[Fix, Test] (clientfb): heal a texture's record from its first set_texture_params - a texture born while the family was not live (the context's default textures are constructed before the backend registers its consumer) has no record, so the application's first glTexParameter* on texture 0 was refused, silently latched away before m-1 and the retrace census's one residual after it went loud; the params path now publishes the create, the storage if the texture has any, and then the parameters, the respecify path's own self-heal shape

- VulkanRenderer::LookupVaoDrawMemo's legacy arm read MG_Config::Features.PipeHandleAbaControl
  a fourth time, bypassing the one-question accessor MagmaPipeAbaControlDefeatsIdentity that
  55d2af9b's own message says all the control's sites go through. It could never be false
  there: the control's early return fires ahead of BOTH arms, so a run that reaches the legacy
  compare has the knob off. The compare is unconditional again, with a note saying where the
  question is answered and to route through the accessor if that early return is ever narrowed
  - which is the trap the dead line was, since narrowing it would have silently restored D18's
  retired semantics at this one site.
- HandleRecycleScenario's vertex-array case still said "BOTH the VAO and the buffer are
  recycled here so that a key built out of raw addresses matches", which the body has
  contradicted since 55d2af9b: both buffers are created before the ABA window and neither is
  deleted inside it, deliberately, so that no buffer traffic moves VkBufferManager's
  slice-epoch counter inside the window. Only the VAO is recycled, and only its GL name - the
  heap block is not handed back, which is why the knob rather than the allocator constructs the
  AbaControl arms' collision.

.github/scripts/validate-plugin-apks.sh

@@ -44,12 +44,12 @@ require 'key:MOBILEGL_BACKEND_TYPE' "$plugin_resource_text" 'V2 backend variable
 require 'defaultValue:DirectGLES' "$plugin_resource_text" 'V2 DirectGLES default'
 require 'DirectVulkan' "$plugin_resource_text" 'V2 DirectVulkan option'
 require 'key:MOBILEGL_DISABLE_TIMERQUERY' "$plugin_resource_text" 'V2 timer-query toggle'
-require 'key:MOBILEGL_DISABLE_SUBGROUP' "$plugin_resource_text" 'V2 Vulkan subgroup toggle'
+require 'key:MOBILEGL_MAGMA_DISABLE_SUBGROUP' "$plugin_resource_text" 'V2 Vulkan subgroup toggle'
 require 'key:MOBILEGL_MAGMA_R11G11B10F_FALLBACK' "$plugin_resource_text" 'V2 Magma format fallback toggle'
 require 'key:MOBILEGL_MAGMA_FRAMESINFLIGHT' "$plugin_resource_text" 'V2 Magma frames-in-flight setting'
-require 'key:MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER' "$plugin_resource_text" 'V2 sampler workaround toggle'
+require 'key:MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER' "$plugin_resource_text" 'V2 sampler workaround toggle'
 require 'key:MOBILEGL_COHERENT_AS_FLUSH' "$plugin_resource_text" 'V2 coherent-as-flush toggle'
-require 'key:MOBILEGL_USE_ANGLE' "$plugin_resource_text" 'V2 ANGLE toggle'
+require 'key:MOBILEGL_ESPRYT_USE_ANGLE' "$plugin_resource_text" 'V2 ANGLE toggle'
 
 if [[ $(grep -Fc 'fclPlugin_V2' <<<"$plugin_manifest") -ne 1 ]]; then
   echo '::error::Plugin manifest must expose exactly one V2 descriptor' >&2

.github/workflows/apk.yml

@@ -6,6 +6,10 @@ on:
       - dev
       - Feat/Backend-Direct-GLES
       - Feat/Backend-Direct-Vulkan
+      # TEMPORARY, remove before merging the MGPipe work into dev: the disaggregation
+      # branch runs the full lane on every push so a phase's landing is not gated on
+      # someone remembering to dispatch the workflow by hand.
+      - feat/disaggregated
   workflow_dispatch:
 
 jobs:
@@ -417,12 +421,12 @@ jobs:
 
       - name: Retrace and validate
         env:
-          MOBILEGL_USE_ANGLE: ${{ matrix.backend.name == 'DirectGLES' && '1' || '0' }}
+          MOBILEGL_ESPRYT_USE_ANGLE: ${{ matrix.backend.name == 'DirectGLES' && '1' || '0' }}
           MOBILEGL_TRACE_ANGLE_VARIANT: ${{ matrix.case.name == 'minecraft-1.21.4-fabric-iris-bliss-in-world' && '90a62123d794' || 'ec889e6ea831' }}
           MOBILEGL_MAGMA_R11G11B10F_FALLBACK: ${{ matrix.backend.name == 'DirectVulkan' && '1' || '0' }}
-          MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
-          MOBILEGL_DERIVE_NUM_SUBGROUPS: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
-          MOBILEGL_ITERATIONRP_FIX_BARRIER: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
         run: |
           apk_file="android-retrace-apks/MobileGL-plugin-trace-release-${GITHUB_SHA}.apk"
           test -f "${apk_file}"

.gitmodules

@@ -34,3 +34,6 @@
 [submodule "include/ska"]
 	path = include/ska
 	url = https://github.com/MobileGL-Dev/flat_hash_map.git
+[submodule "3rdparty/flatbuffers"]
+	path = 3rdparty/flatbuffers
+	url = https://github.com/google/flatbuffers.git

CMakeLists.txt

@@ -14,6 +14,26 @@ option(MOBILEGL_ENABLE_TRACY      "Enable tracy for profiling"
 option(MOBILEGL_BUILD_TRACE_REPLAY "Build desktop apitrace replay runner"            OFF)
 option(MOBILEGL_TRACE_ANGLE_VARIANTS "Enable signed trace-APK ANGLE variant loading" OFF)
 option(MOBILEGL_IOS               "Build MobileGL for iOS instead of macOS when APPLE is set" OFF)
+# The disaggregated (two-process) shape. OFF is the shipping default and OFF
+# must stay byte-comparable to a tree without MG_Remote at all: nothing under
+# MobileGL/MG_Remote/ is compiled, no include path is added, and no library is
+# linked, so `nm --defined-only libMobileGL.so | grep -i MG_Remote` is empty.
+# That emptiness is one of the two byte-level equalities the plan's validation
+# gates keep (section 10.3).
+option(MOBILEGL_BUILD_DISAGGREGATED "Build the MG_Remote transport layer (two-process shape)" OFF)
+option(MOBILEGL_BUILD_SERVER_SPIKE "Build the P0 spike-A MobileGLServer delivery-chain executable (Android only)" OFF)
+# The PipeInputs strangler (ARCHITECTURE.md 9.2). OFF is the pull build and must stay
+# byte-identical to a tree without either option: MGB_CTX is the live GLContext, no
+# MGPipe/PipeInputs source is compiled, every MGP_FILL is ((void)0).
+option(MOBILEGL_PIPE_PUSH "Backends read frontend state through the MGPipe PipeInputs block instead of MG_State::pGLContext (ARCHITECTURE.md 9.2 phase A)" OFF)
+option(MOBILEGL_PIPE_VERIFY "Compile SnapshotFromGLContext() and the G4 per-verb shadow comparator; implies MOBILEGL_PIPE_PUSH; never shipped" OFF)
+# Track H's old-versus-new arm (ARCHITECTURE.md 9.6). With a MOBILEGL_PIPE_PUSH bit clear
+# the backend would still run the RE-KEYED memo code, so the bitmask alone stops being a
+# valid A/B the moment a handle wave lands: this option compiles the pre-handle arm - the
+# registries, OwnerEquals, the TwinLookupMemos, g_fbSlotCache, ComputePipelineStateHash,
+# the address-keyed VaoDrawMemo - beside it, behind the same PipeInputs interface. ON for
+# the whole migration window; it retires with the pull path itself at P13.
+option(MOBILEGL_PIPE_LEGACY_MEMOS "Compile the pre-handle memo arm beside the {slot, gen} arm so Track H has a real A/B (ARCHITECTURE.md 9.6)" ON)
 set(MOBILEGL_LOG_ACTIVE_LEVEL "MOBILEGL_LOG_LEVEL_INFO" CACHE STRING "MobileGL active log level macro")
 set(MOBILEGL_VULKAN_LIBRARY "" CACHE FILEPATH "Vulkan loader/MoltenVK library to link for iOS builds")
 
@@ -238,6 +258,8 @@ set(SOURCE_FILES
 
     MobileGL/MG_Util/Metrics/BufferMetrics.cpp
 
+    MobileGL/MG_Util/Metrics/PipeStats.cpp
+
     MobileGL/MG_Util/Converters/GLToStr/GLEnumConverter.cpp
     MobileGL/MG_Util/Converters/EGLToStr/EGLEnumConverter.cpp
     MobileGL/MG_Util/Converters/MGToStr/DataTypeConverter.cpp
@@ -285,6 +307,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/PackDoubleVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenXfbInterfaceBlocksPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/UniquifyIoBlockNamesPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripIoBlockLocationsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/SplitArrayVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RebaseInstanceIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ZeroBaseVertexPass.cpp
@@ -306,13 +329,16 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeFragmentOutputIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeResourceArrayIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenAtomicCounterBlockPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DemotePointSizePass.cpp
 
     MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.cpp
     MobileGL/MG_Util/BackendLoaders/Vulkan/Loader.cpp
 
     MobileGL/MG_Util/SelfTest/DriverBugProbes.cpp
+    MobileGL/MG_Util/SelfTest/PersistentBufferOrderingProbe.cpp
     MobileGL/MG_Util/SelfTest/DriverPost.cpp
     MobileGL/MG_Util/SelfTest/DriverPostIterationRPWitness.cpp
+    MobileGL/MG_Util/SelfTest/PrimitivesGeneratedNoXfbProbe.cpp
 
     MobileGL/MG_Util/Texture/PixelStoreProcessor.cpp
     MobileGL/MG_Util/Texture/TextureFormatProcessor.cpp
@@ -335,6 +361,7 @@ set(SOURCE_FILES
     MobileGL/MG_Impl/GLImpl/Program/ProgramInterface.cpp
     MobileGL/MG_Impl/GLImpl/Program/GL_ProgramPipeline.cpp
     MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp
+    MobileGL/MG_Impl/GLImpl/Debug/GL_Debug.cpp
     MobileGL/MG_Impl/GLImpl/Texture/Validators.cpp
     MobileGL/MG_Impl/GLImpl/Texture/ProxyTexture.cpp
     MobileGL/MG_Impl/GLImpl/VertexArray/GL_VertexArray.cpp
@@ -392,6 +419,7 @@ set(SOURCE_FILES
     MobileGL/MG_State/GLState/TextureState/TextureObject2DCube.cpp
     MobileGL/MG_State/GLState/TextureState/TextureObject3D.cpp
     MobileGL/MG_State/GLState/TextureState/TextureObjectBuffer.cpp
+    MobileGL/MG_State/GLState/TextureState/TextureObjectView.cpp
     MobileGL/MG_State/GLState/TextureState/TextureUnit.cpp
     MobileGL/MG_State/GLState/TextureState/TextureState.cpp
     MobileGL/MG_State/GLState/ProgramState/ProgramObject.cpp
@@ -412,6 +440,85 @@ set(SOURCE_FILES
     MobileGL/MG_State/GLState/RenderbufferState/RenderbufferState.cpp
 )
 
+# ---------------------------------------------------------------------------
+# MG_Remote (disaggregated transport). Everything below is gated: with the
+# option OFF not one file here is compiled and no include path is added.
+# ---------------------------------------------------------------------------
+
+# FlatBuffers is a submodule and its runtime is header-only. Guard both ways:
+# a checkout without the submodule must configure and build, just without the
+# disaggregated shape, rather than fail with a missing-header error a hundred
+# lines later. Note this only checks for the RUNTIME headers - flatc is never
+# built here (see scripts/gen_protocol.py).
+if (MOBILEGL_BUILD_DISAGGREGATED AND
+    NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/3rdparty/flatbuffers/include/flatbuffers/flatbuffers.h")
+    message(WARNING
+        "MOBILEGL_BUILD_DISAGGREGATED=ON but 3rdparty/flatbuffers/include is missing. "
+        "Run `git submodule update --init 3rdparty/flatbuffers`. Building without the "
+        "disaggregated shape for this configure; the cached ON takes effect once the "
+        "submodule is present.")
+    # A NORMAL variable, deliberately not `CACHE BOOL ... FORCE`: forcing OFF into the cache
+    # made the plain re-configure after `git submodule update` stay OFF with no message at
+    # all. Shadowing the cache entry for this configure only keeps the operator's ON where it
+    # was, so the next configure - with the submodule there - honours it.
+    set(MOBILEGL_BUILD_DISAGGREGATED OFF)
+endif()
+
+# MOBILEGL_PIPE_VERIFY implies MOBILEGL_PIPE_PUSH: the comparator compares the pushed block
+# against a snapshot, so there has to be a pushed block. A normal variable, not a forced
+# cache write, for the same reason as the disaggregated fallback above.
+if (MOBILEGL_PIPE_VERIFY AND NOT MOBILEGL_PIPE_PUSH)
+    message(STATUS "MobileGL: MOBILEGL_PIPE_VERIFY=ON forces MOBILEGL_PIPE_PUSH ON for this configure")
+    set(MOBILEGL_PIPE_PUSH ON)
+endif()
+
+# In a pull build the legacy arm is the ONLY arm, so the option cannot be off there.
+# A normal variable, not a forced cache write, for the same reason as the two above.
+if (NOT MOBILEGL_PIPE_PUSH AND NOT MOBILEGL_PIPE_LEGACY_MEMOS)
+    message(STATUS "MobileGL: MOBILEGL_PIPE_PUSH=OFF forces MOBILEGL_PIPE_LEGACY_MEMOS ON for this "
+                   "configure: with nothing pushed it is the only arm there is")
+    set(MOBILEGL_PIPE_LEGACY_MEMOS ON)
+endif()
+
+if (MOBILEGL_PIPE_PUSH)
+    message(STATUS "MobileGL: PipeInputs push ON, appending the MGPipe fill sources")
+    list(APPEND SOURCE_FILES
+        MobileGL/MG_Backend/MGPipe/PipeInputs.cpp
+        MobileGL/MG_Impl/Pipe/PipeFill.cpp
+        # P2's contract: the chunk table and its subset hash, the in-process applier, and
+        # the client's {slot, gen} allocator. All three are push-only, which is how the
+        # pull build gains no symbol from P2 (G1) - a declaration emits nothing.
+        MobileGL/MG_Pipe/MGPipeRenderStateSpans.cpp
+        MobileGL/MG_Pipe/PipeApply.cpp
+        MobileGL/MG_Impl/Pipe/SlotAllocator.cpp
+        # P4a's contract: the reflection-archive serializer over ProgramArtifacts.h's
+        # VisitFields tables. Push-only for the same G1 reason as the three above - in
+        # monolith the archive never crosses (create_shader_state hands the two structs over
+        # by pointer beside the record), so the codec is live code only in the VERIFY lane,
+        # where the applier serialises, deserialises and field-compares before storing.
+        MobileGL/MG_State/GLState/ProgramState/ProgramArtifactsCodec.cpp
+    )
+endif()
+
+if (MOBILEGL_BUILD_DISAGGREGATED)
+    message(STATUS "MobileGL: disaggregated transport ON, appending MG_Remote sources")
+    list(APPEND SOURCE_FILES
+        MobileGL/MG_Remote/Transport/Ring.cpp
+        MobileGL/MG_Remote/Transport/Doorbell.cpp
+        MobileGL/MG_Remote/Transport/ShmSegment.cpp
+        # Both platform halves are listed unconditionally and each is empty on
+        # the other OS, so neither can rot behind an `if (WIN32)` nobody
+        # configures.
+        MobileGL/MG_Remote/Transport/ShmSegmentPosix.cpp
+        MobileGL/MG_Remote/Transport/ShmSegmentWin32.cpp
+        MobileGL/MG_Remote/Transport/FdPassing.cpp
+        MobileGL/MG_Remote/Transport/InProcessTransport.cpp
+        # Keeps MG_Util/Debug/Log.h - and through it the GL frontend's
+        # umbrella header - out of the header-only wire code (WireLog.h).
+        MobileGL/MG_Remote/Transport/WireLog.cpp
+    )
+endif()
+
 if (APPLE AND NOT MOBILEGL_IOS)
     list(APPEND SOURCE_FILES
         MobileGL/MG_Impl/CGLImpl/CGLImpl.cpp
@@ -462,11 +569,29 @@ set(MOBILEGL_COMPILE_DEF
         -DASIO_NO_DEPRECATED
 )
 
+if (MOBILEGL_BUILD_DISAGGREGATED)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_BUILD_DISAGGREGATED=1)
+endif()
+
+if (MOBILEGL_PIPE_PUSH)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_PIPE_PUSH=1)
+endif()
+if (MOBILEGL_PIPE_VERIFY)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_PIPE_VERIFY=1)
+endif()
+if (MOBILEGL_PIPE_LEGACY_MEMOS)
+    list(APPEND MOBILEGL_COMPILE_DEF -DMOBILEGL_PIPE_LEGACY_MEMOS=1)
+endif()
+
 message(STATUS "MOBILEGL_COMPILE_DEF=${MOBILEGL_COMPILE_DEF}")
 
 set(MOBILEGL_INCLUDE_DIR
         ${CMAKE_SOURCE_DIR}/include
         ${CMAKE_SOURCE_DIR}/MobileGL
+        # The MGPipe boundary headers. They are reachable as <MG_Pipe/MGPipe.h> through the
+        # line above too; this entry lets the client, the backends and MG_Remote spell them
+        # as <MGPipe.h> once MG_Pipe stops being a leaf of the frontend tree.
+        ${CMAKE_SOURCE_DIR}/MobileGL/MG_Pipe
         ${spirv-tools_SOURCE_DIR}
         ${spirv-tools_SOURCE_DIR}/include
         ${spirv-tools_BINARY_DIR}
@@ -477,6 +602,13 @@ set(MOBILEGL_INCLUDE_DIR
         ${CMAKE_SOURCE_DIR}/3rdparty/asio/include
 )
 
+if (MOBILEGL_BUILD_DISAGGREGATED)
+    # Header-only runtime: an include path, no add_subdirectory, no link
+    # target, and above all no flatc in the build graph. protocol_generated.h
+    # is committed and regenerated by scripts/gen_protocol.py.
+    list(APPEND MOBILEGL_INCLUDE_DIR ${CMAKE_SOURCE_DIR}/3rdparty/flatbuffers/include)
+endif()
+
 add_library(${CMAKE_PROJECT_NAME} SHARED
     ${SOURCE_FILES}
 )
@@ -693,3 +825,43 @@ endif()
 if (ANDROID AND MOBILEGL_BUILD_INTEGRATION_TEST)
     add_subdirectory(MobileGL/MG_IntegrationTest)
 endif()
+
+# ---------------------------------------------------------------------------
+# P0 spike A: the Android delivery chain for a second native executable.
+#
+# The disaggregated design needs a server process on Android (PLAN-B.md §8.1,
+# inheriting PLAN.md §11.1-§11.6). An APK's only exec-able install location is
+# lib/<abi>/, and the packager only puts a file there if it is named lib*.so -
+# so a second executable has to be built with an .so name and exec'd out of
+# getApplicationInfo().nativeLibraryDir. This target is the stub that proves the
+# chain end to end: it is packaged like a library, exec'd from the app's own
+# untrusted_app process, and writes a marker the parent reads back.
+#
+# Off by default and ANDROID-only, so no shipping configuration builds it. The
+# trace flavour of the plugin APK turns it on (android-plugin/build.gradle).
+# ---------------------------------------------------------------------------
+if (ANDROID AND MOBILEGL_BUILD_SERVER_SPIKE)
+    add_executable(MobileGLServer
+        ${CMAKE_CURRENT_SOURCE_DIR}/tools/spikes/server_stub/main.cpp)
+
+    # An executable that is named like a shared library still has to be a real
+    # PIE executable: Android has refused non-PIE executables since API 21, and
+    # the name alone does not change what the loader demands of the file.
+    set_target_properties(MobileGLServer PROPERTIES
+        PREFIX "lib"
+        SUFFIX ".so"
+        OUTPUT_NAME "MobileGLServer"
+        POSITION_INDEPENDENT_CODE ON)
+    target_compile_options(MobileGLServer PRIVATE -fPIE)
+    target_link_options(MobileGLServer PRIVATE -pie)
+
+    # AGP packages what the external native build drops into the per-ABI output
+    # directory, and it selects by the .so extension. CMake puts executables in
+    # CMAKE_RUNTIME_OUTPUT_DIRECTORY, which is not the directory AGP hands to
+    # CMAKE_LIBRARY_OUTPUT_DIRECTORY, so point this target's runtime output at
+    # the library directory when the generator gave us one.
+    if (CMAKE_LIBRARY_OUTPUT_DIRECTORY)
+        set_target_properties(MobileGLServer PROPERTIES
+            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_LIBRARY_OUTPUT_DIRECTORY}")
+    endif()
+endif()

MobileGL/Config.h

@@ -14,7 +14,7 @@ namespace MobileGL::MG_Config {
     inline const String ProjectName = "MobileGL";
     inline const String CoreName = "MobileGL Core";
     inline const String CoreVendor = "MobileGL-Dev (BZLZHH, Swung0x48, Tungsten)";
-    inline const Version CoreVersion = {26, 8, 0, "-dev", VersionType::Development};
+    inline const Version CoreVersion = {26, 9, 0, "-dev", VersionType::Development};
     inline const VersionStringFormatAttrib DefaultVersionStringFormatAttrib = {2, 2, 0, true, true};
     inline const Uint64 CacheVersion = 0;
 
@@ -69,27 +69,34 @@ namespace MobileGL::MG_Config {
     struct FeaturesTable {
         // MOBILEGL_DISABLE_TIMERQUERY: do not advertise or use GPU timer queries.
         Bool DisableTimerQuery = false;
+        // MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW: advertise GL_ARB_texture_view on DirectGLES when
+        // the host ES driver has EXT/OES_texture_view. Off by default: the host extension is
+        // present on Adreno 830 and the functional half of KHR-GL4{2,3}.texture_view still fails
+        // there, because the view's ES internalformat is normalized independently of the storage
+        // it aliases (see BackendObject_DirectGLES::BuildAdvertisedExtensions). The flag exists
+        // so that work can be done without editing the gate.
+        Bool EsprytEnableTextureView = false;
         // MOBILEGL_ENABLE_SPIRV_VALIDATION: validate generated and transformed SPIR-V.
         // Disabled by default because validation is a diagnostics-only cost.
         Bool EnableSpirvValidation = false;
-        // MOBILEGL_USE_ANGLE: load ANGLE EGL/GLES libraries.
+        // MOBILEGL_ESPRYT_USE_ANGLE: load ANGLE EGL/GLES libraries.
-        Bool UseAngle = false;
+        Bool EsprytUseAngle = false;
 #if defined(MOBILEGL_TRACE_ANGLE_VARIANTS)
         // MOBILEGL_TRACE_ANGLE_VARIANT: signed trace-APK ANGLE build short hash.
         String TraceAngleVariant;
 #endif
-        // MOBILEGL_DISABLE_SUBGROUP: force-disable Vulkan shader subgroup support,
+        // MOBILEGL_MAGMA_DISABLE_SUBGROUP: force-disable Vulkan shader subgroup support,
         // including the opt-in emulated compute path below.
-        Bool DisableSubgroup = false;
+        Bool MagmaDisableSubgroup = false;
         // MOBILEGL_MAGMA_EMULATE_SUBGROUP: implement GL_KHR_shader_subgroup's compute
         // stage on a 32-lane VIRTUAL subgroup lowered to workgroup-shared memory
         // (ShaderTranspiler::EmulateSubgroupsPass). Strictly a last resort: it only ever
         // engages when this flag is set AND the device has no native subgroup support at
         // all - a device with real subgroup operations always uses them natively,
         // whatever their width (the known iterationRP defect is patched by
-        // FixIterationRPSubgroupScratch below instead). Off by default.
+        // MagmaFixIterationRPSubgroupScratch below instead). Off by default.
         Bool MagmaEmulateSubgroup = false;
-        // MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: patch iterationRP's own bug - the
+        // MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH: patch iterationRP's own bug - the
         // pack declares `shared vec2 prefixSumCache[32]` for a 512-invocation exposure
         // reduction and indexes it by gl_SubgroupID, so any device with sub-16-lane
         // subgroups (8-lane lavapipe -> 64 subgroups) writes shared memory out of
@@ -99,12 +106,12 @@ namespace MobileGL::MG_Config {
         // so every other shader passes through byte-identical - as does iterationRP
         // itself on >= 16-lane devices. Auto is ON; ForceOff replays the pack's bug
         // verbatim.
-        QuirkOverride FixIterationRPSubgroupScratch = QuirkOverride::Auto;
+        QuirkOverride MagmaFixIterationRPSubgroupScratch = QuirkOverride::Auto;
-        // MOBILEGL_ITERATIONRP_FIX_BARRIER: repair Program 203's missing workgroup
+        // MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER: repair Program 203's missing workgroup
         // rendezvous between its two reductions over prefixSumCache. Off by default and
         // fingerprint-gated by FixIterationRPBarrierPass when enabled.
-        Bool IterationRPFixBarrier = false;
+        Bool MagmaIterationRPFixBarrier = false;
-        // MOBILEGL_DERIVE_NUM_SUBGROUPS: replace compute gl_NumSubgroups loads with
+        // MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS: replace compute gl_NumSubgroups loads with
         // ceil(workgroup invocations / gl_SubgroupSize) on the NATIVE subgroup path
         // (ShaderTranspiler::DeriveNumSubgroupsPass). Auto is ON: GL requires
         // gl_SubgroupID < gl_NumSubgroups, Adreno's builtin reports 1 while the same
@@ -112,7 +119,7 @@ namespace MobileGL::MG_Config {
         // whenever the pipeline can request REQUIRE_FULL_SUBGROUPS (which the renderer
         // does whenever local_size_x is a multiple of the native width). ForceOff returns
         // to the raw driver builtin.
-        QuirkOverride DeriveNumSubgroups = QuirkOverride::Auto;
+        QuirkOverride MagmaDeriveNumSubgroups = QuirkOverride::Auto;
         // MOBILEGL_ADVERTISE_FP64: add GL_ARB_gpu_shader_fp64 to the advertised extension
         // string. `double` in a shader always WORKS - it is narrowed to 32 bits before any
         // module reaches a backend (ShaderTranspiler::DemoteFloat64Pass) - but the extension
@@ -125,16 +132,39 @@ namespace MobileGL::MG_Config {
         Bool MagmaR11G11B10FFallback = false;
         // MOBILEGL_MAGMA_FRAMESINFLIGHT: requested Magma frames in flight, defaulting to 3.
         Uint32 MagmaFramesInFlight = 3;
-        // MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER: avoid mipmap min filters in samplers,
+        // MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER: avoid mipmap min filters in samplers,
         // resolves certain rendering bugs on ANGLE + llvmpipe.
-        Bool AvoidSamplerMipmapMinFilter = false;
+        Bool EsprytAvoidSamplerMipmapMinFilter = false;
-        // MOBILEGL_AVOID_EXPLICIT_LOD_BIAS: leave an already-explicit LOD argument alone when
+        // MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS: leave an already-explicit LOD argument alone when
         // emulating GL_TEXTURE_LOD_BIAS, instead of adding the bias uniform to it. Injecting
         // the uniform turns a compile-time-constant LOD into a runtime expression, which
         // sends ANGLE + llvmpipe down a mip-selection path that dereferences a NULL
         // descriptor and kills the process. Deviates from spec (Vulkan adds the bias to
         // OpImageSampleExplicitLod), so it is an avoidance for that stack only.
-        Bool AvoidExplicitLodBias = false;
+        Bool EsprytAvoidExplicitLodBias = false;
+        // MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS: emit a tessellation/geometry program's
+        // inter-stage interface blocks WITHOUT their layout(location=) qualifier, letting ES
+        // match them by block name and member sequence instead. The Mali ES driver delivers
+        // nothing at all through a located block once a tessellation or geometry stage is in
+        // the pipeline; the driver POST measures that and turns this on by itself, so Auto is
+        // the right setting everywhere. ForceOn exists so the emulation can be exercised on a
+        // healthy driver - which is what the integration lane does, since llvmpipe and
+        // lavapipe carry a located block correctly and would otherwise never run this code -
+        // and ForceOff is the negative control. See StripIoBlockLocationsPass.
+        QuirkOverride EsprytUnlocatedIoBlocks = QuirkOverride::Auto;
+        // MOBILEGL_POINT_SIZE_DEMOTION: demote gl_PointSize out of tessellation/geometry
+        // stages into an ordinary varying (ShaderCompiler::
+        // DemoteTessellationGeometryPointSizeForProgram) instead of declining such programs
+        // on a device that advertises neither EXT/OES_tessellation_point_size /
+        // geometry_point_size (DirectGLES) nor shaderTessellationAndGeometryPointSize
+        // (DirectVulkan). Auto arms it exactly where the detection says the capability is
+        // absent, which is the right setting everywhere. ForceOn exists so the demotion can
+        // be exercised on a healthy driver - llvmpipe and lavapipe host the built-in
+        // natively and would otherwise never run this code, which is what the pinned
+        // integration lane uses - and ForceOff restores the plain declines (escape hatch /
+        // negative control). Cross-backend by design: the demotion runs in the shared
+        // phase-B chain, so one switch covers both. See DemotePointSizePass.
+        QuirkOverride PointSizeDemotion = QuirkOverride::Auto;
         // MOBILEGL_COHERENT_AS_FLUSH: app-compat for engines (e.g. Flywheel) that write
         // GPU-read data through persistent GL_MAP_FLUSH_EXPLICIT_BIT maps they never
         // flush. Persistent FLUSH_EXPLICIT map requests are rewritten to coherent
@@ -144,10 +174,38 @@ namespace MobileGL::MG_Config {
         Bool CoherentAsFlush = false;
         // MOBILEGL_TRACE_SKIP_AUTODESTROY: skip teardown in the ELF destructor (Init.cpp).
         Bool TraceSkipAutodestroy = false;
-        // MOBILEGL_DISABLE_UBO_RING: force the DirectGLES global-UBO upload back to the
+        // MOBILEGL_ESPRYT_DISABLE_UBO_RING: force the DirectGLES global-UBO upload back to the
         // per-draw glBufferSubData path instead of the persistent-mapped ring allocator
         // (negative control / driver-bug escape hatch).
-        Bool DisableUboRing = false;
+        Bool EsprytDisableUboRing = false;
+        // MOBILEGL_ESPRYT_DISABLE_UNPACK_RING: force DirectGLES texture uploads back to
+        // glTexSubImage from the client pointer instead of staging them through the
+        // persistent-mapped unpack-PBO ring (negative control / driver-bug escape
+        // hatch).
+        Bool EsprytDisableUnpackRing = false;
+        // MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING: force DirectGLES app buffer updates
+        // (glBufferSubData / map flushes) back to the immediate driver upload instead
+        // of queueing them for the staged-copy flush through the persistent-mapped
+        // upload ring (negative control / driver-bug escape hatch; the immediate
+        // upload stalls on drivers that resolve the WAR hazard on the CPU, e.g. Mali).
+        Bool EsprytDisableUploadRing = false;
+        // MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH: skip the glMapBufferRange(WRITE |
+        // INVALIDATE_RANGE) tier of the DirectGLES pending-range flush and go straight
+        // to the upload ring's staged glCopyBufferSubData (negative control / escape
+        // hatch for a driver whose range-invalidating map misbehaves). The map tier is
+        // what keeps a partial write into a large in-flight buffer priced by the RANGE:
+        // on Mali both the immediate glBufferSubData and a staged copy into a busy
+        // mutable store ghost the whole destination on the CPU.
+        Bool EsprytDisableInvalidateFlush = false;
+        // MOBILEGL_DISABLE_LARGE_BUFFER_ADOPTION: keep mesh-arena-sized buffer stores
+        // (>= 16MiB) on the CPU-shadow model instead of backing them with the backend's
+        // persistently+coherently mapped storage at definition time (negative control /
+        // escape hatch). Frontend-scoped: it engages only where the active backend
+        // provides AcquirePersistentMap. With adoption on, an app SubData into a busy
+        // 128MB arena is a plain memcpy into GPU-visible memory; every driver-mediated
+        // route for the same write stalls the thread or ghost-copies the whole arena on
+        // this class of Mali driver, and the arena stops costing its size again in RAM.
+        Bool DisableLargeBufferAdoption = false;
         // MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION: make DirectGLES skip the native ES
         // depth/stencil reads and always go through the shader-sampling emulation. Core GL
         // ES has no depth or stencil readback, but some drivers accept it anyway (Mesa does,
@@ -168,10 +226,10 @@ namespace MobileGL::MG_Config {
         // gl_FragDepth writers, and fully color-masked attachments are exempt (see
         // PipelineFactory::ShouldSuppressDepthWrite). Auto detects Qualcomm.
         QuirkOverride MagmaDisableBlendedDepthWriteQuirk = QuirkOverride::Auto;
-        // MOBILEGL_DISABLE_ROBUST_BUFFER_ACCESS: leave the Vulkan robustBufferAccess device
+        // MOBILEGL_MAGMA_DISABLE_ROBUST_BUFFER_ACCESS: leave the Vulkan robustBufferAccess device
         // feature off. It is enabled by default to match GL's defined out-of-range fetch
         // behavior; this escape hatch exists to measure or dodge its GPU cost on a device.
-        Bool DisableRobustBufferAccess = false;
+        Bool MagmaDisableRobustBufferAccess = false;
         // MOBILEGL_MAGMA_MULTIDRAW_MODE: preferred DirectVulkan multi-draw dispatch tier
         // ("ext" | "indirect" | "unroll", see MultiDrawMode). Clamped to device support;
         // unset picks the best supported tier.
@@ -212,7 +270,7 @@ namespace MobileGL::MG_Config {
         // miscompiled shader: if a device ever renders differently with the cache
         // on, one run with this falsy says so.
         QuirkOverride ShaderTranslationCache = QuirkOverride::Auto;
-        // MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION: DirectGLES' gl_ViewportIndex routing
+        // MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION: DirectGLES' gl_ViewportIndex routing
         // emulation - the builtin becomes a flat varying, the fragment stage gets a
         // per-pass gate, and a routed draw is REPLAYED once per distinct viewport state
         // with the real glViewport/glScissor/glDepthRangef set for it. Auto is ON, and
@@ -224,7 +282,136 @@ namespace MobileGL::MG_Config {
         // the pre-emulation path, extension passthrough where it exists and
         // LowerViewportIndexPass' demote-to-a-plain-global where it does not - and is
         // the negative control the emulation is measured against.
-        QuirkOverride ViewportArrayEmulation = QuirkOverride::Auto;
+        QuirkOverride EsprytViewportArrayEmulation = QuirkOverride::Auto;
+        // MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE: DirectGLES stores GL_RGB565/GL_RGB5(A1)/GL_RGBA4
+        // images as 8-bit-per-channel ES storage (GL_RGB8/GL_RGBA8) instead of the driver's
+        // native 16-bit packed formats. Auto defers to a POST driver-bug probe
+        // (SelfTest::CopyImageMirrorsPacked16FieldOrder): some Mali drivers store SOME
+        // packed16 allocations with a MIRRORED field order (allocation-scoped and
+        // shape/context dependent - the failing 30x30x12 GL_TEXTURE_2D_ARRAYs are mirrored
+        // at every level), so glCopyImageSubData - a raw texel-block move - lands R/G/B/A
+        // reversed whenever exactly one endpoint sits in a mirrored allocation
+        // (KHR-GL4x.copy_image.functional rgb5/rgb5_a1/rgba4 x every *2d_array* pair).
+        // With no 16-bit packed ES image left there is no field order to disagree about; the
+        // client word still round-trips exactly, because the canonical shadow is already
+        // UNorm8 and an n-bit field encodes to UNorm8 and back losslessly for n <= 8.
+        // ForceOn widens on any driver (the llvmpipe suites use it to exercise the widened
+        // path); ForceOff keeps the native narrow storage even where the probe fires - the
+        // negative control that replays the corruption. Costs 2x the memory of the affected
+        // formats where it engages, which is why Auto is probe-gated rather than always-on.
+        QuirkOverride EsprytWidenPacked16Storage = QuirkOverride::Auto;
+        // MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE: DirectVulkan's GL_PRIMITIVES_GENERATED
+        // reroute for draws made while transform feedback is INACTIVE. The stream query
+        // (VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT primitivesNeeded) is defined to count
+        // them, but a Mali driver - and Mesa lavapipe - answers 0 unless a capture span is
+        // open, which is exactly the shape the CTS uses to measure the tessellator, so ~29
+        // tessellation tests per tree size a capture buffer from the 0 and die on the
+        // zero-length map. Auto defers to a device probe at renderer bring-up
+        // (SelfTest::RunPrimitivesGeneratedNoXfbProbe), which measures two substitutes on
+        // the same capture-less draws and arms the best proven one: the dedicated
+        // VK_EXT_primitives_generated_query (exact semantics by definition; lavapipe passes
+        // it, rasterizer discard included), else a clipping-invocations pipeline-statistics
+        // pool (see the verdict vocabulary for its rasterizer-discard split). ForceOn pins
+        // the reroute structurally wherever a pool can exist (the arming-observable lane,
+        // immune to the probe's verdict moving), and ForceOff is the negative control that
+        // replays the driver's silence.
+        QuirkOverride MagmaPrimGenQueryReroute = QuirkOverride::Auto;
+        // --- MGPipe (the disaggregation plan's explicit frontend/backend boundary) ---
+        // MOBILEGL_PIPE_PUSH: per-subsystem bitmask selecting which state the frontend
+        // PUSHES over MGPipe instead of leaving the backend to pull it out of GLContext.
+        // 0 - the only shipped value until the migration lands - is "pull everything",
+        // i.e. exactly today's behaviour, and is the default of a PULL build, where the
+        // knob is meaningless anyway. A PUSH build defaults to every subsystem migrated so
+        // far (MG_Pipe::kMGPipeSubsystemsMigratedAtP4a), so MOBILEGL_PIPE_PUSH=0 in the
+        // environment is the all-pull control and 0x1ff (kMGPipeSubsystemsMigratedAtP3a) is
+        // the "everything before P4a" control P4a's A/B is run against - each phase's
+        // constant survives as the next phase's control, which is why none of them is ever
+        // edited. Accepts decimal or 0x-prefixed hex, and operators pass it as hex, so the
+        // bits are listed here (MG_Pipe/MGPipe.h owns them):
+        //   0x01 render state (create/bind_render_state + set_dynamic_state)
+        //   0x02 pixel pack        0x04 patch state      0x08 vertex attrib defaults
+        //   0x10 residual values   0x20 Espryt slots     0x40 Magma vertex input
+        //   0x80 resources (the resource_* family: the seven BufferBackendOps hooks)
+        //   0x100 vertex input (vertex elements / vertex buffers / index buffer)
+        //   0x200 framebuffer (set_framebuffer_state)              - requires 0x400
+        //   0x400 texture resources (texture + renderbuffer resource_*,
+        //         set_texture_params)                              - requires 0x80 AND 0x800
+        //         (the built-in sampler CSO a set_texture_params record names is minted by
+        //         the sampler family alone, ID-15; the four rows are MG_Impl/Pipe/PipeFill.cpp's
+        //         kMGPipeP4aFamilyDependencies, mirrored bit for bit by Espryt's resolvers)
+        //   0x800 samplers (sampler CSO, sampler view, set_sampler_views /
+        //         bind_sampler_states / set_shader_images)         - requires 0x400
+        //   0x1000 programs (shader CSO, set_draw/dispatch_program, global constants)
+        //   A dependency that is not met is REFUSED with one ERROR naming both bits and the
+        //   family runs its legacy arm; it is never half-run.
+        //   1<<63 NOT a subsystem, a BEHAVIOUR: turn OFF client-side content addressing of
+        //         CSOs, so every pipeline-version change mints a fresh CSO and the map is
+        //         never probed. The negative control the CSO design is measured against.
+        Uint64 PipePush = 0;
+        // MOBILEGL_PIPE_VERIFY: per-draw, per-FIELD shadow comparison of the pushed state
+        // against a snapshot taken from GLContext the old way, printing the first field
+        // that differs and the draw serial. Roughly 5-10x slower and never shipped; it is
+        // the semantic gate that replaces byte identity, and it catches the dangerous
+        // direction - a dirty bit that fires too RARELY - which no purity gate can see.
+        Bool PipeVerify = false;
+#if MOBILEGL_PIPE_PUSH
+        // The three knobs of the MOBILEGL_PIPE_VERIFY build (P1 brief D2). Compiled only
+        // under MOBILEGL_PIPE_PUSH so the pull build's FeaturesTable does not change size.
+        // MOBILEGL_PIPE_VERIFY_FATAL: the first divergence aborts (default). 0 logs and
+        // counts instead, for triage and for the lane that must survive to read its own
+        // log. Tri-state parse like PipeLegacyMemos: only an explicit falsy value turns it
+        // off.
+        Bool PipeVerifyFatal = true;
+        // MOBILEGL_PIPE_VERIFY_CORRUPT: a field name from kMGPipeInputFieldNames[]; the
+        // comparator perturbs that field in the SNAPSHOT arm before the entry compare, so a
+        // green verify run goes red naming it (negative control A). Unknown name is
+        // Fatal{PipeVerifyBadKnob}.
+        String PipeVerifyCorrupt;
+        // MOBILEGL_PIPE_POISON_OMIT: <Verb>:<FieldName>; the filler skips the STAMP (not
+        // the value) of that field for that verb, an omission indistinguishable from a
+        // forgotten FillPoints.def row, so that verb's read of it is
+        // Fatal{UnmigratedPipeInput} (negative control B). Unknown name is
+        // Fatal{PipeVerifyBadKnob}.
+        String PipePoisonOmit;
+        // MOBILEGL_PIPE_HANDLE_ABA_CONTROL (negative control C, P2 brief D18): replace the
+        // OBJECT IDENTITY in every DirectVulkan vertex-input memo key with a constant, on
+        // whichever arm the run is on - the pre-handle (address, lifetime id) pair AND the
+        // handle arm's {slot, gen} generation - so a replacement object inherits its dead
+        // predecessor's resolved vertex bindings and HandleRecycleScenario.AbaControl asserts
+        // the WRONG pixels. That is what proves the reproducer still reproduces. D18 wrote
+        // this as "hash the raw BufferObject* instead of its lifetime id"; measured, the heap
+        // block is never handed back, so that spelling collided with nothing and the control
+        // went vacuous - see MagmaPipeArms.h's MagmaPipeAbaControlDefeatsIdentity for the
+        // measurement and for what the control still leaves standing. Under
+        // MOBILEGL_PIPE_PUSH only, so it cannot exist in a shipping pull build.
+        Bool PipeHandleAbaControl = false;
+#endif
+        // MOBILEGL_PIPE_STATS: dump the boundary counters (bytes, calls, roundtrips,
+        // texture pulls, upload shapes, residual-block bytes, index mirror bytes).
+        Bool PipeStats = false;
+        // MOBILEGL_PIPE_LEGACY_MEMOS: keep the pre-handle registries and TwinLookupMemos
+        // alive so the first handle waves have a real old-versus-new arm to be compared
+        // against. ON by default for the whole migration window, deleted with the pull
+        // path itself.
+        Bool PipeLegacyMemos = true;
+        // MOBILEGL_PIPE_TEXEL_RETAIN_MB: LRU budget for texels retained against a
+        // server-initiated texture re-send. Default 0, i.e. OFF: MipmapStorage already
+        // holds a complete CPU shadow, so this cache buys latency, never correctness.
+        Uint32 PipeTexelRetainMb = 0;
+        // MOBILEGL_PIPE_INDEX_MIRROR_MB: budget for the server-side index host mirror,
+        // which is what lets primitive-restart rewriting and multi-draw flattening stay on
+        // the server without shipping index bytes per draw. Over budget it degrades to
+        // per-draw staging, counted separately in the stats.
+        Uint32 PipeIndexMirrorMb = 64;
+        // MOBILEGL_PIPE_STATS_PERIOD: frames per boundary-counter summary line. 120 is the
+        // steady-state cadence; the device retrace harness never reaches the teardown dump
+        // and a trimmed fixture (create-indirect) is shorter than 120 frames, so a run that
+        // needs its numbers at all sets this low enough to land at least one window.
+        Uint32 PipeStatsPeriod = 120;
+        // MOBILEGL_PIPE_STATS_FILE: where the boundary counters' teardown JSON dump goes.
+        // Empty (the default) means no dump; the per-120-frame summary line still goes to
+        // the log whenever PipeStats is on, so a device run needs no writable path.
+        String PipeStatsFile;
     };
     extern FeaturesTable Features;
 } // namespace MobileGL::MG_Config

MobileGL/ConfigLoader.cpp

@@ -7,6 +7,12 @@
 // End of Source File Header
 
 #include "Config.h"
+#if MOBILEGL_PIPE_PUSH
+// For kMGPipeSubsystemsMigratedAtP4a, the push build's PipePush default (the P2 and P3a
+// constants beside it are the phase-by-phase controls, not the default). Push-only, so the
+// pull build's translation unit is unchanged.
+#include <MG_Pipe/MGPipe.h>
+#endif
 
 #include <cerrno>
 #include <cstdlib>
@@ -159,35 +165,74 @@ namespace MobileGL::MG_ConfigLoader {
         return static_cast<Uint32>(parsedValue);
     }
 
+    // Same contract as QueryEnvUint32, over 64 bits and accepting an explicit 0x prefix: the
+    // one consumer is a subsystem BITMASK, and a bitmask written in decimal is unreadable.
+    // Decimal otherwise - never strtoull's base 0, whose "leading zero means octal" rule
+    // silently read MOBILEGL_PIPE_PUSH=010 as 8 - and a '-' anywhere is rejected rather than
+    // wrapped, which strtoull would otherwise do without complaint (-1 -> every bit set).
+    inline Uint64 QueryEnvUint64(const String& key, Uint64 defaultValue) {
+        auto it = acceptedEnvVariablesMap->find(key);
+        if (it == acceptedEnvVariablesMap->end()) {
+            return defaultValue;
+        }
+
+        const String& value = it->second;
+        const char* text = value.c_str();
+        int base = 10;
+        if (value.size() > 2 && text[0] == '0' && (text[1] == 'x' || text[1] == 'X')) {
+            text += 2;
+            base = 16;
+        }
+        char* parseEnd = nullptr;
+        errno = 0;
+        const bool negative = value.find('-') != String::npos;
+        const unsigned long long parsedValue = negative ? 0 : std::strtoull(text, &parseEnd, base);
+        if (negative || parseEnd == text || *parseEnd != '\0' || errno == ERANGE) {
+            MGLOG_W("Config: Ignoring invalid env variable %s='%s'; expected a non-negative integer "
+                    "(decimal, or 0x-prefixed hexadecimal), using default %llu",
+                    key.c_str(), value.c_str(), static_cast<unsigned long long>(defaultValue));
+            return defaultValue;
+        }
+
+        return static_cast<Uint64>(parsedValue);
+    }
+
     inline void InitFeatures() {
         auto& features = MG_Config::Features;
         features.DisableTimerQuery = QueryEnvFlag("MOBILEGL_DISABLE_TIMERQUERY");
+        features.EsprytEnableTextureView = QueryEnvFlag("MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW");
         features.EnableSpirvValidation = QueryEnvFlag("MOBILEGL_ENABLE_SPIRV_VALIDATION");
-        features.UseAngle = QueryEnvFlag("MOBILEGL_USE_ANGLE");
+        features.EsprytUseAngle = QueryEnvFlag("MOBILEGL_ESPRYT_USE_ANGLE");
 #if defined(MOBILEGL_TRACE_ANGLE_VARIANTS)
         QueryEnvVariable("MOBILEGL_TRACE_ANGLE_VARIANT", features.TraceAngleVariant, "");
 #endif
-        features.DisableSubgroup = QueryEnvFlag("MOBILEGL_DISABLE_SUBGROUP");
+        features.MagmaDisableSubgroup = QueryEnvFlag("MOBILEGL_MAGMA_DISABLE_SUBGROUP");
         features.MagmaEmulateSubgroup = QueryEnvFlag("MOBILEGL_MAGMA_EMULATE_SUBGROUP");
-        features.FixIterationRPSubgroupScratch =
+        features.MagmaFixIterationRPSubgroupScratch =
-            QueryEnvQuirkOverride("MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH");
+            QueryEnvQuirkOverride("MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH");
-        features.IterationRPFixBarrier = QueryEnvFlag("MOBILEGL_ITERATIONRP_FIX_BARRIER");
+        features.MagmaIterationRPFixBarrier = QueryEnvFlag("MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER");
-        features.DeriveNumSubgroups = QueryEnvQuirkOverride("MOBILEGL_DERIVE_NUM_SUBGROUPS");
+        features.MagmaDeriveNumSubgroups = QueryEnvQuirkOverride("MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS");
         features.AdvertiseFp64 = QueryEnvFlag("MOBILEGL_ADVERTISE_FP64");
         features.MagmaR11G11B10FFallback = QueryEnvFlag("MOBILEGL_MAGMA_R11G11B10F_FALLBACK");
         features.MagmaFramesInFlight = QueryEnvUint32("MOBILEGL_MAGMA_FRAMESINFLIGHT", 3, 1, 64);
-        features.AvoidSamplerMipmapMinFilter =
+        features.EsprytAvoidSamplerMipmapMinFilter =
-            QueryEnvFlag("MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER");
+            QueryEnvFlag("MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER");
-        features.AvoidExplicitLodBias = QueryEnvFlag("MOBILEGL_AVOID_EXPLICIT_LOD_BIAS");
+        features.EsprytAvoidExplicitLodBias = QueryEnvFlag("MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS");
+        features.EsprytUnlocatedIoBlocks = QueryEnvQuirkOverride("MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS");
+        features.PointSizeDemotion = QueryEnvQuirkOverride("MOBILEGL_POINT_SIZE_DEMOTION");
         features.CoherentAsFlush = QueryEnvFlag("MOBILEGL_COHERENT_AS_FLUSH");
         features.TraceSkipAutodestroy = QueryEnvFlag("MOBILEGL_TRACE_SKIP_AUTODESTROY");
-        features.DisableUboRing = QueryEnvFlag("MOBILEGL_DISABLE_UBO_RING");
+        features.EsprytDisableUboRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UBO_RING");
+        features.EsprytDisableUnpackRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UNPACK_RING");
+        features.EsprytDisableUploadRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING");
+        features.EsprytDisableInvalidateFlush = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH");
+        features.DisableLargeBufferAdoption = QueryEnvFlag("MOBILEGL_DISABLE_LARGE_BUFFER_ADOPTION");
         features.EsprytForceDepthStencilReadbackEmulation =
             QueryEnvFlag("MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION");
         features.RelaxedSemantics = QueryEnvFlag("MOBILEGL_RELAXED_SEMANTICS");
         features.MagmaDisableBlendedDepthWriteQuirk =
             QueryEnvQuirkOverride("MOBILEGL_MAGMA_DISABLE_BLENDED_DEPTH_WRITE");
-        features.DisableRobustBufferAccess = QueryEnvFlag("MOBILEGL_DISABLE_ROBUST_BUFFER_ACCESS");
+        features.MagmaDisableRobustBufferAccess = QueryEnvFlag("MOBILEGL_MAGMA_DISABLE_ROBUST_BUFFER_ACCESS");
         features.MagmaMultiDrawMode = QueryEnvMultiDrawMode("MOBILEGL_MAGMA_MULTIDRAW_MODE");
         features.EsprytMultiDrawMode = QueryEnvGLESMultiDrawMode("MOBILEGL_ESPRYT_MULTIDRAW_MODE");
         features.AsyncShaderCompile = QueryEnvQuirkOverride("MOBILEGL_ASYNC_SHADER_COMPILE");
@@ -195,8 +240,45 @@ namespace MobileGL::MG_ConfigLoader {
         features.AsyncOptimisticShaderStatus =
             QueryEnvQuirkOverride("MOBILEGL_ASYNC_OPTIMISTIC_SHADER_STATUS");
         features.ShaderTranslationCache = QueryEnvQuirkOverride("MOBILEGL_SHADER_CACHE");
-        features.ViewportArrayEmulation =
+        features.EsprytViewportArrayEmulation =
-            QueryEnvQuirkOverride("MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION");
+            QueryEnvQuirkOverride("MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION");
+        features.EsprytWidenPacked16Storage =
+            QueryEnvQuirkOverride("MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE");
+        features.MagmaPrimGenQueryReroute = QueryEnvQuirkOverride("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE");
+        // MGPipe. Nothing here needs adding to an allow-list: InitializeAcceptedEnvVariables
+        // accepts every MOBILEGL_ / LIBGL_ prefixed variable in the environment, so a name
+        // that starts with MOBILEGL_ is visible to these queries by construction.
+#if MOBILEGL_PIPE_PUSH
+        // A push build with the knob unset runs every subsystem migrated so far, so the
+        // shipped path is the one the gates measure; MOBILEGL_PIPE_PUSH=0 in the
+        // environment is the all-subsystems-pull control that reproduces P1 exactly, and
+        // kMGPipeSubsystemsMigratedAtP3a (0x1ff) is the phase-by-phase control - P4a's four
+        // subsystems off, everything P3a landed still on.
+        features.PipePush = QueryEnvUint64("MOBILEGL_PIPE_PUSH", MG_Pipe::kMGPipeSubsystemsMigratedAtP4a);
+#else
+        // Meaningless in a pull build: there is nothing to push. Config.h documents 0 as
+        // "pull everything" and that stays literally true.
+        features.PipePush = QueryEnvUint64("MOBILEGL_PIPE_PUSH", 0);
+#endif
+        features.PipeVerify = QueryEnvFlag("MOBILEGL_PIPE_VERIFY");
+#if MOBILEGL_PIPE_PUSH
+        // Defaults ON: read as a tri-state so only an explicitly falsy value turns it off.
+        features.PipeVerifyFatal =
+            QueryEnvQuirkOverride("MOBILEGL_PIPE_VERIFY_FATAL") != MG_Config::QuirkOverride::ForceOff;
+        QueryEnvVariable("MOBILEGL_PIPE_VERIFY_CORRUPT", features.PipeVerifyCorrupt, "");
+        QueryEnvVariable("MOBILEGL_PIPE_POISON_OMIT", features.PipePoisonOmit, "");
+        features.PipeHandleAbaControl = QueryEnvFlag("MOBILEGL_PIPE_HANDLE_ABA_CONTROL");
+#endif
+        features.PipeStats = QueryEnvFlag("MOBILEGL_PIPE_STATS");
+        // Defaults ON, so the flag has to be read as a tri-state rather than as a plain
+        // truthy check: unset must keep the memos, and only an explicitly falsy value may
+        // drop them.
+        features.PipeLegacyMemos =
+            QueryEnvQuirkOverride("MOBILEGL_PIPE_LEGACY_MEMOS") != MG_Config::QuirkOverride::ForceOff;
+        features.PipeTexelRetainMb = QueryEnvUint32("MOBILEGL_PIPE_TEXEL_RETAIN_MB", 0, 0, 4096);
+        features.PipeIndexMirrorMb = QueryEnvUint32("MOBILEGL_PIPE_INDEX_MIRROR_MB", 64, 0, 4096);
+        features.PipeStatsPeriod = QueryEnvUint32("MOBILEGL_PIPE_STATS_PERIOD", 120, 1, 1000000);
+        QueryEnvVariable("MOBILEGL_PIPE_STATS_FILE", features.PipeStatsFile, "");
     }
 
     inline void InitBackendType() {

MobileGL/Init.cpp

@@ -17,6 +17,7 @@
 #include <MG_Impl/GLImpl/Sync/GL_Sync.h>
 #include <MG_Impl/GLImpl/Query/GL_Query.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_State/GLState/ProgramState/ProgramTranslationCache.h>
 #include <MG_Util/ShaderTranspiler/TranslationCache.h>
@@ -42,6 +43,11 @@ namespace MobileGL {
             if (logLifecycle) {
                 MGLOG_I("MobileGL closing...");
             }
+            // Before any subsystem the counters name goes away, and before the last frame's
+            // numbers can be lost: emits the final summary line and, when
+            // MOBILEGL_PIPE_STATS_FILE is set, the JSON dump. A no-op when the counters are
+            // off, and idempotent.
+            MG_Util::PipeStats::Shutdown();
             // First, before anything else is torn down. In-flight compile/link jobs own
             // their own inputs and are safe against everything below EXCEPT glslang's
             // process globals and the TShader/TProgram objects hanging off pGLContext,
@@ -102,6 +108,10 @@ namespace MobileGL {
         MGLOG_I("Initializing MobileGL...");
         MG_ConfigLoader::Init();
         MGLOG_I("Config loaded");
+        // Immediately after the config load and before anything can count: the MGPipe
+        // boundary counters latch their enable flag here, so every counting site in the
+        // two backends is a load of an already-settled global for the rest of the run.
+        MG_Util::PipeStats::Init();
         MG_State::Init();
         MGLOG_D("MG_State initialized");
         MG_Backend::Init();

MobileGL/MG_Backend/BackendObject.h

@@ -192,9 +192,23 @@ namespace MobileGL {
             void (*MemoryBarrierByRegion)(GLbitfield barriers);
             void (*BindImageTexture)(GLuint unit, GLuint texture, GLint level, GLboolean layered, GLint layer,
                                      GLenum access, GLenum format);
+            // The ONLY indexed query that is genuinely a backend one, and only for the pnames
+            // MG_Impl/GLImpl/Getter/GL_Getter.cpp does not already own. Every indexed pname that
+            // names FRONTEND state - the indexed buffer bindings, the per-unit texture/sampler
+            // bindings, the image-unit bindings, the viewport rectangles, the indexed capabilities
+            // - is answered in GL_Getter::GetIntegeri_v and never reaches this entry; the
+            // 64-bit and float/double widths are derived there from the same answer, which is why
+            // no GetInteger64i_v/GetFloati_v/GetDoublei_v table entry exists. In practice this
+            // leaves GL_MAX_COMPUTE_WORK_GROUP_COUNT / _SIZE (also asked directly by
+            // MG_Util/ShaderTranspiler/CompileEnv.cpp) plus whatever pname the frontend has no
+            // case for at all.
             void (*GetIntegeri_v)(GLenum target, GLuint index, GLint* data);
-            void (*GetInteger64i_v)(GLenum target, GLuint index, GLint64* data);
+            // There is deliberately NO GetProgramiv entry: glGetProgramiv describes the program
-            void (*GetProgramiv)(GLuint program, GLenum pname, GLint* params);
+            // the APPLICATION wrote - link status, the transform-feedback mode, the compute local
+            // size - all of which are frontend link artifacts on ProgramObject, and
+            // MG_Impl/GLImpl/Program/GL_Program.cpp answers every one of them from there. Asking a
+            // backend would mean asking about a DIFFERENT program (a SPIRV-Cross-generated ESSL
+            // one, or a SPIR-V module), in a namespace the application never sees.
             // The GL program interface (glGetProgramInterfaceiv / glGetProgramResource*) is NOT
             // a backend query: it describes the program the application wrote, in the
             // application's namespace, which neither backend program is in. It is answered
@@ -301,6 +315,12 @@ namespace MobileGL {
 
         struct DynamicBackendParameters {
             SizeT UniformBufferOffsetAlignment = 256;
+            // GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT, which is a SEPARATE limit from the
+            // uniform one and is routinely larger: Adreno 830 reports 32 for uniform buffers and
+            // 64 for storage buffers. Answering the storage query with the uniform value let an
+            // application bind a storage range at an offset the driver cannot address, which it
+            // accepted without error and then wrote somewhere else entirely.
+            SizeT ShaderStorageBufferOffsetAlignment = 256;
             // GL_MAX_TEXTURE_MAX_ANISOTROPY_EXT. 1.0 means the backend cannot filter anisotropically,
             // which is also why the extension is not advertised in that case.
             Float MaxTextureMaxAnisotropy = 1.0f;
@@ -358,6 +378,19 @@ namespace MobileGL {
             Int MaxFragmentShaderStorageBlocks = 8;
             Int MaxComputeUniformBlocks = 12;
             Int MaxComputeWorkGroupInvocations = 128;
+            // GL_MAX_COMPUTE_WORK_GROUP_COUNT / GL_MAX_COMPUTE_WORK_GROUP_SIZE, one value per
+            // axis. These six, with the invocations limit above, are the only indexed limits a
+            // backend genuinely OWNS - the device answers them (glGetIntegeri_v on DirectGLES,
+            // VkPhysicalDeviceLimits::maxComputeWorkGroupCount/Size on DirectVulkan) - and so
+            // the only ones that survive the retirement of the GetIntegeri_v table entry: they
+            // cross the MGPipe boundary inside MGPCaps, by inclusion of this struct (plan B
+            // section 4.4.1). Every other indexed pname names frontend state. RAW driver
+            // answers, like the invocations limit: GL_Getter and the compile environment floor
+            // them at the shared MIN_COMPUTE_WORK_GROUP_* minimums themselves. The defaults are
+            // the GL 4.3 core minimums (table 23.60) and describe the no-backend case, as
+            // MaxClipDistances' does.
+            Int MaxComputeWorkGroupCount[3] = {65535, 65535, 65535};
+            Int MaxComputeWorkGroupSize[3] = {1024, 1024, 64};
             Int MaxShaderStorageBufferBindings = 8;
             Int MaxTextureBufferSize = 65536;
             // GL_TEXTURE_BUFFER_OFFSET_ALIGNMENT; 1 means the offset is unconstrained.
@@ -383,6 +416,19 @@ namespace MobileGL {
             // where there is no device to be honest about and BuildTBuiltInResource still has to
             // hand glslang a workable gl_MaxClipDistances.
             Int MaxClipDistances = 8;
+            // GL_MAX_CULL_DISTANCES and GL_MAX_COMBINED_CLIP_AND_CULL_DISTANCES, under exactly
+            // the contract stated for MaxClipDistances above: ZERO IS A LEGAL ANSWER and a
+            // backend that cannot host a cull distance MUST report it. The failure this prevents
+            // is worse than the clip one, because cull distance discards the whole primitive:
+            // glslang bounds gl_CullDistance[i] against maxCullDistances and expands
+            // gl_MaxCullDistances from it, SPIRV-Cross then emits
+            // `#extension GL_EXT_clip_cull_distance : require` into the ESSL, and a host driver
+            // without that extension rejects the program in an info log nobody surfaces. These
+            // used to be bare 8s inside BuildTBuiltInResource with no backend consulted at all.
+            // The DEFAULTS are the GL 4.5 core minimums for the same reason MaxClipDistances'
+            // is: they describe the no-backend case (standalone compiles, unit tests).
+            Int MaxCullDistances = 8;
+            Int MaxCombinedClipAndCullDistances = 8;
             Int MaxViewports = 16;
             // GL_LAYER_PROVOKING_VERTEX / GL_VIEWPORT_INDEX_PROVOKING_VERTEX: which vertex of a
             // primitive supplies gl_Layer and gl_ViewportIndex. GL 4.6 table 23.65 makes
@@ -476,6 +522,24 @@ namespace MobileGL {
             // halves (PackDoubleVertexInputsPass and VertexInputStateFactory::ToVkVertexFormat)
             // still see one consistent world.
             Bool SupportsFloat64VertexAttributes = false;
+            // Whether a TESSELLATION stage of this backend may access gl_PointSize - i.e.
+            // whether a module declaring OpCapability TessellationPointSize can reach the
+            // driver at all. DirectVulkan sets both this and the geometry twin from the one
+            // shaderTessellationAndGeometryPointSize feature; DirectGLES sets them
+            // independently from the EXT/OES_tessellation_point_size /
+            // geometry_point_size extension pairs (PointSizeTier), which really do come
+            // separately. When absent, ProgramSpirvTask demotes the built-in to an ordinary
+            // varying program-wide (ShaderCompiler::
+            // DemoteTessellationGeometryPointSizeForProgram); MOBILEGL_POINT_SIZE_DEMOTION
+            // overrides the detection in either direction at backend init.
+            //
+            // Defaults TRUE, deliberately against the house "assume absent" rule: false
+            // ARMS a rewrite, so the conservative no-backend answer (standalone compiles,
+            // unit tests) is the one that leaves modules untouched. A backend that never
+            // sets it gets standard modules and, at worst, the old honest declines.
+            Bool SupportsTessellationPointSize = true;
+            // The geometry-stage twin (OpCapability GeometryPointSize).
+            Bool SupportsGeometryPointSize = true;
             SizeT MaxShaderStorageBlockSize = 128 * 1024 * 1024;
             Uint32 SubgroupSize = 0;
             Uint32 SubgroupSupportedStages = 0;

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -307,6 +307,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return capabilities.MaxColorTextureSamples;
         }
 
+        // The RENDERBUFFER twin, and it is a different set of pnames on purpose.
+        // GL_MAX_{COLOR,DEPTH}_TEXTURE_SAMPLES bound multisample TEXTURES; a renderbuffer is
+        // bounded by GL_MAX_SAMPLES (GL 4.6 core 9.2.4), with GL_MAX_INTEGER_SAMPLES for the
+        // integer formats. Using the texture ceilings here - which is what the renderbuffer probe
+        // did - is not merely untidy: the two texture pnames are ES 3.1 state, so on an ES 3.0
+        // context the loader's rejected-probe clamp leaves them at 1 (see the multisample clamps
+        // in the GLES loader) and the walk below would never run past one sample, recording {1}
+        // for EVERY colour format while GL_MAX_SAMPLES - ES 3.0 core, so genuinely answered -
+        // reports 4. Once the frontend validates against this list, that would reject every
+        // multisample renderbuffer on such a context.
+        Int GetGLESRenderbufferFormatMaxSamples(const MG_External::GLESCapabilities& capabilities,
+                                                GLenum imageFormat) {
+            const Bool isInteger = imageFormat == GL_RED_INTEGER || imageFormat == GL_RG_INTEGER ||
+                                   imageFormat == GL_RGB_INTEGER || imageFormat == GL_RGBA_INTEGER;
+            return isInteger ? capabilities.MaxIntegerSamples : capabilities.MaxSamples;
+        }
+
         Bool ProbeFramebufferCompletenessForTexture(const MG_External::GLESFunctionsTable& gl, TextureTarget target,
                                                     GLuint texture, TextureInternalFormat format) {
             GLuint framebuffer = 0;
@@ -717,7 +734,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         AddFullFormatCaps(cache, renderbufferTargetIndex, formatIndex,
                                           GetRenderbufferFeatureCaps(logicalFormat));
                         const Int maxSamples =
-                            GetGLESFormatMaxSamples(capabilities, logicalFormat, nativeInfo.ImageFormat);
+                            GetGLESRenderbufferFormatMaxSamples(capabilities, nativeInfo.ImageFormat);
                         cache.SampleCounts[renderbufferTargetIndex][formatIndex] =
                             ProbeRenderbufferSampleCounts(gl, nativeInfo.InternalFormat, logicalFormat, maxSamples);
                     } else {
@@ -731,7 +748,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         LogGLESFormatCaveat(logicalFormat, renderbufferTargetIndex, renderbufferFallbackInfo);
                     }
                     const Int maxSamples =
-                        GetGLESFormatMaxSamples(capabilities, logicalFormat, renderbufferFallbackInfo.ImageFormat);
+                        GetGLESRenderbufferFormatMaxSamples(capabilities, renderbufferFallbackInfo.ImageFormat);
                     cache.SampleCounts[renderbufferTargetIndex][formatIndex] = ProbeRenderbufferSampleCounts(
                         gl, renderbufferFallbackInfo.InternalFormat, logicalFormat, maxSamples);
                 }
@@ -749,11 +766,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 .ExtraVendor = Nullopt,              // Extra vendor
                 .RendererGLInfo =
                     {
-                        .TargetGLVersion = {4, 0, 0},   // GL target version
+                        .TargetGLVersion = {4, 6, 0},   // GL target version
                         .TargetGLSLVersion = {4, 6, 0}, // Target Shading Language Version
                         // Baseline advertisement (no runtime capabilities yet); reconciled once
                         // the ES capabilities exist, see UpdateAdvertisedCapabilityExtensions.
-                        .Extensions = BuildAdvertisedExtensions(false, false, false, false),
+                        .Extensions = BuildAdvertisedExtensions(false, false, false, false, false, false),
                         .IsCompatibilityProfile = false // Is Compatibility Profile
                     },
                 .StaticBackendCapability = {.AllowVSOnlyPrograms = false} // Backend Capability
@@ -777,7 +794,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
             MutableRendererInfo().RendererGLInfo.Extensions = BuildAdvertisedExtensions(
                 AreTimerQueriesSupported(), capabilities.SupportsTextureFilterAnisotropy,
                 capabilities.SupportsDrawIndirect,
-                capabilities.SupportsDrawIndirect && capabilities.SupportsBaseInstance);
+                capabilities.SupportsDrawIndirect && capabilities.SupportsBaseInstance,
+                capabilities.SupportsTextureView, capabilities.SupportsTextureCubeMapArray);
         }
     } // namespace
 
@@ -990,9 +1008,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
     Vector<GLExtension> BuildAdvertisedExtensions(Bool timerQueriesSupported, Bool anisotropicFilteringSupported,
                                                   Bool drawIndirectSupported,
-                                                  Bool nonZeroIndirectBaseInstanceSupported) {
+                                                  Bool nonZeroIndirectBaseInstanceSupported,
+                                                  Bool textureViewSupported, Bool cubeMapArraySupported) {
         Vector<GLExtension> extensions = {
-            V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, E_GL_ARB_draw_buffers_blend,
+            // The version tokens have to reach the version the backend actually claims:
+            // TargetGLVersion is {4,6,0}, and a list that stopped at OpenGL40 told an
+            // application feature-detecting off these tokens the opposite of what
+            // GL_MAJOR_VERSION / GL_MINOR_VERSION told it.
+            V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, V_OpenGL41, V_OpenGL42, V_OpenGL43,
+            V_OpenGL44, V_OpenGL45, V_OpenGL46,
+            E_GL_ARB_draw_buffers_blend,
             E_GL_ARB_compute_shader, E_GL_ARB_shader_storage_buffer_object, E_GL_ARB_shader_image_load_store,
             E_GL_ARB_clear_buffer_object, E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_EXT_framebuffer_object,
             E_GL_ARB_depth_texture, E_GL_ARB_buffer_storage, E_GL_ARB_texture_storage,
@@ -1017,6 +1042,77 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // has had the same texture parameter since ES 3.1, which every device MobileGL
             // runs on provides.
             E_GL_ARB_stencil_texturing,
+            // Core since 3.2 and implemented here on both backends - glDrawElementsBaseVertex,
+            // glDrawRangeElementsBaseVertex, glDrawElementsInstancedBaseVertex and
+            // glMultiDrawElementsBaseVertex all reach real per-draw vertex rebasing. The string
+            // was simply never emitted, which left KHR-GL4*.draw_elements_base_vertex_tests
+            // NotSupported on a feature that works.
+            E_GL_ARB_draw_elements_base_vertex,
+            // The whole sync-object family is real and core since 3.2: glFenceSync, glIsSync,
+            // glDeleteSync, glClientWaitSync, glWaitSync and glGetSynciv all live in GLImpl over a
+            // backend fence (a host GLsync here, a VkFence on DirectVulkan), and glGetInteger64v
+            // answers GL_MAX_SERVER_WAIT_TIMEOUT. The string matters for the same reason
+            // ARB_uniform_buffer_object's does: LWJGL builds GLCapabilities from the extension
+            // list, and a caller that finds GL_ARB_sync missing never resolves the entry points -
+            // then calls through null if it uses fences anyway. Nothing in the CTS gates on this
+            // string, so it is advertised on the strength of the implementation, not a test unlock.
+            E_GL_ARB_sync,
+            // Atomic counters, core since 4.2. glGetActiveAtomicCounterBufferiv and the whole
+            // GL_ATOMIC_COUNTER_BUFFER_* query family are real in GLImpl, and SyncAtomicCounterBuffers
+            // re-issues the counter buffer as an SSBO binding in the range reserved at the top of
+            // the ES driver's shader-storage points, so a counter dispatch reads and writes the
+            // buffer the application bound. DirectVulkan reaches the same place through its own
+            // descriptor resolution, so the string is symmetric.
+            E_GL_ARB_shader_atomic_counters,
+            // glVertexAttribDivisor, core since 3.3 and real on both backends. Applications
+            // (Better Clouds' GLCompat among them) accept the extension string as an
+            // ALTERNATIVE to a 3.3 context when deciding whether instanced rendering is
+            // available, so withholding it makes MobileGL look less capable than it is.
+            E_GL_ARB_instanced_arrays,
+            // The whole of KHR_debug lives in GLImpl - the message log, the group stack and the
+            // object-label table are MobileGL's own state, not the host driver's - so it is as
+            // available here as it is on DirectVulkan, which has advertised it all along.
+            E_GL_KHR_debug,
+            // Core GL 3.0-4.3 plumbing that has been real here for as long as the backend has
+            // existed, and that was simply never named. None of these unlocks a single CTS case -
+            // the conformance suite reaches all of them through the version - so they are
+            // advertised for the OTHER consumer of this list: LWJGL builds GLCapabilities from the
+            // string set, and an application that gates its ENTRY POINTS on the string rather than
+            // on the version never resolves them and then calls through null. Each is backed by
+            // the entry points named beside it.
+            //
+            // glBindVertexArray / glGenVertexArrays / glDeleteVertexArrays / glIsVertexArray.
+            E_GL_ARB_vertex_array_object,
+            // The 14 glSamplerParameter* / glGetSamplerParameter* entry points, including the
+            // integer-valued Iiv/Iuiv forms.
+            E_GL_ARB_sampler_objects,
+            // glMapBufferRange + glFlushMappedBufferRange, which ARB_buffer_storage's persistent
+            // maps are already built on top of.
+            E_GL_ARB_map_buffer_range,
+            // glCopyBufferSubData plus the GL_COPY_READ_BUFFER / GL_COPY_WRITE_BUFFER targets.
+            E_GL_ARB_copy_buffer,
+            // glCopyImageSubData, wired to a real backend hook on both backends.
+            E_GL_ARB_copy_image,
+            // GL_TEXTURE_SWIZZLE_{R,G,B,A,RGBA}, which this backend syncs through to the ES
+            // driver's identical parameters.
+            E_GL_ARB_texture_swizzle,
+            // GL_INT_2_10_10_10_REV / GL_UNSIGNED_INT_2_10_10_10_REV on glVertexAttribPointer plus
+            // the eight glVertexAttribP* entry points.
+            E_GL_ARB_vertex_type_2_10_10_10_rev,
+            // The R/RG internal formats. Named separately from the float ones because an
+            // application may check either.
+            E_GL_ARB_texture_rg,
+            // GL_DEPTH_COMPONENT32F and GL_DEPTH32F_STENCIL8.
+            E_GL_ARB_depth_buffer_float,
+            // The floating-point colour formats. Unlike the rest of this block this string DOES
+            // gate CTS cases - KHR-GL4*.internalformat.texture2d.*{16f,32f} is keyed on it with no
+            // core-version fallback, so eight cases per version list were NotSupported on formats
+            // the backend has always had.
+            E_GL_ARB_texture_float,
+            // glViewportArrayv / glViewportIndexedf{,v} / glScissorArrayv / glScissorIndexed{,v} /
+            // glDepthRangeArrayv / glDepthRangeIndexed / glGetFloati_v / glGetDoublei_v, over the
+            // 16 viewports GL_MAX_VIEWPORTS reports and the per-viewport routing emulation.
+            E_GL_ARB_viewport_array,
             // Advertised with GL_NUM_PROGRAM_BINARY_FORMATS = 0, which the
             // extension explicitly permits. It is also the only thing that
             // exposes glProgramParameteri before GL 4.1.
@@ -1065,6 +1161,47 @@ namespace MobileGL::MG_Backend::DirectGLES {
         if (timerQueriesSupported && !MG_Config::Features.DisableTimerQuery) {
             extensions.push_back(E_GL_ARB_timer_query);
         }
+        // Cube map arrays are core from GL 4.0 and from ES 3.2, but on a pre-ES-3.2 driver without
+        // EXT/OES_texture_cube_map_array there is nothing underneath: the texture gets no storage
+        // and a samplerCubeArray shader does not even compile, which is exactly what the POST
+        // reports. So the string follows the host capability rather than the version.
+        //
+        // Named for the application's benefit rather than the suite's: measured on Adreno 830,
+        // KHR-GL43.texture_gather.plain-gather-*-cube-array already passed without the string, so
+        // this unlocks no conformance case. It is advertised because the feature is real and
+        // because an application that feature-detects cube map arrays off the string (rather than
+        // off the 4.0 version) would otherwise decline a path this backend serves.
+        if (cubeMapArraySupported) {
+            extensions.push_back(E_GL_ARB_texture_cube_map_array);
+        }
+        // Only advertised when the host ES driver has EXT/OES_texture_view. ES has no core
+        // texture views at any version and no honest emulation exists: a view is a SECOND NAME
+        // over the SAME storage, so that writes through either are visible through the other and
+        // the two carry independent per-texture parameters at the same time - which is exactly
+        // what applications use it for (Better Clouds samples one D24S8 through its own name with
+        // DEPTH_STENCIL_TEXTURE_MODE = STENCIL_INDEX and through a view with DEPTH_COMPONENT, in
+        // a single shading pass). A copy-based fallback satisfies neither half, and fails
+        // silently; withholding the string and answering glTextureView with INVALID_OPERATION is
+        // the only behaviour that cannot be mistaken for success.
+        //
+        // The host extension is necessary and NOT sufficient, which is why this second gate
+        // exists. Adreno 830 has EXT_texture_view, and on it the whole functional half of
+        // KHR-GL4{2,3}.texture_view fails: base_and_max_levels, reference_counting and
+        // view_sampling Fail and view_classes crashes, while only the two pure-API cases
+        // (errors, gettexparameter - neither of which touches the host view) pass. The cause is
+        // known and is MobileGL's, not the driver's: SyncTextureViewToBackend normalizes the
+        // VIEW's ES internalformat independently of the storage it aliases, so whenever the two
+        // land on different renderability carriers the host rejects the pair, the error is
+        // swallowed, and the view is left as a storage-less name that samples as zeros.
+        // DirectVulkan builds the view as a second VkImageView over one VkImage and has no such
+        // seam - it passes 5 of the 7 cases on the same device - so the string stays there.
+        //
+        // Until that reconciliation exists, advertising here would be the same lie the comment
+        // above refuses to tell, just with an extra prerequisite met. Set
+        // MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW=1 to re-enable it for that work.
+        if (textureViewSupported && MG_Config::Features.EsprytEnableTextureView) {
+            extensions.push_back(E_GL_ARB_texture_view);
+        }
         // Only advertised when the host ES driver actually filters anisotropically: the sampler
         // state is accepted regardless, but forwarding it would be a no-op without the extension,
         // and an app that trusts the string (LWJGL builds GLCapabilities from it) would silently
@@ -1118,8 +1255,6 @@ namespace MobileGL::MG_Backend::DirectGLES {
             funcsTable.GL.MemoryBarrierByRegion = MemoryBarrierByRegion;
             funcsTable.GL.BindImageTexture = BindImageTexture;
             funcsTable.GL.GetIntegeri_v = GetIntegeri_v;
-            funcsTable.GL.GetInteger64i_v = GetInteger64i_v;
-            funcsTable.GL.GetProgramiv = GetProgramiv;
             funcsTable.GL.ShaderStorageBlockBinding = ShaderStorageBlockBinding;
             funcsTable.GL.Clear = Clear;
             funcsTable.GL.ClearBufferfi = ClearBufferfi;
@@ -1204,6 +1339,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
     void BackendObject_DirectGLES::UpdateDynamicBackendParameters() {
         m_dynamicParameters.UniformBufferOffsetAlignment = m_GLESCapabilities.UniformBufferOffsetAlignment;
+        m_dynamicParameters.ShaderStorageBufferOffsetAlignment =
+            m_GLESCapabilities.ShaderStorageBufferOffsetAlignment;
         m_dynamicParameters.MaxTextureMaxAnisotropy = m_GLESCapabilities.MaxTextureMaxAnisotropy;
         m_dynamicParameters.AliasedLineWidthRangeMin = m_GLESCapabilities.AliasedLineWidthRangeMin;
         m_dynamicParameters.AliasedLineWidthRangeMax = m_GLESCapabilities.AliasedLineWidthRangeMax;
@@ -1278,6 +1415,13 @@ namespace MobileGL::MG_Backend::DirectGLES {
             clampStageStorageBlocks(m_GLESCapabilities.MaxFragmentShaderStorageBlocks);
         m_dynamicParameters.MaxComputeUniformBlocks = m_GLESCapabilities.MaxComputeUniformBlocks;
         m_dynamicParameters.MaxComputeWorkGroupInvocations = m_GLESCapabilities.MaxComputeWorkGroupInvocations;
+        // The six per-axis compute limits: the driver's raw glGetIntegeri_v answers, the same
+        // numbers GLFunctionsTable::GetIntegeri_v forwards live. Carried here so that MGPCaps has
+        // them once the table entry retires (plan B section 4.4.1); GL_Getter floors them.
+        for (SizeT axis = 0; axis < 3; ++axis) {
+            m_dynamicParameters.MaxComputeWorkGroupCount[axis] = m_GLESCapabilities.MaxComputeWorkGroupCount[axis];
+            m_dynamicParameters.MaxComputeWorkGroupSize[axis] = m_GLESCapabilities.MaxComputeWorkGroupSize[axis];
+        }
         // (MaxShaderStorageBufferBindings is assigned above, before the per-stage clamp reads it.)
         // This is the number glGetIntegerv(GL_MAX_TEXTURE_BUFFER_SIZE) hands the application, and
         // on a host without buffer textures it is knowingly a floor MobileGL cannot honour rather
@@ -1340,9 +1484,44 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // Follows the line above, and must: OpenGL ES has no double-precision vertex format and no
         // fp64 type to consume one with, so a 64-bit vertex attribute has nowhere to land here.
         m_dynamicParameters.SupportsFloat64VertexAttributes = false;
+        // Whether a tessellation / geometry stage's ESSL may name gl_PointSize at all: the two
+        // extension pairs the loader probed, independently, because they really do come
+        // separately. False arms the shared phase-B demotion
+        // (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram), whose ESSL then
+        // never names the built-in in those stages and needs no extension.
+        // MOBILEGL_POINT_SIZE_DEMOTION=1 pretends both are absent so the demotion can be
+        // exercised on a healthy driver (the pinned integration lane); =0 restores the
+        // detected answer's declines.
+        m_dynamicParameters.SupportsTessellationPointSize =
+            m_GLESCapabilities.TessellationPointSizeSupport !=
+            MG_External::GLESCapabilities::PointSizeTier::None;
+        m_dynamicParameters.SupportsGeometryPointSize =
+            m_GLESCapabilities.GeometryPointSizeSupport !=
+            MG_External::GLESCapabilities::PointSizeTier::None;
+        switch (MG_Config::Features.PointSizeDemotion) {
+        case MG_Config::QuirkOverride::ForceOn:
+            MGLOG_I("DirectGLES: MOBILEGL_POINT_SIZE_DEMOTION=1 - treating tessellation/geometry "
+                    "gl_PointSize as unhosted so the demotion runs on this driver");
+            m_dynamicParameters.SupportsTessellationPointSize = false;
+            m_dynamicParameters.SupportsGeometryPointSize = false;
+            break;
+        case MG_Config::QuirkOverride::ForceOff:
+            MGLOG_I("DirectGLES: MOBILEGL_POINT_SIZE_DEMOTION=0 - keeping the built-in and the "
+                    "plain declines regardless of the driver's extensions");
+            m_dynamicParameters.SupportsTessellationPointSize = true;
+            m_dynamicParameters.SupportsGeometryPointSize = true;
+            break;
+        case MG_Config::QuirkOverride::Auto:
+            break;
+        }
         m_dynamicParameters.MaxDrawBuffers = m_GLESCapabilities.MaxDrawBuffers;
         m_dynamicParameters.MaxColorAttachments = m_GLESCapabilities.MaxColorAttachments;
         m_dynamicParameters.MaxClipDistances = m_GLESCapabilities.MaxClipDistances;
+        // The loader already gated both on GL_EXT_clip_cull_distance and left 0 without it, which
+        // is the answer that keeps glslang from accepting a gl_CullDistance the ESSL compiler
+        // would reject.
+        m_dynamicParameters.MaxCullDistances = m_GLESCapabilities.MaxCullDistances;
+        m_dynamicParameters.MaxCombinedClipAndCullDistances = m_GLESCapabilities.MaxCombinedClipAndCullDistances;
         m_dynamicParameters.MaxViewports = m_GLESCapabilities.MaxViewports;
         // Whatever the driver said about which vertex supplies gl_Layer, and GL_UNDEFINED_VERTEX
         // for gl_ViewportIndex on every driver without GL_OES_viewport_array - which is both test

