MGL_DEFINE_ATOMIC_CASE(Texture1DArray, kKind1DArray)
+
+#undef MGL_DEFINE_ATOMIC_CASE
+
+    // ---- and the same texture bound four times, varying only layered/layer ---
+    //
+    // KHR-GL42.bind_image_texture.single_layer's sweep, on the kinds whose backend target has
+    // neither layers nor faces. Two of its four rows name layer 1 on a single-layer texture,
+    // which the spec says is to be ignored outright rather than honoured or rejected - and
+    // which DirectGLES used to forward to the ES driver as written.
+
+#define MGL_DEFINE_LAYER_SWEEP_CASE(CaseName, Kind)                                                             \
+    TEST_F(ImageTargetKindScenario, IgnoresLayerFor##CaseName) {                                                \
+        if (!Ready()) return;                                                                                   \
+        if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";                                    \
+        if ((Kind).multisample && !MultisampleImagesAreUsable()) {                                              \
+            GTEST_SKIP() << "GL_MAX_IMAGE_SAMPLES is 0, so the conformance case substitutes a plain 2D image "  \
+                            "here and never asks for a multisample one";                                        \
+        }                                                                                                       \
+        RunNonLayerableLayerSweepCase(Kind);                                                                    \
+    }
+
+    MGL_DEFINE_LAYER_SWEEP_CASE(Texture2D, kKind2D)
+    MGL_DEFINE_LAYER_SWEEP_CASE(Texture1D, kKind1D)
+    MGL_DEFINE_LAYER_SWEEP_CASE(TextureRectangle, kKindRect)
+    MGL_DEFINE_LAYER_SWEEP_CASE(Texture2DMultisample, kKind2DMS)
+
+#undef MGL_DEFINE_LAYER_SWEEP_CASE
+
     // ---- and all of them at once -------------------------------------------
     //
     // The conformance case's actual shape. The single-kind cases above cannot see a defect that

MobileGL/MG_IntegrationTest/Scenarios/IoBlockNameCollisionScenario.cpp

@@ -0,0 +1,389 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/IoBlockNameCollisionScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - ONE BLOCK NAME USED IN BOTH DIRECTIONS BY ONE STAGE STILL CARRIES ITS PAYLOAD.
+//
+// Desktop GLSL keeps SEPARATE name namespaces for input and output interface blocks, so a
+// single stage may legally write
+//
+//     in  TcsData { ... } tes_in[];
+//     out TcsData { ... } tes_out;
+//
+// The tessellation evaluation stage of both interface-block tests in
+// KHR-GL42/43.shading_language_420pack does exactly that, and MobileGL's backend used to
+// hand the shape straight through: SPIRV-Cross splits the namespace the same way glslang
+// does (block_input_names vs block_output_names) and re-emits BOTH blocks under the name
+// TcsData, so the generated ESSL declares two different blocks of one name in one shader.
+// Adreno's ES compiler keeps them apart. Mali's does not - the stage compiles, the program
+// links, and the evaluation stage's writes never reach the geometry stage, which is all 22
+// of that group's Mali failures and none of Adreno's or DirectVulkan's.
+//
+// Both cases below drive the SAME five-stage pipeline (vertex -> tessellation control ->
+// tessellation evaluation -> geometry -> fragment) and differ only in whether the
+// evaluation stage reuses one name. The distinct-name case is the negative control: it is
+// what says a red pixel in the colliding case is about the name and not about this machine's
+// tessellation, its geometry stage, or the block mechanism in general.
+//
+// Colour code, so a failure names its own cause:
+//   green  - the payload crossed all four stage boundaries, which is the pass.
+//   blue   - the clear colour: nothing was drawn at all (the program did not link, or the
+//            backend program was rejected and every draw became a no-op).
+//   red    - the pipeline ran but the plain (non-block) varying did not arrive, i.e. the
+//            failure is not about interface blocks.
+//   black  - the pipeline ran, the plain varying arrived, and the BLOCK payload came back
+//            zeroed or garbage. That is the defect this scenario exists for.
+//
+// llvmpipe and lavapipe run this faithfully but do NOT reproduce the original defect - the
+// aliasing is a Mali ES compiler behaviour. Read a green run here as "the rename did not
+// break the ordinary path"; the claim it pins on the device is the CTS group above.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // The payload starts here and is copied, unmodified, through every block below.
+        const char* const kVertexSource = R"(#version 420 core
+out VsData {
+    vec4 payload;
+} vs_out;
+void main()
+{
+    vs_out.payload = vec4(0.0, 1.0, 0.0, 1.0);
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kTessControlSource = R"(#version 420 core
+layout(vertices = 1) out;
+in VsData {
+    vec4 payload;
+} tcs_in[];
+out TcsData {
+    vec4 payload;
+} tcs_out[];
+void main()
+{
+    tcs_out[gl_InvocationID].payload = tcs_in[gl_InvocationID].payload;
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelOuter[3] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+    gl_TessLevelInner[1] = 1.0;
+}
+)";
+
+        // THE CASE UNDER TEST: one name, both directions, in one stage.
+        const char* const kCollidingTessEvalSource = R"(#version 420 core
+layout(isolines, point_mode) in;
+in TcsData {
+    vec4 payload;
+} tes_in[];
+out TcsData {
+    vec4 payload;
+} tes_out;
+out float tes_gs_alive;
+void main()
+{
+    tes_out.payload = tes_in[0].payload;
+    tes_gs_alive = 1.0;
+}
+)";
+
+        // The negative control: byte-identical but for the output block's name.
+        const char* const kDistinctTessEvalSource = R"(#version 420 core
+layout(isolines, point_mode) in;
+in TcsData {
+    vec4 payload;
+} tes_in[];
+out TesData {
+    vec4 payload;
+} tes_out;
+out float tes_gs_alive;
+void main()
+{
+    tes_out.payload = tes_in[0].payload;
+    tes_gs_alive = 1.0;
+}
+)";
+
+        // One geometry source per evaluation stage, because the block it consumes is named
+        // after the block the evaluation stage produced.
+        const char* const kCollidingGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(triangle_strip, max_vertices = 4) out;
+in TcsData {
+    vec4 payload;
+} gs_in[];
+in float tes_gs_alive[];
+out GsData {
+    vec4 payload;
+} gs_out;
+out float gs_fs_alive;
+void EmitCorner(vec2 corner)
+{
+    gs_out.payload = gs_in[0].payload;
+    gs_fs_alive = tes_gs_alive[0];
+    gl_Position = vec4(corner, 0.0, 1.0);
+    EmitVertex();
+}
+void main()
+{
+    EmitCorner(vec2(-1.0, -1.0));
+    EmitCorner(vec2(-1.0,  1.0));
+    EmitCorner(vec2( 1.0, -1.0));
+    EmitCorner(vec2( 1.0,  1.0));
+}
+)";
+
+        const char* const kDistinctGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(triangle_strip, max_vertices = 4) out;
+in TesData {
+    vec4 payload;
+} gs_in[];
+in float tes_gs_alive[];
+out GsData {
+    vec4 payload;
+} gs_out;
+out float gs_fs_alive;
+void EmitCorner(vec2 corner)
+{
+    gs_out.payload = gs_in[0].payload;
+    gs_fs_alive = tes_gs_alive[0];
+    gl_Position = vec4(corner, 0.0, 1.0);
+    EmitVertex();
+}
+void main()
+{
+    EmitCorner(vec2(-1.0, -1.0));
+    EmitCorner(vec2(-1.0,  1.0));
+    EmitCorner(vec2( 1.0, -1.0));
+    EmitCorner(vec2( 1.0,  1.0));
+}
+)";
+
+        // Red when the PLAIN varying did not arrive, so "the pipeline is broken" and "the
+        // block payload is broken" cannot be confused for one another.
+        const char* const kFragmentSource = R"(#version 420 core
+in GsData {
+    vec4 payload;
+} fs_in;
+in float gs_fs_alive;
+out vec4 fragColor;
+void main()
+{
+    fragColor = gs_fs_alive > 0.5 ? fs_in.payload : vec4(1.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        class IoBlockNameCollisionScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                if (!BackendHostsTessellationAndGeometry()) {
+                    GTEST_SKIP() << "no tessellation/geometry stages on " << Gl().BackendName() << " ("
+                                 << Gl().RendererString() << "); there is no five-stage pipeline to "
+                                 << "carry a block through";
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vao = 0;
+            }
+
+            // GL_MAX_TESS_GEN_LEVEL is a real backend answer, not a frontend constant: it
+            // reads 0 on a DirectGLES driver without GL_EXT_tessellation_shader and on a
+            // DirectVulkan device without the tessellationShader feature. There is no
+            // five-stage pipeline to assert about on such a stack.
+            static bool BackendHostsTessellationAndGeometry() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                GLint maxGeometryOutputVertices = 0;
+                glGetIntegerv(GL_MAX_GEOMETRY_OUTPUT_VERTICES, &maxGeometryOutputVertices);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxTessGenLevel >= 1 && maxGeometryOutputVertices >= 4;
+            }
+
+            GLuint BuildPipeline(const char* tessEvalSource, const char* geometrySource) {
+                const GLenum stages[] = {GL_VERTEX_SHADER, GL_TESS_CONTROL_SHADER,
+                                         GL_TESS_EVALUATION_SHADER, GL_GEOMETRY_SHADER,
+                                         GL_FRAGMENT_SHADER};
+                const char* const sources[] = {kVertexSource, kTessControlSource, tessEvalSource,
+                                               geometrySource, kFragmentSource};
+
+                GLuint shaders[5] = {0, 0, 0, 0, 0};
+                bool ok = true;
+                for (int i = 0; i < 5; ++i) {
+                    shaders[i] = glCreateShader(stages[i]);
+                    glShaderSource(shaders[i], 1, &sources[i], nullptr);
+                    glCompileShader(shaders[i]);
+                    GLint compiled = 0;
+                    glGetShaderiv(shaders[i], GL_COMPILE_STATUS, &compiled);
+                    if (!compiled) {
+                        m_buildLog = InfoLog(shaders[i], true);
+                        ok = false;
+                        break;
+                    }
+                }
+                if (!ok) {
+                    for (const GLuint shader : shaders) {
+                        if (shader != 0) glDeleteShader(shader);
+                    }
+                    return 0;
+                }
+
+                const GLuint program = glCreateProgram();
+                for (const GLuint shader : shaders) {
+                    glAttachShader(program, shader);
+                }
+                glLinkProgram(program);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                for (const GLuint shader : shaders) {
+                    glDeleteShader(shader);
+                }
+                if (!linked) {
+                    m_buildLog = InfoLog(program, false);
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                m_programs.push_back(program);
+                return program;
+            }
+
+            // Clears to BLUE, so "the draw painted nothing" is a colour of its own rather
+            // than something that could be mistaken for a zeroed payload.
+            Rgba8 DrawAndReadCentre(GLuint program) const {
+                glViewport(0, 0, Gl().Width(), Gl().Height());
+                glClearColor(0.0f, 0.0f, 1.0f, 1.0f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glUseProgram(program);
+                glPatchParameteri(GL_PATCH_VERTICES, 1);
+                glDrawArrays(GL_PATCHES, 0, 1);
+
+                Rgba8 pixel{};
+                glReadPixels(Gl().Width() / 2, Gl().Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, &pixel);
+                return pixel;
+            }
+
+            static bool IsGreen(const Rgba8& pixel) {
+                return pixel.r < 64 && pixel.g > 192 && pixel.b < 64;
+            }
+
+            const std::string& BuildLog() const { return m_buildLog; }
+
+            static GLenum FirstGLError() {
+                const GLenum first = glGetError();
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return first;
+            }
+
+        private:
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> log(static_cast<std::size_t>(length > 1 ? length : 1), '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                } else {
+                    glGetProgramInfoLog(object, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                }
+                return std::string(log.data());
+            }
+
+            GLuint m_vao = 0;
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+        };
+
+        // The negative control, and it runs first on purpose: if this one is not green there
+        // is nothing to conclude from the case below it.
+        //
+        // It is also the CALIBRATION. GL_MAX_TESS_GEN_LEVEL answers for the tessellation
+        // stages honestly, but nothing MobileGL reports answers for the geometry stage the
+        // same way (GL_MAX_GEOMETRY_* are frontend constants and an ES driver may legitimately
+        // report zero geometry storage blocks while having geometry shaders), so a stack that
+        // cannot build a five-stage program at all is recognised here, by trying.
+        TEST_F(IoBlockNameCollisionScenario, DistinctlyNamedBlocksCarryThePayloadThroughFiveStages) {
+            if (!Ready()) return;
+
+            const GLuint program = BuildPipeline(kDistinctTessEvalSource, kDistinctGeometrySource);
+            if (program == 0) {
+                GTEST_SKIP() << "this stack cannot build a five-stage tessellation+geometry program on "
+                             << Gl().BackendName() << ", so there is no block to carry through: "
+                             << BuildLog();
+            }
+
+            const Rgba8 centre = DrawAndReadCentre(program);
+            EXPECT_EQ(FirstGLError(), 0u);
+            EXPECT_TRUE(IsGreen(centre)) << "the control pipeline did not deliver its payload: " << centre;
+        }
+
+        TEST_F(IoBlockNameCollisionScenario, OneBlockNameInBothDirectionsStillCarriesThePayload) {
+            if (!Ready()) return;
+
+            // Same calibration as the case above, and for the same reason: a five-stage program
+            // this stack cannot build at all is not evidence about block names. Only once the
+            // DISTINCT-name build succeeds does a failure of the colliding one mean something.
+            if (BuildPipeline(kDistinctTessEvalSource, kDistinctGeometrySource) == 0) {
+                GTEST_SKIP() << "this stack cannot build a five-stage tessellation+geometry program on "
+                             << Gl().BackendName() << ", so there is no block to carry through: "
+                             << BuildLog();
+            }
+
+            // Legal desktop GLSL: input and output block names live in separate namespaces, so
+            // the evaluation stage below declares TcsData twice and must still compile. The
+            // control above having built is what makes this assertion about the NAME.
+            const GLuint program = BuildPipeline(kCollidingTessEvalSource, kCollidingGeometrySource);
+            ASSERT_NE(program, 0u)
+                << "an interface block name reused across the two directions of one stage is legal "
+                   "desktop GLSL, but the program did not build: "
+                << BuildLog();
+
+            const Rgba8 centre = DrawAndReadCentre(program);
+            EXPECT_EQ(FirstGLError(), 0u);
+            EXPECT_TRUE(IsGreen(centre))
+                << "the payload did not survive the stage that names its input and output block "
+                   "the same: "
+                << centre << " (blue: nothing drew; red: the plain varying was lost too; black: "
+                             "the block arrived empty)";
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/IterationRPFirstReductionScenario.cpp

@@ -0,0 +1,898 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/IterationRPFirstReductionScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - ITERATIONRP'S FIRST SUBGROUP REDUCTION.
+//
+// iterationRP reduces a 32 x 16 exposure tile with a vector subgroup inclusive add,
+// then a shared-memory scan of subgroup totals.  The source assumes that every
+// subgroup has a last lane, that there are 2..32 subgroups, and that local index
+// 511 belongs to the last subgroup and its last lane.  Those are source assumptions,
+// not API contracts.  This probe intentionally does not repair them: it records the
+// observed topology and makes each handoff independently observable.
+
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <iomanip>
+#include <iostream>
+#include <limits>
+#include <sstream>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr std::size_t kInvocationCount = 512;
+        constexpr std::size_t kScanStageCount = 6;
+        constexpr std::uint32_t kQuietNanBits = 0x7fc00000u;
+        constexpr std::size_t kNoSlot = std::numeric_limits<std::size_t>::max();
+
+        struct UVec4 {
+            std::uint32_t x;
+            std::uint32_t y;
+            std::uint32_t z;
+            std::uint32_t w;
+        };
+
+        struct Vec4 {
+            float x;
+            float y;
+            float z;
+            float w;
+        };
+
+        // Matches the std430 block exactly. uvec4/vec4 arrays have a 16-byte
+        // stride, floats are a dense scalar array, and the outer scan array is
+        // stage-major in both GLSL and C++.
+        struct ProbeOutput {
+            std::array<UVec4, kInvocationCount> invocation;
+            std::array<UVec4, kInvocationCount> subgroup;
+            std::array<Vec4, kInvocationCount> reduction;
+            std::array<float, kInvocationCount> finalAverage;
+            std::array<std::array<float, kInvocationCount>, kScanStageCount> scanAfter;
+        };
+
+        static_assert(sizeof(UVec4) == 16);
+        static_assert(sizeof(Vec4) == 16);
+        static_assert(std::is_standard_layout_v<ProbeOutput>);
+        static_assert(offsetof(ProbeOutput, invocation) == 0);
+        static_assert(offsetof(ProbeOutput, subgroup) == 8192);
+        static_assert(offsetof(ProbeOutput, reduction) == 16384);
+        static_assert(offsetof(ProbeOutput, finalAverage) == 24576);
+        static_assert(offsetof(ProbeOutput, scanAfter) == 26624);
+        static_assert(sizeof(ProbeOutput) == 38912);
+
+        enum class InputMode {
+            SampledRgba32f,
+            IndexedSsbo,
+        };
+
+        const char* InputModeName(InputMode mode) {
+            return mode == InputMode::SampledRgba32f ? "sampled RGBA32F" : "indexed SSBO";
+        }
+
+        std::uint32_t FloatBits(float value) {
+            return std::bit_cast<std::uint32_t>(value);
+        }
+
+        bool SameBits(float lhs, float rhs) {
+            return FloatBits(lhs) == FloatBits(rhs);
+        }
+
+        bool IsQuietNanSentinel(float value) {
+            return FloatBits(value) == kQuietNanBits;
+        }
+
+        bool DrainGlErrors() {
+            bool hadError = false;
+            while (glGetError() != GL_NO_ERROR) hadError = true;
+            return hadError;
+        }
+
+        bool HasExtension(const char* wanted) {
+            GLint extensionCount = 0;
+            glGetIntegerv(GL_NUM_EXTENSIONS, &extensionCount);
+            for (GLint i = 0; i < extensionCount; ++i) {
+                const auto* extension = reinterpret_cast<const char*>(glGetStringi(GL_EXTENSIONS, static_cast<GLuint>(i)));
+                if (extension != nullptr && std::string(extension) == wanted) return true;
+            }
+            return false;
+        }
+
+        struct CapabilityInfo {
+            bool subgroupExtension = false;
+            GLint subgroupSize = 0;
+            GLint supportedStages = 0;
+            GLint supportedFeatures = 0;
+            GLint maxComputeStorageBlocks = 0;
+            GLint maxStorageBindings = 0;
+            GLint maxWorkGroupInvocations = 0;
+            std::array<GLint, 3> maxWorkGroupSize{};
+            bool queryHadError = false;
+
+            // iterationRP's source contract needs gl_NumSubgroups in [2, 32] for its 512
+            // invocations, i.e. an advertised subgroup width in [16, 256]. A device
+            // outside that window (lavapipe's 8-lane subgroups give 64 subgroups) cannot
+            // run the fixture's verbatim reduction at all, so the scenario SKIPS there -
+            // the pack itself replays through the FixIterationRPSubgroupScratch patch, which
+            // this probe deliberately does not model. The width only gates the domain;
+            // lane placement and group counts still come from observed values alone.
+            bool SubgroupWidthInSourceDomain() const {
+                return subgroupSize >= 16 && subgroupSize <= 256;
+            }
+
+            bool SupportsProbe() const {
+                const auto stages = static_cast<GLbitfield>(supportedStages);
+                const auto features = static_cast<GLbitfield>(supportedFeatures);
+                return !queryHadError && subgroupExtension &&
+                       (stages & GL_COMPUTE_SHADER_BIT) != 0 &&
+                       (features & (GL_SUBGROUP_FEATURE_BASIC_BIT_KHR | GL_SUBGROUP_FEATURE_ARITHMETIC_BIT_KHR)) ==
+                           (GL_SUBGROUP_FEATURE_BASIC_BIT_KHR | GL_SUBGROUP_FEATURE_ARITHMETIC_BIT_KHR) &&
+                       SubgroupWidthInSourceDomain() &&
+                       maxComputeStorageBlocks >= 2 && maxStorageBindings >= 2 &&
+                       maxWorkGroupInvocations >= static_cast<GLint>(kInvocationCount) && maxWorkGroupSize[0] >= 32 &&
+                       maxWorkGroupSize[1] >= 16 && maxWorkGroupSize[2] >= 1;
+            }
+
+            std::string MissingRequirements() const {
+                std::vector<std::string> missing;
+                const auto stages = static_cast<GLbitfield>(supportedStages);
+                const auto features = static_cast<GLbitfield>(supportedFeatures);
+                if (queryHadError) missing.emplace_back("a subgroup/compute capability query generated GL error");
+                if (!subgroupExtension) missing.emplace_back("GL_KHR_shader_subgroup");
+                if ((stages & GL_COMPUTE_SHADER_BIT) == 0) {
+                    missing.emplace_back("GL_COMPUTE_SHADER_BIT in GL_SUBGROUP_SUPPORTED_STAGES_KHR");
+                }
+                const auto requiredFeatures =
+                    GL_SUBGROUP_FEATURE_BASIC_BIT_KHR | GL_SUBGROUP_FEATURE_ARITHMETIC_BIT_KHR;
+                if ((features & requiredFeatures) != requiredFeatures) {
+                    missing.emplace_back("basic|arithmetic in GL_SUBGROUP_SUPPORTED_FEATURES_KHR");
+                }
+                if (!SubgroupWidthInSourceDomain()) {
+                    missing.emplace_back(
+                        "GL_SUBGROUP_SIZE_KHR in [16, 256] (iterationRP's source contract needs "
+                        "gl_NumSubgroups in [2, 32] for 512 invocations; width " +
+                        std::to_string(subgroupSize) + " is outside the fixture's domain)");
+                }
+                if (maxComputeStorageBlocks < 2 || maxStorageBindings < 2) {
+                    missing.emplace_back("two compute SSBO bindings");
+                }
+                if (maxWorkGroupInvocations < static_cast<GLint>(kInvocationCount) || maxWorkGroupSize[0] < 32 ||
+                    maxWorkGroupSize[1] < 16 || maxWorkGroupSize[2] < 1) {
+                    missing.emplace_back("a 32x16x1 / 512-invocation compute workgroup");
+                }
+
+                std::ostringstream message;
+                for (std::size_t i = 0; i < missing.size(); ++i) {
+                    if (i != 0) message << ", ";
+                    message << missing[i];
+                }
+                return message.str();
+            }
+        };
+
+        CapabilityInfo QueryCapabilities() {
+            CapabilityInfo info;
+            DrainGlErrors();
+            info.subgroupExtension = HasExtension("GL_KHR_shader_subgroup");
+            glGetIntegerv(GL_SUBGROUP_SIZE_KHR, &info.subgroupSize);
+            glGetIntegerv(GL_SUBGROUP_SUPPORTED_STAGES_KHR, &info.supportedStages);
+            glGetIntegerv(GL_SUBGROUP_SUPPORTED_FEATURES_KHR, &info.supportedFeatures);
+            glGetIntegerv(GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS, &info.maxComputeStorageBlocks);
+            glGetIntegerv(GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS, &info.maxStorageBindings);
+            glGetIntegerv(GL_MAX_COMPUTE_WORK_GROUP_INVOCATIONS, &info.maxWorkGroupInvocations);
+            for (GLuint axis = 0; axis < info.maxWorkGroupSize.size(); ++axis) {
+                glGetIntegeri_v(GL_MAX_COMPUTE_WORK_GROUP_SIZE, axis, &info.maxWorkGroupSize[axis]);
+            }
+            info.queryHadError = DrainGlErrors();
+            return info;
+        }
+
+        void PrintMetadata(const CapabilityInfo& info, std::ostream& output) {
+            output << "IterationRPFirstReductionScenario metadata: "
+                   << "GL_SUBGROUP_SIZE_KHR=" << info.subgroupSize
+                   << ", GL_SUBGROUP_SUPPORTED_STAGES_KHR=0x" << std::hex
+                   << static_cast<GLbitfield>(info.supportedStages)
+                   << ", GL_SUBGROUP_SUPPORTED_FEATURES_KHR=0x"
+                   << static_cast<GLbitfield>(info.supportedFeatures) << std::dec
+                   << ", subgroupExtension=" << info.subgroupExtension
+                   << ", GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS=" << info.maxComputeStorageBlocks
+                   << ", GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS=" << info.maxStorageBindings
+                   << ", GL_MAX_COMPUTE_WORK_GROUP_INVOCATIONS=" << info.maxWorkGroupInvocations
+                   << ", GL_MAX_COMPUTE_WORK_GROUP_SIZE=" << info.maxWorkGroupSize[0] << 'x'
+                   << info.maxWorkGroupSize[1] << 'x' << info.maxWorkGroupSize[2]
+                   << ", queryHadError=" << info.queryHadError << '\n';
+        }
+
+        bool DumpRequested() {
+            const char* value = std::getenv("MOBILEGL_ITEST_SUBGROUP_PROBE_DUMP");
+            return value != nullptr && std::string(value) == "1";
+        }
+
+        constexpr const char* kShaderPreamble = R"(#version 430 core
+#extension GL_KHR_shader_subgroup_basic : require
+#extension GL_KHR_shader_subgroup_arithmetic : require
+
+layout(local_size_x = 32, local_size_y = 16, local_size_z = 1) in;
+
+layout(std430, binding = 1) buffer SubgroupProbeOutput {
+    uvec4 invocation[512];
+    uvec4 subgroup[512];
+    vec4 reduction[512];
+    float finalAverage[512];
+    float scanAfter[6][512];
+} outProbe;
+
+shared vec2 prefixSumCache[32];
+)";
+
+        constexpr const char* kSampledInput = R"(
+uniform sampler2D colortex2;
+uniform vec2 pixelSize;
+)";
+
+        constexpr const char* kIndexedInput = R"(
+layout(std430, binding = 0) readonly buffer Input {
+    float value[512];
+} inputData;
+)";
+
+        // Only the expression producing tileExposure differs between the two
+        // tests. The remainder is the iterationRP first reduction, with stores
+        // placed after its existing barriers to expose each handoff.
+        constexpr const char* kSampledTileExposure = R"(
+    vec2 texCoord = (vec2(gl_GlobalInvocationID.xy) + 0.5) *
+                    vec2(1.0 / 32.0, 1.0 / 16.0);
+    vec2 sampleCoord = texCoord * (1.0 / 64.0);
+    sampleCoord.x += (15.0 / 32.0) + pixelSize.x * 12.0;
+
+    float tileExposure = dot(
+        textureLod(colortex2, sampleCoord, 0.0).rgb,
+        vec3(0.2125, 0.7154, 0.0721));
+)";
+
+        constexpr const char* kIndexedTileExposure = R"(
+    float tileExposure = inputData.value[gl_LocalInvocationIndex];
+)";
+
+        constexpr const char* kReductionBody = R"(
+    vec2 sampleLuminance = vec2(tileExposure, 0.0);
+    sampleLuminance = subgroupInclusiveAdd(sampleLuminance);
+    float nativeInclusive = sampleLuminance.x;
+
+    // This is a uniform, safety-only branch: it leaves an invalid source
+    // contract visible without indexing past the 32-entry cache or underflowing
+    // loopLength - 1. It is deliberately a failure on the CPU, not a skip.
+    bool sourceDomain = gl_NumSubgroups >= 2u && gl_NumSubgroups <= 32u;
+    if (!sourceDomain) {
+        float qNaN = uintBitsToFloat(0x7fc00000u);
+        uint localIndex = gl_LocalInvocationIndex;
+        outProbe.invocation[localIndex] = uvec4(localIndex, gl_LocalInvocationID);
+        outProbe.subgroup[localIndex] = uvec4(gl_SubgroupSize, gl_NumSubgroups, gl_SubgroupID,
+                                               gl_SubgroupInvocationID);
+        outProbe.reduction[localIndex] = vec4(tileExposure, nativeInclusive, qNaN, qNaN);
+        outProbe.finalAverage[localIndex] = qNaN;
+        for (uint stage = 0u; stage < 6u; ++stage)
+            outProbe.scanAfter[stage][localIndex] = qNaN;
+        return;
+    }
+
+    if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+        prefixSumCache[gl_SubgroupID] = sampleLuminance;
+    barrier();
+
+    float sourceRawSubtotal = prefixSumCache[gl_SubgroupID].x;
+
+    uint loopLength = uint(findMSB(gl_NumSubgroups));
+    loopLength += uint(gl_NumSubgroups - (1u << (loopLength - 1u)) > 0u);
+
+    for (uint scanStage = 0u; scanStage < loopLength; ++scanStage) {
+        if ((gl_SubgroupID & (1u << scanStage)) > 0u) {
+            sampleLuminance += prefixSumCache[(gl_SubgroupID >> scanStage << scanStage) - 1u];
+            if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+                prefixSumCache[gl_SubgroupID] = sampleLuminance;
+        }
+        barrier();
+        outProbe.scanAfter[scanStage][gl_LocalInvocationIndex] = sampleLuminance.x;
+    }
+
+    float sourceMergedPrefix = sampleLuminance.x;
+
+    if (gl_LocalInvocationIndex == 511u)
+        prefixSumCache[0] = sampleLuminance / 512.0;
+    barrier();
+
+    float avg = prefixSumCache[0].x;
+
+    uint localIndex = gl_LocalInvocationIndex;
+    outProbe.invocation[localIndex] = uvec4(localIndex, gl_LocalInvocationID);
+    outProbe.subgroup[localIndex] = uvec4(gl_SubgroupSize, gl_NumSubgroups, gl_SubgroupID,
+                                           gl_SubgroupInvocationID);
+    outProbe.reduction[localIndex] = vec4(tileExposure, nativeInclusive, sourceRawSubtotal, sourceMergedPrefix);
+    outProbe.finalAverage[localIndex] = avg;
+}
+)";
+
+        std::string BuildProbeShader(InputMode mode) {
+            std::string source = kShaderPreamble;
+            source += mode == InputMode::SampledRgba32f ? kSampledInput : kIndexedInput;
+            source += "\nvoid main() {\n";
+            source += mode == InputMode::SampledRgba32f ? kSampledTileExposure : kIndexedTileExposure;
+            source += kReductionBody;
+            return source;
+        }
+
+        std::string FormatFloat(float value) {
+            std::ostringstream text;
+            text << std::hexfloat << value;
+            return text.str();
+        }
+
+        struct ValidationResult {
+            bool ok = true;
+            std::string phase;
+            std::string message;
+            bool scanStageMismatch = false;
+            int scanStage = -1;
+            bool ownerEvaluated = false;
+            bool index511IsSourceLastLaneWriter = false;
+            bool index511IsHighestSubgroupMember = false;
+            std::uint32_t highestObservedSubgroup = 0;
+        };
+
+        ValidationResult Failure(std::string phase, std::string message) {
+            ValidationResult result;
+            result.ok = false;
+            result.phase = std::move(phase);
+            result.message = std::move(message);
+            return result;
+        }
+
+        constexpr float kSampledLuminance = 0.2125f + 0.7154f + 0.0721f;
+
+        float ExpectedInput(InputMode mode, std::uint32_t localIndex) {
+            return mode == InputMode::SampledRgba32f ? kSampledLuminance : static_cast<float>(localIndex + 1u);
+        }
+
+        ValidationResult ValidateProbe(const ProbeOutput& output, InputMode mode) {
+            std::array<std::size_t, kInvocationCount> slotForLocal{};
+            slotForLocal.fill(kNoSlot);
+
+            // 1. Record identity. Slots are only used to locate each reported
+            // local index; all subgroup behavior below groups recorded IDs/lanes.
+            for (std::size_t slot = 0; slot < kInvocationCount; ++slot) {
+                const std::uint32_t localIndex = output.invocation[slot].x;
+                if (localIndex >= kInvocationCount) {
+                    std::ostringstream message;
+                    message << "output slot " << slot << " reports localIndex " << localIndex << " outside [0, 511]";
+                    return Failure("record identity", message.str());
+                }
+                if (slotForLocal[localIndex] != kNoSlot) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " appears in output slots " << slotForLocal[localIndex]
+                            << " and " << slot;
+                    return Failure("record identity", message.str());
+                }
+                slotForLocal[localIndex] = slot;
+            }
+            for (std::size_t localIndex = 0; localIndex < kInvocationCount; ++localIndex) {
+                if (slotForLocal[localIndex] == kNoSlot) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " is missing from all 512 records";
+                    return Failure("record identity", message.str());
+                }
+            }
+            for (std::size_t localIndex = 0; localIndex < kInvocationCount; ++localIndex) {
+                const std::size_t slot = slotForLocal[localIndex];
+                const UVec4& invocation = output.invocation[slot];
+                const std::uint32_t expectedX = static_cast<std::uint32_t>(localIndex % 32u);
+                const std::uint32_t expectedY = static_cast<std::uint32_t>(localIndex / 32u);
+                if (invocation.y != expectedX || invocation.z != expectedY || invocation.w != 0u) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " reports local invocation (" << invocation.y << ','
+                            << invocation.z << ',' << invocation.w << "), expected (" << expectedX << ',' << expectedY
+                            << ",0)";
+                    return Failure("record identity", message.str());
+                }
+                const float expectedInput = ExpectedInput(mode, static_cast<std::uint32_t>(localIndex));
+                const float actualInput = output.reduction[slot].x;
+                if (!SameBits(actualInput, expectedInput)) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " input was " << FormatFloat(actualInput) << ", expected "
+                            << FormatFloat(expectedInput);
+                    return Failure("input", message.str());
+                }
+            }
+
+            // 2. Observed topology. Do not derive lanes or subgroup membership
+            // from local invocation indices: only the values the shader recorded
+            // participate in grouping.
+            const std::uint32_t reportedNumSubgroups = output.subgroup[slotForLocal[0]].y;
+            if (reportedNumSubgroups == 0u) {
+                return Failure("observed topology", "localIndex 0 reported gl_NumSubgroups == 0");
+            }
+            if (reportedNumSubgroups > kInvocationCount) {
+                std::ostringstream message;
+                message << "reported gl_NumSubgroups=" << reportedNumSubgroups
+                        << " exceeds the 512 recorded invocations, so at least one subgroup ID is missing";
+                return Failure("observed topology", message.str());
+            }
+            std::vector<std::vector<std::size_t>> subgroupSlots(reportedNumSubgroups);
+            for (std::size_t localIndex = 0; localIndex < kInvocationCount; ++localIndex) {
+                const std::size_t slot = slotForLocal[localIndex];
+                const UVec4& subgroup = output.subgroup[slot];
+                if (subgroup.x == 0u || subgroup.y == 0u) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " reported subgroupSize=" << subgroup.x
+                            << ", numSubgroups=" << subgroup.y;
+                    return Failure("observed topology", message.str());
+                }
+                if (subgroup.y != reportedNumSubgroups) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " reported numSubgroups=" << subgroup.y
+                            << ", while localIndex 0 reported " << reportedNumSubgroups;
+                    return Failure("observed topology", message.str());
+                }
+                if (subgroup.z >= reportedNumSubgroups) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " reported subgroupID=" << subgroup.z
+                            << " outside [0, " << (reportedNumSubgroups - 1u) << ']';
+                    return Failure("observed topology", message.str());
+                }
+                if (subgroup.w >= subgroup.x) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " reported laneID=" << subgroup.w
+                            << " outside its subgroupSize=" << subgroup.x;
+                    return Failure("observed topology", message.str());
+                }
+                subgroupSlots[subgroup.z].push_back(slot);
+            }
+            for (std::uint32_t subgroupID = 0; subgroupID < reportedNumSubgroups; ++subgroupID) {
+                if (subgroupSlots[subgroupID].empty()) {
+                    std::ostringstream message;
+                    message << "reported gl_NumSubgroups=" << reportedNumSubgroups
+                            << " but subgroupID " << subgroupID << " has no recorded members";
+                    return Failure("observed topology", message.str());
+                }
+                auto& members = subgroupSlots[subgroupID];
+                std::sort(members.begin(), members.end(), [&output](std::size_t lhs, std::size_t rhs) {
+                    return output.subgroup[lhs].w < output.subgroup[rhs].w;
+                });
+                for (std::size_t i = 1; i < members.size(); ++i) {
+                    if (output.subgroup[members[i - 1]].w == output.subgroup[members[i]].w) {
+                        std::ostringstream message;
+                        message << "subgroupID " << subgroupID << " contains duplicate laneID "
+                                << output.subgroup[members[i]].w;
+                        return Failure("observed topology", message.str());
+                    }
+                }
+            }
+
+            // 3. Native subgroup arithmetic, in the actual lane ordering emitted
+            // by the driver. The fixture values and all partial sums are exactly
+            // representable binary32 values, so compare representation, not epsilon.
+            std::array<float, kInvocationCount> nativePrefix{};
+            std::vector<float> nativeSubtotal(reportedNumSubgroups, 0.0f);
+            for (std::uint32_t subgroupID = 0; subgroupID < reportedNumSubgroups; ++subgroupID) {
+                float inclusive = 0.0f;
+                for (const std::size_t slot : subgroupSlots[subgroupID]) {
+                    const std::uint32_t localIndex = output.invocation[slot].x;
+                    inclusive += ExpectedInput(mode, localIndex);
+                    nativePrefix[slot] = inclusive;
+                    const float actualNative = output.reduction[slot].y;
+                    if (!SameBits(actualNative, inclusive)) {
+                        std::ostringstream message;
+                        message << "subgroupID " << subgroupID << ", laneID " << output.subgroup[slot].w
+                                << ", localIndex " << localIndex << " nativeInclusive was " << FormatFloat(actualNative)
+                                << ", expected " << FormatFloat(inclusive);
+                        return Failure("native subgroup arithmetic", message.str());
+                    }
+                }
+                nativeSubtotal[subgroupID] = inclusive;
+            }
+
+            // sourceDomain is the narrow source-side safety branch. It is checked
+            // after native arithmetic so an unsupported source topology still
+            // reports native subgroup behavior before failing explicitly.
+            if (reportedNumSubgroups < 2u || reportedNumSubgroups > 32u) {
+                for (std::size_t localIndex = 0; localIndex < kInvocationCount; ++localIndex) {
+                    const std::size_t slot = slotForLocal[localIndex];
+                    const Vec4& reduction = output.reduction[slot];
+                    if (!IsQuietNanSentinel(reduction.z) || !IsQuietNanSentinel(reduction.w) ||
+                        !IsQuietNanSentinel(output.finalAverage[slot])) {
+                        std::ostringstream message;
+                        message << "iterationRP source reduction has no valid contract for gl_NumSubgroups="
+                                << reportedNumSubgroups << "; localIndex " << localIndex
+                                << " did not preserve its qNaN source-reduction sentinel";
+                        return Failure("source domain", message.str());
+                    }
+                    for (std::size_t stage = 0; stage < kScanStageCount; ++stage) {
+                        if (!IsQuietNanSentinel(output.scanAfter[stage][slot])) {
+                            std::ostringstream message;
+                            message << "iterationRP source reduction has no valid contract for gl_NumSubgroups="
+                                    << reportedNumSubgroups << "; localIndex " << localIndex << ", scan stage " << stage
+                                    << " did not preserve its qNaN source-reduction sentinel";
+                            return Failure("source domain", message.str());
+                        }
+                    }
+                }
+                std::ostringstream message;
+                message << "iterationRP source reduction has no valid contract for observed gl_NumSubgroups="
+                        << reportedNumSubgroups << " (requires 2..32); native subgroup results were recorded";
+                return Failure("source domain", message.str());
+            }
+
+            // 4. iterationRP source writer and first shared-memory handoff.
+            std::vector<std::size_t> sourceWriter(reportedNumSubgroups, kNoSlot);
+            for (std::uint32_t subgroupID = 0; subgroupID < reportedNumSubgroups; ++subgroupID) {
+                std::size_t writerCount = 0;
+                for (const std::size_t slot : subgroupSlots[subgroupID]) {
+                    const UVec4& subgroup = output.subgroup[slot];
+                    if (subgroup.w == subgroup.x - 1u) {
+                        sourceWriter[subgroupID] = slot;
+                        ++writerCount;
+                    }
+                }
+                if (writerCount != 1u) {
+                    std::ostringstream message;
+                    message << "subgroupID " << subgroupID << " has " << writerCount
+                            << " recorded lane(s) where laneID == subgroupSize - 1; iterationRP leaves that "
+                               "shared-cache entry unwritten";
+                    return Failure("source writer", message.str());
+                }
+                for (const std::size_t slot : subgroupSlots[subgroupID]) {
+                    const float actualRawSubtotal = output.reduction[slot].z;
+                    if (!SameBits(actualRawSubtotal, nativeSubtotal[subgroupID])) {
+                        std::ostringstream message;
+                        message << "subgroupID " << subgroupID << ", localIndex " << output.invocation[slot].x
+                                << " sourceRawSubtotal was " << FormatFloat(actualRawSubtotal) << ", expected "
+                                << FormatFloat(nativeSubtotal[subgroupID]);
+                        return Failure("source raw subtotal", message.str());
+                    }
+                }
+            }
+
+            // 5. Reproduce the source loop exactly, including the redundant final
+            // scan iteration on power-of-two subgroup counts. Reads and writes in
+            // one iteration target disjoint cache entries, so update the cache at
+            // the CPU equivalent of the source barrier.
+            std::array<float, kInvocationCount> mergedPrefix = nativePrefix;
+            std::vector<float> cache = nativeSubtotal;
+            std::uint32_t loopLength = std::bit_width(reportedNumSubgroups) - 1u;
+            loopLength +=
+                static_cast<std::uint32_t>(reportedNumSubgroups - (1u << (loopLength - 1u)) > 0u);
+            for (std::uint32_t scanStage = 0u; scanStage < loopLength; ++scanStage) {
+                std::vector<float> cacheAfterStage = cache;
+                for (std::uint32_t subgroupID = 0; subgroupID < reportedNumSubgroups; ++subgroupID) {
+                    if ((subgroupID & (1u << scanStage)) == 0u) continue;
+                    const std::uint32_t sourceCacheIndex = (subgroupID >> scanStage << scanStage) - 1u;
+                    const float sourcePrefix = cache[sourceCacheIndex];
+                    for (const std::size_t slot : subgroupSlots[subgroupID]) {
+                        mergedPrefix[slot] += sourcePrefix;
+                    }
+                    cacheAfterStage[subgroupID] = mergedPrefix[sourceWriter[subgroupID]];
+                }
+                cache.swap(cacheAfterStage);
+                for (std::size_t localIndex = 0; localIndex < kInvocationCount; ++localIndex) {
+                    const std::size_t slot = slotForLocal[localIndex];
+                    const float actualAfterStage = output.scanAfter[scanStage][slot];
+                    if (!SameBits(actualAfterStage, mergedPrefix[slot])) {
+                        std::ostringstream message;
+                        message << "scanStage " << scanStage << ", subgroupID " << output.subgroup[slot].z
+                                << ", laneID " << output.subgroup[slot].w << ", localIndex " << localIndex
+                                << " scanAfter was " << FormatFloat(actualAfterStage) << ", expected "
+                                << FormatFloat(mergedPrefix[slot]);
+                        ValidationResult result = Failure("source scan", message.str());
+                        result.scanStageMismatch = true;
+                        result.scanStage = static_cast<int>(scanStage);
+                        return result;
+                    }
+                }
+            }
+            for (std::size_t localIndex = 0; localIndex < kInvocationCount; ++localIndex) {
+                const std::size_t slot = slotForLocal[localIndex];
+                const float actualMergedPrefix = output.reduction[slot].w;
+                if (!SameBits(actualMergedPrefix, mergedPrefix[slot])) {
+                    std::ostringstream message;
+                    message << "localIndex " << localIndex << " sourceMergedPrefix was "
+                            << FormatFloat(actualMergedPrefix) << ", expected " << FormatFloat(mergedPrefix[slot]);
+                    return Failure("source scan", message.str());
+                }
+            }
+
+            // 6. Final owner and average. The uniformity check is intentionally
+            // separate from the source's topology contract at local index 511.
+            const float firstAverage = output.finalAverage[slotForLocal[0]];
+            for (std::size_t localIndex = 1; localIndex < kInvocationCount; ++localIndex) {
+                const float actualAverage = output.finalAverage[slotForLocal[localIndex]];
+                if (!SameBits(actualAverage, firstAverage)) {
+                    std::ostringstream message;
+                    message << "finalAverage differs: localIndex 0 has " << FormatFloat(firstAverage)
+                            << ", localIndex " << localIndex << " has " << FormatFloat(actualAverage);
+                    return Failure("final average", message.str());
+                }
+            }
+
+            ValidationResult ownerResult;
+            ownerResult.ownerEvaluated = true;
+            for (std::uint32_t subgroupID = 0; subgroupID < reportedNumSubgroups; ++subgroupID) {
+                if (!subgroupSlots[subgroupID].empty()) {
+                    ownerResult.highestObservedSubgroup = std::max(ownerResult.highestObservedSubgroup, subgroupID);
+                }
+            }
+            const std::size_t index511Slot = slotForLocal[kInvocationCount - 1u];
+            const UVec4& index511Subgroup = output.subgroup[index511Slot];
+            ownerResult.index511IsSourceLastLaneWriter =
+                index511Subgroup.w == index511Subgroup.x - 1u;
+            ownerResult.index511IsHighestSubgroupMember =
+                index511Subgroup.z == ownerResult.highestObservedSubgroup;
+            if (!ownerResult.index511IsSourceLastLaneWriter || !ownerResult.index511IsHighestSubgroupMember) {
+                std::ostringstream message;
+                message << "iterationRP topology incompatibility: localIndex 511 is sourceLastLaneWriter="
+                        << ownerResult.index511IsSourceLastLaneWriter << ", highestSubgroupMember="
+                        << ownerResult.index511IsHighestSubgroupMember << " (subgroupID=" << index511Subgroup.z
+                        << ", highest observed subgroupID=" << ownerResult.highestObservedSubgroup << ')';
+                ownerResult.ok = false;
+                ownerResult.phase = "final average";
+                ownerResult.message = message.str();
+                return ownerResult;
+            }
+
+            float total = 0.0f;
+            for (const float subtotal : nativeSubtotal) total += subtotal;
+            float sampledExpectedTotal = 0.0f;
+            for (std::size_t i = 0; i < kInvocationCount; ++i) sampledExpectedTotal += kSampledLuminance;
+            const float expectedTotal = mode == InputMode::IndexedSsbo ? 131328.0f : sampledExpectedTotal;
+            if (!SameBits(total, expectedTotal) || !SameBits(mergedPrefix[index511Slot], expectedTotal)) {
+                std::ostringstream message;
+                message << "iterationRP source total was " << FormatFloat(mergedPrefix[index511Slot])
+                        << " (native total " << FormatFloat(total) << "), expected " << FormatFloat(expectedTotal);
+                ownerResult.ok = false;
+                ownerResult.phase = "final average";
+                ownerResult.message = message.str();
+                return ownerResult;
+            }
+
+            const float expectedAverage = mode == InputMode::IndexedSsbo ? 256.5f : sampledExpectedTotal / 512.0f;
+            if (!SameBits(firstAverage, expectedAverage)) {
+                std::ostringstream message;
+                message << "finalAverage was " << FormatFloat(firstAverage) << ", expected "
+                        << FormatFloat(expectedAverage);
+                ownerResult.ok = false;
+                ownerResult.phase = "final average";
+                ownerResult.message = message.str();
+                return ownerResult;
+            }
+            return ownerResult;
+        }
+
+        void DumpProbe(const ProbeOutput& output, const CapabilityInfo& capabilities, const ValidationResult& validation,
+                       bool includeScanStages) {
+            PrintMetadata(capabilities, std::cout);
+            if (validation.ok) {
+                std::cout << "IterationRPFirstReductionScenario firstFailure=none\n";
+            } else {
+                std::cout << "IterationRPFirstReductionScenario firstFailure=" << validation.phase << ": "
+                          << validation.message << '\n';
+            }
+            std::cout << "localIndex,localX,localY,localZ,subgroupSize,numSubgroups,subgroupID,laneID,input,"
+                         "nativeInclusive,subgroupSubtotal,mergedPrefix,finalAverage\n";
+            for (std::size_t slot = 0; slot < kInvocationCount; ++slot) {
+                const UVec4& invocation = output.invocation[slot];
+                const UVec4& subgroup = output.subgroup[slot];
+                const Vec4& reduction = output.reduction[slot];
+                std::cout << invocation.x << ',' << invocation.y << ',' << invocation.z << ',' << invocation.w << ','
+                          << subgroup.x << ',' << subgroup.y << ',' << subgroup.z << ',' << subgroup.w << ','
+                          << std::hexfloat << reduction.x << ',' << reduction.y << ',' << reduction.z << ','
+                          << reduction.w << ',' << output.finalAverage[slot] << std::defaultfloat << '\n';
+            }
+            if (includeScanStages) {
+                std::cout << "scanStage,localIndex,scanAfter\n";
+                for (std::size_t scanStage = 0; scanStage < kScanStageCount; ++scanStage) {
+                    for (std::size_t slot = 0; slot < kInvocationCount; ++slot) {
+                        std::cout << scanStage << ',' << output.invocation[slot].x << ',' << std::hexfloat
+                                  << output.scanAfter[scanStage][slot] << std::defaultfloat << '\n';
+                    }
+                }
+            }
+        }
+
+        class IterationRPFirstReductionScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                m_capabilities = QueryCapabilities();
+                // GL_SUBGROUP_SIZE_KHR gates only whether the fixture's source contract
+                // can hold on this device (SubgroupWidthInSourceDomain); it is
+                // deliberately never used to infer lane placement or an expected group
+                // count - those come from observed values alone.
+                PrintMetadata(m_capabilities, std::cout);
+                RecordProperty("iterationrp_gl_subgroup_size_khr", std::to_string(m_capabilities.subgroupSize));
+                if (!m_capabilities.SupportsProbe()) {
+                    GTEST_SKIP() << "subgroup probe requires " << m_capabilities.MissingRequirements();
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, 0);
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 1, 0);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+                glActiveTexture(GL_TEXTURE3);
+                glBindTexture(GL_TEXTURE_2D, 0);
+                glActiveTexture(GL_TEXTURE0);
+                if (m_texture != 0) glDeleteTextures(1, &m_texture);
+                if (m_inputBuffer != 0) glDeleteBuffers(1, &m_inputBuffer);
+                if (m_outputBuffer != 0) glDeleteBuffers(1, &m_outputBuffer);
+                if (m_program != 0) glDeleteProgram(m_program);
+                m_texture = 0;
+                m_inputBuffer = 0;
+                m_outputBuffer = 0;
+                m_program = 0;
+            }
+
+            GLuint CompileComputeProgram(const std::string& source, std::string* outError) {
+                const char* text = source.c_str();
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                if (shader == 0) {
+                    *outError = "glCreateShader(GL_COMPUTE_SHADER) returned 0";
+                    return 0;
+                }
+                glShaderSource(shader, 1, &text, nullptr);
+                glCompileShader(shader);
+                GLint compiled = GL_FALSE;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[8192] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    *outError = std::string("the subgroup probe compute shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[8192] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    *outError = std::string("the subgroup probe compute program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            bool RunProbe(InputMode mode, ProbeOutput* output, std::string* outError) {
+                m_program = CompileComputeProgram(BuildProbeShader(mode), outError);
+                if (m_program == 0) return false;
+
+                ProbeOutput poison{};
+                std::memset(&poison, 0xa5, sizeof(poison));
+                glGenBuffers(1, &m_outputBuffer);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_outputBuffer);
+                glBufferData(GL_SHADER_STORAGE_BUFFER, sizeof(ProbeOutput), &poison, GL_DYNAMIC_COPY);
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 1, m_outputBuffer);
+
+                if (mode == InputMode::IndexedSsbo) {
+                    std::array<float, kInvocationCount> values{};
+                    for (std::size_t i = 0; i < values.size(); ++i) values[i] = static_cast<float>(i + 1u);
+                    glGenBuffers(1, &m_inputBuffer);
+                    glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_inputBuffer);
+                    glBufferData(GL_SHADER_STORAGE_BUFFER, sizeof(values), values.data(), GL_STATIC_DRAW);
+                    glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, m_inputBuffer);
+                } else {
+                    constexpr std::array<float, 4> kOneTexel = {1.0f, 1.0f, 1.0f, 1.0f};
+                    glGenTextures(1, &m_texture);
+                    glActiveTexture(GL_TEXTURE3);
+                    glBindTexture(GL_TEXTURE_2D, m_texture);
+                    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+                    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+                    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+                    glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+                    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA32F, 1, 1, 0, GL_RGBA, GL_FLOAT, kOneTexel.data());
+                }
+
+                if (const GLenum error = FirstGLError(); error != GL_NO_ERROR) {
+                    std::ostringstream message;
+                    message << "subgroup probe resource setup left " << GLErrorName(error);
+                    *outError = message.str();
+                    return false;
+                }
+
+                glUseProgram(m_program);
+                if (mode == InputMode::SampledRgba32f) {
+                    const GLint sampler = glGetUniformLocation(m_program, "colortex2");
+                    const GLint pixelSize = glGetUniformLocation(m_program, "pixelSize");
+                    if (sampler == -1 || pixelSize == -1) {
+                        *outError = "the sampled probe uniforms were optimized away or not reflected";
+                        return false;
+                    }
+                    glUniform1i(sampler, 3);
+                    glUniform2f(pixelSize, 1.0f / 854.0f, 1.0f / 480.0f);
+                }
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_outputBuffer);
+                glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, sizeof(ProbeOutput), output);
+                if (const GLenum error = FirstGLError(); error != GL_NO_ERROR) {
+                    std::ostringstream message;
+                    message << "subgroup probe dispatch/readback left " << GLErrorName(error);
+                    *outError = message.str();
+                    return false;
+                }
+                return true;
+            }
+
+            void RunAndValidate(InputMode mode) {
+                ProbeOutput output{};
+                std::string error;
+                ASSERT_TRUE(RunProbe(mode, &output, &error)) << InputModeName(mode) << ": " << error;
+
+                const ValidationResult validation = ValidateProbe(output, mode);
+                if (validation.ownerEvaluated) {
+                    RecordProperty("iterationrp_index511_source_last_lane_writer",
+                                   validation.index511IsSourceLastLaneWriter ? "true" : "false");
+                    RecordProperty("iterationrp_index511_highest_subgroup_member",
+                                   validation.index511IsHighestSubgroupMember ? "true" : "false");
+                    RecordProperty("iterationrp_highest_observed_subgroup",
+                                   std::to_string(validation.highestObservedSubgroup));
+                    std::cout << "IterationRPFirstReductionScenario owner: localIndex511 sourceLastLaneWriter="
+                              << validation.index511IsSourceLastLaneWriter << ", highestSubgroupMember="
+                              << validation.index511IsHighestSubgroupMember << ", highestObservedSubgroup="
+                              << validation.highestObservedSubgroup << '\n';
+                }
+                if (!validation.ok || DumpRequested()) {
+                    DumpProbe(output, m_capabilities, validation, validation.scanStageMismatch || DumpRequested());
+                }
+                EXPECT_TRUE(validation.ok) << validation.phase << ": " << validation.message;
+            }
+
+            CapabilityInfo m_capabilities;
+            GLuint m_program = 0;
+            GLuint m_inputBuffer = 0;
+            GLuint m_outputBuffer = 0;
+            GLuint m_texture = 0;
+        };
+
+    } // namespace
+
+    TEST_F(IterationRPFirstReductionScenario, SampledRgba32fFirstAverage) {
+        if (!Ready() || IsSkipped()) return;
+        RunAndValidate(InputMode::SampledRgba32f);
+    }
+
+    TEST_F(IterationRPFirstReductionScenario, IndexedInputTopologyAndReduction) {
+        if (!Ready() || IsSkipped()) return;
+        RunAndValidate(InputMode::IndexedSsbo);
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/IterationRPProgram203Scenario.cpp