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.h

@@ -78,11 +78,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
     // The full OpenGL extension list Espryt advertises (glGetString(GL_EXTENSIONS))
     // for a device whose timer queries / anisotropic filtering / native indirect draws /
-    // non-zero indirect baseInstance semantics are (or are not) usable.
+    // non-zero indirect baseInstance semantics / EXT-OES texture views are (or are not) usable.
     // The MOBILEGL_DISABLE_TIMERQUERY escape hatch is applied inside.
     Vector<GLExtension> BuildAdvertisedExtensions(Bool timerQueriesSupported, Bool anisotropicFilteringSupported,
                                                   Bool drawIndirectSupported,
-                                                  Bool nonZeroIndirectBaseInstanceSupported);
+                                                  Bool nonZeroIndirectBaseInstanceSupported,
+                                                  Bool textureViewSupported, Bool cubeMapArraySupported);
 
     // Format: <OpenGL ES Renderer>, OpenGL ES <Major>.<Minor> — the exact string an
     // initialized backend returns from GetBackendAPIVersionString (and that ends up

MobileGL/MG_Backend/DirectGLES/DirectGLES.h

@@ -92,8 +92,6 @@ namespace MobileGL::MG_Backend::DirectGLES {
     void BindImageTexture(GLuint unit, GLuint texture, GLint level, GLboolean layered, GLint layer, GLenum access,
                           GLenum format);
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params);
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding);
     Bool InitWindowSurface(NativeWindowType window);
     Bool InitPbufferSurface(EGLint width, EGLint height);

MobileGL/MG_Backend/DirectGLES/MultiDraw.cpp

@@ -9,6 +9,8 @@
 #include "MultiDraw.h"
 #include "Managers.h"
 #include <MG_State/GLState/Core.h>
+#include <MG_Pipe/PipeInputsSwitch.h>
+#include <MG_Util/Metrics/PipeStats.h>
 #include <cstring>
 #include <limits>
 
@@ -29,21 +31,26 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             }
         }
 
-        // The all-ones value of an index type, which is what GL restarts on once
+        // The index value this batch restarts on, compared at 32 bits against the zero-extended
-        // primitive restart is in play. CheckPrimitiveRestartSupported has already
+        // source index. Normally the all-ones value of the source type, which is what
-        // rejected the arbitrary-index form of GL_PRIMITIVE_RESTART, so an enabled
+        // GL_PRIMITIVE_RESTART_FIXED_INDEX and GLES both restart on; with desktop
-        // restart always restarts here and nowhere else.
+        // GL_PRIMITIVE_RESTART it is instead whatever glPrimitiveRestartIndex named. The rebased
+        // tier turns whichever it is into 0xFFFFFFFF in its widened stream, which is what the
+        // driver restarts on.
+        //
+        // No truncation, deliberately, and the same rule ResolveRestartSubstitution applies: a
+        // restart index the source type cannot hold simply matches nothing, so returning it
+        // verbatim is already "this batch restarts nowhere".
         Uint32 RestartSentinelFor(GLenum type) {
-            switch (type) {
+            if (ResolveRestartSubstitution(type) != RestartSubstitutionKind::None) {
-            case GL_UNSIGNED_BYTE: return 0xFFu;
+                return MGB_CTX->GetPrimitiveRestartIndex();
-            case GL_UNSIGNED_SHORT: return 0xFFFFu;
-            default: return 0xFFFFFFFFu;
             }
+            return MG_Util::FixedRestartIndexForGLType(type);
         }
 
         Bool RestartActive() {
-            return MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::PrimitiveRestart) ||
+            return MGB_CTX->IsCapabilityEnabled(CapabilityInput::PrimitiveRestart) ||
-                   MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::PrimitiveRestartFixedIndex);
+                   MGB_CTX->IsCapabilityEnabled(CapabilityInput::PrimitiveRestartFixedIndex);
         }
 
         // Vertices per primitive for the modes whose sub-draws may be concatenated into a
@@ -78,7 +85,7 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
         Uint BoundDrawIndirectBufferId() {
             const auto& indirect =
-                MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+                MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
             if (!indirect) return 0;
             const auto* resource = BufferImpl::EnsureBufferResource(indirect);
             return resource ? resource->id : 0;
@@ -86,7 +93,7 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
         const SharedPtr<MG_State::GLState::BufferObject>& BoundIndexBuffer() {
             static const SharedPtr<MG_State::GLState::BufferObject> none;
-            const auto& vao = MG_State::pGLContext->GetBoundVertexArray();
+            const auto& vao = MGB_CTX->GetBoundVertexArray();
             if (!vao) return none;
             return vao->GetIndexBufferBindingSlot().GetBoundObject();
         }
@@ -151,7 +158,10 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         // are bound as storage blocks. Respecifies rather than sub-updates: glBufferData
         // orphans the previous store, so the upload never waits on a dispatch still reading
         // the old contents out of the same name.
-        Bool UploadScratch(ScratchBuffer& buffer, SizeT bytes, const void* data) {
+        // statsClass: which MGPipe byte population these bytes belong to. Counted here
+        // rather than at the four call sites so a new tier cannot forget it.
+        Bool UploadScratch(ScratchBuffer& buffer, SizeT bytes, const void* data,
+                           MG_Util::PipeStats::ByteClass statsClass) {
             if (bytes == 0) return true;
             if (!EnsureScratchName(buffer)) return false;
             BufferImpl::BindBufferId(BufferImpl::TempBufferTarget, buffer.id);
@@ -164,6 +174,9 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             buffer.cursor = 0;
             if (data) {
                 g_GLESFuncs.glBufferSubData(BufferImpl::TempBufferTarget, 0, static_cast<GLsizeiptr>(bytes), data);
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::AddBytes(statsClass, static_cast<Uint64>(bytes));
+                }
             }
             return true;
         }
@@ -178,7 +191,8 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         constexpr SizeT kRingAlignment = 16; // >= 4, so both command and uint32-index offsets stay legal
         constexpr SizeT kMinRingBytes = 1u << 16;
 
-        Bool UploadScratchRing(ScratchBuffer& buffer, SizeT bytes, const void* data, SizeT& outOffset) {
+        Bool UploadScratchRing(ScratchBuffer& buffer, SizeT bytes, const void* data,
+                               MG_Util::PipeStats::ByteClass statsClass, SizeT& outOffset) {
             outOffset = 0;
             if (bytes == 0) return true;
             if (!EnsureScratchName(buffer)) return false;
@@ -202,6 +216,9 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             if (data) {
                 g_GLESFuncs.glBufferSubData(BufferImpl::TempBufferTarget, static_cast<GLintptr>(outOffset),
                                             static_cast<GLsizeiptr>(bytes), data);
+                if (MG_Util::PipeStats::Enabled()) {
+                    MG_Util::PipeStats::AddBytes(statsClass, static_cast<Uint64>(bytes));
+                }
             }
             buffer.cursor += aligned;
             return true;
@@ -275,10 +292,20 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         // its remaining feasibility checks inside its implementation, where the data it
         // has to walk is already in hand.
         GLESMultiDrawMode ResolveTierForBatch(Bool programReadsDrawID, Bool perSubDrawBaseVertex,
-                                              Bool hasIndexBuffer) {
+                                              Bool hasIndexBuffer, Bool arbitraryRestart) {
             ResolveTierOnce();
             GLESMultiDrawMode tier = g_resolvedTier;
 
+            // Desktop GL_PRIMITIVE_RESTART restarts on an application-chosen index; the driver
+            // only ever restarts on the all-ones value. Every tier but the rebased one hands
+            // the application's own index data to the driver, which would then see no restarts
+            // at all and weld the primitives together. The rebased tier is the one that
+            // REWRITES the stream, and RestartSentinelFor already tells it which value to
+            // translate, so it is the only tier this batch can take.
+            if (arbitraryRestart) {
+                return GLESMultiDrawMode::DrawElements;
+            }
+
             // Batched tiers issue one driver entry for the whole batch, so the emulated
             // gl_DrawID uniform can only hold one value across every sub-draw. A program
             // that reads gl_DrawID gets an unrolled tier, which feeds each sub-draw its
@@ -402,7 +429,8 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
             const SizeT commandBytes = g_commandStaging.size() * sizeof(DrawElementsIndirectCommand);
             SizeT commandBase = 0;
-            if (!UploadScratchRing(g_indirectCommands, commandBytes, g_commandStaging.data(), commandBase)) {
+            if (!UploadScratchRing(g_indirectCommands, commandBytes, g_commandStaging.data(),
+                                   MG_Util::PipeStats::ByteClass::StageIndirectCmd, commandBase)) {
                 return false;
             }
 
@@ -488,6 +516,16 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
             const Bool restartActive = RestartActive();
             const Uint32 restartSentinel = RestartSentinelFor(type);
+            // Widening to GL_UNSIGNED_INT gives a UBYTE/USHORT source a sentinel it can never
+            // spell, so those batches are lossless. A UINT source that already uses 0xFFFFFFFF as
+            // a real vertex index while restarting on a different one is the one shape 32 bits
+            // cannot express - the same corner the single-draw substitution reports.
+            if (restartActive && indexSize == 4 && restartSentinel != 0xFFFFFFFFu) {
+                MGLOG_E_ONCE("GL_PRIMITIVE_RESTART with restart index %u over GL_UNSIGNED_INT multi-draw indices: "
+                             "any index that is already 0xFFFFFFFF will restart too, because the rewritten stream "
+                             "has no wider sentinel to move to.",
+                             restartSentinel);
+            }
             g_indexStaging.resize(total);
             SizeT cursor = 0;
             for (GLsizei i = 0; i < drawcount; ++i) {
@@ -507,7 +545,8 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             }
 
             SizeT indexBase = 0;
-            if (!UploadScratchRing(g_rebasedIndices, total * sizeof(Uint32), g_indexStaging.data(), indexBase)) {
+            if (!UploadScratchRing(g_rebasedIndices, total * sizeof(Uint32), g_indexStaging.data(),
+                                   MG_Util::PipeStats::ByteClass::StageIndexClient, indexBase)) {
                 return false;
             }
 
@@ -712,10 +751,16 @@ void main() {
             if (total == 0) return; // nothing to draw; the ordinary tiers no-op just as well
 
             if (!EnsureComputeProgram()) return;
-            if (!UploadScratch(g_drawInfo, g_drawInfoStaging.size() * sizeof(Uint32), g_drawInfoStaging.data())) {
+            if (!UploadScratch(g_drawInfo, g_drawInfoStaging.size() * sizeof(Uint32), g_drawInfoStaging.data(),
+                               MG_Util::PipeStats::ByteClass::StageIndirectCmd)) {
+                return;
+            }
+            // data == nullptr: pure respecify, the compute pass writes the contents, so no
+            // host bytes cross here and nothing is counted.
+            if (!UploadScratch(g_flattenedIndices, total * sizeof(Uint32), nullptr,
+                               MG_Util::PipeStats::ByteClass::StageIndexClient)) {
                 return;
             }
-            if (!UploadScratch(g_flattenedIndices, total * sizeof(Uint32), nullptr)) return;
 
             BufferImpl::BindBufferBaseCached(GL_SHADER_STORAGE_BUFFER, 0, sourceResource->id);
             BufferImpl::BindBufferBaseCached(GL_SHADER_STORAGE_BUFFER, 1, g_drawInfo.id);
@@ -852,8 +897,14 @@ void main() {
     void DrawElementsBatch(GLenum mode, const GLsizei* count, GLenum type, const GLvoid* const* indices,
                            GLsizei drawcount, const GLint* basevertex) {
         if (drawcount <= 0 || !count || !indices) return;
-        // State-independent and possibly throwing, so it runs before any GL work.
+        // Read before any GL work, because it decides the tier below: a desktop restart index
-        CheckPrimitiveRestartSupported(type);
+        // the driver does not know about can only be honoured by the tier that rewrites the
+        // index stream (see ResolveTierForBatch). A restart index this index type cannot hold
+        // needs no rewrite at all - nothing can match it - but it does need the driver's own
+        // fixed-index restart held off for the batch, which is what the scope below does.
+        const RestartSubstitutionKind restartKind = ResolveRestartSubstitution(type);
+        const Bool arbitraryRestart = restartKind == RestartSubstitutionKind::RewriteIndices;
+        const ScopedSuppressedPrimitiveRestart restartCapOverride(restartKind);
 
         const Bool hasIndexBuffer = BoundIndexBuffer() != nullptr;
 
@@ -889,7 +940,8 @@ void main() {
         // the tier choice and the per-sub-draw feeds use those, not the guess above.
         const Bool feedDrawID = CurrentProgramReadsDrawID();
         const Bool feedBaseVertex = basevertex != nullptr && CurrentProgramReadsBaseVertex();
-        const GLESMultiDrawMode tier = ResolveTierForBatch(feedDrawID, feedBaseVertex, hasIndexBuffer);
+        const GLESMultiDrawMode tier =
+            ResolveTierForBatch(feedDrawID, feedBaseVertex, hasIndexBuffer, arbitraryRestart);
 
         Bool drawn = false;
         switch (tier) {
@@ -921,8 +973,10 @@ void main() {
         // Every tier above may decline a batch whose shape it cannot express. The two
         // below are the floor: a base-vertex replay where the driver has one, and the
         // rewritten index stream where it does not. Both are safe for any batch these
-        // entry points can receive.
+        // entry points can receive - except that the base-vertex replay hands the
-        if (!drawn) {
+        // application's own indices to the driver, which cannot restart on a desktop
+        // restart index, so that batch has only the rewriting floor.
+        if (!drawn && !arbitraryRestart) {
             drawn = RunBaseVertexLoop(mode, count, type, indices, drawcount, basevertex, feedDrawID, feedBaseVertex);
         }
         if (!drawn) {

MobileGL/MG_Backend/DirectGLES/SlotTables.h

@@ -0,0 +1,577 @@
+// MobileGL - MobileGL/MG_Backend/DirectGLES/SlotTables.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+#include <MG_Pipe/MGPipeHandles.h>
+
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#endif
+
+// Espryt 0b, the first Track H slice: the DENSE, {slot, gen}-keyed twin table that replaces
+// StateBackendObjectRegistry's UnorderedMap<StateObject*, Entry>.
+//
+// What changes, and why each of them is the point:
+//
+//  * The KEY stops being a frontend heap address. It is MGPipeHandle{Slot, Gen}, minted by the
+//    client's MGPipeSlotAllocator off the frontend object's GetLifetimeId(). A recycled heap
+//    address cannot reproduce a handle, so the weak_ptr the registry carried per entry purely
+//    to catch that (its Entry::stateRef, used as an IDENTITY test) stops being an identity
+//    mechanism, and OwnerEquals / TwinLookupMemo x3 / UnitSamplerLookupMemo's owner compare all
+//    lose their reason to exist.
+//  * The lookup stops being a hash probe into an open-addressed map and becomes one bounds
+//    check plus one array index, so a returned BackendPtr* is NOT invalidated by the next Find
+//    on the table. That kills the hazard Managers.h documents at length, and with it the
+//    by-value copy plus second Find that SyncTextureObjectToBackend paid to survive it.
+//  * Slots are dense per kind, which is what lets the server side (ARCHITECTURE.md 10.1,
+//    MG_Remote/Server/PipeObjectTables) be an array rather than an object graph.
+//
+// Death is ANNOUNCED, and that is what lets this table have no garbage collector - the
+// deliverable ROADMAP.md:18 spells "GC" in and the one D13 makes a precondition of the switch-
+// over. All six re-keyed object classes raise MG_State::GLState::NotifyStateObjectDestroyed()
+// from their destructor (BufferBackendOps' shape, one entry point for six kinds), the backend
+// consumes it in Managers.cpp, and OnFrontendObjectDestroyed() below drops the twin in EVERY
+// table of the kind and returns the slot, at the moment the frontend object's last SharedPtr
+// goes. So:
+//   * there is NO draw-path tick, NO creation tick and NO sweep of any kind on this arm. The
+//     seven CollectGarbageIfNeeded call sites in DirectGLES.cpp drive the LEGACY registry only;
+//   * a twin, and the driver storage it owns, is freed when the application lets go of the
+//     object rather than up to 64 creations or 1024 draw ticks later. That is what
+//     Managers.h's "dead gigabytes" note asked for.
+//
+// EVERY HOLDER OF THE KIND, not one. Two live tables of one kind is a real configuration - the
+// ScopedDirectGLESTextureBindings fixture keeps a by-value copy of the Texture registry for the
+// length of a test, and a context reset does the same in reverse - and the slot allocator
+// erases its lifetimeId -> slot mapping on Free, so a notice delivered to one holder and
+// resolved again by the next would find nothing to resolve. Every table therefore links itself
+// into a per-table-type list at construction and out at destruction, and one notice resolves
+// the handle ONCE, drops the twin in each holder BY HANDLE, and frees the slot once, last. No
+// holder can be left naming a live entry for a dead object, and there is nothing a sweep could
+// still find. (The list is per table TYPE; the kind is the type's template parameter, and each
+// of the six kinds has exactly one table type in this backend. Magma's subsystem-4 table mints
+// out of its own per-renderer allocator, not MGPipeSlots(), so it is not a holder here.)
+//
+// The weak_ptr per entry survives for exactly one reason: ForEachLive() hands the callee a
+// STRONG reference to the frontend object, which the one direct-iteration site
+// (ScopedDetachedTextureFramebufferAttachments) needs. It is never an identity test - that is
+// what Gen is for - and it is never read to decide whether an entry is dead: a destructor that
+// runs after exit() has begun has its notice dropped by InProcessTeardown(), and that twin is
+// then a DELIBERATE leak (the process is exiting, the driver reclaims the object, and a twin
+// destructor must not call into a driver that may already be unloaded), not something to be
+// collected later.
+//
+// P3+ DEBT, recorded rather than hidden: this header is under MG_Backend/ and it MINTS
+// handles (MGPipeSlots().Acquire below) off a frontend SharedPtr's GetLifetimeId().
+// MGPipeHandles.h:13-16 says a handle is minted by the CLIENT and never by the server, and
+// under a real split neither the frontend object nor its lifetime id exists on this side of
+// the wire. This is monolith glue: the minting and the lifetimeId -> handle resolution both
+// belong on the client, and the backend should receive the handle in the verb payload. It is
+// NOT part of "Track H done" and check_include_closure.py does not probe MG_Backend headers,
+// so nothing catches it automatically.
+namespace MobileGL::MG_Backend::DirectGLES {
+
+#if MOBILEGL_PIPE_PUSH
+
+    // Declared in Managers.h as well; repeated here because this header is included from it
+    // before that declaration, and the table below is the arming site on this arm (D13: "the
+    // arming site moves to the slot table's first insertion").
+    void EnsureProcessTeardownSentinel();
+
+    // What the two knobs add up to. Split out as a PURE function of them so a test can drive
+    // every combination without needing a process per combination.
+    enum class EsprytSlotArmVerdict {
+        Handles, // kMGPipeSubsystemEsprytSlots is set: the {slot, gen} tables run.
+        Legacy,  // the bit is clear and the legacy address-keyed registry is reachable.
+        NoArm,   // the bit is clear AND MOBILEGL_PIPE_LEGACY_MEMOS=0 made the legacy arm
+                 // unreachable, so the operator asked for a configuration with no arm at all.
+    };
+
+    EsprytSlotArmVerdict ClassifyEsprytSlotArm(Bool subsystemBitSet, Bool legacyMemosEnabled);
+
+    // This process's verdict, read off MG_Config::Features. Latches nothing and stops nothing.
+    EsprytSlotArmVerdict CurrentEsprytSlotArmVerdict();
+
+    // Says, at backend bring-up, that the knobs leave no arm - and does NOT stop.
+    //
+    // The stop cannot live here, and that is the whole point of the split. Backend context
+    // creation runs inside eglMakeCurrent, and the integration harness pre-flights exactly that
+    // sequence in a FORKED CHILD (MG_IntegrationTest/Harness/HeadlessGL.cpp): a child that dies
+    // on a signal is reported as "no usable GPU/display/ICD" and every scenario in the lane is
+    // SKIPPED - i.e. the lane goes green having run nothing, on the very pair of env vars the
+    // D14/D18 A/B is driven with, which is what ROADMAP.md:7 forbids. So bring-up only
+    // DIAGNOSES; the stop is raised by ResolveEsprytSlotTablesArm() at the first twin lookup,
+    // which happens in the test body where the harness reports it as a failure.
+    //
+    // The CALL SITE (InitDisplayAndContext in DirectGLES.cpp) is pinned by
+    // DirectGLESSlotTable.EglBringUpUnderTheArmlessKnobPairReturnsInsteadOfStopping, which runs
+    // the real bring-up entry point under the pair in a forked child: edit that site back to
+    // ResolveEsprytSlotTablesArm() and the case fails naming both knobs.
+    void DiagnoseEsprytSlotArm();
+
+    // Reads the config, logs, installs the death-notice consumer, and STOPS when the operator
+    // left no arm at all. Cold: called exactly once per process, from the latch below - i.e. at
+    // the first twin lookup, which is the first moment an arm is actually needed. A process
+    // that never twins anything needs no arm and is not stopped.
+    Bool ResolveEsprytSlotTablesArm();
+
+    // True when this process runs the {slot, gen} arm. Fixed for the life of the process: the
+    // two arms hold their twins in different containers, so flipping mid-run would strand them.
+    //
+    // INLINE on purpose. Every Find / GetOrCreate / HandleOf / ForEachLive on the twin tables
+    // consults it, i.e. it is on the per-draw path several times per draw. As an out-of-line
+    // function in Managers.cpp (no LTO in any shipped configuration) that was a call through
+    // the PLT per lookup; here the caller sees a guard-variable load and a perfectly-predicted
+    // branch, and the arm dispatch folds into the caller.
+    inline Bool EsprytSlotTablesEnabled() {
+        static const Bool enabled = ResolveEsprytSlotTablesArm();
+        return enabled;
+    }
+
+    template <typename StateObject, typename BackendObject, MG_Pipe::MGPipeKind kKind>
+    class BackendSlotTable {
+    public:
+        using StatePtr = SharedPtr<StateObject>;
+        using StateWeakPtr = std::weak_ptr<StateObject>;
+        using BackendPtr = SharedPtr<BackendObject>;
+
+        // The largest slot index this table will grow to for a handle that ARRIVED in a call's
+        // payload. Slots are dense and allocated per kind, so a million of one kind is already
+        // far past any application's live object count; the cap is here because the alternative
+        // is letting a corrupt 32-bit slot decide a vector resize. See GetOrCreate(MGPipeHandle).
+        static constexpr Uint32 kMaxHandleSlot = 1u << 20;
+
+        struct Entry {
+            BackendPtr backend;
+            // LIVENESS ONLY, and only for ForEachLive(), which locks it so the callee holds a
+            // strong ref. Never compared against another object to decide identity - that is
+            // what Gen is for - never dereferenced for its address, and never read to decide
+            // whether the slot is dead: death is announced, not discovered.
+            StateWeakPtr stateRef;
+            // The generation this entry's twin was built for. An entry whose Gen no longer
+            // matches the allocator's is a twin of the slot's PREVIOUS owner.
+            Uint32 Gen = 0;
+            Bool Live = false;
+        };
+
+        // Every constructor links the table into the per-type holder list and the destructor
+        // unlinks it, so a by-value copy (the ScopedDirectGLESTextureBindings fixture's saved
+        // registry) is a holder for exactly as long as it exists. Copy and move carry the
+        // ENTRIES and the memo; the links are the table's own and are never copied.
+        BackendSlotTable() { LinkHolder(); }
+        BackendSlotTable(const BackendSlotTable& other):
+            m_slots(other.m_slots),
+            m_nullTwin(other.m_nullTwin),
+            m_memoLifetimeId(other.m_memoLifetimeId),
+            m_memoHandle(other.m_memoHandle) {
+            LinkHolder();
+        }
+        BackendSlotTable(BackendSlotTable&& other) noexcept:
+            m_slots(std::move(other.m_slots)),
+            m_nullTwin(std::move(other.m_nullTwin)),
+            m_memoLifetimeId(other.m_memoLifetimeId),
+            m_memoHandle(other.m_memoHandle) {
+            other.m_slots.clear();
+            other.ForgetHandle();
+            LinkHolder();
+        }
+        BackendSlotTable& operator=(const BackendSlotTable& other) {
+            if (this != &other) {
+                m_slots = other.m_slots;
+                m_nullTwin = other.m_nullTwin;
+                m_memoLifetimeId = other.m_memoLifetimeId;
+                m_memoHandle = other.m_memoHandle;
+            }
+            return *this;
+        }
+        BackendSlotTable& operator=(BackendSlotTable&& other) noexcept {
+            if (this != &other) {
+                m_slots = std::move(other.m_slots);
+                m_nullTwin = std::move(other.m_nullTwin);
+                m_memoLifetimeId = other.m_memoLifetimeId;
+                m_memoHandle = other.m_memoHandle;
+                other.m_slots.clear();
+                other.ForgetHandle();
+            }
+            return *this;
+        }
+        ~BackendSlotTable() { UnlinkHolder(); }
+
+        // Resolve-or-create. The handle comes from the client allocator keyed on the frontend
+        // object's lifetime id, so two calls for the same live object always land on the same
+        // slot, and a successor object at the same heap address never does.
+        BackendPtr& GetOrCreate(const StatePtr& stateObj) {
+            // No assert on null here, unlike the map arm: null is TOLERATED, so a DEBUG build
+            // must not trap where the release build quietly does the documented thing.
+            if (stateObj == nullptr) {
+                // The registry this replaces inserted a null KEY and handed back that entry's
+                // twin (DirectGLES.cpp's SyncTextureObjectToBackend documents relying on
+                // exactly that tolerance), so a release build never dereferenced null here.
+                // Keep the shape exactly, INCLUDING across calls: the map kept its null-keyed
+                // entry, so a second null call was handed the same twin the first one got.
+                // Resetting here instead would have destroyed it - an arm difference in the one
+                // path that documents relying on this. One per-table parking slot, never live,
+                // never handed a handle, because a null object has no identity and
+                // therefore cannot have a {slot, gen}.
+                return m_nullTwin;
+            }
+
+            // D13: the teardown sentinel is armed by the slot table's first insertion. Twin
+            // creation is the moment a driver-owned id starts needing a guarded destructor;
+            // this is the cold path, so the once-guard costs nothing per draw. On the legacy
+            // arm StateBackendObjectRegistry::GetOrCreate arms it itself.
+            EnsureProcessTeardownSentinel();
+
+            const MG_Pipe::MGPipeHandle handle =
+                MG_Pipe::MGPipeSlots().Acquire(kKind, stateObj->GetLifetimeId());
+            MOBILEGL_ASSERT(!MG_Pipe::MGPipeHandleIsNull(handle),
+                            "MGPipe slot space of kind %u is exhausted",
+                            static_cast<Uint32>(kKind));
+            Entry& entry = EntryAt(handle.Slot);
+            if (entry.Live && entry.Gen != handle.Gen) {
+                // The slot was reclaimed and handed to a new object: the twin at it describes
+                // driver ids the new state object never made.
+                entry.backend.reset();
+            }
+            entry.Gen = handle.Gen;
+            entry.Live = true;
+            entry.stateRef = stateObj;
+            // No creation tick and no sweep here. The registry this replaces needed both,
+            // because nothing told it a texture or a renderbuffer had been DELETED and object
+            // CHURN rather than draw count is what made that urgent. Every one of the six kinds
+            // now announces its own death from its destructor, so a dead twin's slot is already
+            // back before the next creation asks for one.
+            RememberHandle(stateObj->GetLifetimeId(), handle);
+            return entry.backend;
+        }
+
+        // P3a: resolve-or-create BY HANDLE, and it is the shape that discharges the debt this
+        // header records against itself at the top of the file.
+        //
+        // The overload above mints - it calls MGPipeSlots().Acquire off a frontend object's
+        // lifetime id, from inside MG_Backend - which is monolith glue: a handle is minted by
+        // the CLIENT, and under a real split neither the object nor its lifetime id exists on
+        // this side. This overload never touches the allocator at all. The handle ARRIVED, in
+        // the call's payload, already minted by the side that owns minting; all this does is
+        // index the slot, notice a generation that no longer matches (the slot was recycled,
+        // so the twin at it describes driver ids the new resource never made) and hand back
+        // the twin pointer. FindByHandle beside it is the same shape and already existed.
+        //
+        // No StatePtr, therefore no Entry::stateRef: the weak pointer is liveness for
+        // ForEachLive() and a handle-keyed entry has no frontend object to weakly hold. Such
+        // an entry is therefore invisible to ForEachLive, which is correct - the one direct
+        // iteration site walks texture twins, and it is not one of these tables.
+        //
+        // Death stays ANNOUNCED, as it is on the other overload: for a handle-keyed kind the
+        // announcement is the family's own destroy call, not the shared death notice, and the
+        // slot is freed by the CLIENT after that call returns.
+        //
+        // UNUSED AT THE CONTRACT COMMIT, deliberately: it is a member of a class template, so
+        // an uninstantiated one costs nothing anywhere, and the backend package is what gives
+        // it its first caller.
+        BackendPtr& GetOrCreate(MG_Pipe::MGPipeHandle handle) {
+            MOBILEGL_ASSERT(!MG_Pipe::MGPipeHandleIsNull(handle),
+                            "GetOrCreate(handle) named the reserved null handle");
+            if (MG_Pipe::MGPipeHandleIsNull(handle)) return m_nullTwin;
+
+            // A slot index that ARRIVED in a payload indexes a vector this call would RESIZE,
+            // and nothing between the payload and here bounds it: the applier's blob gates sit
+            // in front of the vertex-input family, not in front of the resource family, which
+            // dispatches ops->Create(record.Res, ...) straight through. There is no allocator
+            // constant to check against on this side - the allocator is the client's - so this
+            // is a sanity cap and is documented as one: kMaxHandleSlot entries of one kind is
+            // already orders of magnitude past any real GL object count, while a corrupt 32-bit
+            // slot asks for a four-billion-entry resize.
+            if (handle.Slot >= kMaxHandleSlot) {
+                MOBILEGL_ASSERT(false, "GetOrCreate(handle) named slot %u, past this table's %u bound",
+                                handle.Slot, kMaxHandleSlot);
+                return m_nullTwin;
+            }
+
+            // Same arming as the minting overload, and for the same reason: twin creation is
+            // the moment a driver-owned id starts needing a guarded destructor.
+            EnsureProcessTeardownSentinel();
+
+            // THE TWO DIRECTIONS ARE NOT SYMMETRIC HERE, where they are on the minting overload.
+            // There the handle comes straight out of MGPipeSlots().Acquire and can never be
+            // BEHIND the entry, so a bare `!=` only ever means "the slot was recycled forward".
+            // Here the handle arrived in a payload, so `handle.Gen < entry.Gen` is a reachable
+            // input, and adopting it would destroy the INCUMBENT LIVE twin - a driver buffer id,
+            // a persistent map, a pooled store, released by a defaulted destructor that issues
+            // no glDeleteBuffers and no pool enrolment - and then stamp the slot back to the
+            // dead resource's generation, after which the incumbent's own FindByHandle refuses
+            // it and it is silently handed a fresh, empty twin. That is a leak AND a resource
+            // that loses its storage with no diagnostic, i.e. the shape commit d7655247 fixed
+            // and the thing MGPipeHandle::Gen exists to prevent. So: forward is a recycle and
+            // resets the twin, BACKWARD is refused - which is the same answer FindByHandle
+            // below already gives the same input.
+            Entry& entry = EntryAt(handle.Slot);
+            if (entry.Live && entry.Gen > handle.Gen) {
+                MOBILEGL_ASSERT(false,
+                                "GetOrCreate(handle) named generation %u at slot %u, which is BEHIND "
+                                "the live entry's %u - refusing rather than destroying the incumbent",
+                                handle.Gen, handle.Slot, entry.Gen);
+                return m_nullTwin;
+            }
+            if (entry.Live && entry.Gen != handle.Gen) entry.backend.reset();
+            entry.Gen = handle.Gen;
+            entry.Live = true;
+            return entry.backend;
+        }
+
+        // The generation of the LIVE entry at this slot, or 0 when the slot is out of range or
+        // holds no live entry. It exists so a caller can DIAGNOSE - in a release build, where
+        // MOBILEGL_ASSERT is inert - the refusal GetOrCreate(handle) above performs silently.
+        Uint32 LiveGenAt(Uint32 slot) const {
+            if (slot >= m_slots.size()) return 0;
+            const Entry& entry = m_slots[slot];
+            return entry.Live ? entry.Gen : 0;
+        }
+
+        // P3a: the death half of the overload above, for a kind whose announcement is its own
+        // destroy CALL rather than the shared death notice (D-L). Hands the twin OUT rather
+        // than destroying it in place, because the caller may still have to decide what
+        // happens to the driver id it owns - Espryt pools it, deletes it, or parks it on the
+        // deferred-release list when no context is current on this thread - and every one of
+        // those outcomes has to be reached with the entry already retired, so a re-entrant
+        // GetOrCreate from a twin destructor cannot resurrect it.
+        //
+        // The slot itself is NOT freed here: it belongs to the kind, and for a handle-keyed
+        // kind the CLIENT frees it after the destroy call returns (SlotAllocator.h:60 - the
+        // Gen bump rides the next handout, so a double free cannot skip a generation). An
+        // entry whose Gen no longer matches is a twin of the slot's previous owner and is
+        // left alone: the successor's own GetOrCreate resets it.
+        BackendPtr ReleaseByHandle(MG_Pipe::MGPipeHandle handle) {
+            if (MG_Pipe::MGPipeHandleIsNull(handle)) return BackendPtr{};
+            if (m_memoHandle.Slot == handle.Slot) ForgetHandle();
+            if (handle.Slot >= m_slots.size()) return BackendPtr{};
+            Entry& entry = m_slots[handle.Slot];
+            if (!entry.Live || entry.Gen != handle.Gen) return BackendPtr{};
+            BackendPtr dead = std::move(entry.backend);
+            entry.backend.reset();
+            entry.stateRef.reset();
+            entry.Live = false;
+            return dead;
+        }
+
+        // Null when no live twin of this object exists. Unlike the registry's Find this NEVER
+        // mutates the table, so the returned pointer survives any later Find on it; only a
+        // GetOrCreate that grows the vector can move it, and callers that hold one across a
+        // possible insertion still copy the BackendPtr out.
+        BackendPtr* Find(StateObject* stateObj) {
+            if (stateObj == nullptr) return nullptr;
+            return FindByHandle(HandleOf(stateObj));
+        }
+
+        const BackendPtr* Find(StateObject* stateObj) const {
+            return const_cast<BackendSlotTable*>(this)->Find(stateObj);
+        }
+
+        BackendPtr* FindByHandle(MG_Pipe::MGPipeHandle handle) {
+            if (MG_Pipe::MGPipeHandleIsNull(handle)) return nullptr;
+            if (handle.Slot >= m_slots.size()) return nullptr;
+            Entry& entry = m_slots[handle.Slot];
+            if (!entry.Live || entry.Gen != handle.Gen) return nullptr;
+            return &entry.backend;
+        }
+
+        // The handle this object's twin is keyed on, or the null handle. This is what a backend
+        // memo stores instead of a raw pointer, a GL name or a bare lifetime id.
+        //
+        // A NULL answer is never memoised. The memo is per table and the allocator is per
+        // kind, so with two holders of one kind the OTHER table can be the one that acquires;
+        // a cached "no handle" here would then outlive the twin's creation over there, and
+        // nothing on this table's own acquire path would ever refresh it. A miss costs the
+        // allocator probe it always cost; a hit is refreshed the moment anyone acquires.
+        MG_Pipe::MGPipeHandle HandleOf(const StateObject* stateObj) const {
+            if (stateObj == nullptr) return MG_Pipe::kMGPipeNullHandle;
+            const Uint64 lifetimeId = stateObj->GetLifetimeId();
+            if (lifetimeId == m_memoLifetimeId) return m_memoHandle;
+            const MG_Pipe::MGPipeHandle handle =
+                MG_Pipe::MGPipeSlots().FindByLifetimeId(kKind, lifetimeId);
+            if (!MG_Pipe::MGPipeHandleIsNull(handle)) RememberHandle(lifetimeId, handle);
+            return handle;
+        }
+
+        // P2 step e2's backend half. The frontend object with this lifetime id has just been
+        // DESTROYED: resolve its handle ONCE, drop its twin in EVERY table of this type, and
+        // return the slot to the allocator - in that order, because the allocator forgets the
+        // lifetime id on Free and a holder told second could no longer resolve it.
+        //
+        // The slot is returned whether or not any holder still had a twin at it: the lifetime
+        // id is dead and MG_State never hands one out twice, so nothing can acquire it again,
+        // and a slot minted for it that no table holds (a table reset with `= {}` drops its
+        // entries without freeing) would otherwise stay allocated for the life of the process.
+        //
+        // STATIC, and deliberately so: a notice is about an object, not about a table, and
+        // "which table holds it" is exactly the question that produced the two-holder leak.
+        // Returns whether the object had a slot of this kind, i.e. whether anything was freed;
+        // a second call for the same id answers false because the allocator no longer maps it.
+        static Bool OnFrontendObjectDestroyed(Uint64 lifetimeId) {
+            const MG_Pipe::MGPipeHandle handle =
+                MG_Pipe::MGPipeSlots().FindByLifetimeId(kKind, lifetimeId);
+            if (MG_Pipe::MGPipeHandleIsNull(handle)) return false;
+            for (BackendSlotTable* holder = s_firstHolder; holder != nullptr;) {
+                // The successor is read BEFORE the release: ReleaseTwinAt runs the twin's
+                // destructor, which is a driver call, and nothing that outlives it may be a
+                // reference into this holder.
+                BackendSlotTable* const next = holder->m_nextHolder;
+                holder->ReleaseTwinAt(handle);
+                holder = next;
+            }
+            MG_Pipe::MGPipeSlots().Free(kKind, handle);
+            return true;
+        }
+
+        // How many tables of this type exist right now. For the tests that pin the holder
+        // list; nothing on a shipping path asks.
+        static Uint32 HolderCount() {
+            Uint32 count = 0;
+            for (const BackendSlotTable* holder = s_firstHolder; holder != nullptr;
+                 holder = holder->m_nextHolder) {
+                ++count;
+            }
+            return count;
+        }
+
+        // fn(const StatePtr& state, const BackendPtr& twin) over every live, still-owned entry.
+        // Replaces the registry's begin()/end(), whose iterator exposed the raw frontend
+        // address as the map key - the one place the backend read an identity it must not have.
+        // The state object is handed over as a STRONG reference, so the callee cannot be handed
+        // a dangling key the way the old iteration could.
+        template <typename Fn>
+        void ForEachLive(Fn&& fn) const {
+            // Index loop and a COPIED twin, not a range-for over references: fn is arbitrary
+            // backend code, and a nested GetOrCreate on this table would resize m_slots and
+            // invalidate both the iterator and any reference into the vector that outlives the
+            // call. The one caller today happens not to insert; that is not a property the
+            // walk should depend on.
+            for (SizeT slot = 0; slot < m_slots.size(); ++slot) {
+                const Entry& entry = m_slots[slot];
+                if (!entry.Live || !entry.backend) continue;
+                const StatePtr state = entry.stateRef.lock();
+                if (!state) continue;
+                const BackendPtr twin = entry.backend;
+                fn(state, twin);
+            }
+        }
+
+        Uint32 LiveCount() const {
+            Uint32 count = 0;
+            for (const Entry& entry : m_slots) {
+                if (entry.Live) ++count;
+            }
+            return count;
+        }
+
+    private:
+        // Drop the twin at `handle` if THIS table holds it. Frees nothing: the slot belongs to
+        // the kind, not to the table, and OnFrontendObjectDestroyed returns it once, after
+        // every holder has let go.
+        Bool ReleaseTwinAt(MG_Pipe::MGPipeHandle handle) {
+            // Forget the memo whenever it names this slot, even if this table has no entry
+            // there: a memo can be a handle learned from the allocator for an object another
+            // holder twinned, and it must not survive the slot's next handout.
+            if (m_memoHandle.Slot == handle.Slot) ForgetHandle();
+            if (handle.Slot >= m_slots.size()) return false;
+            // The twin's destructor is a driver call and could, in principle, re-enter
+            // GetOrCreate on this table and resize m_slots. So NOTHING that outlives the
+            // destructor may be a reference into m_slots: the twin is moved out into a local,
+            // the entry is finished with, and only then is the local released.
+            BackendPtr dead;
+            {
+                Entry& entry = m_slots[handle.Slot];
+                if (!entry.Live || entry.Gen != handle.Gen) return false;
+                dead = std::move(entry.backend);
+                entry.backend.reset();
+                entry.stateRef.reset();
+                entry.Live = false;
+            }
+            dead.reset();
+            return true;
+        }
+
+        // Grows the table to hold `slot`. Every caller bounds `slot` first - the minting
+        // overload because the allocator produced it, the handle overload against
+        // kMaxHandleSlot - because this is the one place a client-supplied number decides an
+        // allocation size.
+        Entry& EntryAt(Uint32 slot) {
+            if (slot >= m_slots.size()) m_slots.resize(static_cast<SizeT>(slot) + 1);
+            return m_slots[slot];
+        }
+
+        void RememberHandle(Uint64 lifetimeId, MG_Pipe::MGPipeHandle handle) const {
+            m_memoLifetimeId = lifetimeId;
+            m_memoHandle = handle;
+        }
+        void ForgetHandle() const {
+            m_memoLifetimeId = 0;
+            m_memoHandle = MG_Pipe::kMGPipeNullHandle;
+        }
+
+        // The holder list: intrusive and doubly linked, so registering and unregistering are
+        // two pointer writes with no allocation, and its head is a constant-initialised
+        // static - which is what lets the process-lifetime registry globals in Managers.cpp
+        // link themselves in from their own constructors with no initialisation-order
+        // question to answer. Single-threaded, like every table it links (the tables live and
+        // die on the context thread, as the notice they answer does).
+        void LinkHolder() {
+            m_prevHolder = nullptr;
+            m_nextHolder = s_firstHolder;
+            if (s_firstHolder != nullptr) s_firstHolder->m_prevHolder = this;
+            s_firstHolder = this;
+        }
+        void UnlinkHolder() {
+            if (m_prevHolder != nullptr) {
+                m_prevHolder->m_nextHolder = m_nextHolder;
+            } else {
+                s_firstHolder = m_nextHolder;
+            }
+            if (m_nextHolder != nullptr) m_nextHolder->m_prevHolder = m_prevHolder;
+            m_prevHolder = nullptr;
+            m_nextHolder = nullptr;
+        }
+
+        static inline BackendSlotTable* s_firstHolder = nullptr;
+        BackendSlotTable* m_prevHolder = nullptr;
+        BackendSlotTable* m_nextHolder = nullptr;
+
+        // Indexed by MGPipeHandle::Slot; [0] is the reserved slot and is never live.
+        Vector<Entry> m_slots;
+        // Handed back by GetOrCreate for a null state object. Never live, never handed a handle.
+        BackendPtr m_nullTwin;
+
+        // ONE-entry resolution memo, lifetimeId -> handle. It exists because without it every
+        // resolution goes through the allocator's ByLifetimeId hash, which the deleted
+        // TwinLookupMemos existed to avoid and which D13 promises to replace with "direct slot
+        // indexing".
+        //
+        // It is one entry and therefore only helps a caller that asks for the SAME object twice
+        // running - ResolveVaoTwin and SyncCurrentProgram do, once per draw each. Two callers
+        // it does NOT help, recorded rather than claimed away: BindCurrentFBO resolves BOTH
+        // targets in a frame, and ResolveUnitSamplerBackend asks for a different sampler per
+        // texture unit, so both thrash a single-entry memo and pay the probe P1 did not (P1 had
+        // a per-unit memo and a direct-mapped 6-slot array there). Making the memo per-unit /
+        // per-target is the fix, and G11 - the device-side gate that would price it - is owed.
+        //
+        // It cannot serve a stale answer, by three independent arguments:
+        //   * the key is a lifetime id, which MG_State never hands out twice, so a recycled
+        //     heap address cannot hit this memo the way it could hit an address-keyed one;
+        //   * a null answer is never stored, so another holder's acquire cannot be hidden by
+        //     a "no handle" this table remembered earlier; and
+        //   * even a hit for a slot that has since been freed and re-handed is caught, because
+        //     the caller resolves the handle through FindByHandle, which compares Gen.
+        // Cleared anyway when a death notice names the memoised slot. 0 is never a live
+        // lifetime id (MG_State's counters start at 1), so a zeroed memo is a guaranteed miss.
+        mutable Uint64 m_memoLifetimeId = 0;
+        mutable MG_Pipe::MGPipeHandle m_memoHandle = MG_Pipe::kMGPipeNullHandle;
+    };
+
+#endif // MOBILEGL_PIPE_PUSH
+} // namespace MobileGL::MG_Backend::DirectGLES

MobileGL/MG_Backend/DirectGLES/Utils.cpp

@@ -11,10 +11,13 @@
 #include "Managers.h"
 #include "MG_Backend/BackendObjects.h"
 #include "MG_Util/Converters/GLToMG/FramebufferEnumConverter.h"
+#include "MG_Util/SelfTest/DriverBugProbes.h"
 #include "MG_Util/Texture/TextureFormatProcessor.h"
 #include "MG_Util/ShaderTranspiler/ShaderCompiler.h"
+#include <Config.h>
 
 #include <MG_State/GLState/Core.h>
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include <MG_Util/BackendLoaders/OpenGL/Loader.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
@@ -26,6 +29,7 @@
 #include <cmath>
 #include <cctype>
 #include <cstring>
+#include <format>
 #include <regex>
 
 namespace MobileGL::MG_Backend::DirectGLES {
@@ -124,6 +128,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     requestedInternalFormat,
                     TextureImpl::GetRenderTargetNormalizeOptions(g_GLESCapabilities, targetIndex));
             }
+            // Outside the caveat branch on purpose: the driver CAN create the native narrow
+            // storage - the capability probes say so - it just cannot be trusted as a raw-copy
+            // endpoint. Texture and renderbuffer targets both come through here, which is what
+            // keeps a renderbuffer -> texture copy of these formats same-ES-format when the
+            // widening engages.
+            if (TextureImpl::UsesWidenedPacked16NormStorage(internalFormat)) {
+                options |= PixelFormatNormalizeOptionBit::WidenPacked16Norm;
+            }
             NormalizePixelFormat(requestedInternalFormat, options, outInternalFormat, outFormat, outType);
         }
     } // namespace
@@ -181,6 +193,36 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return options;
         }
 
+        Bool UsesWidenedPacked16NormStorage(TextureInternalFormat internalFormat) {
+            switch (internalFormat) {
+            // TextureInternalFormat::RGB5 is both GL_RGB5 and GL_RGB565 - the GL-to-MG
+            // converter folds the two spellings onto one logical format.
+            case TextureInternalFormat::RGB5:
+            case TextureInternalFormat::RGB5A1:
+            case TextureInternalFormat::RGBA4:
+                break;
+            default:
+                return false;
+            }
+            switch (MG_Config::Features.EsprytWidenPacked16Storage) {
+            case MG_Config::QuirkOverride::ForceOn:
+                return true;
+            case MG_Config::QuirkOverride::ForceOff:
+                return false;
+            case MG_Config::QuirkOverride::Auto:
+                break;
+            }
+            // Behind the backend gate on purpose: the memoized probe latches its first answer
+            // for the whole process, and before the backend is up the GL function table may
+            // not be resolved yet - a probe run then would latch "cannot tell" as "clean"
+            // forever. Once the backend exists, the first narrow-format image this process
+            // creates runs the probe on a live context.
+            if (pActiveBackendObject == nullptr) {
+                return false;
+            }
+            return MG_Util::SelfTest::CopyImageMirrorsPacked16FieldOrder(g_GLESFuncs);
+        }
+
         void GenerateTextureFormatInfo(TextureInternalFormat internalFormat, GLenum* outInternalFormat,
                                        GLenum* outFormat, GLenum* outType, TextureTarget target) {
 #ifdef TRACY_ENABLE
@@ -712,6 +754,47 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return glslCode;
         }
 
+        const char* PointSizeExtensionName(MG_External::GLESCapabilities::PointSizeTier tier, Bool tessellation) {
+            using Tier = MG_External::GLESCapabilities::PointSizeTier;
+            switch (tier) {
+                case Tier::ExtensionEXT:
+                    return tessellation ? "GL_EXT_tessellation_point_size" : "GL_EXT_geometry_point_size";
+                case Tier::ExtensionOES:
+                    return tessellation ? "GL_OES_tessellation_point_size" : "GL_OES_geometry_point_size";
+                default:
+                    return nullptr;
+            }
+        }
+
+        String RequestPointSizeExtension(String glslCode, const char* extensionName) {
+#ifdef TRACY_ENABLE
+            ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
+#endif
+            // The gl_ViewportIndex story, one built-in over: ESSL 320 makes the tessellation and
+            // geometry STAGES core but leaves gl_PointSize out of their gl_PerVertex entirely,
+            // and SPIRV-Cross - which only ever sees a SPIR-V BuiltIn PointSize decoration -
+            // prints the identifier with no directive behind it. Same hard rule as the two
+            // neighbours: never emitted speculatively, because `#extension` on a name the driver
+            // does not advertise is a compile error of its own.
+            if (extensionName == nullptr || glslCode.find(extensionName) != String::npos) {
+                return glslCode;
+            }
+            const String directive = String("#extension ") + extensionName + " : require\n";
+            // Right after the #version line, the one position that must stay first;
+            // ForceSupporterOutput's scan for the LAST #extension directive still finds
+            // whichever one that ends up being.
+            const SizeT versionPos = glslCode.find("#version");
+            if (versionPos == String::npos) {
+                return directive + glslCode;
+            }
+            const SizeT lineEnd = glslCode.find('\n', versionPos);
+            if (lineEnd == String::npos) {
+                return glslCode + "\n" + directive;
+            }
+            glslCode.insert(lineEnd + 1, directive);
+            return glslCode;
+        }
+
         String BakeImageFormatQualifiers(String glslCode,
                                          const UnorderedMap<String, String>& esslFormatByUniformName) {
 #ifdef TRACY_ENABLE
@@ -836,7 +919,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         String BuildPassthroughTessControlEssl(const Uint esslVersion, const Uint patchVertices,
                                                const String& inPerVertexMembers,
-                                               const String& outPerVertexMembers) {
+                                               const String& outPerVertexMembers,
+                                               const FloatVec4& defaultOuterLevel,
+                                               const FloatVec2& defaultInnerLevel) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
@@ -866,12 +951,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // was declined before this was ever called (ModuleReadsLocatedInput), and gl_PointSize
             // from a tessellation stage is a separate capability on both targets.
             source += "    gl_out[gl_InvocationID].gl_Position = gl_in[gl_InvocationID].gl_Position;\n";
-            source += "    gl_TessLevelOuter[0] = 1.0;\n";
+            for (Uint i = 0; i < 4; ++i) {
-            source += "    gl_TessLevelOuter[1] = 1.0;\n";
+                source += "    gl_TessLevelOuter[" + std::to_string(i) +
-            source += "    gl_TessLevelOuter[2] = 1.0;\n";
+                          "] = " + MG_Util::ShaderTranspiler::TessellationLevelLiteral(defaultOuterLevel[i]) + ";\n";
-            source += "    gl_TessLevelOuter[3] = 1.0;\n";
+            }
-            source += "    gl_TessLevelInner[0] = 1.0;\n";
+            for (Uint i = 0; i < 2; ++i) {
-            source += "    gl_TessLevelInner[1] = 1.0;\n";
+                source += "    gl_TessLevelInner[" + std::to_string(i) +
+                          "] = " + MG_Util::ShaderTranspiler::TessellationLevelLiteral(defaultInnerLevel[i]) + ";\n";
+            }
             source += "}\n";
             return source;
         }
@@ -2208,11 +2295,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
         static Bool StoreClientRows(SizeT dstPixelBytes, SizeT swapGroupSize, GLsizei width, GLsizei sliceHeight,
                                     GLsizei sliceCount, void* pixels, Bool applyPackImageParams, FillRow&& fillRow) {
             const auto& pixelPackBufferObject =
-                MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
+                MGB_CTX->GetBufferBindingSlot(BufferTarget::PixelPack).GetBoundObject();
 
             // Destination layout is computed from the client-side PACK parameters; only the actual pixel
             // rows are written so skip regions of the destination stay untouched.
-            const auto packParams = MG_State::pGLContext->GetPixelStoreParameters(false);
+            const auto packParams = MGB_CTX->GetPixelStoreParameters(false);
             const SizeT rowPixels = static_cast<SizeT>(packParams.RowLength > 0 ? packParams.RowLength : width);
             const SizeT dstRowStride = AlignReadbackRow(rowPixels * dstPixelBytes, packParams.Alignment);
             const SizeT imageRows =

MobileGL/MG_Backend/DirectGLES/Utils.h

@@ -46,6 +46,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
         Flags<PixelFormatNormalizeOptionBit> GetRenderTargetNormalizeOptions(
             const MG_External::GLESCapabilities& capabilities, SizeT targetIndex);
 
+        // Whether this format's ES storage is widened to 8-bit-per-channel because the
+        // driver stores some packed16 allocations with a mirrored field order
+        // (PixelFormatNormalizeOptionBit::WidenPacked16Norm). True only for
+        // GL_RGB565/GL_RGB5(_A1)/GL_RGBA4, and only where the POST probe measured the
+        // divergence (or MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE forces it). The transfer paths
+        // consult it too: the packed-norm re-upload leg must stand down when the ES storage
+        // is no longer 16-bit packed.
+        Bool UsesWidenedPacked16NormStorage(TextureInternalFormat internalFormat);
+
         void GenerateTextureFormatInfo(TextureInternalFormat internalFormat, GLenum* outInternalFormat,
                                        GLenum* outFormat, GLenum* outType,
                                        TextureTarget target = TextureTarget::Unknown);
@@ -273,6 +282,22 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // error, so this is never emitted speculatively. A no-op when not needed or already
         // present.
         String RequestViewportArrayExtension(String glslCode, Bool needed);
+        // Adds `#extension <extensionName> : require` when a TESSELLATION or GEOMETRY stage's
+        // emitted ESSL names gl_PointSize. Desktop GL has that built-in in gl_PerVertex for every
+        // vertex-processing stage; ESSL does NOT have it in those two at any version - not even
+        // 320, where the stages themselves are core - until EXT/OES_tessellation_point_size resp.
+        // EXT/OES_geometry_point_size is requested. SPIRV-Cross prints the identifier bare and
+        // asks for nothing, exactly as it does for gl_ViewportIndex, so without this the stage
+        // fails to compile with "`gl_PointSize' undeclared" and the WHOLE program is replaced by
+        // program 0 - the draw renders nothing and any transform-feedback capture it was carrying
+        // is rejected outright. `extensionName` is the caller's answer, nullptr when the driver
+        // advertises neither spelling, because requesting an unadvertised extension is itself a
+        // compile error. A no-op when nullptr or already present.
+        String RequestPointSizeExtension(String glslCode, const char* extensionName);
+        // The extension name RequestPointSizeExtension should be given for `tier`, or nullptr for
+        // PointSizeTier::None. `tessellation` picks the tessellation spellings over the geometry
+        // ones; the two extensions are separate and neither implies the other.
+        const char* PointSizeExtensionName(MG_External::GLESCapabilities::PointSizeTier tier, Bool tessellation);
         // Writes a format layout qualifier into the image declarations named in
         // `esslFormatByUniformName` that still have none. The completion half of the image-format
         // bake, and ONLY that: the SPIR-V pass (BakeImageFormatsPass) is what normally puts the
@@ -368,11 +393,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
         //
         // All four outer levels and both inner levels are written unconditionally: writing a
         // level the evaluation stage's domain does not use is legal and ignored, and it saves
-        // this from having to know the domain. They are literal 1.0 because that is the GL
+        // this from having to know the domain. They are the GL_PATCH_DEFAULT_OUTER_LEVEL /
-        // default and glPatchParameterfv - their only setter - is a stub in this frontend
+        // GL_PATCH_DEFAULT_INNER_LEVEL state, baked in as literals - ES has no such state and no
-        // (MG_Impl/GLImpl/Exporting/Definitions.cpp). Implementing that entry point means making
+        // glPatchParameterfv to forward to, so compiling them in is the only way to honour them.
-        // the levels a parameter here AND part of what makes a built program stale, exactly as
+        // That makes them part of what a built program is stale against, exactly as PATCH_VERTICES
-        // PATCH_VERTICES already is; the two must move together, so they are named together.
+        // is: see the staleness clause in DirectGLES.cpp's SyncCurrentProgram, which compares both.
         //
         // The same stage, for the same reason, that DirectVulkan synthesizes in
         // ProgramFactory::BuildPassthroughTessControlSource - Vulkan likewise requires both
@@ -382,7 +407,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // VkShaderModule against a driver shader object.
         String BuildPassthroughTessControlEssl(Uint esslVersion, Uint patchVertices,
                                                const String& inPerVertexMembers,
-                                               const String& outPerVertexMembers);
+                                               const String& outPerVertexMembers,
+                                               const FloatVec4& defaultOuterLevel,
+                                               const FloatVec2& defaultInnerLevel);
         // Prefix of the writeonly half a read+write image uniform is split into (see
         // SplitReadWriteImageUniforms); the suffix is the image's own (already access-tagged) name.
         constexpr const char* IMAGE_WRITE_ALIAS_PREFIX = "mg_imageWrite_";
@@ -505,7 +532,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // avoidExplicitLodBias leaves lookups that already carry an explicit LOD untouched,
         // so their constant level stays constant; only the implicit-LOD forms take the bias.
         // Off by default and only ever set on ANGLE + llvmpipe, where injecting the uniform
-        // into a constant LOD crashes the driver (MOBILEGL_AVOID_EXPLICIT_LOD_BIAS).
+        // into a constant LOD crashes the driver (MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS).
         String EmulateTextureLodBias(const String& glslCode, Bool avoidExplicitLodBias = false);
     } // namespace PrgramImpl
 

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

@@ -12,6 +12,7 @@
 #include "SubgroupSupportPolicy.h"
 #include "MG_State/GLState/FramebufferState/FramebufferObject.h"
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_State/GLState/TextureState/TextureState.h"
 #include "MG_Util/Classifiers/TextureEnumClassifier.h"
 #include "MG_Util/Converters/MGToGL/TextureEnumConverter.h"
@@ -385,8 +386,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
         UpdateDynamicBackendParameters();
         UpdateAdvertisedExtensions();
-        if (MG_State::pGLContext) {
+        if (MGB_CTX_LIVE) {
-            MG_State::pGLContext->InvalidateCompileEnv();
+            MGB_CTX->InvalidateCompileEnv();
         }
         PopulateFormatCapabilities(physicalDevice.handle, vkGetPhysicalDeviceFormatProperties, m_vulkanCaps,
                                    MutableFormatCapabilities());
@@ -500,11 +501,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             .RendererName = "Magma",
             .BackendName = "Direct (Vulkan)",
             .ExtraVendor = Nullopt,
-            .RendererGLInfo = {.TargetGLVersion = {4, 0, 0},
+            .RendererGLInfo = {.TargetGLVersion = {4, 6, 0},
                                .TargetGLSLVersion = {4, 6, 0},
                                // Baseline advertisement (no runtime-gated capabilities); a live
                                // backend reconciles its copy in UpdateAdvertisedExtensions.
-                               .Extensions = BuildAdvertisedExtensions(false, false, false, false),
+                               .Extensions = BuildAdvertisedExtensions(false, false, false, false, false),
                                .IsCompatibilityProfile = false},
             .StaticBackendCapability = {.AllowVSOnlyPrograms = false}};
         return rendererInfo;
@@ -512,9 +513,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     Vector<GLExtension> BuildAdvertisedExtensions(Bool shaderSubgroupSupported, Bool timerQueriesSupported,
                                                   Bool anisotropicFilteringSupported,
-                                                  Bool nonZeroIndirectBaseInstanceSupported) {
+                                                  Bool nonZeroIndirectBaseInstanceSupported,
+                                                  Bool cubeMapArraySupported) {
         Vector<GLExtension> extensions = {
-            V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, E_GL_ARB_draw_buffers_blend,
+            // The version tokens have to reach the version the backend actually claims:
+            // TargetGLVersion is {4,6,0}, and a list that stopped at OpenGL40 told an
+            // application feature-detecting off these tokens the opposite of what
+            // GL_MAJOR_VERSION / GL_MINOR_VERSION told it.
+            V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, V_OpenGL41, V_OpenGL42, V_OpenGL43,
+            V_OpenGL44, V_OpenGL45, V_OpenGL46,
+            E_GL_ARB_draw_buffers_blend,
             E_GL_ARB_compute_shader, E_GL_ARB_shader_storage_buffer_object, E_GL_ARB_shader_image_load_store,
             E_GL_ARB_clear_buffer_object, E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_ARB_draw_indirect,
             E_GL_ARB_multi_draw_indirect,
@@ -533,6 +541,79 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // Sampling the stencil aspect through DEPTH_STENCIL_TEXTURE_MODE. Core from 4.3,
             // so on a 4.0 context the string is the only way to reach it.
             E_GL_ARB_stencil_texturing,
+            // Unconditional, unlike DirectGLES: a GL texture view is a second set of VkImageViews
+            // over the same VkImage with a sub-range and possibly a reinterpreted VkFormat, which
+            // is core Vulkan on every device MobileGL runs on. Format-reinterpreting views need
+            // VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT on the image, which SyncTextureResource sets for
+            // every immutable-storage texture (see the comment there).
+            E_GL_ARB_texture_view,
+            // Core since 3.2 and implemented here on both backends - glDrawElementsBaseVertex,
+            // glDrawRangeElementsBaseVertex, glDrawElementsInstancedBaseVertex and
+            // glMultiDrawElementsBaseVertex all reach real per-draw vertex rebasing. The string
+            // was simply never emitted, which left KHR-GL4*.draw_elements_base_vertex_tests
+            // NotSupported on a feature that works.
+            E_GL_ARB_draw_elements_base_vertex,
+            // The whole sync-object family is real and core since 3.2: glFenceSync, glIsSync,
+            // glDeleteSync, glClientWaitSync, glWaitSync and glGetSynciv all live in GLImpl over a
+            // backend fence (a VkFence here, an EGLSync/GLsync on DirectGLES), and glGetInteger64v
+            // answers GL_MAX_SERVER_WAIT_TIMEOUT. The string matters for the same reason
+            // ARB_uniform_buffer_object's does: LWJGL builds GLCapabilities from the extension
+            // list, and a caller that finds GL_ARB_sync missing never resolves the entry points -
+            // then calls through null if it uses fences anyway. Nothing in the CTS gates on this
+            // string, so it is advertised on the strength of the implementation, not a test unlock.
+            E_GL_ARB_sync,
+            // Atomic counters, core since 4.2. glGetActiveAtomicCounterBufferiv and the whole
+            // GL_ATOMIC_COUNTER_BUFFER_* query family are real in GLImpl, and the counter buffer
+            // now reaches the shader on BOTH backends - Magma resolves the lowered
+            // gl_AtomicCounterBlock_<N> from the atomic-counter binding points rather than the
+            // shader-storage ones (see ResolveStorageBufferDescriptor). Withheld here until that
+            // landed, because the counter silently read whatever was bound as SSBO N instead.
+            E_GL_ARB_shader_atomic_counters,
+            // glVertexAttribDivisor, core since 3.3 and real on both backends. Applications
+            // (Better Clouds' GLCompat among them) accept the extension string as an
+            // ALTERNATIVE to a 3.3 context when deciding whether instanced rendering is
+            // available, so withholding it makes MobileGL look less capable than it is.
+            E_GL_ARB_instanced_arrays,
+            // Core GL 3.0-4.3 plumbing that has been real here for as long as the backend has
+            // existed, and that was simply never named. None of these unlocks a single CTS case -
+            // the conformance suite reaches all of them through the version - so they are
+            // advertised for the OTHER consumer of this list: LWJGL builds GLCapabilities from the
+            // string set, and an application that gates its ENTRY POINTS on the string rather than
+            // on the version never resolves them and then calls through null. Each is backed by
+            // the entry points named beside it. Kept identical to the DirectGLES block so the two
+            // backends do not disagree about what MobileGL is.
+            //
+            // glBindVertexArray / glGenVertexArrays / glDeleteVertexArrays / glIsVertexArray.
+            E_GL_ARB_vertex_array_object,
+            // The 14 glSamplerParameter* / glGetSamplerParameter* entry points, including the
+            // integer-valued Iiv/Iuiv forms.
+            E_GL_ARB_sampler_objects,
+            // glMapBufferRange + glFlushMappedBufferRange, which ARB_buffer_storage's persistent
+            // maps are already built on top of.
+            E_GL_ARB_map_buffer_range,
+            // glCopyBufferSubData plus the GL_COPY_READ_BUFFER / GL_COPY_WRITE_BUFFER targets.
+            E_GL_ARB_copy_buffer,
+            // glCopyImageSubData, wired to a real backend hook on both backends.
+            E_GL_ARB_copy_image,
+            // GL_TEXTURE_SWIZZLE_{R,G,B,A,RGBA}, which map onto a VkImageView's component swizzle.
+            E_GL_ARB_texture_swizzle,
+            // GL_INT_2_10_10_10_REV / GL_UNSIGNED_INT_2_10_10_10_REV on glVertexAttribPointer plus
+            // the eight glVertexAttribP* entry points.
+            E_GL_ARB_vertex_type_2_10_10_10_rev,
+            // The R/RG internal formats. Named separately from the float ones because an
+            // application may check either.
+            E_GL_ARB_texture_rg,
+            // GL_DEPTH_COMPONENT32F and GL_DEPTH32F_STENCIL8.
+            E_GL_ARB_depth_buffer_float,
+            // The floating-point colour formats. Unlike the rest of this block this string DOES
+            // gate CTS cases - KHR-GL4*.internalformat.texture2d.*{16f,32f} is keyed on it with no
+            // core-version fallback, so eight cases per version list were NotSupported on formats
+            // the backend has always had.
+            E_GL_ARB_texture_float,
+            // glViewportArrayv / glViewportIndexedf{,v} / glScissorArrayv / glScissorIndexed{,v} /
+            // glDepthRangeArrayv / glDepthRangeIndexed / glGetFloati_v / glGetDoublei_v, over the
+            // 16 viewports GL_MAX_VIEWPORTS reports.
+            E_GL_ARB_viewport_array,
             // Advertised with GL_NUM_PROGRAM_BINARY_FORMATS = 0, which the
             // extension explicitly permits. It is also the only thing that
             // exposes glProgramParameteri before GL 4.1.
@@ -544,7 +625,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (nonZeroIndirectBaseInstanceSupported) {
             extensions.push_back(E_GL_ARB_base_instance);
         }
-        if (shaderSubgroupSupported && !MG_Config::Features.DisableSubgroup) {
+        if (shaderSubgroupSupported && !MG_Config::Features.MagmaDisableSubgroup) {
             extensions.push_back(E_GL_KHR_shader_subgroup);
         }
         // GL_KHR_parallel_shader_compile is MobileGL's own capability, not the Vulkan
@@ -585,6 +666,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             extensions.push_back(E_GL_EXT_texture_filter_anisotropic);
             extensions.push_back(E_GL_ARB_texture_filter_anisotropic);
         }
+        // A cube map array is a 6n-layer VkImage viewed as VK_IMAGE_VIEW_TYPE_CUBE_ARRAY, and that
+        // view type cannot be created without the imageCubeArray device feature - so the string
+        // follows the feature, not the version, exactly as the per-layer attachment bit does.
+        //
+        // Named for the application's benefit rather than the suite's: measured on Adreno 830,
+        // KHR-GL43.texture_gather.plain-gather-*-cube-array already passed without the string, so
+        // this unlocks no conformance case. It is advertised because the feature is real and
+        // because an application that feature-detects cube map arrays off the string (rather than
+        // off the 4.0 version) would otherwise decline a path this backend serves.
+        if (cubeMapArraySupported) {
+            extensions.push_back(E_GL_ARB_texture_cube_map_array);
+        }
         return extensions;
     }
 
@@ -648,8 +741,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             funcsTable.GL.MemoryBarrierByRegion = MemoryBarrierByRegion;
             funcsTable.GL.BindImageTexture = BindImageTexture;
             funcsTable.GL.GetIntegeri_v = GetIntegeri_v;
-            funcsTable.GL.GetInteger64i_v = GetInteger64i_v;
-            funcsTable.GL.GetProgramiv = GetProgramiv;
             funcsTable.GL.ShaderStorageBlockBinding = ShaderStorageBlockBinding;
             funcsTable.GL.FenceSync = FenceSync;
             funcsTable.GL.ClientWaitSync = ClientWaitSync;
@@ -693,8 +784,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_vulkanCaps = capabilities;
         UpdateDynamicBackendParameters();
         UpdateAdvertisedExtensions();
-        if (MG_State::pGLContext) {
+        if (MGB_CTX_LIVE) {
-            MG_State::pGLContext->InvalidateCompileEnv();
+            MGB_CTX->InvalidateCompileEnv();
         }
         MutableFormatCapabilities().Clear();
     }
@@ -715,7 +806,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_rendererInfo.RendererGLInfo.Extensions = BuildAdvertisedExtensions(
             subgroupSupportAdvertised, pVulkanRenderer && pVulkanRenderer->IsTimerQuerySupported(),
             pVulkanRenderer && pVulkanRenderer->IsSamplerAnisotropySupported(),
-            pVulkanRenderer && pVulkanRenderer->IsNonZeroIndirectBaseInstanceSupported());
+            pVulkanRenderer && pVulkanRenderer->IsNonZeroIndirectBaseInstanceSupported(),
+            m_vulkanCaps.SupportsImageCubeArray);
     }
 
     void BackendObject_DirectVulkan::UpdateDynamicBackendParameters() {
@@ -763,6 +855,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         static constexpr SizeT kMaxAdvertisedShaderStorageBlockSize = 512ull * 1024ull * 1024ull;
         m_dynamicParameters.UniformBufferOffsetAlignment = m_vulkanCaps.UniformBufferOffsetAlignment;
+        m_dynamicParameters.ShaderStorageBufferOffsetAlignment = m_vulkanCaps.ShaderStorageBufferOffsetAlignment;
         m_dynamicParameters.AliasedLineWidthRangeMin = m_vulkanCaps.AliasedLineWidthRangeMin;
         m_dynamicParameters.AliasedLineWidthRangeMax = m_vulkanCaps.AliasedLineWidthRangeMax;
         // Without the samplerAnisotropy feature the limit is unusable, so report 1.0 (no anisotropy)
@@ -845,6 +938,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             clampLimit("GL_MAX_COMPUTE_UNIFORM_BLOCKS", m_vulkanCaps.MaxComputeUniformBlocks,
                        kMaxAdvertisedBufferBlocks);
         m_dynamicParameters.MaxComputeWorkGroupInvocations = m_vulkanCaps.MaxComputeWorkGroupInvocations;
+        // The six per-axis compute limits, from the same VkPhysicalDeviceLimits fields
+        // GLFunctionsTable::GetIntegeri_v (DirectVulkan.cpp) reads live. Carried here so that
+        // MGPCaps has them once the table entry retires (plan B section 4.4.1); GL_Getter floors
+        // them. Not clamped: unlike the block counts these are not amounts an application
+        // allocates, and the frontend already raises them to the GL minimum.
+        for (SizeT axis = 0; axis < 3; ++axis) {
+            m_dynamicParameters.MaxComputeWorkGroupCount[axis] = m_vulkanCaps.MaxComputeWorkGroupCount[axis];
+            m_dynamicParameters.MaxComputeWorkGroupSize[axis] = m_vulkanCaps.MaxComputeWorkGroupSize[axis];
+        }
         m_dynamicParameters.MaxShaderStorageBufferBindings =
             clampLimit("GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS", m_vulkanCaps.MaxShaderStorageBufferBindings,
                        kMaxAdvertisedBufferBlocks);
@@ -912,6 +1014,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // it the limit describes a capacity no shader may use, so report none.
         m_dynamicParameters.MaxClipDistances =
             m_vulkanCaps.SupportsShaderClipDistance ? std::max(m_vulkanCaps.MaxClipDistances, 0) : 0;
+        // The cull pair, gated on its own feature. shaderCullDistance is separate from
+        // shaderClipDistance and VulkanRenderer enables it independently, so it gets its own
+        // gate rather than riding on the clip one.
+        m_dynamicParameters.MaxCullDistances =
+            m_vulkanCaps.SupportsShaderCullDistance ? std::max(m_vulkanCaps.MaxCullDistances, 0) : 0;
+        // GL 4.6 core 11.1.3.10: the combined limit is at least as large as either half. A device
+        // with only one of the two features must not report a combined capacity that implies the
+        // other, so the gate is "either feature" and the value never drops below what is enabled.
+        m_dynamicParameters.MaxCombinedClipAndCullDistances =
+            (m_vulkanCaps.SupportsShaderClipDistance || m_vulkanCaps.SupportsShaderCullDistance)
+                ? std::max({m_vulkanCaps.MaxCombinedClipAndCullDistances, m_dynamicParameters.MaxClipDistances,
+                            m_dynamicParameters.MaxCullDistances})
+                : 0;
         m_dynamicParameters.MaxViewports = m_vulkanCaps.MaxViewports;
         // Assigned explicitly rather than left to the struct's defaults, like every other
         // parameter here, so a second fill cannot inherit a stale value. GL_UNDEFINED_VERTEX is
@@ -974,6 +1089,31 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // report VK_FALSE, so on every real mobile device this is false and the demotion runs
         // exactly as it always has.
         m_dynamicParameters.SupportsShaderFloat64 = m_vulkanCaps.SupportsShaderFloat64;
+        // shaderTessellationAndGeometryPointSize, both stage families from the one feature.
+        // False arms the shared phase-B point-size demotion, whose modules then carry no
+        // TessellationPointSize/GeometryPointSize capability and build without the feature.
+        // MOBILEGL_POINT_SIZE_DEMOTION=1 pretends it is absent so the demotion can be
+        // exercised on a healthy driver (lavapipe advertises the feature); =0 restores the
+        // detected answer's declines.
+        {
+            Bool supportsStagePointSize = m_vulkanCaps.SupportsTessellationAndGeometryPointSize;
+            switch (MG_Config::Features.PointSizeDemotion) {
+            case MG_Config::QuirkOverride::ForceOn:
+                MGLOG_I("DirectVulkan: MOBILEGL_POINT_SIZE_DEMOTION=1 - treating tessellation/geometry "
+                        "gl_PointSize as unhosted so the demotion runs on this driver");
+                supportsStagePointSize = false;
+                break;
+            case MG_Config::QuirkOverride::ForceOff:
+                MGLOG_I("DirectVulkan: MOBILEGL_POINT_SIZE_DEMOTION=0 - keeping the built-in and the "
+                        "plain declines regardless of the device feature");
+                supportsStagePointSize = true;
+                break;
+            case MG_Config::QuirkOverride::Auto:
+                break;
+            }
+            m_dynamicParameters.SupportsTessellationPointSize = supportsStagePointSize;
+            m_dynamicParameters.SupportsGeometryPointSize = supportsStagePointSize;
+        }
         // Never, on any device, and DELIBERATELY NOT COUPLED to the line above even though it
         // once tracked the same feature. It used to, because a `dvec` input needed Float64 to
         // exist in the module at all; a 64-bit vertex FETCH was already impossible

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.h

@@ -70,12 +70,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     const RendererInfo& GetRendererIdentity();
 
     // The full OpenGL extension list Magma advertises (glGetString(GL_EXTENSIONS)) for
-    // a device with the given raw capabilities. The MOBILEGL_DISABLE_SUBGROUP and
+    // a device with the given raw capabilities. The MOBILEGL_MAGMA_DISABLE_SUBGROUP and
     // MOBILEGL_DISABLE_TIMERQUERY escape hatches are applied inside, so callers pass
     // the detected device support (passing an already-gated value is harmless).
     Vector<GLExtension> BuildAdvertisedExtensions(Bool shaderSubgroupSupported, Bool timerQueriesSupported,
                                                   Bool anisotropicFilteringSupported,
-                                                  Bool nonZeroIndirectBaseInstanceSupported);
+                                                  Bool nonZeroIndirectBaseInstanceSupported,
+                                                  Bool cubeMapArraySupported);
 
     // Format: <GPU Name>, Vulkan <Vulkan Version>, Driver <Driver Version> — the exact
     // string an initialized backend returns from GetBackendAPIVersionString (and that