@@ -0,0 +1,379 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/IterationRPProgram203Scenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Full iterationRP Program 203 golden input/output fixture. The original shader
+// consumes deterministic complete textures and uniforms, then its complete
+// 512x513 RG16F output image is compared against fixed half-float golden bits.
+// This catches both a wrong exposure slot and collateral scratch corruption.
+
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+        constexpr int kSceneWidth = 854;
+        constexpr int kSceneHeight = 480;
+        constexpr int kPixelDataWidth = 512;
+        constexpr int kPixelDataHeight = 513;
+        constexpr std::size_t kSceneTexelCount =
+            static_cast<std::size_t>(kSceneWidth) * kSceneHeight;
+        constexpr std::size_t kPixelDataTexelCount =
+            static_cast<std::size_t>(kPixelDataWidth) * kPixelDataHeight;
+
+        struct Rgba32f {
+            float r, g, b, a;
+        };
+
+        struct Rg16 {
+            std::uint16_t r, g;
+        };
+
+        static_assert(sizeof(Rgba32f) == 16);
+        static_assert(sizeof(Rg16) == 4);
+
+        // Captured from the fixed fixture on Adreno 830. These are the exact
+        // RG16F storage bits for (0.806640625, 8.2578125), not rounded decimal
+        // comparisons performed by the test.
+        constexpr Rg16 kGoldenExposure = {0x3a74u, 0x4821u};
+
+        constexpr const char* kCommonSource = R"glsl(
+#version 430 core
+#extension GL_KHR_shader_subgroup_arithmetic : require
+
+uniform int frameCounter;
+uniform float frameTime;
+uniform float aspectRatio;
+uniform vec2 pixelSize;
+uniform float nightVision;
+uniform float darknessLightFactor;
+uniform sampler2D colortex2;
+uniform sampler2D pixelData2D;
+layout(rg16f) uniform image2D img_pixelData2D;
+
+float remapSaturate(float x, float e0, float e1) {
+    return clamp((x - e0) / (e1 - e0), 0.0f, 1.0f);
+}
+
+float GetExposureValue(float luminance) {
+    float aeCurve = 0.65f;
+    aeCurve = mix(aeCurve, clamp(aeCurve * 1.2f, 0.0f, 1.0f), nightVision);
+    aeCurve *= remapSaturate(luminance, 2.0f, 1.0f) * 0.6f + 0.4f;
+    float ae = pow(luminance, -aeCurve);
+    ae *= 1.0f - min(darknessLightFactor * 2.0f, 0.9f);
+    ae *= 8.5f;
+    return ae;
+}
+)glsl";
+
+        constexpr const char* kOriginalMain = R"glsl(
+layout(local_size_x = 32, local_size_y = 16) in;
+shared vec2 prefixSumCache[32];
+
+void main() {
+    vec2 texCoord = (vec2(gl_GlobalInvocationID.xy) + 0.5f) * vec2(1.0f / 32.0f, 1.0f / 16.0f);
+    vec2 sampleCoord = texCoord * (1.0f / 64.0f);
+    sampleCoord.x += (15.0f / 32.0f) + pixelSize.x * 12.0f;
+    float tileExposure = dot(textureLod(colortex2, sampleCoord, 0.0f).rgb,
+                             vec3(0.2125f, 0.7154f, 0.0721f));
+    vec2 sampleLuminance = vec2(tileExposure, 0.0f);
+    sampleLuminance = subgroupInclusiveAdd(sampleLuminance);
+    if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+        prefixSumCache[gl_SubgroupID] = sampleLuminance;
+    barrier();
+
+    uint loopLength = uint(findMSB(gl_NumSubgroups));
+    loopLength += uint(gl_NumSubgroups - (1u << (loopLength - 1u)) > 0u);
+    for (uint i = 0u; i < loopLength; ++i) {
+        if ((gl_SubgroupID & (1u << i)) > 0u) {
+            sampleLuminance += prefixSumCache[(gl_SubgroupID >> i << i) - 1u];
+            if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+                prefixSumCache[gl_SubgroupID] = sampleLuminance;
+        }
+        barrier();
+    }
+    if (gl_LocalInvocationIndex == 511u)
+        prefixSumCache[0] = sampleLuminance / 512.0f;
+    barrier();
+
+    float avg = prefixSumCache[0].x;
+    vec2 tileDistance = texCoord * 2.0f - 1.0f;
+    tileDistance.y /= aspectRatio;
+    float centerDistance = length(tileDistance);
+    float tileWeight = remapSaturate(centerDistance, 0.6f, 0.4f);
+    tileExposure = max(7.0E-7f, tileExposure);
+    float lumaWeight = avg / tileExposure;
+    lumaWeight = pow(lumaWeight, remapSaturate(avg, 0.02f, 0.001f) * 0.4f + 0.2f);
+    tileWeight *= lumaWeight;
+
+    vec2 sampleExposure = vec2(tileExposure * tileWeight, tileWeight);
+    sampleExposure = subgroupInclusiveAdd(sampleExposure);
+    if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+        prefixSumCache[gl_SubgroupID] = sampleExposure;
+    barrier();
+    for (uint i = 0u; i < loopLength; ++i) {
+        if ((gl_SubgroupID & (1u << i)) > 0u) {
+            sampleExposure += prefixSumCache[(gl_SubgroupID >> i << i) - 1u];
+            if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+                prefixSumCache[gl_SubgroupID] = sampleExposure;
+        }
+        barrier();
+    }
+
+    if (gl_LocalInvocationIndex == 511u) {
+        float avgExposure = max(sampleExposure.x / sampleExposure.y * 29.3f, 1.0E-10f);
+        avgExposure = log2(avgExposure);
+        float prevAvgExposure = log2(texelFetch(pixelData2D, ivec2(0, 0), 0).x);
+        float frameTimeFixed = frameTime + step(frameCounter, 20) * 100.0f;
+        float exposureTime = clamp(frameTimeFixed * 2.0f, 0.0f, 1.0f);
+        avgExposure = mix(prevAvgExposure, avgExposure, exposureTime);
+        avgExposure = max(exp2(avgExposure), 1.0E-5f);
+        float exposure = GetExposureValue(avgExposure);
+        imageStore(img_pixelData2D, ivec2(0, 0), vec4(avgExposure, exposure, 0.0f, 0.0f));
+    }
+}
+)glsl";
+
+        GLuint CompileCompute(const char* mainSource, std::string* error) {
+            const std::array<const GLchar*, 2> sources = {kCommonSource, mainSource};
+            const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+            glShaderSource(shader, static_cast<GLsizei>(sources.size()), sources.data(), nullptr);
+            glCompileShader(shader);
+            GLint compiled = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+            if (compiled != GL_TRUE) {
+                std::array<char, 8192> log{};
+                glGetShaderInfoLog(shader, static_cast<GLsizei>(log.size() - 1), nullptr, log.data());
+                *error = log.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, shader);
+            glLinkProgram(program);
+            glDeleteShader(shader);
+            GLint linked = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &linked);
+            if (linked != GL_TRUE) {
+                std::array<char, 8192> log{};
+                glGetProgramInfoLog(program, static_cast<GLsizei>(log.size() - 1), nullptr, log.data());
+                *error = log.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+            return program;
+        }
+
+        std::vector<Rgba32f> MakeSceneInput() {
+            std::vector<Rgba32f> texels(kSceneTexelCount);
+            for (int y = 0; y < kSceneHeight; ++y) {
+                for (int x = 0; x < kSceneWidth; ++x) {
+                    std::uint32_t h = static_cast<std::uint32_t>(x) * 0x9e3779b9u;
+                    h ^= static_cast<std::uint32_t>(y) * 0x85ebca6bu;
+                    h ^= h >> 16u;
+                    h *= 0x7feb352du;
+                    h ^= h >> 15u;
+                    const float noise = static_cast<float>(h & 0xffffu) / 65535.0f;
+                    float base = 0.0002f + noise * 0.075f;
+                    const float dx = static_cast<float>(x - 420);
+                    const float dy = static_cast<float>(y - 4);
+                    base += 0.65f * std::exp(-(dx * dx + dy * dy) / 18.0f);
+                    if (((x + y * 17) % 113) == 0) base += 1.75f;
+                    texels[static_cast<std::size_t>(y) * kSceneWidth + x] =
+                        {base * 0.83f, base * 1.07f, base * 1.31f, 1.0f};
+                }
+            }
+            return texels;
+        }
+
+        std::uint16_t FloatToHalf(float value) {
+            const std::uint32_t bits = std::bit_cast<std::uint32_t>(value);
+            const std::uint32_t sign = (bits >> 16u) & 0x8000u;
+            const std::uint32_t exponent = (bits >> 23u) & 0xffu;
+            std::uint32_t mantissa = bits & 0x7fffffu;
+
+            if (exponent == 0xffu) {
+                return static_cast<std::uint16_t>(sign | (mantissa == 0 ? 0x7c00u : 0x7e00u));
+            }
+            int halfExponent = static_cast<int>(exponent) - 127 + 15;
+            if (halfExponent >= 31) return static_cast<std::uint16_t>(sign | 0x7c00u);
+            if (halfExponent <= 0) {
+                if (halfExponent < -10) return static_cast<std::uint16_t>(sign);
+                mantissa |= 0x800000u;
+                const unsigned shift = static_cast<unsigned>(14 - halfExponent);
+                const std::uint32_t rounded = mantissa + ((1u << (shift - 1u)) - 1u) +
+                                              ((mantissa >> shift) & 1u);
+                return static_cast<std::uint16_t>(sign | (rounded >> shift));
+            }
+            mantissa += 0xfffu + ((mantissa >> 13u) & 1u);
+            if ((mantissa & 0x800000u) != 0) {
+                mantissa = 0;
+                if (++halfExponent >= 31) return static_cast<std::uint16_t>(sign | 0x7c00u);
+            }
+            return static_cast<std::uint16_t>(sign | (static_cast<std::uint32_t>(halfExponent) << 10u) |
+                                              (mantissa >> 13u));
+        }
+
+        std::vector<Rg16> MakePixelDataInput() {
+            std::vector<Rg16> texels(kPixelDataTexelCount);
+            for (std::size_t i = 0; i < texels.size(); ++i) {
+                texels[i] = {FloatToHalf(0.35f + static_cast<float>(i % 97u) * 0.0025f),
+                             FloatToHalf(-0.45f + static_cast<float>(i % 89u) * 0.01f)};
+            }
+            texels[0] = {FloatToHalf(0.73f), FloatToHalf(1.25f)};
+            return texels;
+        }
+
+        std::vector<Rg16> MakeGoldenOutput() {
+            std::vector<Rg16> golden = MakePixelDataInput();
+            golden[0] = kGoldenExposure;
+            return golden;
+        }
+
+        GLuint MakeTexture(GLenum internalFormat, GLenum format, GLenum type, int width, int height,
+                           const void* data) {
+            GLuint texture = 0;
+            glGenTextures(1, &texture);
+            glBindTexture(GL_TEXTURE_2D, texture);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+            glTexImage2D(GL_TEXTURE_2D, 0, static_cast<GLint>(internalFormat), width, height, 0, format,
+                         type, data);
+            return texture;
+        }
+
+        void BindAndDispatch(GLuint program, GLuint scene, GLuint pixelData) {
+            glUseProgram(program);
+            glActiveTexture(GL_TEXTURE3);
+            glBindTexture(GL_TEXTURE_2D, scene);
+            glUniform1i(glGetUniformLocation(program, "colortex2"), 3);
+            glActiveTexture(GL_TEXTURE4);
+            glBindTexture(GL_TEXTURE_2D, pixelData);
+            glUniform1i(glGetUniformLocation(program, "pixelData2D"), 4);
+            glBindImageTexture(0, pixelData, 0, GL_FALSE, 0, GL_READ_WRITE, GL_RG16F);
+            glUniform1i(glGetUniformLocation(program, "img_pixelData2D"), 0);
+            glUniform1i(glGetUniformLocation(program, "frameCounter"), 100);
+            glUniform1f(glGetUniformLocation(program, "frameTime"), 1.0f / 60.0f);
+            glUniform1f(glGetUniformLocation(program, "aspectRatio"),
+                        static_cast<float>(kSceneWidth) / kSceneHeight);
+            glUniform2f(glGetUniformLocation(program, "pixelSize"), 1.0f / kSceneWidth, 1.0f / kSceneHeight);
+            glUniform1f(glGetUniformLocation(program, "nightVision"), 0.23f);
+            glUniform1f(glGetUniformLocation(program, "darknessLightFactor"), 0.08f);
+            glDispatchCompute(1, 1, 1);
+            glMemoryBarrier(GL_TEXTURE_UPDATE_BARRIER_BIT | GL_SHADER_IMAGE_ACCESS_BARRIER_BIT);
+        }
+
+        std::vector<Rg16> ReadWholeRgTexture(GLuint texture) {
+            std::vector<Rg16> texels(kPixelDataTexelCount);
+            glBindTexture(GL_TEXTURE_2D, texture);
+            glGetTexImage(GL_TEXTURE_2D, 0, GL_RG, GL_HALF_FLOAT, texels.data());
+            return texels;
+        }
+
+        class IterationRPProgram203Scenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                GLint stages = 0;
+                GLint features = 0;
+                GLint invocations = 0;
+                glGetIntegerv(GL_SUBGROUP_SUPPORTED_STAGES_KHR, &stages);
+                glGetIntegerv(GL_SUBGROUP_SUPPORTED_FEATURES_KHR, &features);
+                glGetIntegerv(GL_MAX_COMPUTE_WORK_GROUP_INVOCATIONS, &invocations);
+                const GLbitfield required =
+                    GL_SUBGROUP_FEATURE_BASIC_BIT_KHR | GL_SUBGROUP_FEATURE_ARITHMETIC_BIT_KHR;
+                if ((static_cast<GLbitfield>(stages) & GL_COMPUTE_SHADER_BIT) == 0 ||
+                    (static_cast<GLbitfield>(features) & required) != required || invocations < 512) {
+                    GTEST_SKIP() << "requires 512-invocation basic+arithmetic compute subgroups";
+                }
+
+                std::string error;
+                m_original = CompileCompute(kOriginalMain, &error);
+                ASSERT_NE(m_original, 0u) << "original Program 203: " << error;
+
+                const std::vector<Rgba32f> scene = MakeSceneInput();
+                const std::vector<Rg16> pixelData = MakePixelDataInput();
+                m_scene = MakeTexture(GL_RGBA16F, GL_RGBA, GL_FLOAT, kSceneWidth, kSceneHeight, scene.data());
+                m_originalOutput =
+                    MakeTexture(GL_RG16F, GL_RG, GL_HALF_FLOAT, kPixelDataWidth, kPixelDataHeight,
+                                pixelData.data());
+                ASSERT_EQ(FirstGLError(), static_cast<GLenum>(GL_NO_ERROR));
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                const std::array<GLuint, 2> textures = {m_scene, m_originalOutput};
+                glDeleteTextures(static_cast<GLsizei>(textures.size()), textures.data());
+                if (m_original != 0) glDeleteProgram(m_original);
+            }
+
+            GLuint m_original = 0;
+            GLuint m_scene = 0;
+            GLuint m_originalOutput = 0;
+        };
+    } // namespace
+
+    TEST_F(IterationRPProgram203Scenario, FixedCompleteInputProducesFixedCompleteGoldenOutput) {
+        if (!Ready()) return;
+
+        BindAndDispatch(m_original, m_scene, m_originalOutput);
+        glFinish();
+        const std::vector<Rg16> actual = ReadWholeRgTexture(m_originalOutput);
+        const std::vector<Rg16> expected = MakeGoldenOutput();
+        ASSERT_EQ(FirstGLError(), static_cast<GLenum>(GL_NO_ERROR));
+
+        std::size_t mismatchTexels = 0;
+        std::size_t firstMismatch = actual.size();
+        for (std::size_t i = 0; i < actual.size(); ++i) {
+            if (actual[i].r != expected[i].r || actual[i].g != expected[i].g) {
+                if (firstMismatch == actual.size()) firstMismatch = i;
+                ++mismatchTexels;
+            }
+        }
+
+        RecordProperty("program203_output_width", kPixelDataWidth);
+        RecordProperty("program203_output_height", kPixelDataHeight);
+        RecordProperty("program203_compared_texels", static_cast<long long>(actual.size()));
+        RecordProperty("program203_mismatch_texels", static_cast<long long>(mismatchTexels));
+        std::cout << "IterationRPProgram203Scenario complete-output actualExposureBits=(0x" << std::hex
+                  << actual[0].r << ", 0x" << actual[0].g << ") goldenExposureBits=(0x" << expected[0].r
+                  << ", 0x" << expected[0].g << std::dec << ") mismatches=" << mismatchTexels << '/'
+                  << actual.size() << '\n';
+
+        if (firstMismatch != actual.size()) {
+            const std::size_t x = firstMismatch % kPixelDataWidth;
+            const std::size_t y = firstMismatch / kPixelDataWidth;
+            ADD_FAILURE() << "complete Program 203 output differs at " << x << ',' << y
+                          << ": actual half bits=(0x" << std::hex << actual[firstMismatch].r << ", 0x"
+                          << actual[firstMismatch].g << ") golden half bits=(0x" << expected[firstMismatch].r
+                          << ", 0x" << expected[firstMismatch].g << std::dec << "); mismatched "
+                          << mismatchTexels << " of " << actual.size() << " texels";
+        }
+        EXPECT_EQ(mismatchTexels, 0u);
+    }
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/IterationRPScratchFixScenario.cpp

@@ -0,0 +1,302 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/IterationRPScratchFixScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - THE FIXTURE-SHAPED SUBGROUP REDUCTION, ON WHATEVER WIDTH THE DEVICE HAS.
+//
+// iterationRP hard-sizes the scratch its subgroup prefix scans write through
+// prefixSumCache[gl_SubgroupID], and ships that idiom twice: the auto-exposure pass
+// declares `shared vec2 prefixSumCache[32]` for a 512-invocation workgroup, and the
+// RTW importance warp declares `shared float prefixSumCache[64]` for a 1024-invocation
+// one. Both algorithms are width-agnostic; only the static lengths bake in "at most 32
+// (respectively 64) subgroups", which every desktop capture satisfies and an 8-lane
+// device (lavapipe: 64 and 128 subgroups) does not. DirectVulkan patches exactly that with
+// FixIterationRPSubgroupScratchPass, growing the array to ceil(invocations / native
+// width) on the modules that match the pack's reduction fingerprint.
+//
+// This scenario replays the fixture's reduction shape verbatim - the same 32-entry
+// declaration, the same last-lane handoff, the same findMSB combine loop, and NO
+// domain guard - and asserts only the width-independent result: the workgroup total.
+// The inputs are small integers, so the fp32 sum is exact under any lane order and any
+// association; a correct run produces the exact constant on a 4-lane device and a
+// 128-lane device alike. Without the patch, a sub-16-lane device indexes the
+// 32-entry array out of bounds - on lavapipe that is literal heap corruption - and
+// this scenario is the regression test that keeps the patch working, and it runs on every device that
+// has basic+arithmetic compute subgroups (unlike IterationRPFirstReductionScenario,
+// which probes the UNREPAIRED source contract and must skip outside [16, 256]).
+
+#include <cstdint>
+#include <cstring>
+#include <string>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+        constexpr std::uint32_t kInvocationCount = 512u;
+        // sum of 0..511, exactly representable and associativity-proof in fp32.
+        constexpr float kExpectedTotal = 130816.0f;
+        // The RTW warp's shape: 1024 invocations into a 64-entry float scratch.
+        constexpr std::uint32_t kWideInvocationCount = 1024u;
+        // sum of 0..1023, likewise exact in fp32.
+        constexpr float kWideExpectedTotal = 523776.0f;
+
+        constexpr const char* kComputeSource = R"(#version 430 core
+#extension GL_KHR_shader_subgroup_basic : require
+#extension GL_KHR_shader_subgroup_arithmetic : require
+
+layout(local_size_x = 32, local_size_y = 16, local_size_z = 1) in;
+
+layout(std430, binding = 0) buffer Output {
+    float total;
+    uint numSubgroups;
+    uint maxSubgroupId;
+} outputData;
+
+shared vec2 prefixSumCache[32];
+
+void main() {
+    vec2 sampleLuminance = vec2(float(gl_LocalInvocationIndex), 0.0);
+    sampleLuminance = subgroupInclusiveAdd(sampleLuminance);
+    if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+        prefixSumCache[gl_SubgroupID] = sampleLuminance;
+    barrier();
+
+    uint loopLength = uint(findMSB(gl_NumSubgroups));
+    loopLength += uint(gl_NumSubgroups - (1u << (loopLength - 1u)) > 0u);
+
+    for (uint scanStage = 0u; scanStage < loopLength; ++scanStage) {
+        if ((gl_SubgroupID & (1u << scanStage)) > 0u) {
+            sampleLuminance += prefixSumCache[(gl_SubgroupID >> scanStage << scanStage) - 1u];
+            if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+                prefixSumCache[gl_SubgroupID] = sampleLuminance;
+        }
+        barrier();
+    }
+
+    if (gl_LocalInvocationIndex == 511u) {
+        outputData.total = sampleLuminance.x;
+        outputData.numSubgroups = gl_NumSubgroups;
+    }
+    atomicMax(outputData.maxSubgroupId, gl_SubgroupID);
+}
+)";
+
+        // The RTW importance warp's shape: a plain float scan over 1024 invocations
+        // into a 64-entry scratch. Same idiom, different dimensions - which is exactly
+        // what a fingerprint pinned to the exposure pass's shape walks past.
+        constexpr const char* kWideComputeSource = R"(#version 430 core
+#extension GL_KHR_shader_subgroup_basic : require
+#extension GL_KHR_shader_subgroup_arithmetic : require
+
+layout(local_size_x = 1024) in;
+
+layout(std430, binding = 0) buffer Output {
+    float total;
+    uint numSubgroups;
+    uint maxSubgroupId;
+} outputData;
+
+shared float prefixSumCache[64];
+
+void main() {
+    float importance = float(gl_LocalInvocationID.x);
+    float prefixSum = subgroupInclusiveAdd(importance);
+    if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+        prefixSumCache[gl_SubgroupID] = prefixSum;
+    barrier();
+
+    uint loopLength = uint(findMSB(gl_NumSubgroups));
+    loopLength += uint(gl_NumSubgroups - (1u << (loopLength - 1u)) > 0u);
+
+    for (uint scanStage = 0u; scanStage < loopLength; ++scanStage) {
+        if ((gl_SubgroupID & (1u << scanStage)) > 0u) {
+            prefixSum += prefixSumCache[(gl_SubgroupID >> scanStage << scanStage) - 1u];
+            if (gl_SubgroupInvocationID == gl_SubgroupSize - 1u)
+                prefixSumCache[gl_SubgroupID] = prefixSum;
+        }
+        barrier();
+    }
+
+    if (gl_LocalInvocationID.x == 1023u) {
+        outputData.total = prefixSum;
+        outputData.numSubgroups = gl_NumSubgroups;
+    }
+    atomicMax(outputData.maxSubgroupId, gl_SubgroupID);
+}
+)";
+
+        struct OutputBlock {
+            float total = -1.0f;
+            std::uint32_t numSubgroups = 0;
+            std::uint32_t maxSubgroupId = 0;
+        };
+
+        bool HasExtension(const char* wanted) {
+            GLint extensionCount = 0;
+            glGetIntegerv(GL_NUM_EXTENSIONS, &extensionCount);
+            for (GLint i = 0; i < extensionCount; ++i) {
+                const auto* extension =
+                    reinterpret_cast<const char*>(glGetStringi(GL_EXTENSIONS, static_cast<GLuint>(i)));
+                if (extension != nullptr && std::string(extension) == wanted) return true;
+            }
+            return false;
+        }
+
+        class IterationRPScratchFixScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                GLint stages = 0;
+                GLint features = 0;
+                GLint invocations = 0;
+                const bool subgroupExtension = HasExtension("GL_KHR_shader_subgroup");
+                if (subgroupExtension) {
+                    glGetIntegerv(GL_SUBGROUP_SUPPORTED_STAGES_KHR, &stages);
+                    glGetIntegerv(GL_SUBGROUP_SUPPORTED_FEATURES_KHR, &features);
+                }
+                glGetIntegerv(GL_MAX_COMPUTE_WORK_GROUP_INVOCATIONS, &invocations);
+                const GLbitfield requiredFeatures =
+                    GL_SUBGROUP_FEATURE_BASIC_BIT_KHR | GL_SUBGROUP_FEATURE_ARITHMETIC_BIT_KHR;
+                if (!subgroupExtension || (static_cast<GLbitfield>(stages) & GL_COMPUTE_SHADER_BIT) == 0 ||
+                    (static_cast<GLbitfield>(features) & requiredFeatures) != requiredFeatures ||
+                    invocations < static_cast<GLint>(kInvocationCount)) {
+                    GTEST_SKIP() << "needs GL_KHR_shader_subgroup basic+arithmetic in compute and a "
+                                    "512-invocation workgroup";
+                }
+
+                m_maxInvocations = static_cast<std::uint32_t>(invocations);
+
+                glGenBuffers(1, &m_output);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_output);
+                // maxSubgroupId starts at zero HOST-side: the word is touched only by
+                // atomicMax during the dispatch, since a plain shader-side zeroing store
+                // would race the other invocations' atomics (barrier() orders shared
+                // memory, not SSBO stores).
+                const OutputBlock poison{-1.0f, 0xa5a5a5a5u, 0u};
+                glBufferData(GL_SHADER_STORAGE_BUFFER, sizeof(OutputBlock), &poison, GL_DYNAMIC_READ);
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, m_output);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, 0);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+                if (m_output != 0) glDeleteBuffers(1, &m_output);
+                if (m_program != 0) glDeleteProgram(m_program);
+            }
+
+            unsigned int CompileComputeProgram(const char* source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            // Re-poisons the block, compiles the shape under test and runs it once.
+            OutputBlock Dispatch(const char* source) {
+                const OutputBlock poison{-1.0f, 0xa5a5a5a5u, 0u};
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_output);
+                glBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, sizeof(OutputBlock), &poison);
+                m_program = CompileComputeProgram(source);
+                EXPECT_NE(m_program, 0u) << m_buildLog;
+                if (m_program == 0u) return OutputBlock{};
+                glUseProgram(m_program);
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_BUFFER_UPDATE_BARRIER_BIT);
+                OutputBlock block{};
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_output);
+                glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, sizeof(OutputBlock), &block);
+                return block;
+            }
+
+            GLuint m_program = 0;
+            GLuint m_output = 0;
+            std::uint32_t m_maxInvocations = 0;
+            std::string m_buildLog;
+        };
+    } // namespace
+
+    TEST_F(IterationRPScratchFixScenario, FixtureShapedReductionSumsEveryInvocation) {
+        const OutputBlock block = Dispatch(kComputeSource);
+        EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+        // The topology diagnostics catch the failure modes by name before the sum does:
+        // an out-of-bounds handoff corrupts the total, a wrong gl_NumSubgroups breaks
+        // the combine loop's length.
+        ASSERT_NE(block.numSubgroups, 0xa5a5a5a5u) << "invocation 511 never reached its store";
+        EXPECT_GE(block.numSubgroups, 1u);
+        EXPECT_LE(block.numSubgroups, kInvocationCount);
+        EXPECT_LT(block.maxSubgroupId, block.numSubgroups)
+            << "gl_SubgroupID exceeds gl_NumSubgroups - the inconsistency "
+               "DeriveNumSubgroupsPass exists to repair";
+
+        // Integer-valued fp32 inputs: the workgroup total is exact under any subgroup
+        // width, lane order, and association. This is the value iterationRP's exposure
+        // average is built from; without FixIterationRPSubgroupScratchPass an 8-lane
+        // device writes prefixSumCache[32..63] out of bounds and this comparison fails.
+        EXPECT_EQ(block.total, kExpectedTotal)
+            << "workgroup reduction produced " << block.total << " with gl_NumSubgroups="
+            << block.numSubgroups;
+    }
+
+    // The pack's second instance of the same bug, and the one that kept the CI
+    // retrace red after the exposure pass alone was patched.
+    TEST_F(IterationRPScratchFixScenario, WideFixtureShapedReductionSumsEveryInvocation) {
+        if (m_maxInvocations < kWideInvocationCount) {
+            GTEST_SKIP() << "needs a " << kWideInvocationCount << "-invocation workgroup";
+        }
+        const OutputBlock block = Dispatch(kWideComputeSource);
+        EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+        ASSERT_NE(block.numSubgroups, 0xa5a5a5a5u) << "invocation 1023 never reached its store";
+        EXPECT_GE(block.numSubgroups, 1u);
+        EXPECT_LE(block.numSubgroups, kWideInvocationCount);
+        EXPECT_LT(block.maxSubgroupId, block.numSubgroups)
+            << "gl_SubgroupID exceeds gl_NumSubgroups - the inconsistency "
+               "DeriveNumSubgroupsPass exists to repair";
+
+        // Without the patch an 8-lane device writes prefixSumCache[64..127] out of
+        // bounds and this comparison fails.
+        EXPECT_EQ(block.total, kWideExpectedTotal)
+            << "workgroup reduction produced " << block.total << " with gl_NumSubgroups="
+            << block.numSubgroups;
+    }
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/LayeredTextureReadbackScenario.cpp

@@ -0,0 +1,286 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/LayeredTextureReadbackScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - READING EVERY LAYER OF A 1D-ARRAY / CUBE-MAP-ARRAY LEVEL BACK.
+//
+// glGetTexImage has no ES equivalent, so Espryt serves it by attaching the level to a scratch
+// READ framebuffer and reading it with glReadPixels. Two of the targets it has to answer for do
+// not fit that shape the way the others do, and both came back as zeroes in
+// KHR-GL4x.shader_image_load_store.basic-allTargets-* and .non-layered_binding:
+//
+//   * GL_TEXTURE_1D_ARRAY carries its LAYERS in the state-side height - that is what
+//     glTexImage2D(GL_TEXTURE_1D_ARRAY, w, layers) means - while the ES texture behind it is a 2D
+//     array of height 1 with the layers in depth. The readback used the state-side shape, so it
+//     asked layer 0 for a `layers`-row rectangle that layer does not have: row 0 was the only one
+//     that could be right, and everything past it was whatever reading outside an attachment
+//     produces.
+//   * GL_TEXTURE_CUBE_MAP_ARRAY has no glFramebufferTexture2D target token at all, so the 2D
+//     attach it used to take errored, the scratch FBO stayed incomplete, and every read fell
+//     through to the CPU shadow - which holds what was UPLOADED, i.e. the seed, not what the
+//     shader stored.
+//
+// Both cases store from a compute dispatch (so the only copy of the data is the GPU one and a
+// stale shadow cannot pass) and then read the whole level back in one glGetTexImage, checking
+// every layer separately so a failure names which one. r32ui throughout: it is a core GLSL ES
+// image format, so nothing here can be confused with the missing-format story that
+// ImageFormatQualifierScenario covers.
+//
+// Magma reads these back through its own path and is unaffected by the ES attachment rules, so
+// both cases run on both backends and must agree.
+
+#include <cstddef>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kExtent = 4;
+        constexpr int kArrayLayers = 3;     // enough that "layer 0 only" is visibly wrong
+        constexpr int kCubeLayerFaces = 12; // two cubes, which is what the conformance case uses
+        // A value no store writes, so "the store never landed" and "the store wrote the wrong
+        // thing" cannot be confused - and so a readback served from the stale CPU shadow is
+        // recognisable on sight.
+        constexpr GLuint kSeed = 0xFEEDBEEFu;
+        // Deliberately not 0: the unit has to travel through glUniform1i and be baked into the
+        // generated ESSL, so a defect there cannot hide behind the default.
+        constexpr GLint kImageUnit = 1;
+
+        GLuint Expected1DArrayTexel(int x, int layer) {
+            return 1000u + static_cast<GLuint>(layer) * 100u + static_cast<GLuint>(x);
+        }
+
+        GLuint ExpectedCubeArrayTexel(int x, int y, int layerFace) {
+            return 1000u + static_cast<GLuint>(layerFace) * 100u + static_cast<GLuint>(y) * 10u +
+                   static_cast<GLuint>(x);
+        }
+
+        // One invocation per texel, and the value it writes is a function of its coordinate - so
+        // a layer read from the wrong slice does not merely differ, it says which slice it came
+        // from.
+        const char* k1DArrayStoreSource = R"(#version 430 core
+
+layout (local_size_x = 1, local_size_y = 1, local_size_z = 1) in;
+
+layout (r32ui) writeonly uniform uimage1DArray uni_image;
+
+void main()
+{
+    uint x = gl_GlobalInvocationID.x;
+    uint layer = gl_GlobalInvocationID.z;
+    imageStore(uni_image, ivec2(int(x), int(layer)), uvec4(1000u + layer * 100u + x, 0u, 0u, 0u));
+}
+)";
+
+        const char* kCubeArrayStoreSource = R"(#version 430 core
+
+layout (local_size_x = 1, local_size_y = 1, local_size_z = 1) in;
+
+layout (r32ui) writeonly uniform uimageCubeArray uni_image;
+
+void main()
+{
+    uint x = gl_GlobalInvocationID.x;
+    uint y = gl_GlobalInvocationID.y;
+    uint layerFace = gl_GlobalInvocationID.z;
+    imageStore(uni_image, ivec3(int(x), int(y), int(layerFace)),
+               uvec4(1000u + layerFace * 100u + y * 10u + x, 0u, 0u, 0u));
+}
+)";
+
+        class LayeredTextureReadbackScenario : public ScenarioTest {
+        protected:
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (GLuint p : m_programs) glDeleteProgram(p);
+                for (GLuint t : m_textures) glDeleteTextures(1, &t);
+                m_programs.clear();
+                m_textures.clear();
+                GLint maxImageUnits = 0;
+                glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+                for (GLint unit = 0; unit < maxImageUnits; ++unit) {
+                    glBindImageTexture(static_cast<GLuint>(unit), 0, 0, GL_FALSE, 0, GL_READ_ONLY, GL_R32UI);
+                }
+                while (glGetError() != GL_NO_ERROR) {
+                }
+            }
+
+            bool ImagesAreUsable() const {
+                GLint maxImageUnits = 0;
+                glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+                GLint maxComputeImageUniforms = 0;
+                glGetIntegerv(GL_MAX_COMPUTE_IMAGE_UNIFORMS, &maxComputeImageUniforms);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxImageUnits > kImageUnit && maxComputeImageUniforms >= 1;
+            }
+
+            GLuint MakeComputeProgram(const char* source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = GL_FALSE;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the compute shader did not compile: " << log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                m_programs.push_back(program);
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the compute program did not link: " << log;
+                    return 0;
+                }
+                return program;
+            }
+
+            GLuint TrackTexture() {
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                m_textures.push_back(texture);
+                return texture;
+            }
+
+            // layered = GL_TRUE, i.e. the whole level: that is what makes every layer reachable
+            // from one dispatch, and it is what glBindImageTextures is specified to pass.
+            bool DispatchStore(GLuint program, GLuint texture, GLsizei groupsX, GLsizei groupsY, GLsizei groupsZ) {
+                glBindImageTexture(static_cast<GLuint>(kImageUnit), texture, 0, GL_TRUE, 0, GL_WRITE_ONLY, GL_R32UI);
+                if (const GLenum error = FirstGLError()) {
+                    ADD_FAILURE() << "glBindImageTexture errored with " << GLErrorName(error);
+                    return false;
+                }
+                glUseProgram(program);
+                const GLint location = glGetUniformLocation(program, "uni_image");
+                if (location < 0) {
+                    ADD_FAILURE() << "the image uniform was not reflected";
+                    return false;
+                }
+                glUniform1i(location, kImageUnit);
+                if (const GLenum error = FirstGLError()) {
+                    ADD_FAILURE() << "assigning the image unit errored with " << GLErrorName(error);
+                    return false;
+                }
+                glDispatchCompute(groupsX, groupsY, groupsZ);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                glUseProgram(0);
+                if (const GLenum error = FirstGLError()) {
+                    ADD_FAILURE() << "the dispatch errored with " << GLErrorName(error);
+                    return false;
+                }
+                return true;
+            }
+
+            std::vector<GLuint> m_programs;
+            std::vector<GLuint> m_textures;
+        };
+
+        // The 1D-array half. A layer past the first is the whole test: layer 0 lines up with the
+        // ES image's only row whichever way the axes are read, so a readback that never swapped
+        // them still got it right and only the deeper layers came back wrong.
+        TEST_F(LayeredTextureReadbackScenario, GetTexImageReturnsEveryLayerOfA1DArray) {
+            if (!Ready()) return;
+            if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";
+
+            const GLuint program = MakeComputeProgram(k1DArrayStoreSource);
+            if (program == 0) return;
+
+            const GLuint texture = TrackTexture();
+            glBindTexture(GL_TEXTURE_1D_ARRAY, texture);
+            glTexParameteri(GL_TEXTURE_1D_ARRAY, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+            glTexParameteri(GL_TEXTURE_1D_ARRAY, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+            const std::vector<GLuint> seed(static_cast<std::size_t>(kExtent) * kArrayLayers, kSeed);
+            glTexImage2D(GL_TEXTURE_1D_ARRAY, 0, GL_R32UI, kExtent, kArrayLayers, 0, GL_RED_INTEGER, GL_UNSIGNED_INT,
+                         seed.data());
+            ASSERT_EQ(FirstGLError(), 0u) << "creating the R32UI 1D-array texture errored";
+
+            if (!DispatchStore(program, texture, kExtent, 1, kArrayLayers)) return;
+
+            std::vector<GLuint> texels(seed.size(), 0u);
+            glBindTexture(GL_TEXTURE_1D_ARRAY, texture);
+            glGetTexImage(GL_TEXTURE_1D_ARRAY, 0, GL_RED_INTEGER, GL_UNSIGNED_INT, texels.data());
+            ASSERT_EQ(FirstGLError(), 0u) << "reading the 1D-array level back errored";
+
+            // GL hands a 1D array back as a plain two-dimensional image whose ROWS are the
+            // layers, so the destination index is layer * width + x.
+            for (int layer = 0; layer < kArrayLayers; ++layer) {
+                for (int x = 0; x < kExtent; ++x) {
+                    const std::size_t index = static_cast<std::size_t>(layer) * kExtent + x;
+                    EXPECT_EQ(texels[index], Expected1DArrayTexel(x, layer))
+                        << "layer " << layer << " texel " << x << " read back "
+                        << (texels[index] == kSeed ? "the seed (the store never reached it, or the readback came "
+                                                     "from the stale CPU shadow)"
+                                                   : "an unexpected value");
+                }
+            }
+        }
+
+        // The cube-map-array half. glFramebufferTexture2D has no token for the target, so the
+        // scratch FBO used to stay incomplete and every read - including layer 0 - was answered
+        // from the CPU shadow; the seed is what makes that visible rather than merely wrong.
+        TEST_F(LayeredTextureReadbackScenario, GetTexImageReturnsEveryLayerFaceOfACubeMapArray) {
+            if (!Ready()) return;
+            if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";
+
+            const GLuint program = MakeComputeProgram(kCubeArrayStoreSource);
+            if (program == 0) return;
+
+            const GLuint texture = TrackTexture();
+            glBindTexture(GL_TEXTURE_CUBE_MAP_ARRAY, texture);
+            glTexParameteri(GL_TEXTURE_CUBE_MAP_ARRAY, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+            glTexParameteri(GL_TEXTURE_CUBE_MAP_ARRAY, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+            const std::vector<GLuint> seed(static_cast<std::size_t>(kExtent) * kExtent * kCubeLayerFaces, kSeed);
+            glTexImage3D(GL_TEXTURE_CUBE_MAP_ARRAY, 0, GL_R32UI, kExtent, kExtent, kCubeLayerFaces, 0, GL_RED_INTEGER,
+                         GL_UNSIGNED_INT, seed.data());
+            ASSERT_EQ(FirstGLError(), 0u) << "creating the R32UI cube-map-array texture errored";
+
+            if (!DispatchStore(program, texture, kExtent, kExtent, kCubeLayerFaces)) return;
+
+            std::vector<GLuint> texels(seed.size(), 0u);
+            glBindTexture(GL_TEXTURE_CUBE_MAP_ARRAY, texture);
+            glGetTexImage(GL_TEXTURE_CUBE_MAP_ARRAY, 0, GL_RED_INTEGER, GL_UNSIGNED_INT, texels.data());
+            ASSERT_EQ(FirstGLError(), 0u) << "reading the cube-map-array level back errored";
+
+            for (int layerFace = 0; layerFace < kCubeLayerFaces; ++layerFace) {
+                for (int y = 0; y < kExtent; ++y) {
+                    for (int x = 0; x < kExtent; ++x) {
+                        const std::size_t index =
+                            (static_cast<std::size_t>(layerFace) * kExtent + y) * kExtent + x;
+                        EXPECT_EQ(texels[index], ExpectedCubeArrayTexel(x, y, layerFace))
+                            << "layer-face " << layerFace << " texel (" << x << ", " << y << ") read back "
+                            << (texels[index] == kSeed ? "the seed (the store never reached it, or the readback "
+                                                         "came from the stale CPU shadow)"
+                                                       : "an unexpected value");
+                    }
+                }
+            }
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PackedWordReadbackScenario.cpp

@@ -0,0 +1,220 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PackedWordReadbackScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// glGetTexImage of a 32-bit packed format read with its OWN client type owes the application the
+// words the image HOLDS, and KHR-GL43.copy_image compares exactly those words. Two routes used to
+// answer, and both are wrong for a level glCopyImageSubData wrote:
+//
+//   * the colour-attachment route reads GL_RGBA/GL_FLOAT and re-encodes, which canonicalizes an
+//     RGB9_E5 shared exponent and collapses an R11F_G11F_B10F NaN payload to 1;
+//   * the CPU shadow only holds what was UPLOADED, and the mirror that replays a copy into it
+//     declines - silently - for a renderbuffer source, which has no shadow to mirror from.
+//
+// Both are pinned here with words the CTS itself uses, because both failures are invisible to a
+// value comparison: every assertion below is on BITS that decode to the very value the wrong
+// answer also decodes to.
+//
+// The fix is a raw-word route (DirectGLES::ReadPackedLevelWordsViaScratch: copy the level into a
+// scratch GL_R32UI image, read that back as unsigned integers), and DirectVulkan reaches the same
+// place through PackReadbackToClientOrPbo's raw-word branch over the staging bytes - so these
+// scenarios are backend-agnostic on purpose.
+
+#include <cstddef>
+#include <ios>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr GLsizei kExtent = 4;
+
+        // The non-canonical RGB9_E5 word KHR-GL43.copy_image writes: R=0, G=0, B mantissa 63,
+        // shared exponent 31, i.e. the value 8064, which the spec's own encoder would emit as
+        // 0xe7e00000 instead. Anything that decodes and re-encodes hands back the canonical word.
+        //
+        // Reinterpreted in the destination of an RGB9_E5 -> R11F_G11F_B10F copy it is R=0,
+        // G=1920, B=995 - and B's 5-bit exponent is all ones with a nonzero mantissa, i.e. a NaN
+        // whose payload 3 does not survive a float32 round trip (it comes back as the canonical
+        // payload 1, B=993, word 0xf87c0000). The two defects therefore land on the same word.
+        constexpr GLuint kRgb9E5Word = 0xf8fc0000u;
+
+        // The R11F_G11F_B10F word the same test pairs with it: R=0, G=0, B = exponent 12,
+        // mantissa 0 = 0.125. As an RGB9_E5 word it is all-zero channels with a shared exponent of
+        // 12, which the canonical encoder would write as 0x00000000 - so a decode/re-encode of THIS
+        // one loses every bit that distinguishes it.
+        constexpr GLuint kR11fG11fB10fWord = 0x60000000u;
+
+        class PackedWordReadbackScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                DeleteObjects();
+                DrainErrors();
+                ScenarioTest::TearDown();
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            void DeleteObjects() {
+                if (m_src != 0) glDeleteTextures(1, &m_src);
+                if (m_dst != 0) glDeleteTextures(1, &m_dst);
+                if (m_rbo != 0) glDeleteRenderbuffers(1, &m_rbo);
+                m_src = 0;
+                m_dst = 0;
+                m_rbo = 0;
+            }
+
+            // A complete single-level texture whose every texel holds `word`, uploaded through the
+            // packed client type so the stored bits are the client's bits and nothing has had a
+            // chance to re-encode them.
+            GLuint MakePackedTexture(GLenum internalFormat, GLenum type, GLuint word) {
+                const std::vector<GLuint> words(static_cast<std::size_t>(kExtent) * kExtent, word);
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                glBindTexture(GL_TEXTURE_2D, texture);
+                glTexImage2D(GL_TEXTURE_2D, 0, static_cast<GLint>(internalFormat), kExtent, kExtent, 0, GL_RGB, type,
+                             words.data());
+                // What Utils::makeTextureComplete does in the conformance cases, and what
+                // glCopyImageSubData requires of both endpoints.
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_BASE_LEVEL, 0);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, 0);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glBindTexture(GL_TEXTURE_2D, 0);
+                return texture;
+            }
+
+            // Every texel of level 0, as raw client words.
+            std::vector<GLuint> ReadPackedWords(GLuint texture, GLenum type) {
+                std::vector<GLuint> words(static_cast<std::size_t>(kExtent) * kExtent, 0xDEADBEEFu);
+                glBindTexture(GL_TEXTURE_2D, texture);
+                glGetTexImage(GL_TEXTURE_2D, 0, GL_RGB, type, words.data());
+                glBindTexture(GL_TEXTURE_2D, 0);
+                return words;
+            }
+
+            // The copy under test. Returns the error it raised so a driver that cannot perform the
+            // move at all can skip rather than fail: the point of these cases is which BITS come
+            // back, and there are none to compare if the copy never happened.
+            GLenum CopyWholeImage(GLuint srcName, GLenum srcTarget, GLuint dstName, GLenum dstTarget) {
+                DrainErrors();
+                glCopyImageSubData(srcName, srcTarget, 0, 0, 0, 0, dstName, dstTarget, 0, 0, 0, 0, kExtent, kExtent,
+                                   1);
+                const GLenum error = glGetError();
+                EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << "the copy recorded more than one error";
+                return error;
+            }
+
+            static void ExpectEveryTexel(const std::vector<GLuint>& words, GLuint expected, const char* what) {
+                for (std::size_t i = 0; i < words.size(); ++i) {
+                    ASSERT_EQ(words[i], expected)
+                        << what << ": texel " << i << " read 0x" << std::hex << words[i] << ", expected 0x"
+                        << expected;
+                }
+            }
+
+            GLuint m_src = 0;
+            GLuint m_dst = 0;
+            GLuint m_rbo = 0;
+        };
+
+        // The control that has to hold before either regression means anything: a packed word
+        // uploaded and read straight back must be the SAME word, not merely the same colour.
+        TEST_F(PackedWordReadbackScenario, AnUploadedPackedWordReadsBackVerbatim) {
+            if (!Ready()) GTEST_SKIP();
+
+            m_src = MakePackedTexture(GL_RGB9_E5, GL_UNSIGNED_INT_5_9_9_9_REV, kRgb9E5Word);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << "RGB9_E5 upload";
+            ExpectEveryTexel(ReadPackedWords(m_src, GL_UNSIGNED_INT_5_9_9_9_REV), kRgb9E5Word, "RGB9_E5 round trip");
+
+            m_dst = MakePackedTexture(GL_R11F_G11F_B10F, GL_UNSIGNED_INT_10F_11F_11F_REV, kR11fG11fB10fWord);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << "R11F_G11F_B10F upload";
+            ExpectEveryTexel(ReadPackedWords(m_dst, GL_UNSIGNED_INT_10F_11F_11F_REV), kR11fG11fB10fWord,
+                             "R11F_G11F_B10F round trip");
+        }
+
+        // KHR-GL43.copy_image.functional rgb9_e5 -> r11f_g11f_b10f, all nine target combinations of
+        // which failed on both GPUs. glCopyImageSubData is a raw block move, so the destination
+        // physically holds the source's word - but the readback decoded it to float and re-encoded,
+        // and the destination's blue field is a NaN whose payload float32 does not carry. Every
+        // texel came back 0xf87c0000 (payload 1) instead of 0xf8fc0000 (payload 3): the same
+        // "colour", two bits apart.
+        TEST_F(PackedWordReadbackScenario, ACopiedRgb9E5WordSurvivesInAnR11fG11fB10fDestination) {
+            if (!Ready()) GTEST_SKIP();
+
+            m_src = MakePackedTexture(GL_RGB9_E5, GL_UNSIGNED_INT_5_9_9_9_REV, kRgb9E5Word);
+            m_dst = MakePackedTexture(GL_R11F_G11F_B10F, GL_UNSIGNED_INT_10F_11F_11F_REV, 0u);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << "texture setup";
+
+            const GLenum copyError = CopyWholeImage(m_src, GL_TEXTURE_2D, m_dst, GL_TEXTURE_2D);
+            if (copyError != static_cast<GLenum>(GL_NO_ERROR)) {
+                GTEST_SKIP() << "this driver declined the RGB9_E5 -> R11F_G11F_B10F copy (" << copyError << ")";
+            }
+
+            ExpectEveryTexel(ReadPackedWords(m_dst, GL_UNSIGNED_INT_10F_11F_11F_REV), kRgb9E5Word,
+                             "copied word in the R11F_G11F_B10F destination");
+            // ...and the source is still the source. This is verify()'s FIRST check in the
+            // conformance case, and the half that a canonicalizing readback fails on its own.
+            ExpectEveryTexel(ReadPackedWords(m_src, GL_UNSIGNED_INT_5_9_9_9_REV), kRgb9E5Word,
+                             "the RGB9_E5 source after the copy");
+        }
+
+        // KHR-GL43.copy_image.functional *->rgb9_e5 with a GL_RENDERBUFFER source: exactly the three
+        // renderbuffer combinations of each such family failed, and no texture one did. The
+        // destination's CPU shadow is what the readback answered from, the mirror that replays a
+        // copy into it declines when an endpoint is a renderbuffer (there is no shadow to mirror
+        // FROM), and the decline is silent - so glGetTexImage handed back the destination's
+        // pre-copy contents. The word chosen here makes that unmissable: it decodes to the same
+        // all-zero channels the canonical encoder would write as 0x00000000.
+        TEST_F(PackedWordReadbackScenario, ACopyThroughARenderbufferReachesAnRgb9E5Destination) {
+            if (!Ready()) GTEST_SKIP();
+
+            m_src = MakePackedTexture(GL_R11F_G11F_B10F, GL_UNSIGNED_INT_10F_11F_11F_REV, kR11fG11fB10fWord);
+            m_dst = MakePackedTexture(GL_RGB9_E5, GL_UNSIGNED_INT_5_9_9_9_REV, 0xFFFFFFFFu);
+            glGenRenderbuffers(1, &m_rbo);
+            glBindRenderbuffer(GL_RENDERBUFFER, m_rbo);
+            glRenderbufferStorage(GL_RENDERBUFFER, GL_R11F_G11F_B10F, kExtent, kExtent);
+            glBindRenderbuffer(GL_RENDERBUFFER, 0);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << "renderbuffer setup";
+
+            // The conformance case's own shape: texture -> renderbuffer -> texture.
+            const GLenum toRenderbuffer = CopyWholeImage(m_src, GL_TEXTURE_2D, m_rbo, GL_RENDERBUFFER);
+            if (toRenderbuffer != static_cast<GLenum>(GL_NO_ERROR)) {
+                GTEST_SKIP() << "this driver declined a renderbuffer copy destination (" << toRenderbuffer << ")";
+            }
+            const GLenum fromRenderbuffer = CopyWholeImage(m_rbo, GL_RENDERBUFFER, m_dst, GL_TEXTURE_2D);
+            if (fromRenderbuffer != static_cast<GLenum>(GL_NO_ERROR)) {
+                GTEST_SKIP() << "this driver declined a renderbuffer copy source (" << fromRenderbuffer << ")";
+            }
+
+            ExpectEveryTexel(ReadPackedWords(m_dst, GL_UNSIGNED_INT_5_9_9_9_REV), kR11fG11fB10fWord,
+                             "copied word in the RGB9_E5 destination");
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/SnormAttachmentScenario.cpp

@@ -0,0 +1,245 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/SnormAttachmentScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - SIGNED-NORMALIZED COLOUR ATTACHMENTS, on a live driver.
+//
+// The bug: a GLES driver without GL_EXT_render_snorm treats every signed-normalized format as
+// texture-only. DirectGLES had a colour-renderable substitute for exactly one of the eight
+// (GL_RGB16_SNORM, through the three-channel widening), so an R8_SNORM or R16_SNORM attachment got
+// no storage the driver would render into: the ES framebuffer was incomplete, the draw landed
+// nowhere, and glGetTexImage fell through to the CPU shadow - all zeroes for a texture created with
+// no data. KHR-GL4x.texture_swizzle renders into a SINGLE-CHANNEL SNORM output for every one of its
+// SNORM source formats, which is why all 46 of its GL43 SNORM cases failed on Mali.
+//
+// THE OTHER HALF, and the reason this scenario asserts VALUES rather than only completeness: the
+// substitute has to be exact. A half float's 11-bit mantissa cannot represent a 16-bit SNORM
+// channel - 23451/32767 quantizes about six SNORM steps away, against a conformance window of one -
+// so the 16-bit formats must land on a 32-bit float even though the 8-bit ones are fine in a half.
+// Trading 46 visible failures for silent precision loss in Iris' SNORM normal buffers would be the
+// worse outcome, so the round trip below is pinned tightly enough to fail on a half-float substitute
+// (tolerance two SNORM steps, half-float error six).
+//
+// WHAT THIS GATE CAN AND CANNOT SEE. Both CI drivers (Mesa llvmpipe) and Adreno expose
+// GL_EXT_render_snorm, so they take the NATIVE path here and the substitution stays dead. That is
+// precisely why the assertions are written as invariants of the format rather than of the fallback:
+// "a signed-normalized colour attachment is complete and round-trips its channel values" has to
+// hold whichever path answers it, so the scenario fails if anyone ever routes these formats to a
+// lossy storage on a driver where it IS live. The substitution itself can only be observed on a
+// device without EXT_render_snorm (Mali Immortalis-G925).
+//
+// DirectGLES only, like the three-channel scenario next door: DirectVulkan resolves SNORM formats
+// on its own terms and asserting Espryt's answers there would pin a coincidence.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr const char* kVS = R"(#version 330 core
+in vec2 aPos;
+void main() {
+    gl_Position = vec4(aPos, 0.0, 1.0);
+}
+)";
+
+        // A uniform rather than a literal so nothing can constant-fold the value into a different
+        // precision than the one the attachment stores.
+        constexpr const char* kFS = R"(#version 330 core
+out vec4 oColor;
+uniform float uValue;
+void main() { oColor = vec4(uValue, 0.0, 0.0, 1.0); }
+)";
+
+        constexpr int kSize = 8;
+
+        // The two channel values the round trip is pinned on. Both are positive on purpose:
+        // glReadPixels applies GL_CLAMP_READ_COLOR (GL_FIXED_ONLY by default) to a fixed-point
+        // colour buffer, so the negative half of a SNORM attachment reads back as 0 and would
+        // measure the clamp instead of the storage.
+        constexpr int kSnorm8Value = 99;
+        constexpr int kSnorm16Value = 23451;
+
+        class SnormAttachmentScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                if (Gl().BackendName() != "DirectGLES") {
+                    GTEST_SKIP() << "the signed-normalized substitution is a DirectGLES fallback; backend is "
+                                 << Gl().BackendName();
+                }
+            }
+
+            // A single-level 2D texture in `internalFormat`, or 0 when the driver rejects the
+            // storage outright (which is a different failure from rejecting the ATTACHMENT).
+            static GLuint MakeTexture(GLenum internalFormat) {
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                glBindTexture(GL_TEXTURE_2D, texture);
+                glTexStorage2D(GL_TEXTURE_2D, 1, internalFormat, kSize, kSize);
+                if (glGetError() != GL_NO_ERROR) {
+                    glDeleteTextures(1, &texture);
+                    return 0;
+                }
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glBindTexture(GL_TEXTURE_2D, 0);
+                return texture;
+            }
+
+            static GLenum SingleAttachmentStatus(GLenum internalFormat) {
+                const GLuint texture = MakeTexture(internalFormat);
+                if (texture == 0) return GL_NONE;
+                GLuint fbo = 0;
+                glGenFramebuffers(1, &fbo);
+                glBindFramebuffer(GL_DRAW_FRAMEBUFFER, fbo);
+                glFramebufferTexture2D(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+                const GLenum status = glCheckFramebufferStatus(GL_DRAW_FRAMEBUFFER);
+                glBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+                glDeleteFramebuffers(1, &fbo);
+                glDeleteTextures(1, &texture);
+                return status;
+            }
+
+            // Renders `value` into the red channel of a fresh `internalFormat` attachment and hands
+            // back what glReadPixels sees. Returns false when the framebuffer never came up, which
+            // is the failure mode this scenario exists for - a draw into an incomplete framebuffer
+            // is dropped by the driver and leaves the caller reading the cleared texture.
+            bool RenderAndReadRed(GLenum internalFormat, float value, float* outRed) {
+                std::string error;
+                const GLuint program = CompileProgram(kVS, kFS, &error);
+                EXPECT_NE(program, 0u) << error;
+                if (program == 0) return false;
+                const GLint valueLocation = glGetUniformLocation(program, "uValue");
+                EXPECT_GE(valueLocation, 0);
+
+                const GLuint texture = MakeTexture(internalFormat);
+                EXPECT_NE(texture, 0u) << "the driver refused the texture storage itself";
+                if (texture == 0) {
+                    glDeleteProgram(program);
+                    return false;
+                }
+
+                GLuint fbo = 0;
+                glGenFramebuffers(1, &fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+                glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+                const bool complete = glCheckFramebufferStatus(GL_FRAMEBUFFER) == GL_FRAMEBUFFER_COMPLETE;
+
+                if (complete) {
+                    const float quad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+                    GLuint vao = 0;
+                    GLuint vbo = 0;
+                    glGenVertexArrays(1, &vao);
+                    glBindVertexArray(vao);
+                    glGenBuffers(1, &vbo);
+                    glBindBuffer(GL_ARRAY_BUFFER, vbo);
+                    glBufferData(GL_ARRAY_BUFFER, sizeof(quad), quad, GL_STATIC_DRAW);
+                    glEnableVertexAttribArray(0);
+                    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+                    glUseProgram(program);
+                    glUniform1f(valueLocation, value);
+                    glViewport(0, 0, kSize, kSize);
+                    // Cleared to zero so a dropped draw cannot be mistaken for a correct one.
+                    glClearColor(0.0f, 0.0f, 0.0f, 0.0f);
+                    glClear(GL_COLOR_BUFFER_BIT);
+                    glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+
+                    std::vector<float> pixels(static_cast<std::size_t>(kSize) * kSize * 4, -1.0f);
+                    glReadBuffer(GL_COLOR_ATTACHMENT0);
+                    glReadPixels(0, 0, kSize, kSize, GL_RGBA, GL_FLOAT, pixels.data());
+                    if (outRed) *outRed = pixels[0];
+
+                    glDeleteBuffers(1, &vbo);
+                    glDeleteVertexArrays(1, &vao);
+                }
+
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                glDeleteFramebuffers(1, &fbo);
+                glDeleteTextures(1, &texture);
+                glDeleteProgram(program);
+                return complete;
+            }
+        };
+
+        // THE regression gate for the frontend's answer. Every one of these used to be
+        // GL_FRAMEBUFFER_UNSUPPORTED on a driver without EXT_render_snorm, and nothing in the CTS
+        // (or in Iris) checks the status before drawing, so the failure was silent all the way to a
+        // readback of zeroes.
+        TEST_F(SnormAttachmentScenario, SignedNormalizedColorAttachmentsReportComplete) {
+            if (!Ready() || IsSkipped()) return;
+
+            // GL_R8 is the control: colour-renderable in ES core, so it must pass with or without
+            // any substitution. If it ever fails, nothing below means anything.
+            EXPECT_EQ(SingleAttachmentStatus(GL_R8), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE))
+                << "GL_R8 is ES-core colour-renderable";
+
+            // The single-channel pair KHR-GL4x.texture_swizzle renders into for every SNORM source
+            // format - the whole 46-case failure.
+            EXPECT_EQ(SingleAttachmentStatus(GL_R8_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+            EXPECT_EQ(SingleAttachmentStatus(GL_R16_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+            // ...and the two- and four-channel siblings, which are what a shaderpack actually
+            // declares (Iris colortex buffers in RGBA16_SNORM).
+            EXPECT_EQ(SingleAttachmentStatus(GL_RG8_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+            EXPECT_EQ(SingleAttachmentStatus(GL_RG16_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+            EXPECT_EQ(SingleAttachmentStatus(GL_RGBA8_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+            EXPECT_EQ(SingleAttachmentStatus(GL_RGBA16_SNORM), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+            EXPECT_EQ(FirstGLError(), 0u) << GLErrorName(FirstGLError());
+        }
+
+        // The other half: whatever storage answers for the attachment has to hold the channel value
+        // to the format's own precision. This is the assertion that fails if the 16-bit formats are
+        // ever routed to a half float - the substitute an implementer naturally reaches for, because
+        // it is what the 8-bit ones correctly use.
+        TEST_F(SnormAttachmentScenario, SignedNormalizedAttachmentsRoundTripTheirChannelValues) {
+            if (!Ready() || IsSkipped()) return;
+
+            const float snorm8Expected = static_cast<float>(kSnorm8Value) / 127.0f;
+            float red8 = -1.0f;
+            ASSERT_TRUE(RenderAndReadRed(GL_R8_SNORM, snorm8Expected, &red8))
+                << "an R8_SNORM colour attachment must be complete before any value can be asserted";
+            // Two 8-bit SNORM steps. A half float is exact here (worst case 0.03 of a step), so this
+            // only has to catch a storage that quantizes harder than the format itself.
+            EXPECT_NEAR(red8, snorm8Expected, 2.0f / 127.0f)
+                << "R8_SNORM attachment lost its channel value";
+            EXPECT_GT(red8, 0.5f) << "the draw never landed - this is the cleared texture, not the rendered one";
+
+            const float snorm16Expected = static_cast<float>(kSnorm16Value) / 32767.0f;
+            float red16 = -1.0f;
+            ASSERT_TRUE(RenderAndReadRed(GL_R16_SNORM, snorm16Expected, &red16))
+                << "an R16_SNORM colour attachment must be complete before any value can be asserted";
+            // Two 16-bit SNORM steps (6.1e-5). A half float would land 1.9e-4 away - three times
+            // this window - which is exactly the failure this bound exists to catch.
+            EXPECT_NEAR(red16, snorm16Expected, 2.0f / 32767.0f)
+                << "R16_SNORM attachment was stored in something that cannot hold 16 signed bits";
+            EXPECT_GT(red16, 0.5f) << "the draw never landed - this is the cleared texture, not the rendered one";
+
+            float red16x4 = -1.0f;
+            ASSERT_TRUE(RenderAndReadRed(GL_RGBA16_SNORM, snorm16Expected, &red16x4))
+                << "an RGBA16_SNORM colour attachment must be complete before any value can be asserted";
+            EXPECT_NEAR(red16x4, snorm16Expected, 2.0f / 32767.0f)
+                << "RGBA16_SNORM attachment was stored in something that cannot hold 16 signed bits";
+
+            EXPECT_EQ(FirstGLError(), 0u) << GLErrorName(FirstGLError());
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/SsboArrayDynamicIndexScenario.cpp