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.cpp

@@ -10,9 +10,11 @@
 #include "DirectVulkanResourceState.h"
 #include "MG_Backend/BackendObjects.h"
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_State/GLState/ErrorState/ErrorInfo.h"
 #include "MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h"
 #include "MG_Util/Converters/GLToMG/TextureEnumConverter.h"
+#include "MG_Util/Metrics/PipeStats.h"
 #include "MG_Util/Metrics/TextureMetrics.h"
 #include "MG_Util/Miscellany/IndexGenerator.h"
 #include <atomic>
@@ -77,7 +79,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint32 blockBindingVersion = 0;
             Vector<StorageBlockResource> storageBlocks;
             Vector<BufferVariableResource> bufferVariables;
-            GLint computeWorkGroupSize[3] = {1, 1, 1};
         };
 
         struct DrawElementsIndirectCommand {
@@ -208,16 +209,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
 
             for (auto& module : modules) {
-                for (Uint32 entryIndex = 0; entryIndex < module.entry_point_count; ++entryIndex) {
-                    const auto& entryPoint = module.entry_points[entryIndex];
-                    if ((entryPoint.shader_stage & SPV_REFLECT_SHADER_STAGE_COMPUTE_BIT) == 0) {
-                        continue;
-                    }
-                    cache.computeWorkGroupSize[0] = static_cast<GLint>(std::max<Uint32>(entryPoint.local_size.x, 1));
-                    cache.computeWorkGroupSize[1] = static_cast<GLint>(std::max<Uint32>(entryPoint.local_size.y, 1));
-                    cache.computeWorkGroupSize[2] = static_cast<GLint>(std::max<Uint32>(entryPoint.local_size.z, 1));
-                }
-
                 uint32_t bindingCount = 0;
                 SpvReflectResult result = spvReflectEnumerateDescriptorBindings(&module, &bindingCount, nullptr);
                 if (result != SPV_REFLECT_RESULT_SUCCESS || bindingCount == 0) {
@@ -277,15 +268,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         MG_State::GLState::ProgramObject* TryGetDirectVulkanProgram(GLuint program) {
-            if (!MG_State::pGLContext->ValidateProgramName(program)) {
+            if (!MGB_CTX->ValidateProgramName(program)) {
                 return nullptr;
             }
-            auto& programObject = MG_State::pGLContext->GetProgramObject(program);
+            auto& programObject = MGB_CTX->GetProgramObject(program);
             return programObject.get();
         }
 
         const Uint8* ResolveIndirectCommandBytes(const void* indirect, SizeT requiredBytes, const char* label) {
-            auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+            auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
             if (drawBuffer) {
                 drawBuffer->SyncPersistentMappedRange();
                 const SizeT commandOffset = reinterpret_cast<SizeT>(indirect);
@@ -344,64 +335,64 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void ClearBufferfi(GLenum buffer, GLint drawbuffer, GLfloat depth, GLint stencil) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferfi called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferfi called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferfi called with null GL context");
         pVulkanRenderer->ClearBufferfi(buffer, drawbuffer, depth, stencil);
     }
 
     void ClearBufferfv(GLenum buffer, GLint drawbuffer, const GLfloat* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferfv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferfv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferfv called with null GL context");
         pVulkanRenderer->ClearBufferfv(buffer, drawbuffer, value);
     }
 
     void ClearBufferuiv(GLenum buffer, GLint drawbuffer, const GLuint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferuiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferuiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferuiv called with null GL context");
         pVulkanRenderer->ClearBufferuiv(buffer, drawbuffer, value);
     }
 
     void ClearBufferiv(GLenum buffer, GLint drawbuffer, const GLint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearBufferiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearBufferiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearBufferiv called with null GL context");
         pVulkanRenderer->ClearBufferiv(buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferfv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                  GLint drawbuffer, const GLfloat* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferfv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferfv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferfv called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferfv(framebuffer, buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferiv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                  GLint drawbuffer, const GLint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferiv called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferiv(framebuffer, buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferuiv(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                   GLint drawbuffer, const GLuint* value) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferuiv called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferuiv called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferuiv called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferuiv(framebuffer, buffer, drawbuffer, value);
     }
 
     void ClearNamedFramebufferfi(const SharedPtr<MG_State::GLState::FramebufferObject>& framebuffer, GLenum buffer,
                                  GLint drawbuffer, GLfloat depth, GLint stencil) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ClearNamedFramebufferfi called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ClearNamedFramebufferfi called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ClearNamedFramebufferfi called with null GL context");
         pVulkanRenderer->ClearNamedFramebufferfi(framebuffer, buffer, drawbuffer, depth, stencil);
     }
 
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElementsIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElementsIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElementsIndirect called with null GL context");
         pVulkanRenderer->MultiDrawElementsIndirect(mode, type, indirect, drawcount, stride);
     }
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawArraysIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawArraysIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawArraysIndirect called with null GL context");
 
         if (drawcount <= 0) {
             return;
@@ -409,7 +400,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         // With a bound GL_DRAW_INDIRECT_BUFFER the command parameters may be GPU-written
         // (e.g. by a compute shader), so consume them natively on the GPU.
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             pVulkanRenderer->MultiDrawArraysIndirect(mode, indirect, drawcount, stride);
             return;
@@ -452,13 +443,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void MultiDrawElementsIndirectCount(GLenum mode, GLenum type, const void* indirect, GLintptr drawcount,
                                         GLsizei maxdrawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElementsIndirectCount called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElementsIndirectCount called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElementsIndirectCount called with null GL context");
         pVulkanRenderer->MultiDrawElementsIndirectCount(mode, type, indirect, drawcount, maxdrawcount, stride);
     }
     void MultiDrawArraysIndirectCount(GLenum mode, const void* indirect, GLintptr drawcount,
                                       GLsizei maxdrawcount, GLsizei stride) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawArraysIndirectCount called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawArraysIndirectCount called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawArraysIndirectCount called with null GL context");
 
         if (maxdrawcount <= 0) {
             return;
@@ -472,7 +463,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return;
         }
 
-        auto parameterBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
+        auto parameterBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::Parameter).GetBoundObject();
         if (!parameterBuffer || drawcount < 0 || static_cast<SizeT>(drawcount) + sizeof(Uint32) > parameterBuffer->GetSize()) {
             MGLOG_E_ONCE("MultiDrawArraysIndirectCount skipped: invalid GL_PARAMETER_BUFFER binding or range");
             return;
@@ -503,7 +494,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void DrawElementsInstancedBaseVertexBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                                      GLsizei instancecount, GLint basevertex, GLuint baseinstance) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElementsInstancedBaseVertexBaseInstance called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElementsInstancedBaseVertexBaseInstance called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElementsInstancedBaseVertexBaseInstance called with null GL context");
 
         DrawIndexedCmd payload{};
         payload.mode = mode;
@@ -530,7 +521,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
     void DrawElementsIndirect(GLenum mode, GLenum type, const void* indirect) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElementsIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElementsIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElementsIndirect called with null GL context");
 
         const SizeT indexSize = MG_Util::GetGLTypeSize(type);
         if (indexSize == 0) {
@@ -540,7 +531,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         // With a bound GL_DRAW_INDIRECT_BUFFER the command parameters may be GPU-written
         // (e.g. by a compute shader), so consume them natively on the GPU.
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             pVulkanRenderer->MultiDrawElementsIndirect(mode, type, indirect, 1, 0);
             return;
@@ -574,7 +565,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void DrawArraysInstancedBaseInstance(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
                                          GLuint baseinstance) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawArraysInstancedBaseInstance called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawArraysInstancedBaseInstance called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawArraysInstancedBaseInstance called with null GL context");
 
         DrawCmd payload{};
         payload.mode = mode;
@@ -589,11 +580,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
     void DrawArraysIndirect(GLenum mode, const void* indirect) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawArraysIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawArraysIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawArraysIndirect called with null GL context");
 
         // With a bound GL_DRAW_INDIRECT_BUFFER the command parameters may be GPU-written
         // (e.g. by a compute shader), so consume them natively on the GPU.
-        auto drawBuffer = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
+        auto drawBuffer = MGB_CTX->GetBufferBindingSlot(BufferTarget::DrawIndirect).GetBoundObject();
         if (drawBuffer) {
             pVulkanRenderer->MultiDrawArraysIndirect(mode, indirect, 1, 0);
             return;
@@ -623,13 +614,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void CopyTexImage2D(GLenum target, GLint level, GLenum internalformat, GLint x, GLint y, GLsizei width,
                         GLsizei height, GLint border) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyTexImage2D called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyTexImage2D called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::CopyTexImage2D called with null GL context");
         pVulkanRenderer->CopyTexSubImage2D(target, level, 0, 0, x, y, width, height);
     }
     void CopyTexSubImage2D(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width,
                            GLsizei height) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyTexSubImage2D called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyTexSubImage2D called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::CopyTexSubImage2D called with null GL context");
         pVulkanRenderer->CopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     }
     void CopyImageSubData(const CopyImageEndpoint& src,
@@ -638,32 +629,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                           GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ,
                           GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::CopyImageSubData called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::CopyImageSubData called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::CopyImageSubData called with null GL context");
         pVulkanRenderer->CopyImageSubData(src, srcTarget, srcLevel, srcX, srcY, srcZ,
                                           dst, dstTarget, dstLevel, dstX, dstY, dstZ,
                                           srcWidth, srcHeight, srcDepth);
     }
     void GenerateMipmap(GLenum target) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GenerateMipmap called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::GenerateMipmap called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::GenerateMipmap called with null GL context");
         pVulkanRenderer->GenerateMipmap(target);
     }
 
     void DispatchCompute(GLuint numGroupsX, GLuint numGroupsY, GLuint numGroupsZ) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DispatchCompute called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DispatchCompute called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DispatchCompute called with null GL context");
         pVulkanRenderer->DispatchCompute(numGroupsX, numGroupsY, numGroupsZ);
     }
 
     void DispatchComputeIndirect(GLintptr indirect) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DispatchComputeIndirect called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DispatchComputeIndirect called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DispatchComputeIndirect called with null GL context");
         pVulkanRenderer->DispatchComputeIndirect(indirect);
     }
 
     void MemoryBarrier(GLbitfield barriers) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MemoryBarrier called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MemoryBarrier called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MemoryBarrier called with null GL context");
         pVulkanRenderer->MemoryBarrier(barriers);
     }
 
@@ -682,130 +673,40 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         (void)format;
     }
 
+    // The two compute limits are the only indexed pnames a backend genuinely owns: they come
+    // from the physical device, and MG_Impl/GLImpl/Getter/GL_Getter.cpp asks for them here so it
+    // can raise the answer to the GL required minimum. The same six numbers are carried in
+    // DynamicBackendParameters::MaxComputeWorkGroupCount/Size (filled at capability init from
+    // the same limits), which is their MGPCaps carrier once this entry retires - the
+    // AdvertisedLimitsScenario pins the two against each other. Every other indexed pname names FRONTEND
+    // state (the indexed buffer bindings, the per-unit texture/sampler bindings, the image-unit
+    // bindings, the viewport rectangles, the indexed capabilities) and is answered there before
+    // the table is consulted, so the arms this function used to carry for
+    // GL_SHADER_STORAGE_BUFFER_* and GL_IMAGE_BINDING_* were unreachable duplicates - and not
+    // even faithful ones: the frontend reports the range glBindBufferRange was ASKED for,
+    // verbatim, while these clamped it to the buffer's current storage.
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data) {
         if (!data) return;
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GetIntegeri_v called with null VulkanRenderer");
+        if (index >= 3) {
+            *data = 0;
+            return;
+        }
         switch (target) {
         case GL_MAX_COMPUTE_WORK_GROUP_COUNT:
-            if (index >= 3) {
-                *data = 0;
-                return;
-            }
             *data = static_cast<GLint>(
                 pVulkanRenderer->GetPhysicalDevice().properties.limits.maxComputeWorkGroupCount[index]);
             return;
         case GL_MAX_COMPUTE_WORK_GROUP_SIZE:
-            if (index >= 3) {
-                *data = 0;
-                return;
-            }
             *data = static_cast<GLint>(
                 pVulkanRenderer->GetPhysicalDevice().properties.limits.maxComputeWorkGroupSize[index]);
             return;
-        case GL_SHADER_STORAGE_BUFFER_BINDING: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            *data = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_START: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            *data = static_cast<GLint>(point.GetRange().start);
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_SIZE: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            if (!obj) {
-                *data = 0;
-                return;
-            }
-            const auto& range = point.GetRange();
-            const auto start = std::min(range.start, obj->GetSize());
-            const auto end = std::min(range.end, obj->GetSize());
-            *data = static_cast<GLint>(end - start);
-            return;
-        }
-        case GL_IMAGE_BINDING_NAME:
-        case GL_IMAGE_BINDING_LEVEL:
-        case GL_IMAGE_BINDING_LAYERED:
-        case GL_IMAGE_BINDING_LAYER:
-        case GL_IMAGE_BINDING_ACCESS:
-        case GL_IMAGE_BINDING_FORMAT: {
-            if (index >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
-                *data = 0;
-                return;
-            }
-            auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(static_cast<Int>(index));
-            if (target == GL_IMAGE_BINDING_NAME) {
-                *data = imageBinding.Texture ? static_cast<GLint>(imageBinding.Texture->GetExternalIndex()) : 0;
-            } else if (target == GL_IMAGE_BINDING_LEVEL) {
-                *data = imageBinding.Level;
-            } else if (target == GL_IMAGE_BINDING_LAYERED) {
-                *data = imageBinding.Layered;
-            } else if (target == GL_IMAGE_BINDING_LAYER) {
-                *data = imageBinding.Layer;
-            } else if (target == GL_IMAGE_BINDING_ACCESS) {
-                *data = static_cast<GLint>(imageBinding.Access);
-            } else {
-                *data = static_cast<GLint>(imageBinding.Format);
-            }
-            return;
-        }
         default:
             *data = 0;
             return;
         }
     }
 
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data) {
-        if (!data) return;
-        switch (target) {
-        case GL_SHADER_STORAGE_BUFFER_START: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            *data = static_cast<GLint64>(point.GetRange().start);
-            return;
-        }
-        case GL_SHADER_STORAGE_BUFFER_SIZE: {
-            auto& point = MG_State::pGLContext->GetBufferBindingPoint(BufferTarget::ShaderStorage, index);
-            auto& obj = point.GetBoundObject();
-            if (!obj) {
-                *data = 0;
-                return;
-            }
-            const auto& range = point.GetRange();
-            const auto start = std::min(range.start, obj->GetSize());
-            const auto end = std::min(range.end, obj->GetSize());
-            *data = static_cast<GLint64>(end - start);
-            return;
-        }
-        default:
-            *data = 0;
-            return;
-        }
-    }
-
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params) {
-        if (!params) return;
-        auto* programObject = TryGetDirectVulkanProgram(program);
-        if (!programObject) {
-            params[0] = 0;
-            return;
-        }
-        switch (pname) {
-        case GL_COMPUTE_WORK_GROUP_SIZE: {
-            auto& cache = GetProgramResourceCache(*programObject);
-            params[0] = cache.computeWorkGroupSize[0];
-            params[1] = cache.computeWorkGroupSize[1];
-            params[2] = cache.computeWorkGroupSize[2];
-            return;
-        }
-        default:
-            params[0] = 0;
-            return;
-        }
-    }
-
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding) {
         auto* programObject = TryGetDirectVulkanProgram(program);
         if (!programObject || storageBlockName == nullptr) return;
@@ -813,7 +714,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             ? pActiveBackendObject->GetDynamicParameters().MaxShaderStorageBufferBindings
             : 0;
         if (storageBlockBinding >= static_cast<GLuint>(maxBindings)) {
-            MG_State::pGLContext->RecordError(
+            MGB_CTX->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("DirectVulkan", __func__, "Shader storage binding is out of range."));
             return;
@@ -838,24 +739,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::ReadPixels called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::ReadPixels called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::ReadPixels called with null GL context");
         pVulkanRenderer->ReadPixels(x, y, width, height, format, type, pixels);
     }
     void GetTexImage(GLenum target, GLint level, GLenum format, GLenum type, GLvoid* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GetTexImage called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::GetTexImage called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::GetTexImage called with null GL context");
         pVulkanRenderer->GetTexImage(target, level, format, type, pixels);
     }
     void GetTextureImage(const SharedPtr<MG_State::GLState::ITextureObject>& texture, TextureUploadTarget uploadTarget,
                          GLint level, GLenum format, GLenum type, GLsizei bufSize, GLvoid* pixels) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::GetTextureImage called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::GetTextureImage called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::GetTextureImage called with null GL context");
         pVulkanRenderer->GetTextureImage(texture, uploadTarget, level, format, type, bufSize, pixels);
     }
 
     void Clear(GLbitfield mask) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::Clear called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::Clear called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::Clear called with null GL context");
         pVulkanRenderer->Clear(mask);
     }
 
@@ -883,7 +784,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
         const Uint8* indexBytes = nullptr;
-        const auto& vao = *MG_State::pGLContext->GetBoundVertexArray();
+        const auto& vao = *MGB_CTX->GetBoundVertexArray();
         const auto& indexBufferShared = vao.GetIndexBufferBindingSlot().GetBoundObject();
         if (indexBufferShared != nullptr) {
             const SizeT offset = reinterpret_cast<SizeT>(indices);
@@ -914,7 +815,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void DrawArrays(GLenum mode, GLint first, GLsizei count) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawArrays called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawArrays called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawArrays called with null GL context");
 
         if (mode == GL_LINE_LOOP) {
             if (count < 2) {
@@ -939,7 +840,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void DrawElements(GLenum mode, GLsizei count, GLenum type, const void* indices) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElements called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElements called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElements called with null GL context");
 
         if (mode == GL_LINE_LOOP) {
             Vector<Uint32> closedIndices;
@@ -962,7 +863,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     void MultiDrawArrays(GLenum mode, const GLint* first, const GLsizei* count, GLsizei drawcount) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawArrays called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawArrays called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawArrays called with null GL context");
         if (drawcount <= 0) {
             return;
         }
@@ -1007,7 +908,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // MultiDrawIndexedCmd left the client-memory shape addressing a view whose byte
         // offset is a hardcoded 0, so UploadAndBindIndexBuffer saw a null client pointer,
         // declined the whole batch and painted nothing.)
-        const auto& vao = *MG_State::pGLContext->GetBoundVertexArray();
+        const auto& vao = *MGB_CTX->GetBoundVertexArray();
         if (vao.GetIndexBufferBindingSlot().GetBoundObject() == nullptr) {
             for (GLsizei i = 0; i < drawcount; ++i) {
                 if (count[i] <= 0) {
@@ -1068,13 +969,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void MultiDrawElements(GLenum mode, const GLsizei* count, GLenum type, const GLvoid* const* indices,
                            GLsizei drawcount) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElements called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElements called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElements called with null GL context");
         MultiDrawElementsImpl(mode, count, type, indices, drawcount, nullptr);
     }
 
     void DrawElementsBaseVertex(GLenum mode, GLsizei count, GLenum type, const GLvoid* indices, GLint basevertex) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::DrawElementsBaseVertex called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::DrawElementsBaseVertex called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::DrawElementsBaseVertex called with null GL context");
         if (mode == GL_LINE_LOOP) {
             Vector<Uint32> closedIndices;
             if (BuildClosedLineLoopIndices(count, type, indices, closedIndices)) {
@@ -1098,14 +999,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void MultiDrawElementsBaseVertex(GLenum mode, const GLsizei* count, GLenum type, const GLvoid* const* indices,
                                      GLsizei drawcount, const GLint* basevertex) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::MultiDrawElementsBaseVertex called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::MultiDrawElementsBaseVertex called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::MultiDrawElementsBaseVertex called with null GL context");
         MultiDrawElementsImpl(mode, count, type, indices, drawcount, basevertex);
     }
 
     void BlitFramebuffer(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0, GLint dstX1,
                          GLint dstY1, GLbitfield mask, GLenum filter) {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::BlitFramebuffer called with null VulkanRenderer");
-        MOBILEGL_ASSERT(MG_State::pGLContext, "DirectVulkan::BlitFramebuffer called with null GL context");
+        MOBILEGL_ASSERT(MGB_CTX_LIVE, "DirectVulkan::BlitFramebuffer called with null GL context");
         pVulkanRenderer->BlitFramebuffer(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1, mask, filter);
     }
 
@@ -1206,6 +1107,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             SharedPtr<VkTimerQueryManager::TimestampRecord> end;
             // Kind::Occlusion - pool slots recorded between Begin/End; summed at result time.
             Vector<Uint32> occlusionSlots;
+            // Kind::XfbGenerated - reroute-pool slots for the span's XFB-INACTIVE
+            // draws, where the renderer's reroute is armed (the affected driver's
+            // stream query counts nothing without an open capture; see
+            // VulkanRenderer::BeginXfbQueryForDraw). Summed alongside the stream
+            // slots above, which keep the span's XFB-active draws.
+            Vector<Uint32> rerouteSlots;
             // Renderer generation the records were written under (see
             // g_rendererGeneration). A stale generation resolves as available
             // with a final zero result: the records' pool indices and frame
@@ -1215,11 +1122,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // stale queries are always safe to delete.
             Uint64 rendererGeneration = 0;
             // Kind::XfbGenerated - the frontend's paused-draw primitive counter when the
-            // query began. VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT counts only what the
+            // query began. On the affected drivers VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT
-            // capture saw, so a draw made while the span was paused is invisible to it -
+            // counts only what the capture saw, so a draw made while the span was paused is
-            // but GL_PRIMITIVES_GENERATED counts what the last vertex processing stage
+            // invisible to it - but GL_PRIMITIVES_GENERATED counts what the last vertex
-            // emitted regardless. The delta closes that gap at result time.
+            // processing stage emitted regardless. The delta closes that gap at result time.
             Uint64 pausedPrimitiveSnapshot = 0;
+            // ...unless the GPU already counted those paused draws when the span opened -
+            // through the reroute pool (VulkanRenderer::BeginXfbQueryForDraw reroutes every
+            // draw with no open capture, paused ones included) or, where the probe measured
+            // the stream query as counting capture-less draws, through the stream slot the
+            // paused draw still takes. Adding the CPU delta on top would count them twice,
+            // and the CPU counter is the weaker source anyway: only 3 of the ~15 draw entry
+            // points write it and it answers 0 for GL_PATCHES.
+            Bool pausedPrimitivesCountedByGpu = false;
         };
     } // namespace
 
@@ -1313,13 +1228,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (query->kind == VulkanTimerQuery::Kind::XfbWritten ||
             query->kind == VulkanTimerQuery::Kind::XfbGenerated) {
             Uint64 primitives = 0;
-            if (!pVulkanRenderer->ResolveXfbQueryResult(query->occlusionSlots,
+            if (!pVulkanRenderer->ResolveXfbQueryResult(query->occlusionSlots, query->rerouteSlots,
                                                         query->kind == VulkanTimerQuery::Kind::XfbGenerated,
                                                         primitives)) {
                 return false;
             }
-            if (query->kind == VulkanTimerQuery::Kind::XfbGenerated && MG_State::pGLContext != nullptr) {
+            if (query->kind == VulkanTimerQuery::Kind::XfbGenerated &&
-                primitives += MG_State::pGLContext->GetTransformFeedbackPausedPrimitiveCounter() -
+                !query->pausedPrimitivesCountedByGpu && MGB_CTX_LIVE) {
+                primitives += MGB_CTX->GetTransformFeedbackPausedPrimitiveCounter() -
                               query->pausedPrimitiveSnapshot;
             }
             *outNanoseconds = primitives;
@@ -1366,7 +1282,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         query->kind = generated ? VulkanTimerQuery::Kind::XfbGenerated : VulkanTimerQuery::Kind::XfbWritten;
         query->rendererGeneration = GetRendererGeneration();
         query->pausedPrimitiveSnapshot =
-            MG_State::pGLContext ? MG_State::pGLContext->GetTransformFeedbackPausedPrimitiveCounter() : 0;
+            MGB_CTX_LIVE ? MGB_CTX->GetTransformFeedbackPausedPrimitiveCounter() : 0;
+        // Read AFTER StartXfbQueryCapture, which is where a failed reroute-pool creation
+        // disarms: the answer is then what this span will actually do for every draw.
+        query->pausedPrimitivesCountedByGpu = generated && pVulkanRenderer->ArePausedDrawsGpuCounted();
         return query;
     }
 
@@ -1377,7 +1296,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return;
         }
         pVulkanRenderer->StopXfbQueryCapture(
-            query->kind == VulkanTimerQuery::Kind::XfbGenerated ? 1u : 0u, query->occlusionSlots);
+            query->kind == VulkanTimerQuery::Kind::XfbGenerated ? 1u : 0u, query->occlusionSlots,
+            query->rerouteSlots);
     }
 
     BackendQueryHandle BeginOcclusionQuery() {
@@ -1411,5 +1331,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void Present() {
         MOBILEGL_ASSERT(pVulkanRenderer, "DirectVulkan::Present called with null VulkanRenderer");
         pVulkanRenderer->Present();
+        // THE frame boundary for the MGPipe counters, at the backend entry point rather
+        // than inside VulkanRenderer::Present: that function has an early return for the
+        // no-usable-swapchain case, and a suspended frame is still a frame the counters
+        // must close.
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::OnPresent();
+        }
     }
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.h

@@ -95,8 +95,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     void BindImageTexture(GLuint unit, GLuint texture, GLint level, GLboolean layered, GLint layer, GLenum access,
                           GLenum format);
     void GetIntegeri_v(GLenum target, GLuint index, GLint* data);
-    void GetInteger64i_v(GLenum target, GLuint index, GLint64* data);
-    void GetProgramiv(GLuint program, GLenum pname, GLint* params);
     void ShaderStorageBlockBinding(GLuint program, const GLchar* storageBlockName, GLuint storageBlockBinding);
     void ReadPixels(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels);
     void GetTexImage(GLenum target, GLint level, GLenum format, GLenum type, GLvoid* pixels);

MobileGL/MG_Backend/DirectVulkan/Renderer/MagmaPipeArms.h

@@ -0,0 +1,603 @@
+// MobileGL - MobileGL/MG_Backend/DirectVulkan/Renderer/MagmaPipeArms.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+#include <Config.h>
+#if MOBILEGL_PIPE_PUSH
+// kMGPipeSubsystem* - the runtime bitmask's named bits - and MGPipeHandle itself. Both are
+// header-only constant/POD declarations, and both are push-only, so the pull build's include
+// graph is unchanged (G1).
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/MGPipeHandles.h>
+#endif
+
+#include <cstdlib>
+
+// Magma's arm selector for the P2 Track H / render-state re-keys (P2 brief D14), and the
+// {slot, gen} mint the re-keyed sites are written against.
+//
+// Two switches decide which arm a re-keyed site runs, and they are NOT the same switch:
+//
+//   MOBILEGL_PIPE_PUSH (compile)          - is the pushed state there to be keyed on at all
+//   Features.PipePush  (runtime bitmask)  - is THIS subsystem migrated in THIS run
+//   MOBILEGL_PIPE_LEGACY_MEMOS (compile)  - is the pre-handle arm compiled beside it
+//   Features.PipeLegacyMemos (runtime)    - may the pre-handle arm be ENTERED in this run
+//
+// ARCHITECTURE.md 9.6's point: once a handle wave lands, a clear MOBILEGL_PIPE_PUSH bit is
+// only a valid A/B while the legacy arm is still compiled, because with the bit clear the
+// backend would otherwise still run the re-keyed code. So a clear bit selects the legacy
+// arm, and a run that has explicitly disabled the legacy arm may not fall into it.
+//
+// D14 spends that last sentence at STARTUP, not per draw: "a Track-H subsystem whose bit is
+// clear is a startup Fatal{PipeLegacyMemosDisabled}". Nothing in the draw path aborts, and
+// nothing outside Track H consults the legacy-memo lever at all - see
+// MagmaPipeValidateSubsystemConfiguration below for both halves of that rule.
+//
+// The whole header is inert in a pull build: MOBILEGL_PIPE_PUSH is 0 there, every helper
+// below is behind it, and the pull build's translation units are byte-identical (G1).
+namespace MobileGL::MG_Backend::DirectVulkan {
+
+#if MOBILEGL_PIPE_PUSH
+    // Is `subsystemBit` (MG_Pipe/MGPipe.h's kMGPipeSubsystem*) migrated in this run?
+    inline Bool MagmaPipeSubsystemOn(Uint64 subsystemBit) {
+        return (MG_Config::Features.PipePush & subsystemBit) != 0;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // D14's startup gate
+    // ---------------------------------------------------------------------------------
+    //
+    // Called once from VulkanRenderer::Initialize(), i.e. only when Magma is the backend
+    // that is actually running. It answers exactly one question and it answers it before the
+    // first draw: is there an arm for Magma's Track-H subsystem in this configuration?
+    //
+    // Three deliberate boundaries, each of which the per-draw shape this replaces got wrong:
+    //
+    //  * ONLY Magma's own Track-H bit is checked. Espryt's bit 5 is Espryt's business (a
+    //    DirectVulkan run does not execute one line of DirectGLES' re-key), so
+    //    MOBILEGL_PIPE_PUSH=0x20 must not kill a Magma run, and MOBILEGL_PIPE_PUSH=0x40 must
+    //    not kill an Espryt one.
+    //  * bit 0 (kMGPipeSubsystemRenderState) is NOT Track H and is NOT fatal. It is not a
+    //    memo re-key at all: it decides where the pipeline memo's STATE KEY comes from, and
+    //    a clear bit there simply means the client is not pushing render-state CSOs in this
+    //    run, which GetOrCreatePipeline answers with its own state hash. D14 labels bits 5
+    //    and 6 "Track H" and labels bit 0 nothing of the sort.
+    //  * it is Fatal at STARTUP, once, not on a draw. A per-draw abort inside
+    //    GetOrCreatePipeline turns a configuration mistake into a mid-frame crash and puts a
+    //    branch nobody needs on the hottest path in the backend.
+    //
+    // [declared deviation from D14, review v2 minor 2] D14's runtime row reads "false: the
+    // legacy arm is never entered", and D14's compile-switch row names ComputePipelineStateHash
+    // as part of the pre-handle arm. Those two together would make MOBILEGL_PIPE_LEGACY_MEMOS=0
+    // with bit 0 CLEAR a contradiction: the pipeline memo has no CSO handle to key on, so it
+    // keys on a state hash, and in a build that compiles the pre-handle arm that hash IS
+    // ComputePipelineStateHash. Magma does not make that fatal - bit 0 is not Track H, and
+    // there is a correct answer (the state hash) where for bits 5/6 there is none - but it no
+    // longer does it SILENTLY: the combination is named once, at startup, right here.
+    inline void MagmaPipeValidateSubsystemConfiguration() {
+        if (!MG_Config::Features.PipeLegacyMemos &&
+            !MagmaPipeSubsystemOn(MG_Pipe::kMGPipeSubsystemRenderState)) {
+            MGLOG_W("MGPipe: MOBILEGL_PIPE_LEGACY_MEMOS=0 with kMGPipeSubsystemRenderState (bit 0 "
+                    "of MOBILEGL_PIPE_PUSH) clear - Magma's pipeline memo has no CSO handle to key "
+                    "on, so every draw whose pipeline-state version moved runs the pre-handle STATE "
+                    "HASH instead. That is not a Track-H subsystem and not fatal, but it is not the "
+                    "handle arm either: set bit 0 (MOBILEGL_PIPE_PUSH=0x%llx) if this run was meant "
+                    "to measure it.",
+                    static_cast<unsigned long long>(MG_Config::Features.PipePush |
+                                                    MG_Pipe::kMGPipeSubsystemRenderState));
+        }
+#if MOBILEGL_PIPE_LEGACY_MEMOS
+        // The pre-handle arm is compiled AND the operator has not forbidden entering it, so a
+        // clear bit is an ordinary, valid A/B: the site takes the legacy arm.
+        if (MG_Config::Features.PipeLegacyMemos) return;
+#endif
+        if (MagmaPipeSubsystemOn(MG_Pipe::kMGPipeSubsystemMagmaVertexInput)) return;
+#if MOBILEGL_PIPE_LEGACY_MEMOS
+        const char* const why = "this run has MOBILEGL_PIPE_LEGACY_MEMOS=0";
+#else
+        const char* const why =
+            "this build has cmake -DMOBILEGL_PIPE_LEGACY_MEMOS=OFF, which compiles no such arm";
+#endif
+        MGLOG_F("MGPipe: Fatal{PipeLegacyMemosDisabled} Magma's Track-H subsystem "
+                "(kMGPipeSubsystemMagmaVertexInput, bit 6 of MOBILEGL_PIPE_PUSH) is clear, so the "
+                "vertex-input cache and the VAO draw memo want the pre-handle arm - but %s. Set "
+                "bit 6 (MOBILEGL_PIPE_PUSH=0x%llx, or the default 0x%llx), or allow the legacy arm.",
+                why,
+                static_cast<unsigned long long>(MG_Config::Features.PipePush |
+                                                MG_Pipe::kMGPipeSubsystemMagmaVertexInput),
+                static_cast<unsigned long long>(MG_Pipe::kMGPipeSubsystemsMigratedAtP2));
+        std::abort();
+    }
+
+    // "Does this Track-H site run the handle arm?" - the ONE question every re-keyed Track-H
+    // site asks, so that they cannot disagree with each other or with the startup gate.
+    inline Bool MagmaPipeTrackHArmIsHandles(Uint64 trackHBit) {
+#if MOBILEGL_PIPE_LEGACY_MEMOS
+        return MagmaPipeSubsystemOn(trackHBit);
+#else
+        // No pre-handle arm exists in this build, and MagmaPipeValidateSubsystemConfiguration
+        // has already made a clear bit a startup Fatal, so the handle arm is the only arm a
+        // running process can be on.
+        (void)trackHBit;
+        return true;
+#endif
+    }
+
+    // ---------------------------------------------------------------------------------
+    // Negative control C (P2 brief D18): MOBILEGL_PIPE_HANDLE_ABA_CONTROL
+    // ---------------------------------------------------------------------------------
+    //
+    // "Is the object-identity half of every vertex-input memo key deliberately defeated in
+    // this run?" - the ONE question the control's sites ask, for the same reason
+    // MagmaPipeTrackHArmIsHandles exists: three sites deciding separately could disagree,
+    // and a control that defeats two of three guards proves nothing.
+    //
+    // WHAT IT DEFEATS, AND WHY IT IS SPELLED AS "REPLACE THE IDENTITY WITH A CONSTANT"
+    // RATHER THAN "USE THE HEAP ADDRESS".
+    //
+    // D18 wrote the control as "hash attr.Buffer.get() instead of GetLifetimeId(), and skip
+    // the vaoLifetimeId compare", on the theory that a deleted object's replacement lands at
+    // the freed heap block and so reproduces the key. Measured, it does not: in
+    // HandleRecycleScenario the GL NAMES come back (glGen* hands the deleted name straight
+    // out) but the C++ heap blocks do not - a VertexArrayObject is 3920 bytes, too large for
+    // glibc's tcache, so its chunk goes to the unsorted bin and is split by the very next
+    // allocation the replacement path makes. Four create/delete cycles in one run produced
+    // four distinct addresses, ~1 MiB apart. With no address reuse there is nothing for
+    // "hash the address" to collide with: the replacement hashes differently, indexes a
+    // different memo slot, and inherits nothing - so the arm asserted stale pixels and saw
+    // fresh ones, which is a FAILING negative control that had stopped controlling anything.
+    //
+    // So the control no longer asks the allocator for the collision; it manufactures it. On
+    // both arms the object identity is replaced by a constant, which is the strongest form of
+    // "the allocator handed the block back" and is deterministic. That covers strictly more
+    // than D18's spelling, and in particular it reaches the arm P2 SHIPS: on the handle arm
+    // the constant defeats the OBJECT IDENTITY THAT SELECTS THE SLOT - the key the handle arm
+    // ships - so the replacement VAO is handed the dead one's memo entry and its content hash.
+    // Defeating only the retired lifetime-id/address guards would leave that key untested,
+    // which is exactly the vacuity this control exists to catch.
+    //
+    // WHAT IT DOES NOT COVER, AND WHY NO REPRODUCER OF THIS SHAPE CAN [fix-aba review v1,
+    // MAJOR 1]. It does NOT exercise the GENERATION half of {slot, gen}:
+    //
+    //   * this mint has no death notification - nothing in MG_Backend/DirectVulkan consumes
+    //     NotifyStateObjectDestroyed - so a slot returns to the free list only through
+    //     OnFrameBoundary's age sweep (kSweepInterval 256, kRetireAgeBoundaries 1024, below);
+    //   * HandleRecycleScenario issues five frame boundaries, so the free list is empty when
+    //     the replacement VAO acquires and it gets a BRAND-NEW slot at Gen 1 (measured:
+    //     redVao slot=2 gen=1, greenVao slot=3 gen=1). The knob-off FRESH verdict there is
+    //     decided by the SLOT alone, and deleting the ++Gen below leaves all four arms green;
+    //   * a genuine slot REUSE needs >= 1024 idle boundaries after the dead object's last
+    //     draw, which necessarily puts the two draws in different frames - and the only memo
+    //     that carries a GPU slice rather than a layout, ResolvedVertexBindings, declines
+    //     across frames by design. The two requirements are mutually exclusive, so the
+    //     generation is out of reach of any same-frame pixel reproducer for this memo.
+    //
+    // The generation is covered where it IS expressible, over this mint and the claim rule
+    // MagmaPipeClaimSlotMemos below: MG_Test/Pipe/MagmaPipeIdentityTest.cpp drives a real
+    // retire -> reuse and asserts that a memo stamped at {slot, gen=N} is not served at
+    // {slot, gen=N+1} with the knob off and IS served with it on. Deleting the ++Gen reds that
+    // suite; it is the only place in the tree where that deletion is caught.
+    //
+    // Everything the control does NOT defeat is as load-bearing as what it does. It never
+    // touches a guard that is not an IDENTITY guard: the resolved-bindings memo's frame
+    // serial, its slice-epoch compares and its host-map check all stay in force, so a green
+    // AbaControl arm still means "a replacement object was handed its dead predecessor's
+    // resolved vertex bindings because the identity halves of the keys were defeated", not
+    // "every safety net was switched off until something broke".
+    //
+    // Off by default (Config.h), set only by the HandleRecycle AbaControl ctest lanes, and
+    // #if MOBILEGL_PIPE_PUSH throughout, so no shipping pull build can even parse it.
+    // P4a (BRIEF-P4A.md D-I2, G8): WHICH KINDS THIS ANSWER COVERS, and it is not "all of them".
+    //
+    // P4a mints six more client-side kinds - Texture, Renderbuffer, Framebuffer, SamplerCso,
+    // SamplerViewCso and ShaderCso - and requires the ABA control to defeat "the identity half
+    // of P4a's memo keys as well", because a control that only defeats the guards a phase
+    // RETIRED says nothing about the key that phase SHIPS.
+    //
+    // On Magma there is no such key to defeat, and that is a fact about the roadmap rather than
+    // an omission here. MagmaPipeIdentityTables below mints exactly TWO kinds,
+    // VertexElementsCso and Buffer; a texture, a framebuffer, a sampler, a view and a program
+    // are all still reached from their frontend objects on this backend, and moving them onto
+    // handles is P7's work (ROADMAP.md:24 - "Magma anything"; P4a leaves MG_Backend/DirectVulkan
+    // untouched apart from this file). So the honest statement is per KIND, and it is spelled as
+    // code rather than as a comment so that a caller cannot read the blanket answer above and
+    // conclude the knob covers its kind:
+    //
+    //   * for the two kinds this backend really keys on {slot, gen}, the knob defeats the
+    //     identity exactly as it always has (MagmaPipeClaimSlotMemos);
+    //   * for P4a's six there is nothing here to defeat, so the answer is FALSE - and
+    //     MG_IntegrationTest's HandleRecycleScenario reads that through its own build probe and
+    //     makes those cases' AbaControl arm assert the CORRECT pixels while SAYING that it is
+    //     not controlling anything for that kind. It does not assert a corruption that no code
+    //     on this tree can produce, which would be a permanently red always-on lane.
+    //
+    // WHAT MAKES IT TRUE LATER, in one sentence, so the next reader does not have to derive it:
+    // when a backend grows a Features.PipeHandleAbaControl consumer over its P4a object slot
+    // tables - one `if` in GetOrCreate / FindByHandle, the shape MagmaPipeClaimSlotMemos already
+    // has for vertex input - this function's per-kind answer becomes that consumer's, the
+    // integration probe finds the consumer, and the six cases flip to expecting the corruption.
+    inline Bool MagmaPipeAbaControlDefeatsIdentity() {
+        return MG_Config::Features.PipeHandleAbaControl;
+    }
+
+    // WHICH KINDS THIS BACKEND ACTUALLY KEYS ON {slot, gen}, and therefore which kinds the knob
+    // above has an identity to defeat at all. `kind` is MG_Pipe::MGPipeKind.
+    //
+    // EXHAUSTIVE, WITH NO `default:`, for MG_IntegrationTest/Harness/PipeSlotPeek.cpp's reason:
+    // a kind added to MGPipeKind without a decision here must be a -Wswitch warning in this
+    // file rather than a row that silently inherits somebody else's answer. Being wrong in the
+    // "covered" direction is the expensive one - a control asserting a corruption nobody can
+    // produce is a permanently red always-on lane - so an undecided kind must never read true,
+    // and with no `default:` there is no arm for it to read true from.
+    //
+    // constexpr AND PINNED BY static_assert BELOW, which is what stops it rotting the way a
+    // predicate with no caller does: MagmaPipeIdentityTables mints exactly two kinds, the
+    // asserts say so in both directions, and the file no longer compiles if the tables and this
+    // statement of them ever part company. (Review F-m5: the earlier form had no caller at all
+    // and could not make anything red or green.)
+    inline constexpr Bool MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind kind) {
+        switch (kind) {
+            // The two MagmaPipeIdentityTables really mints.
+            case MG_Pipe::MGPipeKind::VertexElementsCso:
+            case MG_Pipe::MGPipeKind::Buffer:
+                return true;
+            // P4a's six object classes: still reached from their frontend objects on this
+            // backend (Magma's object paths are P7, ROADMAP.md:24), so there is no key here for
+            // the knob to defeat.
+            case MG_Pipe::MGPipeKind::Texture:
+            case MG_Pipe::MGPipeKind::Renderbuffer:
+            case MG_Pipe::MGPipeKind::Framebuffer:
+            case MG_Pipe::MGPipeKind::SamplerCso:
+            case MG_Pipe::MGPipeKind::SamplerViewCso:
+            case MG_Pipe::MGPipeKind::ShaderCso:
+            // ...and everything else this backend does not mint a handle for.
+            case MG_Pipe::MGPipeKind::None:
+            case MG_Pipe::MGPipeKind::Xfb:
+            case MG_Pipe::MGPipeKind::RenderStateCso:
+            case MG_Pipe::MGPipeKind::Fence:
+            case MG_Pipe::MGPipeKind::Query:
+            case MG_Pipe::MGPipeKind::Context:
+            case MG_Pipe::MGPipeKind::KindCount:
+                return false;
+        }
+        return false;
+    }
+
+    static_assert(MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::VertexElementsCso),
+                  "MagmaPipeIdentityTables mints VertexElementsCso: the knob has an identity to "
+                  "defeat for it");
+    static_assert(MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::Buffer),
+                  "MagmaPipeIdentityTables mints Buffer: the knob has an identity to defeat for it");
+    static_assert(!MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::Texture) &&
+                      !MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::Renderbuffer) &&
+                      !MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::Framebuffer) &&
+                      !MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::SamplerCso) &&
+                      !MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::SamplerViewCso) &&
+                      !MagmaPipeAbaControlKindIsRekeyedHere(MG_Pipe::MGPipeKind::ShaderCso),
+                  "P4a's six object classes are not keyed on {slot, gen} on this backend, so "
+                  "HandleRecycleScenario's six AbaControl arms must NOT expect a corruption here. "
+                  "Wiring one of them is what flips this assert, this predicate and that arm - and "
+                  "MG_IntegrationTest's two-symbol probe over MG_Backend/DirectVulkan is what "
+                  "carries the answer into the lane");
+
+    // THERE IS DELIBERATELY NO PER-KIND WRAPPER HERE, and review F-v2-m3 is why. An earlier
+    // round carried `MagmaPipeAbaControlCoversKind(kind)` - the conjunction of the two
+    // statements above - and it had no caller anywhere in the tree: the knob's only two
+    // consumers (VulkanRenderer.cpp's VAO draw memo and VertexInputStateFactory.cpp's pipeline
+    // key) each hold ONE kind, VertexElementsCso, by construction, so the kind is not a
+    // variable at either site. A conjunction no build ever evaluates cannot be pinned the way
+    // the predicate above is pinned - it is not constexpr, because it reads MG_Config::Features,
+    // so no static_assert can reach it - which makes it exactly the rot F-m5 was raised about,
+    // one level up: an `&&` whose operands could be inverted or dropped with nothing to say so.
+    //
+    // The two pieces stand alone instead, and each is pinned by something that runs:
+    // MagmaPipeAbaControlKindIsRekeyedHere is constexpr and asserted in BOTH directions by the
+    // three static_asserts above, which compile in every Magma build; MagmaPipeAbaControlDefeats
+    // Identity is the knob, and its two consumers are what make it true or false. A call site
+    // that ever does hold a variable kind writes the `&&` there, where a build will run it.
+
+    // The single consumer-table entry every VAO collapses onto while the control is on. Slot
+    // 0 is a real, ordinary entry of both tables (MagmaPipeSlotIndex maps the first allocatable
+    // handle onto it), so nothing about the tables changes shape for the control's sake.
+    inline constexpr Uint32 kMagmaPipeAbaControlSlotIndex = 0;
+
+    // ---------------------------------------------------------------------------------
+    // The {slot, gen} mint
+    // ---------------------------------------------------------------------------------
+    //
+    // Maps a frontend object's never-reused lifetime id to a dense {slot, gen}. Three
+    // properties, and the third is the one review v2 got wrong:
+    //
+    //   1. exact identity - Gen moves whenever a slot changes owner, so a stale handle can
+    //      never match a live object even if the allocator hands back the same heap address
+    //      (the ABA HandleRecycleScenario reproduces);
+    //   2. dense slots - the slot IS an index, so a consumer's per-slot table needs no hash,
+    //      no probe and no mix;
+    //   3. NO CAPACITY CLIFF. A live object's handle never changes while the object is being
+    //      drawn, whatever the working set size.
+    //
+    // Property 3 is why this is not the fixed 2-way set-associative LRU the previous round
+    // shipped. That structure evicted a LIVE object once the working set passed its capacity,
+    // and every consumer memo keyed on the handle died with it: measured on a verbatim
+    // transcription, 54% of uses lost their handle at 2500 live VAOs against 2048 entries, and
+    // 20% at 1024 live VAOs once the lifetime ids are sparse (an app that creates and destroys
+    // VAOs, which is the Minecraft chunk shape this exists for). Two of the three memos it
+    // fed - the content-hash memo and the resolved-state memo - had NO capacity before this
+    // package: they were unbounded mutable fields on VertexArrayObject. Introducing eviction
+    // there turns one ComputeHash per VAO reconfiguration into one per DRAW, and, once the
+    // buffer table thrashes too, makes the vertex-input content hash a per-draw value that
+    // inserts a fresh heap-allocated BackendVertexInputState into an unbounded map on every
+    // draw. That is a worse leak than the one it was introduced to avoid.
+    //
+    // So: grow on demand, and reclaim by AGE instead of by capacity.
+    //
+    //   * Acquire hits an UnorderedMap<lifetimeId, slotIndex>, in front of which sits a
+    //     one-entry memo. Every re-keyed site in a draw asks about the SAME VAO, so the memo
+    //     turns the five-or-six acquisitions a draw makes into one map probe plus five Uint64
+    //     compares - less than the address multiply plus two-way probe the pre-handle arm ran.
+    //   * OnFrameBoundary retires slots whose object has not been drawn for
+    //     kRetireAgeBoundaries boundaries and returns them to a free list, so the table's
+    //     footprint tracks the LIVE DRAWN working set, not objects ever created. That is the
+    //     property MG_Impl/Pipe/SlotAllocator cannot have here: nothing in P2 can call its
+    //     Free (the tracker emits no object-class state, BufferBackendOps::OnDestroy is handed
+    //     a BackendBufferResource rather than the BufferObject, and VertexArrayObject has no
+    //     death hook at all - adding one is D13's explicit-destroy work, which covers Espryt's
+    //     six kinds, not VertexElementsCso), so an allocator here would grow by one SlotState
+    //     plus one map node per object EVER created, for the life of the process, on a
+    //     platform with an LMK. Age-based reclamation is the stand-in for the death
+    //     notification, and it is exactly as ABA-proof, because reuse bumps Gen.
+    //   * A retire costs at most one memo recompute if the object is drawn again - the same
+    //     price a cache miss costs - and it is charged only to objects that went idle for
+    //     ~1024 frames, never to a hot one.
+    //
+    // Memory: one map node plus one 24-byte Entry per live object, i.e. tens of bytes against
+    // the kilobyte a VertexArrayObject or a BufferObject already costs the frontend. There is
+    // no capacity to size off a device measurement because there is no capacity; what the
+    // device run in D.4.2 can still want is the number itself, so the high-water mark is
+    // logged at MGLOG_D on the allocate-a-new-slot branch (once per new object, never on a
+    // draw - ROADMAP.md:7).
+    //
+    // Single-threaded, like the rest of the renderer. Owned per VulkanRenderer (see
+    // MagmaPipeIdentityTables): a process-global would share one table, and one reclamation
+    // clock, across two live contexts.
+    class MagmaPipeIdentityTable {
+    public:
+        explicit MagmaPipeIdentityTable(const char* kindName) : m_kindName(kindName) {}
+
+        // Slots ever minted. A consumer table indexed by MagmaPipeSlotIndex() needs this many
+        // entries; MagmaPipeSlotTable below grows itself, so nobody has to ask.
+        Uint32 Count() const { return static_cast<Uint32>(m_entries.size()); }
+        // Objects currently holding a slot - the live working set this table tracks.
+        Uint32 LiveCount() const { return static_cast<Uint32>(m_index.size()); }
+
+        MG_Pipe::MGPipeHandle Acquire(Uint64 lifetimeId) {
+            // Unreachable: MG_State hands out lifetime ids from 1 precisely so that a
+            // zero-initialised memo slot cannot carry a live object's id. Guarded anyway so
+            // that a zero can never be minted into a slot and then indexed with.
+            if (lifetimeId == 0) return MG_Pipe::kMGPipeNullHandle;
+            // The one-entry front memo. Cleared by any retire, so it can never serve a slot
+            // that has been handed back to the free list.
+            if (lifetimeId == m_lastLifetimeId) {
+                m_entries[m_lastIndex].LastUse = m_boundary;
+                return m_lastHandle;
+            }
+            Uint32 index = 0;
+            const auto it = m_index.find(lifetimeId);
+            if (it != m_index.end()) {
+                index = it->second;
+            } else {
+                index = ClaimSlot();
+                m_entries[index].LifetimeId = lifetimeId;
+                m_index.emplace(lifetimeId, index);
+            }
+            Entry& entry = m_entries[index];
+            entry.LastUse = m_boundary;
+            m_lastLifetimeId = lifetimeId;
+            m_lastIndex = index;
+            m_lastHandle = MG_Pipe::MGPipeHandle{index + MG_Pipe::kMGPipeFirstAllocatableSlot,
+                                                 entry.Gen};
+            return m_lastHandle;
+        }
+
+        // Ages the table and returns idle slots to the free list. Same shape and the same
+        // self-gating as VertexInputStateFactory::OnFrameBoundary, which is what the reclaimed
+        // slots' consumers use.
+        void OnFrameBoundary() {
+            ++m_boundary;
+            if ((m_boundary % kSweepInterval) != 0) return;
+            SizeT retired = 0;
+            for (auto it = m_index.begin(); it != m_index.end();) {
+                Entry& entry = m_entries[it->second];
+                if ((m_boundary - entry.LastUse) > kRetireAgeBoundaries) {
+                    entry.LifetimeId = 0;
+                    m_freeSlots.push_back(it->second);
+                    it = m_index.erase(it);
+                    ++retired;
+                } else {
+                    ++it;
+                }
+            }
+            if (retired != 0) {
+                // A retired slot's Gen has not moved yet - it moves when the slot is reused -
+                // so a front memo pointing at one would still hand out a handle the consumer
+                // tables would accept. Drop it.
+                m_lastLifetimeId = 0;
+                m_lastHandle = MG_Pipe::kMGPipeNullHandle;
+                MGLOG_D("MagmaPipeIdentityTable(%s): retired %zu idle slots, %u live of %u minted",
+                        m_kindName, retired, LiveCount(), Count());
+            }
+        }
+
+    private:
+        // Sweep cadence and retirement age, deliberately the same numbers
+        // VertexInputStateFactory::OnFrameBoundary uses for the entries these slots key: a slot
+        // retired earlier than its cache entry would mint a new handle for an object whose
+        // entry is still live and still correct, which is a pure waste.
+        static constexpr Uint64 kSweepInterval = 256;
+        static constexpr Uint64 kRetireAgeBoundaries = 1024;
+
+        struct Entry {
+            Uint64 LifetimeId = 0;
+            Uint64 LastUse = 0;
+            // Moves ONLY on slot reuse, never on respecify: an object that keeps its slot keeps
+            // its generation, which is what makes a memo survive a reconfiguration.
+            Uint32 Gen = 0;
+        };
+
+        Uint32 ClaimSlot() {
+            while (!m_freeSlots.empty()) {
+                const Uint32 index = m_freeSlots.back();
+                m_freeSlots.pop_back();
+                // MGPipeHandles.h:52-58 defends the Gen wrap only in a debug allocator, and
+                // MOBILEGL_ASSERT is compiled out of every build P2 runs (Defines.h: asserts are
+                // live only at MOBILEGL_LOG_ACTIVE_LEVEL == DEBUG). So the wrap is handled on the
+                // RELEASE path instead of asserted: a slot that has been reused 2^32 times is
+                // permanently retired rather than wrapped, because a wrapped Gen would let a
+                // stale handle match a live object. It costs one slot.
+                if (m_entries[index].Gen == ~Uint32{0}) {
+                    MGLOG_W("MagmaPipeIdentityTable(%s): slot %u reached generation 2^32-1 and is "
+                            "retired for good; {slot, gen} stays unique",
+                            m_kindName, index + MG_Pipe::kMGPipeFirstAllocatableSlot);
+                    continue;
+                }
+                ++m_entries[index].Gen;
+                return index;
+            }
+            const Uint32 index = static_cast<Uint32>(m_entries.size());
+            m_entries.push_back(Entry{});
+            m_entries[index].Gen = 1;
+            // The high-water mark, at powers of two from 1024 up: at most a handful of lines
+            // for a whole session, emitted from the allocate-a-NEW-slot branch, i.e. once per
+            // object this backend has ever seen and never on a draw (ROADMAP.md:7).
+            //
+            // [narrow, declared deviation from D20's "MGLOG_D for anything non-critical"] This
+            // one is I, not D, because D is compiled out of every build that ships and of every
+            // build P2 measures, and this line IS the measurement review v2's MAJOR 1 asks for:
+            // the live-object high-water mark of minecraft-1.21.4-in-world and
+            // ...-sodium-in-world, which nothing on desktop reaches and no gate here can see.
+            // The structure no longer has a capacity to size off it, so the number is evidence
+            // rather than a tuning input - but D.4.2 should still read it out of the device log,
+            // and it cannot read a line that was compiled away.
+            const SizeT minted = m_entries.size();
+            if (minted >= 1024 && (minted & (minted - 1)) == 0) {
+                MGLOG_I("MagmaPipeIdentityTable(%s): high-water %zu slots minted, %u live",
+                        m_kindName, minted, LiveCount());
+            }
+            return index;
+        }
+
+        const char* m_kindName = "";
+        Uint64 m_boundary = 0;
+        Vector<Entry> m_entries;
+        Vector<Uint32> m_freeSlots;
+        UnorderedMap<Uint64, Uint32> m_index;
+        // One-entry front memo (see Acquire). m_lastLifetimeId == 0 means "empty": a live
+        // object's lifetime id is never 0.
+        Uint64 m_lastLifetimeId = 0;
+        Uint32 m_lastIndex = 0;
+        MG_Pipe::MGPipeHandle m_lastHandle = MG_Pipe::kMGPipeNullHandle;
+    };
+
+    // The two mints one renderer owns. Per renderer, NOT process-global: two live contexts (or
+    // a context recreation, which destroys and rebuilds the renderer) would otherwise share one
+    // table and one reclamation clock, and both consumer tables are per-instance already.
+    class MagmaPipeIdentityTables {
+    public:
+        // A VAO is kind VertexElementsCso: that is the gallium-shaped CSO a vertex array
+        // resolves to, and the only kind in MGPipeKind that names vertex-input state.
+        MG_Pipe::MGPipeHandle HandleOf(MG_Pipe::MGPipeKind kind, Uint64 lifetimeId) {
+            return kind == MG_Pipe::MGPipeKind::Buffer ? m_buffers.Acquire(lifetimeId)
+                                                       : m_vaos.Acquire(lifetimeId);
+        }
+        void OnFrameBoundary() {
+            m_vaos.OnFrameBoundary();
+            m_buffers.OnFrameBoundary();
+        }
+        const MagmaPipeIdentityTable& Vaos() const { return m_vaos; }
+        const MagmaPipeIdentityTable& Buffers() const { return m_buffers; }
+
+    private:
+        MagmaPipeIdentityTable m_vaos{"VertexElementsCso"};
+        MagmaPipeIdentityTable m_buffers{"Buffer"};
+    };
+
+    // The table entry a handle names. Every per-slot table Magma keeps is indexed by this.
+    //
+    // A null handle has no slot, and it is unreachable here: both lifetime-id sources start at
+    // 1 (VertexArrayObject.cpp, BufferObject.cpp), so Acquire's zero guard never fires. The
+    // ternary, not the assertion, is what has effect in a shipped build (Defines.h compiles
+    // MOBILEGL_ASSERT out at INFO), and slot 0 of a consumer table is a real entry that a null
+    // handle can never match, because MGPipeHandleIsNull is also what the consumers compare.
+    inline Uint32 MagmaPipeSlotIndex(const MG_Pipe::MGPipeHandle& handle) {
+        MOBILEGL_ASSERT(!MG_Pipe::MGPipeHandleIsNull(handle),
+                        "a null MGPipeHandle has no slot to index a per-slot table with");
+        return MG_Pipe::MGPipeHandleIsNull(handle)
+                   ? 0u
+                   : handle.Slot - MG_Pipe::kMGPipeFirstAllocatableSlot;
+    }
+
+    // A grow-on-demand per-slot table whose ENTRY ADDRESSES NEVER MOVE.
+    //
+    // D12.4 asks for a grow-on-demand Vector, and with an unbounded mint that is what a
+    // consumer needs - but a Vector that grows relocates its elements, and the draw path holds
+    // references into these entries across nested calls. Chunks of kChunkEntries are appended
+    // instead: the Vector of owning pointers reallocates, the chunks never do, so an entry
+    // reference is valid for the life of the table. That is the same guarantee the fixed table
+    // it replaces gave, without the fixed capacity.
+    template <typename T, Uint32 kChunkEntries = 256>
+    class MagmaPipeSlotTable {
+    public:
+        T& operator[](Uint32 index) {
+            const Uint32 chunk = index / kChunkEntries;
+            while (m_chunks.size() <= chunk) {
+                m_chunks.push_back(MakeUnique<Chunk>());
+            }
+            return m_chunks[chunk]->Entries[index % kChunkEntries];
+        }
+        SizeT Capacity() const { return m_chunks.size() * kChunkEntries; }
+
+    private:
+        struct Chunk {
+            T Entries[kChunkEntries] = {};
+        };
+        Vector<UniquePtr<Chunk>> m_chunks;
+    };
+
+    // The claim rule every per-slot memo table uses, in one place so that the rule and the
+    // negative control that defeats it cannot drift apart between consumers - and so that the
+    // unit suite which drives a REAL slot reuse (MG_Test/Pipe/MagmaPipeIdentityTest.cpp) tests
+    // this code rather than a copy of it.
+    //
+    // The SLOT picks the entry; the WHOLE handle - Gen included - decides whether the entry is
+    // this object's. A slot the mint recycled for a different object comes back with a moved
+    // Gen, so the compare fails and the entry is cleared rather than inherited. That is the
+    // half HandleRecycleScenario cannot reach (see MagmaPipeAbaControlDefeatsIdentity).
+    //
+    // With negative control C on, every object collapses onto one entry and the entry is handed
+    // back UNCLEARED and UNCLAIMED - at once "the replacement reproduced its predecessor's
+    // slot" and "the slot was reused and Gen did not move".
+    //
+    // `Memos` needs a MG_Pipe::MGPipeHandle member named Owner and a default constructor that
+    // means "empty"; VertexInputStateFactory::VaoBackendMemos is the one production instance.
+    template <typename Memos, Uint32 kChunkEntries>
+    inline Memos& MagmaPipeClaimSlotMemos(MagmaPipeSlotTable<Memos, kChunkEntries>& table,
+                                          const MG_Pipe::MGPipeHandle& handle) {
+        if (MagmaPipeAbaControlDefeatsIdentity()) {
+            return table[kMagmaPipeAbaControlSlotIndex];
+        }
+        Memos& memos = table[MagmaPipeSlotIndex(handle)];
+        if (!(memos.Owner == handle)) {
+            memos = Memos{};
+            memos.Owner = handle;
+        }
+        return memos;
+    }
+#endif // MOBILEGL_PIPE_PUSH
+} // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/PipelineFactory.cpp

@@ -201,11 +201,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.renderPass, sizeof(payload.renderPass)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.colorAttachmentCount, sizeof(payload.colorAttachmentCount)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.rasterizationSamples, sizeof(payload.rasterizationSamples)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.sampleShadingEnable, sizeof(payload.sampleShadingEnable)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.minSampleShading, sizeof(payload.minSampleShading)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.sampleMask, sizeof(payload.sampleMask)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.subpass, sizeof(payload.subpass)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.topology, sizeof(payload.topology)));
         XXHASH_VERIFY(
             XXH64_update(m_hashState, &payload.primitiveRestartEnable, sizeof(payload.primitiveRestartEnable)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.patchControlPoints, sizeof(payload.patchControlPoints)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.passthroughTessControlKey,
+                                   sizeof(payload.passthroughTessControlKey)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.viewportCount, sizeof(payload.viewportCount)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.polygonMode, sizeof(payload.polygonMode)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.cullMode, sizeof(payload.cullMode)));
@@ -435,6 +440,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         VkPipelineMultisampleStateCreateInfo ms{VK_STRUCTURE_TYPE_PIPELINE_MULTISAMPLE_STATE_CREATE_INFO};
         ms.rasterizationSamples = payload.rasterizationSamples;
+        ms.sampleShadingEnable = payload.sampleShadingEnable ? VK_TRUE : VK_FALSE;
+        // Ignored by Vulkan unless sampleShadingEnable is set, but written unconditionally so the
+        // struct's bytes match the hash the payload was keyed by.
+        ms.minSampleShading = payload.minSampleShading;
+        // GL_SAMPLE_MASK / glSampleMaski. Left at nullptr - which Vulkan reads as all-ones - until
+        // now, so glSampleMaski was a silent no-op on this backend while DirectGLES forwarded it.
+        // The pointer has to outlive the vkCreateGraphicsPipelines call, which the payload does.
+        ms.pSampleMask = payload.sampleMask;
 
         VkPipelineDepthStencilStateCreateInfo depthStencil{VK_STRUCTURE_TYPE_PIPELINE_DEPTH_STENCIL_STATE_CREATE_INFO};
         depthStencil.depthTestEnable = payload.depthTestEnable ? VK_TRUE : VK_FALSE;

MobileGL/MG_Backend/DirectVulkan/Renderer/PipelineFactory.h

@@ -37,11 +37,39 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             VkRenderPass renderPass = VK_NULL_HANDLE;
             Uint32 colorAttachmentCount = 1;
             VkSampleCountFlagBits rasterizationSamples = VK_SAMPLE_COUNT_1_BIT;
+            // glEnable(GL_SAMPLE_SHADING) + glMinSampleShading, which Vulkan bakes into the
+            // pipeline rather than exposing as dynamic state - so both are part of the pipeline's
+            // identity and both are hashed. The renderer leaves the enable false unless the
+            // device's sampleRateShading feature was enabled
+            // (VUID-VkPipelineMultisampleStateCreateInfo-sampleShadingEnable-00784).
+            Bool sampleShadingEnable = false;
+            Float minSampleShading = 0.0f;
+            // glEnable(GL_SAMPLE_MASK) + glSampleMaski, the fixed-function coverage mask, already
+            // reduced to what GL says this draw gets (VulkanRenderer::ResolveEffectiveSampleMask:
+            // all-ones unless the target is genuinely multisampled). Pipeline state like the two
+            // above - Vulkan has no dynamic sample mask before VK_EXT_extended_dynamic_state3 -
+            // so it is hashed with them, and all-ones has to keep producing the pipeline a null
+            // pSampleMask always did.
+            //
+            // TWO words, though GL only ever fills the first. GL_MAX_SAMPLE_MASK_WORDS is clamped
+            // to 1 on both backends, so glSampleMaski writes index 0 and nothing else - but the
+            // count Vulkan READS is ceil(rasterizationSamples / 32), which is 2 on a 64-sample
+            // target, and GetAdvertisedMaxSamples does not cap the driver's sample count. A
+            // single Uint32 here let such a pipeline read one word past the member (the next
+            // struct field). The second word is all-ones: full coverage for samples 32..63, which
+            // is the only honest answer when GL has no state describing them.
+            Uint32 sampleMask[2] = {0xffffffffu, 0xffffffffu};
             Uint32 subpass = 0;
             VkPrimitiveTopology topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
             Bool primitiveRestartEnable = false;
             // GL_PATCH_VERTICES; only read for a PATCH_LIST topology.
             Uint32 patchControlPoints = 3;
+            // ProgramFactory::ComputePassthroughTessControlKey of the synthesized pass-through
+            // tessellation control stage below, or 0 when this pipeline has none. Hashed, because
+            // the levels glPatchParameterfv set are compiled INTO that module and are not a
+            // function of the program or of patchControlPoints - see the note on
+            // passthroughTessControlStage.
+            Uint64 passthroughTessControlKey = 0;
             // How many of ARB_viewport_array's viewports this pipeline rasterizes into. 1 for
             // every program that never assigns gl_ViewportIndex, which is all of them outside the
             // conformance suite - the wide shape costs a longer vkCmdSetViewport/Scissor per state
@@ -87,8 +115,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // renderer could not build one, and CreatePipeline refuses the pipeline - the same
             // refusal it applies when `stages` itself is half-tessellated.
             //
-            // NOT hashed: it is a pure function of the program and of patchControlPoints, both
+            // NOT hashed directly: it is a pure function of the program, of patchControlPoints and
-            // of which ComputeHash already mixes in.
+            // of the default tessellation levels - the first two of which ComputeHash already
+            // mixes in, and the third of which arrives through passthroughTessControlKey above.
             VkPipelineShaderStageCreateInfo passthroughTessControlStage{};
             const VkPipelineVertexInputStateCreateInfo* vertexInputState = nullptr;
             // Diagnostic only; may be null. Read solely from the pipeline-creation failure path.

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -76,6 +76,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         using CompileOptionFlags = Flags<CompileOptionBit>;
         using HashType = Uint64;
 
+        // The gl_PerVertex members a pass-through tessellation control stage may have to carry,
+        // in the order glslang declares them - which is the order a redeclaration must use.
+        // Which of them exist is a function of the neighbouring stage's GLSL VERSION
+        // (gl_CullDistance joins the block at #version 450), so the mask is read off that
+        // stage's SPIR-V rather than assumed. See ReflectPerVertexInputMembers.
+        enum class PerVertexMemberBit : Uint32 {
+            Position = 1u << 0,
+            PointSize = 1u << 1,
+            ClipDistance = 1u << 2,
+            CullDistance = 1u << 3,
+        };
+        // What a program parsed below #version 450 carries, and the fallback when a module's
+        // block cannot be read.
+        static constexpr Uint32 kDefaultPerVertexMembers =
+            static_cast<Uint32>(PerVertexMemberBit::Position) | static_cast<Uint32>(PerVertexMemberBit::PointSize) |
+            static_cast<Uint32>(PerVertexMemberBit::ClipDistance);
+
         struct UpdateAfterBindLimits {
             Bool enabled = false;
             Uint32 maxPerStageSamplers = 0;
@@ -185,6 +202,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // tessellation stages are present or neither
             // (VUID-VkGraphicsPipelineCreateInfo-pStages-00730). So the draw path has to supply
             // the pass-through stage GL describes; see GetOrCreatePassthroughTessControlStage.
+            // True when this program was built AS a transform-feedback capture variant but its
+            // last pre-rasterization module does NOT carry the Xfb execution mode - so the
+            // renderer must decline the capture span instead of issuing
+            // vkCmdBeginTransformFeedbackEXT against it
+            // (VUID-vkCmdBeginTransformFeedbackEXT-None-04128).
+            //
+            // Two ways to get here, and neither is visible from GL state, which is all
+            // BeginXfbCaptureForDraw otherwise consults: the clip/XFB validation backstop had to
+            // rewind past the capture decoration, or XfbCaptureDecoratePass resolved none of the
+            // requested varyings and returned without changing anything (its own MGLOG_E path)
+            // while its runner still reported success. Both used to ship a non-Xfb module under
+            // an Xfb-flagged cache entry - the flag and the layout are part of the program cache
+            // key, so it was sticky for every later captured draw of the program, not a glitch.
+            Bool xfbCaptureDeclined = false;
+            // The program has a tessellation or geometry module declaring TessellationPointSize /
+            // GeometryPointSize on a device whose shaderTessellationAndGeometryPointSize feature
+            // is off, so a pipeline built from it is invalid usage
+            // (VUID-RuntimeSpirv-PointSize-06439). Its draws are refused in SetupDraw rather than
+            // handed to the driver - the same contract PipelineFactory's half-tessellated refusal
+            // implements one level up, and the counterpart of the DirectGLES arm that reports a
+            // driver with neither point-size extension by name.
+            //
+            // Sticky by construction, which is what makes ONE log line honest: the flag lives on
+            // the cache entry, so every later draw of the same program variant reads the same
+            // answer instead of re-deciding it.
+            Bool pointSizeCapabilityUnsupported = false;
             Bool needsPassthroughTessControl = false;
             // ...and the pass-through this renderer can synthesize carries gl_Position and
             // nothing else, so it is only correct when the evaluation stage's inputs are
@@ -194,6 +237,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // instead (PipelineFactory::CreatePipeline refuses the pipeline and the draw is
             // skipped). See ReflectPassthroughTessControlNeed.
             Bool passthroughTessControlEmulatable = false;
+            // Which gl_PerVertex members the evaluation stage's `in gl_PerVertex gl_in[]` block
+            // actually carries, as a PerVertexMemberBit mask read off its SPIR-V. The synthesized
+            // control stage has to redeclare the SAME shape: glslang appends gl_CullDistance to
+            // that block from #version 450 upward, so a 450/460 program - and every ESSL program,
+            // which the source processor rewrites to "#version 460 core" - carries four members
+            // where a 430 program carries three. A fixed three-member pass-through fed the
+            // evaluation stage a differently-shaped block, which is the black-frame-no-error case
+            // this whole family is written around.
+            Uint32 passthroughPerVertexMembers = 0;
             // Frame-boundary counter value of the last GetOrCreateProgram hit; drives
             // cache eviction (see OnFrameBoundary). Mutable: the draw snapshot's memoised
             // entry pointer re-stamps use through a const reference (StampProgramUse).
@@ -249,6 +301,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 writesViewportIndexBuiltin = other.writesViewportIndexBuiltin;
                 needsPassthroughTessControl = other.needsPassthroughTessControl;
                 passthroughTessControlEmulatable = other.passthroughTessControlEmulatable;
+                passthroughPerVertexMembers = other.passthroughPerVertexMembers;
                 lastUsedFrame = other.lastUsedFrame;
                 other.hash = 0;
                 other.descriptorSetLayout = VK_NULL_HANDLE;
@@ -267,6 +320,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.writesViewportIndexBuiltin = false;
                 other.needsPassthroughTessControl = false;
                 other.passthroughTessControlEmulatable = false;
+                other.passthroughPerVertexMembers = 0;
                 other.lastUsedFrame = 0;
             }
             VkProgramObject& operator=(VkProgramObject&& other) noexcept {
@@ -311,6 +365,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 writesViewportIndexBuiltin = other.writesViewportIndexBuiltin;
                 needsPassthroughTessControl = other.needsPassthroughTessControl;
                 passthroughTessControlEmulatable = other.passthroughTessControlEmulatable;
+                passthroughPerVertexMembers = other.passthroughPerVertexMembers;
                 lastUsedFrame = other.lastUsedFrame;
                 other.hash = 0;
                 other.descriptorSetLayout = VK_NULL_HANDLE;
@@ -329,6 +384,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.writesViewportIndexBuiltin = false;
                 other.needsPassthroughTessControl = false;
                 other.passthroughTessControlEmulatable = false;
+                other.passthroughPerVertexMembers = 0;
                 other.lastUsedFrame = 0;
                 return *this;
             }
@@ -396,12 +452,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         explicit ProgramFactory(VkDevice device, const VulkanRendererConfig& config, Uint32 maxBindings,
                                 Bool shaderDrawParametersEnabled,
                                 Bool unformattedFloatStorageImagesEnabled,
+                                Bool tessellationAndGeometryPointSizeEnabled,
                                 Bool enableSpirvValidation,
                                 UpdateAfterBindLimits updateAfterBindLimits,
                                 SubgroupLoweringPolicy subgroupPolicy)
             : m_device(device), m_maxBindings(maxBindings), m_config(config),
               m_shaderDrawParametersEnabled(shaderDrawParametersEnabled),
               m_unformattedFloatStorageImagesEnabled(unformattedFloatStorageImagesEnabled),
+              m_tessellationAndGeometryPointSizeEnabled(tessellationAndGeometryPointSizeEnabled),
               m_enableSpirvValidation(enableSpirvValidation),
               m_updateAfterBindLimits(updateAfterBindLimits),
               m_subgroupPolicy(subgroupPolicy) {
@@ -448,6 +506,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         static VkShaderStageFlagBits ToVkStage(ShaderStage stage);
         static VkFormat ConvertSpirvImageFormatToVkFormat(SpvImageFormat format);
         static SamplerNumericDomain UniformTypeToSamplerNumericDomain(GLenum glType);
+        // The same question for an IMAGE uniform (`image2D`, `uimageBuffer`, ...), which the
+        // sampler form above deliberately does not answer. Kept separate rather than folded in
+        // because the two are asked in different places for different reasons: a sampler's domain
+        // decides a sampled VIEW format, an image's decides what a placeholder descriptor for an
+        // UNBOUND image unit must be (see UniformManager::AcquireUnboundTexelBufferView and
+        // GetUnboundStorageImageTexture) - a formatless `writeonly` declaration reflects no
+        // format at all, and the numeric domain is then the only thing that constrains it.
+        static SamplerNumericDomain UniformTypeToImageNumericDomain(GLenum glType);
         // True when any entry point declares the DepthReplacing execution mode, i.e. the
         // shader assigns gl_FragDepth. Exposed so the blended depth-write quirk's exemption
         // can be pinned by tests. A false negative loses the exemption, so such a shader is
@@ -477,18 +543,40 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // the caller then has no control stage to inject, and CreatePipeline refuses the
         // pipeline rather than handing the driver a half-tessellated one.
         //
-        // Keyed on the patch size because GL takes the output patch size from PATCH_VERTICES,
+        // Keyed on the patch size, the six default tessellation levels AND the gl_PerVertex
-        // which is draw state, not link state - the CTS case that motivated this links at the
+        // member set, because all three decide what the generator emits. The size comes from
-        // default 3 and draws at 4. The pipeline cache already re-keys on patchControlPoints,
+        // PATCH_VERTICES and the levels from PATCH_DEFAULT_OUTER_LEVEL / PATCH_DEFAULT_INNER_LEVEL
-        // so the module a pipeline was built with is part of that pipeline's identity.
+        // - draw state rather than link state, and the CTS case that motivated this links at the
-        // Compiling is bounded by the number of distinct patch sizes a program draws with
+        // default 3 and draws at 4. The member set comes from the neighbouring evaluation stage's
-        // (MAX_PATCH_VERTICES = 32 in the worst case, one or two in practice) and only ever
+        // own SPIR-V, so two programs at different GLSL versions need different modules. The
-        // happens for the rare program that has no control stage at all.
+        // pipeline cache re-keys on the same inputs, so the module a pipeline was built with is
-        VkPipelineShaderStageCreateInfo GetOrCreatePassthroughTessControlStage(Uint32 patchVertices);
+        // part of that pipeline's identity. Compiling is bounded by the number of distinct
+        // (size, levels, members) combinations a program draws with - one or two in practice -
+        // and only ever happens for the rare program that has no control stage at all.
+        VkPipelineShaderStageCreateInfo GetOrCreatePassthroughTessControlStage(Uint32 patchVertices,
+                                                                              const FloatVec4& defaultOuterLevel,
+                                                                              const FloatVec2& defaultInnerLevel,
+                                                                              Uint32 perVertexMembers);
 
         // Source of the module above. Exposed for tests: the generated GLSL is the whole
         // contract with the evaluation stage, so it is worth pinning independently of a device.
-        static String BuildPassthroughTessControlSource(Uint32 patchVertices);
+        static String BuildPassthroughTessControlSource(Uint32 patchVertices, const FloatVec4& defaultOuterLevel,
+                                                        const FloatVec2& defaultInnerLevel, Uint32 perVertexMembers);
+
+        // The identity of one such module: everything the generator bakes in, folded into a
+        // 64-bit key over the raw bits (so -0.0 and +0.0 key apart, which is harmless, and NaN
+        // keys to itself, which is what matters). Shared with PipelineFactory, which mixes the
+        // same value into the pipeline hash so a pipeline can never be handed a module built for
+        // different levels or a different block shape.
+        static Uint64 ComputePassthroughTessControlKey(Uint32 patchVertices, const FloatVec4& defaultOuterLevel,
+                                                       const FloatVec2& defaultInnerLevel, Uint32 perVertexMembers);
+
+        // The PerVertexMemberBit mask of the INPUT per-vertex block a module declares, read
+        // straight out of its SPIR-V (OpMemberDecorate ... BuiltIn on the struct behind the one
+        // Input variable that is an array of a Block-decorated struct). Zero when the module has
+        // no such block. Exposed for tests, which is the only way to pin the shape agreement
+        // without a device.
+        static Uint32 ReflectPerVertexInputMembers(const Vector<Uint>& spirv);
 
     private:
         struct ProgramLookupCache {
@@ -531,6 +619,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // True only when the logical device enabled both
         // shaderStorageImageReadWithoutFormat and shaderStorageImageWriteWithoutFormat.
         Bool m_unformattedFloatStorageImagesEnabled = false;
+        // True when the logical device enabled shaderTessellationAndGeometryPointSize. When it is
+        // FALSE a program whose tessellation or geometry module declares TessellationPointSize /
+        // GeometryPointSize is refused at build time (see VkProgramObject::
+        // pointSizeCapabilityUnsupported) instead of being handed to the driver as invalid usage.
+        Bool m_tessellationAndGeometryPointSizeEnabled = false;
         // Startup snapshot used only by internally synthesized shader modules, which do not
         // originate from a ProgramLinkTask.
         Bool m_enableSpirvValidation = false;
@@ -548,11 +641,20 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // See GetCacheStructureEpoch(). Starts at 1 so a zero-initialized memo can never match.
         Uint64 m_cacheStructureEpoch = 1;
         IEvictionObserver* m_evictionObserver = nullptr;
-        // Pass-through tessellation control stages by input patch size. Never evicted: at most
+        // Pass-through tessellation control stages by the identity of what was compiled into
-        // MAX_PATCH_VERTICES entries exist for the lifetime of the device, and every pipeline
+        // them - the input patch size and the six default tessellation levels, folded into one
-        // ever built from one keeps referencing its module. A failed build is cached as
+        // 64-bit key by ComputePassthroughTessControlKey (the levels are float state, so the map
+        // cannot simply be keyed on the patch size any more). A failed build is cached as
         // VK_NULL_HANDLE so a broken generator costs one compile, not one per draw.
-        UnorderedMap<Uint32, VkPipelineShaderStageCreateInfo> m_passthroughTessControlStages;
+        //
+        // Hard-capped, because the key is application-controlled: glPatchParameterfv clamps
+        // nothing, so an application that recomputes a level per frame mints a new key per frame.
+        // Reaching the cap destroys every module and starts over (see the flush in
+        // GetOrCreatePassthroughTessControlStage); the cap is far above what any program that
+        // holds its levels still will ever need. The gl_PerVertex member set is in the key too
+        // and adds only a handful of values, so it does not move the cap in practice.
+        static constexpr SizeT kMaxPassthroughTessControlStages = 64;
+        UnorderedMap<Uint64, VkPipelineShaderStageCreateInfo> m_passthroughTessControlStages;
         static inline XXH64_state_t* m_hashState = XXH64_createState();
     };
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.h

@@ -42,7 +42,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             SamplerNumericDomain numericDomain = SamplerNumericDomain::Unknown;
         };
 
-        Bool Initialize(VkDevice device, VkBufferManager* bufferManager,
+        // `physicalDevice` is only ever asked for format properties: a placeholder descriptor for
+        // an unbound texel-buffer binding has to be built from a format the DEVICE accepts as a
+        // texel buffer, and there is no other route to that answer from here.
+        Bool Initialize(VkDevice device, VkPhysicalDevice physicalDevice, VkBufferManager* bufferManager,
                         ProgramFactory* programFactory,
                         VkDeviceSize minUniformBufferOffsetAlignment, Uint32 frameCount,
                         Uint32 maxBindings = 16, Uint32 setsPerFrame = 64,
@@ -176,7 +179,43 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         static MG_State::GLState::ITextureObject* ResolveSamplerTextureRaw(
             const MG_State::GLState::ProgramObject& program,
             const ProgramFactory::VkProgramObject& programObj, Uint32 binding, Uint32 element);
-        SharedPtr<MG_State::GLState::ITextureObject> GetFallbackTexture(TextureTarget target) const;
+        // `numericDomain` is the sampler's class, and it matters only for the multisample arm -
+        // see GetFallbackMultisampleTexture for why the single-sampled fallback can ignore it.
+        SharedPtr<MG_State::GLState::ITextureObject> GetFallbackTexture(
+            TextureTarget target, SamplerNumericDomain numericDomain) const;
+        // The multisample arm of GetFallbackTexture. One object per (target, numeric domain) and
+        // no upload path: a multisample image cannot be written by a transfer, so its texels stay
+        // undefined - which is what GL promises for a texelFetch on an incomplete multisample
+        // texture - and it cannot carry MUTABLE_FORMAT, so its format has to match the sampler's
+        // class outright rather than being reinterpreted at view time.
+        SharedPtr<MG_State::GLState::ITextureObject> GetFallbackMultisampleTexture(
+            TextureTarget target, SamplerNumericDomain numericDomain) const;
+        // ---- placeholders for UNBOUND image-backed descriptors -------------------------
+        // GL lets a program declare `samplerBuffer`, `imageBuffer` or `image2D` and bind nothing
+        // to the unit it names: the fetch is then undefined (GL 4.6 core 8.9 for an incomplete
+        // buffer texture, 8.26 for an image unit with no texture) - undefined VALUES, not a
+        // dropped draw. Vulkan has no unwritten descriptor, so something valid has to sit in the
+        // set or the whole draw or dispatch is lost, which is what these two build. Same shape as
+        // VkBufferManager::AcquireUnboundStorageDescriptor, one level up: per FORMAT rather than
+        // one shared object, because a descriptor whose format disagrees with the shader's
+        // declaration is invalid Vulkan even when nothing ever reads it.
+        //
+        // `declaredFormat` is the format the SHADER declared (VK_FORMAT_UNDEFINED for a sampled
+        // texel buffer, which never carries one, or for a formatless `writeonly` image);
+        // `numericDomain` decides the format when there is no declaration and is the fallback
+        // class when the device cannot use the declared one as a texel buffer.
+        VkBufferView AcquireUnboundTexelBufferView(VkFormat declaredFormat, SamplerNumericDomain numericDomain,
+                                                   Bool storage);
+        // A 1x1 (x1 layer, or 6 faces for a cube) texture of `format`, shaped for `target` so the
+        // view the descriptor gets has the view type the shader's image declaration demands.
+        // Null for a target with no single-sampled placeholder shape - multisample images, whose
+        // descriptor needs a multisample view that this cannot stand in for.
+        SharedPtr<MG_State::GLState::ITextureObject> GetUnboundStorageImageTexture(TextureTarget target,
+                                                                                    VkFormat format) const;
+        // The (target, format) pair a storage-image binding's placeholder is keyed by, resolved
+        // from reflection alone. False when the binding has no placeholder shape.
+        Bool ResolveUnboundStorageImagePlaceholder(const ProgramFactory::VkProgramObject& programObj, Uint32 binding,
+                                                   TextureTarget& outTarget, VkFormat& outFormat) const;
         // `element` indexes a sampler ARRAY inside one binding; each element carries its own
         // independently assigned GL texture unit, so it selects the texture, the sampler
         // override and the fallback separately from its neighbours.
@@ -251,6 +290,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                       VkDescriptorSet& outDescriptorSet);
 
         VkDevice m_device = VK_NULL_HANDLE;
+        VkPhysicalDevice m_physicalDevice = VK_NULL_HANDLE;
         VkBufferManager* m_bufferManager = nullptr;
         ProgramFactory* m_programFactory = nullptr;
         Vector<FrameResources> m_frames;
@@ -263,6 +303,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         VkTextureManager* m_textureManager = nullptr;
         VkSamplerManager* m_samplerManager = nullptr;
         mutable SharedPtr<MG_State::GLState::ITextureObject> m_fallbackTexture2D;
+        // Keyed by (arrayed, numeric domain); see GetFallbackMultisampleTexture. Lazily populated,
+        // never evicted - at most six tiny 1x1 images - and torn down with the manager.
+        mutable UnorderedMap<Uint32, SharedPtr<MG_State::GLState::ITextureObject>> m_fallbackMultisampleTextures;
+        // See AcquireUnboundTexelBufferView / GetUnboundStorageImageTexture. Both are lazily
+        // populated, never evicted (a program's declared formats are a fixed, tiny set) and torn
+        // down with the manager. The texel views are keyed by format AND by storage-vs-sampled
+        // because the two descriptor kinds demand different format FEATURES of the device, so one
+        // format can be usable for one and not the other. Deliberately NOT the per-frame
+        // texelBufferViews list: those are destroyed at every frame boundary, and these must
+        // outlive it or the placeholder would be rebuilt for every unbound binding every frame.
+        UnorderedMap<Uint64, VkBufferView> m_unboundTexelBufferViews;
+        mutable UnorderedMap<Uint64, SharedPtr<MG_State::GLState::ITextureObject>> m_unboundStorageImageTextures;
 
         // Per-draw scratch buffers for BindProgramUniformBuffers: reused (clear keeps
         // capacity) so the descriptor-write path stops allocating on every draw.

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.cpp

@@ -7,6 +7,7 @@
 // End of Source File Header
 
 #include "VertexInputStateFactory.h"
+#include "MagmaPipeArms.h"
 #include "MG_Util/Converters/MGToStr/DataTypeConverter.h"
 #include <MG_Backend/BackendObjects.h>
 #include <utility>
@@ -45,25 +46,149 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // capture came back holding a dead VAO's vertex data (0,0,0,1 - the previous
             // test's positions) instead of its own.
             // Zero for client memory (no buffer), which is a distinct identity of its own.
-            const Uint64 bufferKey = attr.Buffer ? attr.Buffer->GetLifetimeId() : 0;
+            //
+            // P2 D12.4 / ARCHITECTURE.md 9.5: under the handle arm the identity is the
+            // buffer's {slot, gen} rather than its lifetime id - "lifetimeId -> gen mixed
+            // into every server-side content hash". The two are equally ABA-proof (the
+            // allocator maps one onto the other and bumps Gen only on slot REUSE); what
+            // changes is that the key is now the identity the SERVER will be handed once
+            // buffers travel as handles, instead of a number only the client can mint.
+            Uint64 bufferKey = attr.Buffer ? attr.Buffer->GetLifetimeId() : 0;
+#if MOBILEGL_PIPE_PUSH
+            if (attr.Buffer) {
+                // The SAME arm question the other four re-keyed sites ask, through the same
+                // helper: a site that decided for itself could silently key on the pre-handle
+                // identity while its neighbours keyed on the handle.
+                if (MagmaPipeTrackHArmIsHandles(MG_Pipe::kMGPipeSubsystemMagmaVertexInput)) {
+                    const MG_Pipe::MGPipeHandle handle =
+                        m_identity->HandleOf(MG_Pipe::MGPipeKind::Buffer, attr.Buffer->GetLifetimeId());
+                    bufferKey = static_cast<Uint64>(handle.Slot) | (static_cast<Uint64>(handle.Gen) << 32);
+                }
+                if (MagmaPipeAbaControlDefeatsIdentity()) {
+                    // Negative control C (P2 brief D18), on WHICHEVER arm this run is on - the
+                    // pre-handle lifetime id and the handle's {slot, gen} are the same guard
+                    // wearing two hats, and a control that defeated only the retired one would
+                    // say nothing about the key P2 ships.
+                    //
+                    // The identity is replaced by a constant rather than by the raw
+                    // BufferObject*, because the address is not recycled in practice and so
+                    // never collides (see MagmaPipeAbaControlDefeatsIdentity). Zero is what a
+                    // key with NO buffer identity in it looks like - the exact defect this
+                    // hash was fixed for: "the hash is what TryBindResolvedVertexBindings
+                    // accepts as proof that a memoised binding still reads the buffer it was
+                    // resolved from", and with the identity gone it accepts a binding resolved
+                    // from a different buffer. HandleRecycleScenario.AbaControl then draws a
+                    // replacement VAO and gets its dead predecessor's vertex data.
+                    bufferKey = 0;
+                }
+            }
+#endif
             XXHASH_VERIFY(XXH64_update(m_hashState, &bufferKey, sizeof(bufferKey)));
         }
 
         return XXH64_digest(m_hashState);
     }
 
+#if MOBILEGL_PIPE_PUSH
+    VertexInputStateFactory::VaoBackendMemos& VertexInputStateFactory::MemosFor(
+        const MG_State::GLState::VertexArrayObject& vao) const {
+        const MG_Pipe::MGPipeHandle handle =
+            m_identity->HandleOf(MG_Pipe::MGPipeKind::VertexElementsCso, vao.GetLifetimeId());
+        // One entry per mintable slot, grown on demand: the mint has no capacity, so neither
+        // does this, and no two live VAOs can share an entry however large the working set is.
+        // There is no probe in front of it because the mint itself is one - a one-entry memo
+        // hit for every acquisition after this draw's first, and a hash probe otherwise.
+        //
+        // The claim rule - the slot picks the entry, the whole handle (Gen included) decides
+        // whose it is - and negative control C's defeat of it are MagmaPipeArms.h's
+        // MagmaPipeClaimSlotMemos, so that the unit suite which drives a REAL slot reuse
+        // (MG_Test/Pipe/MagmaPipeIdentityTest.cpp) exercises this code and not a copy of it.
+        // What the control defeats HERE is the identity that SELECTS the entry: every VAO
+        // collapses onto one, handed back uncleared, so the replacement inherits the dead
+        // VAO's content hash and its resolved-entry pointer. The GENERATION half is the unit
+        // suite's business, for the reason MagmaPipeAbaControlDefeatsIdentity spells out.
+        return MagmaPipeClaimSlotMemos(m_vaoMemos, handle);
+    }
+#endif
+
+#if MOBILEGL_PIPE_PUSH
+    Bool VertexInputStateFactory::TryGetMemoizedHash(const MG_State::GLState::VertexArrayObject& vao,
+                                                     Uint64& outHash) const {
+        if (MagmaPipeTrackHArmIsHandles(MG_Pipe::kMGPipeSubsystemMagmaVertexInput)) {
+            const VaoBackendMemos& memos = MemosFor(vao);
+            if (memos.HashConfigVersion != vao.GetConfigVersion()) return false;
+            outHash = memos.Hash;
+            return true;
+        }
+#if MOBILEGL_PIPE_LEGACY_MEMOS
+        return vao.GetBackendHashMemo(outHash);
+#else
+        return false;
+#endif
+    }
+#endif
+
     VertexInputStateFactory::HashType VertexInputStateFactory::GetOrComputeHash(
         const MG_State::GLState::VertexArrayObject& vao) const {
         HashType hash = 0;
+#if MOBILEGL_PIPE_PUSH
+        // P2 D12.5: the same memo, on the backend's side of the boundary.
+        if (MagmaPipeTrackHArmIsHandles(MG_Pipe::kMGPipeSubsystemMagmaVertexInput)) {
+            VaoBackendMemos& memos = MemosFor(vao);
+            if (memos.HashConfigVersion == vao.GetConfigVersion()) {
+                return memos.Hash;
+            }
+            hash = ComputeHash(vao);
+            memos.Hash = hash;
+            memos.HashConfigVersion = vao.GetConfigVersion();
+            return hash;
+        }
+#endif
+#if MOBILEGL_PIPE_LEGACY_MEMOS
         if (!vao.GetBackendHashMemo(hash)) {
             hash = ComputeHash(vao);
             vao.SetBackendHashMemo(hash);
         }
+#endif
         return hash;
     }
 
     const VertexInputStateFactory::BackendVertexInputState& VertexInputStateFactory::GetOrCreateVertexInputState(
         const MG_State::GLState::VertexArrayObject& vao) {
+#if MOBILEGL_PIPE_PUSH
+        // P2 D12.5: the same per-draw fast path, but the resolved-entry pointer lives in this
+        // factory's slot-indexed table instead of on the frontend VAO. The eviction epoch
+        // survives the move and is still what stops a stale pointer being dereferenced: the
+        // POINTEE is a cache entry this factory can erase at a frame boundary, and moving the
+        // memo does not change that.
+        if (MagmaPipeTrackHArmIsHandles(MG_Pipe::kMGPipeSubsystemMagmaVertexInput)) {
+            VaoBackendMemos& memos = MemosFor(vao);
+            if (memos.StateConfigVersion == vao.GetConfigVersion() && memos.State != nullptr &&
+                memos.StateEpoch == m_evictionEpoch) {
+                const auto* memoEntry = static_cast<const BackendVertexInputState*>(memos.State);
+                memoEntry->lastUsedFrameBoundary = m_frameBoundaryCounter;
+                return *memoEntry;
+            }
+            const BackendVertexInputState& resolved =
+                GetOrCreateVertexInputState(vao, GetOrComputeHash(vao));
+            // MemosFor is re-taken rather than kept live across GetOrCreateVertexInputState:
+            // the reference is not worth holding across a call that can resize the table.
+            VaoBackendMemos& stamp = MemosFor(vao);
+            stamp.State = &resolved;
+            stamp.StateEpoch = m_evictionEpoch;
+            stamp.StateConfigVersion = vao.GetConfigVersion();
+            // The AUX memo is deliberately NOT stamped here: its two words already live in
+            // VulkanRenderer::VaoDrawMemo (layoutHash / layoutAuxMasks) and its getter has no
+            // live reader anywhere, so the handle arm retires it rather than moving it.
+            return resolved;
+        }
+#endif
+#if !MOBILEGL_PIPE_LEGACY_MEMOS
+        // Unreachable: with no legacy arm compiled MagmaPipeTrackHArmIsHandles is a compile-
+        // time true, so the handle arm above always returns. Written out rather than left to
+        // fall off the end so the function still has a return on every path a compiler sees.
+        return GetOrCreateVertexInputState(vao, GetOrComputeHash(vao));
+#else
         // Per-draw fast path: the VAO carries a pointer to its resolved entry,
         // valid while its config version and the cache's eviction epoch both
         // match - no re-hash, no map lookup.
@@ -83,6 +208,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         vao.SetBackendAuxMemo(entry.layoutHash,
                               PackVertexInputAuxMasks(entry.unsupportedAttribMask, entry.attributeLocationMask));
         return entry;
+#endif // MOBILEGL_PIPE_LEGACY_MEMOS
     }
 
     const VertexInputStateFactory::BackendVertexInputState& VertexInputStateFactory::GetOrCreateVertexInputState(
@@ -316,8 +442,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 // Invalidate every VAO's state-pointer memo: the erased node's
                 // address may be reused by a future insert. Advance through the
                 // process-wide source so the value stays unique across factory
-                // instances (see the member comment).
+                // instances (see the member comment). With no legacy arm the memos
+                // live in this factory and die with it, so a per-instance bump is
+                // enough - P2 D12.5.
+#if MOBILEGL_PIPE_LEGACY_MEMOS
                 m_evictionEpoch = ++s_evictionEpochSource;
+#else
+                ++m_evictionEpoch;
+#endif
             } else {
                 ++it;
             }

MobileGL/MG_Backend/DirectVulkan/Renderer/VertexInputStateFactory.h

@@ -7,8 +7,12 @@
 // End of Source File Header
 
 #pragma once
+// MG_Pipe::MGPipeHandle for the P2 D12.5 memo table below. A header of constexpr constants,
+// so the pull build gains nothing from it.
+#include <MG_Pipe/MGPipeHandles.h>
 
 #include "Config.h"
+#include "MagmaPipeArms.h"
 #include "VertexInputStateBuilder.h"
 #include "MG_State/GLState/VertexArrayState/VertexArrayObject.h"
 #include <Includes.h>
@@ -70,8 +74,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             };
         };
 
+#if MOBILEGL_PIPE_PUSH
+        // The mint is the RENDERER's (MagmaPipeIdentityTables), not a process-global and not
+        // this factory's: VulkanRenderer::LookupVaoDrawMemo has to derive the same {slot, gen}
+        // for the same VAO, and a table that outlived the context it was minted for would share
+        // one reclamation clock across two live contexts (review v2 minor 4).
+        VertexInputStateFactory(const VulkanRendererConfig& config, VkPhysicalDevice physicalDevice,
+                                MagmaPipeIdentityTables& identity):
+            m_config(config), m_physicalDevice(physicalDevice), m_identity(&identity) {}
+#else
         VertexInputStateFactory(const VulkanRendererConfig& config, VkPhysicalDevice physicalDevice):
             m_config(config), m_physicalDevice(physicalDevice) {}
+#endif
         ~VertexInputStateFactory() = default;
         VertexInputStateFactory(const VertexInputStateFactory&) = delete;
 
@@ -86,6 +100,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Memoized ComputeHash: reuses the VAO's cached hash while its config version
         // is unchanged. Use this on per-draw paths.
         HashType GetOrComputeHash(const MG_State::GLState::VertexArrayObject& vao) const;
+#if MOBILEGL_PIPE_PUSH
+        // The VAO's content hash IF it has already been memoized, without computing one.
+        // P2 D12.5: the three draw-path readers that used to ask the VAO object this
+        // question ask the factory instead, because that is where the memo lives once the
+        // frontend object stops carrying the backend's state.
+        Bool TryGetMemoizedHash(const MG_State::GLState::VertexArrayObject& vao, Uint64& outHash) const;
+#endif
         const BackendVertexInputState& GetOrCreateVertexInputState(
             const MG_State::GLState::VertexArrayObject& vao, HashType hash);
         const BackendVertexInputState& GetOrCreateVertexInputState(const MG_State::GLState::VertexArrayObject& vao);
@@ -112,6 +133,44 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         static VkFormat ToFloat32VertexFormat(Int componentCount);
         Bool SupportsVertexBufferFormat(VkFormat format) const;
 
+#if MOBILEGL_PIPE_PUSH
+        // ---- P2 D12.5: the backend's memos, off the frontend VAO and into the backend ----
+        //
+        // The two facts that used to live as `mutable` fields on VertexArrayObject
+        // (Get/SetBackendHashMemo and Get/SetBackendStateMemo), kept here instead, keyed on
+        // the VAO's {slot, gen} and guarded by exactly the same config version. A frontend
+        // state object holding the backend's raw pointer is what P2 retires: under split the
+        // backend is in another process and its cache entry has no address a client could
+        // store, so the memo has to live on the side that owns the pointee.
+        //
+        // The AUX memo is not carried over: its two words moved into VaoDrawMemo::layoutHash
+        // and layoutAuxMasks long ago and its getter has no live reader anywhere in the tree,
+        // so the handle arm simply stops writing it (D12.5 says delete rather than move).
+        struct VaoBackendMemos {
+            // Whose memos these are. The identity table can recycle a slot for a different
+            // VAO under LRU pressure, and the handle compare - Gen included - is what says
+            // the contents are this object's and not its predecessor's.
+            MG_Pipe::MGPipeHandle Owner = MG_Pipe::kMGPipeNullHandle;
+            Uint64 Hash = 0;
+            Uint32 HashConfigVersion = ~0u;
+            const void* State = nullptr;
+            Uint64 StateEpoch = 0;
+            Uint32 StateConfigVersion = ~0u;
+        };
+        // Grow-on-demand (D12.4), one entry per slot the renderer's mint has ever handed
+        // out, and NO CAPACITY: these two memos had none before this package either - they
+        // were unbounded mutable fields on the VertexArrayObject itself - and re-introducing
+        // eviction here is what review v2 rejected. MagmaPipeSlotTable grows in chunks so an
+        // entry reference stays valid across the nested GetOrCreateVertexInputState call.
+        // 48 B per live VAO, reclaimed with the slot when the object goes idle.
+        mutable MagmaPipeSlotTable<VaoBackendMemos> m_vaoMemos;
+        // The renderer's {slot, gen} mint (see the constructor). Never null under push.
+        MagmaPipeIdentityTables* m_identity = nullptr;
+        // The entry belonging to `vao`, claimed (and cleared) if the slot currently holds
+        // someone else's.
+        VaoBackendMemos& MemosFor(const MG_State::GLState::VertexArrayObject& vao) const;
+#endif
+
         const VulkanRendererConfig& m_config;
         VkPhysicalDevice m_physicalDevice = VK_NULL_HANDLE;
         // Values are heap-allocated: UnorderedMap is open-addressing, so INSERT
@@ -130,15 +189,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // stale memo.
         //
         // Drawn from a process-wide source, never a per-instance counter: the VAO
-        // memos outlive this factory (they live on pGLContext's VAOs, the renderer
+        // memos outlive this factory (they live on the frontend context's VAOs, the renderer
         // is destroyed and recreated on EGL surface release/re-create), so a fresh
         // factory restarting at a dead factory's epoch value would honor its
         // dangling entry pointers. The constructor takes a value strictly greater
         // than anything a predecessor ever stamped, so a dead factory's memo can
         // never compare equal here - the same never-reused idiom as the lifetime ids.
         // Single-threaded like the rest of the factory (renderer-thread only).
+        //
+        // P2 D12.5: the process-wide source is the LEGACY arm's need. It exists because the
+        // memos live on the frontend VAOs and therefore outlive the factory. The handle arm's
+        // memo table is owned by this factory and dies with it, so a per-instance counter is
+        // enough there and the epoch shrinks back to what it looks like it should be.
+#if MOBILEGL_PIPE_LEGACY_MEMOS
         static inline Uint64 s_evictionEpochSource = 0;
         Uint64 m_evictionEpoch = ++s_evictionEpochSource;
+#else
+        Uint64 m_evictionEpoch = 1;
+#endif
         static inline XXH64_state_t* m_hashState = XXH64_createState();
     };
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/VkBufferManager.cpp

@@ -10,12 +10,23 @@
 #include "../DirectVulkan.h"
 #include "VulkanRenderer.h"
 
+#include "MG_Util/Metrics/PipeStats.h"
+
 namespace MobileGL::MG_Backend::DirectVulkan {
     namespace {
         constexpr VmaAllocationCreateFlags kResidentBufferAllocationFlags =
             VMA_ALLOCATION_CREATE_HOST_ACCESS_SEQUENTIAL_WRITE_BIT;
         constexpr SizeT kLiveResourcePruneThreshold = 256;
 
+        // See VkBufferManager::AcquireUnboundStorageDescriptor. 256 bytes: comfortably past
+        // every minStorageBufferOffsetAlignment in the wild, and free.
+        constexpr VkDeviceSize kUnboundStorageDescriptorBytes = 256;
+        // See VkBufferManager::AcquireUnboundTexelBufferDescriptor. The same 256 bytes, for the
+        // same reason plus one: a texel buffer view's range must be a whole number of texels of
+        // whatever format the placeholder is asked for, and 256 divides by every texel size in
+        // the GL image-format table (1, 2, 4, 8 and 16 bytes).
+        constexpr VkDeviceSize kUnboundTexelBufferDescriptorBytes = 256;
+
         // A zero-copy persistent buffer is created once and never recreated (the app holds
         // its mapped pointer), and may be bound to any role, so it carries every usage.
         // TRANSFER_DST is added by CreateResidentStorage.
@@ -130,6 +141,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
         }
         m_transientUploadArena.Shutdown();
+        m_unboundStorageBuffer.Destroy();
+        m_unboundTexelBuffer.Destroy();
         DestroyAllDeferredReleases();
         ReleaseAllLiveResources();
         m_copyProvider = nullptr;
@@ -218,8 +231,38 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     Bool VkBufferManager::UploadTransient(BufferKind kind, Uint32 frameIndex, const void* data,
                                           VkDeviceSize size, VkDeviceSize alignment, BufferSlice& outSlice) {
-        (void)kind;
+        if (!m_transientUploadArena.Upload(frameIndex, data, size, alignment, outSlice)) {
-        return m_transientUploadArena.Upload(frameIndex, data, size, alignment, outSlice);
+            return false;
+        }
+        if (MG_Util::PipeStats::Enabled()) {
+            // The single chokepoint for Magma's per-draw staging. Uniform is deliberately
+            // absent: its bytes are counted by the caller, which is the only place that
+            // knows whether the payload is the default block (stage-ubo-global) or a named
+            // one repacked into the ring (stage-ubo-named), and counting here as well would
+            // double every uniform byte.
+            switch (kind) {
+            case BufferKind::Vertex:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageVertexClient,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::Index:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageIndexClient,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::Indirect:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageIndirectCmd,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::TextureBuffer:
+            case BufferKind::ShaderStorage:
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
+                break;
+            case BufferKind::Uniform:
+                break;
+            }
+        }
+        return true;
     }
 
     Bool VkBufferManager::InitializeTransientArenas() {
@@ -328,6 +371,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             resource.pendingFullUpload = true;
             return false;
         }
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
+        }
         resource.pendingFullUpload = false;
         return true;
     }
@@ -342,6 +388,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                            static_cast<VkDeviceSize>(size), 16, staging)) {
             return false;
         }
+        if (MG_Util::PipeStats::Enabled()) {
+            // The staging fill is the host copy; the vkCmdCopyBuffer below is the device
+            // half of the same bytes and is not counted twice.
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
+        }
         VkCommandBuffer commandBuffer = m_copyProvider->AcquireBufferCopyCommandBuffer();
         if (commandBuffer == VK_NULL_HANDLE) {
             return false;
@@ -411,6 +462,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (!resource->buffer.Upload(bufferObject.MappedData(), size, 0)) {
             MGLOG_E_ONCE("VkBufferManager::OnRespecify: in-place upload failed");
             resource->pendingFullUpload = true;
+        } else if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
         }
     }
 
@@ -436,6 +489,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                          static_cast<VkDeviceSize>(size), static_cast<VkDeviceSize>(offset))) {
                 MGLOG_E_ONCE("VkBufferManager::OnSubData: host upload failed");
                 resource->pendingFullUpload = true;
+            } else if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
             }
             return;
         }
@@ -473,6 +529,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                          static_cast<VkDeviceSize>(size), static_cast<VkDeviceSize>(offset))) {
                 MGLOG_E_ONCE("VkBufferManager::OnFlushMappedRange: host upload failed");
                 resource->pendingFullUpload = true;
+            } else if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
             }
             return;
         }
@@ -543,6 +602,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Uint8* seed = bufferObject.MappedData();
         if (seed != nullptr) {
             resource->buffer.Upload(seed, size, 0);
+            if (MG_Util::PipeStats::Enabled()) {
+                // The one-time seed of a persistent map. Everything the app writes AFTER
+                // this goes straight through the mapping and is persistent-map-push
+                // territory (unwired, D4/D-B4), not this class.
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
+            }
         }
         resource->persistentMapped = true;
         resource->pendingFullUpload = false;
@@ -591,6 +657,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 resource->usageFlags = 0;
                 return false;
             }
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer,
+                                             static_cast<Uint64>(size));
+            }
             resource->pendingFullUpload = false;
         }
 
@@ -670,6 +740,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                            outSlice)) {
             return false;
         }
+        if (MG_Util::PipeStats::Enabled()) {
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageBuffer, static_cast<Uint64>(size));
+        }
         resource->transientSlice = outSlice;
         resource->transientFrameSerial = m_frameSerial;
         resource->transientChangeSerial = changeSerial;
@@ -706,6 +779,70 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_deferredResourceReleases[frameIndex].clear();
     }
 
+    BufferSlice VkBufferManager::AcquireUnboundStorageDescriptor() {
+        if (!m_unboundStorageBuffer.IsValid()) {
+            if (m_initInfo.allocator == nullptr) {
+                return {};
+            }
+            // Host-visible so the zero fill needs no command buffer: this can be reached from
+            // descriptor resolution, which runs inside an already-open recording and must not
+            // start a copy of its own. The size is a whole minStorageBufferOffsetAlignment-safe
+            // block rather than 4 bytes so that a shader which does read the block gets a
+            // plausible unsized-array length instead of one that rounds to zero.
+            const Bool created = m_unboundStorageBuffer.Create({
+                .allocator = m_initInfo.allocator,
+                .size = kUnboundStorageDescriptorBytes,
+                .usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT,
+                .memoryUsage = VMA_MEMORY_USAGE_AUTO,
+                .allocationFlags = VMA_ALLOCATION_CREATE_HOST_ACCESS_SEQUENTIAL_WRITE_BIT |
+                                   VMA_ALLOCATION_CREATE_MAPPED_BIT,
+                .requiredFlags = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT,
+            });
+            if (!created) {
+                MGLOG_E_ONCE("VkBufferManager::AcquireUnboundStorageDescriptor: placeholder creation failed");
+                m_unboundStorageBuffer.Destroy();
+                return {};
+            }
+            if (void* mapped = m_unboundStorageBuffer.GetMappedData()) {
+                Memset(mapped, 0, static_cast<SizeT>(kUnboundStorageDescriptorBytes));
+            }
+        }
+        return m_unboundStorageBuffer.GetSlice();
+    }
+
+    BufferSlice VkBufferManager::AcquireUnboundTexelBufferDescriptor() {
+        if (!m_unboundTexelBuffer.IsValid()) {
+            if (m_initInfo.allocator == nullptr) {
+                return {};
+            }
+            // A SECOND placeholder rather than more usage bits on the storage-block one. The two
+            // are independent failure domains: a device that refuses this allocation must not
+            // take the storage-block placeholder - and with it the fix this one is a sibling of -
+            // down with it. Host-visible and zero-filled for the same reason as that one: this is
+            // reached from descriptor resolution, inside an already-open recording, which must
+            // not start a copy of its own.
+            const Bool created = m_unboundTexelBuffer.Create({
+                .allocator = m_initInfo.allocator,
+                .size = kUnboundTexelBufferDescriptorBytes,
+                .usage = VK_BUFFER_USAGE_UNIFORM_TEXEL_BUFFER_BIT | VK_BUFFER_USAGE_STORAGE_TEXEL_BUFFER_BIT |
+                         VK_BUFFER_USAGE_TRANSFER_DST_BIT,
+                .memoryUsage = VMA_MEMORY_USAGE_AUTO,
+                .allocationFlags = VMA_ALLOCATION_CREATE_HOST_ACCESS_SEQUENTIAL_WRITE_BIT |
+                                   VMA_ALLOCATION_CREATE_MAPPED_BIT,
+                .requiredFlags = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT,
+            });
+            if (!created) {
+                MGLOG_E_ONCE("VkBufferManager::AcquireUnboundTexelBufferDescriptor: placeholder creation failed");
+                m_unboundTexelBuffer.Destroy();
+                return {};
+            }
+            if (void* mapped = m_unboundTexelBuffer.GetMappedData()) {
+                Memset(mapped, 0, static_cast<SizeT>(kUnboundTexelBufferDescriptorBytes));
+            }
+        }
+        return m_unboundTexelBuffer.GetSlice();
+    }
+
     VkBufferUsageFlags VkBufferManager::GetVkBufferUsage(BufferKind kind) {
         switch (kind) {
         case BufferKind::Vertex:

MobileGL/MG_Backend/DirectVulkan/Renderer/VkBufferManager.h

@@ -120,6 +120,27 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Bool UploadTransient(BufferKind kind, Uint32 frameIndex, const void* data, VkDeviceSize size,
                              VkDeviceSize alignment, BufferSlice& outSlice);
 
+        // The descriptor a shader storage block gets when the program declares it and the
+        // application bound no buffer at its GL binding point. GL 4.6 core 7.8 makes that a
+        // legal state - the block simply has no store, so reads are undefined and writes go
+        // nowhere - whereas Vulkan has no such thing as an unwritten descriptor, so something
+        // real has to sit in the set or the whole draw/dispatch is lost. One zero-filled
+        // buffer, created once and shared by every unbound binding: bindings that are only
+        // declared (the case this exists for) never touch it, and one that is actually read
+        // sees zeros, which is inside GL's "undefined". robustBufferAccess bounds anything
+        // that indexes past it.
+        BufferSlice AcquireUnboundStorageDescriptor();
+
+        // The store a texel-buffer descriptor - `samplerBuffer` or `imageBuffer` - gets when the
+        // unit the program's uniform names has no buffer texture on it, or the buffer texture on
+        // it has no GL buffer attached. Both are legal GL states that make a fetch return
+        // undefined values (GL 4.6 core 8.9: a buffer texture with no attached buffer object is
+        // incomplete, and sampling an incomplete texture is undefined - not a lost draw), and both
+        // used to take the whole draw or dispatch with them. The VIEW over this - one per format,
+        // and the descriptor is a VkBufferView, not a buffer - is built by
+        // UniformManager::AcquireUnboundTexelBufferView.
+        BufferSlice AcquireUnboundTexelBufferDescriptor();
+
         // Draw-time acquire for resident (device-storage) buffers: ensures the
         // resource exists and is fully uploaded, marks it used this frame.
         Bool AcquireResidentSlice(BufferKind kind, const SharedPtr<MG_State::GLState::BufferObject>& bufferObject,
@@ -180,6 +201,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         VkBufferManagerInitInfo m_initInfo{};
         BufferArena m_transientUploadArena;
+        // See AcquireUnboundStorageDescriptor. Lazily created, never re-created, torn down
+        // with the manager.
+        VkBufferObject m_unboundStorageBuffer;
+        // See AcquireUnboundTexelBufferDescriptor. Same lifetime rules.
+        VkBufferObject m_unboundTexelBuffer;
         IBufferCopyCommandProvider* m_copyProvider = nullptr;
         Vector<Vector<VkBufferObject>> m_deferredBufferReleases;
         Vector<Vector<SharedPtr<VkBufferResource>>> m_deferredResourceReleases;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkClearManager.cpp

@@ -8,7 +8,12 @@
 
 #include "VkClearManager.h"
 
+// For the shared ResolveAttachmentLayerCount (and the ToVulkanLevelExtent it is built on): the
+// clear key's layer span has to be the same one the render pass builds its attachment view from.
+#include "VkTextureManager.h"
+
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_Util/Converters/MGToStr/FramebufferEnumConverter.h"
 #include "MG_Util/Converters/MGToStr/TextureEnumConverter.h"
 
@@ -50,7 +55,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (payload.colorEncoding != ClearColorEncoding::Float) return;
         // With GL_FRAMEBUFFER_SRGB enabled GL performs the encoding itself, so the driver doing it
         // is exactly right and there is nothing to undo.
-        if (MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb)) return;
+        if (MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb)) return;
         if (ResolveSrgbAttachmentWriteFormat(destinationFormat, false) == destinationFormat) return;
 
         // sRGB -> linear (GL 4.6 core 8.24), applied to the colour channels only: alpha is stored
@@ -100,13 +105,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return ResolveAttachmentBaseArrayLayer(uploadTarget);
     }
 
-    static Uint32 ResolveAttachmentLayerCount(
+    // ResolveAttachmentLayerCount used to be duplicated here, reading attachment.GetSize().z()
-        const MG_State::GLState::FramebufferAttachmentObject& attachment) {
+    // raw - no ToVulkanLevelExtent remap for a 1D array, no six-faces arm for a cube map. That is
-        if (attachment.IsLayered()) {
+    // not a cosmetic difference: the count below is not key-only, it is written straight into
-            return static_cast<Uint32>(std::max(attachment.GetSize().z(), 1));
+    // VkImageSubresourceRange::layerCount by MaterializePendingClearForTexture, which then POPS
-        }
+    // the entry - so a layered cube map's glClear reached one face and the other five were lost
-        return 1u;
+    // for good, while the very same queued clear cleared all six through the render pass's
-    }
+    // LOAD_OP_CLEAR. The helper now lives once, in VkTextureManager.h beside ToVulkanLevelExtent.
 
     static const MG_State::GLState::FramebufferAttachmentObject* GetClearableAttachment(
         const MG_State::GLState::FramebufferObject& drawFbo, FramebufferAttachmentType attachmentType) {
@@ -122,8 +127,30 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return &attachment;
     }
 
-    PendingClearKey VkClearManager::MakePendingClearKey(MG_State::GLState::ITextureObject* texture, Uint32 mipLevel,
+    // The texture a pending clear is actually ABOUT. A clear issued through a GL texture view
+    // (ARB_texture_view) targets the storage it views, so it must queue against - and be found
+    // by - the storage texture; keying it on the view instead left the clear invisible to every
+    // materialisation done through the parent's name (and vice versa), so the image stayed in
+    // VK_IMAGE_LAYOUT_UNDEFINED and the readback was dropped as unreadable.
+    static MG_State::GLState::ITextureObject* ClearStorageTextureOf(MG_State::GLState::ITextureObject* texture) {
+        if (texture == nullptr) {
+            return nullptr;
+        }
+        const auto& storageOwner = texture->GetViewStorageOwner();
+        return storageOwner ? storageOwner.get() : texture;
+    }
+
+    PendingClearKey VkClearManager::MakePendingClearKey(MG_State::GLState::ITextureObject* rawTexture, Uint32 mipLevel,
                                                         Uint32 baseArrayLayer, Uint32 layerCount) {
+        MG_State::GLState::ITextureObject* texture = ClearStorageTextureOf(rawTexture);
+        if (rawTexture != nullptr && texture != rawTexture) {
+            // The caller named a level and a layer of the VIEW; the key describes the STORAGE, so
+            // both have to be shifted into its numbering (GL 4.6 core 8.18). Without this a clear
+            // of a view's level 0 would collide with a clear of the storage's level 0 even when
+            // the view opened onto level 1.
+            mipLevel += static_cast<Uint32>(rawTexture->GetViewMinLevel());
+            baseArrayLayer += static_cast<Uint32>(rawTexture->GetViewMinLayer());
+        }
         return PendingClearKey {
             .texture = texture,
             .textureLifetimeId = texture ? texture->GetLifetimeId() : 0,
@@ -157,6 +184,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
 
     TextureIdentity VkClearManager::MakeTextureIdentity(MG_State::GLState::ITextureObject* texture) {
+        // Same rule as VkTextureManager::MakeTextureIdentity: a GL texture view is identified by
+        // the storage it views. A clear posted against a view and one posted against its parent
+        // target the same image, so they have to coalesce rather than queue independently.
+        if (texture != nullptr) {
+            const auto& storageOwner = texture->GetViewStorageOwner();
+            if (storageOwner) {
+                texture = storageOwner.get();
+            }
+        }
         return TextureIdentity {
             .texture = texture,
             .lifetimeId = texture ? texture->GetLifetimeId() : 0,
@@ -286,9 +322,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return;
         }
 
-        const PendingClearKey key = MakePendingClearKey(texture.get());
+        const auto& storageOwner = texture->GetViewStorageOwner();
+        const SharedPtr<MG_State::GLState::ITextureObject>& storageTexture = storageOwner ? storageOwner : texture;
+        const PendingClearKey key = MakePendingClearKey(storageTexture.get());
         const std::lock_guard<std::mutex> lock(m_mutex);
-        m_aliveObjects[MakeTextureIdentity(texture.get())] = texture;
+        m_aliveObjects[MakeTextureIdentity(storageTexture.get())] = storageTexture;
         auto& pending = m_pendingClears[key];
         MergeClearPayload(pending, clearPayload);
         m_pendingCount.store(static_cast<Uint32>(m_pendingClears.size()), std::memory_order_relaxed);
@@ -305,8 +343,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         const PendingClearKey key = MakePendingClearKey(attachment);
+        // The alive entry must hold the STORAGE object, because the key names it:
+        // LockTextureIdentityLocked cross-checks the two, and registering a view here under its
+        // storage's identity made every lookup of this clear fail that check and silently report
+        // "nothing pending" - which is how a clear issued through a view's framebuffer vanished.
+        const auto& storageOwner = texture->GetViewStorageOwner();
+        const SharedPtr<MG_State::GLState::ITextureObject>& storageTexture = storageOwner ? storageOwner : texture;
         const std::lock_guard<std::mutex> lock(m_mutex);
-        m_aliveObjects[MakeTextureIdentity(texture.get())] = texture;
+        m_aliveObjects[MakeTextureIdentity(storageTexture.get())] = storageTexture;
         auto& pending = m_pendingClears[key];
         MergeClearPayload(pending, clearPayload);
         m_pendingCount.store(static_cast<Uint32>(m_pendingClears.size()), std::memory_order_relaxed);
@@ -321,6 +365,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;  // per-draw hot path: nothing pending anywhere
         }
 
+        texture = ClearStorageTextureOf(texture);
         const Uint64 lifetimeId = texture->GetLifetimeId();
         const std::lock_guard<std::mutex> lock(m_mutex);
         for (auto it = m_pendingClears.begin(); it != m_pendingClears.end(); ++it) {
@@ -411,6 +456,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;  // per-draw hot path: nothing pending anywhere
         }
 
+        texture = ClearStorageTextureOf(texture);
         const Uint64 lifetimeId = texture->GetLifetimeId();
         const std::lock_guard<std::mutex> lock(m_mutex);
         SharedPtr<MG_State::GLState::ITextureObject> liveTexture;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkClearManager.h

@@ -114,7 +114,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     class VkClearManager {
     public:
         static PendingClearKey MakePendingClearKey(const MG_State::GLState::FramebufferAttachmentObject& attachment);
-        static PendingClearKey MakePendingClearKey(MG_State::GLState::ITextureObject* texture, Uint32 mipLevel = 0,
+        // Resolves a GL texture view to the storage it views before keying; see the definition.
+        static PendingClearKey MakePendingClearKey(MG_State::GLState::ITextureObject* rawTexture, Uint32 mipLevel = 0,
                                                    Uint32 baseArrayLayer = 0, Uint32 layerCount = 1);
 
         Bool Initialize();

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.cpp

@@ -13,6 +13,7 @@
 #include "MG_Util/Converters/MGToStr/FramebufferEnumConverter.h"
 #include "MG_Util/Converters/MGToVk/TextureEnumConverter.h"
 #include "MG_Util/Metrics/TextureMetrics.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 
 namespace MobileGL::MG_Backend::DirectVulkan {
     static Bool TryResolveSampleCountFlagBits(Int requestedSamples, VkSampleCountFlagBits& outSampleCount) {
@@ -67,28 +68,58 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
 
     static Uint32 ResolveAttachmentBaseArrayLayer(const MG_State::GLState::FramebufferAttachmentObject& attachment) {
+        // Every branch has to go through ToStorageArrayLayer, including the two that name layer 0
+        // implicitly: a layered attachment of a texture VIEW starts at the view's first layer, not
+        // at the image's, and a cube FACE index is a layer index like any other. Leaving either
+        // unshifted made the render pass write layers [0, n) while the clear key, the blit, the
+        // copy and the readback for the same attachment all addressed [minLayer, minLayer + n) -
+        // they resolve the layer through their own copies of this helper, which do shift.
+        const auto* texture = attachment.GetTexture().get();
         if (attachment.IsLayered()) {
-            return 0;
+            return ToStorageArrayLayer(texture, 0);
         }
         const TextureUploadTarget uploadTarget = attachment.GetTextureUploadTarget();
         if (!IsCubeMapFaceUploadTarget(uploadTarget)) {
-            return static_cast<Uint32>(std::max(attachment.GetTextureLayer(), 0));
+            return ToStorageArrayLayer(texture, attachment.GetTextureLayer());
         }
-        return static_cast<Uint32>(uploadTarget) - static_cast<Uint32>(TextureUploadTarget::CubeMapPositiveX);
+        const Int face =
+            static_cast<Int>(uploadTarget) - static_cast<Int>(TextureUploadTarget::CubeMapPositiveX);
+        return ToStorageArrayLayer(texture, face);
     }
 
-    static Uint32 ResolveAttachmentLayerCount(const MG_State::GLState::FramebufferAttachmentObject& attachment) {
+    // ResolveAttachmentLayerCount lives in VkTextureManager.h, beside ToVulkanLevelExtent, because
-        if (attachment.IsLayered()) {
+    // VkClearManager needs the SAME answer: its pending-clear key's layerCount becomes a real
-            return static_cast<Uint32>(std::max(attachment.GetSize().z(), 1));
+    // VkImageSubresourceRange when a clear is materialised outside a render pass. See the header.
-        }
-        return 1u;
-    }
 
+    // VUID-VkFramebufferCreateInfo-flags-04113: every view handed to vkCreateFramebuffer must have
+    // been created as VK_IMAGE_VIEW_TYPE_2D or VK_IMAGE_VIEW_TYPE_2D_ARRAY. The image's OWN view
+    // type is not a legal answer for several of the targets GL can attach, and returning it
+    // unchanged is what took the process down on every layered 3D / cube-map-array attachment:
+    // a 3D view is refused outright by the layer-span guard in GetOrCreateAttachmentViewAtMipLevel
+    // (3D images have arrayLayers == 1) and a CUBE_ARRAY view is built happily and then rejected -
+    // or dereferenced - by the driver inside vkCreateFramebuffer.
+    //
+    // A 2D_ARRAY view is the legal spelling of all three: over a 2D-array-compatible 3D image its
+    // "layers" are the mip's z slices (VUID-VkImageViewCreateInfo-image-04970), and over a
+    // CUBE_COMPATIBLE 2D image - which is what both cube targets are - its layers are the faces.
+    //
+    // Knowingly NOT remapped: VK_IMAGE_VIEW_TYPE_1D / _1D_ARRAY, which 04113 also forbids. There is
+    // no legal alternative for them (a VK_IMAGE_TYPE_1D image admits no 2D-family view at all), so
+    // the only honest answer would be to decline the attachment - and every driver this has run on,
+    // lavapipe included, accepts them. Declining would turn working GL_TEXTURE_1D[_ARRAY] render
+    // targets into skipped draws to satisfy a VU nothing enforces. Left as-is, deliberately.
     static VkImageViewType ResolveAttachmentViewType(
         const MG_State::GLState::FramebufferAttachmentObject& attachment,
         const VkTextureManager::TextureResource& resource) {
         if (attachment.IsLayered()) {
-            return resource.viewType;
+            switch (resource.viewType) {
+            case VK_IMAGE_VIEW_TYPE_3D:
+            case VK_IMAGE_VIEW_TYPE_CUBE:
+            case VK_IMAGE_VIEW_TYPE_CUBE_ARRAY:
+                return VK_IMAGE_VIEW_TYPE_2D_ARRAY;
+            default:
+                return resource.viewType;
+            }
         }
         // A non-layered attachment names ONE layer, so the view over it is a plain 2D view whatever
         // the image's own view type is. The cube-face upload targets always meant this; a cube map
@@ -96,8 +127,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // a single layer is not a legal attachment. The CUBE arm is inert today - no frontend path
         // produces a non-layered cube attachment without a face upload target - and is kept for
         // symmetry with CUBE_ARRAY.
+        //
+        // 3D belongs in the same list and was missing from it, which is why the "per-slice
+        // attachment view is a 2D view whose array layer is the slice" branch in
+        // GetOrCreateAttachmentViewAtMipLevel was unreachable: glFramebufferTextureLayer on a
+        // GL_TEXTURE_3D asked for a 3D view (illegal as an attachment) whose span was then checked
+        // against arrayLayers == 1, so every slice above z = 0 came back VK_NULL_HANDLE.
         if (IsCubeMapFaceUploadTarget(attachment.GetTextureUploadTarget()) ||
-            resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE_ARRAY || resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE) {
+            resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE_ARRAY || resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE ||
+            resource.viewType == VK_IMAGE_VIEW_TYPE_3D) {
             return VK_IMAGE_VIEW_TYPE_2D;
         }
         return resource.viewType;
@@ -318,47 +356,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         const auto internalFormat = renderbuffer->GetInternalFormat();
-        // Three-channel color formats widen to their RGBA twin exactly like textures do
+        // ONE resolver, shared with textures (VkTextureManager::ResolveTextureFormatInfo), so a
-        // (VkTextureManager::ResolveTextureFormatInfo): blits/resolves between a
+        // renderbuffer and a texture of the same GL format cannot disagree about their VkFormat.
-        // renderbuffer and a texture of the same GL format then see one VkFormat.
+        // `expandRgbToRgba` / `componentByteCount` / `alphaBytes` describe how to reshape a SHADOW
-        const VkFormat format = [&]() -> VkFormat {
+        // UPLOAD, and a renderbuffer has none, so only `.format` is taken.
-            switch (internalFormat) {
+        //
-            case TextureInternalFormat::RGB:
+        // This used to be a hand-maintained second copy of that table, and it was missing exactly
-            case TextureInternalFormat::RGB8:
+        // four rows: RGBA2 and RGBA12 fell through to ConvertTextureInternalFormatToVkEnum's
-            case TextureInternalFormat::R3G3B2:
+        // VK_FORMAT_UNDEFINED (no image at all - bound as a draw buffer the attachment became
-            case TextureInternalFormat::RGB4:
+        // VK_ATTACHMENT_UNUSED and every draw into it was dropped), while RGBA4 and RGB5A1 fell
-            case TextureInternalFormat::RGB5:
+        // through to the 16-bit packed formats and then faced 32-bit R8G8B8A8_UNORM textures across
-                return VK_FORMAT_R8G8B8A8_UNORM;
+        // a size-incompatible vkCmdCopyImage.
-            case TextureInternalFormat::SRGB8:
+        const VkFormat format = ResolveTextureFormatInfo(internalFormat).format;
-                return VK_FORMAT_R8G8B8A8_SRGB;
-            case TextureInternalFormat::RGB8Snorm:
-                return VK_FORMAT_R8G8B8A8_SNORM;
-            case TextureInternalFormat::RGB10:
-            case TextureInternalFormat::RGB12:
-            case TextureInternalFormat::RGB16:
-                return VK_FORMAT_R16G16B16A16_UNORM;
-            case TextureInternalFormat::RGB16Snorm:
-                return VK_FORMAT_R16G16B16A16_SNORM;
-            case TextureInternalFormat::RGB16F:
-                return VK_FORMAT_R16G16B16A16_SFLOAT;
-            case TextureInternalFormat::RGB32F:
-                return VK_FORMAT_R32G32B32A32_SFLOAT;
-            case TextureInternalFormat::RGB8I:
-                return VK_FORMAT_R8G8B8A8_SINT;
-            case TextureInternalFormat::RGB8UI:
-                return VK_FORMAT_R8G8B8A8_UINT;
-            case TextureInternalFormat::RGB16I:
-                return VK_FORMAT_R16G16B16A16_SINT;
-            case TextureInternalFormat::RGB16UI:
-                return VK_FORMAT_R16G16B16A16_UINT;
-            case TextureInternalFormat::RGB32I:
-                return VK_FORMAT_R32G32B32A32_SINT;
-            case TextureInternalFormat::RGB32UI:
-                return VK_FORMAT_R32G32B32A32_UINT;
-            default:
-                return MG_Util::ConvertTextureInternalFormatToVkEnum(internalFormat);
-            }
-        }();
         const VkImageAspectFlags aspect = ResolveImageAspectMaskForFormat(format);
         // Renderbuffers are never sampled (GL has no way to bind one to a sampler), so the
         // usage set is attachment + transfer: transfer covers readback (vkCmdCopyImageToBuffer),
@@ -602,7 +611,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // sRGB attachments switch between their sRGB and UNORM-twin views with this
         // capability (ResolveSrgbAttachmentWriteFormat), changing the render pass formats.
         const Bool framebufferSrgbEnabled =
-            MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
+            MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
         XXHASH_VERIFY(XXH64_update(m_hashState, &framebufferSrgbEnabled, sizeof(framebufferSrgbEnabled)));
         auto& drawBuffers = fbo.GetDrawBuffers();
         XXHASH_VERIFY(XXH64_update(m_hashState, drawBuffers.data(), drawBuffers.size() * sizeof(drawBuffers[0])));
@@ -633,11 +642,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             if (att.IsTexture()) {
                 const Uint64 textureLifetimeId = att.GetTexture()->GetLifetimeId();
                 XXHASH_VERIFY(XXH64_update(m_hashState, &textureLifetimeId, sizeof(textureLifetimeId)));
-                const Int textureLevel = att.GetTextureLevel();
+                const Int textureLevel = static_cast<Int>(ToStorageMipLevel(att.GetTexture().get(),
+                                                                             att.GetTextureLevel()));
                 XXHASH_VERIFY(XXH64_update(m_hashState, &textureLevel, sizeof(textureLevel)));
                 const TextureUploadTarget textureUploadTarget = att.GetTextureUploadTarget();
                 XXHASH_VERIFY(XXH64_update(m_hashState, &textureUploadTarget, sizeof(textureUploadTarget)));
-                const Int textureLayer = att.GetTextureLayer();
+                const Int textureLayer = static_cast<Int>(ToStorageArrayLayer(att.GetTexture().get(),
+                                                                              att.GetTextureLayer()));
                 XXHASH_VERIFY(XXH64_update(m_hashState, &textureLayer, sizeof(textureLayer)));
                 const Bool textureLayered = att.IsLayered();
                 XXHASH_VERIFY(XXH64_update(m_hashState, &textureLayered, sizeof(textureLayered)));
@@ -754,7 +765,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return XXH64_digest(m_hashState);
     }
 
-    RenderPassEntry& VkRenderPassManager::GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
+    RenderPassEntry* VkRenderPassManager::GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
                                                                 Uint32 swapchainImageIndex,
                                                                 Bool drawUsesDepthStencil) {
         // Resolve the default-FBO depth flavor (see the header comment): keep the
@@ -840,7 +851,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             auto activeIt = m_renderPasses.find(activeRenderPass->hash);
             if (activeIt != m_renderPasses.end()) {
                 activeIt->second.lastUsedFrame = m_frameCounter;
-                return activeIt->second;
+                return &activeIt->second;
             }
         }
 
@@ -864,13 +875,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             m_rpFastRenderPassHash = activeRenderPass->hash;
             m_rpFastHadDepthStencil = activeIt->second.hasDepthStencilAttachment;
             activeIt->second.lastUsedFrame = m_frameCounter;
-            return activeIt->second;
+            return &activeIt->second;
         }
         auto hash = ComputeHash(fbo, swapchainImageIndex, true, includeDefaultFboDepthStencil);
         auto it = m_renderPasses.find(hash);
         if (it != m_renderPasses.end()) {
             it->second.lastUsedFrame = m_frameCounter;
-            return it->second;
+            return &it->second;
         }
 
         Bool isDefaultFbo = fbo.IsDefaultFramebuffer();
@@ -952,7 +963,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
                     const VkImageLayout trackedRbLayout = rbResource->layout;
                     const Bool rbFramebufferSrgb =
-                        MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
+                        MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
                     const VkFormat rbAttachmentFormat =
                         ResolveSrgbAttachmentWriteFormat(rbResource->format, rbFramebufferSrgb);
                     rbDesc.flags = 0;
@@ -993,8 +1004,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     textureResources.emplace_back(nullptr);
                     attachmentViews.emplace_back(rbAttachmentFormat != rbResource->format ? rbResource->unormTwinView
                                                                                           : rbResource->view);
-                    MOBILEGL_ASSERT(attachmentViews.back() != VK_NULL_HANDLE,
+                    if (attachmentViews.back() == VK_NULL_HANDLE) {
-                                    "GetOrCreateRenderPass: renderbuffer view missing at color attachment %d", i);
+                        MGLOG_E_ONCE("GetOrCreateRenderPass: renderbuffer %u has no usable view for color attachment "
+                                     "%u on FBO %u; declining the render pass",
+                                     renderbuffer->GetExternalIndex(), i, fbo.GetExternalIndex());
+                        return nullptr;
+                    }
 
                     colorAttachmentRefs[i].attachment = rbAttachmentIndex;
                     continue;
@@ -1006,7 +1021,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 continue;
 
             auto& att = fbo.GetAttachment(drawbuf);
-            const Uint32 attachmentMipLevel = static_cast<Uint32>(std::max(att.GetTextureLevel(), 0));
+            const Uint32 attachmentMipLevel = ToStorageMipLevel(att.GetTexture().get(), att.GetTextureLevel());
             const auto textureTarget = texture->GetTarget();
             const Uint32 attachmentIndex = static_cast<Uint32>(attachmentDescriptions.size());
             attachmentDescriptions.emplace_back();
@@ -1049,8 +1064,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                             .key = VkClearManager::MakePendingClearKey(att)
                         });
                     }
-                    const IntVec2 attachmentExtent =
+                    // Same remap as ResolveAttachmentLayerCount, for the same reason: a
-                        ResolveRenderPassFramebufferExtent(isDefaultFbo, att.GetSize(), swapchainExtent);
+                    // 1D-array attachment's GL height is its layer count, and using it as the
+                    // framebuffer height asks for a framebuffer taller than the VK_IMAGE_TYPE_1D
+                    // image it is built over.
+                    const IntVec2 attachmentExtent = ResolveRenderPassFramebufferExtent(
+                        isDefaultFbo, ToVulkanLevelExtent(texture->GetTarget(), att.GetSize()), swapchainExtent);
                     if (width == 0)
                         width = attachmentExtent.x();
                     if (height == 0)
@@ -1078,12 +1097,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         attachmentViews.emplace_back(swapchainViews[swapchainImageIndex]);
                     } else {
                         auto* textureResource = m_textureManager.SyncTextureAndGetDescriptor(*texture);
-                        MOBILEGL_ASSERT(textureResource,
+                        if (textureResource == nullptr) {
-                                        "GetOrCreateRenderPass: SyncTextureAndGetDescriptor failed at color attachment %d", i);
+                            // SyncTextureResource legitimately declines - an unsupported format,
+                            // sample count or image-flag combination, or a vkCreateImage the driver
+                            // refused. There is no image to attach, so there is no render pass.
+                            MGLOG_E_ONCE("GetOrCreateRenderPass: textureId=%d could not be backed for color "
+                                         "attachment %u on FBO %u; declining the render pass",
+                                         texture->GetExternalIndex(), i, fbo.GetExternalIndex());
+                            return nullptr;
+                        }
                         textureResources.emplace_back(textureResource);
                         desc.format = ResolveSrgbAttachmentWriteFormat(
                             textureResource->format,
-                            MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb));
+                            MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb));
                         attachmentSampleCount = textureResource->sampleCount;
                         trackedColorLayout = textureResource->layout;
                         trackedAttachmentLayouts.emplace_back(TrackedAttachmentLayoutInfo {
@@ -1100,8 +1126,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         attachmentViews.emplace_back(
                             m_textureManager.GetOrCreateAttachmentViewAtMipLevel(
                                 *texture, attachmentMipLevel, baseArrayLayer, layerCount, attachmentViewType));
-                        MOBILEGL_ASSERT(attachmentViews.back() != VK_NULL_HANDLE,
+                        if (attachmentViews.back() == VK_NULL_HANDLE) {
-                                        "GetOrCreateRenderPass: GetOrCreateAttachmentView failed at color attachment %d", i);
+                            MGLOG_E_ONCE("GetOrCreateRenderPass: no attachment view for textureId=%d mip=%u layers "
+                                         "[%u, %u) viewType=%d at color attachment %u on FBO %u; declining the "
+                                         "render pass",
+                                         texture->GetExternalIndex(), attachmentMipLevel, baseArrayLayer,
+                                         baseArrayLayer + layerCount, static_cast<Int>(attachmentViewType), i,
+                                         fbo.GetExternalIndex());
+                            return nullptr;
+                        }
                     }
                     desc.samples = attachmentSampleCount;
                     adoptRenderPassSampleCount(attachmentSampleCount, "color", texture->GetExternalIndex());
@@ -1144,7 +1177,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             if (a.IsTexture() && b.IsTexture()) {
                 return a.GetTexture().get() == b.GetTexture().get() &&
                        a.GetTextureUploadTarget() == b.GetTextureUploadTarget() &&
-                       a.GetTextureLevel() == b.GetTextureLevel();
+                       ToStorageMipLevel(a.GetTexture().get(), a.GetTextureLevel()) ==
+                           ToStorageMipLevel(b.GetTexture().get(), b.GetTextureLevel());
             }
             if (a.IsRenderbuffer() && b.IsRenderbuffer()) {
                 return a.GetRenderbuffer().get() == b.GetRenderbuffer().get();
@@ -1193,20 +1227,29 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             } else if (selectedDepthStencilAttachment->IsTexture()) {
                 auto& texture = *selectedDepthStencilAttachment->GetTexture();
                 depthTextureResource = m_textureManager.SyncTextureAndGetDescriptor(texture);
-                MOBILEGL_ASSERT(depthTextureResource,
+                if (depthTextureResource == nullptr) {
-                                "GetOrCreateRenderPass: SyncTextureAndGetDescriptor failed at depth attachment");
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: textureId=%d could not be backed for the depth/stencil "
+                                 "attachment of FBO %u; declining the render pass",
+                                 texture.GetExternalIndex(), fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 trackedDepthLayout = depthTextureResource->layout;
                 depthAttachmentDescription.format = depthTextureResource->format;
                 depthAttachmentSampleCount = depthTextureResource->sampleCount;
                 depthAttachmentId = static_cast<Int>(texture.GetExternalIndex());
-                attachmentExtent =
+                attachmentExtent = ResolveRenderPassFramebufferExtent(
-                    ResolveRenderPassFramebufferExtent(isDefaultFbo, selectedDepthStencilAttachment->GetSize(),
+                    isDefaultFbo,
-                                                       swapchainExtent);
+                    ToVulkanLevelExtent(texture.GetTarget(), selectedDepthStencilAttachment->GetSize()),
+                    swapchainExtent);
             } else {
                 const auto& renderbuffer = selectedDepthStencilAttachment->GetRenderbuffer();
                 depthRenderbufferResource = GetOrCreateRenderbufferResource(renderbuffer);
-                MOBILEGL_ASSERT(depthRenderbufferResource,
+                if (depthRenderbufferResource == nullptr) {
-                                "GetOrCreateRenderPass: GetOrCreateRenderbufferResource failed at depth attachment");
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: renderbuffer %u could not be backed for the depth/stencil "
+                                 "attachment of FBO %u; declining the render pass",
+                                 renderbuffer->GetExternalIndex(), fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 trackedDepthLayout = depthRenderbufferResource->layout;
                 depthAttachmentDescription.format = depthRenderbufferResource->format;
                 depthAttachmentSampleCount = depthRenderbufferResource->sampleCount;
@@ -1254,7 +1297,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             } else if (selectedDepthStencilAttachment->IsTexture()) {
                 auto& texture = *selectedDepthStencilAttachment->GetTexture();
                 const Uint32 attachmentMipLevel =
-                    static_cast<Uint32>(std::max(selectedDepthStencilAttachment->GetTextureLevel(), 0));
+                    ToStorageMipLevel(selectedDepthStencilAttachment->GetTexture().get(),
+                                      selectedDepthStencilAttachment->GetTextureLevel());
                 MOBILEGL_ASSERT(depthTextureResource->layout != VK_IMAGE_LAYOUT_UNDEFINED ||
                                     depthAttachmentDescription.loadOp != VK_ATTACHMENT_LOAD_OP_LOAD,
                                 "GetOrCreateRenderPass: depth attachment textureId=%d has undefined tracked layout with LOAD_OP_LOAD",
@@ -1279,8 +1323,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 attachmentViews.emplace_back(
                     m_textureManager.GetOrCreateAttachmentViewAtMipLevel(
                         texture, attachmentMipLevel, baseArrayLayer, layerCount, attachmentViewType));
-                MOBILEGL_ASSERT(attachmentViews.back() != VK_NULL_HANDLE,
+                if (attachmentViews.back() == VK_NULL_HANDLE) {
-                                "GetOrCreateRenderPass: GetOrCreateAttachmentView failed at depth attachment");
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: no attachment view for textureId=%d mip=%u layers [%u, %u) "
+                                 "viewType=%d at the depth/stencil attachment of FBO %u; declining the render pass",
+                                 texture.GetExternalIndex(), attachmentMipLevel, baseArrayLayer,
+                                 baseArrayLayer + layerCount, static_cast<Int>(attachmentViewType),
+                                 fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 if (width == 0 || height == 0) {
                     width = attachmentExtent.x();
                     height = attachmentExtent.y();
@@ -1302,6 +1352,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 });
                 textureResources.emplace_back(nullptr);
                 attachmentViews.emplace_back(depthRenderbufferResource->view);
+                if (attachmentViews.back() == VK_NULL_HANDLE) {
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: renderbuffer %u has no usable view for the depth/stencil "
+                                 "attachment of FBO %u; declining the render pass",
+                                 renderbuffer->GetExternalIndex(), fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 if (width == 0 || height == 0) {
                     width = attachmentExtent.x();
                     height = attachmentExtent.y();
@@ -1399,8 +1455,25 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         renderPassCreateInfo.dependencyCount = 2;
         renderPassCreateInfo.pDependencies = subpassDependencies;
 
+        // NOT VK_VERIFY. VkIncludes.h states the rule this function now lives by: VK_VERIFY is the
+        // INVARIANT check - a should-never-happen state, fatal-logged unlatched and trapped in a
+        // DEBUG build - and "a soft, recoverable failure must therefore NOT be routed through
+        // VK_VERIFY. Check the VkResult directly and report it with MGLOG_E_ONCE". A decline here
+        // is recoverable by construction: the caller drops the draw. Routing it through VK_VERIFY
+        // would have made the recovery dead code in a DEBUG build (the TRAP fires inside the macro,
+        // before the handle is ever examined) and, in an INFO build, printed an UNLATCHED fatal
+        // line on every draw for the life of the process - a decline caches nothing, so every
+        // later draw to the same framebuffer re-enters this path and fails again.
         VkRenderPass renderPass = VK_NULL_HANDLE;
-        VK_VERIFY(vkCreateRenderPass(m_device, &renderPassCreateInfo, nullptr, &renderPass));
+        const VkResult renderPassResult =
+            vkCreateRenderPass(m_device, &renderPassCreateInfo, nullptr, &renderPass);
+        if (renderPassResult != VK_SUCCESS || renderPass == VK_NULL_HANDLE) {
+            MGLOG_E_ONCE("GetOrCreateRenderPass: vkCreateRenderPass failed (%s, %d) for FBO %u; declining the "
+                         "render pass",
+                         VkResultToString(renderPassResult), static_cast<Int>(renderPassResult),
+                         fbo.GetExternalIndex());
+            return nullptr;
+        }
 
         // Framebuffer
         VkFramebufferCreateInfo framebufferCreateInfo;
@@ -1413,8 +1486,21 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         framebufferCreateInfo.width = width;
         framebufferCreateInfo.height = height;
         framebufferCreateInfo.layers = framebufferLayers;
+        // Direct VkResult check, for the same reason as vkCreateRenderPass above.
         VkFramebuffer framebuffer = VK_NULL_HANDLE;
-        VK_VERIFY(vkCreateFramebuffer(m_device, &framebufferCreateInfo, nullptr, &framebuffer));
+        const VkResult framebufferResult =
+            vkCreateFramebuffer(m_device, &framebufferCreateInfo, nullptr, &framebuffer);
+        if (framebufferResult != VK_SUCCESS || framebuffer == VK_NULL_HANDLE) {
+            // The render pass has no entry to own it yet, so it is destroyed here rather than
+            // leaked - RenderPassEntry's destructor is the only other thing that would.
+            MGLOG_E_ONCE("GetOrCreateRenderPass: vkCreateFramebuffer failed (%s, %d) for FBO %u (%dx%d, "
+                         "%u attachments, %u layers); declining the render pass",
+                         VkResultToString(framebufferResult), static_cast<Int>(framebufferResult),
+                         fbo.GetExternalIndex(), width, height,
+                         static_cast<Uint32>(attachmentViews.size()), framebufferLayers);
+            vkDestroyRenderPass(m_device, renderPass, nullptr);
+            return nullptr;
+        }
         IntVec2 extent = {width, height};
         RenderPassEntry renderPassEntry {
             hash,
@@ -1439,7 +1525,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 extent.y());
         auto [insertedIt, _] = m_renderPasses.emplace(hash, Move(renderPassEntry));
         insertedIt->second.lastUsedFrame = m_frameCounter;
-        return insertedIt->second;
+        return &insertedIt->second;
     }
 
     void VkRenderPassManager::OnPresent() {

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.h

@@ -243,9 +243,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // draw against a depth-less active pass resolves to a new (incompatible)
         // entry, which the caller's compatibility check turns into a pass split;
         // the new pass's depth loads DONT_CARE (content was undefined all along).
-        RenderPassEntry& GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
+        //
-                                               Uint32 swapchainImageIndex,
+        // Returns NULLPTR when this framebuffer cannot be represented as a Vulkan render pass at
-                                               Bool drawUsesDepthStencil = true);
+        // all - a texture the texture manager declined to back (an unsupported format or sample
+        // count), or an attachment view it cannot construct (a layer span the image has no room
+        // for, a 3D image whose format was refused 2D-array compatibility). This used to be
+        // unrepresentable: the function returned a reference, so the only thing the two fallible
+        // calls it builds on could do was trip a MOBILEGL_ASSERT - which is compiled out of every
+        // INFO build - and then dereference the null resource, or hand VK_NULL_HANDLE to
+        // vkCreateFramebuffer. That took the whole process down (51 lost CTS records over 21
+        // bodies, one runner restart each) where a declined draw is merely a wrong picture.
+        //
+        // EVERY caller must handle nullptr by dropping the operation, exactly as the draw path
+        // already drops a draw whose sampler descriptor could not be resolved
+        // (UniformManager::BindProgramUniformBuffers). The failure paths log MGLOG_E_ONCE
+        // themselves, so a caller needs no message of its own.
+        [[nodiscard]] RenderPassEntry* GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
+                                                             Uint32 swapchainImageIndex,
+                                                             Bool drawUsesDepthStencil = true);
         void QueueRenderbufferClear(GLbitfield mask, const ClearFramebufferPayload& clearPayload,
                                     const MG_State::GLState::FramebufferObject& drawFbo);
         void QueueRenderbufferClear(const ClearAttachmentPayload& clearPayload,

MobileGL/MG_Backend/DirectVulkan/Renderer/VkSamplerManager.cpp

@@ -21,6 +21,156 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                    sampler.GetWrapR() == SamplerWrapMode::ClampToBorder;
         }
 
+        // The numeric domain the texture is SAMPLED in. Vulkan splits VkBorderColor into a float
+        // family and an integer family and requires the sampler's choice to match the image view's
+        // format (a float border on an integer view, or the reverse, is undefined) - so the domain
+        // comes from the TEXTURE, while the value comes from whichever GL entry point wrote it.
+        enum class BorderColorDomain {
+            Float,
+            SignedInteger,
+            UnsignedInteger
+        };
+
+        BorderColorDomain ResolveBorderColorDomain(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::R8I:
+            case TextureInternalFormat::R16I:
+            case TextureInternalFormat::R32I:
+            case TextureInternalFormat::RG8I:
+            case TextureInternalFormat::RG16I:
+            case TextureInternalFormat::RG32I:
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGB32I:
+            case TextureInternalFormat::RGBA8I:
+            case TextureInternalFormat::RGBA16I:
+            case TextureInternalFormat::RGBA32I:
+                return BorderColorDomain::SignedInteger;
+            case TextureInternalFormat::R8UI:
+            case TextureInternalFormat::R16UI:
+            case TextureInternalFormat::R32UI:
+            case TextureInternalFormat::RG8UI:
+            case TextureInternalFormat::RG16UI:
+            case TextureInternalFormat::RG32UI:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGB32UI:
+            case TextureInternalFormat::RGBA8UI:
+            case TextureInternalFormat::RGBA16UI:
+            case TextureInternalFormat::RGBA32UI:
+            case TextureInternalFormat::RGB10A2UI:
+                return BorderColorDomain::UnsignedInteger;
+            default:
+                return BorderColorDomain::Float;
+            }
+        }
+
+        Bool IsSignedNormalizedFormat(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::R8Snorm:
+            case TextureInternalFormat::R16Snorm:
+            case TextureInternalFormat::RG8Snorm:
+            case TextureInternalFormat::RG16Snorm:
+            case TextureInternalFormat::RGB8Snorm:
+            case TextureInternalFormat::RGB16Snorm:
+            case TextureInternalFormat::RGBA8Snorm:
+            case TextureInternalFormat::RGBA16Snorm:
+                return true;
+            default:
+                return false;
+            }
+        }
+
+        // GL 4.6 core 8.14.2: "The border values are clamped before they are used, according to the
+        // format in which texture components are stored. For signed and unsigned normalized
+        // fixed-point formats, border values are clamped to [-1,1] and [0,1] respectively. For
+        // floating-point and integer formats, border values are clamped to the representable range of
+        // the format." Every clause of that sentence is a real case here - the clamp is not just the
+        // normalized one.
+        //
+        // Only the 32-bit float formats are genuinely unclamped: every finite float is representable
+        // in them. Half-float has a finite maximum, and the two packed "float" formats are UNSIGNED,
+        // so a negative border on them must come back as 0 rather than as a negative number the
+        // driver delivers verbatim through VK_BORDER_COLOR_FLOAT_CUSTOM_EXT.
+        struct FloatBorderRange {
+            Bool clamped = true;
+            Float minValue = 0.0f;
+            Float maxValue = 1.0f;
+        };
+
+        FloatBorderRange ResolveFloatBorderRange(TextureInternalFormat format, Bool isSignedNormalized) {
+            switch (format) {
+            case TextureInternalFormat::R32F:
+            case TextureInternalFormat::RG32F:
+            case TextureInternalFormat::RGB32F:
+            case TextureInternalFormat::RGBA32F:
+                return {false, 0.0f, 0.0f};
+            case TextureInternalFormat::R16F:
+            case TextureInternalFormat::RG16F:
+            case TextureInternalFormat::RGB16F:
+            case TextureInternalFormat::RGBA16F:
+                return {true, -65504.0f, 65504.0f};
+            // Unsigned packed floats: no sign bit at all. 65024 is the largest 11-bit float; the
+            // 10-bit blue channel tops out lower (64512) and RGB9E5 higher (65408), but the bound
+            // that matters for correctness is the lower one, and a single conservative upper bound
+            // costs nothing a real border colour will ever notice.
+            case TextureInternalFormat::R11FG11FB10F:
+                return {true, 0.0f, 64512.0f};
+            case TextureInternalFormat::RGB9E5:
+                return {true, 0.0f, 65408.0f};
+            default:
+                return {true, isSignedNormalized ? -1.0f : 0.0f, 1.0f};
+            }
+        }
+
+        // Per-component representable range of an integer texture format, as Int64 so that the whole
+        // signed and unsigned 32-bit ranges are expressible in one type and the clamp can be written
+        // once for both domains. Alpha is carried separately because RGB10_A2UI is the one format
+        // whose alpha is narrower than its colour channels.
+        struct IntegerBorderRange {
+            Int64 rgbMin = 0;
+            Int64 rgbMax = 0;
+            Int64 alphaMin = 0;
+            Int64 alphaMax = 0;
+        };
+
+        IntegerBorderRange ResolveIntegerBorderRange(TextureInternalFormat format) {
+            const auto uniform = [](Int64 low, Int64 high) { return IntegerBorderRange{low, high, low, high}; };
+            switch (format) {
+            case TextureInternalFormat::R8I:
+            case TextureInternalFormat::RG8I:
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGBA8I:
+                return uniform(-128, 127);
+            case TextureInternalFormat::R16I:
+            case TextureInternalFormat::RG16I:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGBA16I:
+                return uniform(-32768, 32767);
+            case TextureInternalFormat::R8UI:
+            case TextureInternalFormat::RG8UI:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGBA8UI:
+                return uniform(0, 255);
+            case TextureInternalFormat::R16UI:
+            case TextureInternalFormat::RG16UI:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGBA16UI:
+                return uniform(0, 65535);
+            case TextureInternalFormat::R32UI:
+            case TextureInternalFormat::RG32UI:
+            case TextureInternalFormat::RGB32UI:
+            case TextureInternalFormat::RGBA32UI:
+                return uniform(0, 4294967295LL);
+            case TextureInternalFormat::RGB10A2UI:
+                return {0, 1023, 0, 3};
+            default:
+                // The signed 32-bit formats, and anything unexpected: the full int32 range, i.e. a
+                // clamp that cannot alter a value the GL entry points could have carried.
+                return uniform(-2147483648LL, 2147483647LL);
+            }
+        }
+
         Bool IsDepthTextureFormat(TextureInternalFormat format) {
             switch (format) {
             case TextureInternalFormat::DepthComponent:
@@ -72,6 +222,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_config = initInfo.config;
         m_samplerAnisotropySupported = initInfo.samplerAnisotropySupported;
         m_maxSamplerAnisotropy = std::max(initInfo.maxSamplerAnisotropy, 1.0f);
+        m_customBorderColorSupported = initInfo.customBorderColorSupported;
+        m_maxCustomBorderColorSamplers = initInfo.maxCustomBorderColorSamplers;
+        m_customBorderColorSamplerCount = 0;
         MOBILEGL_ASSERT(m_device != VK_NULL_HANDLE && m_config != nullptr,
                         "VkSamplerManager::Initialize failed: invalid initialization info");
         return true;
@@ -102,6 +255,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_device = VK_NULL_HANDLE;
         m_config = nullptr;
         m_frameBoundaryCounter = 0;
+        m_customBorderColorSupported = false;
+        m_maxCustomBorderColorSamplers = 0;
+        m_customBorderColorSamplerCount = 0;
     }
 
     void VkSamplerManager::OnFrameBoundary() {
@@ -123,6 +279,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 if (m_device != VK_NULL_HANDLE && entry.handle != VK_NULL_HANDLE) {
                     vkDestroySampler(m_device, entry.handle, nullptr);
                 }
+                if (entry.usesCustomBorderColor && m_customBorderColorSamplerCount > 0) {
+                    --m_customBorderColorSamplerCount;
+                }
                 it = m_samplers.erase(it);
             } else {
                 ++it;
@@ -131,8 +290,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
 
     Uint64 VkSamplerManager::BuildSamplerKey(const MG_State::GLState::SamplerObject& sampler,
-                                             const MG_State::GLState::ITextureObject& texture,
+                                             Bool forceNearestFiltering, Bool singleLevelView,
-                                             Bool forceNearestFiltering, Bool singleLevelView) const {
+                                             const ResolvedBorderColor& borderColor) const {
         MOBILEGL_ASSERT(m_config != nullptr, "VkSamplerManager::BuildSamplerKey: m_config is null");
         XXHASH_VERIFY(XXH64_reset(m_hashState, m_config->CacheVersion));
 
@@ -166,8 +325,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         XXHASH_VERIFY(XXH64_update(m_hashState, &compareMode, sizeof(compareMode)));
         const auto compareFunc = sampler.GetSamplerCompareFunc();
         XXHASH_VERIFY(XXH64_update(m_hashState, &compareFunc, sizeof(compareFunc)));
-        const auto borderColor = ResolveVkBorderColor(sampler, texture);
+        // The resolved enum AND, when it is one of the *_CUSTOM_EXT values, the sixteen bytes of the
-        XXHASH_VERIFY(XXH64_update(m_hashState, &borderColor, sizeof(borderColor)));
+        // colour itself: two samplers that differ only in a custom border colour carry the same enum
+        // and would otherwise collide onto whichever one was created first.
+        XXHASH_VERIFY(XXH64_update(m_hashState, &borderColor.color, sizeof(borderColor.color)));
+        if (borderColor.isCustom) {
+            XXHASH_VERIFY(XXH64_update(m_hashState, &borderColor.customValue, sizeof(borderColor.customValue)));
+        }
         return XXH64_digest(m_hashState);
     }
 
@@ -183,7 +347,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // allocation for a genuinely single-level image) and faults the GPU - the same failure
         // the default-framebuffer blit shader had to work around with an explicit-LOD sample.
         const Bool singleLevelView = viewLevelCount == 1;
-        const Uint64 key = BuildSamplerKey(sampler, texture, forceNearestFiltering, singleLevelView);
+        // Resolved once and used for both the key and the create-info; see ResolvedBorderColor.
+        const ResolvedBorderColor borderColor = ResolveBorderColor(sampler, texture);
+        const Uint64 key = BuildSamplerKey(sampler, forceNearestFiltering, singleLevelView, borderColor);
         auto it = m_samplers.find(key);
         if (it != m_samplers.end()) {
             it->second.lastUsedFrameBoundary = m_frameBoundaryCounter;
@@ -211,9 +377,21 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Must match BuildSamplerKey's resolution exactly.
         samplerInfo.maxLod = ResolveSingleLevelMaxLod(sampler, singleLevelView);
         samplerInfo.minLod = ResolveEffectiveMinLod(sampler, samplerInfo.maxLod);
-        samplerInfo.borderColor = ResolveVkBorderColor(sampler, texture);
+        samplerInfo.borderColor = borderColor.color;
         samplerInfo.unnormalizedCoordinates = VK_FALSE;
 
+        // VK_EXT_custom_border_color. `format` stays UNDEFINED, which is legal only because
+        // customBorderColorWithoutFormat was required alongside customBorderColors at device
+        // creation - a GL sampler object has no idea which texture it will be paired with.
+        VkSamplerCustomBorderColorCreateInfoEXT customBorderColorInfo{};
+        if (borderColor.isCustom) {
+            customBorderColorInfo.sType = VK_STRUCTURE_TYPE_SAMPLER_CUSTOM_BORDER_COLOR_CREATE_INFO_EXT;
+            customBorderColorInfo.customBorderColor = borderColor.customValue;
+            customBorderColorInfo.format = VK_FORMAT_UNDEFINED;
+            customBorderColorInfo.pNext = samplerInfo.pNext;
+            samplerInfo.pNext = &customBorderColorInfo;
+        }
+
         VkSampler vkSampler = VK_NULL_HANDLE;
         VK_VERIFY(vkCreateSampler(m_device, &samplerInfo, nullptr, &vkSampler), "vkCreateSampler(texture)");
 