@@ -0,0 +1,189 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/SsboArrayDynamicIndexScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - A NON-CONSTANT INDEX INTO AN ARRAY OF SHADER STORAGE BLOCKS.
+//
+// GL 4.3 allows any dynamically-uniform expression there; GLSL ES keeps the ES 3.1 rule that the
+// index must be a constant integral expression, and the Qualcomm compiler enforces it:
+//
+//     '[' : indexing into an SSBO array using a non-constant expression is not permitted
+//
+// The stage then never compiles, the backend program links nothing, and every dispatch is a
+// silent no-op - while glGetProgramiv(GL_LINK_STATUS) keeps reporting the successful link the
+// frontend already published. That is why the conformance failures
+// (KHR-GL43.shader_storage_buffer_object.basic-stdLayout-case1/case4,
+// advanced-indirectAddressing-case2, compute_shader.resources-max, 7 cases in all) read back as
+// "the buffer was never written" rather than as an error, and why this scenario asserts on
+// contents rather than on link status.
+//
+// Both index shapes the legalization has to cover are exercised in one dispatch: a loop induction
+// variable (which folds when the loop unrolls) and a `uniform int` (which nothing can fold, so the
+// switch/select lowering is what carries it), for a read AND for a write.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // Bindings 0..3 are the block array, 4 is the output.
+        constexpr const char* kComputeSource = R"(#version 430 core
+layout(local_size_x = 1) in;
+layout(std430, binding = 0) buffer Slot {
+    uint value;
+} g_slots[4];
+layout(std430, binding = 4) buffer Output {
+    uint g_result[];
+};
+uniform int g_index;
+void main() {
+    // Loop-derived index: foldable by unrolling.
+    for (int i = 0; i < 4; ++i) {
+        g_result[i] = g_slots[i].value;
+    }
+    // Uniform-derived index: not foldable, read and write both.
+    g_result[4] = g_slots[g_index].value;
+    g_slots[g_index].value = 99u;
+}
+)";
+
+        constexpr int kSlotCount = 4;
+        constexpr int kResultCount = 5;
+
+        class SsboArrayDynamicIndexScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                GLint blocks = 0;
+                glGetIntegerv(GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS, &blocks);
+                if (blocks < kSlotCount + 1) {
+                    GTEST_SKIP() << "GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS is " << blocks << "; this needs "
+                                 << kSlotCount + 1;
+                }
+                m_program = CompileComputeProgram(kComputeSource);
+                ASSERT_NE(m_program, 0u) << m_buildLog;
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                if (!m_buffers.empty()) glDeleteBuffers(static_cast<GLsizei>(m_buffers.size()), m_buffers.data());
+                if (m_program != 0) glDeleteProgram(m_program);
+            }
+
+            unsigned int CompileComputeProgram(const char* source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            GLuint MakeStorageBuffer(const std::vector<unsigned int>& contents) {
+                GLuint buffer = 0;
+                glGenBuffers(1, &buffer);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+                glBufferData(GL_SHADER_STORAGE_BUFFER,
+                             static_cast<GLsizeiptr>(contents.size() * sizeof(unsigned int)), contents.data(),
+                             GL_DYNAMIC_COPY);
+                m_buffers.push_back(buffer);
+                return buffer;
+            }
+
+            static std::vector<unsigned int> ReadBuffer(GLuint buffer, int count) {
+                std::vector<unsigned int> values(static_cast<std::size_t>(count), 0xDEADBEEFu);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, buffer);
+                glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(values.size() * sizeof(unsigned int)), values.data());
+                return values;
+            }
+
+            unsigned int m_program = 0;
+            std::string m_buildLog;
+            std::vector<GLuint> m_buffers;
+        };
+
+    } // namespace
+
+    TEST_F(SsboArrayDynamicIndexScenario, ReadsAndWritesTheBlockTheIndexNames) {
+        if (!Ready() || IsSkipped()) return;
+
+        GLuint slots[kSlotCount] = {};
+        for (int i = 0; i < kSlotCount; ++i) {
+            slots[i] = MakeStorageBuffer({static_cast<unsigned int>(10 + i)});
+            glBindBufferBase(GL_SHADER_STORAGE_BUFFER, static_cast<GLuint>(i), slots[i]);
+        }
+        const GLuint output = MakeStorageBuffer(std::vector<unsigned int>(kResultCount, 0u));
+        glBindBufferBase(GL_SHADER_STORAGE_BUFFER, kSlotCount, output);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        glUseProgram(m_program);
+        const GLint indexLocation = glGetUniformLocation(m_program, "g_index");
+        ASSERT_NE(indexLocation, -1);
+        glUniform1i(indexLocation, 2);
+        glDispatchCompute(1, 1, 1);
+        glMemoryBarrier(GL_BUFFER_UPDATE_BARRIER_BIT);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        const std::vector<unsigned int> result = ReadBuffer(output, kResultCount);
+        for (int i = 0; i < kSlotCount; ++i) {
+            EXPECT_EQ(result[static_cast<std::size_t>(i)], static_cast<unsigned int>(10 + i))
+                << "g_slots[" << i << "] read through the loop index came back as "
+                << result[static_cast<std::size_t>(i)]
+                << "; 0 means the stage never compiled and the dispatch was a silent no-op";
+        }
+        EXPECT_EQ(result[4], 12u) << "g_slots[g_index] with g_index = 2 read back as " << result[4];
+
+        const std::vector<unsigned int> written = ReadBuffer(slots[2], 1);
+        EXPECT_EQ(written[0], 99u) << "the uniform-indexed WRITE landed as " << written[0]
+                                   << " instead of 99 in g_slots[2]";
+        // The write must have gone to element 2 and nowhere else.
+        for (int i = 0; i < kSlotCount; ++i) {
+            if (i == 2) continue;
+            const std::vector<unsigned int> untouched = ReadBuffer(slots[i], 1);
+            EXPECT_EQ(untouched[0], static_cast<unsigned int>(10 + i))
+                << "g_slots[" << i << "] was overwritten by a write that named element 2";
+        }
+
+        for (int i = 0; i <= kSlotCount; ++i) {
+            glBindBufferBase(GL_SHADER_STORAGE_BUFFER, static_cast<GLuint>(i), 0);
+        }
+    }
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/StorageBufferRegrowScenario.cpp

@@ -0,0 +1,156 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/StorageBufferRegrowScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - glBufferData GROWS A BUFFER THAT IS ALREADY BOUND AT AN INDEXED POINT.
+//
+// GL says the indexed binding follows the buffer object, so after the store is re-specified the
+// shader sees the NEW extent. DirectGLES shadows the indexed bindings so a redundant
+// glBindBufferBase can be skipped, and nothing used to invalidate that shadow when the store was
+// re-specified underneath it - so on a driver that resolves a whole-buffer indexed binding's
+// extent at BIND time (Adreno does; Mali does not) the shader kept seeing the OLD, smaller range.
+// Stores past it are dropped and loads return zero, which is exactly what
+// KHR-GL43.compute_shader.dispatch-indirect reported: the first iteration's 6 elements correct and
+// everything past byte 24 zero, after the same buffer was re-specified from 24 to 96 bytes.
+//
+// The assertion is deliberately on the WHOLE grown range, so a partial write names the byte the
+// stale extent stopped at.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr const char* kComputeSource = R"(#version 430 core
+layout(local_size_x = 1) in;
+layout(std430, binding = 0) buffer Output {
+    uint g_data[];
+};
+void main() {
+    g_data[gl_GlobalInvocationID.x] = gl_GlobalInvocationID.x + 1u;
+}
+)";
+
+        constexpr int kSmallElements = 6;  // 24 bytes - the first iteration's size
+        constexpr int kLargeElements = 24; // 96 bytes - what the second iteration grows to
+
+        class StorageBufferRegrowScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                m_program = CompileComputeProgram(kComputeSource);
+                ASSERT_NE(m_program, 0u) << m_buildLog;
+                glGenBuffers(1, &m_buffer);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                if (m_buffer != 0) glDeleteBuffers(1, &m_buffer);
+                if (m_program != 0) glDeleteProgram(m_program);
+            }
+
+            unsigned int CompileComputeProgram(const char* source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("compute program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            void RespecifyTo(int elements) {
+                const std::vector<unsigned int> zeros(static_cast<std::size_t>(elements), 0u);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_buffer);
+                glBufferData(GL_SHADER_STORAGE_BUFFER,
+                             static_cast<GLsizeiptr>(zeros.size() * sizeof(unsigned int)), zeros.data(),
+                             GL_DYNAMIC_COPY);
+            }
+
+            std::vector<unsigned int> DispatchAndRead(int elements) {
+                glUseProgram(m_program);
+                glDispatchCompute(static_cast<GLuint>(elements), 1, 1);
+                glMemoryBarrier(GL_BUFFER_UPDATE_BARRIER_BIT);
+                std::vector<unsigned int> values(static_cast<std::size_t>(elements), 0xDEADBEEFu);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_buffer);
+                glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(values.size() * sizeof(unsigned int)), values.data());
+                return values;
+            }
+
+            unsigned int m_program = 0;
+            GLuint m_buffer = 0;
+            std::string m_buildLog;
+        };
+
+    } // namespace
+
+    TEST_F(StorageBufferRegrowScenario, AGrownStoreIsVisibleThroughItsExistingIndexedBinding) {
+        if (!Ready() || IsSkipped()) return;
+
+        // Iteration one: 24 bytes, bound once, six groups.
+        RespecifyTo(kSmallElements);
+        glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, m_buffer);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        const std::vector<unsigned int> small = DispatchAndRead(kSmallElements);
+        ASSERT_EQ(FirstGLError(), 0u);
+        for (int i = 0; i < kSmallElements; ++i) {
+            ASSERT_EQ(small[static_cast<std::size_t>(i)], static_cast<unsigned int>(i + 1))
+                << "the 24-byte iteration itself did not write element " << i;
+        }
+
+        // Iteration two: the SAME buffer grows to 96 bytes with NO new glBindBufferBase, which is
+        // what the application is entitled to do and what the shadow used to swallow.
+        RespecifyTo(kLargeElements);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        const std::vector<unsigned int> large = DispatchAndRead(kLargeElements);
+        EXPECT_EQ(FirstGLError(), 0u);
+        for (int i = 0; i < kLargeElements; ++i) {
+            EXPECT_EQ(large[static_cast<std::size_t>(i)], static_cast<unsigned int>(i + 1))
+                << "element " << i << " (byte " << i * 4 << ") of the grown store came back as "
+                << large[static_cast<std::size_t>(i)]
+                << "; zero from element " << kSmallElements
+                << " on means the shader still saw the pre-growth extent";
+        }
+
+        glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, 0);
+    }
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/TessellationDrawModeScenario.cpp

@@ -0,0 +1,226 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/TessellationDrawModeScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - GL_PATCHES AND THE TESSELLATION PIPELINE ARE EACH OTHER'S ONLY PARTNER.
+//
+// GL 4.6 core 10.1 states the rule in both directions, and both are GL_INVALID_OPERATION:
+// a program with a tessellation evaluation shader may only be drawn with GL_PATCHES, and
+// GL_PATCHES may only be drawn with such a program. MobileGL's draw-mode validator
+// implemented the geometry-shader input-primitive rule and NOTHING for tessellation, which
+// is two of the four sites KHR-GL43.transform_feedback.api_errors_test checks (all four
+// share one copy-pasted message string, so the trace cannot say which one it stopped at).
+//
+// Needs a real context: the validator returns before either rule when no backend object is
+// active, so the GPU-free negative-API suite cannot reach them.
+
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        const char* const kVertexSource = R"(#version 420 core
+void main()
+{
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kTessControlSource = R"(#version 420 core
+layout(vertices = 1) out;
+void main()
+{
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+    gl_out[gl_InvocationID].gl_Position = gl_in[0].gl_Position;
+}
+)";
+
+        const char* const kTessEvalSource = R"(#version 420 core
+layout(triangles, equal_spacing, cw) in;
+void main()
+{
+    gl_Position = gl_in[0].gl_Position;
+}
+)";
+
+        const char* const kFragmentSource = R"(#version 420 core
+out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(0.0, 1.0, 0.0, 1.0);
+}
+)";
+
+        class TessellationDrawModeScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                if (!BackendHostsTessellation()) {
+                    GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " ("
+                                 << Gl().RendererString() << "); there is no patch draw to validate";
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vao = 0;
+            }
+
+            // The same real-backend probe IoBlockNameCollisionScenario uses: 0 on a DirectGLES
+            // driver without GL_EXT_tessellation_shader and on a DirectVulkan device without
+            // the tessellationShader feature.
+            static bool BackendHostsTessellation() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                DrainErrors();
+                return maxTessGenLevel >= 1;
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            GLuint BuildProgram(const std::vector<std::pair<GLenum, const char*>>& stages) {
+                std::vector<GLuint> shaders;
+                bool ok = true;
+                for (const auto& [stage, source] : stages) {
+                    const GLuint shader = glCreateShader(stage);
+                    glShaderSource(shader, 1, &source, nullptr);
+                    glCompileShader(shader);
+                    GLint compiled = 0;
+                    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                    shaders.push_back(shader);
+                    if (!compiled) {
+                        m_buildLog = InfoLog(shader, true);
+                        ok = false;
+                        break;
+                    }
+                }
+                if (!ok) {
+                    for (const GLuint shader : shaders) glDeleteShader(shader);
+                    return 0;
+                }
+
+                const GLuint program = glCreateProgram();
+                for (const GLuint shader : shaders) glAttachShader(program, shader);
+                glLinkProgram(program);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                for (const GLuint shader : shaders) glDeleteShader(shader);
+                if (!linked) {
+                    m_buildLog = InfoLog(program, false);
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                m_programs.push_back(program);
+                return program;
+            }
+
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, length + 1, nullptr, buffer.data());
+                } else {
+                    glGetProgramInfoLog(object, length + 1, nullptr, buffer.data());
+                }
+                return buffer.data();
+            }
+
+            const std::string& BuildLog() const { return m_buildLog; }
+
+            GLuint m_vao = 0;
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+        };
+
+        // A tessellation program drawn with anything but GL_PATCHES.
+        TEST_F(TessellationDrawModeScenario, TessellationProgramRejectsNonPatchModes) {
+            if (!Ready()) GTEST_SKIP();
+
+            const GLuint program = BuildProgram({{GL_VERTEX_SHADER, kVertexSource},
+                                                 {GL_TESS_CONTROL_SHADER, kTessControlSource},
+                                                 {GL_TESS_EVALUATION_SHADER, kTessEvalSource},
+                                                 {GL_FRAGMENT_SHADER, kFragmentSource}});
+            ASSERT_NE(program, 0u) << "the tessellation program did not build: " << BuildLog();
+
+            glUseProgram(program);
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            for (const GLenum mode : {static_cast<GLenum>(GL_POINTS), static_cast<GLenum>(GL_LINES),
+                                      static_cast<GLenum>(GL_TRIANGLES)}) {
+                glDrawArrays(mode, 0, 1);
+                EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_INVALID_OPERATION))
+                    << "mode " << mode << " must not be accepted while tessellation is active";
+                DrainErrors();
+            }
+
+            // The one mode that IS accepted still is - a rule keyed any wider would break every
+            // patch draw in the suite.
+            glDrawArrays(GL_PATCHES, 0, 1);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+            DrainErrors();
+        }
+
+        // ... and the other direction: GL_PATCHES without a tessellation evaluation stage.
+        TEST_F(TessellationDrawModeScenario, PatchesRejectedWithoutATessellationEvaluationStage) {
+            if (!Ready()) GTEST_SKIP();
+
+            const GLuint program =
+                BuildProgram({{GL_VERTEX_SHADER, kVertexSource}, {GL_FRAGMENT_SHADER, kFragmentSource}});
+            ASSERT_NE(program, 0u) << "the vertex/fragment program did not build: " << BuildLog();
+
+            glUseProgram(program);
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            glDrawArrays(GL_PATCHES, 0, 1);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_INVALID_OPERATION))
+                << "GL_PATCHES has no meaning without a tessellation evaluation stage";
+            DrainErrors();
+
+            // The same program with an ordinary mode is untouched.
+            glDrawArrays(GL_TRIANGLES, 0, 3);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+            DrainErrors();
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/VertexAttribBindingScenario.cpp

@@ -673,4 +673,86 @@ void main() {
         glDeleteProgram(program);
     }
 
+    // A GL_DOUBLE array is NARROWED to float32 and fetched, not dropped. No backend here has a
+    // 64-bit vertex format, but glVertexAttribFormat(GL_DOUBLE) is defined as "doubles in memory,
+    // converted to float" and the shader input is a plain vec4 either way, so nothing about fp64
+    // is needed - only the fetch conversion (KHR-GL43.vertex_attrib_binding.basic-input-case4).
+    // Every value here is exact in float32, so the capture is an equality test.
+    TEST_F(VertexAttribBindingScenario, DoubleArrayIsFetchedAtFloat32Precision) {
+        if (!Ready()) GTEST_SKIP();
+        ResetCurrentAttribs();
+
+        const double vertices[] = {100.0, 200.0, 300.0, 400.0};
+        GLuint vbo = 0;
+        glGenBuffers(1, &vbo);
+        glBindBuffer(GL_ARRAY_BUFFER, vbo);
+        glBufferData(GL_ARRAY_BUFFER, sizeof(vertices), vertices, GL_STATIC_DRAW);
+        glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+        glBindVertexBuffer(0, vbo, 0, 2 * static_cast<GLsizei>(sizeof(double)));
+        glVertexAttribFormat(1, 2, GL_DOUBLE, GL_FALSE, 0);
+        glVertexAttribBinding(1, 0);
+        glEnableVertexAttribArray(1);
+
+        const std::vector<float> data = CapturePoints(m_program, m_xfbo, 2, 1);
+        EXPECT_TRUE(Vec4Is(data, 0, 1, 100.0f, 200.0f, 0.0f, 1.0f));
+        EXPECT_TRUE(Vec4Is(data, 1, 1, 300.0f, 400.0f, 0.0f, 1.0f));
+
+        glDisableVertexAttribArray(1);
+        glDeleteBuffers(1, &vbo);
+    }
+
+    // GL ignores `normalized` for floating-point array types, GL_DOUBLE included: the fetched
+    // values are the raw ones, not scaled into [0,1]. A conversion that forwarded the flag would
+    // return zeros here (KHR-GL43.vertex_attrib_binding.basic-input-case5).
+    TEST_F(VertexAttribBindingScenario, NormalizedIsIgnoredForDoubleArrays) {
+        if (!Ready()) GTEST_SKIP();
+        ResetCurrentAttribs();
+
+        const double vertices[] = {0.0, 10.0, 20.0, 0.0};
+        GLuint vbo = 0;
+        glGenBuffers(1, &vbo);
+        glBindBuffer(GL_ARRAY_BUFFER, vbo);
+        glBufferData(GL_ARRAY_BUFFER, sizeof(vertices), vertices, GL_STATIC_DRAW);
+        glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+        glBindVertexBuffer(0, vbo, 0, 4 * static_cast<GLsizei>(sizeof(double)));
+        glVertexAttribFormat(2, 4, GL_DOUBLE, GL_TRUE, 0);
+        glVertexAttribBinding(2, 0);
+        glEnableVertexAttribArray(2);
+
+        const std::vector<float> data = CapturePoints(m_program, m_xfbo, 1, 1);
+        EXPECT_TRUE(Vec4Is(data, 0, 2, 0.0f, 10.0f, 20.0f, 0.0f));
+
+        glDisableVertexAttribArray(2);
+        glDeleteBuffers(1, &vbo);
+    }
+
+    // The LONG form asks for more precision than any backend here can give and gets the same
+    // float32 stream. IsLong must not gate the narrowing off
+    // (KHR-GL43.vertex_attrib_binding.advanced-bindingUpdate feeds its dvec3 this way).
+    TEST_F(VertexAttribBindingScenario, LongDoubleArrayIsFetchedAtFloat32Precision) {
+        if (!Ready()) GTEST_SKIP();
+        ResetCurrentAttribs();
+
+        const double vertices[] = {1.0, 2.0, 3.0, 4.0, 5.0, 6.0};
+        GLuint vbo = 0;
+        glGenBuffers(1, &vbo);
+        glBindBuffer(GL_ARRAY_BUFFER, vbo);
+        glBufferData(GL_ARRAY_BUFFER, sizeof(vertices), vertices, GL_STATIC_DRAW);
+        glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+        glBindVertexBuffer(0, vbo, 0, 3 * static_cast<GLsizei>(sizeof(double)));
+        glVertexAttribLFormat(3, 3, GL_DOUBLE, 0);
+        glVertexAttribBinding(3, 0);
+        glEnableVertexAttribArray(3);
+
+        const std::vector<float> data = CapturePoints(m_program, m_xfbo, 2, 1);
+        EXPECT_TRUE(Vec4Is(data, 0, 3, 1.0f, 2.0f, 3.0f, 1.0f));
+        EXPECT_TRUE(Vec4Is(data, 1, 3, 4.0f, 5.0f, 6.0f, 1.0f));
+
+        glDisableVertexAttribArray(3);
+        glDeleteBuffers(1, &vbo);
+    }
+
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ViewportArrayScenario.cpp

@@ -428,15 +428,15 @@ void main() { fragColor = vec4(float(gsIndex) * 16.0 / 255.0, 0.0, 0.0, 1.0); }
             std::vector<GLfloat> pixels(static_cast<size_t>(kWidth) * kHeight, 0.0f);
             glReadPixels(0, 0, kWidth, kHeight, GL_RED, GL_FLOAT, pixels.data());
             for (int i = 0; i < kViewportCount; ++i) {
-                const float near = static_cast<float>(i) / 16.0f;
-                const float far = 1.0f - static_cast<float>(i) / 16.0f;
+                const float nearDepth = static_cast<float>(i) / 16.0f;
+                const float farDepth = 1.0f - static_cast<float>(i) / 16.0f;
                 // The tolerance covers depth-buffer-free rasterization of gl_FragCoord.z on a
                 // software rasterizer; the per-index values are 1/16 apart, so it cannot let a
                 // neighbouring viewport's range through, and viewport 0's range (0, 1) differs
                 // from every other index by at least 1/16.
-                EXPECT_NEAR(pixels[i], near, 1.0e-3f)
+                EXPECT_NEAR(pixels[i], nearDepth, 1.0e-3f)
                     << "viewport " << i << " near-plane depth; got viewport 0's range if this is 0";
-                EXPECT_NEAR(pixels[static_cast<size_t>(kWidth) + i], far, 1.0e-3f)
+                EXPECT_NEAR(pixels[static_cast<size_t>(kWidth) + i], farDepth, 1.0e-3f)
                     << "viewport " << i << " far-plane depth; got viewport 0's range if this is 1";
             }
 
@@ -520,5 +520,215 @@ void main() { fragColor = vec4(float(gsIndex) * 16.0 / 255.0, 0.0, 0.0, 1.0); }
             DestroyIntTarget(target);
         }
 
+        // --- 4. an explicitly EMPTY scissor box clips, it does not mean "never written" --------
+        //
+        // Deliberately NOT a ViewportArrayScenario case, because it must run on DirectGLES - the
+        // backend that got it wrong - and that fixture skips there. It needs none of the routing:
+        // one viewport, one scissor rectangle, no geometry stage.
+        //
+        // glScissor(0, 0, 0, 0) is legal GL meaning "the scissor test rejects every fragment",
+        // but it is byte-identical to the all-zero rectangle a context starts with, whose meaning
+        // is the OPPOSITE ("the whole window", which the frontend cannot spell before a surface
+        // exists). DirectGLES resolved the collision from the EXTENT, so it substituted the whole
+        // surface for a deliberately empty box and inverted the request into "clip nothing" -
+        // and did so on every draw, at any origin, no matter how many times the application had
+        // already called glScissor. KHR-GL43.viewport_array.scissor_zero_dimension is the
+        // conformance shape of exactly this, and it is what the written-flag now separates.
+
+        const char* const kFullScreenVertexSource = R"(#version 330 core
+void main() {
+    // One clip-space-covering triangle straight from gl_VertexID: no buffers, no attributes,
+    // and nothing that could clip the draw except the scissor rectangle under test.
+    const vec2 corners[3] = vec2[3](vec2(-1.0, -1.0), vec2(3.0, -1.0), vec2(-1.0, 3.0));
+    gl_Position = vec4(corners[gl_VertexID], 0.0, 1.0);
+}
+)";
+
+        const char* const kConstantIntFragmentSource = R"(#version 330 core
+layout(location = 0) out int fragColor;
+void main() { fragColor = 7; }
+)";
+        constexpr GLint kPainted = 7;
+
+        class EmptyScissorScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                m_program = BuildQuadProgram();
+                ASSERT_NE(m_program, 0u) << "full-screen program failed to build: " << m_buildLog;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+
+                glGenTextures(1, &m_texture);
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glTexImage2D(GL_TEXTURE_2D, 0, GL_R32I, kSurfaceSide, kSurfaceSide, 0, GL_RED_INTEGER, GL_INT,
+                             nullptr);
+                glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_texture, 0);
+                ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), GL_FRAMEBUFFER_COMPLETE)
+                    << "R32I is required to be colour-renderable; an incomplete target would make every "
+                       "assertion below vacuous";
+
+                glViewport(0, 0, kSurfaceSide, kSurfaceSide);
+                glDisable(GL_DEPTH_TEST);
+                ResetScissorState();
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "setup left a GL error behind";
+            }
+
+            void TearDown() override {
+                if (!Ready() || IsSkipped()) return;
+                // The context is shared with every other scenario in the process, and a leftover
+                // 0x0 scissor box with the test enabled would silently blank whatever runs next.
+                ResetScissorState();
+                glScissor(0, 0, kSurfaceSide, kSurfaceSide);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_program != 0) glDeleteProgram(m_program);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                if (m_fbo != 0) glDeleteFramebuffers(1, &m_fbo);
+                if (m_texture != 0) glDeleteTextures(1, &m_texture);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+            }
+
+            static void ResetScissorState() {
+                for (int i = 0; i < kViewportCount; ++i) {
+                    glDisablei(GL_SCISSOR_TEST, static_cast<GLuint>(i));
+                }
+                glDisable(GL_SCISSOR_TEST);
+            }
+
+            // Uploaded, not cleared, for the reason FillIntTarget gives - and here for a second
+            // one that is decisive: glClear is ITSELF scissored, so a clear issued under the very
+            // state this case is testing would be clipped away and prove nothing.
+            void FillTarget() const {
+                const std::vector<GLint> unwritten(static_cast<size_t>(kSurfaceSide) * kSurfaceSide, kUnwritten);
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                glTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, kSurfaceSide, kSurfaceSide, GL_RED_INTEGER, GL_INT,
+                                unwritten.data());
+            }
+
+            static std::vector<GLint> ReadTarget() {
+                std::vector<GLint> pixels(static_cast<size_t>(kSurfaceSide) * kSurfaceSide, 0);
+                glReadPixels(0, 0, kSurfaceSide, kSurfaceSide, GL_RED_INTEGER, GL_INT, pixels.data());
+                return pixels;
+            }
+
+            GLuint BuildQuadProgram() {
+                const GLuint vs = CompileOne(GL_VERTEX_SHADER, kFullScreenVertexSource);
+                if (vs == 0) return 0;
+                const GLuint fs = CompileOne(GL_FRAGMENT_SHADER, kConstantIntFragmentSource);
+                if (fs == 0) {
+                    glDeleteShader(vs);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, vs);
+                glAttachShader(program, fs);
+                glLinkProgram(program);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                glDeleteShader(vs);
+                glDeleteShader(fs);
+                if (linked) return program;
+                GLint length = 0;
+                glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> log(static_cast<size_t>(length > 1 ? length : 1), '\0');
+                glGetProgramInfoLog(program, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                m_buildLog = log.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+
+            GLuint CompileOne(GLenum stage, const char* source) {
+                const GLuint shader = glCreateShader(stage);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled) return shader;
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> log(static_cast<size_t>(length > 1 ? length : 1), '\0');
+                glGetShaderInfoLog(shader, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                m_buildLog = log.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+
+            std::string m_buildLog;
+            GLuint m_program = 0;
+            GLuint m_vao = 0;
+            GLuint m_fbo = 0;
+            GLuint m_texture = 0;
+        };
+
+        TEST_F(EmptyScissorScenario, AnExplicitlyEmptyScissorBoxClipsEveryFragment) {
+            // Positive control FIRST. Without it a regression that simply lost the draw entirely
+            // would sail through the half below, which only asserts that nothing was painted.
+            FillTarget();
+            glEnable(GL_SCISSOR_TEST);
+            glScissor(0, 0, kSurfaceSide, kSurfaceSide);
+            glUseProgram(m_program);
+            glBindVertexArray(m_vao);
+            glDrawArrays(GL_TRIANGLES, 0, 3);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR);
+            {
+                const std::vector<GLint> pixels = ReadTarget();
+                ASSERT_EQ(pixels.front(), kPainted) << "control: a full-surface scissor box must not clip";
+                ASSERT_EQ(pixels.back(), kPainted) << "control: a full-surface scissor box must not clip";
+            }
+
+            // The case itself, and note it runs AFTER an explicit glScissor - the old
+            // extent-based sentinel misfired here too, which is what made this a live rendering
+            // bug and not just a first-frame startup quirk.
+            FillTarget();
+            glScissor(0, 0, 0, 0);
+            glDrawArrays(GL_TRIANGLES, 0, 3);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR);
+            {
+                const std::vector<GLint> pixels = ReadTarget();
+                for (size_t i = 0; i < pixels.size(); ++i) {
+                    ASSERT_EQ(pixels[i], kUnwritten)
+                        << "texel " << i << " was painted through a 0x0 scissor box: the empty rectangle was "
+                           "substituted with the whole surface, inverting 'clip everything' into 'clip nothing'";
+                }
+            }
+        }
+
+        TEST_F(EmptyScissorScenario, IndexedZeroDimensionScissorBoxesClipEveryFragment) {
+            // The conformance shape: setup4x4Scissor(..., set_zeros=true) writes all 16 boxes
+            // through glScissorArrayv with zero extents at a 4x4 grid of origins and enables the
+            // test on every index. Index 0's box is (0, 0, 0, 0) - byte-identical to the
+            // never-written default - which is precisely the collision the written flag breaks.
+            // Backends that collapse every index to 0 (DirectGLES today) still pass: index 0's
+            // box is empty, so the draw is clipped away, which is what the case requires.
+            FillTarget();
+            std::vector<GLint> boxes(static_cast<size_t>(kViewportCount) * 4, 0);
+            for (int i = 0; i < kViewportCount; ++i) {
+                boxes[static_cast<size_t>(i) * 4 + 0] = (i % kGridSide) * kCellSize;
+                boxes[static_cast<size_t>(i) * 4 + 1] = (i / kGridSide) * kCellSize;
+                // width and height stay 0 - that IS the case.
+            }
+            glScissorArrayv(0, kViewportCount, boxes.data());
+            for (int i = 0; i < kViewportCount; ++i) {
+                glEnablei(GL_SCISSOR_TEST, static_cast<GLuint>(i));
+            }
+            glUseProgram(m_program);
+            glBindVertexArray(m_vao);
+            glDrawArrays(GL_TRIANGLES, 0, 3);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR);
+
+            const std::vector<GLint> pixels = ReadTarget();
+            for (size_t i = 0; i < pixels.size(); ++i) {
+                ASSERT_EQ(pixels[i], kUnwritten) << "texel " << i << " was painted through a zero-extent indexed "
+                                                                     "scissor box";
+            }
+        }
+
     } // namespace
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/XfbPrimitiveQueryScenario.cpp

@@ -0,0 +1,268 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/XfbPrimitiveQueryScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// What the two transform feedback queries report for a VERTEX-ONLY capture that
+// OVERFLOWS its buffer - the shape of KHR-GL30.transform_feedback.query_vertex_*,
+// and the one place where the two targets must disagree:
+//
+//   * GL_PRIMITIVES_GENERATED counts what the capture stage assembled: 4 points.
+//   * GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN counts what the capture buffers
+//     took. With room for three vertices, a full buffer stops recording whole
+//     primitives (GL 4.6 core 13.2.2), so the answer is 3, not 4 and not 6.
+//
+// Both numbers came from the backend's own GPU counter until the driver underneath
+// DirectGLES was caught reporting exactly twice the written count for this shape
+// (Adreno 830, vertex-only capture issued right after a large render pass). The
+// frontend already computes the desktop-exact number for a capture with no geometry
+// stage, so that is what answers PRIMITIVES_WRITTEN there now - and this scenario is
+// what pins the value, on every backend, without a device.
+//
+// The non-overflowing case is the negative control: with room for all four points
+// the two targets must AGREE at 4, so a "written" that silently reports the
+// generated count cannot pass both cases at once.
+
+#include <cmath>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr float kPoison = -1234.0f;
+        // One vec4 per captured point.
+        constexpr std::size_t kFloatsPerVertex = 4;
+        constexpr std::size_t kBytesPerVertex = kFloatsPerVertex * sizeof(float);
+        // The draw: four points, whichever way the capture buffer is sized.
+        constexpr GLsizei kDrawnPoints = 4;
+
+        GLuint CompileShader(GLenum type, const std::string& source, std::string* log) {
+            const GLuint shader = glCreateShader(type);
+            const char* text = source.c_str();
+            glShaderSource(shader, 1, &text, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        // Vertex-only capture program - no geometry stage, so nothing amplifies and the
+        // primitives written are the primitives drawn (up to the buffer's capacity).
+        GLuint BuildCaptureProgram(std::string* log) {
+            const std::string vertexSource = R"(#version 430 core
+layout(location = 0) in vec4 vs_in_value;
+out vec4 vs_out_value;
+void main() {
+  vs_out_value = vs_in_value;
+}
+)";
+            const GLuint vertexShader = CompileShader(GL_VERTEX_SHADER, vertexSource, log);
+            if (vertexShader == 0) return 0;
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, vertexShader);
+            const char* varying = "vs_out_value";
+            glTransformFeedbackVaryings(program, 1, &varying, GL_INTERLEAVED_ATTRIBS);
+            glLinkProgram(program);
+            glDeleteShader(vertexShader);
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+            return program;
+        }
+
+        class XfbPrimitiveQueryScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                std::string log;
+                m_program = BuildCaptureProgram(&log);
+                ASSERT_NE(m_program, 0u) << "capture program failed to build: " << log;
+
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                // Vertex i is (i, i+1, i+2, i+3), so a record that landed in the wrong slot
+                // is as visible as one that never landed at all.
+                float vertices[kDrawnPoints * kFloatsPerVertex] = {};
+                for (int point = 0; point < kDrawnPoints; ++point) {
+                    for (std::size_t component = 0; component < kFloatsPerVertex; ++component) {
+                        vertices[static_cast<std::size_t>(point) * kFloatsPerVertex + component] =
+                            static_cast<float>(point) + static_cast<float>(component);
+                    }
+                }
+                glBufferData(GL_ARRAY_BUFFER, sizeof(vertices), vertices, GL_STATIC_DRAW);
+                glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+                glEnableVertexAttribArray(0);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+                glGenQueries(2, m_queries);
+                ASSERT_NE(m_queries[0], 0u);
+                ASSERT_NE(m_queries[1], 0u);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glDeleteQueries(2, m_queries);
+                glBindVertexArray(0);
+                if (m_vbo != 0) glDeleteBuffers(1, &m_vbo);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_program != 0) glDeleteProgram(m_program);
+                glUseProgram(0);
+                ScenarioTest::TearDown();
+            }
+
+            // A capture buffer with room for exactly `vertexCapacity` records, poisoned so
+            // that "captured nothing" is legible, bound to capture point 0.
+            GLuint MakeCaptureBuffer(std::size_t vertexCapacity) {
+                GLuint buffer = 0;
+                glGenBuffers(1, &buffer);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer);
+                const std::vector<float> poison(vertexCapacity * kFloatsPerVertex, kPoison);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER,
+                             static_cast<GLsizeiptr>(vertexCapacity * kBytesPerVertex), poison.data(),
+                             GL_DYNAMIC_DRAW);
+                return buffer;
+            }
+
+            // ONE capture span, four points, with both query targets open across it - the
+            // order KHR-GL30.transform_feedback.query_vertex_interleaved_test uses: the
+            // queries wrap the whole span, never the other way round.
+            void RunQueriedSpan(GLuint* written, GLuint* generated) {
+                glEnable(GL_RASTERIZER_DISCARD);
+                glUseProgram(m_program);
+                glBindVertexArray(m_vao);
+
+                glBeginQuery(GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN, m_queries[0]);
+                glBeginQuery(GL_PRIMITIVES_GENERATED, m_queries[1]);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(GL_POINTS, 0, kDrawnPoints);
+                glEndTransformFeedback();
+                glEndQuery(GL_PRIMITIVES_GENERATED);
+                glEndQuery(GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN);
+
+                glDisable(GL_RASTERIZER_DISCARD);
+                glUseProgram(0);
+
+                *written = 0xFFFFFFFFu;
+                *generated = 0xFFFFFFFFu;
+                glGetQueryObjectuiv(m_queries[0], GL_QUERY_RESULT, written);
+                glGetQueryObjectuiv(m_queries[1], GL_QUERY_RESULT, generated);
+            }
+
+            // The capture record at slot `point` must be the vertex the draw fetched there.
+            static ::testing::AssertionResult CapturedVertexIs(const float* record, int point) {
+                for (std::size_t component = 0; component < kFloatsPerVertex; ++component) {
+                    const float expected = static_cast<float>(point) + static_cast<float>(component);
+                    const float got = record[component];
+                    // isfinite first: every ordered comparison against a NaN is false, so a
+                    // pair of one-sided range tests REPORTS SUCCESS for uninitialised storage
+                    // that happens to read as NaN.
+                    if (!std::isfinite(got) || std::fabs(got - expected) > 0.01f) {
+                        return ::testing::AssertionFailure()
+                               << "point " << point << " component " << component << " is " << got << ", expected "
+                               << expected << (got == kPoison ? " (the capture never reached these bytes)" : "");
+                    }
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            GLuint m_program = 0;
+            GLuint m_vao = 0;
+            GLuint m_vbo = 0;
+            GLuint m_queries[2] = {0, 0};
+        };
+
+        // The negative control: the buffer holds every point the draw produces, so both
+        // targets must report the same 4. A "written" that is really the generated count
+        // passes this case and fails the next one; a "written" that is really zero fails
+        // this one.
+        TEST_F(XfbPrimitiveQueryScenario, ACaptureThatFitsReportsEveryPrimitiveOnBothTargets) {
+            if (!Ready()) GTEST_SKIP();
+
+            const GLuint captureBuffer = MakeCaptureBuffer(kDrawnPoints);
+            GLuint written = 0;
+            GLuint generated = 0;
+            RunQueriedSpan(&written, &generated);
+
+            EXPECT_EQ(written, 4u);
+            EXPECT_EQ(generated, 4u);
+
+            std::vector<float> readback(kDrawnPoints * kFloatsPerVertex, kPoison);
+            glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                               static_cast<GLsizeiptr>(kDrawnPoints * kBytesPerVertex), readback.data());
+            for (int point = 0; point < kDrawnPoints; ++point) {
+                EXPECT_TRUE(CapturedVertexIs(readback.data() + static_cast<std::size_t>(point) * kFloatsPerVertex,
+                                             point));
+            }
+
+            glDeleteBuffers(1, &captureBuffer);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The pin: four points into a buffer sized for three. The fourth is not written, so
+        // the two targets part ways at 3 and 4 - the exact pair
+        // KHR-GL30.transform_feedback.query_vertex_interleaved_test checks, and the pair the
+        // Adreno driver counter got wrong (it answered 6).
+        TEST_F(XfbPrimitiveQueryScenario, AnOverflowingVertexOnlyCaptureStopsWritingAtTheBufferCapacity) {
+            if (!Ready()) GTEST_SKIP();
+
+            constexpr std::size_t kCapacityVertices = 3;
+            const GLuint captureBuffer = MakeCaptureBuffer(kCapacityVertices);
+            GLuint written = 0;
+            GLuint generated = 0;
+            RunQueriedSpan(&written, &generated);
+
+            EXPECT_EQ(written, 3u) << "the capture buffer holds " << kCapacityVertices << " points";
+            EXPECT_EQ(generated, 4u) << "every point the draw assembled is generated, capacity or not";
+
+            // The three records that DID fit are the first three points, in order: an
+            // overflow truncates the capture, it does not scramble or drop what preceded it.
+            std::vector<float> readback(kCapacityVertices * kFloatsPerVertex, kPoison);
+            glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                               static_cast<GLsizeiptr>(kCapacityVertices * kBytesPerVertex), readback.data());
+            for (int point = 0; point < static_cast<int>(kCapacityVertices); ++point) {
+                EXPECT_TRUE(CapturedVertexIs(readback.data() + static_cast<std::size_t>(point) * kFloatsPerVertex,
+                                             point));
+            }
+
+            glDeleteBuffers(1, &captureBuffer);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_State/GLState/BufferState/BufferObject.cpp