@@ -222,6 +400,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         entry.externalIndex = sampler.GetExternalIndex();
         entry.version = sampler.GetVersion();
         entry.lastUsedFrameBoundary = m_frameBoundaryCounter;
+        entry.usesCustomBorderColor = borderColor.isCustom;
+        if (entry.usesCustomBorderColor) {
+            ++m_customBorderColorSamplerCount;
+        }
         m_samplers[key] = entry;
         return vkSampler;
     }
@@ -281,39 +463,148 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
     }
 
-    VkBorderColor VkSamplerManager::ResolveVkBorderColor(const MG_State::GLState::SamplerObject& sampler,
+    VkSamplerManager::ResolvedBorderColor VkSamplerManager::ResolveBorderColor(
-                                                         const MG_State::GLState::ITextureObject& texture) {
+        const MG_State::GLState::SamplerObject& sampler, const MG_State::GLState::ITextureObject& texture) const {
+        ResolvedBorderColor resolved{};
         if (!UsesBorderColor(sampler)) {
-            return VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+            return resolved; // FLOAT_TRANSPARENT_BLACK, never sampled
         }
 
         // Border colour is sampler state: a bound sampler object supplies its own, and a texture
         // with none reaches the very same value through the sampler object it owns.
-        const auto& borderColor = sampler.GetBorderColor();
+        const auto format = texture.GetFormat();
-        const Bool isDepthTexture = IsDepthTextureFormat(texture.GetFormat());
+        const auto domain = ResolveBorderColorDomain(format);
+        const Bool canUseCustom = m_customBorderColorSupported && m_maxCustomBorderColorSamplers > 0 &&
+                                  m_customBorderColorSamplerCount < m_maxCustomBorderColorSamplers;
 
-        if (isDepthTexture) {
+        if (domain != BorderColorDomain::Float) {
+            // An integer image view REQUIRES an integer border colour, whatever the value is - even
+            // (0,0,0,1). The value itself is whichever integer form the application wrote; a float
+            // border on an integer texture is nonsense GL leaves undefined, so the derived integer
+            // representation (a plain cast) is as good an answer as any.
+            //
+            // Clamped to the format's representable range FIRST, per GL 4.6 core 8.14.2, and read
+            // through Int64 so the whole signed and unsigned 32-bit ranges are expressible at once.
+            //
+            // Which representation to start from is the TEXTURE's domain, not the entry-point form
+            // the application used. GL 4.6 core 8.10 stores an "I"-form border colour unmodified with
+            // an integer internal data type and does not define a sign conversion between the two
+            // integer forms, so the stored bits are reinterpreted in the sampled format's own
+            // signedness. Measured, not assumed: a border of -1 written with glTexParameterIiv
+            // against a GL_R8UI texture samples as 255 on the ES driver, i.e. as 0xFFFFFFFF clamped
+            // to the format's maximum - see the IntegerBorderColorScenario case that pins it. Picking
+            // the representation by the FORM instead would answer 0 here, which is a defensible
+            // reading of the same spec text but puts DirectVulkan at odds with DirectGLES - and
+            // DirectGLES cannot deviate, it forwards the value to the driver verbatim. Cross-backend
+            // agreement decides it.
+            const auto range = ResolveIntegerBorderRange(format);
+            const auto& borderColorI = sampler.GetBorderColorI();
+            const auto& borderColorUI = sampler.GetBorderColorUI();
+            const Bool startFromUnsigned = domain == BorderColorDomain::UnsignedInteger;
+            Int64 clamped[4];
+            for (SizeT channel = 0; channel < 4; ++channel) {
+                const Int64 raw = startFromUnsigned ? static_cast<Int64>(borderColorUI[channel])
+                                                    : static_cast<Int64>(borderColorI[channel]);
+                const Int64 low = channel == 3 ? range.alphaMin : range.rgbMin;
+                const Int64 high = channel == 3 ? range.alphaMax : range.rgbMax;
+                clamped[channel] = std::clamp(raw, low, high);
+            }
+
+            // Matched against the CLAMPED value, so a border the format cannot hold still lands on
+            // the palette entry it clamps to rather than missing every one of them.
+            const Bool allZeroRgb = clamped[0] == 0 && clamped[1] == 0 && clamped[2] == 0;
+            if (allZeroRgb && clamped[3] == 0) {
+                resolved.color = VK_BORDER_COLOR_INT_TRANSPARENT_BLACK;
+                return resolved;
+            }
+            if (allZeroRgb && clamped[3] == 1) {
+                resolved.color = VK_BORDER_COLOR_INT_OPAQUE_BLACK;
+                return resolved;
+            }
+            if (clamped[0] == 1 && clamped[1] == 1 && clamped[2] == 1 && clamped[3] == 1) {
+                resolved.color = VK_BORDER_COLOR_INT_OPAQUE_WHITE;
+                return resolved;
+            }
+            if (canUseCustom) {
+                resolved.color = VK_BORDER_COLOR_INT_CUSTOM_EXT;
+                resolved.isCustom = true;
+                for (SizeT channel = 0; channel < 4; ++channel) {
+                    if (domain == BorderColorDomain::UnsignedInteger) {
+                        resolved.customValue.uint32[channel] = static_cast<Uint32>(clamped[channel]);
+                    } else {
+                        resolved.customValue.int32[channel] = static_cast<Int32>(clamped[channel]);
+                    }
+                }
+                return resolved;
+            }
+            // No custom colour available: pick the nearest of the three integer palette entries
+            // rather than always answering transparent black, which is what turned an integer border
+            // of (-1,-1,-1,-1) into 0 and broke the CTS's clamped-texel detection outright.
+            const Bool opaque = clamped[3] != 0;
+            const Bool bright = clamped[0] != 0 || clamped[1] != 0 || clamped[2] != 0;
+            resolved.color = !opaque ? VK_BORDER_COLOR_INT_TRANSPARENT_BLACK
+                                     : (bright ? VK_BORDER_COLOR_INT_OPAQUE_WHITE : VK_BORDER_COLOR_INT_OPAQUE_BLACK);
+            return resolved;
+        }
+
+        // Float domain. GL 4.6 core 8.14.2/8.23: the border colour is interpreted in the texture's
+        // format, so it is clamped to that format's representable range first. Without the clamp the
+        // CTS's border of (255,255,255,255) on a GL_RGBA8 texture matched none of the palette entries
+        // and fell through to transparent black - every border texel sampled 0 where the test wanted
+        // 255. The range is per format class, not just the normalized [0,1] / [-1,1] pair: only the
+        // 32-bit float formats are unclamped.
+        FloatVec4 borderColor = sampler.GetBorderColor();
+        if (const auto range = ResolveFloatBorderRange(format, IsSignedNormalizedFormat(format)); range.clamped) {
+            borderColor = FloatVec4(std::clamp(borderColor.x(), range.minValue, range.maxValue),
+                                    std::clamp(borderColor.y(), range.minValue, range.maxValue),
+                                    std::clamp(borderColor.z(), range.minValue, range.maxValue),
+                                    std::clamp(borderColor.w(), range.minValue, range.maxValue));
+        }
+
+        // A depth texture samples one component, so only x decides - and its alpha reads as 1.
+        if (IsDepthTextureFormat(format)) {
             if (NearlyEqual(borderColor.x(), 1.0f)) {
-                return VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+                resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+                return resolved;
             }
             if (NearlyEqual(borderColor.x(), 0.0f)) {
-                return VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+                resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+                return resolved;
             }
         }
 
         const Bool rgbZero = NearlyEqual(borderColor.x(), 0.0f) && NearlyEqual(borderColor.y(), 0.0f) &&
                              NearlyEqual(borderColor.z(), 0.0f);
         if (rgbZero && NearlyEqual(borderColor.w(), 0.0f)) {
-            return VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+            resolved.color = VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+            return resolved;
         }
         if (rgbZero && NearlyEqual(borderColor.w(), 1.0f)) {
-            return VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+            resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+            return resolved;
         }
         if (NearlyEqual(borderColor.x(), 1.0f) && NearlyEqual(borderColor.y(), 1.0f) &&
             NearlyEqual(borderColor.z(), 1.0f) && NearlyEqual(borderColor.w(), 1.0f)) {
-            return VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+            resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+            return resolved;
         }
 
-        return VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+        if (canUseCustom) {
+            resolved.color = VK_BORDER_COLOR_FLOAT_CUSTOM_EXT;
+            resolved.isCustom = true;
+            resolved.customValue.float32[0] = borderColor.x();
+            resolved.customValue.float32[1] = borderColor.y();
+            resolved.customValue.float32[2] = borderColor.z();
+            resolved.customValue.float32[3] = borderColor.w();
+            return resolved;
+        }
+
+        // Nearest of the three float palette entries. Transparent black stays the answer for a
+        // transparent border, which is what the old unconditional fallback got right by accident.
+        const Bool opaque = borderColor.w() >= 0.5f;
+        const Bool bright = (borderColor.x() + borderColor.y() + borderColor.z()) >= 1.5f;
+        resolved.color = !opaque ? VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK
+                                 : (bright ? VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE : VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK);
+        return resolved;
     }
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/VkSamplerManager.h

@@ -28,6 +28,13 @@ public:
         Bool samplerAnisotropySupported = false;
         // VkPhysicalDeviceLimits::maxSamplerAnisotropy.
         Float maxSamplerAnisotropy = 1.0f;
+        // VK_EXT_custom_border_color was enabled with BOTH customBorderColors and
+        // customBorderColorWithoutFormat; see VulkanRenderer::m_customBorderColorFeatureEnabled.
+        Bool customBorderColorSupported = false;
+        // VkPhysicalDeviceCustomBorderColorPropertiesEXT::maxCustomBorderColorSamplers. A hard device
+        // limit on how many LIVE samplers may carry a custom border colour, so the cache counts them
+        // and falls back to the snapped predefined value once it is reached.
+        Uint32 maxCustomBorderColorSamplers = 0;
     };
 
     Bool Initialize(const InitInfo& initInfo);
@@ -52,6 +59,21 @@ public:
     // boundaries.
     void OnFrameBoundary();
 
+    // What GL_TEXTURE_BORDER_COLOR resolves to for one (sampler, texture) pair. `color` is always a
+    // legal VkBorderColor; when `isCustom` it is one of the *_CUSTOM_EXT values and `customValue`
+    // carries the actual components in a VkSamplerCustomBorderColorCreateInfoEXT.
+    //
+    // Resolved ONCE per GetOrCreateSampler call and threaded into both the cache key and the
+    // create-info, so the two cannot disagree - the same discipline the resolved anisotropy needs,
+    // and here it also makes the maxCustomBorderColorSamplers fallback deterministic: whether a
+    // custom colour was affordable is decided before the key is built, not twice with a budget
+    // change in between.
+    struct ResolvedBorderColor {
+        VkBorderColor color = VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+        VkClearColorValue customValue{};
+        Bool isCustom = false;
+    };
+
 private:
     struct SamplerCacheEntry {
         VkSampler handle = VK_NULL_HANDLE;
@@ -60,17 +82,18 @@ private:
         // Frame boundary of the last cache hit; entries idle past the
         // OnFrameBoundary retirement age have their VkSampler destroyed.
         Uint64 lastUsedFrameBoundary = 0;
+        // Counted against maxCustomBorderColorSamplers for as long as this entry lives.
+        Bool usesCustomBorderColor = false;
     };
 
-    Uint64 BuildSamplerKey(const MG_State::GLState::SamplerObject& sampler,
+    Uint64 BuildSamplerKey(const MG_State::GLState::SamplerObject& sampler, Bool forceNearestFiltering,
-                           const MG_State::GLState::ITextureObject& texture,
+                           Bool singleLevelView, const ResolvedBorderColor& borderColor) const;
-                           Bool forceNearestFiltering, Bool singleLevelView) const;
     static VkFilter ToVkFilter(SamplerFilterMode mode);
     static VkSamplerMipmapMode ToVkMipmapMode(SamplerMipmapMode mode);
     static VkSamplerAddressMode ToVkAddressMode(SamplerWrapMode mode);
     static VkCompareOp ToVkCompareOp(SamplerCompareFunc func);
-    static VkBorderColor ResolveVkBorderColor(const MG_State::GLState::SamplerObject& sampler,
+    ResolvedBorderColor ResolveBorderColor(const MG_State::GLState::SamplerObject& sampler,
-                                              const MG_State::GLState::ITextureObject& texture);
+                                           const MG_State::GLState::ITextureObject& texture) const;
     // The anisotropy Vulkan will actually apply: 1.0 (i.e. disabled) unless the feature is on and
     // the sampler filters linearly both ways, otherwise the GL request clamped to the device limit.
     // GL happily carries GL_TEXTURE_MAX_ANISOTROPY on a NEAREST sampler (Blaze3D's blocks do exactly
@@ -82,6 +105,12 @@ private:
     const VulkanRendererConfig* m_config = nullptr;
     Bool m_samplerAnisotropySupported = false;
     Float m_maxSamplerAnisotropy = 1.0f;
+    Bool m_customBorderColorSupported = false;
+    Uint32 m_maxCustomBorderColorSamplers = 0;
+    // Live cache entries carrying a custom border colour. Kept in step with the entries themselves
+    // in exactly the three places one can appear or disappear: creation, the OnFrameBoundary sweep,
+    // and Shutdown.
+    Uint32 m_customBorderColorSamplerCount = 0;
     UnorderedMap<Uint64, SamplerCacheEntry> m_samplers;
     // Monotonic frame-boundary counter (bumped in OnFrameBoundary) for cache aging.
     Uint64 m_frameBoundaryCounter = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp

@@ -11,8 +11,10 @@
 #include "ProgramFactory.h"
 
 #include "MG_State/GLState/Core.h"
+#include <MG_Pipe/PipeInputsSwitch.h>
 #include "MG_Util/Converters/MGToStr/TextureEnumConverter.h"
 #include "MG_Util/Converters/MGToVk/TextureEnumConverter.h"
+#include "MG_Util/Metrics/PipeStats.h"
 
 #include <Config.h>
 #include <algorithm>
@@ -46,13 +48,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return mipLevelCount;
     }
 
-    struct TextureFormatInfo {
-        VkFormat format = VK_FORMAT_UNDEFINED;
-        Bool expandRgbToRgba = false;
-        Uint32 componentByteCount = 0;
-        Array<Uint8, 4> alphaBytes = {0, 0, 0, 0};
-    };
-
     struct TextureShapeInfo {
         VkImageType imageType = VK_IMAGE_TYPE_2D;
         VkImageViewType viewType = VK_IMAGE_VIEW_TYPE_2D;
@@ -220,6 +215,22 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     VkTextureManager::TextureIdentity VkTextureManager::MakeTextureIdentity(
         MG_State::GLState::ITextureObject* texture) {
+        // A GL texture view (ARB_texture_view) is identified by the texture whose STORAGE it
+        // views, not by itself. Everything this identity keys - the TextureResource, the tracked
+        // image layout, the alive-object weak reference, the storage-usage marks, the per-draw
+        // sync memos - is a property of the IMAGE, and a view shares that image exactly. Doing
+        // the resolution here rather than at each call site is what makes it impossible to miss
+        // one: a layout update posted against a view's own identity would have found no resource
+        // at all, which is precisely how an attached view came back blank.
+        //
+        // One hop suffices and cannot recurse: glTextureView composes a view-of-a-view onto the
+        // root at creation, so a storage owner is never itself a view.
+        if (texture != nullptr) {
+            const auto& storageOwner = texture->GetViewStorageOwner();
+            if (storageOwner) {
+                texture = storageOwner.get();
+            }
+        }
         return TextureIdentity{
             .texture = texture,
             .lifetimeId = texture ? texture->GetLifetimeId() : 0,
@@ -364,7 +375,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return true;
     }
 
-    static TextureFormatInfo ResolveTextureFormatInfo(TextureInternalFormat format) {
+    TextureFormatInfo ResolveTextureFormatInfo(TextureInternalFormat format) {
         switch (format) {
         case TextureInternalFormat::RGB:
         case TextureInternalFormat::RGB8:
@@ -694,6 +705,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
 
     void VkTextureManager::EraseTrackedTexture(const TextureIdentity& identity) {
+        m_viewRequestedImageFlags.erase(identity);
+        m_viewRequestedFormats.erase(identity);
         auto resourceIt = m_textureResources.find(identity);
         if (resourceIt != m_textureResources.end()) {
             DeferResourceRelease(Move(resourceIt->second));
@@ -737,9 +750,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_drawSyncedThisDraw.clear();
     }
 
-    VkTextureManager::TextureResource* VkTextureManager::SyncTextureAndGetDescriptor(MG_State::GLState::ITextureObject& texture) {
+    VkTextureManager::TextureResource* VkTextureManager::SyncTextureAndGetDescriptor(MG_State::GLState::ITextureObject& textureOrView) {
         MOBILEGL_ASSERT(m_device != VK_NULL_HANDLE, "SyncTextureAndGetDescriptor: m_device == VK_NULL_HANDLE");
 
+        // A GL texture view has no image of its own; it resolves to - and shares - the resource
+        // of the texture whose storage it views, so that there is exactly one VkImage, one
+        // tracked layout and one upload path per storage. Everything that makes the view a
+        // different texture (format, level/layer window, sampled aspect) is applied where the
+        // VkImageViews are built, keyed in alternateSampledViews / attachmentViews.
+        MG_State::GLState::ITextureObject& texture = StorageTextureOf(textureOrView);
+        if (&texture != &textureOrView) {
+            NoteTextureViewImageRequirements(textureOrView, texture);
+        }
+
         const TextureIdentity identity = MakeTextureIdentity(&texture);
 
         // Per-draw memo fast path (see BeginDrawSyncScope): a texture already fully
@@ -784,7 +807,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // sampled-texture sync scan the entire alive-texture map per draw.
             if (aliveIt == m_aliveObjects.end()) {
                 WeakPtr<MG_State::GLState::ITextureObject> aliveTexture;
-                const auto& liveTexture = MG_State::pGLContext->GetTextureObject(texture.GetExternalIndex());
+                const auto& liveTexture = MGB_CTX->GetTextureObject(texture.GetExternalIndex());
                 if (liveTexture && liveTexture.get() == &texture) {
                     aliveTexture = liveTexture;
                 } else {
@@ -838,7 +861,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     VkImageView VkTextureManager::GetOrCreateViewAtMipLevel(MG_State::GLState::ITextureObject& texture, Uint32 mipLevel) {
         TextureResource* resource = SyncTextureAndGetDescriptor(texture);
-        if (resource == nullptr || resource->image == VK_NULL_HANDLE || mipLevel >= resource->mipLevels) {
+        if (resource == nullptr || resource->image == VK_NULL_HANDLE) {
+            return VK_NULL_HANDLE;
+        }
+        // A GL texture view shares this resource with the texture it views, so it must not touch
+        // perMipViews: that vector is indexed by mip level alone and holds views built with the
+        // STORAGE texture's format and full layer range. Route it through the keyed attachment
+        // cache instead, where its own window is part of the key.
+        if (texture.IsTextureView()) {
+            const TextureViewWindow window = ResolveTextureViewWindow(texture, *resource);
+            return GetOrCreateAttachmentViewAtMipLevel(texture, mipLevel, window.baseArrayLayer, window.layerCount,
+                                                       window.viewType);
+        }
+        if (mipLevel >= resource->mipLevels) {
             return VK_NULL_HANDLE;
         }
 
@@ -866,21 +901,43 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                                       Uint32 layerCount,
                                                                       VkImageViewType viewType) {
         TextureResource* resource = SyncTextureAndGetDescriptor(texture);
-        if (resource == nullptr || resource->image == VK_NULL_HANDLE || mipLevel >= resource->mipLevels) {
+        if (resource == nullptr || resource->image == VK_NULL_HANDLE) {
             return VK_NULL_HANDLE;
         }
-        // A 3D image has arrayLayers == 1 and keeps its GL layers on the z axis, so a per-slice
+        // mipLevel and baseArrayLayer arrive in STORAGE space - every caller runs them through
-        // attachment view is a 2D view whose "array layer" is the slice - legal only on a
+        // ToStorageMipLevel / ToStorageArrayLayer at the GL attachment boundary. What a GL texture
-        // 2D-array-compatible image (VUID-VkImageViewCreateInfo-image-04970), which
+        // view still contributes here is its own internal format, which may reinterpret the
-        // SyncTextureResource asks for and may have had refused per format.
+        // storage's (GL 4.6 core table 8.21) and is what the attachment must actually be written
-        if (resource->viewType == VK_IMAGE_VIEW_TYPE_3D && viewType == VK_IMAGE_VIEW_TYPE_2D) {
+        // through.
+        VkFormat viewFormatOverride = VK_FORMAT_UNDEFINED;
+        if (texture.IsTextureView()) {
+            viewFormatOverride = ResolveTextureViewWindow(texture, *resource).format;
+        }
+        if (mipLevel >= resource->mipLevels) {
+            return VK_NULL_HANDLE;
+        }
+        // A 3D image has arrayLayers == 1 and keeps its GL layers on the z axis, so an attachment
+        // view over it addresses SLICES through baseArrayLayer/layerCount: one slice for a
+        // non-layered attachment (a 2D view) and the whole span for a layered one (a 2D_ARRAY view,
+        // which is what a layered GL_TEXTURE_3D attachment plus a gl_Layer-writing geometry shader
+        // means). BOTH spellings are legal only on a 2D-array-compatible image
+        // (VUID-VkImageViewCreateInfo-image-04970 / -06723), which SyncTextureResource asks for and
+        // may have had refused per format.
+        //
+        // The span is validated against the MIP's slice count, never against arrayLayers: a 3D
+        // image's arrayLayers is 1 by construction, so measuring a layered span against it rejected
+        // every layered 3D attachment - the null view that used to reach vkCreateFramebuffer.
+        if (resource->viewType == VK_IMAGE_VIEW_TYPE_3D &&
+            (viewType == VK_IMAGE_VIEW_TYPE_2D || viewType == VK_IMAGE_VIEW_TYPE_2D_ARRAY)) {
             const Uint32 sliceCount = std::max(resource->depth >> mipLevel, 1u);
             if ((resource->imageCreateFlags & VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT) == 0 ||
                 layerCount == 0 || baseArrayLayer >= sliceCount || baseArrayLayer + layerCount > sliceCount) {
-                MGLOG_D("%s: cannot name slice span [%u, %u) of 3D textureId=%d (mip %u has %u slices, "
+                // Not an error line: the render-pass builder turns the null view into one
-                        "2D-array-compatible=%d)",
+                // MGLOG_E_ONCE and a skipped draw, which is the level this belongs at.
+                MGLOG_D("%s: cannot name slice span [%u, %u) of 3D textureId=%d as viewType=%d (mip %u has %u "
+                        "slices, 2D-array-compatible=%d)",
                         __func__, baseArrayLayer, baseArrayLayer + layerCount, texture.GetExternalIndex(),
-                        mipLevel, sliceCount,
+                        static_cast<Int>(viewType), mipLevel, sliceCount,
                         (int)((resource->imageCreateFlags & VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT) != 0));
                 return VK_NULL_HANDLE;
             }
@@ -893,11 +950,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         const Bool framebufferSrgbEnabled =
-            MG_State::pGLContext->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
+            MGB_CTX->IsCapabilityEnabled(MobileGL::CapabilityInput::FramebufferSrgb);
-        const VkFormat attachmentFormat = ResolveSrgbAttachmentWriteFormat(resource->format, framebufferSrgbEnabled);
+        const VkFormat baseAttachmentFormat =
+            viewFormatOverride != VK_FORMAT_UNDEFINED ? viewFormatOverride : resource->format;
+        const VkFormat attachmentFormat =
+            ResolveSrgbAttachmentWriteFormat(baseAttachmentFormat, framebufferSrgbEnabled);
 
-        if (attachmentFormat == resource->format && baseArrayLayer == 0 && layerCount == resource->arrayLayers &&
+        // The shortcut back to the per-mip vector is only sound for the storage texture itself;
-            viewType == resource->viewType) {
+        // for a view every field below is part of what distinguishes it from its parent.
+        if (viewFormatOverride == VK_FORMAT_UNDEFINED && attachmentFormat == resource->format &&
+            baseArrayLayer == 0 && layerCount == resource->arrayLayers && viewType == resource->viewType) {
             return GetOrCreateViewAtMipLevel(texture, mipLevel);
         }
 
@@ -932,7 +994,22 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     VkImageView VkTextureManager::GetOrCreateSampledViewAtMipLevel(MG_State::GLState::ITextureObject& texture,
                                                                    Uint32 mipLevel) {
         TextureResource* resource = SyncTextureAndGetDescriptor(texture);
-        if (resource == nullptr || resource->image == VK_NULL_HANDLE || mipLevel >= resource->mipLevels) {
+        if (resource == nullptr || resource->image == VK_NULL_HANDLE) {
+            return VK_NULL_HANDLE;
+        }
+        // As in GetOrCreateViewAtMipLevel: perMipSampledViews belongs to the storage texture's
+        // own format and aspect, so a GL view has to go to the keyed cache.
+        if (texture.IsTextureView()) {
+            if (mipLevel >= resource->mipLevels) {
+                return VK_NULL_HANDLE;
+            }
+            TextureViewWindow window = ResolveTextureViewWindow(texture, *resource);
+            // Storage space already (see ToStorageMipLevel); only the level COUNT narrows.
+            window.baseMipLevel = mipLevel;
+            window.levelCount = 1;
+            return GetOrCreateWindowedSampledView(texture, *resource, window);
+        }
+        if (mipLevel >= resource->mipLevels) {
             return VK_NULL_HANDLE;
         }
 
@@ -960,14 +1037,76 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return perMipSampledView;
     }
 
-    VkImageView VkTextureManager::GetOrCreateSampledImageView(MG_State::GLState::ITextureObject& texture,
+    // Builds (and caches) one sampled VkImageView over `resource`'s image for an arbitrary
-                                                               VkFormat format) {
+    // window - the shared back end of every GL-texture-view sampled path. Keyed by the whole
-        TextureResource* resource = SyncTextureAndGetDescriptor(texture);
+    // window, which is what keeps a D24S8's depth-aspect view and its stencil-aspect view apart
-        if (resource == nullptr || resource->image == VK_NULL_HANDLE ||
+    // in the same cache while both name the same image, the same levels and the same layers.
-            resource->sampledView == VK_NULL_HANDLE) {
+    VkImageView VkTextureManager::GetOrCreateWindowedSampledView(MG_State::GLState::ITextureObject& texture,
+                                                                 TextureResource& resource,
+                                                                 const TextureViewWindow& window) {
+        const TextureResource::SampledImageViewKey key{
+            .baseMipLevel = window.baseMipLevel,
+            .levelCount = window.levelCount,
+            .baseArrayLayer = window.baseArrayLayer,
+            .layerCount = window.layerCount,
+            .viewType = window.viewType,
+            .format = window.format,
+            .aspect = window.sampledAspect,
+            .componentSwizzle = PackComponentSwizzle(window.components),
+        };
+        const auto existing = resource.alternateSampledViews.find(key);
+        if (existing != resource.alternateSampledViews.end()) {
+            return existing->second;
+        }
+
+        if (window.format != resource.format &&
+            (resource.imageCreateFlags & VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT) == 0) {
+            MGLOG_E_ONCE("%s: textureId=%d needs a mutable-format image to be viewed as format=%d "
+                         "(image format=%d)",
+                         __func__, texture.GetExternalIndex(), static_cast<Int>(window.format),
+                         static_cast<Int>(resource.format));
             return VK_NULL_HANDLE;
         }
 
+        const VkImageView view =
+            CreateImageView(resource.image, window.format, window.sampledAspect, window.viewType,
+                            window.baseMipLevel, window.levelCount, window.baseArrayLayer, window.layerCount,
+                            &window.components);
+        if (view == VK_NULL_HANDLE) {
+            MGLOG_E_ONCE("%s: failed to create sampled view for textureId=%d format=%d aspect=0x%x "
+                         "mips=[%u,%u) layers=[%u,%u)",
+                         __func__, texture.GetExternalIndex(), static_cast<Int>(window.format),
+                         static_cast<Uint32>(window.sampledAspect), window.baseMipLevel,
+                         window.baseMipLevel + window.levelCount, window.baseArrayLayer,
+                         window.baseArrayLayer + window.layerCount);
+            return VK_NULL_HANDLE;
+        }
+        resource.alternateSampledViews.emplace(key, view);
+        return view;
+    }
+
+    VkImageView VkTextureManager::GetOrCreateSampledImageView(MG_State::GLState::ITextureObject& texture,
+                                                               VkFormat format) {
+        TextureResource* resource = SyncTextureAndGetDescriptor(texture);
+        if (resource == nullptr || resource->image == VK_NULL_HANDLE) {
+            return VK_NULL_HANDLE;
+        }
+
+        // A GL texture view never has a sampledView of its own on this resource - that one
+        // belongs to the storage texture, with the storage texture's format, level range and
+        // depth/stencil aspect. The window is the view's whole identity, so it always goes to the
+        // keyed cache, even when the requested format happens to match the image's.
+        if (texture.IsTextureView()) {
+            TextureViewWindow window = ResolveTextureViewWindow(texture, *resource);
+            if (format != VK_FORMAT_UNDEFINED) {
+                window.format = format;
+            }
+            return GetOrCreateWindowedSampledView(texture, *resource, window);
+        }
+
+        if (resource->sampledView == VK_NULL_HANDLE) {
+            return VK_NULL_HANDLE;
+        }
         if (format == VK_FORMAT_UNDEFINED || format == resource->format) {
             return resource->sampledView;
         }
@@ -987,8 +1126,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const TextureResource::SampledImageViewKey key{
             .baseMipLevel = resource->sampledBaseMipLevel,
             .levelCount = resource->sampledLevelCount,
+            .baseArrayLayer = 0,
+            .layerCount = resource->arrayLayers,
             .viewType = resource->viewType,
             .format = format,
+            .aspect = VK_IMAGE_ASPECT_COLOR_BIT,
+            .componentSwizzle = PackComponentSwizzle(
+                ResolveSampledViewComponents(texture, ResolveTextureFormatInfo(texture.GetFormat()))),
         };
         const auto existing = resource->alternateSampledViews.find(key);
         if (existing != resource->alternateSampledViews.end()) {
@@ -1029,6 +1173,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     VkImageView VkTextureManager::GetOrCreateStorageImageView(MG_State::GLState::ITextureObject& texture,
                                                                Uint32 mipLevel, VkFormat format,
                                                                Bool layered, Int32 layer) {
+        // mipLevel and layer arrive in STORAGE space; ResolveStorageImageDescriptor converts
+        // the glBindImageTexture values with ToStorageMipLevel / ToStorageArrayLayer.
         TextureResource* resource = SyncTextureAndGetDescriptor(texture);
         if (resource == nullptr || resource->image == VK_NULL_HANDLE || mipLevel >= resource->mipLevels ||
             resource->sampleCount != VK_SAMPLE_COUNT_1_BIT ||
@@ -1053,8 +1199,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return VK_NULL_HANDLE;
         }
 
-        Uint32 baseArrayLayer = 0;
+        // A GL texture view opens onto a WINDOW of the storage's layers; a layered image
-        Uint32 layerCount = resource->arrayLayers;
+        // binding of it must not reach past that window into the parent's other layers.
+        Uint32 baseArrayLayer = ToStorageArrayLayer(&texture, 0);
+        Uint32 layerCount = texture.IsTextureView()
+                                ? std::min(static_cast<Uint32>(texture.GetViewNumLayers()),
+                                           resource->arrayLayers - baseArrayLayer)
+                                : resource->arrayLayers;
         VkImageViewType viewType = resource->viewType;
         if (!layered) {
             switch (resource->viewType) {
@@ -1087,7 +1238,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         const Bool isFullResourceView = baseArrayLayer == 0 && layerCount == resource->arrayLayers &&
                                         viewType == resource->viewType;
-        if (format == resource->format && isFullResourceView) {
+        if (format == resource->format && isFullResourceView && !texture.IsTextureView()) {
             return GetOrCreateViewAtMipLevel(texture, mipLevel);
         }
 
@@ -1613,7 +1764,20 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const Bool storageUpgradePending =
             !outResource.storageUsageResolved &&
             m_storageImageTextures.find(MakeTextureIdentity(&texture)) != m_storageImageTextures.end();
-        if (outResource.image != VK_NULL_HANDLE && !storageUpgradePending &&
+        // Same shape for a GL texture view's demands on the image (MUTABLE_FORMAT for a
+        // format-reinterpreting view, CUBE_COMPATIBLE for a cube view of an array texture):
+        // nothing about the texture itself changed, but the live image cannot carry the view.
+        // Masked by what this format can actually be given: MUTABLE_FORMAT is deliberately
+        // withheld from formats the driver already refused it for (see SyncTextureResource), and
+        // without this mask the "upgrade still pending" test below could never come true again -
+        // costing every later sync of that texture the whole slow path, forever.
+        VkImageCreateFlags requestedViewFlags = GetViewRequestedImageFlags(texture);
+        if (m_mutableFormatUnsupported.find(outResource.format) != m_mutableFormatUnsupported.end()) {
+            requestedViewFlags &= ~VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT;
+        }
+        const Bool viewFlagUpgradePending =
+            (outResource.imageCreateFlags & requestedViewFlags) != requestedViewFlags;
+        if (outResource.image != VK_NULL_HANDLE && !storageUpgradePending && !viewFlagUpgradePending &&
             outResource.syncedContentVersion == syncingContentVersion &&
             outResource.syncedShapeVersion == syncingShapeVersion &&
             outResource.syncedTextureParamsVersion == texture.GetTextureParamsVersion() &&
@@ -1807,6 +1971,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             m_mutableFormatUnsupported.find(format) == m_mutableFormatUnsupported.end()) {
             imageCreateFlags |= VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT;
         }
+        // Flags a GL texture view over this storage asked for (see NoteTextureViewImageRequirements).
+        // MUTABLE_FORMAT is still withheld from formats the driver has already refused it for, so a
+        // reinterpreting view degrades to no view rather than to no texture.
+        const VkImageCreateFlags requestedViewFlags = GetViewRequestedImageFlags(texture);
+        if (requestedViewFlags != 0) {
+            imageCreateFlags |= requestedViewFlags;
+            if (m_mutableFormatUnsupported.find(format) != m_mutableFormatUnsupported.end()) {
+                imageCreateFlags &= ~VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT;
+            }
+        }
         // sRGB color images attach through their UNORM twin while GL_FRAMEBUFFER_SRGB is
         // disabled (see ResolveSrgbAttachmentWriteFormat), which needs format-reinterpreting
         // views - multisample sRGB render targets included.
@@ -1967,6 +2141,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     viewFormats.push_back(viewFormat);
                 }
             }
+            // ...plus every format a glTextureView over this storage reinterprets it as. Those
+            // are NOT enumerable from ResolveSampledImageViewFormat - an application may name any
+            // member of the format's view class (GL 4.6 core table 8.21) - so without this the
+            // list would forbid the very view the MUTABLE_FORMAT bit was requested for.
+            AppendViewRequestedFormats(texture, viewFormats);
             formatListInfo.sType = VK_STRUCTURE_TYPE_IMAGE_FORMAT_LIST_CREATE_INFO;
             formatListInfo.viewFormatCount = static_cast<Uint32>(viewFormats.size());
             formatListInfo.pViewFormats = viewFormats.data();
@@ -1999,12 +2178,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
             if (imageFormatResult != VK_SUCCESS && !isMultisampleTexture &&
                 (imageInfo.flags & VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT) != 0) {
-                // Losing 2D-array compatibility only costs per-slice framebuffer attachment for this
+                // Losing 2D-array compatibility only costs framebuffer attachment of this format's
-                // format; failing creation would lose the texture entirely. Remembered so later syncs
+                // 3D images - per-slice AND layered, since both are spelled as a 2D-family view over
-                // neither reprobe nor flag-mismatch against this image and recreate it.
+                // the z axis; failing creation would lose the texture entirely. Recorded here (the
+                // per-format set below) so later syncs neither reprobe nor flag-mismatch against this
+                // image and recreate it, and so GetOrCreateAttachmentViewAtMipLevel declines rather
+                // than handing back a view that cannot exist - the render-pass builder then turns
+                // that decline into a skipped draw instead of a null VkImageView in pAttachments.
                 MGLOG_W_ONCE("%s: VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT is unsupported for format=%d "
-                        "textureId=%d; creating without it (per-slice framebuffer attachment will be "
+                        "textureId=%d; creating without it (per-slice and layered framebuffer "
-                        "unavailable for it)",
+                        "attachment of 3D textures in this format will be unavailable)",
                         __func__, static_cast<Int>(format), texture.GetExternalIndex());
                 m_2dArrayCompatibleUnsupported.insert(format);
                 imageInfo.flags &= ~VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT;
@@ -2392,6 +2575,164 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_deferredViewReleases[m_currentFrameIndex].push_back(view);
     }
 
+    MG_State::GLState::ITextureObject& VkTextureManager::StorageTextureOf(
+        MG_State::GLState::ITextureObject& texture) {
+        const auto& storageOwner = texture.GetViewStorageOwner();
+        return storageOwner ? *storageOwner : texture;
+    }
+
+    // The VkImageViewType a GL texture view's own target asks for. Deliberately derived from the
+    // GL target rather than inherited from the storage image: a 2D view of a 2D-array texture is
+    // a VK_IMAGE_VIEW_TYPE_2D over one layer, and a cube view of the same image is a
+    // VK_IMAGE_VIEW_TYPE_CUBE over six - which is the whole reason table 8.20 lists those pairs.
+    static VkImageViewType ResolveTextureViewImageViewType(TextureTarget target,
+                                                           VkImageViewType storageViewType) {
+        switch (target) {
+        case TextureTarget::Texture1D:
+            return VK_IMAGE_VIEW_TYPE_1D;
+        case TextureTarget::Texture1DArray:
+            return VK_IMAGE_VIEW_TYPE_1D_ARRAY;
+        case TextureTarget::Texture2D:
+        case TextureTarget::TextureRectangle:
+        case TextureTarget::Texture2DMultisample:
+            return VK_IMAGE_VIEW_TYPE_2D;
+        case TextureTarget::Texture2DArray:
+        case TextureTarget::Texture2DMultisampleArray:
+            return VK_IMAGE_VIEW_TYPE_2D_ARRAY;
+        case TextureTarget::TextureCubeMap:
+            return VK_IMAGE_VIEW_TYPE_CUBE;
+        case TextureTarget::TextureCubeMapArray:
+            return VK_IMAGE_VIEW_TYPE_CUBE_ARRAY;
+        default:
+            return storageViewType;
+        }
+    }
+
+    VkTextureManager::TextureViewWindow VkTextureManager::ResolveTextureViewWindow(
+        MG_State::GLState::ITextureObject& texture, const TextureResource& resource) const {
+        TextureViewWindow window{};
+        window.format = resource.format;
+        window.viewType = resource.viewType;
+        window.baseArrayLayer = 0;
+        window.layerCount = resource.arrayLayers;
+        window.sampledAspect =
+            ResolveSampledImageViewAspectMask(resource.aspect, texture.GetDepthStencilTextureMode());
+        window.components = ResolveSampledViewComponents(texture, ResolveTextureFormatInfo(texture.GetFormat()));
+        ResolveViewMipRange(texture, resource.mipLevels, window.baseMipLevel, window.levelCount);
+        if (!texture.IsTextureView()) {
+            return window;
+        }
+
+        window.isTextureView = true;
+        // GL 4.6 core 8.18: the view's TEXTURE_BASE_LEVEL / TEXTURE_MAX_LEVEL are relative to the
+        // view, so ResolveViewMipRange above already clamped them against the view's own level
+        // count (TextureObjectView reports it); shifting by TEXTURE_VIEW_MIN_LEVEL puts them back
+        // into the storage image's numbering.
+        window.baseMipLevel += static_cast<Uint32>(texture.GetViewMinLevel());
+        window.baseArrayLayer = static_cast<Uint32>(texture.GetViewMinLayer());
+        window.layerCount = static_cast<Uint32>(texture.GetViewNumLayers());
+        window.viewType = ResolveTextureViewImageViewType(texture.GetTarget(), resource.viewType);
+        // The view's OWN internalformat, which may reinterpret the storage's (table 8.21).
+        const VkFormat viewFormat = ResolveTextureFormatInfo(texture.GetFormat()).format;
+        if (viewFormat != VK_FORMAT_UNDEFINED) {
+            window.format = viewFormat;
+        }
+        // Recomputed against the view's own format: a depth/stencil storage viewed as
+        // depth/stencil still has to honour the VIEW's DEPTH_STENCIL_TEXTURE_MODE, which is the
+        // one parameter Better Clouds deliberately sets differently on the two names.
+        window.sampledAspect =
+            ResolveSampledImageViewAspectMask(GetAspectMaskForFormat(window.format) != VK_IMAGE_ASPECT_NONE
+                                                  ? GetAspectMaskForFormat(window.format)
+                                                  : resource.aspect,
+                                              texture.GetDepthStencilTextureMode());
+
+        // Clamp to what the image actually has; a malformed view must degrade to an empty range
+        // rather than reach vkCreateImageView with an out-of-bounds subresource.
+        if (window.baseMipLevel >= resource.mipLevels) {
+            window.baseMipLevel = resource.mipLevels - 1;
+            window.levelCount = 1;
+        } else {
+            window.levelCount = std::min(window.levelCount, resource.mipLevels - window.baseMipLevel);
+        }
+        if (window.levelCount == 0) window.levelCount = 1;
+        if (window.baseArrayLayer >= resource.arrayLayers) {
+            window.baseArrayLayer = resource.arrayLayers - 1;
+            window.layerCount = 1;
+        } else {
+            window.layerCount = std::min(window.layerCount, resource.arrayLayers - window.baseArrayLayer);
+        }
+        if (window.layerCount == 0) window.layerCount = 1;
+        return window;
+    }
+
+    // The extra VkImageCreateFlags a GL texture view needs on the image it views. Recorded
+    // BEFORE the storage texture is synced (see SyncTextureAndGetDescriptor) so the very first
+    // resolve of a view already creates - or recreates and copies forward - an image the view can
+    // legally be built over, instead of handing back VK_NULL_HANDLE for a frame.
+    void VkTextureManager::NoteTextureViewImageRequirements(MG_State::GLState::ITextureObject& viewTexture,
+                                                            MG_State::GLState::ITextureObject& storageTexture) {
+        const TextureIdentity storageIdentity = MakeTextureIdentity(&storageTexture);
+        VkImageCreateFlags required = 0;
+        const VkFormat viewFormat = ResolveTextureFormatInfo(viewTexture.GetFormat()).format;
+        const VkFormat storageFormat = ResolveTextureFormatInfo(storageTexture.GetFormat()).format;
+        if (viewFormat != VK_FORMAT_UNDEFINED && storageFormat != VK_FORMAT_UNDEFINED &&
+            viewFormat != storageFormat) {
+            required |= VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT;
+            // The image may be created with a NARROWED format list (see SyncTextureResource), and
+            // that list is a promise about every format the image will ever be viewed as. Record
+            // this one so the promise stays true.
+            m_viewRequestedFormats[storageIdentity].insert(viewFormat);
+        }
+        const TextureTarget viewTarget = viewTexture.GetTarget();
+        if (viewTarget == TextureTarget::TextureCubeMap || viewTarget == TextureTarget::TextureCubeMapArray) {
+            // Only when the storage could legally carry the bit. VK_IMAGE_CREATE_CUBE_COMPATIBLE
+            // demands a 2D image with square levels and at least six array layers
+            // (VUID-VkImageCreateInfo-flags-00954), and asking for it on a storage that has fewer
+            // would fail vkCreateImage - which, because SyncTextureResource has already released
+            // the old resource by then, would leave the PARENT texture with no image at all. A
+            // degenerate view must not be able to destroy the texture it views; let its own view
+            // creation fail instead.
+            const IntVec3 storageSize = storageTexture.GetBaseSize();
+            const Bool storageCanBeCube = storageSize.x() == storageSize.y() &&
+                                          storageTexture.GetViewNumLayers() >= 6 &&
+                                          storageTexture.GetTarget() != TextureTarget::Texture3D;
+            if (storageCanBeCube) {
+                required |= VK_IMAGE_CREATE_CUBE_COMPATIBLE_BIT;
+            } else {
+                MGLOG_W_ONCE("Texture view %d wants a cube view of texture %d, whose storage is %dx%d with %u "
+                             "layers and cannot be cube-compatible; the view will have no image view.",
+                             viewTexture.GetExternalIndex(), storageTexture.GetExternalIndex(), storageSize.x(),
+                             storageSize.y(), storageTexture.GetViewNumLayers());
+            }
+        }
+        if (required == 0) {
+            return;
+        }
+        VkImageCreateFlags& stored = m_viewRequestedImageFlags[storageIdentity];
+        stored |= required;
+    }
+
+    VkImageCreateFlags VkTextureManager::GetViewRequestedImageFlags(
+        const MG_State::GLState::ITextureObject& storageTexture) const {
+        const auto it = m_viewRequestedImageFlags.find(
+            MakeTextureIdentity(const_cast<MG_State::GLState::ITextureObject*>(&storageTexture)));
+        return it == m_viewRequestedImageFlags.end() ? 0 : it->second;
+    }
+
+    void VkTextureManager::AppendViewRequestedFormats(const MG_State::GLState::ITextureObject& storageTexture,
+                                                      Vector<VkFormat>& outFormats) const {
+        const auto it = m_viewRequestedFormats.find(
+            MakeTextureIdentity(const_cast<MG_State::GLState::ITextureObject*>(&storageTexture)));
+        if (it == m_viewRequestedFormats.end()) {
+            return;
+        }
+        for (const VkFormat viewFormat : it->second) {
+            if (std::find(outFormats.begin(), outFormats.end(), viewFormat) == outFormats.end()) {
+                outFormats.push_back(viewFormat);
+            }
+        }
+    }
+
     Bool VkTextureManager::SyncTextureViews(const MG_State::GLState::ITextureObject& texture, TextureResource& resource) {
         MOBILEGL_ASSERT(resource.image != VK_NULL_HANDLE, "SyncTextureViews: image == VK_NULL_HANDLE");
 
@@ -2811,6 +3152,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             packBox(dst, item.regionLo, item.regionSize);
         }
 
+        if (MG_Util::PipeStats::Enabled()) {
+            // Same shape split as Espryt's: one union box per item, or one job per rect of
+            // a refined rect list. The box/rect decision is invisible to SSIM and is what
+            // the +6 ms/frame Mali cliff of section 7.3 was, so it is counted apart from
+            // the bytes.
+            Uint64 boxEmissions = 0;
+            Uint64 rectEmissions = 0;
+            Uint64 jobs = 0;
+            for (const auto& item : uploadItems) {
+                if (item.rects.empty()) {
+                    ++boxEmissions;
+                    jobs += isCombinedDepthStencil ? 2u : 1u;
+                } else {
+                    ++rectEmissions;
+                    jobs += static_cast<Uint64>(item.rects.size());
+                }
+            }
+            MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::StageTexture,
+                                         static_cast<Uint64>(stagingSize));
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadEmissions,
+                                         static_cast<Uint64>(uploadItems.size()));
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadBoxEmissions, boxEmissions);
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadRectEmissions, rectEmissions);
+            MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::TextureUploadJobs, jobs);
+        }
+
         const VkImageAspectFlags aspectMask = GetAspectMaskForFormat(outResource.format);
         VkPipelineStageFlags uploadSrcStageMask = VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT;
         VkAccessFlags uploadSrcAccessMask = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.h

@@ -10,8 +10,10 @@
 
 #include "../VkIncludes.h"
 #include <Includes.h>
+#include <MG_State/GLState/FramebufferState/FramebufferObject.h>
 #include <MG_State/GLState/TextureState/TextureObject.h>
 #include <vk_mem_alloc.h>
+#include <algorithm>
 #include <unordered_map>
 #include <unordered_set>
 
@@ -22,6 +24,31 @@ class ITextureObject;
 namespace MobileGL::MG_Backend::DirectVulkan {
 enum class SamplerNumericDomain : Uint8;
 
+// What VkFormat a GL internal format is BACKED with, and how a shadow upload has to be reshaped to
+// fit it. This is not the same question as "is there an exact VkFormat for this GL format", which is
+// what ConvertTextureInternalFormatToVkEnum answers: several GL formats have no Vulkan twin at all
+// (RGBA2, RGBA12) and several three-channel ones are deliberately widened to their four-channel twin
+// because Vulkan devices rarely support the 3-channel layouts.
+//
+// SHARED, and it must stay the only answer to that question. A renderbuffer and a texture of the
+// same GL format have to resolve to the SAME VkFormat or every blit, resolve and glCopyImageSubData
+// between them crosses a size-incompatible pair, which vkCmdCopyImage leaves undefined
+// (VUID-vkCmdCopyImage-srcImage-01548). The renderbuffer path used to carry a hand-maintained second
+// copy of this table that was missing four rows - RGBA2, RGBA4, RGB5A1 and RGBA12 - so those four
+// renderbuffer formats either got no image at all or a 16-bit-packed one facing a 32-bit texture.
+struct TextureFormatInfo {
+    VkFormat format = VK_FORMAT_UNDEFINED;
+    // The GL format has three channels and is carried in a four-channel image; a shadow upload has
+    // to be expanded, inserting `alphaBytes` after every `componentByteCount * 3` source bytes.
+    Bool expandRgbToRgba = false;
+    Uint32 componentByteCount = 0;
+    Array<Uint8, 4> alphaBytes = {0, 0, 0, 0};
+};
+
+// Callers that only need the backing VkFormat (a renderbuffer has no shadow upload to reshape) take
+// `.format` and ignore the rest.
+TextureFormatInfo ResolveTextureFormatInfo(TextureInternalFormat format);
+
 // A GL 1D-ARRAY level keeps its LAYER COUNT in the state-side HEIGHT: that is what
 // glTexImage2D(GL_TEXTURE_1D_ARRAY, width, layers) means, and the frontend records the level
 // as {width, layers, 1} (see GL_Texture.cpp's AllocateStorage and the completeness walk in
@@ -41,6 +68,58 @@ inline IntVec3 ToVulkanLevelExtent(TextureTarget stateTarget, const IntVec3& glT
     return glTexelSize;
 }
 
+// How many Vulkan array layers (or, for a 3D image, z slices) a GL framebuffer attachment spans.
+//
+// THE ONE COPY, deliberately. This used to exist twice - privately in VkRenderPassManager.cpp and
+// again in VkClearManager.cpp - and the two are not independent: the render pass builds the
+// attachment view and VkFramebufferCreateInfo::layers from one, while the CLEAR key built from the
+// other is written verbatim into VkImageSubresourceRange::layerCount when a queued glClear is
+// materialised outside a render pass (MaterializePendingClearForTexture). They are two consumers
+// of the same GL clear, so any disagreement means the same glClear produces two different pictures
+// depending only on which path happens to consume it first - and the materialise path then POPS
+// the entry, so the other one never runs. Fixing one copy and leaving the other is exactly how
+// that split gets introduced; keep them the same function.
+//
+// Two shapes make this more than `size.z()`:
+//   * GL_TEXTURE_1D_ARRAY keeps its layer count in the state-side HEIGHT (see ToVulkanLevelExtent
+//     just above), so z reads 1 and every layer above the first was silently dropped.
+//   * GL_TEXTURE_CUBE_MAP is attached layered as its REPRESENTATIVE upload target, the +X face
+//     (ResolveRepresentableFramebufferTextureUploadTarget), and one face's level size has z = 1 -
+//     but a layered cube attachment names all six faces (GL 4.6 core 9.2.8), which are the image's
+//     six array layers. A cube ARRAY needs no such arm: its representative target carries 6n in z.
+inline Uint32 ResolveAttachmentLayerCount(const MG_State::GLState::FramebufferAttachmentObject& attachment) {
+    if (!attachment.IsLayered()) {
+        return 1u;
+    }
+    const auto& texture = attachment.GetTexture();
+    const TextureTarget target = texture != nullptr ? texture->GetTarget() : TextureTarget::Unknown;
+    if (target == TextureTarget::TextureCubeMap) {
+        return 6u;
+    }
+    return static_cast<Uint32>(std::max(ToVulkanLevelExtent(target, attachment.GetSize()).z(), 1));
+}
+
+// A GL framebuffer attachment's level/layer, and a GL image unit's, are relative to the texture
+// the application NAMED. When that texture was created by glTextureView (ARB_texture_view) they
+// are relative to the VIEW, and have to be shifted into the storage image's numbering before they
+// can index a Vulkan subresource - DirectVulkan gives a view no image of its own, it shares the
+// storage texture's (VkTextureManager::StorageTextureOf).
+//
+// Apply EXACTLY ONCE, at the boundary where a GL level/layer becomes a subresource index. Every
+// GetOrCreate*View entry point below expects values that have already been through here, and so
+// does everything that reads or copies an attachment directly. Both are identity on a plain
+// texture (TEXTURE_VIEW_MIN_LEVEL / MIN_LAYER are 0 there), so the conversion is unconditional
+// and there is no second, view-only code path to keep in step.
+inline Uint32 ToStorageMipLevel(const MG_State::GLState::ITextureObject* texture, Int glLevel) {
+    const Uint32 level = static_cast<Uint32>(glLevel > 0 ? glLevel : 0);
+    return texture != nullptr ? level + static_cast<Uint32>(texture->GetViewMinLevel()) : level;
+}
+
+inline Uint32 ToStorageArrayLayer(const MG_State::GLState::ITextureObject* texture, Int glLayer) {
+    const Uint32 layer = static_cast<Uint32>(glLayer > 0 ? glLayer : 0);
+    return texture != nullptr ? layer + static_cast<Uint32>(texture->GetViewMinLayer()) : layer;
+}
+
 class VkTextureManager {
 public:
     // Monotonic epoch bumped whenever a texture VkImage is (re)created. The render-pass
@@ -139,17 +218,35 @@ public:
             }
         };
 
+        // Layer range and aspect join the key because a GL texture view (ARB_texture_view) can
+        // differ from its storage on either: the Better Clouds shape samples ONE D24S8 image
+        // through two GL names in one draw, the parent with the stencil aspect and the view with
+        // the depth aspect, and a layer-sliced view of an array texture names a sub-range of the
+        // same image. Without these two fields those views would alias each other in the cache.
         struct SampledImageViewKey {
             Uint32 baseMipLevel = 0;
             Uint32 levelCount = 1;
+            Uint32 baseArrayLayer = 0;
+            Uint32 layerCount = 1;
             VkImageViewType viewType = VK_IMAGE_VIEW_TYPE_2D;
             VkFormat format = VK_FORMAT_UNDEFINED;
+            VkImageAspectFlags aspect = VK_IMAGE_ASPECT_COLOR_BIT;
+            // GL_TEXTURE_SWIZZLE_* is per-texture state, so two views over one storage with the
+            // same window but different swizzles are different views. Baked into the key because
+            // a GL texture view's ONLY sampled view lives in this cache: unlike the storage
+            // texture's own sampledView, which SyncTextureViews rebuilds whenever the params
+            // version moves, nothing else would ever notice a swizzle change on a view.
+            Uint32 componentSwizzle = 0;
 
             Bool operator==(const SampledImageViewKey& other) const {
                 return baseMipLevel == other.baseMipLevel &&
                        levelCount == other.levelCount &&
+                       baseArrayLayer == other.baseArrayLayer &&
+                       layerCount == other.layerCount &&
                        viewType == other.viewType &&
-                       format == other.format;
+                       format == other.format &&
+                       aspect == other.aspect &&
+                       componentSwizzle == other.componentSwizzle;
             }
         };
 
@@ -157,10 +254,15 @@ public:
             SizeT operator()(const SampledImageViewKey& key) const {
                 SizeT hash = std::hash<Uint32>{}(key.baseMipLevel);
                 hash ^= std::hash<Uint32>{}(key.levelCount) + 0x9e3779b9u + (hash << 6) + (hash >> 2);
+                hash ^= std::hash<Uint32>{}(key.baseArrayLayer) + 0x9e3779b9u + (hash << 6) + (hash >> 2);
+                hash ^= std::hash<Uint32>{}(key.layerCount) + 0x9e3779b9u + (hash << 6) + (hash >> 2);
                 hash ^= std::hash<Uint32>{}(static_cast<Uint32>(key.viewType)) +
                         0x9e3779b9u + (hash << 6) + (hash >> 2);
                 hash ^= std::hash<Uint32>{}(static_cast<Uint32>(key.format)) +
                         0x9e3779b9u + (hash << 6) + (hash >> 2);
+                hash ^= std::hash<Uint32>{}(static_cast<Uint32>(key.aspect)) +
+                        0x9e3779b9u + (hash << 6) + (hash >> 2);
+                hash ^= std::hash<Uint32>{}(key.componentSwizzle) + 0x9e3779b9u + (hash << 6) + (hash >> 2);
                 return hash;
             }
         };
@@ -358,6 +460,58 @@ public:
     // present-less frame-boundary drain.
     void CollectAllDeferredReleases();
 
+    // ---- GL texture views (ARB_texture_view / GL 4.6 core 8.18) ----
+    // The GL texture whose STORAGE backs the given one: itself, or - for a texture created by
+    // glTextureView - the texture it views. Every image-scoped question (which VkImage, its
+    // LAYOUT, its uploads, its extent, its usage) must be asked of this object, because a view
+    // has none of its own; only the VkImageViews differ per GL texture object. Sharing one
+    // TextureResource is not an optimisation, it is the only correct arrangement: layout is a
+    // property of the image, and VulkanRenderer caches raw pointers straight to the resource's
+    // layout field, so a second resource aliasing the same image would desynchronise the moment
+    // either of them transitioned it.
+    static MG_State::GLState::ITextureObject& StorageTextureOf(MG_State::GLState::ITextureObject& texture);
+
+    // The window a GL texture object opens onto its storage image. For a plain texture this is
+    // the resource's own full extent; for a view it is the sub-range, format and aspect
+    // glTextureView gave it. Views built from a non-default window must live in the KEYED caches
+    // (attachmentViews / alternateSampledViews), never in the per-mip vectors, which belong to
+    // the storage texture's own defaults.
+    struct TextureViewWindow {
+        Uint32 baseMipLevel = 0;
+        Uint32 levelCount = 1;
+        Uint32 baseArrayLayer = 0;
+        Uint32 layerCount = 1;
+        VkFormat format = VK_FORMAT_UNDEFINED;
+        VkImageViewType viewType = VK_IMAGE_VIEW_TYPE_2D;
+        VkImageAspectFlags sampledAspect = VK_IMAGE_ASPECT_COLOR_BIT;
+        VkComponentMapping components{VK_COMPONENT_SWIZZLE_R, VK_COMPONENT_SWIZZLE_G, VK_COMPONENT_SWIZZLE_B,
+                                      VK_COMPONENT_SWIZZLE_A};
+        Bool isTextureView = false;
+    };
+
+    // The four component swizzles packed into one value, for the sampled-view cache key.
+    static Uint32 PackComponentSwizzle(const VkComponentMapping& components) {
+        return (static_cast<Uint32>(components.r) & 0xFFu) | ((static_cast<Uint32>(components.g) & 0xFFu) << 8) |
+               ((static_cast<Uint32>(components.b) & 0xFFu) << 16) |
+               ((static_cast<Uint32>(components.a) & 0xFFu) << 24);
+    }
+    TextureViewWindow ResolveTextureViewWindow(MG_State::GLState::ITextureObject& texture,
+                                               const TextureResource& resource) const;
+    // Records what a GL texture view needs of the image it views, so the next sync of the
+    // STORAGE texture creates (or recreates and copies forward) an image the view can be built
+    // over. See m_viewRequestedImageFlags for why this is lazy rather than unconditional.
+    void NoteTextureViewImageRequirements(MG_State::GLState::ITextureObject& viewTexture,
+                                          MG_State::GLState::ITextureObject& storageTexture);
+    VkImageCreateFlags GetViewRequestedImageFlags(const MG_State::GLState::ITextureObject& storageTexture) const;
+    // Appends every format a GL texture view reinterprets this storage as, for the narrowed
+    // VkImageFormatListCreateInfo the image is created with.
+    void AppendViewRequestedFormats(const MG_State::GLState::ITextureObject& storageTexture,
+                                    Vector<VkFormat>& outFormats) const;
+    // Builds (and caches, keyed by the whole window) one sampled VkImageView over a storage
+    // image. Shared back end of every GL-texture-view sampled path.
+    VkImageView GetOrCreateWindowedSampledView(MG_State::GLState::ITextureObject& texture,
+                                               TextureResource& resource, const TextureViewWindow& window);
+
     TextureResource* SyncTextureAndGetDescriptor(
         MG_State::GLState::ITextureObject& texture);
     VkImageView GetOrCreateViewAtMipLevel(MG_State::GLState::ITextureObject& texture, Uint32 mipLevel);
@@ -572,6 +726,19 @@ private:
     std::unordered_map<TextureIdentity, TextureResource, TextureIdentityHash> m_textureResources;
     // Textures that have been bound to a GL image unit (see MarkStorageImageTexture).
     std::unordered_set<TextureIdentity, TextureIdentityHash> m_storageImageTextures;
+    // Extra VkImageCreateFlags a GL texture view needs on the storage image it views, keyed by
+    // the STORAGE texture's identity. Requested lazily, exactly like STORAGE usage above and for
+    // the same reason: VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT costs bandwidth compression on tilers
+    // (it is what VK_KHR_image_format_list exists to claw back), so setting it on every
+    // immutable-storage texture would tax every glTexStorage2D render target in a game for a
+    // feature almost none of them use. A SAME-format view - which is the common case, and the
+    // Better Clouds case - needs no flag at all and therefore costs nothing.
+    std::unordered_map<TextureIdentity, VkImageCreateFlags, TextureIdentityHash> m_viewRequestedImageFlags;
+    // Every VkFormat a GL texture view has asked to reinterpret this storage as. The narrowed
+    // VkImageFormatListCreateInfo the image is created with must name them: the list is a promise
+    // that NO other format will ever be viewed, and building a view outside it is
+    // VUID-VkImageViewCreateInfo-pNext-01585. Keyed, like the flags above, by the STORAGE texture.
+    std::unordered_map<TextureIdentity, std::unordered_set<VkFormat>, TextureIdentityHash> m_viewRequestedFormats;
     // Supported multisample counts per format, so repeat texture syncs do not
     // re-query vkGetPhysicalDeviceImageFormatProperties.
     std::unordered_map<VkFormat, VkSampleCountFlags> m_multisampleCountsByFormat;

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.h

@@ -9,6 +9,7 @@
 #pragma once
 #include "Config.h"
 #include "FrameContext.h"
+#include "MagmaPipeArms.h"
 #include "PipelineFactory.h"
 #include "ProgramFactory.h"
 #include "SwapchainObject.h"
@@ -24,6 +25,13 @@
 #include "MG_Util/Math/VectorTypes.h"
 #include <Includes.h>
 #include <MG_Backend/BackendObject.h>
+#include <MG_Pipe/MGPipeHandles.h>
+#include <MG_Util/SelfTest/PrimitivesGeneratedNoXfbProbe.h>
+#if MOBILEGL_PIPE_PUSH
+// The applier's CSO store: MGPipeApplier().BoundRenderStateCso is what the pipeline memo
+// keys on after P2 (D12.1). Push-only, so the pull build's include graph is unchanged.
+#include <MG_Pipe/PipeApply.h>
+#endif
 #include <vk_mem_alloc.h>
 
 #include "../VkIncludes.h"
@@ -563,7 +571,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Native subgroup topology, queried at device creation for the compute-module
         // subgroup repairs (SubgroupSupportPolicy.h) and the REQUIRE_FULL_SUBGROUPS
         // stage flag; 0 / false when the device has no usable compute subgroups or
-        // MOBILEGL_DISABLE_SUBGROUP forced them off.
+        // MOBILEGL_MAGMA_DISABLE_SUBGROUP forced them off.
         Uint32 m_nativeSubgroupSize = 0;
         Bool m_nativeSubgroupSupported = false;
         Bool m_computeFullSubgroupsFeatureEnabled = false;
@@ -584,6 +592,30 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // needs no feature). Both cached at device creation and drive a hard-fail-at-draw when absent.
         Bool m_dualSrcBlendFeatureEnabled = false;
         Bool m_primitiveTopologyListRestartFeatureEnabled = false;
+        // shaderTessellationAndGeometryPointSize gates the PointSize built-in in a tessellation
+        // or geometry stage, which desktop GL treats as an ordinary per-vertex output (writable,
+        // and capturable by name through transform feedback). Cached at device creation and
+        // handed to ProgramFactory, which refuses a program whose tessellation or geometry module
+        // declares the matching SPIR-V capability while this is false - SetupDraw then skips its
+        // draws (VkProgramObject::pointSizeCapabilityUnsupported) rather than building a pipeline
+        // that is invalid usage.
+        Bool m_tessellationAndGeometryPointSizeFeatureEnabled = false;
+        // VK_EXT_custom_border_color. Vulkan's four predefined VkBorderColor values cover only
+        // transparent/opaque black and opaque white; GL_TEXTURE_BORDER_COLOR is an arbitrary vec4 (or
+        // an arbitrary ivec4/uvec4 through the "I" entry points). Without this extension a border
+        // colour outside the palette has to be snapped to the nearest predefined one. Both features
+        // are required together: customBorderColorWithoutFormat is what lets a sampler carry a custom
+        // colour without naming the image format it will be paired with, which GL's sampler objects
+        // cannot know. maxCustomBorderColorSamplers is a real device limit, so the sampler cache has
+        // to be able to fall back to the snapped value once it is reached.
+        Bool m_customBorderColorFeatureEnabled = false;
+        Uint32 m_maxCustomBorderColorSamplers = 0;
+        // sampleRateShading gates VkPipelineMultisampleStateCreateInfo::sampleShadingEnable, i.e.
+        // glEnable(GL_SAMPLE_SHADING) + glMinSampleShading. Unlike dualSrcBlend this does NOT
+        // hard-fail the draw when absent: sample shading is a rate hint, and every sample-rate
+        // pipeline is still correct (just not per-sample) at the default rate - so the enable is
+        // dropped and the draw proceeds, which is what a GL implementation with SAMPLES=1 does too.
+        Bool m_sampleRateShadingFeatureEnabled = false;
         // multiViewport gates rasterizing into more than one of ARB_viewport_array's 16 viewports
         // (gl_ViewportIndex). m_maxRasterizableViewports is min(MAX_VIEWPORTS, device limit), or 1
         // when the feature is off, and is the viewportCount a gl_ViewportIndex-writing pipeline
@@ -650,8 +682,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // per object: one group of four slots each, handed out on first use.
         static constexpr SizeT kXfbCounterObjectSlots = 16;
         VkBufferObject m_xfbCounterBuffer;
-        UnorderedMap<Uint, Uint32> m_xfbCounterSlotByObject;
+        // Which transform feedback object owns each slot group, by the frontend's never-reused
-        Uint32 m_xfbNextCounterSlot = 0;
+        // lifetime id (0 = the slot is free). This used to be an UnorderedMap keyed on the GL
+        // NAME, which is recycled by glGenTransformFeedbacks: a deleted-and-recreated object
+        // inherited the dead one's slot, and since nothing ever removed an entry the map also
+        // grew for the life of the context. A fixed table cannot do either: a group is taken over
+        // only from an owner with no OPEN span (see CurrentXfbCounterSlot), so an object whose
+        // counters can still be resumed never loses them, and a dead object's group comes back.
+        Array<Uint64, kXfbCounterObjectSlots> m_xfbCounterSlotOwner{};
+        // Tie-break among reclaimable groups only; never on its own, because the paused span the
+        // groups exist for is by construction the least recently used one.
+        Array<Uint64, kXfbCounterObjectSlots> m_xfbCounterSlotLastUse{};
+        Uint64 m_xfbCounterSlotUseSerial = 0;
         // Set for a slot once a captured draw has been recorded into its span; selects
         // counter-buffer resume on the next captured draw of the same span.
         Array<Bool, kXfbCounterObjectSlots> m_xfbCountersValid{};
@@ -693,15 +735,74 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Vector<Uint32> m_xfbQueryActiveSlots[2];
         Bool m_xfbQuerySlotOpen = false;
         Uint32 m_xfbQueryOpenSlot = 0;
+        // GL_PRIMITIVES_GENERATED reroute for draws made while transform feedback is
+        // INACTIVE. The stream pool's primitivesNeeded is defined to count those draws
+        // too, but a Mali driver (and Mesa lavapipe) answers 0 unless a capture span
+        // is open (the CTS's tessellator-measuring shape). Where the bring-up probe
+        // finds that defect with a working control - or
+        // MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE forces it - such draws accumulate the
+        // GENERATED count through this pool instead, whose type the arming picks:
+        // VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT where the device hosts the dedicated
+        // query with its rasterizer-discard feature (exact semantics by definition -
+        // the extension exists because GL needs this count without a capture), else a
+        // VK_QUERY_TYPE_PIPELINE_STATISTICS pool over clipping-stage invocations (one
+        // per primitive reaching primitive clipping - after every vertex processing
+        // stage, before rasterizer discard - which is the same set).
+        // XFB-ACTIVE draws keep the stream slot (exact today, and WRITTEN needs it);
+        // every draw with no open capture - a PAUSED span's draws included - takes a
+        // reroute slot, and the span then ignores the frontend's CPU paused-primitive
+        // counter rather than adding it on top (see IsPrimGenRerouteArmed): that
+        // counter is written by only 3 of the ~15 draw entry points and answers 0 for
+        // GL_PATCHES, so it cannot price the draws this reroute exists to repair. One
+        // GL query span may therefore hold slots of both pools.
+        Bool m_pipelineStatisticsQueryFeatureEnabled = false;
+        // VK_EXT_primitives_generated_query: base feature, and the
+        // ...WithRasterizerDiscard feature without which a discarding draw inside the
+        // query is invalid usage (so the reroute never picks the dedicated pool on a
+        // base-only device - GL applications toggle discard freely).
+        Bool m_primitivesGeneratedQueryFeatureEnabled = false;
+        Bool m_primitivesGeneratedQueryDiscardFeatureEnabled = false;
+        // tessellationShader was enabled at device creation (it is taken whenever the
+        // device advertises it); gates the probe's PATCHES shape.
+        Bool m_tessellationShaderFeatureEnabled = false;
+        MG_Util::SelfTest::PrimGenRerouteKind m_primGenRerouteKind =
+            MG_Util::SelfTest::PrimGenRerouteKind::None;
+        // The bring-up probe measured this device's stream query as counting draws made
+        // with no capture span open (the StreamCounts verdict) - so it counts the
+        // PAUSED-span ones too, through the stream slot they take when nothing is
+        // rerouted. Only the probe can know this, so it stays false wherever the probe
+        // is not consulted (the forced arms), which keeps those lanes' accounting as it
+        // was.
+        Bool m_primGenStreamCountsXfbInactiveDraws = false;
+        VkQueryPool m_primGenReroutePool = VK_NULL_HANDLE;
+        Uint32 m_primGenRerouteSlotCursor = 0;
+        Vector<Uint32> m_primGenRerouteActiveSlots;
+        Bool m_primGenRerouteSlotOpen = false;
+        Uint32 m_primGenRerouteOpenSlot = 0;
+        // Runs the bring-up probe (memoized per process) and decides
+        // m_primGenRerouteKind. Called at the end of device creation: it records on
+        // m_graphicsQueue, which nothing else is using yet.
+        void ArmPrimGenReroute();
 
     public:
+        // Whether a GENERATED span opened now will have the draws made while the GL
+        // span is PAUSED counted on the GPU - through the reroute pool, which takes
+        // every draw with no open capture, or (where the reroute is not armed because
+        // the stream query was measured to count capture-less draws) through the stream
+        // slot such a draw still takes. The frontend's CPU paused-primitive counter
+        // must not be added on top of either: it would double count, and it cannot
+        // price the draws that matter anyway - only 3 of the ~15 draw entry points
+        // write it and it answers 0 for GL_PATCHES. Read once per span, after
+        // StartXfbQueryCapture (whose pool creation may disarm the reroute).
+        Bool ArePausedDrawsGpuCounted() const;
         // kind: 0 = PRIMITIVES_WRITTEN, 1 = PRIMITIVES_GENERATED.
         Bool StartXfbQueryCapture(Uint32 kind);
-        void StopXfbQueryCapture(Uint32 kind, Vector<Uint32>& outSlots);
+        void StopXfbQueryCapture(Uint32 kind, Vector<Uint32>& outSlots, Vector<Uint32>& outRerouteSlots);
-        Bool ResolveXfbQueryResult(const Vector<Uint32>& slots, Bool wantGenerated, Uint64& outPrimitives);
+        Bool ResolveXfbQueryResult(const Vector<Uint32>& slots, const Vector<Uint32>& rerouteSlots,
+                                   Bool wantGenerated, Uint64& outPrimitives);
 
     private:
-        void BeginXfbQueryForDraw(VkCommandBuffer commandBuffer);
+        void BeginXfbQueryForDraw(VkCommandBuffer commandBuffer, Bool xfbActive);
         void EndXfbQueryForDraw(VkCommandBuffer commandBuffer);
 
         VkCommandPool m_commandPool = VK_NULL_HANDLE;
@@ -726,29 +827,186 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint64 programHash = 0;
             Uint64 vertexInputHash = 0;
             Uint64 renderPassHash = 0;
-            // VALUE hash of the pipeline-relevant fixed-function state (see
+            // The PRE-HANDLE arm's key component (P2 brief D12.1), and 0 in every entry the
-            // ComputePipelineStateHash), not the monotonic pipeline-state version:
+            // handle arm mints. VALUE hash of the pipeline-relevant fixed-function state (see
-            // the version never repeats, so a per-draw GL_BLEND toggle would miss
+            // ComputePipelineStateHash), not the monotonic pipeline-state version: the version
-            // all entries forever even though the state alternates between two
+            // never repeats, so a per-draw GL_BLEND toggle would miss all entries forever even
-            // values the memo already holds.
+            // though the state alternates between two values the memo already holds.
             Uint64 pipelineStateHash = 0;
+#if MOBILEGL_PIPE_PUSH
+            // The HANDLE arm's key component, and the whole of D12.1: the CLIENT already
+            // hashed the pipeline subset of RenderStateParameters and minted a content-
+            // addressed CSO for it (MG_Pipe/MGPipeRenderStateSpans.h, MG_Impl/Pipe/CsoCache),
+            // so re-hashing the same 396 bytes here was work the boundary had already done.
+            // Two draws share a CSO handle exactly when their pipeline bytes are equal, and
+            // the client's subset is a strict SUPERSET of what ComputePipelineStateHash read,
+            // so the handle discriminates at least as finely as the hash it replaces.
+            //
+            // renderPassHash STAYS beside it and is what keeps this key complete: the CSO
+            // carries GL state only, while colorAttachmentCount and the rasterization sample
+            // count - which ComputePipelineStateHash folded in through its signature and
+            // through ResolveEffectiveSampleMask - are render-pass facts that the render-pass
+            // hash already separates.
+            //
+            // Null in an entry minted by the legacy arm, so entries of the two arms can never
+            // match each other: the compare below tests BOTH components.
+            MG_Pipe::MGPipeHandle renderStateCso = MG_Pipe::kMGPipeNullHandle;
+#endif
             ProgramFactory::CompileOptionFlags transformFlags = {};
+            // Baked into the pipeline (PipelineFactory::ComputeHash mixes it), and NOT derivable
+            // from anything else in this key: it depends on whether the draw is indexed and on the
+            // index type, neither of which the mode/program/state hashes carry. Without it an
+            // indexed and a non-indexed draw over the same program and state collide on one entry
+            // and the second one gets the first one's restart setting.
+            Bool primitiveRestartEnable = false;
             VkPipeline pipeline = VK_NULL_HANDLE;
         };
         static constexpr Uint32 kPipelineMemoSize = 8;
         PipelineMemoEntry m_pipelineMemo[kPipelineMemoSize];
         Uint32 m_pipelineMemoCount = 0;
         Uint32 m_pipelineMemoNext = 0;
-        // Hash of every fixed-function GL state the pipeline payload reads that the
+
-        // memo key's other fields (mode / program / vertex input / render pass /
+#if MOBILEGL_PIPE_PUSH
-        // transform flags) do not already pin down. Equal hash under an equal rest
+        // P2 D12.1's arm selector, and the whole of the pipeline memo's re-key. Returns the
-        // of key => byte-identical PipelineCreatePayload. Cached per pipeline-state
+        // render-state CSO this draw is keyed on, or the null handle when the pre-handle arm
+        // is the one that runs.
+        //
+        // Under the handle arm the memo's state key IS this handle. The client hashed those
+        // 396 pipeline bytes when it minted the CSO (MGPipeComputePipelineSubsetHash), so
+        // recomputing an overlapping hash here was work the boundary had already done; the
+        // client's pipeline subset is a strict SUPERSET of what ComputePipelineStateHash read,
+        // so the handle discriminates at least as finely as the hash it replaces. What the
+        // handle does NOT carry is the render-pass side - colorAttachmentCount and the
+        // rasterization sample count, which ComputePipelineStateHash folded in through its
+        // signature and through ResolveEffectiveSampleMask - and that is exactly why
+        // entry.renderPassHash stays in the key beside it.
+        //
+        // The arm is live only when the render-state subsystem is migrated in this run AND the
+        // client has actually bound a CSO. The second half is not belt and braces: a tree whose
+        // tracker does not emit create/bind_render_state yet has no handle to key on, and
+        // delete_render_state clears the binding (MG_Pipe/PipeApply.cpp), so the null handle is
+        // reachable on any tree. Keying every draw on it would alias every render state onto
+        // one memo entry, so a null handle means "fall back to a state hash" - never an abort,
+        // and never a per-draw consultation of the legacy-memo lever: bit 0 is not a Track-H
+        // subsystem (D14 labels only bits 5 and 6 that), and the lever's Fatal is a STARTUP
+        // one, in MagmaPipeValidateSubsystemConfiguration.
+        //
+        // The fallback is warned ONCE rather than logged at debug, and that is deliberate: a
+        // silent fallback is what makes "the CSO arm never ran" easy to miss. W is compiled in
+        // at every shipped log level.
+        //
+        // The latch is a plain member bool, NOT MGLOG_W_ONCE. MOBILEGL_LOG_ONCE_INTERNAL
+        // (MG_Util/Debug/Log.h) is an UNCONDITIONAL std::atomic_flag::test_and_set - a locked
+        // xchg, executed on every evaluation, not "one static bool test" as an earlier round of
+        // this comment claimed - and this site is on the per-draw pipeline path in the very
+        // configuration that reaches it (no tracker: every draw). ROADMAP.md:7 forbids leaving
+        // instrumentation on a hot path, so the once-ness is one non-atomic, always-predicted
+        // load of a member that is false exactly once. Single-threaded like the rest of the
+        // renderer, and per renderer rather than per process, which is also the right scope: a
+        // second context that never binds a CSO deserves to say so.
+        //
+        // What the absence of this warning from a run's log proves, EXACTLY: that no draw took
+        // the fallback WHILE bit 0 was set. With kMGPipeSubsystemRenderState clear the function
+        // returns before the latch, so absence proves nothing at all - and no draw is keyed on a
+        // handle either. Grep the mask out of the log beside it (review v2 minor 3).
+        //
+        // Push-only by construction: the pull build does not compile this function at all, so
+        // its two callers are statement-for-statement what they were (G1).
+        //
+        // [routed to the integrator, review v2 minor 11] MG_Pipe::MGPipeApplier() is ONE
+        // process-global applier (MG_Pipe/PipeApply.cpp), not the per-context CSO store D2
+        // specifies. In a multi-context process this reads whatever CSO another context last
+        // bound. The defect is package A's and the fix belongs there; Magma is its only P2
+        // consumer, so it is named here rather than left for both reviews to assume the other
+        // caught it.
+        MG_Pipe::MGPipeHandle ResolveBoundRenderStateCso() const {
+            if (!MagmaPipeSubsystemOn(MG_Pipe::kMGPipeSubsystemRenderState)) {
+                return MG_Pipe::kMGPipeNullHandle;
+            }
+            const MG_Pipe::MGPipeHandle boundCso = MG_Pipe::MGPipeApplier().BoundRenderStateCso;
+            if (MG_Pipe::MGPipeHandleIsNull(boundCso) && !m_pipelineCsoFallbackWarned) {
+                m_pipelineCsoFallbackWarned = true;
+                MGLOG_W("MGPipe: kMGPipeSubsystemRenderState is on but no render-state CSO is "
+                        "bound; the pipeline memo is running on a state hash, not on the CSO "
+                        "handle (no tracker on this build, or a draw between "
+                        "delete_render_state and the next bind)");
+            }
+            return boundCso;
+        }
+        // Latch for the warning above. Mutable because the resolve is const and the latch is
+        // not part of the renderer's observable state.
+        mutable Bool m_pipelineCsoFallbackWarned = false;
+        // The memo key's STATE-HASH half, for a draw that has no CSO handle to key on: the
+        // pre-handle arm, and the fallback of D12.1's handle arm. Cached on the pipeline-state
+        // version plus the two render-pass facts the hash's inputs depend on, so an unchanged
+        // (version, colorAttachmentCount, sampleCount) proves the bytes are unchanged.
+        //
+        // [deviation from D12.1] The brief deletes this gate and its cached fields outright.
+        // They cannot go while a no-CSO draw is reachable - and it is, on any tree: a draw
+        // between delete_render_state and the next bind has no handle. On a tree whose tracker
+        // binds a CSO these five words are written once and never read again; they retire for
+        // real when the pull path does, at P13.
+        Uint64 ResolveFallbackPipelineStateHash(Uint renderStateVersion, Uint32 colorAttachmentCount,
+                                                VkSampleCountFlagBits rasterizationSamples) {
+            if (!m_pipelineStateHashValid || m_pipelineStateHashVersion != renderStateVersion ||
+                m_pipelineStateHashColorCount != colorAttachmentCount ||
+                m_pipelineStateHashSampleCount != rasterizationSamples) {
+#if MOBILEGL_PIPE_LEGACY_MEMOS
+                m_pipelineStateHash =
+                    ComputePipelineStateHash(colorAttachmentCount, rasterizationSamples);
+#else
+                m_pipelineStateHash = ComputePipelineSubsetStateHashFallback();
+#endif
+                m_pipelineStateHashVersion = renderStateVersion;
+                m_pipelineStateHashColorCount = colorAttachmentCount;
+                m_pipelineStateHashSampleCount = rasterizationSamples;
+                m_pipelineStateHashValid = true;
+            }
+            return m_pipelineStateHash;
+        }
+#endif // MOBILEGL_PIPE_PUSH
+#if MOBILEGL_PIPE_PUSH && !MOBILEGL_PIPE_LEGACY_MEMOS
+        // The same answer as ComputePipelineStateHash, computed from the P2 chunk table
+        // instead of from a hand-written field list, for the build that compiles no
+        // pre-handle arm (cmake -DMOBILEGL_PIPE_LEGACY_MEMOS=OFF). It is the CLIENT's own
+        // hash function - MGPipeComputePipelineSubsetHash over the 396 pipeline bytes - so a
+        // draw keyed on it and a draw keyed on a CSO handle are keyed on the same equivalence
+        // class of state, and the render-pass facts stay separated by renderPassHash either
+        // way. This is what makes the no-legacy build RUNNABLE rather than a configuration
+        // that aborts on the first draw that arrives without a CSO.
+        Uint64 ComputePipelineSubsetStateHashFallback() const;
+#endif
+#if MOBILEGL_PIPE_LEGACY_MEMOS
+        // THE PRE-HANDLE ARM (P2 brief D12.1 / D14). Hash of every fixed-function GL state the
+        // pipeline payload reads that the memo key's other fields (mode / program / vertex
+        // input / render pass / transform flags) do not already pin down. Equal hash under an
+        // equal rest of key => byte-identical PipelineCreatePayload. Cached per pipeline-state
         // version: the version is monotonic and bumps on every pipeline-state
         // change, so an unchanged (version, colorAttachmentCount) proves the state
         // bytes are unchanged and the hash can be reused without re-reading them.
-        Uint64 ComputePipelineStateHash(Uint32 colorAttachmentCount) const;
+        //
+        // The handle arm computes none of this: the client hashed the same bytes when it
+        // minted the CSO, so all five cached-hash members below exist only to avoid a
+        // re-hash the handle arm never performs.
+        Uint64 ComputePipelineStateHash(Uint32 colorAttachmentCount,
+                                        VkSampleCountFlagBits rasterizationSamples) const;
+#endif
+        // The effective GL_SAMPLE_MASK word for a draw at this rasterization sample count; see
+        // the definition for the GL-vs-Vulkan rule it reconciles. Shared by the pipeline payload
+        // and the pipeline-state memo word so the two cannot disagree. NOT part of the legacy
+        // arm: it is a PAYLOAD computation that depends on rasterizationSamples, so it survives
+        // the re-key and keeps reading Multisample / SampleMask / SampleMaskValue out of the
+        // working block.
+        Uint32 ResolveEffectiveSampleMask(VkSampleCountFlagBits rasterizationSamples) const;
+        // ResolveFallbackPipelineStateHash's cache. Written once and never read again on a
+        // build whose client binds a render-state CSO; see that function for why it survives
+        // the re-key at all.
         Uint m_pipelineStateHashVersion = 0;
         Uint32 m_pipelineStateHashColorCount = 0;
+        // The sample count the cached hash was computed at. A pipeline-state input now depends on
+        // it (the effective sample mask), so a draw that changes only the target's sample count
+        // has to recompute rather than reuse.
+        VkSampleCountFlagBits m_pipelineStateHashSampleCount = VK_SAMPLE_COUNT_1_BIT;
         Uint64 m_pipelineStateHash = 0;
         Bool m_pipelineStateHashValid = false;
         // GetShaderTransformFlags memo. NOT pure in the pre-transform alone: the
@@ -768,7 +1026,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Drops every memoized pipeline handle. Required at command-buffer
         // boundaries and whenever any pipeline may have been destroyed. Also drops
         // the cached pipeline-state hash: the same boundaries can retire the GL
-        // context whose monotonic version the cache is keyed on.
+        // context whose monotonic version the cache is keyed on. The handle arm has no
+        // such cache to drop - a CSO handle is not derived from a monotonic version.
         void InvalidatePipelineMemo() {
             m_pipelineMemoCount = 0;
             m_pipelineMemoNext = 0;
@@ -790,7 +1049,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Skip the per-draw CollectSampledTextures walk (~5% of the render thread) when the sampled
         // texture SET is provably unchanged from the previous draw: same program (lifetime id +
         // backend-state version, which covers sampler-uniform reassignment / relink) and transform
-        // flags, and no texture bind/unbind/delete since (GetTextureBindGeneration). On a hit,
+        // flags, no texture bind/unbind/delete since (GetTextureBindGeneration), and nothing that
+        // moves a texture's shape or a sampler's parameters since (GetSamplingResolutionGeneration
+        // - membership depends on mipmap-completeness, which both of those decide). On a hit,
         // m_sampledTexturesScratch still holds the previous draw's list and steps 2-4 (feedback /
         // layout probe / transition) re-run on it, so layout correctness is unaffected - only the GL
         // walk is skipped. The program lifetime id (never reused, unlike the GL name) and the
@@ -801,6 +1062,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Uint32 m_lastSampledSetProgramVersion = 0;
         ProgramFactory::CompileOptionFlags m_lastSampledSetTransformFlags = {};
         Uint64 m_lastSampledSetBindGeneration = 0;
+        Uint64 m_lastSampledSetSamplingGeneration = 0;
+        // Set from the draw's resolved VkProgramObject on both the full and the fast setup paths;
+        // read by BeginXfbCaptureForDraw, which has only GL state otherwise. See
+        // VkProgramObject::xfbCaptureDeclined.
+        Bool m_currentDrawXfbCaptureDeclined = false;
 