@@ -163,7 +163,7 @@ namespace MobileGL::MG_State::GLState {
             if (!m_resource.IsGpuResident() &&
                 !(m_mappingAccess & BufferMappingAccessBit::FlushExplicit)) { // if we didn't flush explicitly
                 if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
-                    Memcpy(m_resource.Bytes() + m_mappedRange.start, m_stagingData.data(),
+                    Memcpy(m_resource.Bytes() + m_mappedRange.start, m_stagingData.data() + m_stagingBias,
                            m_mappedRange.end - m_mappedRange.start);
                 }
                 NotifyFlushMappedRange(m_mappedRange, m_mappingAccess);
@@ -175,6 +175,7 @@ namespace MobileGL::MG_State::GLState {
         m_isMapped = false;
         m_mappingAccess = BufferMappingAccessBit::Null;
         m_mappedRange = {0, 0};
+        m_stagingBias = 0;
         m_ownsStagingData = false;
     }
 
@@ -193,7 +194,7 @@ namespace MobileGL::MG_State::GLState {
         // FLUSH_EXPLICIT maps are never GPU-resident (only coherent maps are adopted), so
         // the staged bytes must be copied into the shadow before the backend reads them.
         if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
-            Memcpy(m_resource.Bytes() + start, m_stagingData.data() + offset, length);
+            Memcpy(m_resource.Bytes() + start, m_stagingData.data() + m_stagingBias + offset, length);
         }
         NotifyFlushMappedRange({start, end}, m_mappingAccess);
     }
@@ -250,6 +251,34 @@ namespace MobileGL::MG_State::GLState {
         NotifyContentWrite(atOffset, data.size);
     }
 
+    void BufferObject::FillSubData(DataPtr pattern, SizeT atOffset, SizeT size) {
+        MOBILEGL_ASSERT(pattern.data != nullptr && pattern.size > 0,
+                        "FillSubData requires a non-empty pattern.");
+        MOBILEGL_ASSERT(size % pattern.size == 0,
+                        "FillSubData size (%zu) must be a multiple of pattern size (%zu).", size, pattern.size);
+        MOBILEGL_ASSERT(atOffset <= m_size && size <= m_size - atOffset,
+                        "FillSubData out of bounds: atOffset (%zu) + size (%zu) > m_size (%zu)", atOffset, size,
+                        m_size);
+        MOBILEGL_ASSERT(!m_isMapped || (m_mappingAccess & BufferMappingAccessBit::Persistent),
+                        "Cannot fill data while buffer is non-persistently mapped.");
+        if (size == 0) return;
+
+        // A clear is ordered after all earlier GPU writes. Partial clears additionally need the
+        // retained shadow bytes; whole-store clears need the same synchronization before writing
+        // an adopted persistent mapping that the GPU may still be accessing.
+        SyncGpuWrites();
+
+        Uint8* dst = m_resource.Bytes() + atOffset;
+        if (pattern.size == 1) {
+            Memset(dst, *static_cast<const Uint8*>(pattern.data), size);
+        } else {
+            for (SizeT at = 0; at < size; at += pattern.size) {
+                Memcpy(dst + at, pattern.data, pattern.size);
+            }
+        }
+        NotifyContentWrite(atOffset, size);
+    }
+
     void BufferObject::DownloadSubData(void* dst, SizeT atOffset, SizeT size) const {
         MOBILEGL_ASSERT(atOffset + size <= m_size,
                         "DownloadSubData out of bounds: atOffset (%zu) + size (%zu) > m_size (%zu)", atOffset, size,
@@ -283,6 +312,9 @@ namespace MobileGL::MG_State::GLState {
             m_mappedRange = {0, m_size};
 
             if (m_mappingAccess & BufferMappingAccessBit::Write) {
+                // glMapBuffer maps from offset 0, so no bias: the allocation's own
+                // GL_MIN_MAP_BUFFER_ALIGNMENT-aligned base is what the application must get.
+                m_stagingBias = 0;
                 m_stagingData.resize(m_size);
                 m_ownsStagingData = true;
 
@@ -344,14 +376,21 @@ namespace MobileGL::MG_State::GLState {
         }
 
         if (access & BufferMappingAccessBit::Write) {
-            m_stagingData.resize(range.end - range.start);
+            // ARB_map_buffer_alignment constrains (returned pointer - offset), not the pointer:
+            // a map at offset 63 must hand back a pointer 63 bytes past the alignment grid, which
+            // is exactly what the read path below gets for free from shadowBase + offset. The
+            // staging store has to be biased by the same phase to match, so it over-allocates by
+            // it and the mapped bytes start at data() + m_stagingBias.
+            m_stagingBias = range.start % MIN_MAP_BUFFER_ALIGNMENT;
+            const SizeT mappedLength = range.end - range.start;
+            m_stagingData.resize(m_stagingBias + mappedLength);
             m_ownsStagingData = true;
 
             if (!(access & (BufferMappingAccessBit::InvalidateRange | BufferMappingAccessBit::InvalidateBuffer))) {
-                Memcpy(m_stagingData.data(), m_resource.Bytes() + range.start, m_stagingData.size());
+                Memcpy(m_stagingData.data() + m_stagingBias, m_resource.Bytes() + range.start, mappedLength);
             }
 
-            return m_stagingData.data();
+            return m_stagingData.data() + m_stagingBias;
         } else {
             m_ownsStagingData = false;
             return m_resource.Bytes() + range.start;
@@ -410,7 +449,7 @@ namespace MobileGL::MG_State::GLState {
             return const_cast<Uint8*>(m_resource.Bytes()) + m_mappedRange.start;
         }
         if (m_ownsStagingData) {
-            return const_cast<Uint8*>(m_stagingData.data());
+            return const_cast<Uint8*>(m_stagingData.data()) + m_stagingBias;
         }
         return const_cast<Uint8*>(m_resource.Bytes()) + m_mappedRange.start;
     }

MobileGL/MG_State/GLState/BufferState/BufferObject.h

@@ -132,6 +132,9 @@ namespace MobileGL {
 
             void UploadData(DataPtr data, SizeT atOffset);
             void UploadSubData(DataPtr data, SizeT atOffset);
+            // Repeats one already-converted element through [atOffset, atOffset + size) and
+            // publishes the range as one content mutation.
+            void FillSubData(DataPtr pattern, SizeT atOffset, SizeT size);
             // Reads `size` bytes from the CPU shadow at `atOffset` into `dst` (glGetBufferSubData).
             // The shadow reflects CPU writes (BufferData/SubData/maps) and backend write-backs, but not
             // arbitrary GPU-side writes.
@@ -236,7 +239,14 @@ namespace MobileGL {
             // Set by MarkGpuWritten, cleared by SyncGpuWrites once the shadow is refreshed.
             Bool m_gpuWritePending = false;
             Range1D m_mappedRange;
-            Vector<Uint8> m_stagingData;
+            // The write-map staging store. MapAlignedData because the application is handed a
+            // pointer into it, and biased by m_stagingBias because ARB_map_buffer_alignment
+            // requires (returned pointer - offset) to be aligned, not the pointer itself: a range
+            // map at offset 63 must hand back a pointer sitting 63 bytes past the alignment grid.
+            // The bias is the offset's phase, so the mapped bytes still start at
+            // m_stagingData.data() + m_stagingBias and the allocation is that much longer.
+            MapAlignedData m_stagingData;
+            SizeT m_stagingBias = 0;
             Bool m_ownsStagingData;
         };
     } // namespace MG_State::GLState

MobileGL/MG_State/GLState/BufferState/PipeResource.h

@@ -10,8 +10,56 @@
 #include <Includes.h>
 #include <MG_Util/Types.h>
 #include <bit>
+#include <new>
+#include <vector>
 
 namespace MobileGL::MG_State::GLState {
+    // GL_MIN_MAP_BUFFER_ALIGNMENT. GL 4.2 / ARB_map_buffer_alignment fix the minimum at 64 and
+    // MobileGL advertises exactly that (MG_Impl/GLImpl/Getter/GL_Getter.cpp reads this constant),
+    // so under-reporting is not available - the implementation has to be brought up to the number
+    // instead. The promise is about POINTERS, not just the query: glMapBuffer must return a
+    // 64-byte-aligned pointer, and glMapBufferRange must return one whose base - the returned
+    // pointer minus the offset the caller asked for - is. Every pointer the frontend hands out
+    // comes from the shadow below or from BufferObject's staging buffer, and std::vector only
+    // promises alignof(std::max_align_t) (16 on aarch64), so both allocations carry the alignment
+    // themselves. One constant for the getter and the allocator, because the two may never
+    // disagree - the same reason the atomic-counter limits are shared through
+    // MG_Util/ShaderTranspiler/Types.h.
+    inline constexpr SizeT MIN_MAP_BUFFER_ALIGNMENT = 64;
+
+    // Allocator that gives every allocation MIN_MAP_BUFFER_ALIGNMENT. Deliberately minimal: the
+    // vectors it backs hold raw bytes and are only ever sized, so allocate/deallocate plus the
+    // rebinding and equality boilerplate std::vector requires is the whole interface.
+    template <typename T>
+    struct MapAlignedAllocator {
+        using value_type = T;
+
+        MapAlignedAllocator() noexcept = default;
+        template <typename U>
+        MapAlignedAllocator(const MapAlignedAllocator<U>&) noexcept {}
+
+        T* allocate(SizeT count) {
+            if (count == 0) return nullptr;
+            return static_cast<T*>(
+                ::operator new(count * sizeof(T), std::align_val_t{MIN_MAP_BUFFER_ALIGNMENT}));
+        }
+        void deallocate(T* pointer, SizeT) noexcept {
+            ::operator delete(pointer, std::align_val_t{MIN_MAP_BUFFER_ALIGNMENT});
+        }
+
+        template <typename U>
+        Bool operator==(const MapAlignedAllocator<U>&) const noexcept {
+            return true;
+        }
+        template <typename U>
+        Bool operator!=(const MapAlignedAllocator<U>&) const noexcept {
+            return false;
+        }
+    };
+
+    // Byte store for anything the application may end up holding a mapped pointer into.
+    using MapAlignedData = std::vector<Uint8, MapAlignedAllocator<Uint8>>;
+
     // Opaque, refcounted handle to the backend's GPU storage for one buffer
     // (the driver-side resource). The active backend derives from it and attaches
     // its own payload (VkBufferResource / GLESBufferResource). Held by PipeResource.
@@ -57,8 +105,8 @@ namespace MobileGL::MG_State::GLState {
         }
         // Direct shadow access, used only by the backend's upload-from-shadow path,
         // which never runs for a GPU-resident (persistent) buffer.
-        Data& Shadow() { return *m_shadow; }
-        const Data& Shadow() const { return *m_shadow; }
+        MapAlignedData& Shadow() { return *m_shadow; }
+        const MapAlignedData& Shadow() const { return *m_shadow; }
 
         // Transition to persistent GPU residency: adopt the backend's coherent
         // mapped base as the source of truth and drop the CPU shadow. The caller
@@ -85,7 +133,10 @@ namespace MobileGL::MG_State::GLState {
         SharedPtr<BackendBufferResource> ReleaseBackend() { return std::move(m_backend); }
 
     private:
-        SharedPtr<Data> m_shadow = MakeShared<Data>();
+        // MapAlignedData, not Data: a read-only glMapBuffer hands the application this very
+        // pointer, and a range map hands it base + offset, so the base has to be on the
+        // GL_MIN_MAP_BUFFER_ALIGNMENT grid for either to satisfy ARB_map_buffer_alignment.
+        SharedPtr<MapAlignedData> m_shadow = MakeShared<MapAlignedData>();
         void* m_gpuMapped = nullptr;
         SharedPtr<BackendBufferResource> m_backend;
     };

MobileGL/MG_State/GLState/Core.cpp

@@ -39,6 +39,11 @@ namespace MobileGL::MG_State {
             return m_compileEnv;
         }
 
+        void GLContext::InvalidateCompileEnv() {
+            m_compileEnv.reset();
+            m_compileEnvBackend = nullptr;
+        }
+
         // Error
         void GLContext::RecordError(ErrorCode code, UniquePtr<ErrorInfo> info) {
             // Invariant I1, mechanically enforced: the GL error state is GL-thread-owned.
@@ -641,9 +646,17 @@ namespace MobileGL::MG_State {
             for (SizeT stage = 0; stage < ProgramPipelineObject::kGraphicsStageCount; ++stage) {
                 const auto& stageProgram = pipeline->GetStageProgram(static_cast<ShaderStage>(stage));
                 if (!stageProgram) continue;
-                for (const auto& shader : stageProgram->GetAttachedShaders()) {
-                    if (!shader || static_cast<SizeT>(shader->GetShaderStage()) != stage) continue;
-                    composite->AttachShader(shader);
+                // The stage program contributes the shaders its LAST LINK consumed, never
+                // its live attach list: per GL 4.6 7.3/7.4 a pipeline stage executes the
+                // stage program as last linked - glAttachShader and glCompileShader take
+                // effect only at the program's next link - and neither of those moves the
+                // link version this cache keys on, so reading live state here would let a
+                // post-link attach or recompile leak into the composite while the signature
+                // still hits. The pinned (source, node) makes the composite's Link()
+                // consume the very inputs that link consumed.
+                for (const auto& ref : stageProgram->GetLinkedShaderSnapshot()) {
+                    if (!ref.shader || static_cast<SizeT>(ref.shader->GetShaderStage()) != stage) continue;
+                    composite->AttachShaderWithPinnedLinkInput(ref);
                     anyStage = true;
                 }
             }

MobileGL/MG_State/GLState/Core.h

@@ -328,6 +328,7 @@ namespace MobileGL {
                 // transform feedback counter cannot see them - nothing was being captured.
                 void AddTransformFeedbackPausedPrimitives(Uint64 primitives) {
                     m_transformFeedbackPausedPrimitiveCounter += primitives;
+                    m_transformFeedbackGeneratedPrimitiveCounter += primitives;
                 }
                 Uint64 GetTransformFeedbackPausedPrimitiveCounter() const {
                     return m_transformFeedbackPausedPrimitiveCounter;
@@ -342,8 +343,55 @@ namespace MobileGL {
                 // (pre-clamp; drives the GS strip capture-order fixup at EndTF).
                 void AddTransformFeedbackInputPrimitives(Uint64 primitives) {
                     m_transformFeedbackInputPrimitives += primitives;
+                    m_transformFeedbackGeneratedPrimitiveCounter += primitives;
                 }
                 Uint64 GetTransformFeedbackInputPrimitives() const { return m_transformFeedbackInputPrimitives; }
+                // What a GL_PRIMITIVES_GENERATED query counts over its span: every primitive the
+                // capture stage assembled, including the ones a paused span discarded (those are
+                // generated but never written). Kept as its own running total rather than derived
+                // from the input counter above, which BeginTransformFeedback resets per span while
+                // a query may cover several of them.
+                Uint64 GetTransformFeedbackGeneratedCounter() const {
+                    return m_transformFeedbackGeneratedPrimitiveCounter;
+                }
+                // Capture draws whose written-primitive count the CPU accounting reproduced
+                // exactly, and the subset it could not: a program with a geometry stage amplifies
+                // by whatever the shader emits, which only the driver's own counter knows. The
+                // transform feedback queries diff both over their span to decide whether the CPU
+                // delta may stand in for the backend's GPU result (GL_Query.cpp).
+                void AddTransformFeedbackAccountedCaptureDraw() { ++m_transformFeedbackAccountedCaptureDraws; }
+                Uint64 GetTransformFeedbackAccountedCaptureDraws() const {
+                    return m_transformFeedbackAccountedCaptureDraws;
+                }
+                void AddTransformFeedbackGeometryCaptureDraw() { ++m_transformFeedbackGeometryCaptureDraws; }
+                Uint64 GetTransformFeedbackGeometryCaptureDraws() const {
+                    return m_transformFeedbackGeometryCaptureDraws;
+                }
+
+                // Conditional rendering (GL 4.6 core 10.9). `discard` is the verdict already
+                // resolved from the query object at glBeginConditionalRender - the predicate is
+                // read ONCE there, not per command, because GL specifies the block against the
+                // result available at Begin and re-reading it would let a query that is still
+                // being written change the answer mid-block.
+                void BeginConditionalRender(GLuint queryId, GLenum mode, Bool discard) {
+                    m_conditionalRenderActive = true;
+                    m_conditionalRenderQuery = queryId;
+                    m_conditionalRenderMode = mode;
+                    m_conditionalRenderDiscards = discard;
+                }
+                void EndConditionalRender() {
+                    m_conditionalRenderActive = false;
+                    m_conditionalRenderQuery = 0;
+                    m_conditionalRenderMode = GL_NONE;
+                    m_conditionalRenderDiscards = false;
+                }
+                Bool IsConditionalRenderActive() const { return m_conditionalRenderActive; }
+                GLuint GetConditionalRenderQuery() const { return m_conditionalRenderQuery; }
+                // Whether the commands GL 4.6 core 10.9 makes conditional are being discarded
+                // right now. False whenever no block is open, so a caller needs no second test.
+                Bool ConditionalRenderDiscardsCommands() const {
+                    return m_conditionalRenderActive && m_conditionalRenderDiscards;
+                }
 
                 // Transform feedback objects (ARB_transform_feedback2 / GL 4.0 core).
                 // The capture state above and the indexed GL_TRANSFORM_FEEDBACK_BUFFER
@@ -413,9 +461,12 @@ namespace MobileGL {
                 // cannot be captured in MG_State::Init() - that runs BEFORE MG_Backend::Init(),
                 // so there is no backend to query yet. Re-captured whenever the active backend
                 // object changes, which also rolls the fingerprint and therefore invalidates
-                // every P0b preprocess memo keyed against the old one.
+                // every P0b preprocess memo keyed against the old one. A backend whose dynamic
+                // capabilities become available without changing object identity must call
+                // InvalidateCompileEnv() after publishing them.
                 // GL thread only.
                 const SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv>& GetCompileEnv();
+                void InvalidateCompileEnv();
 
             private:
                 // State Components
@@ -436,6 +487,16 @@ namespace MobileGL {
                 Uint64 m_transformFeedbackPausedPrimitiveCounter = 0;
                 Uint64 m_transformFeedbackCapturedVertices = 0;
                 Uint64 m_transformFeedbackInputPrimitives = 0;
+                Uint64 m_transformFeedbackGeneratedPrimitiveCounter = 0;
+                Uint64 m_transformFeedbackAccountedCaptureDraws = 0;
+                Uint64 m_transformFeedbackGeometryCaptureDraws = 0;
+
+                // Conditional rendering. Context state, not object state: GL 4.6 core 10.9 allows
+                // exactly one block open at a time and no object owns it.
+                Bool m_conditionalRenderActive = false;
+                Bool m_conditionalRenderDiscards = false;
+                GLuint m_conditionalRenderQuery = 0;
+                GLenum m_conditionalRenderMode = GL_NONE;
 
                 // Everything a transform feedback object owns while it is NOT the bound one.
                 struct TransformFeedbackObjectState {

MobileGL/MG_State/GLState/FramebufferState/FramebufferObject.cpp

@@ -9,7 +9,18 @@
 #include "FramebufferObject.h"
 #include "MG_Util/Types.h"
 
+#include <atomic>
+
 namespace MobileGL::MG_State::GLState {
+    // Starts at 1 so a zero-initialized memo slot can never carry a live object's id.
+    // Atomic for the same reason as the VAO counter: it costs nothing, and a duplicate
+    // id would resurrect exactly the ABA this id exists to kill.
+    static std::atomic<Uint64> s_nextFramebufferLifetimeId{1};
+
+    Uint64 FramebufferObject::AllocateLifetimeId() {
+        return s_nextFramebufferLifetimeId.fetch_add(1, std::memory_order_relaxed);
+    }
+
     // FramebufferAttachmentObject
     FramebufferAttachmentObject::FramebufferAttachmentObject(
         const SharedPtr<MG_State::GLState::ITextureObject>& texture, TextureUploadTarget textureUploadTarget, Int level,

MobileGL/MG_State/GLState/FramebufferState/FramebufferObject.h

@@ -148,13 +148,25 @@ namespace MobileGL {
 
             Uint16 GetObjectVersion() const { return m_objectVersion; }
 
+            // Globally-unique, never-reused id for THIS object's lifetime - the same
+            // contract as VertexArrayObject::GetLifetimeId(), and needed for the same
+            // reason: neither the GL name nor the heap address can tell a
+            // deleted-and-recreated framebuffer from the original, and m_objectVersion
+            // starts at 0 for every new object, so a backend memo keyed on
+            // (pointer, version) alone would silently inherit the dead object's entry
+            // (see VkRenderPassManager's per-draw fast-path memo).
+            Uint64 GetLifetimeId() const { return m_lifetimeId; }
+
             Uint GetExternalIndex() const;
             Bool IsDefaultFramebuffer() const { return m_externalIndex == 0; }
 
         private:
+            static Uint64 AllocateLifetimeId();
+
             void BumpAttachmentVersion(FramebufferAttachmentType type);
 
             const Uint m_externalIndex = 0;
+            const Uint64 m_lifetimeId = AllocateLifetimeId();
             FramebufferAttachmentObjectArray m_attachmentObjects;
             FramebufferAttachmentVersionArray m_attachmentVersions;
 

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.cpp

@@ -8,6 +8,8 @@
 
 #include "ProgramLinkTask.h"
 
+#include <MG_State/GLState/ProgramState/ProgramTranslationCache.h>
+
 #include <MG_State/GLState/VertexArrayState/VertexArrayObject.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
@@ -36,6 +38,70 @@ namespace {
         return std::min(backendLimit, capacity);
     }
 
+    // Everything the post-link query surface ever asks a glslang::TType, flattened into a
+    // POD. The list is closed and was audited call site by call site: nothing after the link
+    // walks a struct, a type name or the AST, so there is no recursion to mirror.
+    //
+    // Why it has to be flattened at all: TObjectReflection::type points into the TProgram's
+    // OWN TPoolAllocator (reflection.cpp clones each TType into it), so every one of these
+    // pointers dangles the moment the TProgram is released - and releasing it is exactly what
+    // lets a link be served from the L1 translation memo without a parse.
+    static MobileGL::MG_State::GLState::ProgramObject::TypeFacts MakeTypeFacts(const glslang::TType* type) {
+        MobileGL::MG_State::GLState::ProgramObject::TypeFacts facts;
+        if (type == nullptr) return facts;
+        facts.isArray = type->isArray();
+        facts.isSizedArray = type->isSizedArray();
+        facts.isMatrix = type->isMatrix();
+        facts.isVector = type->isVector();
+        facts.isOpaque = type->isOpaque();
+        facts.isTexture = type->isTexture();
+        facts.isImage = type->isImage();
+        facts.isDouble = type->getBasicType() == glslang::EbtDouble;
+        facts.isVoid = type->getBasicType() == glslang::EbtVoid;
+        facts.basicType = static_cast<MobileGL::Int>(type->getBasicType());
+        // Stored RAW, exactly as glslang reports them (0 for a non-matrix, 1 for a scalar),
+        // because the callers already gate on isMatrix()/isVector() themselves.
+        facts.vectorSize = type->getVectorSize();
+        facts.matrixCols = type->getMatrixCols();
+        facts.matrixRows = type->getMatrixRows();
+        const glslang::TQualifier& qualifier = type->getQualifier();
+        facts.isBuffer = qualifier.storage == glslang::EvqBuffer;
+        facts.isPatch = qualifier.patch;
+        facts.hasIndex = qualifier.hasIndex();
+        facts.layoutIndex = static_cast<MobileGL::Int>(qualifier.layoutIndex);
+        facts.hasFormat = qualifier.hasFormat();
+        facts.layoutFormat = static_cast<MobileGL::Uint>(qualifier.getFormat());
+        facts.layoutMatrix = static_cast<MobileGL::Int>(qualifier.layoutMatrix);
+        return facts;
+    }
+
+    // One glslang::TObjectReflection, flattened. Shared by uniforms, blocks, pipe inputs and
+    // pipe outputs, because glslang reflects all four as TObjectReflection.
+    static MobileGL::MG_State::GLState::ProgramObject::ResourceReflection MakeResourceReflection(
+        const glslang::TObjectReflection& object) {
+        MobileGL::MG_State::GLState::ProgramObject::ResourceReflection record;
+        record.name = object.name;
+        record.glDefineType = object.glDefineType;
+        record.offset = object.offset;
+        record.size = object.size;
+        record.index = object.index;
+        record.counterIndex = object.counterIndex;
+        record.arrayStride = object.arrayStride;
+        record.topLevelArraySize = object.topLevelArraySize;
+        record.topLevelArrayStride = object.topLevelArrayStride;
+        record.binding = object.getBinding();
+        record.location = object.layoutLocation();
+        record.stages = static_cast<MobileGL::Uint32>(object.stages);
+        record.type = MakeTypeFacts(object.getType());
+        // GL_UNIFORM_SIZE / GL_ARRAY_SIZE, resolved here so no caller needs the TType:
+        // TObjectReflection::size carries the element count only for a NON-block array, so
+        // the sized-array outer count wins whenever it exists.
+        const glslang::TType* type = object.getType();
+        record.arraySize = (type != nullptr && type->isSizedArray()) ? type->getOuterArraySize()
+                                                                     : (object.size < 1 ? 1 : object.size);
+        return record;
+    }
+
     static MobileGL::String StripArrayElementSuffix(const MobileGL::String& name) {
         const MobileGL::SizeT bracket = name.find('[');
         return bracket == MobileGL::String::npos ? name : name.substr(0, bracket);
@@ -63,6 +129,180 @@ namespace {
         return element;
     }
 
+    // GL 4.6 core 7.7 / ARB_shader_atomic_counters: within one binding no two atomic counters
+    // may occupy the same bytes, every offset is a multiple of 4, and no counter may reach past
+    // GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE. glslang enforces all three in fixOffset(), which the
+    // Vulkan-relaxed parse never reaches - vkRelaxedRemapUniformVariable folds the atomic_uint
+    // into a synthesized storage block and returns from declareVariable() before fixOffset()
+    // runs, clearing explicitOffset on the way ("xxTODO: use logic from fixOffset()"). Two
+    // counters declared at the same binding AND the same offset therefore linked cleanly.
+    //
+    // The offsets themselves survive that lowering (reflection and the SPIR-V generator both
+    // honour layoutOffset), so the check belongs here, over the same model the GL queries answer
+    // from. Returns the info-log line for an illegal layout, empty for a legal one.
+    static MobileGL::String ValidateAtomicCounterLayout(glslang::TProgram& reflection) {
+        using MobileGL::Bool;
+        using MobileGL::Int;
+        using MobileGL::SizeT;
+        using MobileGL::String;
+        using MobileGL::Vector;
+        namespace Transpiler = MobileGL::MG_Util::ShaderTranspiler;
+
+        const Int blockCount = reflection.getNumUniformBlocks();
+        if (blockCount <= 0) return {};
+        const SizeT prefixLength = std::strlen(Transpiler::ATOMIC_COUNTER_BLOCK_PREFIX);
+        Vector<Bool> isCounterBlock(static_cast<SizeT>(blockCount), false);
+        Bool anyCounterBlock = false;
+        for (Int i = 0; i < blockCount; ++i) {
+            const auto& block = reflection.getUniformBlock(i);
+            isCounterBlock[static_cast<SizeT>(i)] =
+                block.name.compare(0, prefixLength, Transpiler::ATOMIC_COUNTER_BLOCK_PREFIX) == 0;
+            anyCounterBlock = anyCounterBlock || isCounterBlock[static_cast<SizeT>(i)];
+        }
+        if (!anyCounterBlock) return {}; // every program that declares no atomic counter
+
+        struct CounterSpan {
+            Int offset = 0;
+            Int size = 0;
+            String name;
+        };
+        Vector<Vector<CounterSpan>> spansByBlock(static_cast<SizeT>(blockCount));
+        const Int uniformCount = reflection.getNumUniformVariables();
+        for (Int i = 0; i < uniformCount; ++i) {
+            const auto& uniform = reflection.getUniform(i);
+            const Int owner = uniform.index;
+            if (owner < 0 || owner >= blockCount || !isCounterBlock[static_cast<SizeT>(owner)]) continue;
+            const Int offset = uniform.offset;
+            if (offset < 0) continue; // no offset recorded; nothing to compare
+            Int elements = uniform.size > 1 ? uniform.size : 1;
+            if (const glslang::TType* type = uniform.getType(); type != nullptr && type->isArray()) {
+                elements = type->isSizedArray() ? type->getCumulativeArraySize() : 1;
+            }
+            const Int size = elements * static_cast<Int>(sizeof(MobileGL::Uint32));
+            if (offset % 4 != 0) {
+                return std::format("Atomic counter '{}' is declared at offset {}, which is not a multiple of 4.",
+                                   uniform.name, offset);
+            }
+            if (offset > Transpiler::MAX_ATOMIC_COUNTER_BUFFER_SIZE - size) {
+                return std::format("Atomic counter '{}' ends at byte {}, past the {}-byte "
+                                   "GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE.",
+                                   uniform.name, offset + size, Transpiler::MAX_ATOMIC_COUNTER_BUFFER_SIZE);
+            }
+            auto& spans = spansByBlock[static_cast<SizeT>(owner)];
+            for (const CounterSpan& existing : spans) {
+                if (offset < existing.offset + existing.size && existing.offset < offset + size) {
+                    return std::format("Atomic counters '{}' and '{}' share a binding and overlap at byte offset {}.",
+                                       existing.name, uniform.name, std::max(offset, existing.offset));
+                }
+            }
+            spans.push_back({offset, size, uniform.name});
+        }
+        return {};
+    }
+
+    // GL 4.6 core 7.6: LinkProgram FAILS when a stage's count of active image uniforms exceeds
+    // GL_MAX_{VERTEX,TESS_CONTROL,TESS_EVALUATION,GEOMETRY,FRAGMENT,COMPUTE}_IMAGE_UNIFORMS, or
+    // when their sum exceeds GL_MAX_COMBINED_IMAGE_UNIFORMS. Nothing enforced it: glslang carries
+    // those numbers in TBuiltInResource only so gl_Max*ImageUniforms can expand from them, and
+    // its linker never counts uniforms against them - so a program declaring one image uniform
+    // more than the limit linked cleanly and then rendered nothing.
+    //
+    // The limits are the ones glGetIntegerv answers (MG_Impl/GLImpl/Getter/GL_Getter.cpp), the
+    // hardcoded tessellation zeros included: a program may not exceed a limit the implementation
+    // advertises, whatever the driver underneath would have taken.
+    //
+    // Counts the APPLICATION's image uniforms. The DirectGLES read/write split emits a second
+    // declaration for an image a stage both reads and writes (MG_Backend/DirectGLES/Utils.h), but
+    // that happens in the backend after this link, and counting the expanded set here would
+    // reject programs that are legal by the numbers GL advertises. Returns the info-log line for
+    // a program over a limit, empty for one within them.
+    static MobileGL::String ValidateImageUniformLimits(
+        glslang::TProgram& reflection, const MobileGL::MG_Util::ShaderTranspiler::CompileEnv& env) {
+        using MobileGL::Array;
+        using MobileGL::Int;
+        using MobileGL::SizeT;
+        using MobileGL::UnorderedMap;
+
+        static constexpr EShLanguage kStages[] = {EShLangVertex,   EShLangTessControl, EShLangTessEvaluation,
+                                                  EShLangGeometry, EShLangFragment,    EShLangCompute};
+        static constexpr const char* kLimitNames[] = {
+            "GL_MAX_VERTEX_IMAGE_UNIFORMS",   "GL_MAX_TESS_CONTROL_IMAGE_UNIFORMS",
+            "GL_MAX_TESS_EVALUATION_IMAGE_UNIFORMS", "GL_MAX_GEOMETRY_IMAGE_UNIFORMS",
+            "GL_MAX_FRAGMENT_IMAGE_UNIFORMS", "GL_MAX_COMPUTE_IMAGE_UNIFORMS"};
+        constexpr SizeT kStageCount = sizeof(kStages) / sizeof(kStages[0]);
+        const Int limits[kStageCount] = {env.params.MaxVertexImageUniforms,
+                                         0,
+                                         0,
+                                         env.params.MaxGeometryImageUniforms,
+                                         env.params.MaxFragmentImageUniforms,
+                                         env.params.MaxComputeImageUniforms};
+
+        // Reflection spells an image ARRAY one of two ways, and which one it picks depends on how
+        // the shader indexed it: a variable index makes glslang expand the array into one entry
+        // per element ("u_image[0]".."u_image[8]", each carrying the ELEMENT type), while an
+        // array never dereferenced at all stays a single entry carrying the array type. One
+        // program can even produce both spellings for the same array. So neither counting entries
+        // nor trusting the declared size is right on its own - they are reconciled per declared
+        // name with a max, which is exact for either spelling and cannot double-count the mixture.
+        struct ImageUse {
+            Int entries = 0;  // reflection entries seen for this name in this stage
+            Int declared = 0; // largest element count any of them declared
+        };
+        UnorderedMap<MobileGL::String, Array<ImageUse, kStageCount>> useByName;
+
+        const Int uniformCount = reflection.getNumUniformVariables();
+        for (Int i = 0; i < uniformCount; ++i) {
+            const auto& uniform = reflection.getUniform(i);
+            const glslang::TType* type = uniform.getType();
+            if (type == nullptr || !type->isImage()) continue;
+            // An array occupies one image unit per element; an unsized one (never indexed, so
+            // never more than the single element glslang kept) counts as one.
+            Int elements = uniform.size > 1 ? uniform.size : 1;
+            if (type->isArray()) {
+                elements = type->isSizedArray() ? type->getCumulativeArraySize() : 1;
+            }
+            // `stages` is the set of stages that REFERENCE the uniform, which is exactly what GL
+            // counts: an image declared in two stages costs a unit in each, and one no stage
+            // reads is not active at all and costs nothing.
+            Array<ImageUse, kStageCount>* use = nullptr;
+            for (SizeT stage = 0; stage < kStageCount; ++stage) {
+                if ((static_cast<unsigned>(uniform.stages) & (1u << static_cast<unsigned>(kStages[stage]))) == 0) {
+                    continue;
+                }
+                // The one insert this uniform performs, so the reference survives the rest of the
+                // stage loop - a flat hash map relocates on insert, never on read.
+                if (use == nullptr) {
+                    use = &useByName[StripArrayElementSuffix(uniform.name)];
+                }
+                ++(*use)[stage].entries;
+                (*use)[stage].declared = std::max((*use)[stage].declared, elements);
+            }
+        }
+
+        Int counts[kStageCount] = {};
+        for (const auto& entry : useByName) {
+            for (SizeT stage = 0; stage < kStageCount; ++stage) {
+                counts[stage] += std::max(entry.second[stage].entries, entry.second[stage].declared);
+            }
+        }
+
+        Int combined = 0;
+        for (SizeT stage = 0; stage < kStageCount; ++stage) {
+            combined += counts[stage];
+            if (counts[stage] > limits[stage]) {
+                return std::format("This program uses {} active image uniforms in one stage, more than the {} "
+                                   "{} allows.",
+                                   counts[stage], limits[stage], kLimitNames[stage]);
+            }
+        }
+        if (combined > env.params.MaxCombinedImageUniforms) {
+            return std::format("This program uses {} active image uniforms across its stages, more than the {} "
+                               "GL_MAX_COMBINED_IMAGE_UNIFORMS allows.",
+                               combined, env.params.MaxCombinedImageUniforms);
+        }
+        return {};
+    }
+
     static bool IsBuiltInPipelineOutput(const glslang::TObjectReflection& output) {
         const auto* type = output.getType();
         return type && type->getQualifier().builtIn != glslang::EbvNone;
@@ -309,6 +549,20 @@ namespace MobileGL::MG_State::GLState {
 