         // Memo for the per-draw explicit-LOD-0 eligibility probe
         // (ProgramSamplesOnlySingleLevelTextures): same key family as the
@@ -852,6 +1118,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // common shape), and "the VAO did not move" would then skip the layout
             // re-resolve for a different VAO.
             Uint64 vaoLifetimeId = 0;
+#if MOBILEGL_PIPE_PUSH
+            // P2 D12.4: the handle arm's answer to the same question, and one compare rather
+            // than the pair above. Kept BESIDE them rather than replacing them because the
+            // pre-handle arm is still compiled (MOBILEGL_PIPE_LEGACY_MEMOS) and this snapshot
+            // is a value struct, not a wire type.
+            MG_Pipe::MGPipeHandle vaoHandle = MG_Pipe::kMGPipeNullHandle;
+#endif
             Uint32 vaoConfigVersion = 0;
             const void* drawFbo = nullptr;
             // Never-reused lifetime id beside the raw pointer + Uint16 version: a
@@ -865,6 +1138,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint64 bindGeneration = 0;
             Uint32 baseTransformFlags = 0;
             Uint32 resolvedTransformFlags = 0;
+            // What ResolvePrimitiveRestartEnable answered for the draw this snapshot was taken
+            // from, i.e. what its pipeline's primitiveRestartEnable was built with. `aspects`
+            // already separates indexed from non-indexed draws, but not one index TYPE from
+            // another, and a restart index that fits GL_UNSIGNED_INT but not GL_UNSIGNED_SHORT
+            // makes those two draws want different pipelines.
+            Bool primitiveRestartEnable = false;
             Uint64 renderPassHash = 0;
             Uint32 imageIndex = 0;
             Uint64 textureEraseEpoch = 0;
@@ -893,6 +1172,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // probe the pipeline memo after a state change without re-fetching the
             // render-pass entry (the pass itself is pinned by renderPassHash above).
             Uint32 renderPassColorCount = 0;
+            // Pinned with the colour count and for the same reason: the fast path recomputes the
+            // pipeline-state value hash from the snapshot, and that hash reads the sample count.
+            VkSampleCountFlagBits renderPassSampleCount = VK_SAMPLE_COUNT_1_BIT;
             VkPipeline pipeline = VK_NULL_HANDLE;
             // layoutHash of the snapshotting draw's vertex-input state. The pipeline and
             // the vertex-input pre-flight depend on the VAO only through this (plus the
@@ -1117,6 +1399,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         //  - bindings revalidates per draw exactly as before (frame serial, content
         //    hash, per-binding live buffer pointers and slice epochs).
         struct alignas(64) VaoDrawMemo {
+#if MOBILEGL_PIPE_PUSH
+            // P2 D12.4: the handle arm's key, and the ONLY key it needs. {slot, gen} is an
+            // identity, so the pointer-plus-lifetime-id pair below stops being a key here;
+            // the slot also picks the table entry, so the address hash and the two-way probe
+            // go with it. Null in an entry that has never been claimed.
+            MG_Pipe::MGPipeHandle vaoHandle = MG_Pipe::kMGPipeNullHandle;
+#endif
             const MG_State::GLState::VertexArrayObject* vaoKey = nullptr;
             // The VAO's never-reused lifetime id, checked alongside vaoKey. The pointer
             // ALONE is not an identity: a deleted VAO's heap address is handed straight
@@ -1143,8 +1432,48 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // fixed table also makes every VaoDrawMemo/ResolvedVertexBindings pointer
         // stable for the duration of a draw, which the EBO memo handoff
         // (m_currentDrawResolvedEntry) relies on.
+        //
+        // [deviation from D12.4, deliberate and narrow] The brief asks for a grow-on-demand
+        // Vector. This one stays FIXED at exactly the capacity and exactly the 2-way victim
+        // rule it has on the base ref, and only its KEY changes (a {slot, gen} handle instead
+        // of a hashed heap address plus a lifetime id). Two reasons, and the second is the
+        // whole of review v2's MAJOR 1:
+        //   * a VaoDrawMemo is ~450 B (ResolvedVertexBindings dominates), so growing this
+        //     table with the live VAO set is megabytes on a platform with an LMK, where the
+        //     other two memos are 48 B and can afford it;
+        //   * this is the ONLY one of the three memos that had a capacity before this package.
+        //     Losing an entry here costs a vertex-binding re-resolve, exactly what losing it
+        //     cost on the base ref, so at any working-set size this table is no worse than what
+        //     it replaces - and strictly better below capacity, where the handle is a bijection
+        //     with the slot and the two-way probe never collides at all. The other two memos
+        //     (VertexInputStateFactory::m_vaoMemos) had NO capacity, so they keep having none.
         static constexpr Uint32 kVaoDrawMemoSlotCount = 2048; // power of two
         Vector<VaoDrawMemo> m_vaoDrawMemoTable;
+#if MOBILEGL_PIPE_PUSH
+        // The renderer's {slot, gen} mint, shared with its VertexInputStateFactory so both
+        // derive the same handle for the same VAO. Per renderer, never a process-global: a
+        // global would share one table and one reclamation clock across two live contexts and
+        // outlive every one of them (review v2 minor 4).
+        MagmaPipeIdentityTables m_pipeIdentity;
+        // The VAO's {slot, gen}. A one-entry memo hit for every acquisition after a draw's
+        // first, so there is no second memo in front of it here.
+        MG_Pipe::MGPipeHandle ResolveVaoHandle(const MG_State::GLState::VertexArrayObject& vao) {
+            return m_pipeIdentity.HandleOf(MG_Pipe::MGPipeKind::VertexElementsCso,
+                                           vao.GetLifetimeId());
+        }
+#endif
+        // "Is this VAO's content hash already memoized?", asked of whichever side owns the
+        // memo (P2 D12.5). Force-inlined and defined in the class body so that the PULL
+        // build's three readers keep compiling to the very same two loads they always did -
+        // G1 admits no resize, and an out-of-line call here would be one.
+        [[gnu::always_inline]] inline Bool VaoContentHashIfKnown(
+            const MG_State::GLState::VertexArrayObject& vao, Uint64& outHash) const {
+#if MOBILEGL_PIPE_PUSH
+            return m_vertexInputStateFactory->TryGetMemoizedHash(vao, outHash);
+#else
+            return vao.GetBackendHashMemo(outHash);
+#endif
+        }
         // Finds the slot holding `vao`, or recycles the older of its two candidate
         // slots into an empty memo keyed on `vao`. Never returns null.
         VaoDrawMemo* LookupVaoDrawMemo(const MG_State::GLState::VertexArrayObject* vao);
@@ -1168,13 +1497,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         void CreateSwapchain();
         void CreateCommandPool();
 
+        // Whether THIS draw's primitive stream restarts, and therefore what
+        // VkPipelineInputAssemblyStateCreateInfo::primitiveRestartEnable must be. Resolved by the
+        // caller because it needs two facts a pipeline cannot see: whether the draw is indexed at
+        // all (GL primitive restart acts on the index stream, so it is a no-op for glDrawArrays),
+        // and the index TYPE (an application restart index that does not fit the type matches no
+        // index, so that draw restarts nowhere - see UploadAndBindIndexBuffer).
+        Bool ResolvePrimitiveRestartEnable(Flags<DrawSetupAspect> aspects,
+                                           const IndexBufferView* pIndexBufferView) const;
+
         VkPipeline GetOrCreatePipeline(
             GLenum mode,
             const MG_State::GLState::ProgramObject& program,
             const ProgramFactory::VkProgramObject& programObj,
             ProgramFactory::CompileOptionFlags transformFlags,
             const MG_State::GLState::VertexArrayObject& vao,
-            const RenderPassEntry& renderPassEntry);
+            const RenderPassEntry& renderPassEntry,
+            Bool primitiveRestartEnable);
         VkPipeline GetOrCreateComputePipeline(const ProgramFactory::VkProgramObject& programObj);
         void DestroyComputePipelines();
         // Takes the frame rather than a command buffer: a first-time storage-usage upgrade has to
@@ -1241,13 +1580,25 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                    GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1,
                                                    GLint dstX0, GLint dstY0, GLint dstX1, GLint dstY1,
                                                    GLenum filter);
-        // Clears one z slice of a VK_IMAGE_TYPE_3D colour image. See the call site in
+        // Clears one layer of a colour image through a throwaway render pass whose entire content
-        // MaterializePendingClearForTexture for why a transfer clear cannot do this.
+        // is its LOAD_OP_CLEAR. Two callers, both of which a transfer clear cannot serve: a z
+        // slice of a VK_IMAGE_TYPE_3D image (vkCmdClearColorImage cannot name one), and a
+        // MULTISAMPLE image (which carries no TRANSFER_DST usage at all). `finalLayout` is the
+        // layout the caller already tracks for the whole image, so this never has to touch
+        // resource->layout.
         Bool ClearDepthSliceWithRenderPass(VkCommandBuffer commandBuffer,
                                            MG_State::GLState::ITextureObject& texture, Uint32 mipLevel,
-                                           Uint32 depthSlice, const VkClearValue& clearValue);
+                                           Uint32 depthSlice, const VkClearValue& clearValue,
+                                           VkImageLayout finalLayout = VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL);
         Bool MaterializePendingClearForTexture(VkCommandBuffer commandBuffer,
                                                MG_State::GLState::ITextureObject& texture);
+        // The multisample arm of the above. Split out rather than branched inline because it
+        // shares none of the transfer path: a multisample image carries no TRANSFER_DST usage, so
+        // neither the TRANSFER_DST transition nor vkCmdClearColorImage is legal on one.
+        Bool MaterializeMultisamplePendingClear(VkCommandBuffer commandBuffer,
+                                                MG_State::GLState::ITextureObject& texture,
+                                                VkTextureManager::TextureResource& resource,
+                                                const Vector<PendingClearEntry>& pendingClears);
         Bool MaterializePendingClearForRenderbuffer(
             VkCommandBuffer commandBuffer,
             const SharedPtr<MG_State::GLState::RenderbufferObject>& renderbuffer);

MobileGL/MG_Backend/DirectVulkan/SubgroupSupportPolicy.h

@@ -39,18 +39,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     inline Bool ShouldEmulateSubgroups(const Bool nativeSubgroupSupported) {
         return MG_Config::Features.MagmaEmulateSubgroup && !nativeSubgroupSupported &&
-               !MG_Config::Features.DisableSubgroup;
+               !MG_Config::Features.MagmaDisableSubgroup;
     }
 
     inline Bool ShouldFixIterationRPSubgroupScratch() {
         // Auto is ON: the patch is fingerprint-gated to iterationRP's reduction and
         // grows one under-declared array; every other module passes through untouched.
-        return MG_Config::Features.FixIterationRPSubgroupScratch !=
+        return MG_Config::Features.MagmaFixIterationRPSubgroupScratch !=
                MG_Config::QuirkOverride::ForceOff;
     }
 
     inline Bool ShouldFixIterationRPBarrier() {
-        return MG_Config::Features.IterationRPFixBarrier;
+        return MG_Config::Features.MagmaIterationRPFixBarrier;
     }
 
     inline Bool ShouldDeriveNumSubgroups() {
@@ -58,6 +58,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // contract to hold, and the derived ceil() value is the one the renderer can pin
         // with REQUIRE_FULL_SUBGROUPS - the driver builtin is the value with no
         // cross-driver guarantee (Adreno returns 1 for an 8-subgroup dispatch).
-        return MG_Config::Features.DeriveNumSubgroups != MG_Config::QuirkOverride::ForceOff;
+        return MG_Config::Features.MagmaDeriveNumSubgroups != MG_Config::QuirkOverride::ForceOff;
     }
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/MGPipe/PipeInputs.cpp

@@ -0,0 +1,179 @@
+// MobileGL - MobileGL/MG_Backend/MGPipe/PipeInputs.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// The backend-side half of the PipeInputs block: the poison Fatal with its verb name, the
+// name lookups the runtime knobs need, and - in a verify build - the per-field equality,
+// the entry comparator and the corruption injector. Compiled only under MOBILEGL_PIPE_PUSH
+// (CMakeLists.txt appends it to SOURCE_FILES there), so the pull build never sees it. Spells
+// no MG_State global: everything that reads the live context lives in MG_Impl/Pipe/PipeFill.cpp.
+#include <MG_Backend/MGPipe/PipeInputs.h>
+
+#include <cstdint>
+#include <cstring>
+
+namespace MobileGL::MG_Pipe {
+    const char* MGPipeVerbName(MGPipeVerb verb) {
+        const auto index = static_cast<SizeT>(verb);
+        return index < kMGPipeVerbCount ? kMGPipeVerbNames[index] : "<none>";
+    }
+
+    [[noreturn]] void MGPipeInputPoisonFatalForVerb(MGPipeInputField field, MGPipeVerb verb) {
+        MGPipeInputPoisonFatal(field, MGPipeVerbName(verb));
+    }
+
+    Optional<MGPipeInputField> MGPipeFindInputField(const char* name) {
+        if (name == nullptr) return std::nullopt;
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            if (std::strcmp(kMGPipeInputFieldNames[i], name) == 0) return static_cast<MGPipeInputField>(i);
+        }
+        return std::nullopt;
+    }
+
+    Optional<MGPipeVerb> MGPipeFindVerb(const char* name) {
+        if (name == nullptr) return std::nullopt;
+        for (SizeT i = 0; i < kMGPipeVerbCount; ++i) {
+            if (std::strcmp(kMGPipeVerbNames[i], name) == 0) return static_cast<MGPipeVerb>(i);
+        }
+        return std::nullopt;
+    }
+
+#if MOBILEGL_PIPE_VERIFY
+    namespace {
+        using CurrentVertexAttributeValue = PipeInputs::CurrentVertexAttributeValue;
+
+        // Every overload is declared up front: the array overloads recurse into their element
+        // type, and a call inside a template only sees what was declared before the template.
+        template <class T>
+        Bool StorageEqual(const T& a, const T& b);
+        template <class T>
+        Bool StorageEqual(T* const& a, T* const& b);
+        template <class T>
+        Bool StorageEqual(const SharedPtr<T>& a, const SharedPtr<T>& b);
+        template <class T, SizeT N>
+        Bool StorageEqual(const T (&a)[N], const T (&b)[N]);
+        Bool StorageEqual(const PipeInputs::IndexedCapabilities& a, const PipeInputs::IndexedCapabilities& b);
+        Bool StorageEqual(const CurrentVertexAttributeValue& a, const CurrentVertexAttributeValue& b);
+        template <class T>
+        void CorruptStorage(T& v);
+        template <class T>
+        void CorruptStorage(T*& p);
+        template <class T>
+        void CorruptStorage(SharedPtr<T>& p);
+        template <class T, SizeT N>
+        void CorruptStorage(T (&a)[N]);
+        void CorruptStorage(PipeInputs::IndexedCapabilities& c);
+        void CorruptStorage(CurrentVertexAttributeValue& v);
+
+        // ---- equality over one field's storage ----
+        // O-class storage compares by identity: a raw pointer into the context, or the object a
+        // SharedPtr owns. Everything else goes through G4's MGPipeFieldEqual, recursing through
+        // C arrays element-wise.
+        template <class T>
+        Bool StorageEqual(T* const& a, T* const& b) {
+            return a == b;
+        }
+        template <class T>
+        Bool StorageEqual(const SharedPtr<T>& a, const SharedPtr<T>& b) {
+            return a.get() == b.get();
+        }
+        template <class T, SizeT N>
+        Bool StorageEqual(const T (&a)[N], const T (&b)[N]) {
+            for (SizeT i = 0; i < N; ++i) {
+                if (!StorageEqual(a[i], b[i])) return false;
+            }
+            return true;
+        }
+        Bool StorageEqual(const PipeInputs::IndexedCapabilities& a, const PipeInputs::IndexedCapabilities& b) {
+            return StorageEqual(a.Blend, b.Blend) && StorageEqual(a.ScissorTest, b.ScissorTest);
+        }
+        // Three scalar arrays and nothing else (Core.h), so a bitwise compare has no padding to
+        // false-differ on and keeps a NaN float attribute equal to itself. The size assertion is
+        // what turns a fourth member into a build break rather than a blind spot.
+        Bool StorageEqual(const CurrentVertexAttributeValue& a, const CurrentVertexAttributeValue& b) {
+            static_assert(sizeof(CurrentVertexAttributeValue) == 3 * 4 * 4,
+                          "CurrentVertexAttributeValue grew a member; update the comparator");
+            return std::memcmp(&a, &b, sizeof(CurrentVertexAttributeValue)) == 0;
+        }
+        template <class T>
+        Bool StorageEqual(const T& a, const T& b) {
+            return MGPipeFieldEqual(a, b);
+        }
+
+        // ---- corruption of one field's storage ----
+        // Every shape is perturbed in a way the comparator above must see: a Bool flips, a
+        // scalar or enum moves by one, a pointer's low bits are flipped (never dereferenced:
+        // the snapshot is only ever compared), a SharedPtr becomes an aliasing pointer to a
+        // flipped address with no control block, an array corrupts its first element, and any
+        // other struct has its first byte XOR'ed with 0x5A.
+        template <class T>
+        T* FlipPointer(T* p) {
+            return reinterpret_cast<T*>(reinterpret_cast<std::uintptr_t>(p) ^ 0x5A);
+        }
+        template <class T>
+        void CorruptStorage(T*& p) {
+            p = FlipPointer(p);
+        }
+        template <class T>
+        void CorruptStorage(SharedPtr<T>& p) {
+            p = SharedPtr<T>(SharedPtr<T>(), FlipPointer(p.get()));
+        }
+        template <class T, SizeT N>
+        void CorruptStorage(T (&a)[N]) {
+            CorruptStorage(a[0]);
+        }
+        void CorruptStorage(PipeInputs::IndexedCapabilities& c) {
+            CorruptStorage(c.Blend);
+        }
+        void CorruptStorage(CurrentVertexAttributeValue& v) {
+            v.floatValue[0] += 1.f;
+        }
+        template <class T>
+        void CorruptStorage(T& v) {
+            if constexpr (std::is_same_v<T, Bool>) {
+                v = !v;
+            } else if constexpr (std::is_enum_v<T>) {
+                v = static_cast<T>(static_cast<std::underlying_type_t<T>>(v) + 1);
+            } else if constexpr (std::is_arithmetic_v<T>) {
+                v = static_cast<T>(v + 1);
+            } else {
+                static_assert(std::is_trivially_copyable_v<T>, "PipeInputs storage must be trivially copyable");
+                unsigned char first = 0;
+                std::memcpy(&first, &v, 1);
+                first ^= 0x5A;
+                std::memcpy(&v, &first, 1);
+            }
+        }
+    } // namespace
+
+    Bool MGPipeInputsFieldEqual(MGPipeInputField field, const PipeInputs& a, const PipeInputs& b) {
+        // A forwarded field has no storage and is equal by definition; VisitStorage answers
+        // false for it, hence the explicit sticky test first.
+        if (kMGPipeInputFieldSticky[static_cast<SizeT>(field)]) return true;
+        return PipeInputs::VisitStorage(field, a, b, [](const auto& x, const auto& y) { return StorageEqual(x, y); });
+    }
+
+    Bool MGPipeVerifyInputs(const PipeInputs& pushed, const PipeInputs& snapshot, const MGPipeFieldMask& mask,
+                            MGPipeInputField* outField) {
+        for (SizeT i = 0; i < kMGPipeInputFieldCount; ++i) {
+            const auto field = static_cast<MGPipeInputField>(i);
+            if (!MGPipeFieldMaskHas(mask, field)) continue;
+            if (MGPipeInputsFieldEqual(field, pushed, snapshot)) continue;
+            if (outField != nullptr) *outField = field;
+            return false;
+        }
+        return true;
+    }
+
+    Bool MGPipeApplyVerifyCorruption(PipeInputs& snapshot, MGPipeInputField field) {
+        return PipeInputs::VisitStorage(field, snapshot, snapshot, [](auto& x, auto&) {
+            CorruptStorage(x);
+            return true;
+        });
+    }
+#endif // MOBILEGL_PIPE_VERIFY
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Backend/MGPipe/PipeInputs.h

@@ -0,0 +1,736 @@
+// MobileGL - MobileGL/MG_Backend/MGPipe/PipeInputs.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <MG_Pipe/MGPipe.h>
+// The frontend types the accessors return. Allowed here: P13 keeps this include for the
+// verify arm (ARCHITECTURE.md 9.5). This header spells no MG_State global - every read of
+// the live context happens on the client side, in MG_Impl/Pipe/PipeFill.cpp.
+#include <MG_State/GLState/Core.h>
+
+// MOBILEGL_PIPE_POISON: the per-verb generation stamps and the read-side
+// Fatal{UnmigratedPipeInput} check. Derived here, once. The repository's debug gate is
+// MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG (Defines.h); the verify CI build is
+// Release/INFO with MOBILEGL_BUILD_DISAGGREGATED=OFF, so the third arm is what arms the poison
+// there without dragging MG_Remote in.
+#if MOBILEGL_PIPE_PUSH && (MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG || MOBILEGL_BUILD_DISAGGREGATED || \
+                           MOBILEGL_PIPE_VERIFY)
+#define MOBILEGL_PIPE_POISON 1
+#else
+#define MOBILEGL_PIPE_POISON 0
+#endif
+
+namespace MobileGL::MG_Pipe {
+    // PipeInputs.cpp. The poison Fatal with the verb's name ("<none>" before the first
+    // verb): MGLOG_F + std::abort(), live at every log level on purpose - this is not
+    // MOBILEGL_ASSERT, which is inert in INFO builds.
+    [[noreturn]] void MGPipeInputPoisonFatalForVerb(MGPipeInputField field, MGPipeVerb verb);
+    // kMGPipeVerbNames[verb], or "<none>" for kVerbCount (no verb has been filled yet).
+    const char* MGPipeVerbName(MGPipeVerb verb);
+    // Name lookups for the runtime knobs (MOBILEGL_PIPE_VERIFY_CORRUPT names a field,
+    // MOBILEGL_PIPE_POISON_OMIT a Verb:Field pair). Empty on an unknown name.
+    Optional<MGPipeInputField> MGPipeFindInputField(const char* name);
+    Optional<MGPipeVerb> MGPipeFindVerb(const char* name);
+
+    // The read-side poison check, on every non-forwarded accessor. Under MOBILEGL_PIPE_POISON
+    // a read of a field whose stamp is older than the current verb serial is
+    // Fatal{UnmigratedPipeInput, "Field@Verb"}; otherwise the accessor is a plain load.
+#if MOBILEGL_PIPE_POISON
+#define MGP_INPUT_CHECK(Field)                                                                                         \
+    do {                                                                                                               \
+        if (!::MobileGL::MG_Pipe::MGPipeInputFieldIsFresh(m_filled, (Field))) {                                        \
+            ::MobileGL::MG_Pipe::MGPipeInputPoisonFatalForVerb((Field), m_currentVerb);                                \
+        }                                                                                                              \
+    } while (0)
+#else
+#define MGP_INPUT_CHECK(Field) ((void)0)
+#endif
+    // The compare-at-read hook of the MOBILEGL_PIPE_VERIFY comparator (P1 brief D8), defined
+    // in MG_Impl/Pipe/PipeFill.cpp: re-reads the field from the live context and compares it
+    // against the stored value, and reports the FIRST divergence as
+    // Fatal{PipeVerifyDiffer, "Field@Verb", verb=<serial>, where=read} (the indices go in a
+    // preceding MGLOG_E). Only the live block (gPipeInputs) is verified; a snapshot's own
+    // accessors are plain loads. Off in every other build.
+    struct PipeInputs;
+#if MOBILEGL_PIPE_VERIFY
+    void MGPipeVerifyReadHook(const PipeInputs& self, MGPipeInputField field, Uint index0, Uint index1);
+#define MGP_INPUT_VERIFY_READ(Field, Index0, Index1)                                                                   \
+    ::MobileGL::MG_Pipe::MGPipeVerifyReadHook(*this, (Field), static_cast<Uint>(Index0), static_cast<Uint>(Index1))
+#else
+#define MGP_INPUT_VERIFY_READ(Field, Index0, Index1) ((void)0)
+#endif
+
+    // The V/O storage of every field that has storage, by field id. The seven F-class
+    // (forwarded) fields have none. PipeInputs::VisitStorage dispatches on this list, which
+    // is what keeps the comparator and the corruption injector one function each instead of
+    // two sixty-way switches.
+    // clang-format off
+#define MGP_INPUT_STORAGE_LIST(X)                                                    \
+    X(GetActiveTextureUnit,                        m_activeTextureUnit)              \
+    X(GetBlendColor,                               m_blendColor)                     \
+    X(GetBlendEquationIndexed,                     m_blendEquation)                  \
+    X(GetBlendFuncIndexed,                         m_blendFunc)                      \
+    X(GetBoundTransformFeedbackName,               m_boundTransformFeedbackName)     \
+    X(GetBoundVertexArray,                         m_boundVertexArray)               \
+    X(GetBufferBindingSlot,                        m_bufferBindingSlot)              \
+    X(GetBufferBindingPoint,                       m_bufferBindingPointBase)         \
+    X(GetTouchedBufferBindingPointCount,           m_touchedBindingPointCount)       \
+    X(GetClampReadColor,                           m_clampReadColor)                 \
+    X(GetClearColor,                               m_clearColor)                     \
+    X(GetClearDepth,                               m_clearDepth)                     \
+    X(GetClearStencil,                             m_clearStencil)                   \
+    X(GetColorMaskIndexed,                         m_colorMask)                      \
+    X(GetCullFaceMode,                             m_cullFaceMode)                   \
+    X(GetCurrentVertexAttribute,                   m_currentVertexAttribute)         \
+    X(GetDepthFunc,                                m_depthFunc)                      \
+    X(GetDepthMask,                                m_depthMask)                      \
+    X(GetDepthRangeIndexed,                        m_depthRange)                     \
+    X(GetFramebufferBindingSlot,                   m_framebufferBindingSlot)         \
+    X(GetImageTextureBinding,                      m_imageTextureBindingBase)        \
+    X(GetLineWidth,                                m_lineWidth)                      \
+    X(GetLogicOp,                                  m_logicOp)                        \
+    X(GetMaxTouchedTextureUnit,                    m_maxTouchedTextureUnit)          \
+    X(GetMinSampleShadingValue,                    m_minSampleShadingValue)          \
+    X(GetPatchDefaultInnerLevel,                   m_patchDefaultInnerLevel)         \
+    X(GetPatchDefaultOuterLevel,                   m_patchDefaultOuterLevel)         \
+    X(GetPatchVertices,                            m_patchVertices)                  \
+    X(GetPipelineStateVersion,                     m_pipelineStateVersion)           \
+    X(GetPixelStoreParameters,                     m_pixelStore)                     \
+    X(GetPolygonModeFront,                         m_polygonModeFront)               \
+    X(GetPolygonOffsetFactor,                      m_polygonOffsetFactor)            \
+    X(GetPolygonOffsetUnits,                       m_polygonOffsetUnits)             \
+    X(GetPrimitiveRestartIndex,                    m_primitiveRestartIndex)          \
+    X(GetProgramForDispatch,                       m_programForDispatch)             \
+    X(GetProgramForDraw,                           m_programForDraw)                 \
+    X(GetProvokingVertexMode,                      m_provokingVertexMode)            \
+    X(GetRenderStateParameters,                    m_renderState)                    \
+    X(GetRenderStateParametersVersion,             m_renderStateParametersVersion)   \
+    X(GetSamplingResolutionGeneration,             m_samplingResolutionGeneration)   \
+    X(GetScissorBox,                               m_scissorBox)                     \
+    X(GetStencilState,                             m_stencil)                        \
+    X(GetTextureBindGeneration,                    m_textureBindGeneration)          \
+    X(GetTextureContextId,                         m_textureContextId)               \
+    X(GetTextureUnitObject,                        m_textureUnitBase)                \
+    X(GetTransformFeedbackCapturedVertices,        m_transformFeedbackCapturedVertices) \
+    X(GetTransformFeedbackGeneration,              m_transformFeedbackGeneration)    \
+    X(GetTransformFeedbackPausedPrimitiveCounter,  m_transformFeedbackPausedPrimitiveCounter) \
+    X(GetTransformFeedbackProgram,                 m_transformFeedbackProgram)       \
+    X(GetViewport,                                 m_viewport)                       \
+    X(GetViewportIndexed,                          m_viewportIndexed)                \
+    X(IsCapabilityEnabled,                         m_capability)                     \
+    X(IsCapabilityEnabledIndexed,                  m_capabilityIndexed)              \
+    X(IsTransformFeedbackActive,                   m_transformFeedbackActive)        \
+    X(IsTransformFeedbackPaused,                   m_transformFeedbackPaused)        \
+    X(GetBoundTransformFeedbackLifetimeId,         m_boundTransformFeedbackLifetimeId)
+    // clang-format on
+
+    // The seven F-class fields, for the arithmetic below and for the sticky table's proof.
+    // The forwarded set IS the sticky set (PipeFields.def marks the same seven rows F and
+    // sticky), so an eighth sticky row without a forwarder is refused here, not by a test.
+    inline constexpr SizeT kMGPipeForwardedFieldCount = 7;
+    static_assert(kMGPipeForwardedFieldCount == kMGPipeInputStickyFieldCount,
+                  "the forwarded (F-class) fields and the sticky fields of PipeFields.def are the same seven rows");
+
+    // The block the backends read instead of GLContext (ARCHITECTURE.md 9.2 phase A, P1 brief
+    // D4). One struct, three storage classes, and every accessor keeps the NAME, PARAMETERS
+    // and RETURN TYPE of its GLContext counterpart (MG_State/GLState/Core.h) so the strangler
+    // sed is type-neutral:
+    //
+    //   V (value)            copied out of GLContext at fill time by calling the same accessor;
+    //                        no derivation logic is re-implemented here, which is what keeps the
+    //                        copy semantically identical by construction.
+    //   O (object reference) a SharedPtr copy, or a raw pointer to the live GLContext-owned
+    //                        slot/array for the accessors that return a non-const reference into
+    //                        the context. Identity is what phase C turns into a handle.
+    //   F (forwarded)        argument-keyed lookups and reverse-channel calls, defined out of
+    //                        line in MG_Impl/Pipe/PipeFill.cpp (the client side, where the live
+    //                        context may be spelled). Sticky: stamped once by the first fill that
+    //                        sees a live context.
+    //
+    // Every non-forwarded accessor is MGP_INPUT_CHECK (poison) -> MGP_INPUT_VERIFY_READ
+    // (compare-at-read) -> the storage. Both macros expand to nothing when their switch is
+    // off, so a plain MOBILEGL_PIPE_PUSH build's accessor is a load.
+    struct PipeInputs {
+        using GLContext = MG_State::GLState::GLContext;
+        using BufferObject = MG_State::GLState::BufferObject;
+        using BufferTarget = ::MobileGL::BufferTarget;
+        using FramebufferObject = MG_State::GLState::FramebufferObject;
+        using FramebufferTarget = ::MobileGL::FramebufferTarget;
+        using VertexArrayObject = MG_State::GLState::VertexArrayObject;
+        using ProgramObject = MG_State::GLState::ProgramObject;
+        using ITextureObject = MG_State::GLState::ITextureObject;
+        using TextureUnit = MG_State::GLState::TextureUnit;
+        using ImageTextureBinding = MG_State::GLState::ImageTextureBinding;
+        using CurrentVertexAttributeValue = MG_State::GLState::CurrentVertexAttributeValue;
+
+        static constexpr SizeT kBufferTargetCount = static_cast<SizeT>(BufferTarget::BufferTargetCount);
+        static constexpr SizeT kFramebufferTargetCount = static_cast<SizeT>(FramebufferTarget::FramebufferTargetCount);
+        static constexpr SizeT kCapabilityCount = static_cast<SizeT>(CapabilityInput::CapabilityInputCount);
+        static constexpr SizeT kMaxViewports = RenderStateParameters::MAX_VIEWPORTS;
+        static constexpr SizeT kMaxVertexAttribs = VertexArrayObject::MAX_VERTEX_ATTRIBS;
+        static constexpr SizeT kStencilFaceCount = static_cast<SizeT>(StencilFace::StencilFaceCount);
+
+        // IsCapabilityEnabledIndexed's two indexed capabilities, the only ones GLContext keeps
+        // indexed state for (RenderState::IsCapabilityEnabledIndexed).
+        struct IndexedCapabilities {
+            Bool Blend[kMGMaxDrawBuffers];
+            Bool ScissorTest[kMaxViewports];
+        };
+
+        // ---- identity / liveness (not fields) ----
+        // Whether a live GLContext exists. Forwarded (PipeFill.cpp): under push MGB_CTX_LIVE
+        // must be true as soon as a context exists, fill or no fill, which is what today's
+        // null-context guards test.
+        Bool IsLive() const;
+        // The live GLContext's address at the last fill; serves MGB_CTX_IDENTITY.
+        const void* ContextIdentity() const { return m_contextIdentity; }
+        // The verb of the last fill, kVerbCount before the first one.
+        MGPipeVerb CurrentVerb() const { return m_currentVerb; }
+#if MOBILEGL_PIPE_POISON
+        const MGPipeFilledState& FilledState() const { return m_filled; }
+#endif
+
+        // ---- V: values ----
+        Int GetActiveTextureUnit() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetActiveTextureUnit);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetActiveTextureUnit, 0, 0);
+            return m_activeTextureUnit;
+        }
+        const FloatVec4& GetBlendColor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBlendColor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBlendColor, 0, 0);
+            return m_blendColor;
+        }
+        void GetBlendEquationIndexed(Uint index, BlendEquation& color, BlendEquation& alpha) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBlendEquationIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBlendEquationIndexed, index, 0);
+            if (index >= kMGMaxDrawBuffers) {
+                MOBILEGL_ASSERT(false, "Blend equation index out of range: %u", index);
+                return;
+            }
+            color = m_blendEquation[index][0];
+            alpha = m_blendEquation[index][1];
+        }
+        void GetBlendFuncIndexed(Uint index, BlendFactor& srcRGB, BlendFactor& dstRGB, BlendFactor& srcAlpha,
+                                 BlendFactor& dstAlpha) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBlendFuncIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBlendFuncIndexed, index, 0);
+            if (index >= kMGMaxDrawBuffers) {
+                MOBILEGL_ASSERT(false, "Blend func index out of range: %u", index);
+                return;
+            }
+            srcRGB = m_blendFunc[index][0];
+            dstRGB = m_blendFunc[index][1];
+            srcAlpha = m_blendFunc[index][2];
+            dstAlpha = m_blendFunc[index][3];
+        }
+        // Dead field: filled, read by no backend since the D21 XFB counter-slot rekey; kept so
+        // the vendored inventory row keeps its mapping (Coverage.def).
+        Uint GetBoundTransformFeedbackName() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBoundTransformFeedbackName);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBoundTransformFeedbackName, 0, 0);
+            return m_boundTransformFeedbackName;
+        }
+        SizeT GetTouchedBufferBindingPointCount(BufferTarget target) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTouchedBufferBindingPointCount);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTouchedBufferBindingPointCount, static_cast<Uint>(target), 0);
+            return m_touchedBindingPointCount[static_cast<SizeT>(target)];
+        }
+        GLenum GetClampReadColor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClampReadColor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClampReadColor, 0, 0);
+            return m_clampReadColor;
+        }
+        const FloatVec4& GetClearColor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClearColor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClearColor, 0, 0);
+            return m_clearColor;
+        }
+        Float GetClearDepth() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClearDepth);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClearDepth, 0, 0);
+            return m_clearDepth;
+        }
+        Uint32 GetClearStencil() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetClearStencil);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetClearStencil, 0, 0);
+            return m_clearStencil;
+        }
+        BoolVec4 GetColorMaskIndexed(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetColorMaskIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetColorMaskIndexed, index, 0);
+            return m_colorMask[index];
+        }
+        CullFaceMode GetCullFaceMode() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetCullFaceMode);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetCullFaceMode, 0, 0);
+            return m_cullFaceMode;
+        }
+        const CurrentVertexAttributeValue& GetCurrentVertexAttribute(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetCurrentVertexAttribute);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetCurrentVertexAttribute, index, 0);
+            if (index >= kMaxVertexAttribs) {
+                static const CurrentVertexAttributeValue defaultValue{};
+                MGLOG_E_ONCE("PipeInputs::GetCurrentVertexAttribute: index %u is out of range", index);
+                return defaultValue;
+            }
+            return m_currentVertexAttribute[index];
+        }
+        DepthTestFunc GetDepthFunc() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetDepthFunc);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetDepthFunc, 0, 0);
+            return m_depthFunc;
+        }
+        Bool GetDepthMask() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetDepthMask);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetDepthMask, 0, 0);
+            return m_depthMask;
+        }
+        const FloatVec2& GetDepthRangeIndexed(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetDepthRangeIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetDepthRangeIndexed, index, 0);
+            if (index >= kMaxViewports) {
+                MOBILEGL_ASSERT(false, "Depth range index out of range: %u", index);
+                return m_depthRange[0];
+            }
+            return m_depthRange[index];
+        }
+        Float GetLineWidth() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetLineWidth);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetLineWidth, 0, 0);
+            return m_lineWidth;
+        }
+        LogicOperation GetLogicOp() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetLogicOp);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetLogicOp, 0, 0);
+            return m_logicOp;
+        }
+        Int GetMaxTouchedTextureUnit() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetMaxTouchedTextureUnit);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetMaxTouchedTextureUnit, 0, 0);
+            return m_maxTouchedTextureUnit;
+        }
+        Float GetMinSampleShadingValue() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetMinSampleShadingValue);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetMinSampleShadingValue, 0, 0);
+            return m_minSampleShadingValue;
+        }
+        const FloatVec2& GetPatchDefaultInnerLevel() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPatchDefaultInnerLevel);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPatchDefaultInnerLevel, 0, 0);
+            return m_patchDefaultInnerLevel;
+        }
+        const FloatVec4& GetPatchDefaultOuterLevel() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPatchDefaultOuterLevel);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPatchDefaultOuterLevel, 0, 0);
+            return m_patchDefaultOuterLevel;
+        }
+        Uint GetPatchVertices() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPatchVertices);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPatchVertices, 0, 0);
+            return m_patchVertices;
+        }
+        Uint GetPipelineStateVersion() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPipelineStateVersion);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPipelineStateVersion, 0, 0);
+            return m_pipelineStateVersion;
+        }
+        Uint GetRenderStateParametersVersion() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetRenderStateParametersVersion);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetRenderStateParametersVersion, 0, 0);
+            return m_renderStateParametersVersion;
+        }
+        PixelStoreParameters GetPixelStoreParameters(Bool isUnpack) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPixelStoreParameters);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPixelStoreParameters, isUnpack ? 1u : 0u, 0);
+            return m_pixelStore[isUnpack ? 1 : 0];
+        }
+        GLenum GetPolygonModeFront() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPolygonModeFront);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPolygonModeFront, 0, 0);
+            return m_polygonModeFront;
+        }
+        Float GetPolygonOffsetFactor() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPolygonOffsetFactor);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPolygonOffsetFactor, 0, 0);
+            return m_polygonOffsetFactor;
+        }
+        Float GetPolygonOffsetUnits() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPolygonOffsetUnits);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPolygonOffsetUnits, 0, 0);
+            return m_polygonOffsetUnits;
+        }
+        Uint32 GetPrimitiveRestartIndex() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetPrimitiveRestartIndex);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetPrimitiveRestartIndex, 0, 0);
+            return m_primitiveRestartIndex;
+        }
+        ProvokingVertexMode GetProvokingVertexMode() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetProvokingVertexMode);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetProvokingVertexMode, 0, 0);
+            return m_provokingVertexMode;
+        }
+        const RenderStateParameters& GetRenderStateParameters() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetRenderStateParameters);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetRenderStateParameters, 0, 0);
+            return m_renderState;
+        }
+        Uint64 GetSamplingResolutionGeneration() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetSamplingResolutionGeneration);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetSamplingResolutionGeneration, 0, 0);
+            return m_samplingResolutionGeneration;
+        }
+        const IntVec4& GetScissorBox() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetScissorBox);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetScissorBox, 0, 0);
+            return m_scissorBox;
+        }
+        const StencilFaceState& GetStencilState(StencilFace face) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetStencilState);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetStencilState, static_cast<Uint>(face), 0);
+            return m_stencil[face == StencilFace::Back ? 1 : 0];
+        }
+        Uint64 GetTextureBindGeneration() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTextureBindGeneration);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTextureBindGeneration, 0, 0);
+            return m_textureBindGeneration;
+        }
+        Uint64 GetTextureContextId() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTextureContextId);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTextureContextId, 0, 0);
+            return m_textureContextId;
+        }
+        Uint64 GetTransformFeedbackCapturedVertices() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackCapturedVertices);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackCapturedVertices, 0, 0);
+            return m_transformFeedbackCapturedVertices;
+        }
+        Uint64 GetTransformFeedbackGeneration() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackGeneration);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackGeneration, 0, 0);
+            return m_transformFeedbackGeneration;
+        }
+        Uint64 GetTransformFeedbackPausedPrimitiveCounter() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackPausedPrimitiveCounter);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackPausedPrimitiveCounter, 0, 0);
+            return m_transformFeedbackPausedPrimitiveCounter;
+        }
+        Uint64 GetBoundTransformFeedbackLifetimeId() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBoundTransformFeedbackLifetimeId);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBoundTransformFeedbackLifetimeId, 0, 0);
+            return m_boundTransformFeedbackLifetimeId;
+        }
+        IntVec4 GetViewport() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetViewport);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetViewport, 0, 0);
+            return m_viewport;
+        }
+        const FloatVec4& GetViewportIndexed(Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetViewportIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetViewportIndexed, index, 0);
+            if (index >= kMaxViewports) {
+                MOBILEGL_ASSERT(false, "Viewport index out of range: %u", index);
+                return m_viewportIndexed[0];
+            }
+            return m_viewportIndexed[index];
+        }
+        Bool IsCapabilityEnabled(CapabilityInput cap) const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsCapabilityEnabled);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsCapabilityEnabled, static_cast<Uint>(cap), 0);
+            const auto index = static_cast<SizeT>(cap);
+            return index < kCapabilityCount ? m_capability[index] : false;
+        }
+        // Blend and ScissorTest are the only indexed capabilities GLContext keeps; no backend
+        // asks for another (VulkanRenderer asks Blend). Any other cap is a read the fill cannot
+        // have served: Fatal{UnmigratedPipeInput} naming the field and the verb, the cap in a
+        // preceding MGLOG_E.
+        Bool IsCapabilityEnabledIndexed(CapabilityInput cap, Uint index) const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsCapabilityEnabledIndexed);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsCapabilityEnabledIndexed, static_cast<Uint>(cap), index);
+            if (cap == CapabilityInput::Blend) {
+                return index < kMGMaxDrawBuffers ? m_capabilityIndexed.Blend[index] : false;
+            }
+            if (cap == CapabilityInput::ScissorTest) {
+                return index < kMaxViewports ? m_capabilityIndexed.ScissorTest[index] : false;
+            }
+            MGLOG_E("PipeInputs::IsCapabilityEnabledIndexed: no indexed storage for cap=%d (index=%u)",
+                    static_cast<int>(cap), index);
+            MGPipeInputPoisonFatalForVerb(MGPipeInputField::IsCapabilityEnabledIndexed, m_currentVerb);
+        }
+        Bool IsTransformFeedbackActive() const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsTransformFeedbackActive);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsTransformFeedbackActive, 0, 0);
+            return m_transformFeedbackActive;
+        }
+        Bool IsTransformFeedbackPaused() const {
+            MGP_INPUT_CHECK(MGPipeInputField::IsTransformFeedbackPaused);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::IsTransformFeedbackPaused, 0, 0);
+            return m_transformFeedbackPaused;
+        }
+
+        // ---- O: object references ----
+        const SharedPtr<VertexArrayObject>& GetBoundVertexArray() {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBoundVertexArray);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBoundVertexArray, 0, 0);
+            return m_boundVertexArray;
+        }
+        // A target the fill left null (one outside GlobalBufferTargets / BufferBindPointTargets,
+        // or a read before any fill) is a read the fill cannot have served: the poison Fatal,
+        // the target in a preceding MGLOG_E.
+        BindingSlot<BufferObject>& GetBufferBindingSlot(BufferTarget target) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBufferBindingSlot);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBufferBindingSlot, static_cast<Uint>(target), 0);
+            const auto index = static_cast<SizeT>(target);
+            if (index >= kBufferTargetCount || m_bufferBindingSlot[index] == nullptr) {
+                MGLOG_E("PipeInputs::GetBufferBindingSlot: no slot for target=%d", static_cast<int>(target));
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetBufferBindingSlot, m_currentVerb);
+            }
+            return *m_bufferBindingSlot[index];
+        }
+        BindingSlotRange1D<BufferObject>& GetBufferBindingPoint(BufferTarget target, Uint index) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetBufferBindingPoint);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetBufferBindingPoint, static_cast<Uint>(target), index);
+            const auto targetIndex = static_cast<SizeT>(target);
+            if (targetIndex >= kBufferTargetCount || m_bufferBindingPointBase[targetIndex] == nullptr) {
+                MGLOG_E("PipeInputs::GetBufferBindingPoint: no binding points for target=%d (index=%u)",
+                        static_cast<int>(target), index);
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetBufferBindingPoint, m_currentVerb);
+            }
+            // The live storage is Array<Array<BindingSlotRange1D, BufferBindingPointCount>, N>
+            // (BufferState.h), so base[index] is the live slot GLContext would hand out.
+            return m_bufferBindingPointBase[targetIndex][index];
+        }
+        BindingSlot<FramebufferObject>& GetFramebufferBindingSlot(FramebufferTarget target) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetFramebufferBindingSlot);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetFramebufferBindingSlot, static_cast<Uint>(target), 0);
+            const auto index = static_cast<SizeT>(target);
+            if (index >= kFramebufferTargetCount || m_framebufferBindingSlot[index] == nullptr) {
+                MGLOG_E("PipeInputs::GetFramebufferBindingSlot: no slot for target=%d", static_cast<int>(target));
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetFramebufferBindingSlot, m_currentVerb);
+            }
+            return *m_framebufferBindingSlot[index];
+        }
+        ImageTextureBinding& GetImageTextureBinding(Int unit) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetImageTextureBinding);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetImageTextureBinding, static_cast<Uint>(unit), 0);
+            if (m_imageTextureBindingBase == nullptr) {
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetImageTextureBinding, m_currentVerb);
+            }
+            return m_imageTextureBindingBase[unit];
+        }
+        const ImageTextureBinding& GetImageTextureBinding(Int unit) const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetImageTextureBinding);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetImageTextureBinding, static_cast<Uint>(unit), 0);
+            if (m_imageTextureBindingBase == nullptr) {
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetImageTextureBinding, m_currentVerb);
+            }
+            return m_imageTextureBindingBase[unit];
+        }
+        const SharedPtr<ProgramObject>& GetProgramForDispatch() {
+            MGP_INPUT_CHECK(MGPipeInputField::GetProgramForDispatch);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetProgramForDispatch, 0, 0);
+            return m_programForDispatch;
+        }
+        const SharedPtr<ProgramObject>& GetProgramForDraw() {
+            MGP_INPUT_CHECK(MGPipeInputField::GetProgramForDraw);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetProgramForDraw, 0, 0);
+            return m_programForDraw;
+        }
+        const SharedPtr<ProgramObject>& GetTransformFeedbackProgram() const {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTransformFeedbackProgram);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTransformFeedbackProgram, 0, 0);
+            return m_transformFeedbackProgram;
+        }
+        TextureUnit& GetTextureUnitObject(Int unit) {
+            MGP_INPUT_CHECK(MGPipeInputField::GetTextureUnitObject);
+            MGP_INPUT_VERIFY_READ(MGPipeInputField::GetTextureUnitObject, static_cast<Uint>(unit), 0);
+            if (m_textureUnitBase == nullptr) {
+                MGPipeInputPoisonFatalForVerb(MGPipeInputField::GetTextureUnitObject, m_currentVerb);
+            }
+            return m_textureUnitBase[unit];
+        }
+
+        // ---- F: forwarded to the live context (MG_Impl/Pipe/PipeFill.cpp); sticky ----
+        // Each takes an argument that is not verb state - a GL name, a lifetime id, a target -
+        // i.e. it is a lookup or a reverse-channel write, not a state read; there is no value
+        // the filler could copy and no verb whose fill could make it stale. Phase C replaces
+        // them with handle tables and callbacks.
+        // They carry no MGP_INPUT_CHECK / MGP_INPUT_VERIFY_READ (the declared exception to
+        // P1 brief D4's "every accessor body"): a forward is a live call, not a stored value,
+        // and InvalidateCompileEnv is reached from backend initialisation before any verb has
+        // filled, where a check would be Fatal{...@<none>} on every start. Their sticky stamp
+        // is therefore consulted by no accessor; the tests pin it through
+        // MGPipeInputFieldIsFresh directly.
+        SizeT GetBufferBindingPointCount(BufferTarget target) const;
+        const SharedPtr<ProgramObject>& GetProgramObject(Uint index);
+        const SharedPtr<ITextureObject>& GetTextureObject(Uint index);
+        Bool HasOpenTransformFeedbackSpan(Uint64 lifetimeId) const;
+        void InvalidateCompileEnv();
+        Bool ValidateProgramName(Uint index) const;
+        // Dropped with an MGLOG_E_ONCE when no context is live; today's guarded sites never
+        // reach it without one.
+        void RecordError(ErrorCode code, UniquePtr<ErrorInfo> info);
+
+        // ---- the storage visitor ----
+        // Calls fn(a.<member>, b.<member>) for the field's storage and returns its result; returns
+        // false without calling fn for a forwarded field, which has none. The comparator's
+        // per-field equality and the verify corruption injector are both one call of this.
+        template <class Fn>
+        static Bool VisitStorage(MGPipeInputField field, PipeInputs& a, PipeInputs& b, Fn&& fn) {
+            switch (field) {
+#define MGP_INPUT_VISIT(Field, Member)                                                                                 \
+    case MGPipeInputField::Field:                                                                                      \
+        return fn(a.Member, b.Member);
+                MGP_INPUT_STORAGE_LIST(MGP_INPUT_VISIT)
+#undef MGP_INPUT_VISIT
+            default:
+                return false;
+            }
+        }
+        template <class Fn>
+        static Bool VisitStorage(MGPipeInputField field, const PipeInputs& a, const PipeInputs& b, Fn&& fn) {
+            switch (field) {
+#define MGP_INPUT_VISIT(Field, Member)                                                                                 \
+    case MGPipeInputField::Field:                                                                                      \
+        return fn(a.Member, b.Member);
+                MGP_INPUT_STORAGE_LIST(MGP_INPUT_VISIT)
+#undef MGP_INPUT_VISIT
+            default:
+                return false;
+            }
+        }
+
+    private:
+        // The one door into the storage from the client side (MG_Impl/Pipe/PipeFill.cpp):
+        // the filler's per-field copies and stamps, and the verify snapshot.
+        friend struct MGPipeFillAccess;
+        // The other door, and the one that exists because of what this block IS after P2:
+        // the server's working RenderStateParameters. MG_Pipe/PipeApply.cpp scatters
+        // bind_render_state's and set_dynamic_state's chunks straight into m_renderState,
+        // which is why DirectGLES' SyncRenderState is not one line changed. It deliberately
+        // does NOT stamp the poison generations - a stamp says "the filler published this
+        // for THIS verb", which is the walk's statement, not the applier's.
+        friend struct MGPipeApplyAccess;
+
+        // ---- identity ----
+        const void* m_contextIdentity = nullptr;
+        Bool m_live = false;
+        MGPipeVerb m_currentVerb = MGPipeVerb::kVerbCount;
+#if MOBILEGL_PIPE_POISON
+        MGPipeFilledState m_filled{};
+#endif
+
+        // ---- V ----
+        Int m_activeTextureUnit = 0;
+        FloatVec4 m_blendColor{};
+        BlendEquation m_blendEquation[kMGMaxDrawBuffers][2]{};
+        BlendFactor m_blendFunc[kMGMaxDrawBuffers][4]{};
+        Uint m_boundTransformFeedbackName = 0;
+        SizeT m_touchedBindingPointCount[kBufferTargetCount]{};
+        GLenum m_clampReadColor = 0;
+        FloatVec4 m_clearColor{};
+        Float m_clearDepth = 0.f;
+        Uint32 m_clearStencil = 0;
+        BoolVec4 m_colorMask[kMGMaxDrawBuffers]{};
+        CullFaceMode m_cullFaceMode{};
+        CurrentVertexAttributeValue m_currentVertexAttribute[kMaxVertexAttribs]{};
+        DepthTestFunc m_depthFunc{};
+        Bool m_depthMask = false;
+        FloatVec2 m_depthRange[kMaxViewports]{};
+        Float m_lineWidth = 0.f;
+        LogicOperation m_logicOp{};
+        Int m_maxTouchedTextureUnit = -1;
+        Float m_minSampleShadingValue = 0.f;
+        FloatVec2 m_patchDefaultInnerLevel{};
+        FloatVec4 m_patchDefaultOuterLevel{};
+        Uint m_patchVertices = 0;
+        Uint m_pipelineStateVersion = 0;
+        Uint m_renderStateParametersVersion = 0;
+        PixelStoreParameters m_pixelStore[2]{}; // [0] = pack, [1] = unpack
+        GLenum m_polygonModeFront = 0;
+        Float m_polygonOffsetFactor = 0.f;
+        Float m_polygonOffsetUnits = 0.f;
+        Uint32 m_primitiveRestartIndex = 0;
+        ProvokingVertexMode m_provokingVertexMode{};
+        RenderStateParameters m_renderState{};
+        Uint64 m_samplingResolutionGeneration = 0;
+        Uint64 m_textureBindGeneration = 0;
+        Uint64 m_textureContextId = 0;
+        IntVec4 m_scissorBox{};
+        StencilFaceState m_stencil[kStencilFaceCount]{};
+        Uint64 m_transformFeedbackCapturedVertices = 0;
+        Uint64 m_transformFeedbackGeneration = 0;
+        Uint64 m_transformFeedbackPausedPrimitiveCounter = 0;
+        Uint64 m_boundTransformFeedbackLifetimeId = 0;
+        IntVec4 m_viewport{};
+        FloatVec4 m_viewportIndexed[kMaxViewports]{};
+        Bool m_capability[kCapabilityCount]{};
+        IndexedCapabilities m_capabilityIndexed{};
+        Bool m_transformFeedbackActive = false;
+        Bool m_transformFeedbackPaused = false;
+
+        // ---- O ----
+        SharedPtr<VertexArrayObject> m_boundVertexArray;
+        BindingSlot<BufferObject>* m_bufferBindingSlot[kBufferTargetCount]{};
+        BindingSlotRange1D<BufferObject>* m_bufferBindingPointBase[kBufferTargetCount]{};
+        BindingSlot<FramebufferObject>* m_framebufferBindingSlot[kFramebufferTargetCount]{};
+        ImageTextureBinding* m_imageTextureBindingBase = nullptr;
+        SharedPtr<ProgramObject> m_programForDispatch;
+        SharedPtr<ProgramObject> m_programForDraw;
+        SharedPtr<ProgramObject> m_transformFeedbackProgram;
+        TextureUnit* m_textureUnitBase = nullptr;
+    };
+
+    // The single global the backends read through MGB_CTX (ARCHITECTURE.md 9.2). An inline
+    // variable: no .cpp is needed for the definition.
+    //
+    // LEAK-AT-EXIT STORAGE, and it is the same rule Init.cpp and GlobalObjects.cpp state for
+    // pGLContext and pActiveBackendObject: "a process that exits without eglTerminate simply
+    // leaks the global singletons to the OS instead of running destructors during static
+    // teardown". This block breaks that rule if it is a value, because its O-class members
+    // are SharedPtrs to FRONTEND objects: a VertexArrayObject that the application deleted
+    // while it was bound has its last reference here, and destroying this block from
+    // __run_exit_handlers therefore runs ~VertexArrayObject -> ~BufferObject at exit. Those
+    // destructors are not exit-safe and cannot be made so - they reach the client's slot
+    // allocator, the resource tracker, the vertex-input emitter, the applier AND, through
+    // MGPipeApplyResourceDestroy, the backend's own twin tables, deferred-release queue,
+    // buffer pool and driver entry points, every one of which is either already destroyed or
+    // about to be. So the reference is never dropped: nothing here can start such a chain.
+    // A live context releases these SharedPtrs the ordinary way, at the fill point.
+    // (P3a; the exit-time heap corruption this closes is p3a-results/exit-order-v1.md.)
+    inline PipeInputs& gPipeInputs = *new PipeInputs();
+
+    // Every field has storage or is forwarded, and nothing else.
+#define MGP_INPUT_COUNT_ONE(Field, Member) +1
+    static_assert(0 MGP_INPUT_STORAGE_LIST(MGP_INPUT_COUNT_ONE) + kMGPipeForwardedFieldCount == kMGPipeInputFieldCount,
+                  "MGP_INPUT_STORAGE_LIST plus the seven forwarded fields is not the PipeInputs field set");
+#undef MGP_INPUT_COUNT_ONE
+    // The docs budget ~20 KB; the block is a few KB.
+    static_assert(sizeof(PipeInputs) < 20 * 1024, "PipeInputs outgrew its budget");
+
+#if MOBILEGL_PIPE_VERIFY
+    // PipeInputs.cpp. Per-field equality for the entry compare (P1 brief D8): V by value
+    // through G4's MGPipeFieldEqual (bitwise floats, field-wise structs), O by identity, F
+    // always equal (no storage).
+    Bool MGPipeInputsFieldEqual(MGPipeInputField field, const PipeInputs& a, const PipeInputs& b);
+    // PipeInputs.cpp. The entry compare: every field in `mask` of the pushed block against the
+    // snapshot, first differing field out. Exported from the shared library on purpose - the
+    // retrace-verify CI job proves it swapped in a verify build by finding this symbol with
+    // nm -D, so a "green" run against a library without the comparator cannot happen.
+#if defined(__GNUC__) || defined(__clang__)
+    __attribute__((visibility("default")))
+#endif
+    Bool MGPipeVerifyInputs(const PipeInputs& pushed, const PipeInputs& snapshot, const MGPipeFieldMask& mask,
+                            MGPipeInputField* outField);
+    // PipeInputs.cpp. Negative control A: perturbs one field's storage (flip a Bool, +1 a
+    // scalar, ^0x5A the first byte of a struct, flip a pointer's low bits - never
+    // dereferenced, the snapshot is only ever compared). Returns false for a forwarded field,
+    // which has nothing to corrupt.
+    Bool MGPipeApplyVerifyCorruption(PipeInputs& snapshot, MGPipeInputField field);
+#endif
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Benchmark/Driver/CMakeLists.txt

@@ -11,5 +11,51 @@ endif()
 add_executable(DriverBench DriverBench.c)
 target_link_libraries(DriverBench PRIVATE dl)
 
+# WHY EVERY ENTRY HERE CARRIES A PASS_REGULAR_EXPRESSION.
+#
+# DriverBench prints one CSV row per case it ran and exits 0 whatever it ran. Before this, a ctest
+# entry naming a case therefore could not answer the only question it exists to ask: an argument
+# matching nothing in kBenchCases selected no case, printed only the header row, and still exited
+# 0. DriverBench.c now refuses an unknown case name (exit 2), which closes it at the source - but
+# the entry must be able to go red for the reason it exists WITHOUT depending on that check
+# staying in the binary, so each entry also requires the case's own output row to appear.
+#
+# The regex is what a healthy run of that case prints and nothing else does: the case name at the
+# start of a line, then the frames / ops-per-frame / median-ms / ns-per-op / fps columns
+# (run_case()). A rename, a drop from kBenchCases, a boot_egl() failure or
+# a crash part-way through the case all remove that row and turn the entry red.
+#
+# Note that a PASS_REGULAR_EXPRESSION makes ctest ignore the process exit code (cmCTestRunTest:
+# success is `retVal == 0 || !RequiredRegularExpressions.empty()`), which is why the row itself
+# has to be the evidence rather than a companion to the rc.
 add_test(NAME DriverBench COMMAND DriverBench draw_tiny)
-set_tests_properties(DriverBench PROPERTIES LABELS benchmark)
+# draw_tiny's a/ops scale with $DRIVERBENCH_DRAWS (main()), so only the shape of
+# the row is pinned here, not the column values.
+set_tests_properties(DriverBench PROPERTIES
+    LABELS benchmark
+    PASS_REGULAR_EXPRESSION "(^|\n)draw_tiny,[0-9]+,[0-9]+,[0-9.]+,[0-9.]+,[0-9.]+")
+
+# The Blaze3D blend toggle, as its own entry.
+#
+# mc_state_toggle is glEnable(GL_BLEND) / glBlendFuncSeparate / glDrawElements /
+# glDisable(GL_BLEND) / glDrawElements, 46 times - the measured vanilla-frame rate, and the exact
+# shape ROADMAP.md writes down as the microbenchmark P2 owes the GO/NO-GO. It is the workload the
+# whole "push at validate, not in the setter" decision was made for: a per-setter design pays for
+# every toggle, and a CSO that is minted twice and then reused pays for none of them.
+#
+# The case has existed in kBenchCases since P0 and nothing ran it, so nothing noticed if it broke.
+# Exposing it costs about 1.2 s inside an existing three-minute job, and it means the number the
+# P2 report quotes comes from a case CI has been executing all along rather than from a code path
+# whose first run is the day it is measured.
+#
+# Like the entry above, this runs against whatever $DRIVERBENCH_EGL_LIB names (the system driver
+# when unset) - the ctest entry is a "does this case still run" gate, not the measurement. The
+# measurement is run_driver_bench.sh against each of {native, espryt, magma}.
+add_test(NAME DriverBenchStateToggle COMMAND DriverBench mc_state_toggle)
+# The ops-per-frame column is pinned to 46 here, unlike the entry above: the mc_* cases are
+# excluded from the $DRIVERBENCH_DRAWS scaling on purpose ("the mc_* rates are measured and must
+# not move, or the numbers stop being comparable", main()), so 46 toggles per frame
+# is part of what "this case still runs" means. Change the workload and this entry says so.
+set_tests_properties(DriverBenchStateToggle PROPERTIES
+    LABELS benchmark
+    PASS_REGULAR_EXPRESSION "(^|\n)mc_state_toggle,[0-9]+,46,[0-9.]+,[0-9.]+,[0-9.]+")

MobileGL/MG_Benchmark/Driver/DriverBench.c

@@ -476,6 +476,28 @@ int main(int argc, char** argv) {
     if (getenv("DRIVERBENCH_FRAMES")) g_frames = atoi(getenv("DRIVERBENCH_FRAMES"));
     if (getenv("DRIVERBENCH_SPRITES")) g_mixSprites = atol(getenv("DRIVERBENCH_SPRITES"));
 
+    /* A requested case name that matches nothing used to select nothing, print the header row and
+     * exit 0 - so a caller that names a case (run_driver_bench.sh, and the two ctest entries in
+     * CMakeLists.txt) could not tell "the case ran" from "the case has been renamed or deleted".
+     * Refuse it here, before any GL work, so the refusal reaches a caller that has no display
+     * either, and name what does exist so the fix is obvious. */
+    int unknownCases = 0;
+    for (int j = 1; j < argc; ++j) {
+        int known = 0;
+        for (int i = 0; i < kBenchCaseCount; ++i)
+            if (strcmp(argv[j], kBenchCases[i].name) == 0) known = 1;
+        if (!known) {
+            fprintf(stderr, "DriverBench: no case named '%s'\n", argv[j]);
+            unknownCases = 1;
+        }
+    }
+    if (unknownCases) {
+        fprintf(stderr, "DriverBench: the %d cases in kBenchCases are:\n", kBenchCaseCount);
+        for (int i = 0; i < kBenchCaseCount; ++i)
+            fprintf(stderr, "  %s\n", kBenchCases[i].name);
+        return 2;
+    }
+
     if (boot_egl()) return 1;
     build_resources();
 

MobileGL/MG_Impl/GLImpl/Debug/GL_Debug.cpp

@@ -0,0 +1,271 @@
+// MobileGL - MobileGL/MG_Impl/GLImpl/Debug/GL_Debug.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "GL_Debug.h"
+
+#include <cstring>
+
+#include <MG_State/GLState/Core.h>
+#include <MG_State/GLState/ErrorState/Error.h>
+#include <MG_Impl/GLImpl/Query/GL_Query.h>
+#include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
+
+namespace MobileGL::MG_Impl::GLImpl {
+    namespace {
+        // Must agree with what GL_Getter answers for GL_MAX_DEBUG_GROUP_STACK_DEPTH and
+        // GL_MAX_DEBUG_MESSAGE_LENGTH / GL_MAX_LABEL_LENGTH; an application that sizes a buffer
+        // off the query and then trips a different limit here would have no way to explain it.
+        constexpr SizeT kMaxDebugGroupStackDepth = 64;
+        constexpr GLsizei kMaxDebugMessageLength = 1024;
+        constexpr GLsizei kMaxLabelLength = 256;
+
+        // The debug state KHR_debug makes per-context. Held here rather than on GLContext because
+        // nothing else in MobileGL reads it, and it is keyed on the context id so a
+        // destroyed-and-recreated context starts with an empty stack and no labels - which the
+        // unit tests, which recreate the context between cases, depend on.
+        struct DebugState {
+            Uint64 contextId = 0;
+            // The messages pushed with glPushDebugGroup, innermost last. The base group GL creates
+            // the context with is implicit and is what makes the reported depth start at 1.
+            Vector<String> groupStack;
+            // Keyed by (identifier, name); see MakeObjectLabelKey.
+            UnorderedMap<Uint64, String> objectLabels;
+        };
+
+        DebugState& State() {
+            static DebugState state;
+            const Uint64 contextId = MG_State::pGLContext ? MG_State::pGLContext->GetTextureContextId() : 0;
+            if (state.contextId != contextId) {
+                state.contextId = contextId;
+                state.groupStack.clear();
+                state.objectLabels.clear();
+            }
+            return state;
+        }
+
+        Uint64 MakeObjectLabelKey(GLenum identifier, GLuint name) {
+            return (static_cast<Uint64>(identifier) << 32) | static_cast<Uint64>(name);
+        }
+
+        void RecordDebugError(ErrorCode code, const char* caller, const String& message) {
+            MG_State::pGLContext->RecordError(code, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, message));
+        }
+
+        // GL 4.6 core 20.2: only an APPLICATION or THIRD_PARTY source may be injected; the rest
+        // are reserved for the implementation itself.
+        Bool ValidateInjectedSource(GLenum source, const char* caller) {
+            if (source == GL_DEBUG_SOURCE_APPLICATION || source == GL_DEBUG_SOURCE_THIRD_PARTY) {
+                return true;
+            }
+            RecordDebugError(ErrorCode::InvalidEnum, caller,
+                             std::format("source {} is not GL_DEBUG_SOURCE_APPLICATION or "
+                                         "GL_DEBUG_SOURCE_THIRD_PARTY.",
+                                         MG_Util::ConvertGLEnumToString(source)));
+            return false;
+        }
+
+        // A negative length means the string is NUL-terminated (GL 4.6 core 20.2), which is how
+        // every one of these entry points spells "just use the whole thing".
+        Bool ValidateDebugStringLength(GLsizei length, const GLchar* text, GLsizei limit, const char* caller,
+                                       const char* what) {
+            const GLsizei effective =
+                length < 0 ? static_cast<GLsizei>(text != nullptr ? std::strlen(text) : 0) : length;
+            if (effective < limit) {
+                return true;
+            }
+            RecordDebugError(ErrorCode::InvalidValue, caller,
+                             std::format("{} length {} is not less than the {} limit of {}.", what, effective, what,
+                                         limit));
+            return false;
+        }
+
+        String MakeDebugString(GLsizei length, const GLchar* text) {
+            if (text == nullptr) return {};
+            return length < 0 ? String(text) : String(text, static_cast<SizeT>(length));
+        }
+
+        // Whether `name` currently names an object of `identifier`'s type. GL 4.6 core 20.5 makes
+        // labelling something that does not exist INVALID_VALUE, and every type KHR_debug lists
+        // has a frontend name check - so this is answered exactly rather than waved through.
+        // GL_DISPLAY_LIST is deliberately absent: it exists only in the compatibility profile,
+        // which MobileGL does not expose, so it falls to the INVALID_ENUM path below.
+        Bool ValidateLabelledObject(GLenum identifier, GLuint name, Bool& outIdentifierKnown) {
+            outIdentifierKnown = true;
+            auto* context = MG_State::pGLContext.get();
+            switch (identifier) {
+            case GL_BUFFER:
+                return context->ValidateBufferName(name);
+            case GL_SHADER:
+                return context->ValidateShaderName(name);
+            case GL_PROGRAM:
+                return context->ValidateProgramName(name);
+            case GL_VERTEX_ARRAY:
+                return context->ValidateVertexArrayName(name);
+            case GL_QUERY:
+                return IsQuery(name) == GL_TRUE;
+            case GL_PROGRAM_PIPELINE:
+                return context->ValidateProgramPipelineName(name);
+            case GL_TRANSFORM_FEEDBACK:
+                return context->ValidateTransformFeedbackName(name);
+            case GL_SAMPLER:
+                return context->ValidateSamplerName(name);
+            case GL_TEXTURE:
+                return context->ValidateTextureName(name);
+            case GL_RENDERBUFFER:
+                return context->ValidateRenderbufferName(name);
+            case GL_FRAMEBUFFER:
+                // Name 0 is the default framebuffer, which is a real, labellable object.
+                return name == 0 || context->ValidateFramebufferName(name);
+            default:
+                outIdentifierKnown = false;
+                return false;
+            }
+        }
+    } // namespace
+
+    GLint GetDebugGroupStackDepth() {
+        // GL 4.6 core 20.6: the context is created with one group already on the stack, so the
+        // reported depth is one more than the number of pushes the application has made.
+        return static_cast<GLint>(State().groupStack.size()) + 1;
+    }
+
+    void PushDebugGroup(GLenum source, GLuint id, GLsizei length, const GLchar* message) {
+        static_cast<void>(id);
+        if (!ValidateInjectedSource(source, __func__)) return;
+        if (!ValidateDebugStringLength(length, message, kMaxDebugMessageLength, __func__, "message")) return;
+
+        auto& state = State();
+        if (state.groupStack.size() + 1 >= kMaxDebugGroupStackDepth) {
+            // Not INVALID_*: KHR_debug gives the group stack its own error code.
+            RecordDebugError(ErrorCode::StackOverflow, __func__,
+                             std::format("the debug group stack is already {} deep, which is its maximum.",
+                                         kMaxDebugGroupStackDepth));
+            return;
+        }
+        state.groupStack.push_back(MakeDebugString(length, message));
+        MGLOG_D("glPushDebugGroup(%s) -> depth %d", state.groupStack.back().c_str(), GetDebugGroupStackDepth());
+    }
+
+    void PopDebugGroup() {
+        auto& state = State();
+        if (state.groupStack.empty()) {
+            // The base group the context was created with may not be popped (GL 4.6 core 20.6).
+            RecordDebugError(ErrorCode::StackUnderflow, __func__,
+                             "the debug group stack holds only the group the context was created with.");
+            return;
+        }
+        MGLOG_D("glPopDebugGroup(%s)", state.groupStack.back().c_str());
+        state.groupStack.pop_back();
+    }
+
+    void DebugMessageInsert(GLenum source, GLenum type, GLuint id, GLenum severity, GLsizei length,
+                            const GLchar* buf) {
+        static_cast<void>(id);
+        if (!ValidateInjectedSource(source, __func__)) return;
+        switch (type) {
+        case GL_DEBUG_TYPE_ERROR:
+        case GL_DEBUG_TYPE_DEPRECATED_BEHAVIOR:
+        case GL_DEBUG_TYPE_UNDEFINED_BEHAVIOR:
+        case GL_DEBUG_TYPE_PORTABILITY:
+        case GL_DEBUG_TYPE_PERFORMANCE:
+        case GL_DEBUG_TYPE_MARKER:
+        case GL_DEBUG_TYPE_PUSH_GROUP:
+        case GL_DEBUG_TYPE_POP_GROUP:
+        case GL_DEBUG_TYPE_OTHER:
+            break;
+        default:
+            RecordDebugError(ErrorCode::InvalidEnum, __func__,
+                             std::format("type {} is not a debug message type.",
+                                         MG_Util::ConvertGLEnumToString(type)));
+            return;
+        }
+        switch (severity) {
+        case GL_DEBUG_SEVERITY_HIGH:
+        case GL_DEBUG_SEVERITY_MEDIUM:
+        case GL_DEBUG_SEVERITY_LOW:
+        case GL_DEBUG_SEVERITY_NOTIFICATION:
+            break;
+        default:
+            RecordDebugError(ErrorCode::InvalidEnum, __func__,
+                             std::format("severity {} is not a debug message severity.",
+                                         MG_Util::ConvertGLEnumToString(severity)));
+            return;
+        }
+        if (!ValidateDebugStringLength(length, buf, kMaxDebugMessageLength, __func__, "message")) return;
+
+        // No callback is ever invoked and the message log is empty by construction
+        // (GL_MAX_DEBUG_LOGGED_MESSAGES is 1 and glGetDebugMessageLog returns nothing), so the
+        // application-visible effect is exactly the error checking above. The text still reaches
+        // MobileGL's own log, where it is worth having next to the calls it annotates - at debug
+        // level, so an application that inserts a message per draw costs nothing in a release build.
+        MGLOG_D("glDebugMessageInsert: %s", MakeDebugString(length, buf).c_str());
+    }
+
+    void ObjectLabel(GLenum identifier, GLuint name, GLsizei length, const GLchar* label) {
+        Bool identifierKnown = false;
+        const Bool objectExists = ValidateLabelledObject(identifier, name, identifierKnown);
+        if (!identifierKnown) {
+            RecordDebugError(ErrorCode::InvalidEnum, __func__,
+                             std::format("identifier {} is not a labellable object type.",
+                                         MG_Util::ConvertGLEnumToString(identifier)));
+            return;
+        }
+        if (!objectExists) {
+            RecordDebugError(ErrorCode::InvalidValue, __func__,
+                             std::format("{} {} is not the name of an existing object.",
+                                         MG_Util::ConvertGLEnumToString(identifier), name));
+            return;
+        }
+        if (!ValidateDebugStringLength(length, label, kMaxLabelLength, __func__, "label")) return;
+
+        auto& labels = State().objectLabels;
+        const Uint64 key = MakeObjectLabelKey(identifier, name);
+        if (label == nullptr) {
+            // GL 4.6 core 20.5: a NULL label removes any label the object had.
+            labels.erase(key);
+            return;
+        }
+        labels[key] = MakeDebugString(length, label);
+    }
+
+    void GetObjectLabel(GLenum identifier, GLuint name, GLsizei bufSize, GLsizei* length, GLchar* label) {
+        if (bufSize < 0) {
+            RecordDebugError(ErrorCode::InvalidValue, __func__, "bufSize must not be negative.");
+            return;
+        }
+        Bool identifierKnown = false;
+        const Bool objectExists = ValidateLabelledObject(identifier, name, identifierKnown);
+        if (!identifierKnown) {
+            RecordDebugError(ErrorCode::InvalidEnum, __func__,
+                             std::format("identifier {} is not a labellable object type.",
+                                         MG_Util::ConvertGLEnumToString(identifier)));
+            return;
+        }
+        if (!objectExists) {
+            RecordDebugError(ErrorCode::InvalidValue, __func__,
+                             std::format("{} {} is not the name of an existing object.",
+                                         MG_Util::ConvertGLEnumToString(identifier), name));
+            return;
+        }
+
+        const auto& labels = State().objectLabels;
+        const auto it = labels.find(MakeObjectLabelKey(identifier, name));
+        const String& text = it != labels.end() ? it->second : String{};
+        // GL 4.6 core 20.5: the returned length excludes the NUL, and an unlabelled object hands
+        // back an empty string with length 0 rather than an error.
+        SizeT copied = 0;
+        if (label != nullptr && bufSize > 0) {
+            copied = std::min(text.size(), static_cast<SizeT>(bufSize) - 1);
+            std::memcpy(label, text.data(), copied);
+            label[copied] = '\0';
+        }
+        if (length != nullptr) {
+            *length = static_cast<GLsizei>(copied);
+        }
+    }
+} // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Debug/GL_Debug.h