         MGLOG_D("ProgramObject %u: Link body start, shaders to link: %zu", in.externalIndex, in.shaders.size());
 
+        if (!ValidateAttachedShaders()) return;
+
+        // The two merges below read the COMPILE snapshots only - no parsed shader - so they
+        // run before the L1 probe, which needs the merged opaque bindings in its key.
+        MergeShaderSideChannels();
+        if (!artifacts.infoLog.empty()) return; // a conflicting explicit uniform location
+
+        // ---- L1 of the shader translation memo ----
+        // Everything below this point - the parse, the link, mapIO, GlslangToSpv, spirv-opt,
+        // buildReflection and the global-UBO routing - is what a hit skips. See
+        // ProgramTranslationCache.h.
+        spirvHandoff.spirvCacheKey = BuildSpirvCacheKey(env);
+        if (TryPublishFromTranslationCache()) return;
+
         Vector<SharedPtr<glslang::TShader>> shaders;
         if (!ConsumeShaders(shaders)) return;
 
@@ -335,30 +589,6 @@ namespace MobileGL::MG_State::GLState {
             }
         }
 
-        // Merge the shaders' lexically extracted explicit uniform locations. The same
-        // uniform declared in several stages must agree on its location (config-A glslang
-        // enforced this at mapIO; the relaxed parse no longer sees the qualifiers).
-        for (const auto& shader : in.shaders) {
-            const ShaderCompileArtifacts& compiled = CompiledArtifacts(shader.compiled);
-            for (const auto& [name, location] : compiled.explicitUniformLocations) {
-                const auto [it, inserted] = artifacts.linkedExplicitUniformLocations.emplace(name, location);
-                if (!inserted && it->second != location) {
-                    artifacts.infoLog = std::format(
-                        "Uniform '{}' is declared with conflicting explicit locations ({} and {}) "
-                        "across stages.",
-                        name, it->second, location);
-                    DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
-                    return;
-                }
-            }
-            // Sampler/image layout(binding = N) initial units, likewise invisible to the
-            // relaxed parse. Stage order matches the old per-stage mapIO capture, so a
-            // name declared in several stages keeps the last stage's binding as before.
-            for (const auto& [name, binding] : compiled.explicitOpaqueBindings) {
-                artifacts.explicitOpaqueUniformBindings[name] = binding;
-            }
-        }
-
         ProgramAttrib attrib{.shaders = Move(shaders),
                              .explicitVertexInLocations = in.explicitAttribLocations,
                              .explicitFragmentOutLocations = in.explicitFragDataLocation,
@@ -497,14 +727,138 @@ namespace MobileGL::MG_State::GLState {
         spirvHandoff.reflection.uniformIndexInTProgram = artifacts.uniformIndexInTProgram;
         spirvHandoff.reflection.tProgramUniformIndexToGl = artifacts.tProgramUniformIndexToGl;
         spirvHandoff.reflection.maxUniformLocation = artifacts.maxUniformLocation;
+        // The owned reflection mirror, and the block index space its global-UBO test needs.
+        // BuildGlobalUboRouting reads BOTH - per-uniform array size, opaqueness, GL type and
+        // matrix shape, plus "is this a member of a GL-visible block". Leaving them out of the
+        // handoff is not a compile error, it is a SILENT one: every array collapses to a
+        // single element and every element past the first falls through to the fallback tail
+        // allocator (ProgramTest.NestedStructArrayUniformElementWrites catches exactly that).
+        spirvHandoff.reflection.uniformReflection = artifacts.uniformReflection;
+        spirvHandoff.reflection.blockReflection = artifacts.blockReflection;
+        spirvHandoff.reflection.tProgramBlockIndexToGl = artifacts.tProgramBlockIndexToGl;
+        // Phase B pairs this with its own SpirvArtifacts to insert the completed front end.
+        // A COPY, because the GL-thread join moves `artifacts` out of this node before phase B
+        // runs - and with the TProgram dropped, because a memo must never hold a glslang arena.
+        if (spirvHandoff.spirvCacheKey.Valid()) {
+            auto forCache = MakeShared<ProgramObject::LinkArtifacts>(artifacts);
+            forCache->program.reset();
+            spirvHandoff.linkArtifactsForCache = Move(forCache);
+        }
         spirvHandoff.ready = true;
         MGLOG_D("ProgramObject %u: phase A done, %zu module(s) handed to the SPIR-V job", in.externalIndex,
                 spirvHandoff.shaderTypes.size());
     }
 
-    Bool ProgramLinkTask::ConsumeShaders(Vector<SharedPtr<glslang::TShader>>& outShaders) {
-        outShaders.assign(in.shaders.size(), nullptr);
+    // The L1 key. Every input below is one that can change the SPIR-V this program
+    // generates; see the key inventory on SpirvTranslationKeyInputs.
+    //
+    // Deliberately NOT keyed on: nothing that only steers a BACKEND transpile - see the
+    // classification on CompileEnv::frontendFingerprint, and L2's own key in
+    // MG_Util/ShaderTranspiler/TranslationCache.h.
+    MG_Util::ShaderTranspiler::TranslationCacheKey ProgramLinkTask::BuildSpirvCacheKey(
+        const MG_Util::ShaderTranspiler::CompileEnv& env) const {
+        using namespace MG_Util::ShaderTranspiler;
+        if (!ShaderTranslationCacheEnabled()) return {};
 
+        SpirvTranslationKeyInputs keyInputs;
+        // The FRONT-END fingerprint, not env.fingerprint: L1 must be shared by two contexts
+        // on different GPUs whenever glslang would produce the same thing for them. See the
+        // classification on CompileEnv::frontendFingerprint.
+        keyInputs.frontendFingerprint = env.frontendFingerprint;
+        // Always 0 on both production parse paths (ShaderCompileTask::RunCompilePipeline and
+        // ClaimParsedShader's re-parse). In the key regardless, so that a future non-zero
+        // value cannot alias a module parsed without it.
+        keyInputs.shaderCompileFlags = 0;
+        keyInputs.enableSpirvValidation = in.enableSpirvValidation;
+        keyInputs.stages.reserve(in.shaders.size());
+        for (const LinkShaderInput& shader : in.shaders) {
+            const ShaderCompileArtifacts& compiled = CompiledArtifacts(shader.compiled);
+            if (compiled.preprocessedSource.empty()) {
+                // No text to key on - an internal shader object, or an artifact this build
+                // did not populate. Refuse to key rather than key on nothing.
+                return {};
+            }
+            keyInputs.stages.push_back(SpirvTranslationKeyInputs::Stage{
+                .type = MG_Util::ConvertShaderStageToGLEnum(shader.stage),
+                .preprocessedSource = StringView(compiled.preprocessedSource)});
+        }
+        if (keyInputs.stages.empty()) return {};
+        keyInputs.explicitVertexInLocations = &in.explicitAttribLocations;
+        keyInputs.explicitFragmentOutLocations = &in.explicitFragDataLocation;
+        keyInputs.explicitFragmentOutIndices = &in.explicitFragDataIndex;
+        keyInputs.explicitOpaqueUniformBindings = &artifacts.explicitOpaqueUniformBindings;
+        // In the key ONLY because the payload now carries the reflection: transform feedback
+        // is resolved by reading the linked intermediates and never perturbs the generated
+        // SPIR-V, but it does shape xfbVaryings / xfbStrides / xfbBufferMode /
+        // gsStripTriangles, and maxFragmentOutputColorNumber decides whether the link is
+        // rejected at all. Widening a payload means widening the key.
+        keyInputs.requestedXfbVaryings = &in.requestedXfbVaryings;
+        keyInputs.xfbBufferMode = static_cast<Uint32>(in.requestedXfbBufferMode);
+        keyInputs.maxFragmentOutputColorNumber = in.maxFragmentOutputColorNumber;
+        return BuildSpirvTranslationKey(keyInputs);
+    }
+
+    // The link rejections that need nothing but the compile snapshots. They run before the
+    // L1 memo is consulted, so a hit can never paper over a program that must fail to link.
+    // The two lexical side channels the relaxed parse cannot provide, merged across stages:
+    // explicit default-block uniform locations (which must agree, or the link fails) and
+    // sampler/image layout(binding = N) initial units. Reads the COMPILE snapshots only, so
+    // it is legal - and necessary - before any shader is parsed: the merged bindings are part
+    // of the L1 memo key.
+    void ProgramLinkTask::MergeShaderSideChannels() {
+        // Merge the shaders' lexically extracted explicit uniform locations. The same
+        // uniform declared in several stages must agree on its location (config-A glslang
+        // enforced this at mapIO; the relaxed parse no longer sees the qualifiers).
+        for (const auto& shader : in.shaders) {
+            const ShaderCompileArtifacts& compiled = CompiledArtifacts(shader.compiled);
+            for (const auto& [name, location] : compiled.explicitUniformLocations) {
+                const auto [it, inserted] = artifacts.linkedExplicitUniformLocations.emplace(name, location);
+                if (!inserted && it->second != location) {
+                    artifacts.infoLog = std::format(
+                        "Uniform '{}' is declared with conflicting explicit locations ({} and {}) "
+                        "across stages.",
+                        name, it->second, location);
+                    DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
+                    return;
+                }
+            }
+            // Sampler/image layout(binding = N) initial units, likewise invisible to the
+            // relaxed parse. Stage order matches the old per-stage mapIO capture, so a
+            // name declared in several stages keeps the last stage's binding as before.
+            for (const auto& [name, binding] : compiled.explicitOpaqueBindings) {
+                artifacts.explicitOpaqueUniformBindings[name] = binding;
+            }
+        }
+
+    }
+
+    // An L1 hit: the entire front end, published without constructing a TShader or a
+    // TProgram. Everything here is a copy out of plain owned data - `link.program` is null in
+    // the payload by construction, and nothing reads it any more.
+    Bool ProgramLinkTask::TryPublishFromTranslationCache() {
+        if (!spirvHandoff.spirvCacheKey.Valid()) return false;
+        const ProgramTranslationResultPtr hit =
+            GetProgramTranslationCache().Find(spirvHandoff.spirvCacheKey);
+        if (!hit) return false;
+
+        artifacts = hit->link;
+        spirvHandoff.shaderTypes.resize(in.shaders.size());
+        for (SizeT i = 0; i < in.shaders.size(); i++) {
+            spirvHandoff.shaderTypes[i] = MG_Util::ConvertShaderStageToGLEnum(in.shaders[i].stage);
+        }
+        // An ALIASING SharedPtr: it points at the payload's SpirvArtifacts while sharing
+        // ownership of the whole payload, so phase B publishes them without a second copy and
+        // without any chance of the entry being evicted from under it.
+        spirvHandoff.cachedSpirv =
+            SharedPtr<const ProgramObject::SpirvArtifacts>(hit, &hit->spirv);
+        spirvHandoff.ready = true;
+        MGLOG_D("ProgramObject %u: L1 cache hit - the whole front end was reused; no parse, no "
+                "link, no SPIR-V generation",
+                in.externalIndex);
+        return true;
+    }
+
+    Bool ProgramLinkTask::ValidateAttachedShaders() {
         // GL 4.6 core 7.3: a compute shader may only be linked with other compute shaders -
         // the compute pipeline has no other stages to link against, so a program that mixes
         // them must fail to link (KHR-GL43.compute_shader.api-program).
@@ -526,8 +880,6 @@ namespace MobileGL::MG_State::GLState {
             const LinkShaderInput& input = in.shaders[i];
             const GLenum shaderType = MG_Util::ConvertShaderStageToGLEnum(input.stage);
             const ShaderCompileArtifacts& compiled = CompiledArtifacts(input.compiled);
-            MGLOG_D("ProgramObject %u: Preparing shader[%zu] stage %s", in.externalIndex, i,
-                    MG_Util::ConvertGLEnumToString(shaderType).c_str());
 
             if (!compiled.compileStatus) {
                 // The compile log LEADS the quoted source, and that order is load-bearing:
@@ -546,6 +898,17 @@ namespace MobileGL::MG_State::GLState {
                                      in.externalIndex, i, artifacts.infoLog));
                 return false;
             }
+        }
+        return true;
+    }
+
+    Bool ProgramLinkTask::ConsumeShaders(Vector<SharedPtr<glslang::TShader>>& outShaders) {
+        outShaders.assign(in.shaders.size(), nullptr);
+        for (SizeT i = 0; i < in.shaders.size(); i++) {
+            const LinkShaderInput& input = in.shaders[i];
+            const GLenum shaderType = MG_Util::ConvertShaderStageToGLEnum(input.stage);
+            MGLOG_D("ProgramObject %u: Preparing shader[%zu] stage %s", in.externalIndex, i,
+                    MG_Util::ConvertGLEnumToString(shaderType).c_str());
             String reparseLog;
             outShaders[i] = input.compiled->ClaimParsedShader(reparseLog);
             if (!outShaders[i]) {
@@ -606,6 +969,22 @@ namespace MobileGL::MG_State::GLState {
             return false;
         }
 
+        if (String atomicCounterError = ValidateAtomicCounterLayout(*artifacts.program);
+            !atomicCounterError.empty()) {
+            artifacts.infoLog = Move(atomicCounterError);
+            DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
+            ProgramObject::ResetLinkArtifacts(artifacts);
+            return false;
+        }
+
+        if (String imageUniformError = ValidateImageUniformLimits(*artifacts.program, env);
+            !imageUniformError.empty()) {
+            artifacts.infoLog = Move(imageUniformError);
+            DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
+            ProgramObject::ResetLinkArtifacts(artifacts);
+            return false;
+        }
+
         // ---------- GL-facing index spaces (relaxed-parse cleanup) ----------
         // Blocks first: global-UBO membership drives the uniform filter below. The
         // synthesized MGL_GLOBAL_UBO is a transpiler artifact - its members are GL
@@ -658,7 +1037,16 @@ namespace MobileGL::MG_State::GLState {
         //    MGL_GLOBAL_UBO, so reflection cannot provide them ("source-explicit");
         //  - glslang's layoutLocation() for opaque uniforms, where the qualifier
         //    survives the relaxed parse (and mapIO auto-assigns the rest).
-        constexpr Uint kNoLocation = glslang::TQualifier::layoutLocationEnd;
+        //
+        // "no effective location yet". Deliberately OUTSIDE the location space rather than
+        // glslang::TQualifier::layoutLocationEnd, which is the first location past the pool and
+        // therefore only one off a legal one - a sentinel that sits at the boundary it guards has
+        // to be re-proved safe every time the ceiling moves, and glslang uses that same value for
+        // "this opaque uniform has no location" as well.
+        constexpr Uint kNoLocation = ~static_cast<Uint>(0);
+        // The ceiling glGetIntegerv(GL_MAX_UNIFORM_LOCATIONS) advertises, which is what the
+        // allocator below has to honour: locations 0..kMaxUniformLocations-1 and no others.
+        constexpr Uint kMaxUniformLocations = static_cast<Uint>(ProgramObject::MAX_UNIFORM_LOCATIONS);
         Vector<Uint> effectiveLocation(tProgramUniformCount, kNoLocation);
         Vector<Bool> locationIsSourceExplicit(tProgramUniformCount, false);
         UnorderedMap<String, Uint> structExplicitCursor; // declared root -> next member location
@@ -695,13 +1083,19 @@ namespace MobileGL::MG_State::GLState {
                     cursor->second += static_cast<Uint>(GetUniformLocationSpan(uniform));
                 }
             }
-            if (effectiveLocation[i] == kNoLocation && type != nullptr && type->isOpaque()) {
+            // glslang parks "no location" at layoutLocationEnd, which is a real location in this
+            // table's numbering - test for it explicitly rather than letting it through as one.
+            if (effectiveLocation[i] == kNoLocation && type != nullptr && type->isOpaque() &&
+                uniform.layoutLocation() != glslang::TQualifier::layoutLocationEnd) {
                 effectiveLocation[i] = uniform.layoutLocation();
             }
             if (locationIsSourceExplicit[i] &&
-                effectiveLocation[i] + static_cast<Uint>(GetUniformLocationSpan(uniform)) > kNoLocation) {
+                effectiveLocation[i] + static_cast<Uint>(GetUniformLocationSpan(uniform)) > kMaxUniformLocations) {
                 // Config A rejected out-of-range explicit locations at parse; keep them
-                // from growing the location table unboundedly.
+                // from growing the location table unboundedly. Stated against the advertised
+                // GL_MAX_UNIFORM_LOCATIONS, because that is the rule being enforced (GL 4.6 core
+                // 7.6.1): an array whose LAST element passes the ceiling is a link error even
+                // though its base compiled fine.
                 artifacts.infoLog = std::format("Uniform '{}' explicit location {} is out of range.", uniform.name,
                                                 effectiveLocation[i]);
                 ProgramObject::ResetLinkArtifacts(artifacts);
@@ -709,12 +1103,55 @@ namespace MobileGL::MG_State::GLState {
             }
         }
 
-        Int requiredUniformLocations = 0;
+        // ARB_explicit_uniform_location / GL 4.6 core 7.6.1: an explicit location is RESERVED
+        // whether or not the uniform turned out to be active. The dead default-block uniforms
+        // filtered out of glUniformIndexToTProgram above are invisible to every GL query - which
+        // is correct - but their locations must still be kept out of the implicit allocator's
+        // reach, or an implicit uniform is handed a location the source already claimed.
+        //
+        // Deliberately NOT written into artifacts.uniformLocations or uniformIndexInTProgram:
+        // glGetUniformLocation must keep answering -1 for a dead uniform, and a location no
+        // application can legally obtain must not become writable through glUniform*. The
+        // occupancy therefore lives in its own bitset, built once the table has been sized.
+        Vector<Pair<Uint, Int>> deadExplicitReservations;
+        Int deadReservedLocationCount = 0;
+        for (Int i = 0; i < tProgramUniformCount; i++) {
+            if (artifacts.tProgramUniformIndexToGl[i] >= 0) continue; // GL-visible: handled above
+            const auto& uniform = artifacts.program->getUniform(i);
+            if (!isGlobalUboMember(uniform) || uniform.stages != 0) continue;
+            const Int* explicitLocation = findExplicitLocation(uniform.name);
+            if (explicitLocation == nullptr) continue;
+
+            const Uint location = static_cast<Uint>(*explicitLocation);
+            const Int locationSpan = GetUniformLocationSpan(uniform);
+            if (location + static_cast<Uint>(locationSpan) > kMaxUniformLocations) {
+                artifacts.infoLog = std::format("Uniform '{}' explicit location {} is out of range.", uniform.name,
+                                                location);
+                ProgramObject::ResetLinkArtifacts(artifacts);
+                return false;
+            }
+            deadExplicitReservations.emplace_back(location, locationSpan);
+            deadReservedLocationCount += locationSpan;
+            artifacts.maxUniformLocation = std::max(artifacts.maxUniformLocation, location + locationSpan - 1);
+            MGLOG_D("ProgramObject %u: Reflection - inactive uniform '%s' reserves locations %u..%u without "
+                    "becoming GL-visible",
+                    in.externalIndex, uniform.name.c_str(), location, location + locationSpan - 1);
+        }
+
+        Int requiredUniformLocations = deadReservedLocationCount;
+        // The same count restricted to DEFAULT-BLOCK uniforms, which is the only thing
+        // GL_MAX_UNIFORM_LOCATIONS bounds. requiredUniformLocations cannot serve: it also carries
+        // named-block members, which take a slot in this allocator's table (an implementation
+        // detail) but consume no GL uniform location at all, so a big UBO array would otherwise
+        // fail a link the spec allows.
+        Int defaultBlockLocationDemand = deadReservedLocationCount;
         for (const Int i : artifacts.glUniformIndexToTProgram) {
             auto& uniform = artifacts.program->getUniform(i);
             const Uint location = effectiveLocation[i];
             const Int locationSpan = GetUniformLocationSpan(uniform);
             requiredUniformLocations += locationSpan;
+            const Bool inNamedBlock = uniform.index >= 0 && !isGlobalUboMember(uniform);
+            if (!inNamedBlock) defaultBlockLocationDemand += locationSpan;
             if (location != kNoLocation) {
                 artifacts.maxUniformLocation = std::max(artifacts.maxUniformLocation, location + locationSpan - 1);
             }
@@ -727,6 +1164,22 @@ namespace MobileGL::MG_State::GLState {
         MGLOG_D("ProgramObject %u: Reflection - computed maxUniformLocation=%u uniformNameMaxLength=%d",
                 in.externalIndex, artifacts.maxUniformLocation, artifacts.uniformNameMaxLength);
 
+        // GL 4.6 core 7.6.1: explicit, implicit and reserved-but-inactive default-block uniforms
+        // all draw from the one GL_MAX_UNIFORM_LOCATIONS pool, and a program asking for more than
+        // the implementation advertises FAILS TO LINK
+        // (KHR-GL43.explicit_uniform_location.uniform-loc-negative-link-max-num-of-locations).
+        // A single uniform whose own span passes the ceiling was already rejected above; this is
+        // the aggregate half of the same rule.
+        if (defaultBlockLocationDemand > static_cast<Int>(kMaxUniformLocations)) {
+            artifacts.infoLog =
+                std::format("Uniform locations exhausted: the default-block uniforms need {} locations but "
+                            "GL_MAX_UNIFORM_LOCATIONS is {}.",
+                            defaultBlockLocationDemand, kMaxUniformLocations);
+            DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
+            ProgramObject::ResetLinkArtifacts(artifacts);
+            return false;
+        }
+
         if (artifacts.maxUniformLocation + 1 < requiredUniformLocations) {
             MGLOG_D("ProgramObject %u: Reflection - maxUniformLocation+1 (%u) < requiredUniformLocations (%d), "
                     "adjusting",
@@ -741,6 +1194,27 @@ namespace MobileGL::MG_State::GLState {
                                                 glslang::TQualifier::layoutLocationEnd);
         artifacts.uniformSamplerOrImageUnitIndex.resize(artifacts.maxUniformLocation + 1, -1);
 
+        // Occupancy for the inactive explicit uniforms collected above: a set bit means "the
+        // source claimed this location", which is enough to keep the two implicit passes off it
+        // without making the location reachable through any GL entry point. A location the
+        // fallback grow path mints later is past this bitset by construction (every reservation
+        // was folded into maxUniformLocation before the table was sized), so the lookup treats
+        // out-of-range as free rather than resizing in lockstep.
+        // Left empty - and unallocated - when nothing reserved anything, which is every program in
+        // the shader-pack corpus; the lookup below reads an empty bitset as "nothing is reserved".
+        Vector<Bool> reservedLocation;
+        if (!deadExplicitReservations.empty()) {
+            reservedLocation.assign(artifacts.maxUniformLocation + 1, false);
+            for (const auto& [reservedBase, reservedSpan] : deadExplicitReservations) {
+                for (Int element = 0; element < reservedSpan; ++element) {
+                    reservedLocation[reservedBase + element] = true;
+                }
+            }
+        }
+        const auto locationIsReserved = [&reservedLocation](SizeT location) {
+            return location < reservedLocation.size() && reservedLocation[location];
+        };
+
         Vector<int> unallocatedUniformIndex;
 
         // Pass 1: source-explicit locations. These are API contract
@@ -785,7 +1259,8 @@ namespace MobileGL::MG_State::GLState {
             Bool spanIsFree = location + locationSpan - 1 <= artifacts.maxUniformLocation;
             for (Int element = 0; spanIsFree && element < locationSpan; ++element) {
                 spanIsFree =
-                    artifacts.uniformIndexInTProgram[location + element] == glslang::TQualifier::layoutLocationEnd;
+                    artifacts.uniformIndexInTProgram[location + element] == glslang::TQualifier::layoutLocationEnd &&
+                    !locationIsReserved(location + element);
             }
             if (!spanIsFree) {
                 artifacts.uniformLocations[uniform.name] = kNoLocation;
@@ -817,7 +1292,8 @@ namespace MobileGL::MG_State::GLState {
                 bool hasRoom = locNeedle + locationSpan - 1 <= artifacts.maxUniformLocation;
                 for (Int element = 0; hasRoom && element < locationSpan; ++element) {
                     hasRoom = artifacts.uniformIndexInTProgram[locNeedle + element] ==
-                              glslang::TQualifier::layoutLocationEnd;
+                                  glslang::TQualifier::layoutLocationEnd &&
+                              !locationIsReserved(locNeedle + element);
                 }
                 if (!hasRoom) continue;
                 // Found a vacant location at locNeedle
@@ -837,6 +1313,24 @@ namespace MobileGL::MG_State::GLState {
                 // span is left; grow the table instead of leaving the uniform without
                 // a location (which would make it unsettable via glUniform*).
                 const SizeT base = artifacts.uniformIndexInTProgram.size();
+                // The growth stops at the pool GL advertises. GL 4.6 core 7.6.1 bounds every
+                // uniform location by GL_MAX_UNIFORM_LOCATIONS, and the conformance suite reads a
+                // returned location >= the advertised maximum as a failure outright
+                // (KHR-GLES31.explicit_uniform_location.uniform-loc-mix-with-implicit-max). Minting
+                // 4095, 4096, ... is strictly worse than refusing: those are locations no
+                // application may legally name and no later query can make legal, so they would
+                // only turn a link-time exhaustion into a silently unwritable uniform. Unreachable
+                // for any program that fits glslang's per-stage uniform-component limits - it takes
+                // a fragmented pool of thousands of explicitly-located slots to get here.
+                if (base + static_cast<SizeT>(locationSpan) > kMaxUniformLocations) {
+                    artifacts.infoLog = std::format(
+                        "Uniform locations exhausted: '{}' needs {} location(s) and no free span is left below "
+                        "GL_MAX_UNIFORM_LOCATIONS ({}).",
+                        uniform.name, locationSpan, kMaxUniformLocations);
+                    DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
+                    ProgramObject::ResetLinkArtifacts(artifacts);
+                    return false;
+                }
                 artifacts.uniformIndexInTProgram.resize(base + locationSpan,
                                                         glslang::TQualifier::layoutLocationEnd);
                 artifacts.uniformSamplerOrImageUnitIndex.resize(base + locationSpan, -1);
@@ -987,9 +1481,78 @@ namespace MobileGL::MG_State::GLState {
             MGLOG_D("ProgramObject %u: Reflection - UBO[%d] name='%s' size=%u binding=%d", in.externalIndex, i,
                     ubo.name.c_str(), ubo.size, ubo.getBinding());
         }
+
+        SnapshotGlslangReflection();
         return true;
     }
 
+    // The last thing DoReflection does, and the thing that lets everything after it stop
+    // caring that a glslang::TProgram ever existed: copy every reflection record the GL query
+    // surface reads into LinkArtifacts' own owned tables.
+    //
+    // Indexed by TPROGRAM index throughout - the same space glUniformIndexToTProgram,
+    // tProgramUniformIndexToGl and uniformIndexInTProgram already speak - so the accessors
+    // that used to call program->getUniform(i) index uniformReflection[i] and are otherwise
+    // unchanged.
+    void ProgramLinkTask::SnapshotGlslangReflection() {
+        glslang::TProgram& program = *artifacts.program;
+
+        // Blocks FIRST: a uniform's effective layoutMatrix is resolved against its owning
+        // block below, which needs the block records to already exist.
+        const Int blockCount = program.getNumUniformBlocks();
+        artifacts.blockReflection.clear();
+        artifacts.blockReflection.reserve(static_cast<SizeT>(blockCount));
+        for (Int i = 0; i < blockCount; ++i) {
+            artifacts.blockReflection.push_back(MakeResourceReflection(program.getUniformBlock(i)));
+        }
+
+        const Int uniformCount = program.getNumUniformVariables();
+        artifacts.uniformReflection.clear();
+        artifacts.uniformReflection.reserve(static_cast<SizeT>(uniformCount));
+        artifacts.uniformIndexByName.clear();
+        artifacts.uniformIndexByName.reserve(static_cast<SizeT>(uniformCount));
+        for (Int i = 0; i < uniformCount; ++i) {
+            ProgramObject::UniformReflection record = MakeResourceReflection(program.getUniform(i));
+            // A block-level layout(row_major)/(column_major) that the member did not inherit
+            // in its own qualifier. Resolved once HERE rather than at every GL_UNIFORM_* query,
+            // which is what the getUniformBlock() fallback in the old accessors was doing.
+            if (record.type.layoutMatrix == static_cast<Int>(glslang::ElmNone) && record.index >= 0 &&
+                record.index < static_cast<Int>(artifacts.blockReflection.size())) {
+                record.type.layoutMatrix = artifacts.blockReflection[record.index].type.layoutMatrix;
+            }
+            // Keyed on the REFLECTED name and on uniforms only. That is deliberate and is the
+            // filtered semantics the old code hand-rolled: glslang's TReflection::nameToIndex
+            // also holds block and function entries, which is exactly why every
+            // getUniformIndex() call site re-checked getUniform(idx).name == name afterwards.
+            // First writer wins, so a duplicated name resolves the way a forward scan would.
+            artifacts.uniformIndexByName.emplace(record.name, i);
+            artifacts.uniformReflection.push_back(Move(record));
+        }
+
+        const Int pipeInputCount = program.getNumPipeInputs();
+        artifacts.pipeInputReflection.clear();
+        artifacts.pipeInputReflection.reserve(static_cast<SizeT>(pipeInputCount));
+        for (Int i = 0; i < pipeInputCount; ++i) {
+            artifacts.pipeInputReflection.push_back(MakeResourceReflection(program.getPipeInput(i)));
+        }
+
+        const Int pipeOutputCount = program.getNumPipeOutputs();
+        artifacts.pipeOutputReflection.clear();
+        artifacts.pipeOutputReflection.reserve(static_cast<SizeT>(pipeOutputCount));
+        for (Int i = 0; i < pipeOutputCount; ++i) {
+            artifacts.pipeOutputReflection.push_back(MakeResourceReflection(program.getPipeOutput(i)));
+        }
+
+        artifacts.lastStageIsFragment = program.getIntermediate(EShLangFragment) != nullptr;
+        for (Uint dim = 0; dim < 3u; ++dim) {
+            artifacts.computeLocalSize[dim] = program.getLocalSize(static_cast<Int>(dim));
+        }
+        MGLOG_D("ProgramObject %u: Reflection - snapshot: %zu uniform(s), %zu block(s), %zu input(s), "
+                "%zu output(s)",
+                in.externalIndex, artifacts.uniformReflection.size(), artifacts.blockReflection.size(),
+                artifacts.pipeInputReflection.size(), artifacts.pipeOutputReflection.size());
+    }
+
     Bool ProgramLinkTask::ValidateFragmentOutputLocations() {
         if (!artifacts.program) return false;
         // The pipe-output list is the output interface of the program's LAST stage. Only a

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.h

@@ -12,6 +12,7 @@
 #include <MG_State/GLState/ProgramState/ShaderCompileTask.h>
 #include <MG_Util/Async/JobNode.h>
 #include <MG_Util/ShaderTranspiler/CompileEnv.h>
+#include <MG_Util/ShaderTranspiler/TranslationCache.h>
 
 namespace MobileGL::MG_State::GLState {
     // One attached shader, as the link sees it: never the ShaderObject, always a snapshot.
@@ -60,6 +61,8 @@ namespace MobileGL::MG_State::GLState {
             Uint externalIndex = 0; // logs only
             Vector<LinkShaderInput> shaders; // already stage-sorted
             SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env;
+            // Startup configuration copied with the task, never read from worker code.
+            Bool enableSpirvValidation = false;
             // The four "takes effect at the next link" request maps. Snapshotted rather than
             // referenced, which is precisely what makes glBindAttribLocation and friends
             // legal to call over a pending link without cancelling it: the pending link keeps
@@ -114,6 +117,27 @@ namespace MobileGL::MG_State::GLState {
             // for phase B after the join has moved `artifacts` away.
             ProgramObject::LinkArtifacts reflection;
 
+            // L1 shader-translation memo key for this program's SPIR-V (see
+            // MG_Util/ShaderTranspiler/TranslationCache.h). Built HERE, at the tail of phase
+            // A, and not by phase B - two reasons, both structural:
+            //   * the key covers the four link-time request maps and the merged opaque
+            //     bindings, and one of those (explicitOpaqueUniformBindings) lives in
+            //     `artifacts`, which phase B is forbidden to read because the GL-thread join
+            //     moves it out from under phase B;
+            //   * built once, it serves both the lookup and the insert, so the program's
+            //     sources are copied into the blob exactly once per link.
+            // Invalid (null blob) when the cache is disabled, or when a stage arrived
+            // without preprocessed source - in which case phase B simply translates.
+            MG_Util::ShaderTranspiler::TranslationCacheKey spirvCacheKey;
+
+            // Set on an L1 HIT: phase B publishes these SpirvArtifacts verbatim instead of
+            // generating anything. Null on a miss.
+            SharedPtr<const ProgramObject::SpirvArtifacts> cachedSpirv;
+            // Set on a MISS: the LinkArtifacts phase B has to pair with its own SpirvArtifacts
+            // to insert the completed front end. Copied here rather than read off the node,
+            // because the GL-thread join MOVES `artifacts` out before phase B runs.
+            SharedPtr<const ProgramObject::LinkArtifacts> linkArtifactsForCache;
+
             // The one flag phase B tests before doing anything: false means this link never
             // reached the tail of RunBody (it failed, or was cancelled mid-body).
             Bool ready = false;
@@ -140,8 +164,31 @@ namespace MobileGL::MG_State::GLState {
         // ---- the link body, split exactly as ProgramObject::Link() had it ----
         // Each returns false to abort the link with `artifacts.infoLog` already set, which is
         // GL's definition of a failed link: LINK_STATUS false plus a log, never a GL error.
+        // The two link-rejection gates that need no parsed shader: a compute stage mixed
+        // with any other, and an attached shader that failed to compile. Split out of
+        // ConsumeShaders so they still run - in the same order, with the same diagnostics -
+        // BEFORE the L1 memo is consulted, rather than behind a hit that would skip them.
+        // The two lexical side channels the relaxed parse cannot provide, merged across
+        // stages. Reads the compile snapshots only, so it runs before any parse - the merged
+        // opaque bindings are part of the L1 memo key. Sets artifacts.infoLog and leaves
+        // linkStatus false when two stages disagree on an explicit uniform location.
+        void MergeShaderSideChannels();
+        Bool ValidateAttachedShaders();
         Bool ConsumeShaders(Vector<SharedPtr<glslang::TShader>>& outShaders);
+        // Publishes a whole front end straight out of the L1 memo: no TShader, no TProgram,
+        // no SPIR-V generation. Returns false on a miss.
+        Bool TryPublishFromTranslationCache();
+
+        // The L1 memo key for the SPIR-V this program is about to generate, or an invalid
+        // key when the cache is off or a stage has no preprocessed source to key on.
+        // Called at the tail of RunBody, where every input it needs is still owned by this
+        // node and `artifacts` has not yet been published.
+        MG_Util::ShaderTranspiler::TranslationCacheKey BuildSpirvCacheKey(
+            const MG_Util::ShaderTranspiler::CompileEnv& env) const;
         Bool DoReflection(const MG_Util::ShaderTranspiler::CompileEnv& env);
+        // Copies every reflection record the GL query surface reads out of the glslang
+        // TProgram into LinkArtifacts own owned tables. Runs at the tail of DoReflection.
+        void SnapshotGlslangReflection();
         Bool ValidateFragmentOutputLocations();
         Bool ResolveTransformFeedbackVaryings();
         void ResolveGsTriangleStripCapture(const glslang::TIntermediate* captureIntermediate);

MobileGL/MG_State/GLState/ProgramState/ProgramObject.cpp

@@ -393,6 +393,14 @@ namespace MobileGL::MG_State::GLState {
         return true;
     }
 
+    bool ProgramObject::AttachShaderWithPinnedLinkInput(const LinkedShaderRef& ref) {
+        if (!AttachShader(ref.shader)) {
+            return false;
+        }
+        m_pinnedLinkInputs[ref.shader.get()] = ref;
+        return true;
+    }
+
     SizeT ProgramObject::DetachShader(const SharedPtr<ShaderObject>& shader) {
         MGLOG_D("DetachShader called for shader %p from ProgramObject %u", shader.get(), m_externalIndex);
         if (!ShaderIsAttached(shader)) {
@@ -475,6 +483,8 @@ namespace MobileGL::MG_State::GLState {
             AddDefaultFragmentShaderIfMissing();
         }
         if (m_shaders.empty()) {
+            // This IS the last link now, and it consumed nothing.
+            m_linkedShaderSnapshot.clear();
             m_artifacts.infoLog = "No shader objects are attached to program.";
             MGLOG_E("ProgramObject %u: Link failed - no shader objects attached.", m_externalIndex);
             return;
@@ -494,6 +504,7 @@ namespace MobileGL::MG_State::GLState {
         auto task = MakeShared<ProgramLinkTask>();
         task->in.externalIndex = m_externalIndex;
         task->in.env = MG_Util::ShaderTranspiler::GetCurrentCompileEnv();
+        task->in.enableSpirvValidation = MG_Config::Features.EnableSpirvValidation;
         task->in.explicitAttribLocations = m_explicitAttribLocations;
         task->in.explicitFragDataLocation = m_explicitFragDataLocation;
         task->in.explicitFragDataIndex = m_explicitFragDataIndex;
@@ -504,8 +515,19 @@ namespace MobileGL::MG_State::GLState {
         Vector<SharedPtr<ShaderCompileTask>> deps;
         deps.reserve(m_shaders.size());
         task->in.shaders.reserve(m_shaders.size());
+        m_linkedShaderSnapshot.clear();
+        m_linkedShaderSnapshot.reserve(m_shaders.size());
         for (const auto& shader : m_shaders) {
-            const SharedPtr<ShaderCompileTask>& node = shader->CompiledNodeForLink();
+            // A pipeline composite pins the (source, node) each stage program's LAST link
+            // consumed (AttachShaderWithPinnedLinkInput); an ordinary program takes the
+            // shader's current ones. Without the pin a post-link recompile would leak a
+            // shader the stage program never linked into the composite.
+            SharedPtr<const String> sourcePtr = shader->GetShaderSourcePtr();
+            SharedPtr<ShaderCompileTask> node = shader->CompiledNodeForLink();
+            if (const auto pinned = m_pinnedLinkInputs.find(shader.get()); pinned != m_pinnedLinkInputs.end()) {
+                sourcePtr = pinned->second.source;
+                node = pinned->second.node;
+            }
             if (node) {
                 // This link is now an observer of that node's result, and the ShaderObject is
                 // no longer the only route to it: without the marker, the ordinary
@@ -514,7 +536,10 @@ namespace MobileGL::MG_State::GLState {
                 node->MarkLinkReferenced();
                 if (!node->IsTerminal()) deps.push_back(node);
             }
-            task->in.shaders.push_back({shader->GetShaderStage(), shader->GetShaderSourcePtr(), node});
+            task->in.shaders.push_back({shader->GetShaderStage(), sourcePtr, node});
+            // What "as last linked" will mean for this program from now on - the pipeline
+            // composite cache rebuilds from exactly this set (GetProgramForDraw).
+            m_linkedShaderSnapshot.push_back({shader, sourcePtr, node});
         }
 
         // Phase B of the same link: SPIR-V generation, spirv-opt and the global-UBO routing
@@ -590,15 +615,22 @@ namespace MobileGL::MG_State::GLState {
 
 
     Int ProgramObject::GetFragmentDataLocation(const char* name) {
-        if (!Artifacts().program || !name) return -1;
+        // Answered from the OWNED pipe-output snapshot, not from Artifacts().program. The live
+        // TProgram is null on a translation-cache L1 hit - that is the entire point of the memo
+        // - and it is also null for any program that never linked. The old `if
+        // (!Artifacts().program) return -1` guard silently produced the never-linked answer for
+        // a perfectly good cached program, so glGetFragDataLocation returned -1 for every
+        // fragment output of it. The empty snapshot gives the never-linked case the same -1
+        // without needing the guard at all.
+        if (!name) return -1;
 
         const auto explicitLocation = Artifacts().linkedFragDataLocation.find(name);
-        const Int outputCount = Artifacts().program->getNumPipeOutputs();
-        for (Int index = 0; index < outputCount; ++index) {
-            const auto& output = Artifacts().program->getPipeOutput(index);
+        for (const PipeOutputReflection& output : Artifacts().pipeOutputReflection) {
             if (output.name != name) continue;
-            if (explicitLocation != Artifacts().linkedFragDataLocation.end()) return static_cast<Int>(explicitLocation->second);
-            return static_cast<Int>(output.layoutLocation());
+            if (explicitLocation != Artifacts().linkedFragDataLocation.end()) {
+                return static_cast<Int>(explicitLocation->second);
+            }
+            return output.location;
         }
         return -1;
     }

MobileGL/MG_State/GLState/ProgramState/ProgramObject.h

@@ -24,6 +24,85 @@ namespace MobileGL::MG_State::GLState {
 
     class ProgramObject {
     public:
+        // GL_MAX_UNIFORM_LOCATIONS: locations 0 .. MAX_UNIFORM_LOCATIONS-1 are the whole legal
+        // range (GL 4.6 core 7.6.1 / ARB_explicit_uniform_location). Shared with GL_Getter rather
+        // than spelled twice, because the link and the query must agree exactly - the CTS declares
+        // a uniform at the advertised value minus one and expects it to link
+        // (KHR-GL43.explicit_uniform_location.uniform-loc-max).
+        //
+        // Tied to glslang's own ceiling and NOT raisable past it: ParseHelper rejects
+        // `layout(location = N)` for N >= TQualifier::layoutLocationEnd at COMPILE time, so
+        // layoutLocationEnd - 1 is the largest location any shader in this stack can declare -
+        // which makes exactly layoutLocationEnd locations, 0 .. layoutLocationEnd - 1, the pool.
+        // Advertising more would promise a location no shader could name. Comfortably above the
+        // 1024 GL 4.3 requires.
+        static constexpr Int MAX_UNIFORM_LOCATIONS = static_cast<Int>(glslang::TQualifier::layoutLocationEnd);
+
+        // Everything the query surface ever asked a glslang::TType, flattened. Twenty
+        // predicates, no recursion: nothing post-link ever walks a struct, a type name or the
+        // AST, so a POD covers the whole surface exactly.
+        struct TypeFacts {
+            Bool isArray = false;
+            // A runtime-sized array (a storage block's unsized trailing member) is an array
+            // that is NOT sized; GL_ARRAY_SIZE reports 0 for it.
+            Bool isSizedArray = false;
+            Bool isMatrix = false;
+            Bool isVector = false;
+            Bool isOpaque = false;
+            Bool isTexture = false;
+            Bool isImage = false;
+            Bool isDouble = false;   // getBasicType() == EbtDouble
+            Bool isVoid = false;     // getBasicType() == EbtVoid (hidden block members)
+            Bool isBuffer = false;   // getQualifier().storage == EvqBuffer
+            Bool isPatch = false;    // getQualifier().patch
+            Bool hasIndex = false;   // getQualifier().hasIndex()
+            Bool hasFormat = false;  // getQualifier().hasFormat()
+            Int vectorSize = 0;
+            Int matrixCols = 0;
+            Int matrixRows = 0;
+            Int layoutIndex = 0;     // getQualifier().layoutIndex
+            Uint layoutFormat = 0;   // getQualifier().getFormat()
+            // glslang::TLayoutMatrix, widened. For a uniform this is already RESOLVED against
+            // the owning block's qualifier, so the getUniformBlock() fallback the old
+            // accessors carried is gone.
+            Int layoutMatrix = 0;
+            // glslang::TBasicType, widened - ApplyUniformInitialValues and the typed
+            // glGetUniform* paths compare against a handful of enumerators.
+            Int basicType = 0;
+        };
+
+        // One glslang::TObjectReflection, flattened. Used for uniforms, blocks, pipe inputs
+        // and pipe outputs alike, because glslang reflects all four as TObjectReflection.
+        struct ResourceReflection {
+            String name;
+            GLenum glDefineType = 0;
+            Int offset = -1;
+            // TObjectReflection::size, RAW. For a uniform prefer `arraySize` below, which is
+            // the resolved GL_UNIFORM_SIZE answer.
+            Int size = 0;
+            // TObjectReflection::index - for a uniform, the TPROGRAM block index owning it
+            // (-1 for a default-block one; translate with GlBlockIndexFromTProgram).
+            Int index = -1;
+            Int counterIndex = -1;
+            Int arrayStride = 0;
+            Int topLevelArraySize = 0;
+            Int topLevelArrayStride = 0;
+            Int binding = -1;
+            Int location = -1; // layoutLocation()
+            // EShLanguageMask of the stages that reference it; 0 means "declared but read by
+            // nobody", which is what the dead-default-block-uniform filter tests.
+            Uint32 stages = 0;
+            // GL_UNIFORM_SIZE / GL_ARRAY_SIZE, already resolved through the
+            // isSizedArray()/getOuterArraySize()/size fallback.
+            GLint arraySize = 1;
+            TypeFacts type;
+        };
+
+        using UniformReflection = ResourceReflection;
+        using BlockReflection = ResourceReflection;
+        using PipeInputReflection = ResourceReflection;
+        using PipeOutputReflection = ResourceReflection;
+
         ProgramObject(Uint externalIndex) : m_externalIndex(externalIndex), m_lifetimeId(AllocateLifetimeId()) {}
         // Cancel-not-join, exactly like ~ShaderObject: the link job owns its inputs, so an
         // in-flight link whose program just went away is safe to abandon where it stands.
@@ -60,6 +139,26 @@ namespace MobileGL::MG_State::GLState {
 
         Vector<SharedPtr<ShaderObject>>& GetAttachedShaders();
         const Vector<SharedPtr<ShaderObject>>& GetAttachedShaders() const;
+
+        // One shader exactly as this program's last Link() consumed it: the object, the
+        // source snapshot, and the compile node taken at that link's enqueue. GL 4.6 7.3/7.4
+        // makes this triple - not the live attach list, not the shader's current compile -
+        // what a program pipeline stage executes ("as last linked"): glAttachShader and
+        // glCompileShader take effect only at the program's next link, yet neither moves
+        // m_linkVersion, so anything keyed on the link generation must consume this
+        // snapshot rather than re-read the live state.
+        struct LinkedShaderRef {
+            SharedPtr<ShaderObject> shader;
+            SharedPtr<const String> source;
+            SharedPtr<ShaderCompileTask> node;
+        };
+        // The last link's full input set; empty when this program has never linked (or its
+        // last link had no shaders attached). GL-thread-owned, rebuilt in Link()'s prologue.
+        const Vector<LinkedShaderRef>& GetLinkedShaderSnapshot() const { return m_linkedShaderSnapshot; }
+        // Pipeline-composite attach: AttachShader plus a pin that makes THIS program's
+        // Link() consume ref's (source, node) instead of the shader's current ones, so a
+        // post-link recompile of the stage program's shader cannot leak into the composite.
+        bool AttachShaderWithPinnedLinkInput(const LinkedShaderRef& ref);
         const String& GetInfoLog() const { return Artifacts().infoLog; }
         // glCreateShaderProgramv folds the shader's compile log into the program's log, which
         // is the only place a caller can read it from once the shader name is gone.
@@ -114,8 +213,7 @@ namespace MobileGL::MG_State::GLState {
             const Int index = Artifacts().uniformIndexInTProgram[base];
             // "[k]" only addresses arrays ("scalar[0]" is not a uniform name), and only
             // in-range elements.
-            const glslang::TType* type = Artifacts().program->getUniform(index).getType();
-            if (type == nullptr || !type->isArray()) return -1;
+            if (!UniformAt(index).type.isArray) return -1;
             if (static_cast<GLint>(element) >= GetUniformArraySizeByTIndex(index)) return -1;
             const Int location = base + (Int)element;
             if (!UniformLocationsAliasSameUniform(base, location)) return -1;
@@ -155,44 +253,38 @@ namespace MobileGL::MG_State::GLState {
         }
 
         Int GetActiveUniformIndex(const String& name) const {
-            const Int tProgramCount = static_cast<Int>(Artifacts().tProgramUniformIndexToGl.size());
-            const Int uniformIndex = Artifacts().program->getUniformIndex(name.c_str());
-            if (uniformIndex >= 0 && uniformIndex < tProgramCount &&
-                Artifacts().program->getUniform(uniformIndex).name == name) {
-                return GlUniformIndexFromTProgram(uniformIndex);
+            // uniformIndexByName is keyed by the REFLECTED name, so a lookup that hits is
+            // already the exact-match the old code re-verified with a string compare after
+            // glslang's getUniformIndex(); a lookup that misses needs no bounds check.
+            const auto& byName = Artifacts().uniformIndexByName;
+            if (const auto direct = byName.find(name); direct != byName.end()) {
+                return GlUniformIndexFromTProgram(direct->second);
             }
 
             // Reflection stores an array uniform under "arr[0]"; accept the bare "arr"
             // spelling too. The reverse ("arr[0]" against a bare "arr" entry) is kept for
             // robustness against non-suffixed reflection entries.
             if (!name.empty() && name.back() != ']') {
-                const String suffixedName = name + "[0]";
-                const Int suffixedIndex = Artifacts().program->getUniformIndex(suffixedName.c_str());
-                if (suffixedIndex >= 0 && suffixedIndex < tProgramCount &&
-                    Artifacts().program->getUniform(suffixedIndex).name == suffixedName) {
-                    return GlUniformIndexFromTProgram(suffixedIndex);
-                }
-                return -1;
+                const auto suffixed = byName.find(name + "[0]");
+                return suffixed != byName.end() ? GlUniformIndexFromTProgram(suffixed->second) : -1;
             }
 
             if (name.length() <= 3 || name.compare(name.length() - 3, 3, "[0]") != 0) return -1;
-            const String baseName = name.substr(0, name.length() - 3);
-            const Int baseIndex = Artifacts().program->getUniformIndex(baseName.c_str());
-            if (baseIndex < 0 || baseIndex >= tProgramCount) return -1;
-            return Artifacts().program->getUniform(baseIndex).name == baseName ? GlUniformIndexFromTProgram(baseIndex)
-                                                                     : -1;
+            const auto base = byName.find(name.substr(0, name.length() - 3));
+            return base != byName.end() ? GlUniformIndexFromTProgram(base->second) : -1;
         }
 
         Bool IsValidUniformLocation(Int location) const { return IsValidUniformLocation(Artifacts(), location); }
 
         GLenum GetUniformType(Uint location) const {
-            auto& uniform = Artifacts().program->getUniform(Artifacts().uniformIndexInTProgram[location]);
-            return uniform.glDefineType;
+            return UniformAt(Artifacts().uniformIndexInTProgram[location]).glDefineType;
         }
 
         GLenum GetActiveUniformType(Uint index) const {
-            auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
-            return uniform.glDefineType;
+            // The lowered counter is a plain uint inside a synthesized block; what the GL
+            // client declared - and what glGetActiveUniform must report - is an atomic_uint.
+            if (IsActiveUniformAtomicCounter(index)) return GL_UNSIGNED_INT_ATOMIC_COUNTER;
+            return UniformAt(TProgramUniformIndex(index)).glDefineType;
         }
 
         // Number of active array elements (GL_UNIFORM_SIZE / GL_ARRAY_SIZE); 1 for a non-array.
@@ -209,16 +301,62 @@ namespace MobileGL::MG_State::GLState {
         }
 
         Int GetActiveUniformBlockIndex(Uint index) const {
-            auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
+            // An atomic counter is a DEFAULT-BLOCK uniform to GL, whatever block the
+            // transpiler lowered it onto (GL 4.6 core 7.6, table 7.6): -1.
+            if (IsActiveUniformAtomicCounter(index)) return -1;
             // Members of the synthesized global UBO are default-block uniforms to GL: -1.
-            return GlBlockIndexFromTProgram(uniform.index);
+            return GlBlockIndexFromTProgram(UniformAt(TProgramUniformIndex(index)).index);
+        }
+
+        // The transpiler lowers every atomic_uint onto a synthesized gl_AtomicCounterBlock_N
+        // block, but GL keeps seeing an atomic counter as a default-block uniform of type
+        // GL_UNSIGNED_INT_ATOMIC_COUNTER that points at an atomic-counter BUFFER. These two
+        // answer for that GL-level declaration; without them the query surface reports the
+        // lowering instead (GL_UNSIGNED_INT, block index 0) and
+        // KHR-GL43.shader_atomic_counters.basic-program-query fails on both.
+        //
+        // The returned value is an index into the GL_ACTIVE_ATOMIC_COUNTER_BUFFERS list, i.e.
+        // the RANK of the owning counter block among the counter blocks in glslang's block
+        // order - exactly how ProgramInterface numbers the GL_ATOMIC_COUNTER_BUFFER
+        // resources glGetActiveAtomicCounterBufferiv answers from. -1 when this uniform is
+        // not an atomic counter.
+        // Answered from the OWNED reflection snapshot, never from Artifacts().program. This
+        // arrived reading the live TProgram, which is null for every program served from the
+        // translation cache's L1 - and unlike the other query-surface accessors that made the
+        // same mistake, this one DEREFERENCES it, so the second program built from a given set
+        // of sources would have taken the process down rather than answered wrongly. The
+        // snapshot carries the same three facts in the same TPROGRAM index space:
+        // getUniform(i).index -> UniformAt(i).index, getNumUniformBlocks() ->
+        // blockReflection.size(), getUniformBlock(i).name -> BlockAt(i).name.
+        Int GetActiveUniformAtomicCounterBufferIndex(Uint index) const {
+            const Int tIndex = TProgramUniformIndex(index);
+            if (tIndex < 0) return -1;
+            const Int owner = UniformAt(tIndex).index;
+            if (owner < 0) return -1;
+            const Int blockCount = static_cast<Int>(Artifacts().blockReflection.size());
+            if (owner >= blockCount) return -1;
+            const SizeT prefixLength = StringView(MG_Util::ShaderTranspiler::ATOMIC_COUNTER_BLOCK_PREFIX).size();
+            Int counterBufferIndex = 0;
+            for (Int i = 0; i < blockCount; ++i) {
+                const auto& blockName = BlockAt(i).name;
+                if (blockName.compare(0, prefixLength, MG_Util::ShaderTranspiler::ATOMIC_COUNTER_BLOCK_PREFIX) != 0) {
+                    continue;
+                }
+                if (i == owner) return counterBufferIndex;
+                ++counterBufferIndex;
+            }
+            return -1;
+        }
+
+        Bool IsActiveUniformAtomicCounter(Uint index) const {
+            return GetActiveUniformAtomicCounterBufferIndex(index) >= 0;
         }
 
         // GL_UNIFORM_OFFSET: byte offset within the owning named block; -1 for a default-block
         // uniform. The relaxed parse gives global-UBO members real byte offsets, but GL must keep
         // seeing them as default-block uniforms, so gate on the GL-visible block index.
         GLint GetActiveUniformOffset(Uint index) const {
-            const auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
+            const auto& uniform = UniformAt(TProgramUniformIndex(index));
             if (GlBlockIndexFromTProgram(uniform.index) < 0) return -1;
             return uniform.offset;
         }
@@ -232,13 +370,12 @@ namespace MobileGL::MG_State::GLState {
         // generated SPIR-V lay the array out with std140 16-byte-rounded strides. MobileGL's UBO
         // layout is always std140, where every array element stride rounds up to a vec4.
         GLint GetActiveUniformArrayStride(Uint index) const {
-            const auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
+            const auto& uniform = UniformAt(TProgramUniformIndex(index));
             if (GlBlockIndexFromTProgram(uniform.index) < 0) return -1;
-            const glslang::TType* type = uniform.getType();
-            if (type == nullptr || !type->isArray()) return 0;
-            if (type->isMatrix()) {
+            if (!uniform.type.isArray) return 0;
+            if (uniform.type.isMatrix) {
                 const bool rowMajor = GetActiveUniformIsRowMajor(index) != 0;
-                const int vectors = rowMajor ? type->getMatrixRows() : type->getMatrixCols();
+                const int vectors = rowMajor ? uniform.type.matrixRows : uniform.type.matrixCols;
                 return GetActiveUniformMatrixStride(index) * vectors;
             }
             return 16; // scalars and vectors: std140 rounds the element stride up to a vec4
@@ -252,15 +389,12 @@ namespace MobileGL::MG_State::GLState {
         // check suffices; the getUniformBlock() fallback is defensive for a config that instead leaves
         // an inheriting member's layoutMatrix == ElmNone.
         GLint GetActiveUniformIsRowMajor(Uint index) const {
-            const auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
+            const auto& uniform = UniformAt(TProgramUniformIndex(index));
             if (GlBlockIndexFromTProgram(uniform.index) < 0) return 0;
-            const glslang::TType* type = uniform.getType();
-            if (type == nullptr || !type->isMatrix()) return 0;
-            glslang::TLayoutMatrix layoutMatrix = type->getQualifier().layoutMatrix;
-            if (layoutMatrix == glslang::ElmNone) {
-                layoutMatrix = Artifacts().program->getUniformBlock(uniform.index).getType()->getQualifier().layoutMatrix;
-            }
-            return (layoutMatrix == glslang::ElmRowMajor) ? 1 : 0;
+            if (!uniform.type.isMatrix) return 0;
+            // layoutMatrix is already resolved against the owning block's qualifier at
+            // snapshot time, so the getUniformBlock() fallback this used to carry is gone.
+            return (uniform.type.layoutMatrix == static_cast<Int>(glslang::ElmRowMajor)) ? 1 : 0;
         }
 
         // GL_UNIFORM_MATRIX_STRIDE: byte stride between columns (col-major) / rows (row-major) of a
@@ -270,16 +404,11 @@ namespace MobileGL::MG_State::GLState {
         // out as std140 (packed/shared are coerced), so this matches the offsets glslang reports. For
         // every GL 3.3 float matrix this evaluates to 16, independent of majorness.
         GLint GetActiveUniformMatrixStride(Uint index) const {
-            const auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
+            const auto& uniform = UniformAt(TProgramUniformIndex(index));
             if (GlBlockIndexFromTProgram(uniform.index) < 0) return -1;
-            const glslang::TType* type = uniform.getType();
-            if (type == nullptr || !type->isMatrix()) return 0;
-            glslang::TLayoutMatrix layoutMatrix = type->getQualifier().layoutMatrix;
-            if (layoutMatrix == glslang::ElmNone) {
-                layoutMatrix = Artifacts().program->getUniformBlock(uniform.index).getType()->getQualifier().layoutMatrix;
-            }
-            const bool rowMajor = (layoutMatrix == glslang::ElmRowMajor);
-            const int strideVectorComponents = rowMajor ? type->getMatrixCols() : type->getMatrixRows();
+            if (!uniform.type.isMatrix) return 0;
+            const bool rowMajor = (uniform.type.layoutMatrix == static_cast<Int>(glslang::ElmRowMajor));
+            const int strideVectorComponents = rowMajor ? uniform.type.matrixCols : uniform.type.matrixRows;
             constexpr int scalarSize = 4; // GL 3.3 core uniform matrices are float
             const int vectorAlignment = (strideVectorComponents <= 1)   ? scalarSize
                                         : (strideVectorComponents == 2) ? 2 * scalarSize
@@ -287,21 +416,39 @@ namespace MobileGL::MG_State::GLState {
             return (vectorAlignment + 15) & ~15; // std140 round-up to a vec4
         }
 
-        const glslang::TType* GetUniformTType(Uint location) const {
-            auto& uniform = Artifacts().program->getUniform(Artifacts().uniformIndexInTProgram[location]);
-            return uniform.getType();
+        // The flattened type of the uniform at `location`. This is what replaced
+        // GetUniformTType(): the same information, owned by the program instead of by a
+        // glslang pool, so it stays valid for a link served from the L1 translation memo.
+        const TypeFacts& GetUniformTypeFacts(Uint location) const {
+            return UniformAt(Artifacts().uniformIndexInTProgram[location]).type;
         }
 
-        Bool IsUniformOpaqueAtLocation(Uint location) const { return GetUniformTType(location)->isOpaque(); }
+        // Replaces GetUniformTType(), which used to hand a raw glslang::TType* - into a
+        // pool the program no longer necessarily owns - out to the DirectGLES image-format
+        // bake. These are the only three things any caller ever read off it.
+        Bool UniformHasDeclaredImageFormat(Uint location) const {
+            return UniformAt(Artifacts().uniformIndexInTProgram[location]).type.hasFormat;
+        }
+        Uint GetUniformDeclaredImageFormat(Uint location) const {
+            return UniformAt(Artifacts().uniformIndexInTProgram[location]).type.layoutFormat;
+        }
+        // Matrix column count, 0 for a non-matrix. The global-UBO fallback allocator sizes a
+        // matrix slot from it.
+        Int GetUniformMatrixColumns(Uint location) const {
+            const auto& uniform = UniformAt(Artifacts().uniformIndexInTProgram[location]);
+            return uniform.type.isMatrix ? uniform.type.matrixCols : 0;
+        }
+
+        Bool IsUniformOpaqueAtLocation(Uint location) const {
+            return UniformAt(Artifacts().uniformIndexInTProgram[location]).type.isOpaque;
+        }
 
         const String& GetUniformName(Uint location) const {
-            auto& uniform = Artifacts().program->getUniform(Artifacts().uniformIndexInTProgram[location]);
-            return uniform.name;
+            return UniformAt(Artifacts().uniformIndexInTProgram[location]).name;
         }
 
         const String& GetActiveUniformName(Uint index) const {
-            auto& uniform = Artifacts().program->getUniform(TProgramUniformIndex(index));
-            return uniform.name;
+            return UniformAt(TProgramUniformIndex(index)).name;
         }
         // Sentinel for a uniform location without global-UBO backing storage (should not
         // survive linking: GenerateBinary falls back to tail-allocated scratch storage).
@@ -335,17 +482,17 @@ namespace MobileGL::MG_State::GLState {
         // would, half its GL type size, and a `dmat4` is padded like any other matrix. Anything
         // reading or writing a whole uniform's storage - a bounds check, a copy between two
         // programs' shadows - wants this rather than GetUniformSizesInBytes.
-        static SizeT UniformStorageSpanInBytes(const glslang::TType* type, SizeT tightSize) {
-            if (type != nullptr && type->isMatrix()) {
-                return static_cast<SizeT>(type->getMatrixCols()) * 4 * sizeof(Float);
+        static SizeT UniformStorageSpanInBytes(const TypeFacts& type, SizeT tightSize) {
+            if (type.isMatrix) {
+                return static_cast<SizeT>(type.matrixCols) * 4 * sizeof(Float);
             }
-            if (type != nullptr && type->getBasicType() == glslang::EbtDouble) {
+            if (type.isDouble) {
                 return tightSize / 2;
             }
             return tightSize;
         }
         SizeT GetUniformStorageSpanInBytes(Uint location) const {
-            return UniformStorageSpanInBytes(GetUniformTType(location), GetUniformSizesInBytes(location));
+            return UniformStorageSpanInBytes(GetUniformTypeFacts(location), GetUniformSizesInBytes(location));
         }
 
         // ---- "written since link": the per-location dirty set the pipeline composite mirrors from ----
@@ -456,14 +603,14 @@ namespace MobileGL::MG_State::GLState {
             return mask;
         }
         Uint32 GetActiveFragmentOutputLocationMask() const {
-            if (!Artifacts().program) {
+            if (Artifacts().pipeOutputReflection.empty()) {
                 return 0;
             }
 
             Uint32 mask = 0;
-            const Int outputCount = Artifacts().program->getNumPipeOutputs();
+            const Int outputCount = static_cast<Int>(Artifacts().pipeOutputReflection.size());
             for (Int index = 0; index < outputCount; ++index) {
-                const Int location = static_cast<Int>(Artifacts().program->getPipeOutput(index).layoutLocation());
+                const Int location = Artifacts().pipeOutputReflection[index].location;
                 if (location >= 0 && location < 32) {
                     mask |= (1u << location);
                 }
@@ -471,38 +618,34 @@ namespace MobileGL::MG_State::GLState {
             return mask;
         }
         Int GetActiveFragmentOutputCount() const {
-            return Artifacts().program ? Artifacts().program->getNumPipeOutputs() : 0;
+            return static_cast<Int>(Artifacts().pipeOutputReflection.size());
         }
         const String& GetActiveFragmentOutputName(Uint index) const {
-            MOBILEGL_ASSERT(Artifacts().program != nullptr, "ProgramObject::GetActiveFragmentOutputName: program is null");
-            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().program->getNumPipeOutputs()),
+            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().pipeOutputReflection.size()),
                             "ProgramObject::GetActiveFragmentOutputName: index=%u out of range", index);
-            return Artifacts().program->getPipeOutput(static_cast<Int>(index)).name;
+            return Artifacts().pipeOutputReflection[index].name;
         }
         Int GetFragmentOutputLocation(Uint index) const {
-            MOBILEGL_ASSERT(Artifacts().program != nullptr, "ProgramObject::GetFragmentOutputLocation: program is null");
-            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().program->getNumPipeOutputs()),
+            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().pipeOutputReflection.size()),
                             "ProgramObject::GetFragmentOutputLocation: index=%u out of range",
                             index);
-            return static_cast<Int>(Artifacts().program->getPipeOutput(static_cast<Int>(index)).layoutLocation());
+            return Artifacts().pipeOutputReflection[index].location;
         }
         GLint GetActiveFragmentOutputArraySize(Uint index) const {
-            MOBILEGL_ASSERT(Artifacts().program != nullptr, "ProgramObject::GetActiveFragmentOutputArraySize: program is null");
-            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().program->getNumPipeOutputs()),
+            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().pipeOutputReflection.size()),
                             "ProgramObject::GetActiveFragmentOutputArraySize: index=%u out of range", index);
-            return Artifacts().program->getPipeOutput(static_cast<Int>(index)).size;
+            return Artifacts().pipeOutputReflection[index].size;
         }
         GLenum GetFragmentOutputType(Uint index) const {
-            MOBILEGL_ASSERT(Artifacts().program != nullptr, "ProgramObject::GetFragmentOutputType: program is null");
-            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().program->getNumPipeOutputs()),
+            MOBILEGL_ASSERT(index < static_cast<Uint>(Artifacts().pipeOutputReflection.size()),
                             "ProgramObject::GetFragmentOutputType: index=%u out of range",
                             index);
-            return Artifacts().program->getPipeOutput(static_cast<Int>(index)).glDefineType;
+            return Artifacts().pipeOutputReflection[index].glDefineType;
         }
         GLenum GetAttribType(Uint index) const { return Artifacts().attribTypes[index]; }
         const String& GetAttribName(Uint index) const { return Artifacts().attribs[index]; }
-        GLenum GetActiveAttribType(Uint index) const { return Artifacts().program->getPipeInput(static_cast<Int>(index)).glDefineType; }
-        GLint GetActiveAttribArraySize(Uint index) const { return Artifacts().program->getPipeInput(static_cast<Int>(index)).size; }
+        GLenum GetActiveAttribType(Uint index) const { return Artifacts().pipeInputReflection[index].glDefineType; }
+        GLint GetActiveAttribArraySize(Uint index) const { return Artifacts().pipeInputReflection[index].size; }
         // The Vulkan-semantics parse reflects the vertex builtins under their SPIR-V names;
         // GL must keep reporting the GL spellings (glGetActiveAttrib and the program-input
         // resource queries enumerate builtins).
@@ -514,7 +657,7 @@ namespace MobileGL::MG_State::GLState {
             return name;
         }
         const String& GetActiveAttribName(Uint index) const {
-            return NormalizeBuiltinPipeInputName(Artifacts().program->getPipeInput(static_cast<Int>(index)).name);
+            return NormalizeBuiltinPipeInputName(Artifacts().pipeInputReflection[index].name);
         }
         // PHASE B, all three (see EnsureSpirvJoined): the shadow buffer's layout is decided
         // by the OPTIMIZED SPIR-V, so it does not exist until the SPIR-V job has settled - and
@@ -607,7 +750,7 @@ namespace MobileGL::MG_State::GLState {
             // which means the change is only honoured by regenerating the program. That
             // regeneration is gated on link-shaped versions, so without a counter that moves
             // here the new unit would never reach the driver.
-            if (const glslang::TType* type = GetUniformTType(location); type != nullptr && type->isImage()) {
+            if (GetUniformTypeFacts(location).isImage) {
                 ++m_imageUnitVersion;
             }
         }
@@ -682,20 +825,14 @@ namespace MobileGL::MG_State::GLState {
         // SIGSEGV inside glslang::TProgram::getNumPipeInputs - KHR-GL30.api.coverage does exactly
         // this after a failed glGetAttribLocation, and reached it as soon as the CopyTexImage2D
         // throw ahead of it stopped killing the run first.
-        Int GetActiveAtomicCounterCount() const {
-            const auto& program = Artifacts().program;
-            return program ? program->getNumAtomicCounters() : 0;
-        }
         Int GetActiveAttributesCount() const {
-            const auto& program = Artifacts().program;
-            return program ? program->getNumPipeInputs() : 0;
+            return static_cast<Int>(Artifacts().pipeInputReflection.size());
         }
         // GL-visible uniform blocks only: the synthesized MGL_GLOBAL_UBO the relaxed parse
         // materializes for default-block uniforms is filtered out by DoReflection.
         Int GetActiveUniformBlocksCount() const { return static_cast<Int>(Artifacts().glBlockIndexToTProgram.size()); }
         GLuint GetComputeLocalSize(Uint dim) const {
-            const auto& program = Artifacts().program;
-            return program ? program->getLocalSize(static_cast<Int>(dim)) : 0;
+            return dim < 3u ? Artifacts().computeLocalSize[dim] : 0u;
         }
         Int GetActiveAttributesMaxLength() const { return Artifacts().attribInNameMaxLength; }
         Int GetActiveUniformBlocksMaxNameLength() const { return Artifacts().uniformBlockNameMaxLength; }
@@ -719,11 +856,11 @@ namespace MobileGL::MG_State::GLState {
             // (like a std140 struct) occupies a vec4-rounded size, and that is what the
             // backend compiles: ES drivers reject draws whose bound UBO range is smaller
             // than the block (a block ending in ivec3 reported 12 while the driver needs 16).
-            return (Artifacts().program->getUniformBlock(Artifacts().glBlockIndexToTProgram[index]).size + 15u) & ~15u;
+            return (static_cast<Uint>(BlockAt(Artifacts().glBlockIndexToTProgram[index]).size) + 15u) & ~15u;
         }
 
         const String& GetUniformBlockName(Uint index) const {
-            auto& ubo = Artifacts().program->getUniformBlock(Artifacts().glBlockIndexToTProgram[index]);
+            const auto& ubo = BlockAt(Artifacts().glBlockIndexToTProgram[index]);
             return ubo.name;
         }
 
@@ -754,7 +891,7 @@ namespace MobileGL::MG_State::GLState {
         }
 
         Bool IsUniformBlockReferencedByStage(Uint index, EShLanguage stage) const {
-            const auto& ubo = Artifacts().program->getUniformBlock(Artifacts().glBlockIndexToTProgram[index]);
+            const auto& ubo = BlockAt(Artifacts().glBlockIndexToTProgram[index]);
             const auto stageMask = static_cast<EShLanguageMask>(1 << stage);
             return (ubo.stages & stageMask) != 0;
         }
@@ -786,6 +923,13 @@ namespace MobileGL::MG_State::GLState {
         // order - and the name is the only coordinate all three agree on. Absent from the map
         // means "never rebound", and the shader's declared binding still stands.
         void SetShaderStorageBlockBinding(const String& blockName, Uint binding) {
+            // Equality bail-out like SetUniformBlockBinding's: the pipeline composite
+            // mirror replays every override each draw, and without this every replay
+            // would churn m_blockBindingVersion and rebuild whatever keys on it.
+            const auto it = Artifacts().shaderStorageBlockBinding.find(blockName);
+            if (it != Artifacts().shaderStorageBlockBinding.end() && it->second == static_cast<Int>(binding)) {
+                return;
+            }
             Artifacts().shaderStorageBlockBinding[blockName] = static_cast<Int>(binding);
             // Deliberately NOT m_backendStateVersion: Espryt's entry point never forces a
             // program build off this, and bumping that version would start doing so. The
@@ -819,14 +963,15 @@ namespace MobileGL::MG_State::GLState {
         // backend asks this exactly where it used to ask GetLinkStatus(), i.e. right before
         // it builds or draws with the program.
         Bool GetSpirvStatus() const { return Spirv().spirvStatus; }
+        // Copied from the link task that generated this program's SPIR-V. Backends use it for
+        // their final transforms, which must honor the same diagnostic setting as phase B.
+        Bool GetSpirvValidationEnabled() const { return Spirv().enableSpirvValidation; }
 
         // The linked glslang reflection itself, for the ONE consumer that needs resource
         // lists no typed getter above exposes: the GL program-interface query layer
         // (MG_Impl/GLImpl/Program/ProgramInterface.cpp), which has to enumerate buffer
         // blocks, buffer variables, atomic counters and per-stage reference masks. Null
         // until a link has succeeded. Read through the join gate like everything else.
-        const glslang::TProgram* GetReflection() const { return Artifacts().program.get(); }
-
         Int GetShaderIndexByStage(ShaderStage stage) const {
             auto it = std::find_if(m_shaders.begin(), m_shaders.end(), [stage](const SharedPtr<ShaderObject>& shader) {
                 return shader->GetShaderStage() == stage;
@@ -879,9 +1024,50 @@ namespace MobileGL::MG_State::GLState {
         // what makes "every read of link output joins the pending link" a property the
         // compiler checks rather than a review item - a new reader cannot spell the field
         // without going through the gate.
+        // ---- the owned mirror of glslang's reflection ----
+        //
+        // WHY THIS EXISTS. Every GL query about a linked program used to be answered by
+        // asking the live glslang::TProgram - program->getUniform(i).getType()->isMatrix()
+        // and friends. That made the TProgram part of the program's PERMANENT state, which
+        // in turn made the whole front end (parse + link) unskippable: the L1 shader
+        // translation memo could hand back the SPIR-V but the reflection still had to be
+        // rebuilt from a freshly parsed AST.
+        //
+        // These three tables are a snapshot of everything the query surface ever reads off
+        // the TProgram, in PLAIN OWNED VALUES - no TType*, no TString, nothing pointing into
+        // a glslang pool. Taken once at the tail of DoReflection (SnapshotGlslangReflection),
+        // they are copyable, immutable after the link, and safe to memoize and share between
+        // ProgramObjects and threads. Once they are filled, `program` is dead weight to
+        // everything except DoReflection itself.
+        //
+        // INDEXED BY TPROGRAM INDEX, deliberately: that is the space uniformIndexInTProgram,
+        // glUniformIndexToTProgram and tProgramUniformIndexToGl already speak, so every
+        // accessor that used to call program->getUniform(i) indexes uniformReflection[i]
+        // instead, unchanged in every other respect.
+
         struct LinkArtifacts {
+            // Live only between LinkProgram() and the end of DoReflection. Everything after
+            // that reads the owned mirror below; a link served from the L1 memo never
+            // constructs one at all, so this is null for such a program and MUST NOT be
+            // dereferenced outside DoReflection.
             SharedPtr<glslang::TProgram> program;
 
+            // The owned reflection snapshot. Indexed by TProgram index; see the structs above.
+            Vector<UniformReflection> uniformReflection;
+            Vector<BlockReflection> blockReflection;
+            Vector<PipeInputReflection> pipeInputReflection;
+            Vector<PipeOutputReflection> pipeOutputReflection;
+            // Program-level scalars glslang answers off the linked intermediates.
+            // Whether the program's LAST stage is the fragment stage. A color number - and so a
+            // color index - exists only there; a separable tess/geometry/vertex program's
+            // outputs are varyings and must report -1 (KHR-GL43.program_interface_query.
+            // separate-programs-tess-control).
+            Bool lastStageIsFragment = false;
+            Array<GLuint, 3> computeLocalSize{};
+            // Replaces program->getUniformIndex(name). Maps the reflected name to its
+            // TProgram uniform index.
+            UnorderedMap<String, Int> uniformIndexByName;
+
             // Attributes (Vertex in)
             Vector<String> attribs;
             Vector<GLenum> attribTypes;
@@ -985,6 +1171,7 @@ namespace MobileGL::MG_State::GLState {
         // cannot be lifted out of glslang's reflection instead.
         struct SpirvArtifacts {
             Vector<Vector<unsigned>> generatedSpirv;
+            Bool enableSpirvValidation = false;
             // Byte offset of each uniform location inside globalUboScratch, or
             // kInvalidUniformOffset. Sized maxUniformLocation + 1 by the routing pass.
             Vector<Uint> uniformOffsets;
@@ -1011,6 +1198,14 @@ namespace MobileGL::MG_State::GLState {
         // ordering is explicit and nothing is exempt.
         static void ResetLinkArtifacts(LinkArtifacts& artifacts);
 
+        // The owned reflection snapshot, for the program-interface query layer. Replaces
+        // GetReflection(), which handed out the live glslang::TProgram - the last thing that
+        // forced a linked program to keep its parse alive.
+        const LinkArtifacts& GetLinkReflection() const {
+            EnsureLinkJoined();
+            return Artifacts();
+        }
+
         static Bool IsValidUniformLocation(const LinkArtifacts& artifacts, Int location) {
             if (location < 0 || location > static_cast<Int>(artifacts.maxUniformLocation)) return false;
             if (static_cast<SizeT>(location) >= artifacts.uniformIndexInTProgram.size()) return false;
@@ -1026,12 +1221,24 @@ namespace MobileGL::MG_State::GLState {
         // for both. GL 3.3 core uniforms are always sized. Takes a TProgram uniform index (the space
         // the artifacts' uniformIndexInTProgram stores).
         static GLint GetUniformArraySizeByTIndex(const LinkArtifacts& artifacts, Int tIndex) {
-            const auto& uniform = artifacts.program->getUniform(tIndex);
-            const glslang::TType* type = uniform.getType();
-            if (type != nullptr && type->isSizedArray()) {
-                return type->getOuterArraySize();
+            return UniformAtIn(artifacts, tIndex).arraySize;
+        }
+
+        // Bounds-checked mirror lookup. Out of range yields a default-constructed entry
+        // rather than UB, which is the same shape the phase-B getters use: a program whose
+        // reflection is missing must stay answerable, not crash the query surface.
+        static const UniformReflection& UniformAtIn(const LinkArtifacts& artifacts, Int tIndex) {
+            static const UniformReflection kEmpty;
+            if (tIndex < 0 || static_cast<SizeT>(tIndex) >= artifacts.uniformReflection.size()) return kEmpty;
+            return artifacts.uniformReflection[tIndex];
+        }
+        const UniformReflection& UniformAt(Int tIndex) const { return UniformAtIn(Artifacts(), tIndex); }
+        const BlockReflection& BlockAt(Int tBlockIndex) const {
+            static const BlockReflection kEmpty;
+            if (tBlockIndex < 0 || static_cast<SizeT>(tBlockIndex) >= Artifacts().blockReflection.size()) {
+                return kEmpty;
             }
-            return uniform.size < 1 ? 1 : uniform.size;
+            return Artifacts().blockReflection[tBlockIndex];
         }
 