@@ -0,0 +1,42 @@
+// MobileGL - MobileGL/MG_Impl/GLImpl/Debug/GL_Debug.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+namespace MobileGL::MG_Impl::GLImpl {
+    // KHR_debug, core since GL 4.3 (GL 4.6 core 20). Applications use these to annotate a capture
+    // and to name their objects; Better Clouds calls all four for exactly that.
+    //
+    // MobileGL implements the STATE and the ERRORS, and deliberately does not forward the calls to
+    // the host driver. Two independent reasons:
+    //
+    //  * glObjectLabel names a FRONTEND object. MobileGL's texture 5 is not the ES driver's
+    //    texture 5 (and under DirectVulkan it is not a driver object at all), so forwarding the
+    //    pair verbatim would label an unrelated object or a nonexistent one - worse than not
+    //    labelling.
+    //  * A debug GROUP is only meaningful if it brackets the commands the application issued
+    //    inside it. Neither backend emits its work at the moment the GL call arrives: DirectGLES
+    //    defers and reorders state sync and uploads around draws, and DirectVulkan is usually not
+    //    even recording a command buffer here. A forwarded push/pop would therefore enclose the
+    //    wrong commands, which is a misleading capture rather than a helpful one.
+    //
+    // What the application can rely on is the observable contract: the group stack depth is real
+    // (GL_DEBUG_GROUP_STACK_DEPTH tracks it, and over/underflow raise the errors KHR_debug
+    // specifies), and a label written with glObjectLabel comes back from glGetObjectLabel.
+    void PushDebugGroup(GLenum source, GLuint id, GLsizei length, const GLchar* message);
+    void PopDebugGroup();
+    void DebugMessageInsert(GLenum source, GLenum type, GLuint id, GLenum severity, GLsizei length,
+                            const GLchar* buf);
+    void ObjectLabel(GLenum identifier, GLuint name, GLsizei length, const GLchar* label);
+    void GetObjectLabel(GLenum identifier, GLuint name, GLsizei bufSize, GLsizei* length, GLchar* label);
+
+    // Current depth of the debug group stack, for GL_DEBUG_GROUP_STACK_DEPTH. The base group the
+    // context is created with counts, so this is never below 1 (GL 4.6 core 20.6).
+    GLint GetDebugGroupStackDepth();
+} // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.cpp

@@ -11,6 +11,7 @@
 #include <MG_State/GLState/Core.h>
 #include <MG_State/EGLState/Core.h>
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 #include "../Getter/GL_Getter.h"
 
 namespace MobileGL::MG_Impl::GLImpl {
@@ -34,8 +35,81 @@ namespace MobileGL::MG_Impl::GLImpl {
         return true;
     }
 
-    static Bool ValidateCurrentProgramForExecution(const char* functionName) {
+    // Takes the ALREADY-RESOLVED draw program rather than looking it up: GLContext::GetProgramForDraw
-        return ValidateProgramForExecution(MG_State::pGLContext->GetProgramForDraw(), functionName);
+    // is not a plain getter (it settles the program's link and SPIR-V jobs so every version a
+    // backend samples during this draw describes the program it is drawing), so the draw funnel
+    // below resolves it exactly once and hands it to both users.
+    static Bool ValidateResolvedProgramForDraw(const SharedPtr<MG_State::GLState::ProgramObject>& currentProgram,
+                                               const char* functionName) {
+        // "If there is no current program object or bound program pipeline object, the results of
+        // a draw are UNDEFINED" - and undefined is not an error (GL 4.6 core 7.3, ES 3.1 7.3).
+        // The draw is dropped, silently, which is one of the shapes "undefined" is allowed to
+        // take; recording INVALID_OPERATION here is not, and es31cSeparateShaderObjsTests'
+        // StateInteraction reads exactly that error back after useProgram(0) + bindProgramPipeline(0).
+        // A DISPATCH is the opposite rule ("INVALID_OPERATION if there is no active program for
+        // the compute shader stage"), which is why this lives on the draw path and not in the
+        // shared ValidateProgramForExecution below.
+        if (!currentProgram) return false;
+        if (!ValidateProgramForExecution(currentProgram, functionName)) return false;
+
+        // GL 4.6 core 7.4.1, the pipeline validation rule every vertex-transferring command
+        // inherits: it is an INVALID_OPERATION when a tessellation control, tessellation
+        // evaluation or geometry stage has an executable but no program supplies an executable
+        // VERTEX shader. A non-separable program cannot reach this - the link rule forbids the
+        // shape - so in practice it catches a program pipeline assembled out of stage programs,
+        // which today draws happily and renders nothing.
+        //
+        // Asked of the EXECUTABLE, like the compute check below: for a pipeline the resolved
+        // program is the graphics composite, whose linked-shader snapshot is built out of exactly
+        // the pipeline's own graphics stage programs (GLContext::GetProgramForDraw), and the only
+        // stage compositing ever invents is a default FRAGMENT shader. A fragment-only pipeline is
+        // deliberately NOT rejected: the rule above names the three pre-rasterization stages, and
+        // nothing else here should start refusing draws GL accepts.
+        //
+        // On the DRAW path only, never in ValidateProgramForExecution itself, so a dispatch -
+        // which shares that helper and legitimately has no vertex stage - is untouched.
+        const Bool hasPreRasterizationStage = currentProgram->HasLinkedShaderStage(ShaderStage::Geometry) ||
+                                              currentProgram->HasLinkedShaderStage(ShaderStage::TessControl) ||
+                                              currentProgram->HasLinkedShaderStage(ShaderStage::TessEval);
+        if (hasPreRasterizationStage && !currentProgram->HasLinkedShaderStage(ShaderStage::Vertex)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", functionName,
+                    "The program in use runs a geometry or tessellation stage but has no vertex shader stage."));
+            return false;
+        }
+
+        return true;
+    }
+
+    // gl_NumSamples has no SPIR-V built-in, so the source pipeline lowers it onto a reserved
+    // default-block uniform (see InjectNumSamplesBuiltinShim). This is where that uniform is paid
+    // for: the value is a property of the DRAW FRAMEBUFFER, not of the program, so one program
+    // drawn into a 4x target and then into the default framebuffer must see 4 and then 1 - which
+    // rules out baking it at link time.
+    //
+    // Per draw rather than on framebuffer changes because the pair (program, framebuffer) is what
+    // decides the value and either half can move between draws. It costs a phase-A flag read for
+    // every program that has no shim, and a 4-byte compare for the ones that do: the write only
+    // bumps the UBO content version when the number actually changes, so a run of draws into one
+    // framebuffer re-uploads nothing.
+    static void PublishDrawFramebufferSampleCount(const SharedPtr<MG_State::GLState::ProgramObject>& program) {
+        if (!program || !program->UsesReservedNumSamples()) return;
+        // GL 4.6 core 15.2.2: gl_NumSamples is the number of samples in the framebuffer, or ONE
+        // when the target is not multisampled - where glGetIntegerv(GL_SAMPLES) answers zero.
+        program->WriteReservedNumSamples(static_cast<Int>(std::max<GLint>(ResolveDrawFramebufferSampleCount(), 1)));
+    }
+
+    // The one funnel every drawing command passes through. Order is load-bearing: validate first
+    // (a rejected draw must leave state alone), then publish the sample count - which reads the
+    // DRAW FRAMEBUFFER binding, so it has to run after the caller's framebuffer state is settled
+    // and before the backend consumes the program's UBO content version.
+    static Bool PrepareCurrentProgramForDraw(const char* functionName) {
+        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
+        if (!ValidateResolvedProgramForDraw(currentProgram, functionName)) return false;
+        PublishDrawFramebufferSampleCount(currentProgram);
+        return true;
     }
 
     // A dispatch resolves its program through the DISPATCH accessor: with a pipeline bound
@@ -73,6 +147,20 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_TRIANGLES: return static_cast<Uint64>(count / 3);
         case GL_TRIANGLE_STRIP:
         case GL_TRIANGLE_FAN: return count >= 3 ? static_cast<Uint64>(count - 2) : 0;
+        // Adjacency primitives (GL 4.6 core table 10.1). Only a geometry stage can consume
+        // them, and it is the ADJACENT-free primitive count that reaches it: 4 vertices per
+        // line, 6 per triangle, one per step for the strips. Answering 0 here - which is what
+        // the default arm did - made AccountTransformFeedbackPrimitives bail before it had
+        // recorded anything, so an adjacency capture advanced neither the captured-vertex
+        // counter the scattered-capture path is bounded by nor the geometry-capture-draw flag
+        // that routes the transform feedback queries to the driver's own counter.
+        case GL_LINES_ADJACENCY: return static_cast<Uint64>(count / 4);
+        case GL_LINE_STRIP_ADJACENCY: return count >= 4 ? static_cast<Uint64>(count - 3) : 0;
+        case GL_TRIANGLES_ADJACENCY: return static_cast<Uint64>(count / 6);
+        case GL_TRIANGLE_STRIP_ADJACENCY: return count >= 6 ? static_cast<Uint64>((count - 4) / 2) : 0;
+        // GL_PATCHES is deliberately absent: the tessellator's amplification is not knowable
+        // on the CPU, and answering 0 is what defers GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN
+        // to the driver's own counter, which is the only correct source for a patch capture.
         default: return 0;
         }
     }
@@ -99,11 +187,17 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_LINES:
         case GL_LINE_STRIP:
         case GL_LINE_LOOP:
+        // An adjacency primitive delivers the same line/triangle to the geometry stage; the
+        // adjacent vertices are context, not part of the primitive.
+        case GL_LINES_ADJACENCY:
+        case GL_LINE_STRIP_ADJACENCY:
             verticesPerPrimitive = 2;
             break;
         case GL_TRIANGLES:
         case GL_TRIANGLE_STRIP:
         case GL_TRIANGLE_FAN:
+        case GL_TRIANGLES_ADJACENCY:
+        case GL_TRIANGLE_STRIP_ADJACENCY:
             verticesPerPrimitive = 3;
             break;
         default:
@@ -308,11 +402,21 @@ namespace MobileGL::MG_Impl::GLImpl {
             case GL_POINTS:
                 compatible = mode == GL_POINTS;
                 break;
+            // The adjacency modes belong here too (GL 4.6 core table 13.1, ES 3.2 table 12.1).
+            // This arm is only reached when the program has NO geometry or tessellation
+            // evaluation stage, and without a geometry stage the adjacent vertices are simply
+            // ignored (GL 4.6 core 10.1) - the primitive assembled IS a plain line or triangle,
+            // so the combination is legal and must capture. Omitting them raised a spurious
+            // GL_INVALID_OPERATION and dropped the draw entirely, leaving the capture buffer
+            // with its pre-draw bytes. The geometry-stage input table above already carries the
+            // same four arms; this is the second table catching up with it.
             case GL_LINES:
-                compatible = mode == GL_LINES || mode == GL_LINE_STRIP || mode == GL_LINE_LOOP;
+                compatible = mode == GL_LINES || mode == GL_LINE_STRIP || mode == GL_LINE_LOOP ||
+                             mode == GL_LINES_ADJACENCY || mode == GL_LINE_STRIP_ADJACENCY;
                 break;
             case GL_TRIANGLES:
-                compatible = mode == GL_TRIANGLES || mode == GL_TRIANGLE_STRIP || mode == GL_TRIANGLE_FAN;
+                compatible = mode == GL_TRIANGLES || mode == GL_TRIANGLE_STRIP || mode == GL_TRIANGLE_FAN ||
+                             mode == GL_TRIANGLES_ADJACENCY || mode == GL_TRIANGLE_STRIP_ADJACENCY;
                 break;
             default:
                 break;
@@ -382,6 +486,31 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
+    // GL 4.6 core 10.3.9: every DrawElements-family count is a sizei and "if count is negative, an
+    // INVALID_VALUE error is generated". The same sentence covers instancecount and the
+    // MultiDraw* drawcount, so one helper serves all of them; the parameter is named for the
+    // caller so the message says which argument the application actually got wrong.
+    static Bool ValidateNonNegativeDrawArgument(const char* functionName, const char* argumentName, GLsizei value) {
+        if (value >= 0) return true;
+        MG_State::pGLContext->RecordError(
+            ErrorCode::InvalidValue,
+            MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                         String(argumentName) + " must be non-negative."));
+        return false;
+    }
+
+    // GL 4.6 core 10.3.9 for DrawRangeElements*: "if end < start, an INVALID_VALUE error is
+    // generated". Both are uints, so a caller that passes -1 for start arrives here as
+    // 0xFFFFFFFF and is caught by the same comparison - which is exactly what
+    // KHR-GL4x.draw_elements_base_vertex_tests.invalid_count_argument checks.
+    static Bool ValidateDrawElementsRange(const char* functionName, GLuint start, GLuint end) {
+        if (end >= start) return true;
+        MG_State::pGLContext->RecordError(
+            ErrorCode::InvalidValue,
+            MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName, "end must not be less than start."));
+        return false;
+    }
+
     // GL 4.6 core 10.9: inside a conditional block whose predicate did not pass, the drawing
     // commands, Clear, ClearBuffer* and the compute dispatches are DISCARDED. The gate sits on the
     // wrappers that ISSUE the backend call rather than at the top of each entry point, so that
@@ -399,6 +528,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(Clear);
         MG_Backend::gBackendFunctionsTable.GL.Clear(mask);
     }
 
@@ -407,6 +537,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElements);
         MG_Backend::gBackendFunctionsTable.GL.DrawElements(mode, count, type, indices);
     }
 
@@ -416,6 +547,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElements);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElements(mode, count, type, indices, drawcount);
     }
 
@@ -425,6 +557,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElementsBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsBaseVertex(mode, count, type, indices, drawcount,
                                                                           basevertex);
     }
@@ -434,6 +567,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArrays);
         MG_Backend::gBackendFunctionsTable.GL.DrawArrays(mode, first, count);
     }
 
@@ -442,6 +576,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawArrays);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArrays(mode, first, count, drawcount);
     }
 
@@ -451,6 +586,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsBaseVertex(mode, count, type, indices, basevertex);
     }
 
@@ -460,6 +596,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElementsIndirect);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirect(mode, type, indirect, drawcount, stride);
     }
 
@@ -468,6 +605,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawArraysIndirect);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirect(mode, indirect, drawcount, stride);
     }
 
@@ -477,6 +615,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawElementsIndirectCount);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirectCount(mode, type, indirect, drawcount,
                                                                              maxdrawcount, stride);
     }
@@ -487,6 +626,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(MultiDrawArraysIndirectCount);
         MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirectCount(mode, indirect, drawcount, maxdrawcount,
                                                                            stride);
     }
@@ -497,6 +637,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawRangeElementsBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.DrawRangeElementsBaseVertex(mode, start, end, count, type, indices,
                                                                           basevertex);
     }
@@ -507,6 +648,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawRangeElements);
         MG_Backend::gBackendFunctionsTable.GL.DrawRangeElements(mode, start, end, count, type, indices);
     }
 
@@ -517,6 +659,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_SET_BASE_INSTANCE(baseinstance);
+        MGP_FILL(DrawElementsInstancedBaseVertexBaseInstance);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseVertexBaseInstance(
             mode, count, type, indices, instancecount, basevertex, baseinstance);
     }
@@ -527,6 +671,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsInstancedBaseVertex);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseVertex(mode, count, type, indices, instancecount,
                                                                               basevertex);
     }
@@ -537,6 +682,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_SET_BASE_INSTANCE(baseinstance);
+        MGP_FILL(DrawElementsInstancedBaseInstance);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstancedBaseInstance(mode, count, type, indices,
                                                                                 instancecount, baseinstance);
     }
@@ -547,6 +694,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsInstanced);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsInstanced(mode, count, type, indices, instancecount);
     }
 
@@ -555,6 +703,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawElementsIndirect);
         MG_Backend::gBackendFunctionsTable.GL.DrawElementsIndirect(mode, type, indirect);
     }
     void DrawArraysInstancedBaseInstance_Backend(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
@@ -563,6 +712,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_SET_BASE_INSTANCE(baseinstance);
+        MGP_FILL(DrawArraysInstancedBaseInstance);
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysInstancedBaseInstance(mode, first, count, instancecount,
                                                                               baseinstance);
     }
@@ -572,6 +723,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArraysInstanced);
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysInstanced(mode, first, count, instancecount);
     }
 
@@ -580,6 +732,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DrawArraysIndirect);
         MG_Backend::gBackendFunctionsTable.GL.DrawArraysIndirect(mode, indirect);
     }
 
@@ -611,6 +764,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         // GL 4.3 added both dispatches to the conditional-render set (GL 4.6 core 10.9), which is
         // exactly what KHR-GL43.compute_shader.conditional-dispatching checks.
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DispatchCompute);
         dispatchCompute(numGroupsX, numGroupsY, numGroupsZ);
     }
 
@@ -663,6 +817,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         if (!ValidateCurrentProgramForCompute(__func__)) return;
         if (ConditionalRenderDiscardsCommand()) return;
+        MGP_FILL(DispatchComputeIndirect);
         dispatchComputeIndirect(indirect);
     }
 
@@ -684,11 +839,70 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->SetPatchVertices(static_cast<Uint>(value));
         if (const auto patchParameteri = MG_Backend::gBackendFunctionsTable.GL.PatchParameteri) {
+            MGP_FILL(PatchParameteri);
             patchParameteri(pname, value);
         }
     }
 
+    // GL 4.6 core 11.2.2. The default tessellation levels a program with an evaluation stage and
+    // NO control stage tessellates at; both backends have to synthesize that control stage
+    // themselves (ES 3.2 and Vulkan both require one), and they compile these numbers into it, so
+    // there is no backend entry point to forward to - ES has none at all. INVALID_ENUM on a bad
+    // pname is the only error the spec lists: any float values are accepted, negatives and NaN
+    // included, and it is the tessellator that clamps them.
+    //
+    // This used to be a stub, which is why the two synthesizers hardcoded 1.0.
+    void PatchParameterfv(GLenum pname, const GLfloat* values) {
+        if (pname != GL_PATCH_DEFAULT_OUTER_LEVEL && pname != GL_PATCH_DEFAULT_INNER_LEVEL) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", __func__,
+                    "pname must be GL_PATCH_DEFAULT_OUTER_LEVEL or GL_PATCH_DEFAULT_INNER_LEVEL."));
+            return;
+        }
+        if (!values) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "values pointer cannot be null"));
+            return;
+        }
+        if (pname == GL_PATCH_DEFAULT_OUTER_LEVEL) {
+            MG_State::pGLContext->SetPatchDefaultOuterLevel(
+                FloatVec4(values[0], values[1], values[2], values[3]));
+        } else {
+            MG_State::pGLContext->SetPatchDefaultInnerLevel(FloatVec2(values[0], values[1]));
+        }
+    }
+
+    namespace {
+        // GL 4.6 core 7.11.2 (and ARB_shader_image_load_store, which introduced the call): the
+        // barrier bitfield is INVALID_VALUE unless every bit is one of the defined ones, with
+        // GL_ALL_BARRIER_BITS - which is 0xFFFFFFFF, not the union of the list - accepted whole.
+        // Forwarding an undefined bit to the host driver let a caller that had computed its mask
+        // wrongly (or reused an ES-only bit) get silence instead of the error the spec promises.
+        constexpr GLbitfield kAllDefinedBarrierBits =
+            GL_VERTEX_ATTRIB_ARRAY_BARRIER_BIT | GL_ELEMENT_ARRAY_BARRIER_BIT | GL_UNIFORM_BARRIER_BIT |
+            GL_TEXTURE_FETCH_BARRIER_BIT | GL_SHADER_IMAGE_ACCESS_BARRIER_BIT | GL_COMMAND_BARRIER_BIT |
+            GL_PIXEL_BUFFER_BARRIER_BIT | GL_TEXTURE_UPDATE_BARRIER_BIT | GL_BUFFER_UPDATE_BARRIER_BIT |
+            GL_FRAMEBUFFER_BARRIER_BIT | GL_TRANSFORM_FEEDBACK_BARRIER_BIT | GL_ATOMIC_COUNTER_BARRIER_BIT |
+            GL_SHADER_STORAGE_BARRIER_BIT | GL_CLIENT_MAPPED_BUFFER_BARRIER_BIT | GL_QUERY_BUFFER_BARRIER_BIT;
+
+        Bool ValidateMemoryBarrierBits(const char* function, GLbitfield barriers) {
+            if (barriers == GL_ALL_BARRIER_BITS) return true;
+            if ((barriers & ~kAllDefinedBarrierBits) != 0) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", function,
+                                                 "barriers contains bits that are not defined barrier bits."));
+                return false;
+            }
+            return true;
+        }
+    } // namespace
+
     void MemoryBarrier(GLbitfield barriers) {
+        if (!ValidateMemoryBarrierBits(__func__, barriers)) return;
         auto memoryBarrier = MG_Backend::gBackendFunctionsTable.GL.MemoryBarrier;
         if (!memoryBarrier) {
             MG_State::pGLContext->RecordError(
@@ -696,10 +910,34 @@ namespace MobileGL::MG_Impl::GLImpl {
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Backend does not support memory barriers."));
             return;
         }
+        MGP_FILL(MemoryBarrier);
         memoryBarrier(barriers);
     }
 
+    void TextureBarrier() {
+        // GL 4.5 core 8.26 / GL_ARB_texture_barrier: order every write the fixed-function
+        // framebuffer has already issued ahead of every subsequent texture fetch, so a shader may
+        // read texels of a texture that is also attached to the current framebuffer.
+        //
+        // Both backends serve this through their existing memory-barrier hook rather than a new
+        // entry point of their own: GL_FRAMEBUFFER_BARRIER_BIT is the source half (framebuffer
+        // writes) and GL_TEXTURE_FETCH_BARRIER_BIT the destination half (texture fetches), which
+        // is exactly the dependency ARB_texture_barrier defines - just expressed with the wider
+        // scope glMemoryBarrier gives it. That is a superset of the required ordering, never a
+        // subset, so it cannot under-synchronize.
+        auto memoryBarrier = MG_Backend::gBackendFunctionsTable.GL.MemoryBarrier;
+        if (!memoryBarrier) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Backend does not support memory barriers."));
+            return;
+        }
+        MGP_FILL(MemoryBarrier);
+        memoryBarrier(GL_TEXTURE_FETCH_BARRIER_BIT | GL_FRAMEBUFFER_BARRIER_BIT);
+    }
+
     void MemoryBarrierByRegion(GLbitfield barriers) {
+        if (!ValidateMemoryBarrierBits(__func__, barriers)) return;
         auto memoryBarrierByRegion = MG_Backend::gBackendFunctionsTable.GL.MemoryBarrierByRegion;
         if (!memoryBarrierByRegion) {
             MG_State::pGLContext->RecordError(
@@ -708,19 +946,20 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support regional memory barriers."));
             return;
         }
+        MGP_FILL(MemoryBarrierByRegion);
         memoryBarrierByRegion(barriers);
     }
 
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElementsIndirect_Backend(mode, type, indirect, drawcount, stride);
     }
 
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawArraysIndirect_Backend(mode, indirect, drawcount, stride);
     }
@@ -798,7 +1037,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         // NegativeApiErrorsTest.IndirectParameterDrawsCheckBothBuffers pins the INVALID_VALUE
         // they produce for a call made with no program bound. Same precedence decision, and
         // the same reason, as DispatchComputeIndirect above.
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         auto multiDrawElementsIndirectCount = MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirectCount;
         if (!multiDrawElementsIndirectCount) {
             MG_State::pGLContext->RecordError(
@@ -819,7 +1058,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         // See MultiDrawElementsIndirectCount, including why this one goes last.
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         auto multiDrawArraysIndirectCount = MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirectCount;
         if (!multiDrawArraysIndirectCount) {
             MG_State::pGLContext->RecordError(
@@ -834,14 +1073,17 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawRangeElementsBaseVertex(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type,
                                      const void* indices, GLint basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
+        if (!ValidateDrawElementsIndexType(__func__, type)) return;
+        if (!ValidateNonNegativeDrawArgument(__func__, "count", count)) return;
+        if (!ValidateDrawElementsRange(__func__, start, end)) return;
         DrawRangeElementsBaseVertex_Backend(mode, start, end, count, type, indices, basevertex);
     }
 
     void DrawRangeElements(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type, const void* indices) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawRangeElements_Backend(mode, start, end, count, type, indices);
     }
@@ -849,7 +1091,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawElementsInstancedBaseVertexBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                                      GLsizei instancecount, GLint basevertex, GLuint baseinstance) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseVertexBaseInstance_Backend(mode, count, type, indices, instancecount, basevertex,
                                                             baseinstance);
@@ -858,29 +1100,32 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawElementsInstancedBaseVertex(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                          GLsizei instancecount, GLint basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
+        if (!ValidateDrawElementsIndexType(__func__, type)) return;
+        if (!ValidateNonNegativeDrawArgument(__func__, "count", count)) return;
+        if (!ValidateNonNegativeDrawArgument(__func__, "instancecount", instancecount)) return;
         DrawElementsInstancedBaseVertex_Backend(mode, count, type, indices, instancecount, basevertex);
     }
 
     void DrawElementsInstancedBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                            GLsizei instancecount, GLuint baseinstance) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseInstance_Backend(mode, count, type, indices, instancecount, baseinstance);
     }
 
     void DrawElementsInstanced(GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstanced_Backend(mode, count, type, indices, instancecount);
     }
 
     void DrawElementsIndirect(GLenum mode, GLenum type, const void* indirect) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
         if (!ValidateIndirectDrawSource(__func__, indirect, kDrawElementsIndirectCommandBytes)) return;
@@ -890,21 +1135,21 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawArraysInstancedBaseInstance(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
                                          GLuint baseinstance) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawArraysInstancedBaseInstance_Backend(mode, first, count, instancecount, baseinstance);
     }
 
     void DrawArraysInstanced(GLenum mode, GLint first, GLsizei count, GLsizei instancecount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawArraysInstanced_Backend(mode, first, count, instancecount);
     }
 
     void DrawArraysIndirect(GLenum mode, const void* indirect) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateIndirectDrawSource(__func__, indirect, kDrawArraysIndirectCommandBytes)) return;
         DrawArraysIndirect_Backend(mode, indirect);
@@ -912,15 +1157,17 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElementsBaseVertex(GLenum mode, GLsizei count, GLenum type, const void* indices, GLint basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
+        if (!ValidateDrawElementsIndexType(__func__, type)) return;
+        if (!ValidateNonNegativeDrawArgument(__func__, "count", count)) return;
         AccountTransformFeedbackPrimitives(mode, count);
         DrawElementsBaseVertex_Backend(mode, count, type, indices, basevertex);
     }
 
     void DrawArrays(GLenum mode, GLint first, GLsizei count) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);
         DrawArrays_Backend(mode, first, count);
@@ -928,7 +1175,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void MultiDrawArrays(GLenum mode, const GLint* first, const GLsizei* count, GLsizei drawcount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (drawcount < 0) {
             MG_State::pGLContext->RecordError(
@@ -942,7 +1189,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void MultiDrawElements(GLenum mode, const GLsizei* count, GLenum type, const void* const* indices,
                            GLsizei drawcount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElements_Backend(mode, count, type, indices, drawcount);
     }
@@ -950,8 +1197,21 @@ namespace MobileGL::MG_Impl::GLImpl {
     void MultiDrawElementsBaseVertex(GLenum mode, const GLsizei* count, GLenum type, const void* const* indices,
                                      GLsizei drawcount, const GLint* basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
+        if (!ValidateDrawElementsIndexType(__func__, type)) return;
+        if (!ValidateNonNegativeDrawArgument(__func__, "drawcount", drawcount)) return;
+        // GL 4.6 core 10.5 defines MultiDrawElementsBaseVertex as drawcount separate
+        // DrawElementsBaseVertex calls, so each element of the count array carries the same
+        // non-negative requirement the single-draw entry point applies to its own count. The
+        // whole call is rejected before any sub-draw is issued, which is what makes the error
+        // observable at all - a driver that drew the valid prefix first would leave the
+        // framebuffer half-written.
+        if (count != nullptr) {
+            for (GLsizei draw = 0; draw < drawcount; ++draw) {
+                if (!ValidateNonNegativeDrawArgument(__func__, "every element of count", count[draw])) return;
+            }
+        }
         MultiDrawElementsBaseVertex_Backend(mode, count, type, indices, drawcount, basevertex);
     }
 
@@ -961,7 +1221,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElements(GLenum mode, GLsizei count, GLenum type, const void* indices) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);
         DrawElements_Backend(mode, count, type, indices);
@@ -1009,6 +1269,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->BeginTransformFeedback(primitiveMode, program);
         if (const auto beginXfb = MG_Backend::gBackendFunctionsTable.GL.BeginTransformFeedback) {
+            MGP_FILL(BeginTransformFeedback);
             beginXfb(primitiveMode);
         }
     }
@@ -1091,6 +1352,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         // Closed while the capture state is still active: a backend that captures
         // through its own driver reads the capture program and buffer bindings here.
         if (const auto endXfb = MG_Backend::gBackendFunctionsTable.GL.EndTransformFeedback) {
+            MGP_FILL(EndTransformFeedback);
             endXfb();
         }
         MG_State::pGLContext->EndTransformFeedback();
@@ -1099,9 +1361,12 @@ namespace MobileGL::MG_Impl::GLImpl {
         // the GPU work is all that is required.
         auto& backendGL = MG_Backend::gBackendFunctionsTable.GL;
         if (backendGL.FenceSync && backendGL.ClientWaitSync) {
+            MGP_FILL(FenceSync);
             if (auto sync = backendGL.FenceSync()) {
+                MGP_FILL(ClientWaitSync);
                 backendGL.ClientWaitSync(sync, GL_SYNC_FLUSH_COMMANDS_BIT, ~0ull);
                 if (backendGL.DeleteSync) {
+                    MGP_FILL(DeleteSync);
                     backendGL.DeleteSync(sync);
                 }
             }
@@ -1120,6 +1385,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->SetTransformFeedbackPaused(true);
         if (const auto pauseXfb = MG_Backend::gBackendFunctionsTable.GL.PauseTransformFeedback) {
+            MGP_FILL(PauseTransformFeedback);
             pauseXfb();
         }
     }
@@ -1134,6 +1400,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->SetTransformFeedbackPaused(false);
         if (const auto resumeXfb = MG_Backend::gBackendFunctionsTable.GL.ResumeTransformFeedback) {
+            MGP_FILL(ResumeTransformFeedback);
             resumeXfb();
         }
     }
@@ -1339,6 +1606,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 continue;
             }
             if (const auto deleteXfb = MG_Backend::gBackendFunctionsTable.GL.DeleteTransformFeedback) {
+                MGP_FILL(DeleteTransformFeedback);
                 deleteXfb(id);
             }
             MG_State::pGLContext->MarkTransformFeedbackObjectForDeletion(id);
@@ -1370,6 +1638,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         MG_State::pGLContext->BindTransformFeedbackObject(id);
         if (const auto bindXfb = MG_Backend::gBackendFunctionsTable.GL.BindTransformFeedback) {
+            MGP_FILL(BindTransformFeedback);
             bindXfb(id);
         }
     }
@@ -1385,7 +1654,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     // (GL 4.6 core 10.3.7).
     static void DrawTransformFeedbackImpl(const char* functionName, GLenum mode, GLuint id, GLuint stream,
                                           GLsizei instancecount) {
-        if (!ValidateCurrentProgramForExecution(functionName)) return;
+        if (!PrepareCurrentProgramForDraw(functionName)) return;
         if (!ValidatePrimitiveModeForBackend(functionName, mode)) return;
         if (instancecount < 0) {
             MG_State::pGLContext->RecordError(
@@ -1408,8 +1677,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::to_string(id) + " is not a transform feedback object name."));
             return;
         }
-        // GL_MAX_VERTEX_STREAMS is 1, so stream 0 is the only one that exists.
+        // GL 4.6 core 10.3.7 bounds `stream` by GL_MAX_VERTEX_STREAMS, which this implementation
-        if (stream != 0) {
+        // answers as 1 - so stream 0 is the only one that exists and anything else is
+        // INVALID_VALUE. Read from the getter rather than written as `stream != 0` so the two can
+        // never drift: if vertex-stream support ever lands, this bound moves with the limit.
+        GLint maxVertexStreams = 1;
+        GetIntegerv(GL_MAX_VERTEX_STREAMS, &maxVertexStreams);
+        if (stream >= static_cast<GLuint>(std::max(maxVertexStreams, 1))) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
@@ -1427,6 +1701,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        // `stream` is provably 0 here (the bound above is 1), so this is stream 0's record.
         const Uint64 vertices = MG_State::pGLContext->GetTransformFeedbackRecordedVertices(id);
         if (vertices == 0) return;
         const auto count = static_cast<GLsizei>(vertices);

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.h

@@ -32,8 +32,10 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DispatchCompute(GLuint numGroupsX, GLuint numGroupsY, GLuint numGroupsZ);
     void DispatchComputeIndirect(GLintptr indirect);
     void PatchParameteri(GLenum pname, GLint value);
+    void PatchParameterfv(GLenum pname, const GLfloat* values);
     void MemoryBarrier(GLbitfield barriers);
     void MemoryBarrierByRegion(GLbitfield barriers);
+    void TextureBarrier();
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride);
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride);
     void MultiDrawElementsIndirectCount(GLenum mode, GLenum type, const void* indirect, GLintptr drawcount,

MobileGL/MG_Impl/GLImpl/Exporting/Definitions.cpp

@@ -20,6 +20,7 @@
 #include "../Framebuffer/GL_Framebuffer.h"
 #include "../VertexArray/GL_VertexArray.h"
 #include "../Sync/GL_Sync.h"
+#include "../Debug/GL_Debug.h"
 #include <MG_State/GLState/Core.h>
 
 #define DECLARE_GL_FUNCTION_STUB_HEAD(type, name, ...) MOBILEGL_GL_API type gl##name(__VA_ARGS__) {
@@ -159,7 +160,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, ReleaseShaderCompiler) DECLARE_GL_FUNCTION_S
 DECLARE_GL_FUNCTION_HEAD(void, RenderbufferStorage, GLenum target, GLenum internalformat, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, RenderbufferStorage, target, internalformat, width, height)
 DECLARE_GL_FUNCTION_HEAD(void, SampleCoverage, GLfloat value, GLboolean invert) DECLARE_GL_FUNCTION_END_NO_RETURN(void, SampleCoverage, value, invert)
 DECLARE_GL_FUNCTION_HEAD(void, Scissor, GLint x, GLint y, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, Scissor, x, y, width, height)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, ShaderBinary, GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShaderBinary, count, shaders, binaryformat, binary, length)
+DECLARE_GL_FUNCTION_HEAD(void, ShaderBinary, GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ShaderBinary, count, shaders, binaryformat, binary, length)
 DECLARE_GL_FUNCTION_HEAD(void, ShaderSource, GLuint shader, GLsizei count, const GLchar* const* string, const GLint* length) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ShaderSource, shader, count, string, length)
 DECLARE_GL_FUNCTION_HEAD(void, StencilFunc, GLenum func, GLint ref, GLuint mask) DECLARE_GL_FUNCTION_END_NO_RETURN(void, StencilFunc, func, ref, mask)
 DECLARE_GL_FUNCTION_HEAD(void, StencilFuncSeparate, GLenum face, GLenum func, GLint ref, GLuint mask) DECLARE_GL_FUNCTION_END_NO_RETURN(void, StencilFuncSeparate, face, func, ref, mask)
@@ -378,27 +379,13 @@ DECLARE_GL_FUNCTION_HEAD(void, VertexBindingDivisor, GLuint bindingindex, GLuint
 DECLARE_GL_FUNCTION_STUB_HEAD(void, BlendBarrier) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, BlendBarrier)
 DECLARE_GL_FUNCTION_HEAD(void, CopyImageSubData, GLuint srcName, GLenum srcTarget, GLint srcLevel, GLint srcX, GLint srcY, GLint srcZ, GLuint dstName, GLenum dstTarget, GLint dstLevel, GLint dstX, GLint dstY, GLint dstZ, GLsizei srcWidth, GLsizei srcHeight, GLsizei srcDepth) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CopyImageSubData, srcName, srcTarget, srcLevel, srcX, srcY, srcZ, dstName, dstTarget, dstLevel, dstX, dstY, dstZ, srcWidth, srcHeight, srcDepth)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, DebugMessageControl, GLenum source, GLenum type, GLenum severity, GLsizei count, const GLuint* ids, GLboolean enabled) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, DebugMessageControl, source, type, severity, count, ids, enabled)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, DebugMessageInsert, GLenum source, GLenum type, GLuint id, GLenum severity, GLsizei length, const GLchar* buf) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, DebugMessageInsert, source, type, id, severity, length, buf)
+DECLARE_GL_FUNCTION_HEAD(void, DebugMessageInsert, GLenum source, GLenum type, GLuint id, GLenum severity, GLsizei length, const GLchar* buf) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DebugMessageInsert, source, type, id, severity, length, buf)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, DebugMessageCallback, GLDEBUGPROC callback, const void* userParam) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, DebugMessageCallback, callback, userParam)
 DECLARE_GL_FUNCTION_STUB_HEAD(GLuint, GetDebugMessageLog, GLuint count, GLsizei bufSize, GLenum* sources, GLenum* types, GLuint* ids, GLenum* severities, GLsizei* lengths, GLchar* messageLog) DECLARE_GL_FUNCTION_STUB_END(GLuint, GetDebugMessageLog, count, bufSize, sources, types, ids, severities, lengths, messageLog)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PushDebugGroup, GLenum source, GLuint id, GLsizei length, const GLchar* message) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PushDebugGroup, source, id, length, message)
+DECLARE_GL_FUNCTION_HEAD(void, PushDebugGroup, GLenum source, GLuint id, GLsizei length, const GLchar* message) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PushDebugGroup, source, id, length, message)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PopDebugGroup) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PopDebugGroup)
+DECLARE_GL_FUNCTION_HEAD(void, PopDebugGroup) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PopDebugGroup)
-MOBILEGL_GL_API void glObjectLabel(GLenum identifier, GLuint name, GLsizei length, const GLchar* label) {
+DECLARE_GL_FUNCTION_HEAD(void, ObjectLabel, GLenum identifier, GLuint name, GLsizei length, const GLchar* label) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ObjectLabel, identifier, name, length, label)
-    (void)identifier;
+DECLARE_GL_FUNCTION_HEAD(void, GetObjectLabel, GLenum identifier, GLuint name, GLsizei bufSize, GLsizei* length, GLchar* label) DECLARE_GL_FUNCTION_END_NO_RETURN(void, GetObjectLabel, identifier, name, bufSize, length, label)
-    (void)name;
-    (void)length;
-    (void)label;
-}
-MOBILEGL_GL_API void glGetObjectLabel(GLenum identifier, GLuint name, GLsizei bufSize, GLsizei* length, GLchar* label) {
-    (void)identifier;
-    (void)name;
-    if (length) {
-        *length = 0;
-    }
-    if (label && bufSize > 0) {
-        label[0] = '\0';
-    }
-}
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ObjectPtrLabel, const void* ptr, GLsizei length, const GLchar* label) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ObjectPtrLabel, ptr, length, label)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetObjectPtrLabel, const void* ptr, GLsizei bufSize, GLsizei* length, GLchar* label) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetObjectPtrLabel, ptr, bufSize, length, label)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetPointerv, GLenum pname, void** params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetPointerv, pname, params)
@@ -424,7 +411,7 @@ DECLARE_GL_FUNCTION_HEAD(void, ReadnPixels, GLint x, GLint y, GLsizei width, GLs
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnUniformfv, GLuint program, GLint location, GLsizei bufSize, GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnUniformfv, program, location, bufSize, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnUniformiv, GLuint program, GLint location, GLsizei bufSize, GLint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnUniformiv, program, location, bufSize, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnUniformuiv, GLuint program, GLint location, GLsizei bufSize, GLuint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnUniformuiv, program, location, bufSize, params)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, MinSampleShading, GLfloat value) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, MinSampleShading, value)
+DECLARE_GL_FUNCTION_HEAD(void, MinSampleShading, GLfloat value) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MinSampleShading, value)
 DECLARE_GL_FUNCTION_HEAD(void, PatchParameteri, GLenum pname, GLint value) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PatchParameteri, pname, value)
 DECLARE_GL_FUNCTION_HEAD(void, TexParameterIiv, GLenum target, GLenum pname, const GLint* params) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TexParameterIiv, target, pname, params)
 DECLARE_GL_FUNCTION_HEAD(void, TexParameterIuiv, GLenum target, GLenum pname, const GLuint* params) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TexParameterIuiv, target, pname, params)
@@ -936,7 +923,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetActiveSubroutineName, GLuint program, GLe
 DECLARE_GL_FUNCTION_STUB_HEAD(void, UniformSubroutinesuiv, GLenum shadertype, GLsizei count, const GLuint* indices) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, UniformSubroutinesuiv, shadertype, count, indices)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetUniformSubroutineuiv, GLenum shadertype, GLint location, GLuint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetUniformSubroutineuiv, shadertype, location, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramStageiv, GLuint program, GLenum shadertype, GLenum pname, GLint* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetProgramStageiv, program, shadertype, pname, values)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PatchParameterfv, GLenum pname, const GLfloat* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PatchParameterfv, pname, values)
+DECLARE_GL_FUNCTION_HEAD(void, PatchParameterfv, GLenum pname, const GLfloat* values) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PatchParameterfv, pname, values)
 DECLARE_GL_FUNCTION_HEAD(void, DrawTransformFeedback, GLenum mode, GLuint id) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawTransformFeedback, mode, id)
 DECLARE_GL_FUNCTION_HEAD(void, DrawTransformFeedbackStream, GLenum mode, GLuint id, GLuint stream) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawTransformFeedbackStream, mode, id, stream)
 DECLARE_GL_FUNCTION_HEAD(void, BeginQueryIndexed, GLenum target, GLuint index, GLuint id) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BeginQueryIndexed, target, index, id)
@@ -996,7 +983,7 @@ DECLARE_GL_FUNCTION_HEAD(void, MultiDrawArraysIndirect, GLenum mode, const void*
 DECLARE_GL_FUNCTION_HEAD(void, MultiDrawElementsIndirect, GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MultiDrawElementsIndirect, mode, type, indirect, drawcount, stride)
 DECLARE_GL_FUNCTION_HEAD(GLint, GetProgramResourceLocationIndex, GLuint program, GLenum programInterface, const GLchar* name) DECLARE_GL_FUNCTION_END(GLint, GetProgramResourceLocationIndex, program, programInterface, name)
 DECLARE_GL_FUNCTION_HEAD(void, ShaderStorageBlockBinding, GLuint program, GLuint storageBlockIndex, GLuint storageBlockBinding) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ShaderStorageBlockBinding, program, storageBlockIndex, storageBlockBinding)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureView, GLuint texture, GLenum target, GLuint origtexture, GLenum internalformat, GLuint minlevel, GLuint numlevels, GLuint minlayer, GLuint numlayers) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureView, texture, target, origtexture, internalformat, minlevel, numlevels, minlayer, numlayers)
+DECLARE_GL_FUNCTION_HEAD(void, TextureView, GLuint texture, GLenum target, GLuint origtexture, GLenum internalformat, GLuint minlevel, GLuint numlevels, GLuint minlayer, GLuint numlayers) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureView, texture, target, origtexture, internalformat, minlevel, numlevels, minlayer, numlayers)
 DECLARE_GL_FUNCTION_HEAD(void, VertexAttribLFormat, GLuint attribindex, GLint size, GLenum type, GLuint relativeoffset) DECLARE_GL_FUNCTION_END_NO_RETURN(void, VertexAttribLFormat, attribindex, size, type, relativeoffset)
 DECLARE_GL_FUNCTION_HEAD(void, BufferStorage, GLenum target, GLsizeiptr size, const void* data, GLbitfield flags) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BufferStorage, target, size, data, flags)
 DECLARE_GL_FUNCTION_HEAD(void, ClearTexImage, GLuint texture, GLint level, GLenum format, GLenum type, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ClearTexImage, texture, level, format, type, data)
@@ -1007,7 +994,7 @@ DECLARE_GL_FUNCTION_HEAD(void, BindTextures, GLuint first, GLsizei count, const
 DECLARE_GL_FUNCTION_HEAD(void, BindSamplers, GLuint first, GLsizei count, const GLuint* samplers) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BindSamplers, first, count, samplers)
 DECLARE_GL_FUNCTION_HEAD(void, BindImageTextures, GLuint first, GLsizei count, const GLuint* textures) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BindImageTextures, first, count, textures)
 DECLARE_GL_FUNCTION_HEAD(void, BindVertexBuffers, GLuint first, GLsizei count, const GLuint* buffers, const GLintptr* offsets, const GLsizei* strides) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BindVertexBuffers, first, count, buffers, offsets, strides)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, ClipControl, GLenum origin, GLenum depth) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ClipControl, origin, depth)
+DECLARE_GL_FUNCTION_HEAD(void, ClipControl, GLenum origin, GLenum depth) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ClipControl, origin, depth)
 DECLARE_GL_FUNCTION_HEAD(void, CreateTransformFeedbacks, GLsizei n, GLuint* ids) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CreateTransformFeedbacks, n, ids)
 DECLARE_GL_FUNCTION_HEAD(void, TransformFeedbackBufferBase, GLuint xfb, GLuint index, GLuint buffer) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TransformFeedbackBufferBase, xfb, index, buffer)
 DECLARE_GL_FUNCTION_HEAD(void, TransformFeedbackBufferRange, GLuint xfb, GLuint index, GLuint buffer, GLintptr offset, GLsizeiptr size) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TransformFeedbackBufferRange, xfb, index, buffer, offset, size)
@@ -1060,9 +1047,9 @@ DECLARE_GL_FUNCTION_HEAD(void, TextureStorage3DMultisample, GLuint texture, GLsi
 DECLARE_GL_FUNCTION_HEAD(void, TextureSubImage1D, GLuint texture, GLint level, GLint xoffset, GLsizei width, GLenum format, GLenum type, const void* pixels) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureSubImage1D, texture, level, xoffset, width, format, type, pixels)
 DECLARE_GL_FUNCTION_HEAD(void, TextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, const void* pixels) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, type, pixels)
 DECLARE_GL_FUNCTION_HEAD(void, TextureSubImage3D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, const void* pixels) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureSubImage3D, texture, level, xoffset, yoffset, zoffset, width, height, depth, format, type, pixels)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage1D, GLuint texture, GLint level, GLint xoffset, GLsizei width, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage1D, texture, level, xoffset, width, format, imageSize, data)
+DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage1D, GLuint texture, GLint level, GLint xoffset, GLsizei width, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage1D, texture, level, xoffset, width, format, imageSize, data)
 DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, imageSize, data)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage3D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage3D, texture, level, xoffset, yoffset, zoffset, width, height, depth, format, imageSize, data)
+DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage3D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage3D, texture, level, xoffset, yoffset, zoffset, width, height, depth, format, imageSize, data)
 DECLARE_GL_FUNCTION_HEAD(void, CopyTextureSubImage1D, GLuint texture, GLint level, GLint xoffset, GLint x, GLint y, GLsizei width) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CopyTextureSubImage1D, texture, level, xoffset, x, y, width)
 DECLARE_GL_FUNCTION_HEAD(void, CopyTextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CopyTextureSubImage2D, texture, level, xoffset, yoffset, x, y, width, height)
 DECLARE_GL_FUNCTION_HEAD(void, CopyTextureSubImage3D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLint x, GLint y, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CopyTextureSubImage3D, texture, level, xoffset, yoffset, zoffset, x, y, width, height)
@@ -1120,11 +1107,11 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnConvolutionFilter, GLenum target, GLenum
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnSeparableFilter, GLenum target, GLenum format, GLenum type, GLsizei rowBufSize, void* row, GLsizei columnBufSize, void* column, void* span) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnSeparableFilter, target, format, type, rowBufSize, row, columnBufSize, column, span)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnHistogram, GLenum target, GLboolean reset, GLenum format, GLenum type, GLsizei bufSize, void* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnHistogram, target, reset, format, type, bufSize, values)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnMinmax, GLenum target, GLboolean reset, GLenum format, GLenum type, GLsizei bufSize, void* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnMinmax, target, reset, format, type, bufSize, values)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureBarrier, void) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureBarrier, )
+DECLARE_GL_FUNCTION_HEAD(void, TextureBarrier, void) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureBarrier, )
-DECLARE_GL_FUNCTION_STUB_HEAD(void, SpecializeShader, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, SpecializeShader, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
+DECLARE_GL_FUNCTION_HEAD(void, SpecializeShader, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_END_NO_RETURN(void, SpecializeShader, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
 DECLARE_GL_FUNCTION_HEAD(void, MultiDrawArraysIndirectCount, GLenum mode, const void* indirect, GLintptr drawcount, GLsizei maxdrawcount, GLsizei stride) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MultiDrawArraysIndirectCount, mode, indirect, drawcount, maxdrawcount, stride)
 DECLARE_GL_FUNCTION_HEAD(void, MultiDrawElementsIndirectCount, GLenum mode, GLenum type, const void* indirect, GLintptr drawcount, GLsizei maxdrawcount, GLsizei stride) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MultiDrawElementsIndirectCount, mode, type, indirect, drawcount, maxdrawcount, stride)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PolygonOffsetClamp, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PolygonOffsetClamp, factor, units, clamp)
+DECLARE_GL_FUNCTION_HEAD(void, PolygonOffsetClamp, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PolygonOffsetClamp, factor, units, clamp)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PrimitiveBoundingBoxARB, GLfloat minX, GLfloat minY, GLfloat minZ, GLfloat minW, GLfloat maxX, GLfloat maxY, GLfloat maxZ, GLfloat maxW) DECLARE_GL_FUNCTION_STUB_END(void, PrimitiveBoundingBoxARB, minX, minY, minZ, minW, maxX, maxY, maxZ, maxW)
 DECLARE_GL_FUNCTION_STUB_HEAD(GLuint64, GetTextureHandleARB, GLuint texture) DECLARE_GL_FUNCTION_STUB_END(GLuint64, GetTextureHandleARB, texture)
 DECLARE_GL_FUNCTION_STUB_HEAD(GLuint64, GetTextureSamplerHandleARB, GLuint texture, GLuint sampler) DECLARE_GL_FUNCTION_STUB_END(GLuint64, GetTextureSamplerHandleARB, texture, sampler)
@@ -1163,7 +1150,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramLocalParameterdvARB, GLenum target
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramLocalParameterfvARB, GLenum target, GLuint index, GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetProgramLocalParameterfvARB, target, index, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramStringARB, GLenum target, GLenum pname, void* string) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetProgramStringARB, target, pname, string)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, FramebufferTextureFaceARB, GLenum target, GLenum attachment, GLuint texture, GLint level, GLenum face) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, FramebufferTextureFaceARB, target, attachment, texture, level, face)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, SpecializeShaderARB, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, SpecializeShaderARB, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
+DECLARE_GL_FUNCTION_HEAD(void, SpecializeShaderARB, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_END_NO_RETURN(void, SpecializeShader, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, Uniform1i64ARB, GLint location, GLint64 x) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, Uniform1i64ARB, location, x)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, Uniform2i64ARB, GLint location, GLint64 x, GLint64 y) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, Uniform2i64ARB, location, x, y)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, Uniform3i64ARB, GLint location, GLint64 x, GLint64 y, GLint64 z) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, Uniform3i64ARB, location, x, y, z)
@@ -1848,9 +1835,9 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetBooleanIndexedvEXT, GLenum target, GLuint
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureImage3DEXT, GLuint texture, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureImage3DEXT, texture, target, level, internalformat, width, height, depth, border, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureImage2DEXT, GLuint texture, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureImage2DEXT, texture, target, level, internalformat, width, height, border, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureImage1DEXT, GLuint texture, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureImage1DEXT, texture, target, level, internalformat, width, border, imageSize, bits)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage3DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage3DEXT, texture, target, level, xoffset, yoffset, zoffset, width, height, depth, format, imageSize, bits)
+DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage3DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage3D, texture, level, xoffset, yoffset, zoffset, width, height, depth, format, imageSize, bits)
 DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage2DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, imageSize, bits)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage1DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLsizei width, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage1DEXT, texture, target, level, xoffset, width, format, imageSize, bits)
+DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage1DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLsizei width, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage1D, texture, level, xoffset, width, format, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetCompressedTextureImageEXT, GLuint texture, GLenum target, GLint lod, void* img) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetCompressedTextureImageEXT, texture, target, lod, img)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedMultiTexImage3DEXT, GLenum texunit, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedMultiTexImage3DEXT, texunit, target, level, internalformat, width, height, depth, border, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedMultiTexImage2DEXT, GLenum texunit, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedMultiTexImage2DEXT, texunit, target, level, internalformat, width, height, border, imageSize, bits)
@@ -2062,7 +2049,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetPixelTransformParameterivEXT, GLenum targ
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetPixelTransformParameterfvEXT, GLenum target, GLenum pname, GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetPixelTransformParameterfvEXT, target, pname, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PointParameterfEXT, GLenum pname, GLfloat param) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PointParameterfEXT, pname, param)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PointParameterfvEXT, GLenum pname, const GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PointParameterfvEXT, pname, params)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PolygonOffsetClampEXT, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PolygonOffsetClampEXT, factor, units, clamp)
+DECLARE_GL_FUNCTION_HEAD(void, PolygonOffsetClampEXT, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PolygonOffsetClamp, factor, units, clamp)
 DECLARE_GL_FUNCTION_HEAD(void, ProvokingVertexEXT, GLenum mode) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ProvokingVertex, mode)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, RasterSamplesEXT, GLuint samples, GLboolean fixedsamplelocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, RasterSamplesEXT, samples, fixedsamplelocations)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, SecondaryColor3bEXT, GLbyte red, GLbyte green, GLbyte blue) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, SecondaryColor3bEXT, red, green, blue)
@@ -2559,7 +2546,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateImageBarrierNV, GLboolean synchro
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateImagePaletteNV, GLuint viewport, GLuint first, GLsizei count, const GLenum* rates) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShadingRateImagePaletteNV, viewport, first, count, rates)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateSampleOrderNV, GLenum order) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShadingRateSampleOrderNV, order)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateSampleOrderCustomNV, GLenum rate, GLuint samples, const GLint* locations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShadingRateSampleOrderCustomNV, rate, samples, locations)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureBarrierNV, void) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureBarrierNV, )
+DECLARE_GL_FUNCTION_HEAD(void, TextureBarrierNV, void) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureBarrier, )
 DECLARE_GL_FUNCTION_STUB_HEAD(void, TexImage2DMultisampleCoverageNV, GLenum target, GLsizei coverageSamples, GLsizei colorSamples, GLint internalFormat, GLsizei width, GLsizei height, GLboolean fixedSampleLocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TexImage2DMultisampleCoverageNV, target, coverageSamples, colorSamples, internalFormat, width, height, fixedSampleLocations)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, TexImage3DMultisampleCoverageNV, GLenum target, GLsizei coverageSamples, GLsizei colorSamples, GLint internalFormat, GLsizei width, GLsizei height, GLsizei depth, GLboolean fixedSampleLocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TexImage3DMultisampleCoverageNV, target, coverageSamples, colorSamples, internalFormat, width, height, depth, fixedSampleLocations)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureImage2DMultisampleNV, GLuint texture, GLenum target, GLsizei samples, GLint internalFormat, GLsizei width, GLsizei height, GLboolean fixedSampleLocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureImage2DMultisampleNV, texture, target, samples, internalFormat, width, height, fixedSampleLocations)

MobileGL/MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.cpp

@@ -15,6 +15,15 @@
 #include <MG_Impl/GLImpl/Texture/Validators.h>
 #include <MG_Impl/GLImpl/Getter/GL_Getter.h>
 #include <MG_State/GLState/ErrorState/Error.h>
+#include <MG_Impl/Pipe/PipeFill.h>
+#if MOBILEGL_PIPE_PUSH
+// P4a, ID-19(c). This file is the ONLY place every DSA framebuffer entry point lives, and the
+// emitter it reaches is this package's own header rather than a declaration in one of the
+// contract's: MG_Pipe/PipeMutation.h is the door MG_State has into the client and carries no
+// framebuffer row, and MG_Impl/GLImpl and MG_Impl/Pipe are the same layer (this file already
+// includes MG_Impl/Pipe/PipeFill.h for MGP_FILL).
+#include <MG_Impl/Pipe/FramebufferEmit.h>
+#endif
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToMG/TextureEnumConverter.h>
@@ -474,6 +483,75 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
         }
 
+        // GL 4.6 core 9.2.8 conditions that depend only on the framebuffer and the attachment
+        // point. Shared, because glFramebufferTexture / 1D / 2D / 3D / TextureLayer are aliases of
+        // one another in that section and a CTS case that walks the family must not get five
+        // different answers - which is exactly what happened when these lived in one helper that
+        // only two of the five went through.
+        Bool ValidateFramebufferTextureAttachmentPoint(const char* functionName,
+                                                       const SharedPtr<MG_State::GLState::FramebufferObject>&
+                                                           framebufferObject,
+                                                       FramebufferAttachmentType attachmentType) {
+            // "An INVALID_OPERATION error is generated if COLOR_ATTACHMENTm is used with m greater
+            // than or equal to MAX_COLOR_ATTACHMENTS."
+            if (!FramebufferImpl::ValidateColorAttachmentInRange(attachmentType, functionName)) return false;
+            // "An INVALID_OPERATION error is generated if zero is bound to target." MobileGL keeps
+            // a real FramebufferObject for framebuffer 0, so a null test can never see this - the
+            // object is always there, and framebuffer 0 has to be recognised by identity instead,
+            // the same comparison DrawBuffers_State makes. Without this an attach onto the default
+            // framebuffer silently REPLACED its colour attachment, permanently desynchronising it
+            // from what the swapchain keeps publishing.
+            const auto& defaultFramebufferInfo = FramebufferImpl::pDefaultFramebufferInfo;
+            if (!framebufferObject ||
+                (defaultFramebufferInfo && framebufferObject == defaultFramebufferInfo->defaultFBO)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", functionName,
+                        "No framebuffer object is bound to the target; the default framebuffer's attachments "
+                        "cannot be named."));
+                return false;
+            }
+            return true;
+        }
+
+        // The other half of 9.2.8: "level must be greater than or equal to zero", and for a
+        // texture with immutable storage it "must be smaller than the number of levels the texture
+        // has". Split from the attachment-point half because the caller only has a texture object
+        // once the detach (texture == 0) case is behind it.
+        Bool ValidateFramebufferTextureLevel(const char* functionName,
+                                             const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
+                                             GLint level) {
+            if (level < 0) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                                 "Texture level must be non-negative."));
+                return false;
+            }
+            if (!textureObject || !textureObject->IsImmutable()) {
+                // A mutable texture has no level bound here: a level it has not specified yet is
+                // not an error, it just leaves the framebuffer incomplete.
+                return true;
+            }
+            // GetAddressableLevelCount(), NOT GetImmutableLevels(): for a VIEW the latter is
+            // deliberately the ORIGINAL texture's count (GL 4.6 core 8.18 defines
+            // TEXTURE_IMMUTABLE_LEVELS on a view that way), which is far too large a bound - a
+            // two-level view onto a ten-level texture would accept level 5 and attach an image
+            // nothing can draw into.
+            const Uint levelBound = textureObject->GetAddressableLevelCount();
+            if (static_cast<Uint>(level) >= levelBound) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", functionName,
+                        std::format("Texture level {} is beyond the {} level(s) this texture has.", level,
+                                    levelBound)));
+                return false;
+            }
+            return true;
+        }
+
         void AttachFramebufferTextureWithUploadTarget(const char* functionName, GLenum target, GLenum attachment,
                                                       GLuint texture, GLint level,
                                                       TextureUploadTarget textureUploadTarget, Bool layered = false) {
@@ -482,10 +560,24 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
 
             if (attachment == GL_DEPTH_STENCIL_ATTACHMENT) {
+                // `layered` has to travel with the split. GL_DEPTH_STENCIL_ATTACHMENT is only a
+                // shorthand for attaching the same image to both halves (GL 4.6 core 9.2.6), so
+                // whether glFramebufferTexture made it LAYERED is a property of the call, not of
+                // which half is being recorded - and dropping it here (the parameter defaults to
+                // false) recorded a non-layered depth/stencil attachment beside a layered colour
+                // one for every layered target. That is an inconsistent framebuffer by 9.4.1's
+                // own rule, and downstream it means the depth/stencil attachment covers layer 0
+                // alone: DirectVulkan built its view with layerCount 1 under a framebuffer
+                // declaring N layers (VUID-VkFramebufferCreateInfo-flags-04535), and DirectGLES
+                // attached one layer of it beside a layered colour target, which the driver
+                // answers with GL_FRAMEBUFFER_INCOMPLETE_LAYER_TARGETS - every draw silently
+                // produced nothing. This is the shape
+                // texture_cube_map_array.stencil_attachments_*_layered and
+                // geometry_shader.layered_framebuffer.stencil_support are built on.
                 AttachFramebufferTextureWithUploadTarget(functionName, target, GL_DEPTH_ATTACHMENT, texture, level,
-                                                        textureUploadTarget);
+                                                        textureUploadTarget, layered);
                 AttachFramebufferTextureWithUploadTarget(functionName, target, GL_STENCIL_ATTACHMENT, texture, level,
-                                                        textureUploadTarget);
+                                                        textureUploadTarget, layered);
                 return;
             }
 
@@ -497,13 +589,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
             auto& bindingSlot = MG_State::pGLContext->GetFramebufferBindingSlot(framebufferTarget);
             auto& framebufferObject = bindingSlot.GetBoundObject();
-            if (!framebufferObject) {
+            if (!ValidateFramebufferTextureAttachmentPoint(functionName, framebufferObject, attachmentType)) return;
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
-                                                 "Framebuffer target is bound to no framebuffer object."));
-                return;
-            }
 
             if (texture == 0) {
                 framebufferObject->Detach(attachmentType);
@@ -518,6 +604,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                                  std::format("Texture object {} is not valid.", texture)));
                 return;
             }
+            if (!ValidateFramebufferTextureLevel(functionName, textureObject, level)) return;
 
             const auto expectedTextureTarget = MG_Util::ConvertTextureUploadTargetToTextureTarget(textureUploadTarget);
             if (expectedTextureTarget == TextureTarget::Unknown ||
@@ -534,10 +621,40 @@ namespace MobileGL::MG_Impl::GLImpl {
 
             framebufferObject->AttachTexture(attachmentType, textureObject, textureUploadTarget, level, 0, layered);
         }
+#if MOBILEGL_PIPE_PUSH
+        // P4a, ID-19(c): ANY FRAMEBUFFER THE SERVER IS ABOUT TO RECEIVE BY NAME HAS A RECORD.
+        //
+        // The applier keeps framebuffer records PER OBJECT, keyed by the handle - but before
+        // ID-19 it held only the two BOUND-target records, and the emitter only ever built them
+        // at the validate point out of the two bindings. So glClearNamedFramebufferfv(fbo) or
+        // glBlitNamedFramebuffer(..., fbo, ...) on an fbo bound to NEITHER binding reached a
+        // backend that minted a fresh driver framebuffer with no attachments, found no record
+        // for it, declined, and issued the clear against it anyway: GL_INVALID_FRAMEBUFFER_-
+        // OPERATION and nothing cleared, where the legacy arm cleared correctly.
+        //
+        // TWO CLASSES OF SITE call this, and both are "the point at which the object is final
+        // for this call": the five CONSUMERS (blit and the four clears) publish immediately
+        // before MGP_FILL, so the record precedes the verb that hands the object over and a
+        // later bound-target record for the same object still wins; the ten MUTATORS (the DSA
+        // attachment, draw-buffer and read-buffer setters) publish immediately after the
+        // frontend mutation, because they have no validate point at all - FillPoints.def has no
+        // verb for any of them, so there is no MGP_FILL to sit in front of.
+        //
+        // A CALL THAT MOVED NOTHING IS FREE: the record's ContentHash is the emitter's own
+        // suppressor and it is keyed per framebuffer object, so a redundant publish emits zero
+        // bytes. EmitFramebufferByName picks Draw/Read/Both over Named when the object IS
+        // bound, so a Named record can never overwrite a bound record's Target underneath the
+        // binding that resolves through it.
+        void PipePublishFramebufferByName(const SharedPtr<MG_State::GLState::FramebufferObject>& fbo) {
+            if (!fbo) return;
+            MG_Pipe::MGPipeFramebufferEmitterInstance().EmitFramebufferByName(*fbo);
+        }
+#endif
     } // namespace
 
     void BlitFramebuffer_Backend(GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1, GLint dstX0, GLint dstY0,
                                  GLint dstX1, GLint dstY1, GLbitfield mask, GLenum filter) {
+        MGP_FILL(BlitFramebuffer);
         MG_Backend::gBackendFunctionsTable.GL.BlitFramebuffer(srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1, dstY1,
                                                               mask, filter);
     }
@@ -551,6 +668,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glBlitNamedFramebuffer skipped: backend does not implement explicit framebuffer blit.");
             return;
         }
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(readFramebuffer);
+        PipePublishFramebufferByName(drawFramebuffer);
+#endif
+        MGP_FILL(BlitNamedFramebuffer);
         blitNamedFramebuffer(readFramebuffer, drawFramebuffer, srcX0, srcY0, srcX1, srcY1, dstX0, dstY0, dstX1,
                              dstY1, mask, filter);
     }
@@ -562,6 +684,10 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferfv skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebuffer);
+#endif
+        MGP_FILL(ClearNamedFramebufferfv);
         clearNamedFramebufferfv(framebuffer, buffer, drawbuffer, value);
     }
 
@@ -572,6 +698,10 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferfi skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebuffer);
+#endif
+        MGP_FILL(ClearNamedFramebufferfi);
         clearNamedFramebufferfi(framebuffer, buffer, drawbuffer, depth, stencil);
     }
 
@@ -582,6 +712,10 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferiv skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebuffer);
+#endif
+        MGP_FILL(ClearNamedFramebufferiv);
         clearNamedFramebufferiv(framebuffer, buffer, drawbuffer, value);
     }
 
@@ -592,6 +726,10 @@ namespace MobileGL::MG_Impl::GLImpl {
             MGLOG_E_ONCE("glClearNamedFramebufferuiv skipped: backend does not implement explicit framebuffer clear.");
             return;
         }
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebuffer);
+#endif
+        MGP_FILL(ClearNamedFramebufferuiv);
         clearNamedFramebufferuiv(framebuffer, buffer, drawbuffer, value);
     }
 
@@ -624,16 +762,33 @@ namespace MobileGL::MG_Impl::GLImpl {
     // GL_MAX_SAMPLES is the ceiling over all formats; an integer format has its own
     // (GL_MAX_INTEGER_SAMPLES) and GL 4.6 core 9.2.4 makes exceeding it INVALID_OPERATION.
     // The multisample TEXTURE path resolves the limit per format the same way
-    // (GL_Texture.cpp, GetMaxSupportedTextureSamples). Both are floored to the value MobileGL
+    // (GL_Texture.cpp, GetMaxSupportedTextureSamples), and both now enforce exactly what their
-    // advertises: on a driver where the two differ - Adreno reports GL_MAX_SAMPLES 4 and
+    // pname advertises. The integer ceiling used to be floored at GL_MAX_SAMPLES so that the
-    // GL_MAX_INTEGER_SAMPLES 1 - rejecting the advertised count here only moves the failure
+    // frontend would accept a count it had advertised globally - but on Adreno and Mali the
-    // from the driver into MobileGL, so the frontend accepts it and the backend clamps the
+    // integer path is genuinely one sample, and accepting four only moved the failure from an
-    // count it actually hands the driver.
+    // honest INVALID_OPERATION here to a silently under-allocated renderbuffer.
+    // The head of the per-format renderbuffer sample list the backend probed, or 0 when nothing
+    // was probed for it. Same shape as GetProbedMaxTextureSamples in GL_Texture.cpp, and reads
+    // the same cache glGetInternalformativ(GL_RENDERBUFFER, ..., GL_SAMPLES) answers from.
+    static Int GetProbedMaxRenderbufferSamples(TextureInternalFormat format) {
+        if (MG_Backend::pActiveBackendObject == nullptr) {
+            return 0;
+        }
+        const SizeT targetIndex = MG_Backend::GetRenderbufferFormatCapabilityTargetIndex();
+        const SizeT formatIndex = static_cast<SizeT>(format);
+        if (targetIndex >= MG_Backend::kFormatCapabilityTargetCount ||
+            formatIndex >= MG_Backend::kFormatCapabilityFormatCount) {
+            return 0;
+        }
+        const auto& sampleCounts =
+            MG_Backend::pActiveBackendObject->GetFormatCapabilities().SampleCounts[targetIndex][formatIndex];
+        return sampleCounts.empty() ? 0 : sampleCounts.front();
+    }
+
     Int GetMaxRenderbufferSamplesForFormat_State(TextureInternalFormat format) {
         if (MG_Backend::pActiveBackendObject == nullptr) {
             return std::numeric_limits<Int>::max();
         }
-        const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
 
         GLenum normalizedInternalFormat = MG_Util::ConvertTextureInternalFormatToGLEnum(format);
         GLenum normalizedFormat = GL_RGBA;
@@ -644,13 +799,24 @@ namespace MobileGL::MG_Impl::GLImpl {
                                                               &normalizedType);
         const Bool isIntegerFormat = normalizedFormat == GL_RED_INTEGER || normalizedFormat == GL_RG_INTEGER ||
                                      normalizedFormat == GL_RGB_INTEGER || normalizedFormat == GL_RGBA_INTEGER;
+        // The per-format probe first, for the same reason the texture path takes it first: GL 4.6
+        // core 9.2.4 words the error as "samples is greater than the maximum number of samples
+        // supported for internalformat (see GetInternalformativ)", and
+        // glGetInternalformativ(GL_RENDERBUFFER, ..., GL_SAMPLES) is answered from exactly this
+        // list. It was never consulted here - the TODO that deferred it was written before the
+        // query was backed and had gone stale - so a format whose multisample probes fail inside
+        // a category that allows four was accepted at four, quietly allocated at one by
+        // ClampSamplesToBackendSupport, and then reported as four by
+        // glGetRenderbufferParameteriv(GL_RENDERBUFFER_SAMPLES).
+        const Int probedMaxSamples = GetProbedMaxRenderbufferSamples(format);
+        if (probedMaxSamples > 0) {
+            return probedMaxSamples;
+        }
         if (!isIntegerFormat) {
             return GetMaxRenderbufferSamples_State();
         }
-        // Per-format still, but never below the ceiling glGetIntegerv(GL_MAX_SAMPLES) promised:
+        // Exactly what glGetIntegerv(GL_MAX_INTEGER_SAMPLES) reports.
-        // the driver's raw GL_MAX_INTEGER_SAMPLES stays the *backend* limit and the backend
+        return GetAdvertisedIntegerMaxSamples();
-        // clamps to it, while the frontend honours what it advertised.
-        return std::max(dynamicParameters.MaxIntegerSamples, GetAdvertisedMaxSamples());
     }
 
     Bool ValidateRenderbufferStorageSize_State(GLsizei width, GLsizei height, const char* caller) {
@@ -682,8 +848,10 @@ namespace MobileGL::MG_Impl::GLImpl {
             return false;
         }
 
-        // TODO: Resolve the remaining per-internalformat renderbuffer sample limits once
+        // Per-internalformat, from the probe list glGetInternalformativ answers with, falling back
-        // glGetInternalformativ is backed; integer formats are handled below.
+        // to the format's category pname where nothing was probed. (This carried a TODO deferring
+        // the per-format resolution "once glGetInternalformativ is backed"; it has been backed for
+        // both renderbuffers and multisample textures since, so the deferral was collected.)
         const Int maxSamples = GetMaxRenderbufferSamplesForFormat_State(format);
         if (samples > maxSamples) {
             // GL 4.6 core 9.2.4 makes asking for more samples than the format supports
@@ -1048,13 +1216,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         auto& bindingSlot = MG_State::pGLContext->GetFramebufferBindingSlot(framebufferTarget);
         auto& framebufferObject = bindingSlot.GetBoundObject();
-        if (!framebufferObject) {
+        if (!ValidateFramebufferTextureAttachmentPoint(functionName, framebufferObject, attachmentType)) return;
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidOperation,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
-                                             "Framebuffer target is bound to no framebuffer object."));
-            return;
-        }
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
@@ -1069,6 +1231,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::format("Texture object {} is not valid.", texture)));
             return;
         }
+        if (!ValidateFramebufferTextureLevel(functionName, textureObject, level)) return;
         if (layer < 0) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
@@ -1191,6 +1354,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Framebuffer target is bound to no framebuffer object."));
             return;
         }
+        // glFramebufferTexture2D is by far the most-used member of the family and the only one
+        // that inlines its own logic instead of going through the shared helper, so the 9.2.8
+        // conditions have to be asked here explicitly.
+        if (!ValidateFramebufferTextureAttachmentPoint("FramebufferTexture2D_State", framebufferObject,
+                                                       attachmentType)) {
+            return;
+        }
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
@@ -1205,6 +1375,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::format("Texture object {} is not valid.", texture)));
             return;
         }
+        if (!ValidateFramebufferTextureLevel("FramebufferTexture2D_State", textureObject, level)) return;
 
         const auto expectedTextureTarget = MG_Util::ConvertTextureUploadTargetToTextureTarget(textureUploadTarget);
         if (expectedTextureTarget == TextureTarget::Unknown ||
@@ -1241,6 +1412,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        // The name's validity is an INVALID_VALUE condition (GL 4.6 core 9.2.8), and it has to be
+        // asked BEFORE the object is resolved: reporting the miss as the INVALID_OPERATION below
+        // pre-empted the shared helper's ValidateTextureName and answered the wrong error code for
+        // every texture name that was never generated.
+        if (!TextureImpl::ValidateTextureName(texture, true)) return;
+
         auto& textureObject = MG_State::pGLContext->GetTextureObject(texture);
         if (!textureObject) {
             MG_State::pGLContext->RecordError(
@@ -1280,6 +1457,9 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
             return;
         }
 
@@ -1291,13 +1471,10 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::format("Texture object {} is not valid.", texture)));
             return;
         }
-        if (level < 0) {
+        // The whole level condition, not just its negative half: glNamedFramebufferTexture and
-            MG_State::pGLContext->RecordError(
+        // glFramebufferTexture are equivalent in 9.2.8, so an out-of-range immutable level has to
-                ErrorCode::InvalidValue,
+        // be rejected on both or a CTS case gets two answers for one rule.
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "NamedFramebufferTexture_State",
+        if (!ValidateFramebufferTextureLevel("NamedFramebufferTexture_State", textureObject, level)) return;
-                                             "Texture level must be non-negative."));
-            return;
-        }
 
         TextureUploadTarget textureUploadTarget = TextureUploadTarget::Unknown;
         Bool layered = false;
@@ -1309,6 +1486,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
 
         framebufferObject->AttachTexture(attachmentType, textureObject, textureUploadTarget, level, 0, layered);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     void NamedFramebufferTextureWithUploadTarget_State(const char* functionName, GLuint framebuffer, GLenum attachment,
@@ -1332,6 +1512,9 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
             return;
         }
 
@@ -1359,6 +1542,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
 
         framebufferObject->AttachTexture(attachmentType, textureObject, textureUploadTarget, level);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     void NamedFramebufferTexture1D_State(GLuint framebuffer, GLenum attachment, GLenum textarget, GLuint texture,
@@ -1413,6 +1599,9 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
             return;
         }
 
@@ -1515,6 +1704,9 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         framebufferObject->AttachTexture(attachmentType, textureObject, textureUploadTarget, level, layer,
                                          /*layered=*/false);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     void FramebufferRenderbuffer_State(GLenum target, GLenum attachment, GLenum renderbuffertarget,
@@ -1584,6 +1776,9 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         if (renderbuffer == 0) {
             framebufferObject->Detach(attachmentType);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
             return;
         }
 
@@ -1593,6 +1788,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!renderbufferObject) return;
 
         framebufferObject->AttachRenderbuffer(attachmentType, renderbufferObject);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     void DrawBuffersForFramebuffer_State(const SharedPtr<MG_State::GLState::FramebufferObject>& fbo, Bool isDefaultFBO,
@@ -1792,6 +1990,9 @@ namespace MobileGL::MG_Impl::GLImpl {
             : GetNamedFramebufferObject_State(framebuffer, "NamedFramebufferDrawBuffers_State");
         if (!framebufferObject) return;
         DrawBuffersForFramebuffer_State(framebufferObject, framebuffer == 0, n, bufs, false);
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     void NamedFramebufferDrawBuffer_State(GLuint framebuffer, GLenum buf) {
@@ -1806,6 +2007,9 @@ namespace MobileGL::MG_Impl::GLImpl {
             const GLenum bufs[] = {buf};
             DrawBuffersForFramebuffer_State(framebufferObject, framebuffer == 0, 1, bufs, true);
         }
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     void NamedFramebufferReadBuffer_State(GLuint framebuffer, GLenum src) {
@@ -1815,6 +2019,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!framebufferObject) return;
         ReadBufferForFramebuffer_State(framebufferObject, framebuffer == 0, src,
                                        "NamedFramebufferReadBuffer_State");
+#if MOBILEGL_PIPE_PUSH
+        PipePublishFramebufferByName(framebufferObject);
+#endif
     }
 
     SharedPtr<MG_State::GLState::FramebufferObject> GetFramebufferObjectForNamedClear(GLuint framebuffer,
@@ -2615,24 +2822,28 @@ namespace MobileGL::MG_Impl::GLImpl {
     void ClearBufferfi_Backend(GLenum buffer, GLint drawbuffer, GLfloat depth, GLint stencil) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferfi);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferfi(buffer, drawbuffer, depth, stencil);
     }
 
     void ClearBufferfv_Backend(GLenum buffer, GLint drawbuffer, const GLfloat* value) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferfv);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferfv(buffer, drawbuffer, value);
     }
 
     void ClearBufferuiv_Backend(GLenum buffer, GLint drawbuffer, const GLuint* value) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferuiv);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferuiv(buffer, drawbuffer, value);
     }
 
     void ClearBufferiv_Backend(GLenum buffer, GLint drawbuffer, const GLint* value) {
         // GL 4.6 core 10.9 makes ClearBuffer* conditional alongside the drawing commands.
         if (MG_State::pGLContext->ConditionalRenderDiscardsCommands()) return;
+        MGP_FILL(ClearBufferiv);
         MG_Backend::gBackendFunctionsTable.GL.ClearBufferiv(buffer, drawbuffer, value);
     }
 
@@ -2880,6 +3091,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void ReadPixels_Backend(GLint x, GLint y, GLsizei width, GLsizei height, GLenum format, GLenum type, void* pixels) {
+        MGP_FILL(ReadPixels);
         MG_Backend::gBackendFunctionsTable.GL.ReadPixels(x, y, width, height, format, type, pixels);
     }
 