         // Blocks until a pending link has published its artifacts. Public because a few call
@@ -1219,6 +1426,13 @@ namespace MobileGL::MG_State::GLState {
         // glGetAttachedShaders / GL_ATTACHED_SHADERS / the orphan-shader sweep need no join.
         Vector<SharedPtr<ShaderObject>> m_shaders;
         Vector<SharedPtr<ShaderObject>> m_detachedShaders; // Store detached shaders and remove on next link
+        // See GetLinkedShaderSnapshot. Holding the SharedPtrs here is deliberate: the
+        // "as last linked" set must survive detach-and-delete of its shaders (the
+        // glCreateShaderProgramv shape) until the next link replaces it.
+        Vector<LinkedShaderRef> m_linkedShaderSnapshot;
+        // See AttachShaderWithPinnedLinkInput. Populated only on pipeline composites,
+        // which never detach, so entries need no removal path. GL-thread-owned.
+        UnorderedMap<const ShaderObject*, LinkedShaderRef> m_pinnedLinkInputs;
 
         // Link INPUTS (all "take effect at the next link" per GL): glBindAttribLocation,
         // glBindFragDataLocation(Indexed), glTransformFeedbackVaryings, and the draw-buffer

MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.cpp

@@ -12,6 +12,8 @@
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_Util/ShaderTranspiler/SpvcSession.h>
+#include <MG_State/GLState/ProgramState/ProgramTranslationCache.h>
+#include <MG_Util/ShaderTranspiler/TranslationCache.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 
 #include <cstring>
@@ -95,14 +97,32 @@ namespace MobileGL::MG_State::GLState {
         // and `diagnostics`, and this node is the sole reader of the handoff.
         ProgramLinkTask::SpirvHandoff& handoff = m_phaseA->spirvHandoff;
         const Uint externalIndex = m_phaseA->in.externalIndex;
-        if (!handoff.ready || !handoff.reflection.program) {
+        if (!handoff.ready) {
             // Phase A did not reach its tail (it failed the link, or was cancelled mid-body).
             // Publish nothing; spirvStatus stays false.
             return;
         }
+        // A TProgram is required only to GENERATE. A link served from the L1 memo has none by
+        // construction - that is the entire point of the widened payload - and its SPIR-V and
+        // routing tables arrive ready-made in cachedSpirv.
+        if (!handoff.cachedSpirv && !handoff.reflection.program) return;
+
+        // An L1 hit already carries everything this phase would have produced. Publish it
+        // and stop: no GlslangToSpv, no spirv-opt, no routing pass.
+        if (handoff.cachedSpirv) {
+            artifacts = *handoff.cachedSpirv;
+            MGLOG_D("ProgramObject %u: L1 cache hit - %zu SPIR-V module(s) and the global-UBO "
+                    "routing reused",
+                    externalIndex, artifacts.generatedSpirv.size());
+            return;
+        }
 
         MGLOG_D("ProgramObject %u: Starting SPIR-V generation", externalIndex);
-        GenerateSpirv(handoff, externalIndex);
+        const Bool deferOutputValidationForDirectVulkan =
+            m_phaseA->in.env != nullptr && m_phaseA->in.env->backend == BackendType::DirectVulkan;
+        const Bool enableSpirvValidation = m_phaseA->in.enableSpirvValidation;
+        artifacts.enableSpirvValidation = enableSpirvValidation;
+        GenerateSpirv(handoff, externalIndex, deferOutputValidationForDirectVulkan, enableSpirvValidation);
         // GlslangToSpv was the only consumer of the parsed ASTs; everything after this point
         // works on the SPIR-V and on the TProgram's own self-contained reflection pool. Drop
         // them here rather than at the end of the body, which is ~87% of this node's runtime
@@ -113,13 +133,18 @@ namespace MobileGL::MG_State::GLState {
         //   * CAS-LOSER shaders (the re-parse in ShaderCompileTask::ClaimParsedShader, i.e.
         //     the 2nd..Nth link of a shared shader): freed here in full. The handoff is their
         //     ONLY owner.
-        //   * CAS-WINNER shaders (the common case - one shader object linked into one
-        //     program, which is every program of an Iris pack load): NOT freed here. The
-        //     winner branch returns a COPY of ShaderCompileTask::artifacts.shader
-        //     (ShaderCompileTask.cpp:320) and the node never releases its own reference, while
-        //     phase A holds that node through in.shaders[i].compiled for its whole life - and
-        //     phase A lives until PhaseAReleaser fires at the end of this body. So the
-        //     refcount goes 2 -> 1 here and the arena dies where it would have died anyway.
+        //   * L1c-HIT shaders (the compile published a verdict and never parsed, so the parse
+        //     was made on demand by ClaimParsedShader): freed here in full, exactly like a
+        //     CAS loser and for the same reason - the handoff is their only owner. This
+        //     category did not exist before the translation memo's compile half, and it makes
+        //     the clear below strictly more effective than the paragraph below describes.
+        //   * CAS-WINNER shaders (one shader object linked into one program, whose compile
+        //     MISSED L1c and therefore stored its parse): NOT freed here. The winner branch
+        //     returns a COPY of ShaderCompileTask::artifacts.shader and the node never
+        //     releases its own reference, while phase A holds that node through
+        //     in.shaders[i].compiled for its whole life - and phase A lives until
+        //     PhaseAReleaser fires at the end of this body. So the refcount goes 2 -> 1 here
+        //     and the arena dies where it would have died anyway.
         //
         // Making it free the winner's arena too means releasing whatever pins the TShader
         // inside the compile node, and neither obvious route is safe as a drive-by: moving out
@@ -133,11 +158,30 @@ namespace MobileGL::MG_State::GLState {
 
         MGLOG_D("ProgramObject %u: Building global-UBO routing tables", externalIndex);
         BuildGlobalUboRouting(handoff, externalIndex);
+
+        // The completed front end goes into the L1 memo HERE, where both halves exist: phase
+        // A's LinkArtifacts (carried in the handoff) and this phase's SpirvArtifacts.
+        //
+        // Only a clean run is memoized. A failed optimizer run leaves a module as whatever the
+        // chain got to before it gave up, and that is exactly the binary no other program
+        // should ever be handed.
+        if (artifacts.spirvStatus && handoff.spirvCacheKey.Valid() && handoff.linkArtifactsForCache) {
+            auto payload = MakeShared<ProgramTranslationResult>();
+            payload->link = *handoff.linkArtifactsForCache;
+            payload->link.program.reset(); // belt and braces: never memoize a glslang arena
+            payload->spirv = artifacts;
+            const SizeT payloadBytes = ProgramTranslationResultBytes(*payload);
+            GetProgramTranslationCache().Insert(handoff.spirvCacheKey,
+                                                ProgramTranslationResultPtr(Move(payload)),
+                                                payloadBytes);
+        }
         MGLOG_D("ProgramObject %u: Binary generation finished (generatedSpirv size=%zu)", externalIndex,
                 artifacts.generatedSpirv.size());
     }
 
-    void ProgramSpirvTask::GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, const Uint externalIndex) {
+    void ProgramSpirvTask::GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, const Uint externalIndex,
+                                         const Bool deferOutputValidationForDirectVulkan,
+                                         const Bool enableSpirvValidation) {
         /* As we passed first stage compilation/linking,
          * we'll assume all the operations here should
          * pass. We may be able to employ some optimizations
@@ -169,7 +213,8 @@ namespace MobileGL::MG_State::GLState {
         Bool allOptimized = true;
         {
             for (auto& spv : artifacts.generatedSpirv) {
-                auto success = ShaderCompiler::SanitizeAndOptimizeBinary(spv, spv);
+                auto success = ShaderCompiler::SanitizeAndOptimizeBinary(
+                    spv, spv, !deferOutputValidationForDirectVulkan, enableSpirvValidation);
                 if (!success) {
                     // The one genuine phase-B failure mode: one of the seven optimizer passes
                     // reported failure, so `spv` is whatever the run left behind. A fordebug
@@ -289,22 +334,25 @@ namespace MobileGL::MG_State::GLState {
         for (Uint location = 0; location <= reflection.maxUniformLocation; ++location) {
             if (artifacts.uniformOffsets[location] != ProgramObject::kInvalidUniformOffset) continue;
             if (!ProgramObject::IsValidUniformLocation(reflection, static_cast<Int>(location))) continue;
-            const auto& uniform = reflection.program->getUniform(reflection.uniformIndexInTProgram[location]);
-            const glslang::TType* type = uniform.getType();
-            if (type != nullptr && type->isOpaque()) continue;
-            if (uniform.index >= 0 && uniform.index < reflection.program->getNumUniformBlocks() &&
-                std::strstr(reflection.program->getUniformBlock(uniform.index).name.c_str(),
-                            MG_Util::ShaderTranspiler::GLOBAL_UBO_NAME) == nullptr) {
-                // Member of a named uniform block: not settable through glUniform*, so it
-                // needs no global-UBO shadow storage.
+            const auto& uniform =
+                ProgramObject::UniformAtIn(reflection, reflection.uniformIndexInTProgram[location]);
+            if (uniform.type.isOpaque) continue;
+            // Member of a named uniform block: not settable through glUniform*, so it needs
+            // no global-UBO shadow storage. tProgramBlockIndexToGl[i] >= 0 means block i is
+            // GL-visible, i.e. NOT the synthesized MGL_GLOBAL_UBO - which is exactly what the
+            // strstr(GLOBAL_UBO_NAME) test this replaced was asking, without needing the
+            // TProgram to spell the block name.
+            if (uniform.index >= 0 &&
+                uniform.index < static_cast<Int>(reflection.tProgramBlockIndexToGl.size()) &&
+                reflection.tProgramBlockIndexToGl[uniform.index] >= 0) {
                 continue;
             }
 
             // std140-style slot: the matrix upload paths write column vectors at
             // 16-byte strides, so a matrix slot must cover cols * 16 bytes.
             SizeT slotSize = MG_Util::GetGLTypeSize(uniform.glDefineType);
-            if (type != nullptr && type->isMatrix()) {
-                slotSize = static_cast<SizeT>(type->getMatrixCols()) * 16u;
+            if (uniform.type.isMatrix) {
+                slotSize = static_cast<SizeT>(uniform.type.matrixCols) * 16u;
             }
             slotSize = (slotSize + 15u) & ~static_cast<SizeT>(15u);
             const SizeT slotOffset = (artifacts.globalUboScratch.size() + 15u) & ~static_cast<SizeT>(15u);

MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.h

@@ -65,7 +65,8 @@ namespace MobileGL::MG_State::GLState {
     private:
         void RunBody() override;
 
-        void GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex);
+        void GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex,
+                           Bool deferOutputValidationForDirectVulkan, Bool enableSpirvValidation);
         void BuildGlobalUboRouting(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex);
 
         // Worker-side MGLOG replacement, replayed by the join on the GL thread. Same reason as

MobileGL/MG_State/GLState/ProgramState/ProgramTranslationCache.cpp

@@ -0,0 +1,82 @@
+// MobileGL - MobileGL/MG_State/GLState/ProgramState/ProgramTranslationCache.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "ProgramTranslationCache.h"
+
+namespace MobileGL::MG_State::GLState {
+    namespace {
+        // ---- L1 caps: 48 entries / 24 MiB ----
+        //
+        // Both numbers moved when the payload grew from "the SPIR-V modules" to "the whole
+        // front end". An entry is now the stages' preprocessed source (the key), the SPIR-V,
+        // the reflection snapshot and the global-UBO shadow - roughly twice what it was - so
+        // the byte budget doubled and the entry count came down to keep the worst case in the
+        // same place on a phone.
+        //
+        // The shape of the choice has not changed: this cache exists for REPETITION, not
+        // coverage. A KHR-GL33.texture_swizzle smoke case builds 2592 programs out of fewer
+        // than ten distinct ones, so a handful of entries serves it completely; an Iris
+        // shaderpack load is ~300-600 MOSTLY DISTINCT programs that would never hit however
+        // large the cache is, so a bigger cap there buys nothing and costs resident memory.
+        // 48 is comfortably above the distinct-program count of every repetition workload
+        // measured, and 24 MiB bounds the pathological case - a pack whose ~100 KB stages
+        // really are re-linked - at roughly three times the existing 8 MiB
+        // ShaderPreprocessCache budget, which is the other memo on this path.
+        constexpr SizeT kMaxEntries = 48;
+        constexpr SizeT kMaxBytes = 24u * 1024u * 1024u;
+
+        SizeT StringsBytes(const Vector<String>& values) {
+            SizeT bytes = 0;
+            for (const String& value : values) bytes += value.size() + sizeof(String);
+            return bytes;
+        }
+
+        SizeT ResourcesBytes(const Vector<ProgramObject::ResourceReflection>& records) {
+            SizeT bytes = records.size() * sizeof(ProgramObject::ResourceReflection);
+            for (const auto& record : records) bytes += record.name.size();
+            return bytes;
+        }
+    } // namespace
+
+    // Approximate on purpose: it feeds a budget, not an allocator. It counts the things that
+    // actually scale with shader size - the SPIR-V, the reflection names, the UBO shadow -
+    // and ignores per-entry fixed overhead.
+    SizeT ProgramTranslationResultBytes(const ProgramTranslationResult& result) {
+        SizeT bytes = 0;
+        for (const auto& module : result.spirv.generatedSpirv) bytes += module.size() * sizeof(unsigned);
+        bytes += result.spirv.uniformOffsets.size() * sizeof(Uint);
+        bytes += result.spirv.globalUboScratch.size();
+        bytes += ResourcesBytes(result.link.uniformReflection);
+        bytes += ResourcesBytes(result.link.blockReflection);
+        bytes += ResourcesBytes(result.link.pipeInputReflection);
+        bytes += ResourcesBytes(result.link.pipeOutputReflection);
+        bytes += StringsBytes(result.link.attribs);
+        bytes += StringsBytes(result.link.xfbInterfaceNames);
+        bytes += result.link.infoLog.size();
+        return bytes;
+    }
+
+    MG_Util::ShaderTranspiler::BoundedTranslationCache<ProgramTranslationResult>&
+    GetProgramTranslationCache() {
+        // DELIBERATELY LEAKED - see the same note on the L2 cache in
+        // MG_Util/ShaderTranspiler/TranslationCache.cpp. A function-local static OBJECT
+        // registers its destructor at first use, and first use here is a ShaderCompilePool
+        // worker; ShaderCompilePool's own atexit drain sentinel is registered strictly
+        // earlier, and exit handlers run in reverse order - so the cache would be destroyed
+        // while workers were still inserting into it. A function-local static POINTER is
+        // trivially destructible and registers no exit handler at all.
+        static auto* const kCache =
+            new MG_Util::ShaderTranspiler::BoundedTranslationCache<ProgramTranslationResult>(
+                "ShaderTranslationCache L1 (GLSL->front end)", kMaxEntries, kMaxBytes);
+        return *kCache;
+    }
+
+    void ClearProgramTranslationCache() { GetProgramTranslationCache().Clear(); }
+
+    void LogProgramTranslationCacheStats() { GetProgramTranslationCache().LogStats(); }
+} // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ProgramTranslationCache.h

@@ -0,0 +1,69 @@
+// MobileGL - MobileGL/MG_State/GLState/ProgramState/ProgramTranslationCache.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+#include <MG_State/GLState/ProgramState/ProgramObject.h>
+#include <MG_Util/ShaderTranspiler/TranslationCache.h>
+
+namespace MobileGL::MG_State::GLState {
+    // ===================================================================================
+    // L1 of the shader translation memo: THE WHOLE FRONT END of one glLinkProgram.
+    //
+    // A hit skips the glslang link and mapIO, GlslangToSpv, the 11-pass
+    // SanitizeAndOptimizeBinary chain, buildReflection, and the global-UBO routing pass. No
+    // TProgram is constructed at all - which is only possible because the GL query surface no
+    // longer reads one (see ProgramObject::UniformReflection and
+    // ProgramLinkTask::SnapshotGlslangReflection).
+    //
+    // IT DOES NOT SKIP THE PARSE, and no widening of this payload could: the parse belongs to
+    // glCompileShader, a different entry point one job earlier, and it has already run by the
+    // time a link looks this key up. Skipping it is L1c's job - the compile half of the memo,
+    // in MG_Util/ShaderTranspiler/TranslationCache.h. The two together are what make a
+    // repeated program build construct no glslang object of any kind; either one alone leaves
+    // roughly half the front end on the hot path (~322 us of parse against a ~650 us
+    // CTS-shaped program build, and 1.45-1.48x measured on device with L1 alone).
+    //
+    // WHY THE PAYLOAD IS THE WHOLE THING rather than just the SPIR-V: the frontend answers
+    // glGetActiveUniform, glGetProgramResource*, glGetUniformLocation and the rest out of
+    // LinkArtifacts, and glUniform*/glGetUniform* out of SpirvArtifacts. Caching only the
+    // modules would have left the link on the hot path to rebuild exactly the data the
+    // payload can carry.
+    //
+    // WHY IT LIVES HERE AND NOT IN MG_Util: the payload is a ProgramObject::LinkArtifacts
+    // plus a ProgramObject::SpirvArtifacts, and MG_Util must not depend on MG_State. The
+    // KEY is plain bytes and stays in MG_Util (BuildSpirvTranslationKey), so both layers
+    // agree on exactly one definition of "the same front-end input".
+    //
+    // EVERYTHING IN THE PAYLOAD IS PLAIN OWNED DATA. `link.program` is null by construction:
+    // the whole point is that a hit never has a glslang arena to point into. Both structs
+    // were audited field by field - the only member that ever pointed into glslang-owned
+    // memory was `program` itself, and TUniformInitializer / XfbVarying, which look like
+    // glslang types, are std::string + std::vector aggregates.
+    struct ProgramTranslationResult {
+        // program == nullptr, always. Asserted at insert.
+        ProgramObject::LinkArtifacts link;
+        ProgramObject::SpirvArtifacts spirv;
+    };
+    using ProgramTranslationResultPtr = SharedPtr<const ProgramTranslationResult>;
+
+    SizeT ProgramTranslationResultBytes(const ProgramTranslationResult& result);
+
+    // Process-global, and safe to be: the FRONT-END environment fingerprint is in the key
+    // (see CompileEnv::frontendFingerprint), so a program built under one context's glslang
+    // limits can never be handed to a context with different ones - while two contexts on
+    // DIFFERENT GPUs that agree on those limits deliberately share entries.
+    //
+    // Global rather than per-context because the producer runs on a ShaderCompilePool worker
+    // and must not reach MG_State::pGLContext.
+    MG_Util::ShaderTranspiler::BoundedTranslationCache<ProgramTranslationResult>&
+    GetProgramTranslationCache();
+
+    void ClearProgramTranslationCache();
+    void LogProgramTranslationCacheStats();
+} // namespace MobileGL::MG_State::GLState

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.cpp

@@ -8,13 +8,16 @@
 
 #include "ShaderCompileTask.h"
 
+#include <MG_State/GLState/BufferState/BufferState.h>
 #include <MG_Util/Converters/MGToGL/ProgramEnumConverter.h>
 #include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_Util/ShaderTranspiler/ShaderSourceProcessor.h>
+#include <MG_Util/ShaderTranspiler/TranslationCache.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 
 #include <glslang/Include/PoolAlloc.h>
 
+#include <algorithm>
 #include <charconv>
 
 namespace {
@@ -137,8 +140,21 @@ namespace {
         return std::nullopt;
     }
 
+    // What glGetIntegerv(GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS) answers, recomputed rather than
+    // queried: the compile runs on a worker with no context, and the pname is not a plain backend
+    // parameter - the getter caps the backend's count by the state layer's fixed binding-point
+    // array (GL_Getter's GetIndexedBufferQueryPointCount). A shader must be judged against the
+    // number the application was told, not against either half of it.
+    static MobileGL::Int MaxShaderStorageBufferBindings(
+        const MobileGL::MG_Util::ShaderTranspiler::CompileEnv& env) {
+        const MobileGL::Int frontendPoints =
+            static_cast<MobileGL::Int>(MobileGL::MG_State::GLState::BufferBindingPointCount);
+        if (!env.HasBackend()) return frontendPoints;
+        return std::min<MobileGL::Int>(frontendPoints, std::max<MobileGL::Int>(env.params.MaxShaderStorageBufferBindings, 0));
+    }
+
     // The half of a compile that depends on nothing but the source text, the stage and the
-    // environment snapshot: preprocessing, the two lexical rejections, and the two lexical
+    // environment snapshot: preprocessing, the three lexical rejections, and the two lexical
     // side-channel extractions. Split out so P0b layer 2 can memoize exactly this and
     // nothing else - the glslang parse stays per-object because its TShader is consume-once.
     // Deliberately free of any per-object state so the memo is sound.
@@ -172,6 +188,20 @@ namespace {
             return result;
         }
 
+        if (const std::optional<String> bindingError = FindShaderStorageBindingViolation(
+                result.preprocessedSource, MaxShaderStorageBufferBindings(env))) {
+            result.outcome = ShaderPreprocessOutcome::ResourceBindingRejected;
+            result.infoLog = *bindingError;
+            return result;
+        }
+
+        if (const std::optional<String> counterOffsetError =
+                FindAtomicCounterOffsetViolation(result.preprocessedSource)) {
+            result.outcome = ShaderPreprocessOutcome::AtomicCounterOffsetRejected;
+            result.infoLog = *counterOffsetError;
+            return result;
+        }
+
         // The parse this feeds runs in the link-compatible configuration (Vulkan-client
         // env with relaxed rules): the TShader it produces is what glLinkProgram links and
         // what the backends' SPIR-V is generated from - there is no second, GL-client
@@ -248,17 +278,80 @@ namespace MobileGL::MG_State::GLState {
             return;
         }
 
-        ShaderAttrib attrib{.shaderType = MG_Util::ConvertShaderStageToGLEnum(stage),
-                            .sourceStr = shared.preprocessedSource,
-                            .flags = 0,
-                            .env = &compileEnv};
+        const GLenum glShaderType = MG_Util::ConvertShaderStageToGLEnum(stage);
+        // Always 0 on both production parse paths; see the key inventory on
+        // ShaderParseVerdictKeyInputs for why it is in the key regardless.
+        constexpr Uint32 kShaderCompileFlags = 0;
 
-        auto result = ShaderCompiler::CompileShader(attrib);
-        if (result) {
+        // ---- L1c of the shader translation memo: the PARSE VERDICT ----------------------
+        // Everything below this probe - the glslang parse itself - is what a hit skips. What
+        // a hit does NOT produce is a TShader, and that is deliberate rather than a
+        // limitation: the TShader is consume-once, so it could never have been shared, and
+        // nothing on the COMPILE side of GL reads it. GL_COMPILE_STATUS, the info log,
+        // GL_SHADER_SOURCE, attach/detach and reuse across programs are all answered from
+        // what the verdict and the source-only half already carry.
+        //
+        // The parse is not skipped, it is DEFERRED: ClaimParsedShader re-parses on demand
+        // when a link finds no stored parse. A link that hits L1 never asks, so the parse
+        // never happens at all; a link that misses pays exactly one parse, where the CAS
+        // loser has always paid it. See TranslationCache.h's L1c section.
+        const TranslationCacheKey parseKey =
+            ShaderTranslationCacheEnabled()
+                ? BuildShaderParseVerdictKey(ShaderParseVerdictKeyInputs{
+                      .frontendFingerprint = compileEnv.frontendFingerprint,
+                      .shaderType = glShaderType,
+                      .preprocessedSource = StringView(shared.preprocessedSource),
+                      .shaderCompileFlags = kShaderCompileFlags})
+                : TranslationCacheKey{};
+        const ShaderParseVerdictPtr verdict =
+            parseKey.Valid() ? GetShaderParseVerdictCache().Find(parseKey) : nullptr;
+
+        // The two branches produce exactly one thing between them - a verdict, plus a TShader
+        // only when this task actually parsed - and converge on one publish below. Keeping the
+        // publish common is what stops a hit and a miss from ever drifting on WHAT a compile
+        // makes observable.
+        Bool parsedOk = false;
+        String parseLog;
+        SharedPtr<glslang::TShader> parsedShader;
+
+        if (verdict) {
+            parsedOk = verdict->parsed;
+            parseLog = verdict->infoLog;
+            MGLOG_D("ShaderCompileTask: shader %u (stage %d) L1c hit - the glslang parse was skipped; "
+                    "compileStatus = %d",
+                    externalIndex, static_cast<Int>(stage), static_cast<Int>(parsedOk));
+        } else {
+            const ShaderAttrib attrib{.shaderType = glShaderType,
+                                      .sourceStr = shared.preprocessedSource,
+                                      .flags = kShaderCompileFlags,
+                                      .env = &compileEnv};
+            auto result = ShaderCompiler::CompileShader(attrib);
+            parsedOk = result.has_value();
+            if (parsedOk) {
+                parsedShader = result.value();
+            } else {
+                parseLog = result.error().log;
+            }
+            if (parseKey.Valid()) {
+                auto freshVerdict = MakeShared<ShaderParseVerdict>();
+                freshVerdict->parsed = parsedOk;
+                // Empty on success by construction, matching what the publish below does with
+                // the artifacts' own log; the diagnostic the application reads on failure.
+                freshVerdict->infoLog = parseLog;
+                const SizeT verdictBytes = ShaderParseVerdictBytes(*freshVerdict);
+                GetShaderParseVerdictCache().Insert(parseKey, ShaderParseVerdictPtr(Move(freshVerdict)),
+                                                    verdictBytes);
+            }
+        }
+
+        if (parsedOk) {
             artifacts.compileStatus = true;
-            artifacts.shader = result.value();
+            // NULL ON AN L1c HIT, and that is a supported state rather than an oversight: see
+            // ShaderCompileArtifacts::shader and ClaimParsedShader.
+            artifacts.shader = Move(parsedShader);
             // Copy, not move: `shared` may alias a cache entry that has to outlive us, and
-            // `fresh` is about to be handed to the cache.
+            // `fresh` is about to be handed to the cache. Populated on the hit path too - it
+            // is what ClaimParsedShader's deferred parse consumes.
             artifacts.preprocessedSource = shared.preprocessedSource;
             artifacts.explicitUniformLocations = shared.explicitUniformLocations;
             artifacts.explicitOpaqueBindings = shared.explicitOpaqueBindings;
@@ -267,7 +360,7 @@ namespace MobileGL::MG_State::GLState {
                 cache->Insert(stage, sourceHash, *source, compileEnv.fingerprint, Move(fresh));
             }
         } else {
-            artifacts.infoLog = result.error().log;
+            artifacts.infoLog = Move(parseLog);
             // Deferred, not logged here, for two reasons. MGLOG from a pool thread interleaves
             // mid-line with the GL thread's own output and lands out of order relative to the
             // glCompileShader that caused it; diagnostics.logLines is replayed by the join, on
@@ -310,10 +403,11 @@ namespace MobileGL::MG_State::GLState {
             }
         }
 
-        // Either another link already consumed the stored parse (and mapIO mutated its
-        // intermediate), or there never was one. Re-parse the preprocessed source through the
-        // identical configuration; that costs one glslang parse, which is what GenerateBinary
-        // used to spend here on EVERY link rather than only on reuse.
+        // Three ways to be here: another link already consumed the stored parse (and mapIO
+        // mutated its intermediate); the compile hit L1c and never parsed at all; or there
+        // simply never was one. All three want the same thing - parse the preprocessed source
+        // through the identical configuration. That costs one glslang parse, which is what
+        // GenerateBinary used to spend here on EVERY link rather than only when needed.
         //
         // The guard is not optional on this path: from stage 4 this runs on a pool worker,
         // and TShader::parse would leave that worker's TLS allocator pointing at a pool the
@@ -329,7 +423,12 @@ namespace MobileGL::MG_State::GLState {
                             .env = artifacts.env.get()};
         auto result = ShaderCompiler::CompileShader(attrib);
         if (!result) {
-            // Should be unreachable: the same source parsed successfully at Compile().
+            // Should be unreachable. This exact (stage, preprocessed source, front-end env)
+            // parsed successfully once - either at this node's own Compile(), or at the
+            // Compile() whose verdict L1c handed this node - and every input the parse reads
+            // is covered by that tuple. ConsumeShaders turns a null into a failed link with a
+            // named internal error rather than a crash, which is the right shape for a
+            // "cannot happen" that would otherwise be a silent miscompile.
             outReparseLog = result.error().log;
             return nullptr;
         }

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.h

@@ -41,6 +41,20 @@ namespace MobileGL::MG_State::GLState {
         // re-parse in ClaimParsedShader() reproduces the original parse exactly, instead of
         // re-reading whatever the backend says now.
         SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env;
+        // The parse, WHEN THIS COMPILE ACTUALLY PARSED - and null otherwise, including when
+        // compileStatus is true.
+        //
+        // That combination is not a half-finished compile; it is an L1c hit. The translation
+        // memo's compile half (TranslationCache.h) knows this exact (stage, preprocessed
+        // source, front-end env) parses cleanly, so the verdict is published without running
+        // glslang. What a hit cannot hand over is the TShader itself: mapIO mutates its
+        // aliased intermediate at link, so a parse feeds exactly ONE link and could never
+        // have been shared between compiles.
+        //
+        // Nothing on the compile side of GL reads this - GL_COMPILE_STATUS, the info log,
+        // GL_SHADER_SOURCE, attach/detach and reuse across programs are all answered from the
+        // fields below. The one reader is ClaimParsedShader, which treats null as "parse it
+        // now", which is the same path the consume-once CAS loser has always taken.
         SharedPtr<glslang::TShader> shader;
         // The source the parse actually consumed (after PreprocessShaderSource), kept for
         // ClaimParsedShader's re-parse so a later link never depends on the preprocessor
@@ -53,8 +67,9 @@ namespace MobileGL::MG_State::GLState {
     };
 
     // The unit of asynchronous shader compilation: one glCompileShader's worth of pure CPU
-    // work - preprocess, the two lexical rejections, the two lexical extractions, and the
-    // glslang parse - with every input it needs owned by the node itself.
+    // work - preprocess, the two lexical rejections, the two lexical extractions, and (unless
+    // the translation memo's compile half already knows the answer) the glslang parse - with
+    // every input it needs owned by the node itself.
     //
     // That ownership is the whole point. The node reads no GL-thread state (the source is a
     // SharedPtr<const String> snapshot, the device limits come from the CompileEnv snapshot,
@@ -87,22 +102,29 @@ namespace MobileGL::MG_State::GLState {
         // ---- output: valid iff IsComplete(), immutable afterwards ----
         ShaderCompileArtifacts artifacts;
 
-        // Hands out a link-consumable TShader, exactly once for the stored parse.
+        // Hands out a link-consumable TShader, parsing one on demand when this node has none.
         //
-        // glslang's mapIO mutates the TShader's aliased intermediate, so the parse this node
-        // produced may feed exactly ONE link; every later link (a relink, or the same shader
-        // attached to a second program) needs a fresh parse. The claim is a CAS on this
-        // shared node rather than a flag on the ShaderObject because from stage 4 the two
-        // callers can be two ProgramLinkTasks running on two workers: two programs sharing
-        // one shader, linked back to back. Copying the parse out and tracking consumed-ness
-        // per program would let both of them decide they were the first, run mapIO over the
-        // same intermediate twice, and ship silently corrupt SPIR-V.
+        // TWO WAYS TO GET HERE WITHOUT A STORED PARSE, and they share one implementation:
+        //   * the CAS loser. glslang's mapIO mutates the TShader's aliased intermediate, so
+        //     the parse this node produced may feed exactly ONE link; every later link (a
+        //     relink, or the same shader attached to a second program) needs a fresh one. The
+        //     claim is a CAS on this shared node rather than a flag on the ShaderObject
+        //     because from stage 4 the two callers can be two ProgramLinkTasks on two
+        //     workers: two programs sharing one shader, linked back to back. Copying the
+        //     parse out and tracking consumed-ness per program would let both of them decide
+        //     they were the first, run mapIO over the same intermediate twice, and ship
+        //     silently corrupt SPIR-V.
+        //   * an L1c HIT. The compile published a verdict without parsing at all (see
+        //     ShaderCompileArtifacts::shader), so this call IS the parse - deferred out of
+        //     glCompileShader to the first link that genuinely needs an AST. A link served
+        //     from L1 never gets here, which is the whole point: that program's front end
+        //     never constructs a glslang object of any kind.
         //
-        // The CAS loser re-parses artifacts.preprocessedSource against THIS node's own
+        // Either way the parse runs over artifacts.preprocessedSource against THIS node's own
         // CompileEnv (not against whatever the backend reports now), through the identical
-        // CompileShader path - so winner and loser produce byte-identical SPIR-V. Callable
-        // only once IsComplete() and compileStatus are true. Returns null only if that
-        // re-parse fails, and outReparseLog then carries its diagnostics.
+        // CompileShader path - so every claimant produces byte-identical SPIR-V. Callable
+        // only once IsComplete() and compileStatus are true. Returns null only if that parse
+        // fails, and outReparseLog then carries its diagnostics.
         //
         // Const because the claim is the node's own synchronization, not a mutation of its
         // published artifacts: a claim that is taken and then abandoned (its link was

MobileGL/MG_State/GLState/ProgramState/ShaderObject.cpp

@@ -140,6 +140,13 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void ShaderObject::Compile() {
+        // The compile-environment snapshot is taken HERE, on the GL thread, and handed to
+        // the job. Everything the pipeline needs to know about the device comes through it,
+        // never through pActiveBackendObject - that is what makes the body movable.
+        // Hoisted above the memo check because the memo must be env-disciplined too (below).
+        const SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env =
+            MG_Util::ShaderTranspiler::GetCurrentCompileEnv();
+
         // P0b layer 1, as a tri-state: the memo is "the node in m_compiled was built from
         // the string m_source still points at". SetShaderSource only swaps that pointer when
         // the text actually differs, so this is a pointer compare, and it covers Pending as
@@ -152,7 +159,18 @@ namespace MobileGL::MG_State::GLState {
         // ClaimParsedShader's on-demand re-parse needs - a real recompile would have handed
         // the next link a fresh parse, the no-op hands it a fresh re-parse of the identical
         // source instead. Same result, one parse either way.
-        if (HasMemoizedCompile()) return;
+        //
+        // The environment joins the check (ShaderSourceKey.h's memo-hazard rule: a memo
+        // must never be handed back under an environment other than the one it was
+        // computed against). Layers 2 and 3 key on the fingerprint, but this memo sits
+        // ABOVE both, so without this compare a node computed against a dead environment
+        // - e.g. a compute shader rejected against the pre-capability fallback limits -
+        // would keep answering forever while a fresh object with byte-identical source
+        // compiles fine. The fingerprint is a content hash, so a republish of identical
+        // capabilities still hits.
+        if (HasMemoizedCompile() && m_compiled->env != nullptr && m_compiled->env->fingerprint == env->fingerprint) {
+            return;
+        }
 
         // Two reasons to stay on this thread, one rule. Without the async flag the whole
         // path must be byte-identical to the synchronous implementation, and a cache-less
@@ -168,12 +186,6 @@ namespace MobileGL::MG_State::GLState {
         // glMaxShaderCompilerThreadsKHR(0) and a flag-off build both bypass sharing exactly
         // as they bypass the pool, and their behaviour stays byte-identical to pre-stage-6.
         const Bool runOnPool = m_preprocessCache && MG_Util::Async::AsyncShaderCompileActive();
-
-        // The compile-environment snapshot is taken HERE, on the GL thread, and handed to
-        // the job. Everything the pipeline needs to know about the device comes through it,
-        // never through pActiveBackendObject - that is what makes the body movable.
-        const SharedPtr<const MG_Util::ShaderTranspiler::CompileEnv> env =
-            MG_Util::ShaderTranspiler::GetCurrentCompileEnv();
         const Uint64 sourceHash = ShaderPreprocessCache::HashSource(*m_source);
 
         // ---- P1 stage 6: adopt an equivalent compile instead of enqueueing a duplicate ----

MobileGL/MG_State/GLState/ProgramState/ShaderPreprocessCache.h

@@ -26,6 +26,12 @@ namespace MobileGL::MG_State::GLState {
         ComputeLocalSizeRejected,
         // FindReservedIdentifierViolation rejected it.
         ReservedIdentifierRejected,
+        // FindShaderStorageBindingViolation rejected it: a storage block declared a binding at or
+        // past GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS.
+        ResourceBindingRejected,
+        // FindAtomicCounterOffsetViolation rejected it: an atomic counter declared a
+        // layout(offset =) that is misaligned or reaches past GL_MAX_ATOMIC_COUNTER_BUFFER_SIZE.
+        AtomicCounterOffsetRejected,
         // The source-only half was clean but glslang rejected the preprocessed source.
         // Memoizing this saves the parse itself on every later object with that source.
         ParseFailed,

MobileGL/MG_State/GLState/RenderState/RenderState.cpp

@@ -843,6 +843,21 @@ namespace MobileGL {
                     stored = box;
                     stateChanged = true;
                 }
+                // "The application has written this rectangle" is a DIFFERENT predicate from "the
+                // value moved", and the backends need the first one: glScissor(0, 0, 0, 0) as the
+                // very first scissor call leaves every stored box byte-identical to its
+                // never-written default, and that call is precisely the one whose meaning a
+                // backend must stop guessing at (see ScissorBoxWrittenMask).
+                //
+                // The transition has to count as a state change for the version too. DirectGLES'
+                // SyncRenderState early-outs on an unchanged render-state version BEFORE it
+                // reaches the span memcmp that would otherwise notice the mask, so a version-less
+                // flag flip would sit in the parameter block and never be pushed. It is a
+                // once-per-index transition, so the steady state still costs nothing.
+                if (m_parameters.ScissorBoxWrittenMask != kAllViewportsMask) {
+                    m_parameters.ScissorBoxWrittenMask = kAllViewportsMask;
+                    stateChanged = true;
+                }
                 if (stateChanged) ++m_version;
             }
 
@@ -855,9 +870,15 @@ namespace MobileGL {
                     MOBILEGL_ASSERT(false, "Scissor box index out of range: %u", index);
                     return;
                 }
-                if (m_parameters.ScissorBoxes[index] == box) return;
+                // See SetScissorBox: a first write is state even when it does not move the value,
+                // so the unchanged-value early-out may only fire once this index is already
+                // marked written.
+                const Uint32 writtenBit = 1u << index;
+                const Bool alreadyWritten = (m_parameters.ScissorBoxWrittenMask & writtenBit) != 0;
+                if (alreadyWritten && m_parameters.ScissorBoxes[index] == box) return;
 
                 m_parameters.ScissorBoxes[index] = box;
+                m_parameters.ScissorBoxWrittenMask |= writtenBit;
                 ++m_version;
             }