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.cpp

@@ -7,9 +7,12 @@
 // End of Source File Header
 
 #include "GL_Getter.h"
+#include <algorithm>
 #include <cmath>
+#include <limits>
 #include <Config.h>
 #include <MGGitHash.h>
+#include <MG_Impl/GLImpl/Debug/GL_Debug.h>
 #include <MG_Impl/GLImpl/VertexArray/Validators.h>
 #include <MG_State/EGLState/Core.h>
 #include <MG_State/GLState/Core.h>
@@ -27,6 +30,7 @@
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     // Declared rather than #included from GL_RenderState.h on purpose: that header also declares
@@ -92,8 +96,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         // limits they advertise still have to be legal.
         constexpr GLint kFrontendMaxDebugGroupStackDepth = 64;
         constexpr GLint kFrontendMaxDebugLoggedMessages = 1;
-        constexpr GLint kFrontendMaxVertexUniformComponents = 4096;
+        // The *_VECTORS answers are the *_COMPONENTS ones divided by four, never a second
-        constexpr GLint kFrontendMaxVertexUniformVectors = 128;
+        // literal: they used to be independent (4096 components against 128 vectors, 64 varying
+        // components against 8 varying vectors) and could not both be describing the same
+        // capacity. Both are shared with BuildTBuiltInResource through Types.h, because
+        // gl_MaxVertexUniformVectors and gl_MaxVaryingVectors expand from the same numbers.
+        constexpr GLint kFrontendMaxVertexUniformComponents =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VERTEX_UNIFORM_COMPONENTS);
+        constexpr GLint kFrontendMaxVertexUniformVectors =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VERTEX_UNIFORM_VECTORS);
         constexpr GLint kFrontendMaxVertexUniformBlocks = 14;
         constexpr GLint kFrontendMaxVertexOutputComponents = 64;
         constexpr GLint kFrontendMaxFragmentInputComponents = 128;
@@ -105,21 +116,61 @@ namespace MobileGL::MG_Impl::GLImpl {
         constexpr GLint kFrontendMaxGeometryTextureImageUnits = 16;
         constexpr GLint kFrontendMaxGeometryUniformComponents = 1024;
         constexpr GLint kFrontendMaxGeometryUniformBlocks = 14;
-        constexpr GLint kFrontendMaxCombinedUniformBlocks = kFrontendMaxVertexUniformBlocks +
+        // ARB_geometry_shader4's per-invocation count. No TBuiltInResource field and no
-                                                            kFrontendMaxGeometryUniformBlocks +
+        // gl_MaxGeometryShaderInvocations built-in exists to keep in step, so this is a getter
-                                                            kFrontendMaxFragmentUniformBlocks;
+        // answer only; 32 is the GL 4.6 core minimum (table 23.57).
-        constexpr GLint kFrontendMaxVaryingComponents = 64;
+        constexpr GLint kFrontendMaxGeometryShaderInvocations = 32;
-        constexpr GLint kFrontendMaxVaryingVectors = 8;
+        constexpr GLint kFrontendMaxTessControlUniformBlocks = 14;
+        constexpr GLint kFrontendMaxTessEvaluationUniformBlocks = 14;
+        // The compute stage's share of the combined sum below. Compute's own per-stage answer is
+        // backend-derived (GL_MAX_COMPUTE_UNIFORM_BLOCKS reads dynamicParameters), so this is not
+        // what that query returns - it is the GL 4.3 core minimum, present here only so the
+        // combined total covers all SIX stages.
+        constexpr GLint kFrontendMaxComputeUniformBlocksShare = 14;
+        // GL 4.6 table 23.64 orders MAX_UNIFORM_BUFFER_BINDINGS >= MAX_COMBINED_UNIFORM_BLOCKS >=
+        // every per-stage count, and the sum has to run over SIX stages, not three and not five.
+        // Three (42) was the original bug. Five (70) replaced it and broke the middle term the
+        // other way: compute's per-stage count is backend-derived and clamps at the binding count,
+        // so a device reporting descriptor-indexing-scale uniform buffers (Adreno reports
+        // maxPerStageDescriptorUniformBuffers = 16777216) advertised 84 compute blocks against a
+        // combined 70. Six stages x 14 = 84, which is also exactly the binding-point count and the
+        // arithmetic the GL 4.5 minimum of 84 bindings is built from, so the ordering is now tight
+        // rather than accidental.
+        constexpr GLint kFrontendMaxCombinedUniformBlocks =
+            kFrontendMaxVertexUniformBlocks + kFrontendMaxTessControlUniformBlocks +
+            kFrontendMaxTessEvaluationUniformBlocks + kFrontendMaxGeometryUniformBlocks +
+            kFrontendMaxFragmentUniformBlocks + kFrontendMaxComputeUniformBlocksShare;
+        constexpr GLint kFrontendMaxVaryingComponents =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VARYING_COMPONENTS);
+        constexpr GLint kFrontendMaxVaryingVectors =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VARYING_VECTORS);
         constexpr GLint kFrontendMaxProgramTexelOffset = 7;
         constexpr GLint kFrontendMinProgramTexelOffset = -8;
         constexpr GLint kFrontendMaxTransformFeedbackInterleavedComponents = 64;
         constexpr GLint kFrontendMaxTransformFeedbackSeparateAttribs = 4;
         constexpr GLint kFrontendMaxTransformFeedbackSeparateComponents = 4;
+        // ARB_transform_feedback3's vertex-stream count. One is what this implementation can
+        // actually emit to; see the GL_MAX_VERTEX_STREAMS case for why it is not four.
+        constexpr GLint kFrontendMaxVertexStreams = 1;
         constexpr GLint kFrontendMaxGeometryOutputVertices = 256;
         constexpr GLint kFrontendMaxGeometryTotalOutputComponents = 1024;
-        constexpr GLint kFrontendMinUniformBufferBindings = 36;
+        // GL 4.5 core table 23.64 requires 84 indexed uniform binding points, and that is exactly
+        // how wide the state layer's array is (BufferState::BufferBindingPointCount) - see the
+        // GL_MAX_UNIFORM_BUFFER_BINDINGS case for why the ES driver's own, smaller count is not
+        // the ceiling here.
+        constexpr GLint kFrontendMinUniformBufferBindings = 84;
         constexpr GLint kFrontendSubpixelBits = 4;
-        constexpr GLint kFrontendMaxSamples = 4;
+        constexpr GLint kFrontendMaxSamples =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MIN_ADVERTISED_MAX_SAMPLES);
+        // ARB_shader_subroutine's two limits. NOTHING IMPLEMENTS SUBROUTINES: there is no
+        // glGetSubroutineIndex / glUniformSubroutinesuiv, only the program-interface enum
+        // plumbing. These are answered - with the GL 4.5 core minimums - because the conformance
+        // suite queries them before it checks for the feature and an INVALID_ENUM both leaves the
+        // caller reading its own uninitialised stack slot and strands an error for the next
+        // unrelated call to trip over. The extension is deliberately NOT advertised, so the
+        // numbers are a table entry, not a capability claim.
+        constexpr GLint kFrontendMaxSubroutines = 256;
+        constexpr GLint kFrontendMaxSubroutineUniformLocations = 1024;
 
         // The floors under GL_MAX_COMPUTE_WORK_GROUP_COUNT / _SIZE. Shared with the compile
         // pipeline (CaptureCompileEnv floors the same driver answers at them, and
@@ -133,9 +184,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             return index < 3 ? static_cast<GLint>(MG_Util::ShaderTranspiler::MIN_COMPUTE_WORK_GROUP_SIZE[index]) : 0;
         }
 
+        // GL 4.6 core table 23.64: components + blocks * (blockSize / 4). The product has to be
+        // formed in 64 bits and saturated on the way out - it overflowed a signed 32-bit int on
+        // every Vulkan host that reports a large maxUniformBufferRange. A Mali driver answering
+        // 0xFFFFFFFF saturates to INT32_MAX in the loader, and 14 * (2147483647 / 4) + 4096 wraps
+        // to -1073737742, which the conformance suite read back as a limit "smaller than 58368".
+        // Saturating instead of wrapping is also the only honest answer: an implementation that
+        // can serve more components than a GLint holds still has to report a GLint.
         GLint GetMaxCombinedUniformComponents(GLint maxDefaultUniformComponents, GLint maxUniformBlocks,
                                               GLint maxUniformBlockSizeBytes) {
-            return maxDefaultUniformComponents + maxUniformBlocks * (maxUniformBlockSizeBytes / 4);
+            const Int64 blocks = std::max<Int64>(static_cast<Int64>(maxUniformBlocks), 0);
+            const Int64 componentsPerBlock = std::max<Int64>(static_cast<Int64>(maxUniformBlockSizeBytes), 0) / 4;
+            const Int64 total = static_cast<Int64>(maxDefaultUniformComponents) + blocks * componentsPerBlock;
+            return static_cast<GLint>(std::min<Int64>(total, std::numeric_limits<GLint>::max()));
         }
 
         bool TryDecodeIndexedBufferQuery(GLenum pname, BufferTarget& bufferTarget, IndexedBufferQueryKind& queryKind) {
@@ -303,24 +364,6 @@ namespace MobileGL::MG_Impl::GLImpl {
             return true;
         }
 
-        GLint ResolveDrawFramebufferSampleCount() {
-            const auto& drawFbo =
-                MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
-            if (!drawFbo) return 0;
-
-            GLint maxSamples = 0;
-            for (const auto& attachment : drawFbo->GetAllAttachmentObjects()) {
-                if (attachment.IsRenderbuffer() && attachment.GetRenderbuffer()) {
-                    maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetRenderbuffer()->GetSamples()));
-                } else if (attachment.IsTexture() && attachment.GetTexture()) {
-                    // Multisample texture attachments count too (GL_SAMPLE_BUFFERS must
-                    // report 1 for any multisampled draw framebuffer).
-                    maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetTexture()->GetSamples()));
-                }
-            }
-            return maxSamples;
-        }
-
         void RecordIndexedOnlyGetterError(const char* functionName, GLenum pname) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,
@@ -472,10 +515,18 @@ namespace MobileGL::MG_Impl::GLImpl {
     } // namespace
 
     // GL 4.6 core table 23.53 requires GL_MAX_SAMPLES >= 4, so the driver's value is floored
-    // before it is advertised. Every other multisample ceiling MobileGL advertises has to be
+    // before it is advertised. gl_MaxSamples expands from the same floored number
-    // floored the same way: promising 4 samples globally while answering GL_MAX_INTEGER_SAMPLES
+    // (BuildTBuiltInResource), which is also what sizes gl_SampleMask[].
-    // 1 - which is exactly what Adreno reports - makes the frontend reject the very count it
+    //
-    // just told the application to use. The backends clamp the realised count instead.
+    // THE FLOOR STOPS HERE, and that is the point. It used to be applied to
+    // GL_MAX_INTEGER_SAMPLES, GL_MAX_COLOR_TEXTURE_SAMPLES and GL_MAX_DEPTH_TEXTURE_SAMPLES too,
+    // on the reasoning that an application reads GL_MAX_SAMPLES once and hands that count to
+    // every glTexStorage*Multisample. Table 23.53 gives those three a minimum of ONE, and the
+    // reasoning had it backwards: Adreno and Mali back an integer multisample texture with a
+    // single sample, so flooring the query at 4 did not make four samples exist - it made the
+    // backend silently under-allocate (ClampSamplesToBackendSupport) while the application wrote
+    // per-sample data it could never read back. Reporting what was probed turns that into an
+    // honest "unsupported" the application can branch on.
     GLint GetAdvertisedMaxSamples() {
         if (MG_Backend::pActiveBackendObject == nullptr) {
             return kFrontendMaxSamples;
@@ -483,6 +534,50 @@ namespace MobileGL::MG_Impl::GLImpl {
         return std::max(MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxSamples, kFrontendMaxSamples);
     }
 
+    // GL 4.6 core table 23.53 minimum for the per-category multisample ceilings. One, not four:
+    // see the note on GetAdvertisedMaxSamples. A zero would be a probe that never ran, so it is
+    // floored rather than trusted.
+    namespace {
+        GLint AdvertisedCategoryMaxSamples(Int MG_Backend::DynamicBackendParameters::*categoryLimit) {
+            if (MG_Backend::pActiveBackendObject == nullptr) {
+                return 1;
+            }
+            return std::max(MG_Backend::pActiveBackendObject->GetDynamicParameters().*categoryLimit, 1);
+        }
+    } // namespace
+
+    GLint GetAdvertisedColorTextureMaxSamples() {
+        return AdvertisedCategoryMaxSamples(&MG_Backend::DynamicBackendParameters::MaxColorTextureSamples);
+    }
+
+    GLint GetAdvertisedDepthTextureMaxSamples() {
+        return AdvertisedCategoryMaxSamples(&MG_Backend::DynamicBackendParameters::MaxDepthTextureSamples);
+    }
+
+    GLint GetAdvertisedIntegerMaxSamples() {
+        return AdvertisedCategoryMaxSamples(&MG_Backend::DynamicBackendParameters::MaxIntegerSamples);
+    }
+
+    // Declared in GL_Getter.h, so that the draw path can feed the same number to the reserved
+    // gl_NumSamples stand-in that glGetIntegerv(GL_SAMPLES) reports.
+    GLint ResolveDrawFramebufferSampleCount() {
+        const auto& drawFbo =
+            MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
+        if (!drawFbo) return 0;
+
+        GLint maxSamples = 0;
+        for (const auto& attachment : drawFbo->GetAllAttachmentObjects()) {
+            if (attachment.IsRenderbuffer() && attachment.GetRenderbuffer()) {
+                maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetRenderbuffer()->GetSamples()));
+            } else if (attachment.IsTexture() && attachment.GetTexture()) {
+                // Multisample texture attachments count too (GL_SAMPLE_BUFFERS must
+                // report 1 for any multisampled draw framebuffer).
+                maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetTexture()->GetSamples()));
+            }
+        }
+        return maxSamples;
+    }
+
     /* @INSERTION_POINT:FUNCTION_IMPLEMENTATION@ */
     const GLubyte* GetString(GLenum name) {
         static String vendorString;
@@ -679,12 +774,30 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         case GL_MIN_FRAGMENT_INTERPOLATION_OFFSET:
         case GL_MAX_FRAGMENT_INTERPOLATION_OFFSET:
-        case GL_FRAGMENT_INTERPOLATION_OFFSET_BITS: {
+        case GL_FRAGMENT_INTERPOLATION_OFFSET_BITS:
+        // Same reason as the three above: the integer fallback would round the fraction to 0
+        // or 1 first, so a 0.25 sample-shading rate would answer GL_FALSE.
+        case GL_MIN_SAMPLE_SHADING_VALUE: {
             GLfloat value = 0.0f;
             GetFloatv(pname, &value);
             *params = value != 0.0f ? GL_TRUE : GL_FALSE;
             return;
         }
+        // Float-native state, so GL 4.6 core 2.2.2's "zero becomes FALSE, every other value
+        // becomes TRUE" has to be applied to the VALUE. Answering these through the integer getter
+        // below instead - which rounds - reported GL_FALSE for a perfectly non-zero level of 0.25,
+        // and every other float state in this function already reads through GetFloatv for exactly
+        // that reason.
+        case GL_PATCH_DEFAULT_OUTER_LEVEL:
+        case GL_PATCH_DEFAULT_INNER_LEVEL: {
+            const GLsizei componentCount = pname == GL_PATCH_DEFAULT_OUTER_LEVEL ? 4 : 2;
+            GLfloat levels[4] = {};
+            GetFloatv(pname, levels);
+            for (GLsizei i = 0; i < componentCount; ++i) {
+                params[i] = levels[i] != 0.0f ? GL_TRUE : GL_FALSE;
+            }
+            return;
+        }
         default:
             break;
         }
@@ -734,6 +847,22 @@ namespace MobileGL::MG_Impl::GLImpl {
             params[1] = depthRange.y();
             return;
         }
+        // glPatchParameterfv's two states. Float-native, so they are answered here rather than
+        // through the integer fallback below - which rounds, and would report 0 for a level of 0.5.
+        case GL_PATCH_DEFAULT_OUTER_LEVEL: {
+            const FloatVec4& outer = MG_State::pGLContext->GetPatchDefaultOuterLevel();
+            params[0] = outer.x();
+            params[1] = outer.y();
+            params[2] = outer.z();
+            params[3] = outer.w();
+            return;
+        }
+        case GL_PATCH_DEFAULT_INNER_LEVEL: {
+            const FloatVec2& inner = MG_State::pGLContext->GetPatchDefaultInnerLevel();
+            params[0] = inner.x();
+            params[1] = inner.y();
+            return;
+        }
         case GL_VIEWPORT_BOUNDS_RANGE: {
             const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
             params[0] = dynamicParameters.ViewportBoundsRangeMin;
@@ -799,6 +928,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_POLYGON_OFFSET_UNITS:
             params[0] = MG_State::pGLContext->GetPolygonOffsetUnits();
             return;
+        case GL_POLYGON_OFFSET_CLAMP:
+            // Float-native state, so it is answered here rather than through the integer
+            // fallback: glPolygonOffsetClamp(1, 1, 0.5) must read back as 0.5, not as 0.
+            params[0] = MG_State::pGLContext->GetPolygonOffsetClamp();
+            return;
         case GL_SMOOTH_LINE_WIDTH_RANGE: {
             const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
             params[0] = dynamicParameters.SmoothLineWidthRangeMin;
@@ -814,6 +948,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_SAMPLE_COVERAGE_VALUE:
             params[0] = MG_State::pGLContext->GetSampleCoverageValue();
             return;
+        case GL_MIN_SAMPLE_SHADING_VALUE:
+            // Float state, so it has to be answered here rather than through the integer
+            // fallback: glMinSampleShading(0.5) must read back as 0.5 and not as 0.
+            params[0] = MG_State::pGLContext->GetMinSampleShadingValue();
+            return;
         case GL_POINT_FADE_THRESHOLD_SIZE:
             // Float state: read it directly so the fractional part is not lost to the integer path.
             params[0] = MG_State::pGLContext->GetPointFadeThresholdSize();
@@ -1035,6 +1174,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 : GetMinComputeWorkGroupSize(index);
             GLint backendValue = 0;
             if (getIntegeri) {
+                MGP_FILL(GetIntegeri_v);
                 getIntegeri(target, index, &backendValue);
             }
             *data = std::max(backendValue, minimum);
@@ -1185,6 +1325,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
 
         switch (pname) {
+        case GL_MAX_ELEMENT_INDEX:
+            // The largest value a GL_UNSIGNED_INT index may take. It has to be answered HERE and
+            // not left to the 32-bit fallback below: the conformance suite reads it with
+            // glGetInteger64v, and widening the saturated GLint would report INT32_MAX where the
+            // spec requires 2^32-1.
+            params[0] = 0xFFFFFFFFLL;
+            return;
         case GL_MAX_SHADER_STORAGE_BLOCK_SIZE:
             if (MG_Backend::pActiveBackendObject) {
                 params[0] = static_cast<GLint64>(
@@ -1208,6 +1355,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             Int64 timestamp = 0;
             if (!MG_Config::Features.DisableTimerQuery) {
                 if (const auto getGpuTimestampNs = MG_Backend::gBackendFunctionsTable.GL.GetGpuTimestampNs) {
+                    MGP_FILL(GetGpuTimestampNs);
                     timestamp = getGpuTimestampNs();
                 }
             }
@@ -1221,12 +1369,17 @@ namespace MobileGL::MG_Impl::GLImpl {
         GLint ints[4] = {};
         GetIntegerv(pname, ints);
 
+        // GL 4.6 core 22.1 gives glGetInteger64v the same accepted-pname set as glGetIntegerv, so
+        // every pname the integer getter answers with several components owes them all here too.
+        // A pname that reaches the `default:` arm writes params[0] and leaves the caller's other
+        // components holding whatever they held, with no error to say so.
         switch (pname) {
         case GL_BLEND_COLOR:
         case GL_COLOR_CLEAR_VALUE:
         case GL_COLOR_WRITEMASK:
         case GL_SCISSOR_BOX:
         case GL_VIEWPORT:
+        case GL_PATCH_DEFAULT_OUTER_LEVEL:
             for (int i = 0; i < 4; ++i) {
                 params[i] = static_cast<GLint64>(ints[i]);
             }
@@ -1236,6 +1389,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_VIEWPORT_DIMS:
         case GL_POINT_SIZE_RANGE:
         case GL_VIEWPORT_BOUNDS_RANGE:
+        case GL_PATCH_DEFAULT_INNER_LEVEL:
             params[0] = static_cast<GLint64>(ints[0]);
             params[1] = static_cast<GLint64>(ints[1]);
             return;
@@ -1267,6 +1421,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_POINT_SIZE_RANGE:
         case GL_SMOOTH_LINE_WIDTH_RANGE:
         case GL_MAX_VIEWPORT_DIMS:
+        case GL_PATCH_DEFAULT_INNER_LEVEL:
             count = 2;
             break;
         case GL_BLEND_COLOR:
@@ -1274,6 +1429,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_VIEWPORT:
         case GL_SCISSOR_BOX:
         case GL_COLOR_WRITEMASK:
+        case GL_PATCH_DEFAULT_OUTER_LEVEL:
             count = 4;
             break;
         default:
@@ -1313,6 +1469,15 @@ namespace MobileGL::MG_Impl::GLImpl {
                 *params = 0;
             return;
         }
+        // GL_TEXTURE_BUFFER_BINDING and GL_TEXTURE_BUFFER are the same token (0x8C2A): as a
+        // glGetIntegerv pname it asks which BUFFER object is bound to the buffer-texture target,
+        // not which texture is (that one is GL_TEXTURE_BINDING_BUFFER, handled by the texture-unit
+        // decoder above).
+        case GL_TEXTURE_BUFFER_BINDING: {
+            auto& obj = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::Texture).GetBoundObject();
+            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
+            return;
+        }
         case GL_BLEND:
             *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::Blend) ? GL_TRUE : GL_FALSE;
             return;
@@ -1368,6 +1533,16 @@ namespace MobileGL::MG_Impl::GLImpl {
             // this single case serves every getter flavor.
             *params = static_cast<GLint>(MG_State::pGLContext->GetClampReadColor());
             return;
+        // glClipControl's two state variables (GL 4.5 core table 23.7). They answer from the
+        // state the entry point records, which is what the conformance suite's initial-value and
+        // set-then-get cases read - the RASTERIZATION half of clip control is a separate,
+        // backend-side question and does not gate the query.
+        case GL_CLIP_ORIGIN:
+            *params = static_cast<GLint>(MG_State::pGLContext->GetClipOrigin());
+            return;
+        case GL_CLIP_DEPTH_MODE:
+            *params = static_cast<GLint>(MG_State::pGLContext->GetClipDepthMode());
+            return;
         case GL_COLOR_CLEAR_VALUE: {
             const FloatVec4& clearColor = MG_State::pGLContext->GetClearColor();
             params[0] = static_cast<GLint>(clearColor.x());
@@ -1427,19 +1602,21 @@ namespace MobileGL::MG_Impl::GLImpl {
                           : 0;
             return;
         case GL_MAX_DEBUG_GROUP_STACK_DEPTH:
-            // KHR_debug floors this at 64 even when the group entry points are stubs: the
+            // KHR_debug floors this at 64. It must agree with what GL_Debug.cpp actually enforces,
-            // limit describes how deep glPushDebugGroup may nest, and 0 is not a legal answer.
+            // or an application that nests to the reported limit would take a STACK_OVERFLOW.
             *params = kFrontendMaxDebugGroupStackDepth;
             return;
         case GL_MAX_DEBUG_MESSAGE_LENGTH:
-            *params = 1024; // debug-message entrypoints are stubbed, but KHR_debug requires a valid limit
+            *params = 1024; // agrees with GL_Debug.cpp's kMaxDebugMessageLength
             return;
         case GL_MAX_DEBUG_LOGGED_MESSAGES:
             // Size of the message log ring; KHR_debug requires at least 1.
             *params = kFrontendMaxDebugLoggedMessages;
             return;
         case GL_DEBUG_GROUP_STACK_DEPTH:
-            *params = 0; // debug-group entrypoints are stubbed
+            // The live depth, which is never 0: GL 4.6 core 20.6 creates the context with one
+            // group already on the stack, and that is the one glPopDebugGroup may not pop.
+            *params = GetDebugGroupStackDepth();
             return;
         case GL_CONTEXT_FLAGS: {
             *params = MG_State::pEGLContext ? MG_State::pEGLContext->GetCurrentContextFlags() : 0;
@@ -1654,6 +1831,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_GEOMETRY_UNIFORM_COMPONENTS:
             *params = kFrontendMaxGeometryUniformComponents;
             return;
+        case GL_MAX_GEOMETRY_SHADER_INVOCATIONS:
+            *params = kFrontendMaxGeometryShaderInvocations;
+            return;
         case GL_MAX_IMAGE_SAMPLES:
             *params = 0; // multisampled image load/store is not exposed by the DirectGLES frontend
             return;
@@ -1707,6 +1887,59 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params =
                 StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxTessEvaluationShaderStorageBlocks);
             return;
+        // The tessellation per-stage resource limits. Every one of these is ALSO a GLSL built-in
+        // constant that BuildTBuiltInResource expands, and the two must report the same number
+        // (KHR-GL45.limits.max_tess_* compares them directly) - which is why the values come from
+        // the shared block in MG_Util/ShaderTranspiler/Types.h rather than from literals here.
+        // They were the whole per-stage tess family: the table had been filled in only where the
+        // honest answer was zero (the atomic counters, the image uniforms) or where a driver
+        // query existed (GL_MAX_PATCH_VERTICES, GL_MAX_TESS_GEN_LEVEL), so every pname whose
+        // answer is a real resource count fell through to GL_INVALID_ENUM.
+        case GL_MAX_TESS_CONTROL_INPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_INPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_CONTROL_OUTPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_OUTPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_CONTROL_TOTAL_OUTPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_TOTAL_OUTPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_CONTROL_TEXTURE_IMAGE_UNITS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_TEXTURE_IMAGE_UNITS);
+            return;
+        case GL_MAX_TESS_CONTROL_UNIFORM_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_UNIFORM_COMPONENTS);
+            return;
+        case GL_MAX_TESS_EVALUATION_INPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_INPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_EVALUATION_OUTPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_OUTPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_EVALUATION_TEXTURE_IMAGE_UNITS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_TEXTURE_IMAGE_UNITS);
+            return;
+        case GL_MAX_TESS_EVALUATION_UNIFORM_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_UNIFORM_COMPONENTS);
+            return;
+        case GL_MAX_TESS_PATCH_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_PATCH_COMPONENTS);
+            return;
+        // Routed through the same clamp as every other per-stage block count so the
+        // MAX_UNIFORM_BUFFER_BINDINGS >= MAX_COMBINED_UNIFORM_BLOCKS >= per-stage ordering of
+        // GL 4.6 table 23.64 cannot be broken by the two families moving independently.
+        case GL_MAX_TESS_CONTROL_UNIFORM_BLOCKS:
+            *params = ClampUniformBlockCount(kFrontendMaxTessControlUniformBlocks);
+            return;
+        case GL_MAX_TESS_EVALUATION_UNIFORM_BLOCKS:
+            *params = ClampUniformBlockCount(kFrontendMaxTessEvaluationUniformBlocks);
+            return;
+        case GL_MAX_SUBROUTINES:
+            *params = kFrontendMaxSubroutines;
+            return;
+        case GL_MAX_SUBROUTINE_UNIFORM_LOCATIONS:
+            *params = kFrontendMaxSubroutineUniformLocations;
+            return;
         case GL_MAX_TEXTURE_LOD_BIAS:
             *params = 15; // TODO
             return;
@@ -1752,8 +1985,21 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_NUM_PROGRAM_BINARY_FORMATS:
             *params = 0;
             return;
+        // GL_ARB_spirv_extensions / GL 4.6 core 22.2. An implementation that advertises no
+        // SPIR-V extension answers zero here, and glGetStringi(GL_SPIR_V_EXTENSIONS, i) is then
+        // never legally called - MobileGL runs the module through its own translation pipeline
+        // and relies on no SPIR-V extension to do it, so zero is the true answer rather than a
+        // placeholder.
+        case GL_NUM_SPIR_V_EXTENSIONS:
+            *params = 0;
+            return;
+        // GL_ARB_gl_spirv, core since 4.6: exactly one shader binary format, and the pair has to
+        // agree - an application sizes its GL_SHADER_BINARY_FORMATS array from the count.
         case GL_NUM_SHADER_BINARY_FORMATS:
-            *params = 0; // ShaderBinary entrypoints are stubbed
+            *params = 1;
+            return;
+        case GL_SHADER_BINARY_FORMATS:
+            *params = static_cast<GLint>(GL_SHADER_BINARY_FORMAT_SPIR_V);
             return;
         case GL_PACK_ALIGNMENT:
             *params = MG_State::pGLContext->GetPixelStoreParam(PixelStoreParam::PackAlignment);
@@ -1812,6 +2058,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_PRIMITIVE_RESTART_INDEX:
             *params = static_cast<GLint>(MG_State::pGLContext->GetPrimitiveRestartIndex());
             return;
+        case GL_POLYGON_OFFSET_CLAMP:
+            // Float state (see GetFloatv); rounded to nearest for the integer query per GL 4.6
+            // core 22.1's float-to-integer rule.
+            *params = static_cast<GLint>(std::lround(MG_State::pGLContext->GetPolygonOffsetClamp()));
+            return;
         case GL_PROGRAM_BINARY_FORMATS:
             *params = 0; // program-binary entrypoints are stubbed
             return;
@@ -1897,6 +2148,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_SAMPLE_MASK:
             *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::SampleMask) ? GL_TRUE : GL_FALSE;
             return;
+        case GL_SAMPLE_SHADING:
+            *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::SampleShading) ? GL_TRUE : GL_FALSE;
+            return;
+        case GL_MIN_SAMPLE_SHADING_VALUE:
+            // GL 4.6 core 22.2: a floating-point value queried as an integer rounds to nearest.
+            *params = static_cast<GLint>(std::lround(MG_State::pGLContext->GetMinSampleShadingValue()));
+            return;
         case GL_SAMPLE_MASK_VALUE:
             *params = static_cast<GLint>(MG_State::pGLContext->GetSampleMaskValue());
             return;
@@ -2008,6 +2266,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             Int64 timestamp = 0;
             if (!MG_Config::Features.DisableTimerQuery) {
                 if (const auto getGpuTimestampNs = MG_Backend::gBackendFunctionsTable.GL.GetGpuTimestampNs) {
+                    MGP_FILL(GetGpuTimestampNs);
                     timestamp = getGpuTimestampNs();
                 }
             }
@@ -2115,7 +2374,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         case GL_MAX_ELEMENT_INDEX:
-            *params = 1024 * 1024; // TODO
+            // 64-bit state (see GetInteger64v); the 32-bit query saturates, per the GL
+            // state-query conversion rules - the same shape GL_MAX_SHADER_STORAGE_BLOCK_SIZE
+            // uses. The real answer is 2^32-1 because both backends draw with GL_UNSIGNED_INT
+            // indices and neither bounds an index value; the old `1024 * 1024` was a placeholder
+            // that no draw path ever consulted.
+            *params = INT32_MAX;
             return;
         case GL_CONTEXT_PROFILE_MASK:
             // Reports the requested context profile (EGL defaults 3.x contexts to core);
@@ -2171,8 +2435,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = dynamicParameters.MaxComputeTextureImageUnits;
             break;
         case GL_MAX_COMBINED_COMPUTE_UNIFORM_COMPONENTS:
+            // The CLAMPED block count, i.e. exactly what GL_MAX_COMPUTE_UNIFORM_BLOCKS answers.
+            // GL 4.6 table 23.64 defines this as the components reachable through the blocks a
+            // stage may declare, so deriving it from the raw backend number described 256 blocks
+            // an application is only ever allowed 84 of.
             *params = GetMaxCombinedUniformComponents(kFrontendMaxComputeUniformComponents,
-                                                      dynamicParameters.MaxComputeUniformBlocks,
+                                                      ClampUniformBlockCount(dynamicParameters.MaxComputeUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_COMPUTE_WORK_GROUP_INVOCATIONS:
@@ -2216,16 +2484,16 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = static_cast<GLint>(dynamicParameters.ViewportIndexProvokingVertex);
             break;
         case GL_MAX_COLOR_TEXTURE_SAMPLES:
-            *params = std::max(dynamicParameters.MaxColorTextureSamples, GetAdvertisedMaxSamples());
+            *params = GetAdvertisedColorTextureMaxSamples();
             break;
         case GL_MAX_COMBINED_FRAGMENT_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxFragmentUniformComponents,
-                                                      kFrontendMaxFragmentUniformBlocks,
+                                                      ClampUniformBlockCount(kFrontendMaxFragmentUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_COMBINED_GEOMETRY_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxGeometryUniformComponents,
-                                                      kFrontendMaxGeometryUniformBlocks,
+                                                      ClampUniformBlockCount(kFrontendMaxGeometryUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_GEOMETRY_OUTPUT_VERTICES:
@@ -2239,14 +2507,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             break;
         case GL_MAX_COMBINED_VERTEX_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxVertexUniformComponents,
-                                                      kFrontendMaxVertexUniformBlocks,
+                                                      ClampUniformBlockCount(kFrontendMaxVertexUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_CUBE_MAP_TEXTURE_SIZE:
             *params = dynamicParameters.MaxCubeMapTextureSize;
             break;
         case GL_MAX_DEPTH_TEXTURE_SAMPLES:
-            *params = std::max(dynamicParameters.MaxDepthTextureSamples, GetAdvertisedMaxSamples());
+            *params = GetAdvertisedDepthTextureMaxSamples();
             break;
         case GL_MAX_FRAMEBUFFER_WIDTH:
             *params = dynamicParameters.MaxFramebufferWidth;
@@ -2273,7 +2541,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = dynamicParameters.MaxComputeImageUniforms;
             break;
         case GL_MAX_INTEGER_SAMPLES:
-            *params = std::max(dynamicParameters.MaxIntegerSamples, GetAdvertisedMaxSamples());
+            *params = GetAdvertisedIntegerMaxSamples();
             break;
         case GL_MAX_RENDERBUFFER_SIZE:
             *params = dynamicParameters.MaxRenderbufferSize;
@@ -2284,12 +2552,56 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_PATCH_VERTICES:
             *params = static_cast<GLint>(MG_State::pGLContext->GetPatchVertices());
             break;
+        // Float state, so glGetIntegerv rounds it (GL 4.6 core 2.2.2) - the exact values come back
+        // through glGetFloatv. Answered here so glGetBooleanv, which delegates to this getter for
+        // everything its own switch does not handle, does not report INVALID_ENUM for them.
+        case GL_PATCH_DEFAULT_OUTER_LEVEL: {
+            const FloatVec4& outer = MG_State::pGLContext->GetPatchDefaultOuterLevel();
+            for (Uint i = 0; i < 4; ++i) params[i] = static_cast<GLint>(std::lround(outer[i]));
+            break;
+        }
+        case GL_PATCH_DEFAULT_INNER_LEVEL: {
+            const FloatVec2& inner = MG_State::pGLContext->GetPatchDefaultInnerLevel();
+            for (Uint i = 0; i < 2; ++i) params[i] = static_cast<GLint>(std::lround(inner[i]));
+            break;
+        }
+        // GL 4.6 core table 23.66: whether the primitive-restart index terminates a patch.
+        // GL_FALSE is a legal answer and the true one - neither backend cuts a patch short, and
+        // the DirectVulkan draw path relies on this staying false (it resolves primitive restart
+        // to "never" for a PATCH_LIST topology on the strength of it).
+        case GL_PRIMITIVE_RESTART_FOR_PATCHES_SUPPORTED:
+            *params = GL_FALSE;
+            break;
         case GL_MAX_PATCH_VERTICES:
             *params = dynamicParameters.MaxPatchVertices;
             break;
         case GL_MAX_TESS_GEN_LEVEL:
             *params = dynamicParameters.MaxTessGenLevel;
             break;
+        // Same helper, and so the same arithmetic, as every other GL_MAX_COMBINED_*_UNIFORM_
+        // COMPONENTS: default-block components + blocks * (block size / 4). It reproduces the
+        // conformance suite's own formula exactly, so the two cannot drift.
+        case GL_MAX_COMBINED_TESS_CONTROL_UNIFORM_COMPONENTS:
+            *params = GetMaxCombinedUniformComponents(
+                static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_UNIFORM_COMPONENTS),
+                ClampUniformBlockCount(kFrontendMaxTessControlUniformBlocks), dynamicParameters.MaxUniformBlockSize);
+            break;
+        case GL_MAX_COMBINED_TESS_EVALUATION_UNIFORM_COMPONENTS:
+            *params = GetMaxCombinedUniformComponents(
+                static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_UNIFORM_COMPONENTS),
+                ClampUniformBlockCount(kFrontendMaxTessEvaluationUniformBlocks), dynamicParameters.MaxUniformBlockSize);
+            break;
+        // ARB_cull_distance. Backend-derived exactly like GL_MAX_CLIP_DISTANCES beside it, and
+        // for a stronger reason: a cull distance discards the whole primitive, so advertising
+        // eight the rasterizer cannot serve turns every culling draw into a silent no-op. Zero is
+        // the honest answer on a host with no cull-distance route, and the conformance suite then
+        // skips the functional cases instead of failing them deep inside a pixel comparison.
+        case GL_MAX_CULL_DISTANCES:
+            *params = dynamicParameters.MaxCullDistances;
+            break;
+        case GL_MAX_COMBINED_CLIP_AND_CULL_DISTANCES:
+            *params = dynamicParameters.MaxCombinedClipAndCullDistances;
+            break;
         case GL_MIN_PROGRAM_TEXTURE_GATHER_OFFSET:
             *params = dynamicParameters.MinProgramTextureGatherOffset;
             break;
@@ -2340,7 +2652,25 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = kFrontendMaxTransformFeedbackSeparateAttribs;
             break;
         case GL_MAX_VERTEX_STREAMS:
-            *params = 1;
+            // ONE, which is under the GL 4.5 core table 23.62 minimum of four and is a known,
+            // deliberate non-conformance. It was briefly raised to 4 on the theory that streams
+            // 1..3 could exist and be permanently empty; measuring that decision refuted it.
+            // Raising the limit un-gates two CTS cases per package across KHR-GL40..GL46 -
+            // transform_feedback.draw_xfb_stream_test (which stops being skipped) and
+            // transform_feedback3.multiple_streams (which stops reporting NotSupported) - and
+            // both then fail, because nothing in the shader pipeline supports layout(stream = N),
+            // EmitStreamVertex or EndStreamPrimitive, and because the query state machine tracks
+            // one active query per TARGET rather than per (target, stream). That is 14 new
+            // failures against 2 gained limits passes, and a 4 nothing can back is the
+            // advertised-caps lie with the sign flipped.
+            //
+            // The real fix is the feature, not the number: per-stream capture needs
+            // layout(stream = N) through the transpiler plus per-(target, stream) query slots,
+            // which DirectVulkan could back with VK_EXT_transform_feedback's geometryStreams and
+            // DirectGLES cannot back at all (ES has no vertex streams). Until that lands, one is
+            // the honest count and every stream-addressing entry point bounds itself by THIS
+            // query, so raising it later moves them all together.
+            *params = kFrontendMaxVertexStreams;
             break;
         case GL_TRANSFORM_FEEDBACK_ACTIVE:
             *params = MG_State::pGLContext->IsTransformFeedbackActive() ? 1 : 0;
@@ -2357,15 +2687,36 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_TEXTURE_SIZE:
             *params = dynamicParameters.MaxTextureSize;
             break;
-        case GL_MAX_UNIFORM_BUFFER_BINDINGS:
+        case GL_MAX_UNIFORM_BUFFER_BINDINGS: {
             // Never advertise more bindings than the state layer's indexed-binding array can track
             // (BufferState::BufferBindingPointCount): glBindBufferBase rejects indices past that
             // capacity, and the GL CTS per-case state reset calls glBindBufferBase on every
-            // advertised index and expects no error. The floor equals the GL 3.3 core minimum
+            // advertised index and expects no error. The floor is the GL 4.5 core minimum, and
-            // (36), so the clamp never under-advertises.
+            // the array was widened to exactly it, so the two coincide by construction.
+            //
+            // WHY THE BACKEND'S OWN COUNT IS NOT THE CEILING HERE, unlike the shader-storage
+            // family. A GL uniform binding point is where an APPLICATION parks a buffer; it is
+            // not a driver binding point. Neither backend forwards it as one on the draw path:
+            // DirectGLES rebinds the blocks a program declares onto COMPACTED ES points
+            // (BindCurrentProgramWithResources maps block i to ES point i+1) and DirectVulkan
+            // resolves each block to a descriptor. So what the host driver's count bounds is how
+            // many blocks ONE PROGRAM may use, not how many points an application may bind.
+            //
+            // That per-program number is NOT GL_MAX_COMBINED_UNIFORM_BLOCKS (84, the six-stage
+            // sum): no single program can reach it. A graphics program is bounded by the five
+            // graphics stages' per-stage counts, 14 each, so 70 blocks plus the global UBO at ES
+            // point 0 = 71 - inside the ES 3.2 minimum of 72. A compute program is bounded by
+            // GL_MAX_COMPUTE_UNIFORM_BLOCKS, which on DirectGLES is the ES driver's own count
+            // (GL-scale, ~14) and on DirectVulkan is served from descriptors with no ES binding
+            // points involved. Raising any per-stage graphics count past 14 is what would break
+            // this, so that is the edit to check against the ES ceiling - not this one.
+            static_assert(static_cast<GLint>(MG_State::GLState::BufferBindingPointCount) >=
+                              kFrontendMinUniformBufferBindings,
+                          "the indexed-binding array must be able to hold every advertised uniform binding point");
             *params = std::clamp(dynamicParameters.MaxUniformBufferBindings, kFrontendMinUniformBufferBindings,
                                  static_cast<GLint>(MG_State::GLState::BufferBindingPointCount));
             break;
+        }
         case GL_MAX_UNIFORM_BLOCK_SIZE:
             *params = dynamicParameters.MaxUniformBlockSize;
             break;
@@ -2403,7 +2754,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = static_cast<GLint>(dynamicParameters.PointSizeGranularity);
             break;
         case GL_SHADER_STORAGE_BUFFER_OFFSET_ALIGNMENT:
-            *params = static_cast<GLint>(dynamicParameters.UniformBufferOffsetAlignment);
+            // The STORAGE alignment, which is its own limit - this used to answer with the
+            // uniform one. They differ on real hardware (Adreno 830: 32 uniform, 64 storage), and
+            // under-reporting it is silent: ValidateBindBufferRange accepts the offset, the ES
+            // driver accepts it too without raising an error, and the shader's writes then land
+            // at an address the application never bound.
+            *params = static_cast<GLint>(dynamicParameters.ShaderStorageBufferOffsetAlignment);
             break;
         case GL_SMOOTH_LINE_WIDTH_RANGE:
             params[0] = static_cast<GLint>(dynamicParameters.SmoothLineWidthRangeMin);

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.h

@@ -25,7 +25,24 @@ namespace MobileGL::MG_Impl::GLImpl {
     GLenum GetError();
     GLenum GetGraphicsResetStatus();
     // The GL_MAX_SAMPLES value MobileGL advertises, i.e. the driver's value floored to the GL
-    // core minimum. Frontend multisample validators have to honour this ceiling for every
+    // core minimum of 4. This is the RENDERBUFFER ceiling; the three per-category texture
-    // format, otherwise MobileGL rejects a sample count it advertised itself.
+    // ceilings below have a minimum of one and are reported as probed.
     GLint GetAdvertisedMaxSamples();
+    // Exactly what GL_MAX_COLOR_TEXTURE_SAMPLES / GL_MAX_DEPTH_TEXTURE_SAMPLES /
+    // GL_MAX_INTEGER_SAMPLES report: the probed backend limit floored at the GL 4.6 core minimum
+    // of ONE (table 23.53). Exported so the frontend's storage validation enforces exactly what
+    // the query promised - it used to floor both at 4 and then let the backend quietly
+    // under-allocate whatever the driver could not actually provide.
+    GLint GetAdvertisedColorTextureMaxSamples();
+    GLint GetAdvertisedDepthTextureMaxSamples();
+    GLint GetAdvertisedIntegerMaxSamples();
+    // What glGetIntegerv(GL_SAMPLES) answers for the CURRENT draw framebuffer: the largest sample
+    // count over its attachments, and 0 for a single-sample or default framebuffer (GL 4.6 core
+    // 9.2.3 / 22.2 - GL_SAMPLE_BUFFERS is 1 exactly when this is non-zero).
+    //
+    // Shared rather than duplicated because two callers need the identical number and disagreeing
+    // would be a silent bug: the query itself, and the draw path's write of the reserved
+    // gl_NumSamples stand-in - a shader comparing gl_NumSamples against glGetIntegerv(GL_SAMPLES)
+    // is exactly what the sample_variables CTS does.
+    GLint ResolveDrawFramebufferSampleCount();
 } // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Program/GL_Program.cpp

@@ -11,6 +11,8 @@
 #include "Config.h"
 #include <cmath>
 #include <limits>
+#include <set>
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_Impl/GLImpl/VertexArray/Validators.h>
 #include <MG_State/GLState/Core.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
@@ -19,6 +21,7 @@
 #include <MG_Util/Converters/SPIRVCrossToGL/SpvcTypeConverter.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Backend/BackendObjects.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     // The flattened uniform type these helpers used to take as a raw glslang::TType*
@@ -30,10 +33,22 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     static bool CheckShaderNameValidity(Uint shader) {
         if (shader == 0 || !MG_State::pGLContext->ValidateShaderName(shader)) {
+            // The mirror of CheckProgramNameValidity below, and for the same reason: programs and
+            // shaders are drawn from ONE name space (ProgramState hands both out of a single
+            // generator), so a name that exists but belongs to a PROGRAM is the wrong kind of
+            // object - GL 3.3 core 2.11.x makes that INVALID_OPERATION - while a name GL never
+            // handed out is INVALID_VALUE. This half of the split was missing, so every shader
+            // entry point handed a program name reported INVALID_VALUE; the conformance suite
+            // reads exactly that code back from glSpecializeShader.
+            const ErrorCode error = (shader != 0 && MG_State::pGLContext->ValidateProgramName(shader))
+                ? ErrorCode::InvalidOperation
+                : ErrorCode::InvalidValue;
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue,
+                error,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                             std::to_string(shader) + " is not a valid name."));
+                                             std::to_string(shader) +
+                                                 (error == ErrorCode::InvalidOperation ? " is not a shader object."
+                                                                                       : " is not a valid name.")));
             return false;
         }
         return true;
@@ -245,6 +260,30 @@ namespace MobileGL::MG_Impl::GLImpl {
         return true;
     }
 
+    // GL 4.6 core 7.6.3: INVALID_VALUE when uniformBlockBinding >= MAX_UNIFORM_BUFFER_BINDINGS.
+    // The storage-block twin below has always had this check; the uniform one never did, and the
+    // value it stores is used as a RAW SUBSCRIPT into the state layer's fixed indexed-binding
+    // array on every draw and dispatch (DirectGLES's per-program UBO rebind, DirectVulkan's
+    // descriptor resolve, whose only guard is a MOBILEGL_ASSERT that compiles away in release).
+    // An out-of-range binding therefore did not merely go unreported - it read past the array and
+    // dereferenced whatever SharedPtr it found there.
+    bool ValidateUniformBlockBinding(GLuint binding) {
+        // Exactly what glGetIntegerv(GL_MAX_UNIFORM_BUFFER_BINDINGS) advertises: the state
+        // layer's array width, which the getter clamps to as well.
+        const SizeT maxBindingCount = MG_State::pGLContext->GetBufferBindingPointCount(BufferTarget::Uniform);
+        if (binding < maxBindingCount) {
+            return true;
+        }
+
+        MG_State::pGLContext->RecordError(
+            ErrorCode::InvalidValue,
+            MakeUnique<GenericErrorInfo>(
+                "MG_Impl/GLImpl", __func__,
+                std::format("Uniform block binding {} is not less than GL_MAX_UNIFORM_BUFFER_BINDINGS ({}).", binding,
+                            maxBindingCount)));
+        return false;
+    }
+
     bool ValidateShaderStorageBlockBinding(GLuint binding) {
         SizeT maxBindingCount = MG_State::pGLContext->GetBufferBindingPointCount(BufferTarget::ShaderStorage);
         if (MG_Backend::pActiveBackendObject) {
@@ -307,9 +346,195 @@ namespace MobileGL::MG_Impl::GLImpl {
     void CompileShader_State(GLuint shader) {
         auto& shaderObject = TryToGetShaderObject(shader);
         if (!shaderObject) return;
+        // ARB_gl_spirv: "INVALID_OPERATION is generated by CompileShader if shader has been
+        // associated with a SPIR-V binary". Such an object has no GLSL source to compile - it is
+        // waiting for glSpecializeShader, which is the operation that compiles it.
+        if (shaderObject->HasSpirvBinary()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", __func__,
+                    "shader " + std::to_string(shader) +
+                        " holds a SPIR-V binary; use glSpecializeShader instead of glCompileShader."));
+            return;
+        }
         shaderObject->Compile();
     }
 
+    // ---------------------------------------------------------------------------------------
+    // GL_ARB_gl_spirv
+    // ---------------------------------------------------------------------------------------
+
+    void ShaderBinary_State(GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary,
+                            GLsizei length) {
+        if (count < 0 || length < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "count and length must be non-negative."));
+            return;
+        }
+        // GL_NUM_SHADER_BINARY_FORMATS advertises exactly one format, so every other value is
+        // INVALID_ENUM (GL 4.6 core 7.2). This is the check that used to be missing entirely -
+        // the entry point was a silent stub, so an application handed a format nothing supports
+        // and was told nothing.
+        if (binaryformat != GL_SHADER_BINARY_FORMAT_SPIR_V) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "binaryformat must be GL_SHADER_BINARY_FORMAT_SPIR_V."));
+            return;
+        }
+        if (count == 0) return;
+        if (shaders == nullptr || (length > 0 && binary == nullptr)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "shaders and binary must not be null."));
+            return;
+        }
+        // A SPIR-V module is a sequence of 32-bit words, so a length that is not a multiple of
+        // four cannot be one (ARB_gl_spirv makes this INVALID_VALUE).
+        if ((length % 4) != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "length must be a multiple of four for a SPIR-V module."));
+            return;
+        }
+
+        // EVERY name is validated before ANY of them is written: the entry point is all-or-
+        // nothing, and half-applying it would leave some objects holding a module the call was
+        // rejected for. The duplicate check is the extension's own ("INVALID_VALUE ... if the
+        // same shader object is specified more than once").
+        std::set<GLuint> seen;
+        for (GLsizei i = 0; i < count; ++i) {
+            if (!seen.insert(shaders[i]).second) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 "shader " + std::to_string(shaders[i]) +
+                                                     " appears more than once in `shaders`."));
+                return;
+            }
+            if (!MG_State::pGLContext->ValidateShaderName(shaders[i])) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 std::to_string(shaders[i]) + " is not the name of a shader object."));
+                return;
+            }
+        }
+
+        const SizeT wordCount = static_cast<SizeT>(length) / 4;
+        Vector<Uint32> module(wordCount);
+        if (wordCount != 0) {
+            Memcpy(module.data(), binary, static_cast<SizeT>(length));
+        }
+        // spirv-val here, not at glSpecializeShader: this is where the words arrive, and past it
+        // they reach SPIRV-Cross, which parses rather than validates. ARB_gl_spirv lets an
+        // implementation reject an invalid module at either call; rejecting at the earlier one
+        // means the application's error is reported next to the data that caused it.
+        if (const auto validated = MG_Util::ShaderTranspiler::ShaderCompiler::ValidateSpirvModule(module);
+            !validated) {
+            MGLOG_D("%s: rejected SPIR-V module: %s", __func__, validated.error().log.c_str());
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, validated.error().log));
+            return;
+        }
+
+        for (GLsizei i = 0; i < count; ++i) {
+            auto& shaderObject = TryToGetShaderObject(shaders[i]);
+            if (!shaderObject) continue;
+            // A copy per object, not a shared buffer: each shader object may be specialized with
+            // different constants, and each specialization re-reads its own original words.
+            Vector<Uint32> perObject = module;
+            shaderObject->SetSpirvBinary(Move(perObject));
+        }
+    }
+
+    void SpecializeShader_State(GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants,
+                                const GLuint* pConstantIndex, const GLuint* pConstantValue) {
+        auto& shaderObject = TryToGetShaderObject(shader);
+        if (!shaderObject) return;
+        if (!shaderObject->HasSpirvBinary()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "shader " + std::to_string(shader) +
+                                                 " has no SPIR-V binary; call glShaderBinary first."));
+            return;
+        }
+        // ARB_gl_spirv: a shader that has already been specialized may not be specialized again
+        // until glShaderBinary re-associates a module with it.
+        if (shaderObject->HasBeenSpecialized()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "shader " + std::to_string(shader) +
+                                                 " has already been specialized; re-associate its module with "
+                                                 "glShaderBinary before specializing it again."));
+            return;
+        }
+        // pEntryPoint names the entry point to specialize; there is no default. A null pointer
+        // cannot name one, and neither can the empty string.
+        if (pEntryPoint == nullptr || *pEntryPoint == '\0') {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "pEntryPoint must name an entry point."));
+            return;
+        }
+        if (numSpecializationConstants > 0 && (pConstantIndex == nullptr || pConstantValue == nullptr)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "pConstantIndex and pConstantValue must not be null."));
+            return;
+        }
+        // "INVALID_VALUE is generated if any value in pConstantIndex is repeated" - checked before
+        // anything is applied, for the same all-or-nothing reason glShaderBinary checks its names
+        // up front.
+        Vector<Uint32> constantIds(pConstantIndex, pConstantIndex + numSpecializationConstants);
+        Vector<Uint32> constantValues(pConstantValue, pConstantValue + numSpecializationConstants);
+        {
+            std::set<Uint32> seen;
+            for (const Uint32 id : constantIds) {
+                if (seen.insert(id).second) continue;
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 "constant index " + std::to_string(id) + " is repeated."));
+                return;
+            }
+        }
+
+        const String entryPoint(pEntryPoint);
+        const GLenum shaderType = MG_Util::ConvertShaderStageToGLEnum(shaderObject->GetShaderStage());
+        using SpecializationFailure = MG_Util::ShaderTranspiler::ShaderCompiler::SpecializationFailure;
+        SpecializationFailure failure = SpecializationFailure::None;
+        auto specialized = MG_Util::ShaderTranspiler::ShaderCompiler::SpecializeAndDecompileSpirvModule(
+            shaderObject->GetSpirvBinary(), shaderType, entryPoint, constantIds, constantValues, failure);
+        if (!specialized) {
+            MGLOG_D("%s: specialization failed for shader %u: %s", __func__, shader,
+                    specialized.error().log.c_str());
+            // The two conditions ARB_gl_spirv ENUMERATES are GL errors, and an erroring GL command
+            // must have no other effect - so the shader object is left exactly as it was rather
+            // than being pushed into a failed-compile state. Anything else is a genuine compile
+            // failure of a well-formed request, which the extension routes through COMPILE_STATUS
+            // and the info log exactly as glCompileShader does.
+            if (failure == SpecializationFailure::UnknownEntryPoint ||
+                failure == SpecializationFailure::UnknownConstantId) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, specialized.error().log));
+                return;
+            }
+            shaderObject->RecordSpecializationFailure(String(specialized.error().log));
+            return;
+        }
+        shaderObject->SpecializeFromSpirv(Move(specialized.value().glsl), Move(specialized.value().xfbVaryings),
+                                          specialized.value().xfbBufferMode);
+    }
+
     // glMaxShaderCompilerThreadsKHR / glMaxShaderCompilerThreadsARB - one implementation,
     // because GL_KHR_parallel_shader_compile and GL_ARB_parallel_shader_compile define the
     // same entry point with the same semantics and GetProcAddress.cpp maps both spellings.
@@ -744,12 +969,77 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = programObject->GetBinaryRetrievableHint() ? GL_TRUE : GL_FALSE;
             break;
         case GL_PROGRAM_SEPARABLE:
-            *params = programObject->GetSeparable() ? GL_TRUE : GL_FALSE;
+            // The LATCHED flag, not the live one: glProgramParameteri's write takes effect at the
+            // next link (GL 4.6 core 7.3), so a program told to be separable and then never
+            // linked still reports GL_FALSE.
+            *params = programObject->GetLinkedSeparable() ? GL_TRUE : GL_FALSE;
             break;
 
+        // The geometry and tessellation link properties (GL 4.6 core table 23.35). Same shape as
+        // GL_COMPUTE_WORK_GROUP_SIZE above, and for the same reason: "a linked program object
+        // with a geometry shader" is one whose EXECUTABLE has the stage, so an
+        // attached-but-not-yet-linked shader must give INVALID_OPERATION rather than the previous
+        // link's value. The geometry three used to be listed here only to fall through into the
+        // INVALID_ENUM default, and the tessellation five were not listed at all.
         case GL_GEOMETRY_VERTICES_OUT:
         case GL_GEOMETRY_INPUT_TYPE:
         case GL_GEOMETRY_OUTPUT_TYPE:
+        case GL_GEOMETRY_SHADER_INVOCATIONS: {
+            if (!programObject->GetLinkStatus() || !programObject->HasLinkedShaderStage(ShaderStage::Geometry)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 std::to_string(program) +
+                                                     " is not a linked program object with a geometry shader."));
+                return;
+            }
+            switch (pname) {
+            case GL_GEOMETRY_VERTICES_OUT: *params = programObject->GetGeometryVerticesOut(); break;
+            case GL_GEOMETRY_INPUT_TYPE: *params = static_cast<GLint>(programObject->GetGeometryInputType()); break;
+            case GL_GEOMETRY_OUTPUT_TYPE: *params = static_cast<GLint>(programObject->GetGeometryOutputType()); break;
+            default: *params = programObject->GetGeometryShaderInvocations(); break;
+            }
+            MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
+            break;
+        }
+        case GL_TESS_CONTROL_OUTPUT_VERTICES: {
+            if (!programObject->GetLinkStatus() || !programObject->HasLinkedShaderStage(ShaderStage::TessControl)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", __func__,
+                        std::to_string(program) +
+                            " is not a linked program object with a tessellation control shader."));
+                return;
+            }
+            *params = programObject->GetTessControlOutputVertices();
+            MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
+            break;
+        }
+        case GL_TESS_GEN_MODE:
+        case GL_TESS_GEN_SPACING:
+        case GL_TESS_GEN_VERTEX_ORDER:
+        case GL_TESS_GEN_POINT_MODE: {
+            if (!programObject->GetLinkStatus() || !programObject->HasLinkedShaderStage(ShaderStage::TessEval)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", __func__,
+                        std::to_string(program) +
+                            " is not a linked program object with a tessellation evaluation shader."));
+                return;
+            }
+            switch (pname) {
+            case GL_TESS_GEN_MODE: *params = static_cast<GLint>(programObject->GetTessGenMode()); break;
+            case GL_TESS_GEN_SPACING: *params = static_cast<GLint>(programObject->GetTessGenSpacing()); break;
+            case GL_TESS_GEN_VERTEX_ORDER:
+                *params = static_cast<GLint>(programObject->GetTessGenVertexOrder());
+                break;
+            default: *params = programObject->GetTessGenPointMode() ? GL_TRUE : GL_FALSE; break;
+            }
+            MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
+            break;
+        }
         default:
             MGLOG_D("%s: %s", __func__, MG_Util::ConvertGLEnumToString(pname).c_str());
             MG_State::pGLContext->RecordError(
@@ -811,8 +1101,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             *params = shaderObject->GetInfoLog().empty() ? 0 : (GLint)shaderObject->GetInfoLog().length() + 1;
             break;
-        case GL_SHADER_SOURCE_LENGTH:
+        case GL_SHADER_SOURCE_LENGTH: {
-            *params = shaderObject->GetShaderSource().empty() ? 0 : (GLint)shaderObject->GetShaderSource().length() + 1;
+            // The APPLICATION's source, which is empty for a shader that came from glShaderBinary -
+            // see ShaderObject::GetApplicationShaderSource.
+            const auto& source = shaderObject->GetApplicationShaderSource();
+            *params = source.empty() ? 0 : (GLint)source.length() + 1;
+            break;
+        }
+        // GL_ARB_gl_spirv. GL_SPIR_V_BINARY and GL_SPIR_V_BINARY_ARB are the same token: TRUE
+        // while the object stands for an application-supplied module. It is the FIRST thing the
+        // conformance suite asks after glShaderBinary, and it used to fall into the terminal
+        // default arm below and take the whole test with it.
+        case GL_SPIR_V_BINARY:
+            *params = shaderObject->HasSpirvBinary() ? GL_TRUE : GL_FALSE;
             break;
         // GL_KHR_parallel_shader_compile. THIS CASE MUST NOT JOIN - see the identical case in
         // GetProgramiv_State. GL_COMPILE_STATUS two cases up deliberately DOES join (it has
@@ -858,13 +1159,23 @@ namespace MobileGL::MG_Impl::GLImpl {
         auto& shaderObject = TryToGetShaderObject(shader);
         if (!shaderObject) return;
 
-        auto& src = shaderObject->GetShaderSource();
+        auto& src = shaderObject->GetApplicationShaderSource();
         CopyStr(bufSize, length, source, src.c_str(), (GLsizei)src.length());
     }
 
     GLint GetUniformLocation_State(GLuint program, const GLchar* name) {
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return -1;
+        // GL 4.6 core 7.6: "INVALID_OPERATION is generated if program has not been successfully
+        // linked". Answering -1 silently is not the same thing - the conformance suite reads the
+        // error, not the location.
+        if (!programObject->GetLinkStatus()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "program " + std::to_string(program) + " is not linked."));
+            return -1;
+        }
         auto loc = programObject->GetUniformLocation(name);
         MGLOG_D("%s: loc %02d = %s", __func__, loc, name);
         return loc;
@@ -1277,11 +1588,13 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     template <GLsizei ItemCount, typename T>
     void ProgramUniformv_State(GLuint program, GLint location, GLsizei count, T* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
+        // The link check comes BEFORE the location == -1 early-out, not after. GL 4.6 core 7.6
+        // makes an unlinked program INVALID_OPERATION regardless of the location, and -1 is
+        // exactly the location an application holds after glGetUniformLocation on such a program -
+        // so checking -1 first swallowed the very case the rule exists for.
         if (!programObject->GetLinkStatus()) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
@@ -1289,6 +1602,10 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        // "If location is equal to -1, the data passed in will be silently ignored and the
+        // specified uniform variable will not be changed" - after the program itself has been
+        // found acceptable.
+        if (location == -1) return;
 
         for (GLint offset = 0; offset < count; offset++) {
             if (offset > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + offset)) {
@@ -1699,8 +2016,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                        const GLfloat* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1712,14 +2027,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         UniformMatrixfv_Object(*programObject, __func__, location, count, transpose, value, 2, 2,
                                "program " + std::to_string(program));
     }
 
     void ProgramUniformMatrix3fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                        const GLfloat* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1731,6 +2046,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         for (GLint i = 0; i < count; i++) {
             if (i > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + i)) {
                 // Values for elements beyond the end of the uniform array are ignored.
@@ -1756,8 +2073,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                        const GLfloat* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1769,6 +2084,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         for (GLint i = 0; i < count; i++) {
             if (i > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + i)) {
                 // Values for elements beyond the end of the uniform array are ignored.
@@ -1790,8 +2107,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrixNonSquarefv_State(const char* caller, GLuint program, GLint location, GLsizei count,
                                                GLboolean transpose, const GLfloat* value, Int columns, Int rows) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1803,6 +2118,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         UniformMatrixfv_Object(*programObject, caller, location, count, transpose, value, columns, rows,
                                "program " + std::to_string(program));
     }
@@ -1836,6 +2153,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Program object" + std::to_string(program) + " that has been linked."));
             return;
         }
+        if (!ValidateUniformBlockBinding(uniformBlockBinding)) return;
         if (!programObject->IsActiveGlUniformBlock(uniformBlockIndex)) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
@@ -2083,6 +2401,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         BindAttribLocation_State(program, index, name);
     }
 
+    void ShaderBinary(GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length) {
+        ShaderBinary_State(count, shaders, binaryformat, binary, length);
+    }
+
+    void SpecializeShader(GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants,
+                          const GLuint* pConstantIndex, const GLuint* pConstantValue) {
+        SpecializeShader_State(shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue);
+    }
+
     void CompileShader(GLuint shader) {
         CompileShader_State(shader);
     }
@@ -2342,7 +2669,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2352,6 +2678,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 2, 2);
     }
     void UniformMatrix3dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2368,7 +2695,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix3dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2378,6 +2704,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 3, 3);
     }
     void UniformMatrix4dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2394,7 +2721,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2404,6 +2730,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 4, 4);
     }
     void UniformMatrix2x3dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2420,7 +2747,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2x3dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2430,6 +2756,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 2, 3);
     }
     void UniformMatrix2x4dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2446,7 +2773,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2x4dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2456,6 +2782,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 2, 4);
     }
     void UniformMatrix3x2dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2472,7 +2799,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix3x2dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2482,6 +2808,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 3, 2);
     }
     void UniformMatrix3x4dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2498,7 +2825,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix3x4dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2508,6 +2834,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 3, 4);
     }
     void UniformMatrix4x2dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2524,7 +2851,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4x2dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2534,6 +2860,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 4, 2);
     }
     void UniformMatrix4x3dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2550,7 +2877,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4x3dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2560,6 +2886,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 4, 3);
     }
     void GetUniformdv(GLuint program, GLint location, GLdouble* params) {
@@ -3072,6 +3399,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Backend does not support shader storage block binding."));
             return;
         }
+        MGP_FILL(ShaderStorageBlockBinding);
         shaderStorageBlockBinding(program, blockName.c_str(), storageBlockBinding);
     }
 

MobileGL/MG_Impl/GLImpl/Program/GL_Program.h

@@ -13,6 +13,12 @@ namespace MobileGL::MG_Impl::GLImpl {
     void AttachShader(GLuint program, GLuint shader);
     void BindAttribLocation(GLuint program, GLuint index, const GLchar* name);
     void CompileShader(GLuint shader);
+    // GL_ARB_gl_spirv, core since 4.6. The pair is a two-step operation: glShaderBinary attaches
+    // the module to one or more shader objects, glSpecializeShader names its entry point and
+    // supplies its specialization constants and is what actually compiles them.
+    void ShaderBinary(GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length);
+    void SpecializeShader(GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants,
+                          const GLuint* pConstantIndex, const GLuint* pConstantValue);
     GLuint CreateProgram(void);
     GLuint CreateShader(GLenum type);
     void DeleteProgram(GLuint program);

MobileGL/MG_Impl/GLImpl/Program/GL_ProgramPipeline.cpp

@@ -192,6 +192,15 @@ namespace MobileGL::MG_Impl::GLImpl {
                                     std::format("Program {} has not been linked successfully.", program));
                 return;
             }
+            // GL 4.6 core 7.4: "INVALID_OPERATION is generated if program was not linked with its
+            // PROGRAM_SEPARABLE status set". The LATCHED flag is the one that decides - a program
+            // whose live flag was cleared after a separable link is still a legal stage, and a
+            // program whose live flag was set after a non-separable link is not.
+            if (!programObject->GetLinkedSeparable()) {
+                RecordPipelineError(ErrorCode::InvalidOperation, __func__,
+                                    std::format("Program {} was not linked as a separable program.", program));
+                return;
+            }
         }
 
         const GLbitfield selected = stages == GL_ALL_SHADER_BITS ? kAllStageBits : stages;

MobileGL/MG_Impl/GLImpl/Query/GL_Query.cpp

@@ -12,6 +12,7 @@
 #include <MG_Backend/BackendObjects.h>
 #include <MG_State/GLState/Core.h>
 #include <MG_State/GLState/ErrorState/ErrorInfo.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -59,6 +60,62 @@ namespace MobileGL::MG_Impl::GLImpl {
         GLuint g_activePrimitivesGeneratedQueryId = 0;
         // Id of the query active on GL_SAMPLES_PASSED (0 = none).
         GLuint g_activeSamplesPassedQueryId = 0;
+        // Ids of the queries active on the GL_ARB_pipeline_statistics_query targets, one slot per
+        // target (0 = none). A map rather than a field per target: the eleven behave identically
+        // and none of them has any state beyond "which object is counting".
+        UnorderedMap<GLenum, GLuint> g_activePipelineStatisticsQueryIds;
+
+        // Whether MobileGL puts GL_ARB_tessellation_shader in its extension string. Read from the
+        // ADVERTISED list rather than from a capability bit for the same reason
+        // BackendSupportsTextureViews does (GL_Texture.cpp): it makes "MobileGL claims tessellation
+        // support" and "the tessellation-conditional API surface is open" the same fact by
+        // construction, so the day a backend starts advertising the string the surface below opens
+        // with it and no second edit is owed.
+        Bool AdvertisesTessellationShaderExtension() {
+            const auto& activeBackendObject = MG_Backend::pActiveBackendObject;
+            if (!activeBackendObject) return false;
+            const auto& extensions = activeBackendObject->GetRendererInfo().RendererGLInfo.Extensions;
+            return std::find(extensions.begin(), extensions.end(), E_GL_ARB_tessellation_shader) != extensions.end();
+        }
+
+        // The eleven pipeline-statistics counters (GL 4.6 core table 4.3 / ARB_pipeline_statistics_query).
+        // A 4.6 core context ACCEPTS the nine unconditional ones at glBeginQuery - there is no query
+        // by which an application could learn otherwise before calling. MobileGL instruments none of
+        // them, and says so the way GL 4.6 core 4.2.1 provides for: GL_QUERY_COUNTER_BITS answers
+        // zero for these targets, which is the spec's own signal that the counter is unsupported and
+        // its results indeterminate. That is an honest zero, not an advertised capability - the
+        // alternative, GL_INVALID_ENUM on a core entry point, is both non-conformant AND less
+        // informative.
+        //
+        // The two TESSELLATION targets are the exception, because ARB_pipeline_statistics_query
+        // makes them conditional on tessellation support rather than unconditional, and the only
+        // thing an application (or the conformance suite) can read to decide whether an
+        // implementation has it is the GL_ARB_tessellation_shader string. MobileGL does not emit it
+        // today, so these two answer GL_INVALID_ENUM: an API surface that accepts a
+        // tessellation-conditional token while withholding the string that announces the condition
+        // is self-contradictory, and it is the contradiction the suite catches
+        // (KHR-GL46.pipeline_statistics_query_tests_ARB.api_coverage_unsupported_calls, whose
+        // support probe is gl4cPipelineStatisticsQueryTests.cpp:1166-1176). The gate is the
+        // advertisement itself, not a hardcoded "no", so this is one switch and not two.
+        Bool IsPipelineStatisticsQueryTarget(GLenum target) {
+            switch (target) {
+            case GL_VERTICES_SUBMITTED:
+            case GL_PRIMITIVES_SUBMITTED:
+            case GL_VERTEX_SHADER_INVOCATIONS:
+            case GL_GEOMETRY_SHADER_INVOCATIONS:
+            case GL_GEOMETRY_SHADER_PRIMITIVES_EMITTED:
+            case GL_FRAGMENT_SHADER_INVOCATIONS:
+            case GL_COMPUTE_SHADER_INVOCATIONS:
+            case GL_CLIPPING_INPUT_PRIMITIVES:
+            case GL_CLIPPING_OUTPUT_PRIMITIVES:
+                return true;
+            case GL_TESS_CONTROL_SHADER_PATCHES:
+            case GL_TESS_EVALUATION_SHADER_INVOCATIONS:
+                return AdvertisesTessellationShaderExtension();
+            default:
+                return false;
+            }
+        }
 
         Bool TimerQueryDisabled() {
             return MG_Config::Features.DisableTimerQuery;
@@ -108,6 +165,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         void ResetQueryObjectLocked(QueryObject* queryObject) {
             if (queryObject->backendHandle) {
                 if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                    MGP_FILL(DeleteBackendQuery);
                     deleteBackendQuery(queryObject->backendHandle);
                 }
                 queryObject->backendHandle = nullptr;
@@ -122,6 +180,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         void EndTimeElapsedQueryLocked(QueryObject* queryObject) {
             const auto endTimeElapsedQuery = MG_Backend::gBackendFunctionsTable.GL.EndTimeElapsedQuery;
             if (endTimeElapsedQuery && queryObject->backendHandle) {
+                MGP_FILL(EndTimeElapsedQuery);
                 endTimeElapsedQuery(queryObject->backendHandle);
             }
             queryObject->active = false;
@@ -201,6 +260,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 }
                 Uint64 result = 0;
                 const auto getQueryResult64 = MG_Backend::gBackendFunctionsTable.GL.GetQueryResult64;
+                MGP_FILL(GetQueryResult64);
                 if (queryObject->backendHandle && getQueryResult64 &&
                     !getQueryResult64(queryObject->backendHandle, /*wait=*/false, &result)) {
                     // Not ready. The whole point of the no-wait form is that the caller's
@@ -215,6 +275,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 }
                 if (queryObject->backendHandle) {
                     if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        MGP_FILL(DeleteBackendQuery);
                         deleteBackendQuery(queryObject->backendHandle);
                     }
                     queryObject->backendHandle = nullptr;
@@ -230,6 +291,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                     return true;
                 }
                 const auto isQueryResultAvailable = MG_Backend::gBackendFunctionsTable.GL.IsQueryResultAvailable;
+                MGP_FILL(IsQueryResultAvailable);
                 outValue = (!isQueryResultAvailable || isQueryResultAvailable(queryObject->backendHandle)) ? 1 : 0;
                 return true;
             }
@@ -241,6 +303,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                 Uint64 result = 0;
                 if (queryObject->backendHandle) {
                     const auto getQueryResult64 = MG_Backend::gBackendFunctionsTable.GL.GetQueryResult64;
+                    MGP_FILL(GetQueryResult64);
                     if (getQueryResult64 &&
                         !getQueryResult64(queryObject->backendHandle, /*wait=*/true, &result)) {
                         // The backend could not produce the result YET (e.g. a
@@ -261,6 +324,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                     // query degrades to a zero result); the backend handle is
                     // consumed and the value cached for later reads.
                     if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        MGP_FILL(DeleteBackendQuery);
                         deleteBackendQuery(queryObject->backendHandle);
                     }
                     queryObject->backendHandle = nullptr;
@@ -366,10 +430,14 @@ namespace MobileGL::MG_Impl::GLImpl {
                     queryObject->target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) {
                     if (const auto endOcclusionQuery = MG_Backend::gBackendFunctionsTable.GL.EndOcclusionQuery;
                         endOcclusionQuery && queryObject->backendHandle) {
+                        MGP_FILL(EndOcclusionQuery);
                         endOcclusionQuery(queryObject->backendHandle);
                     }
                     queryObject->active = false;
                     g_activeSamplesPassedQueryId = 0;
+                } else if (IsPipelineStatisticsQueryTarget(queryObject->target)) {
+                    queryObject->active = false;
+                    g_activePipelineStatisticsQueryIds[queryObject->target] = 0;
                 } else if (queryObject->target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ||
                            queryObject->target == GL_PRIMITIVES_GENERATED) {
                     queryObject->active = false;
@@ -382,6 +450,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             if (queryObject->backendHandle) {
                 if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                    MGP_FILL(DeleteBackendQuery);
                     deleteBackendQuery(queryObject->backendHandle);
                 }
                 queryObject->backendHandle = nullptr;
@@ -410,7 +479,9 @@ namespace MobileGL::MG_Impl::GLImpl {
             (target == GL_SAMPLES_PASSED || target == GL_ANY_SAMPLES_PASSED ||
              target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) &&
             MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery != nullptr;
-        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery) {
+        const Bool isPipelineStatisticsQuery = IsPipelineStatisticsQueryTarget(target);
+        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery &&
+            !isPipelineStatisticsQuery) {
             // GL_TIMESTAMP is not a valid BeginQuery target; the occlusion targets
             // need backend support.
             RecordQueryError(ErrorCode::InvalidEnum, __FUNCTION__, "Query target is not supported.");
@@ -426,10 +497,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "Query object does not exist.");
             return;
         }
-        GLuint& activeQueryId = isTransformFeedbackQuery
+        GLuint& activeQueryId = isPipelineStatisticsQuery
-            ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
+            ? g_activePipelineStatisticsQueryIds[target]
-                                                                  : g_activePrimitivesGeneratedQueryId)
+            : (isTransformFeedbackQuery
-            : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId);
+                   ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
+                                                                         : g_activePrimitivesGeneratedQueryId)
+                   : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId));
         if (activeQueryId != 0) {
             RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__,
                              "A query is already active on this target.");
@@ -448,10 +521,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         ResetQueryObjectLocked(queryObject); // discard any previous result
         queryObject->target = target;
         queryObject->active = true;
-        if (isTransformFeedbackQuery) {
+        if (isPipelineStatisticsQuery) {
+            // Nothing to start: the counter is uninstrumented and GL_QUERY_COUNTER_BITS says so.
+            // The object still becomes a real, target-latched query so every other rule about it
+            // (re-use with another target, double-begin, EndQuery pairing) keeps holding.
+        } else if (isTransformFeedbackQuery) {
             // Prefer real GPU transform-feedback queries (exact with geometry shaders);
             // the CPU accounting delta stays as the fallback when the backend lacks them.
             const auto beginXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.BeginXfbPrimitivesQuery;
+            MGP_FILL(BeginXfbPrimitivesQuery);
             queryObject->backendHandle =
                 beginXfbPrimitivesQuery ? beginXfbPrimitivesQuery(target == GL_PRIMITIVES_GENERATED) : nullptr;
             queryObject->counterSnapshot = TransformFeedbackCounterForTarget(target);
@@ -460,9 +538,11 @@ namespace MobileGL::MG_Impl::GLImpl {
             queryObject->geometryCaptureDrawSnapshot =
                 MG_State::pGLContext->GetTransformFeedbackGeometryCaptureDraws();
         } else if (isOcclusionQuery) {
+            MGP_FILL(BeginOcclusionQuery);
             queryObject->backendHandle = MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery();
         } else {
             const auto beginTimeElapsedQuery = MG_Backend::gBackendFunctionsTable.GL.BeginTimeElapsedQuery;
+            MGP_FILL(BeginTimeElapsedQuery);
             queryObject->backendHandle =
                 (!TimerQueryDisabled() && beginTimeElapsedQuery) ? beginTimeElapsedQuery() : nullptr;
         }
@@ -476,15 +556,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             (target == GL_SAMPLES_PASSED || target == GL_ANY_SAMPLES_PASSED ||
              target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) &&
             MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery != nullptr;
-        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery) {
+        const Bool isPipelineStatisticsQuery = IsPipelineStatisticsQueryTarget(target);
+        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery &&
+            !isPipelineStatisticsQuery) {
             RecordQueryError(ErrorCode::InvalidEnum, __FUNCTION__, "Query target is not supported.");
             return;
         }
         const std::lock_guard<std::mutex> lock(g_queryObjectsMutex);
-        GLuint& activeQueryId = isTransformFeedbackQuery
+        GLuint& activeQueryId = isPipelineStatisticsQuery
-            ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
+            ? g_activePipelineStatisticsQueryIds[target]
-                                                                  : g_activePrimitivesGeneratedQueryId)
+            : (isTransformFeedbackQuery
-            : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId);
+                   ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
+                                                                         : g_activePrimitivesGeneratedQueryId)
+                   : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId));
         if (activeQueryId == 0) {
             RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "No query is active on this target.");
             return;
@@ -494,9 +578,21 @@ namespace MobileGL::MG_Impl::GLImpl {
             activeQueryId = 0; // should not happen; keep state consistent
             return;
         }
+        if (isPipelineStatisticsQuery) {
+            // The result is a definite zero rather than an unread backend handle, so a later
+            // GetQueryObject* answers immediately and never waits on something that was never
+            // started. GL_QUERY_COUNTER_BITS = 0 is what marks that zero indeterminate.
+            queryObject->cachedResult = 0;
+            queryObject->resultCached = true;
+            queryObject->active = false;
+            queryObject->ended = true;
+            activeQueryId = 0;
+            return;
+        }
         if (isTransformFeedbackQuery) {
             if (queryObject->backendHandle) {
                 if (const auto endXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.EndXfbPrimitivesQuery) {
+                    MGP_FILL(EndXfbPrimitivesQuery);
                     endXfbPrimitivesQuery(queryObject->backendHandle);
                 }
             }
@@ -506,6 +602,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             if (!queryObject->backendHandle || PrefersCpuTransformFeedbackResult(queryObject)) {
                 if (queryObject->backendHandle) {
                     if (const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery) {
+                        MGP_FILL(DeleteBackendQuery);
                         deleteBackendQuery(queryObject->backendHandle);
                     }
                     queryObject->backendHandle = nullptr;
@@ -522,6 +619,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (isOcclusionQuery) {
             if (const auto endOcclusionQuery = MG_Backend::gBackendFunctionsTable.GL.EndOcclusionQuery;
                 endOcclusionQuery && queryObject->backendHandle) {
+                MGP_FILL(EndOcclusionQuery);
                 endOcclusionQuery(queryObject->backendHandle);
             }
             queryObject->active = false;
@@ -560,6 +658,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         ResetQueryObjectLocked(queryObject); // discard any previous result
         queryObject->target = target;
         const auto queryCounterTimestamp = MG_Backend::gBackendFunctionsTable.GL.QueryCounterTimestamp;
+        MGP_FILL(QueryCounterTimestamp);
         queryObject->backendHandle =
             (!TimerQueryDisabled() && queryCounterTimestamp) ? queryCounterTimestamp() : nullptr;
         queryObject->ended = true;
@@ -657,7 +756,12 @@ namespace MobileGL::MG_Impl::GLImpl {
                 *params = static_cast<GLint>(g_activePrimitivesGeneratedQueryId);
                 break;
             default:
-                *params = 0;
+                if (IsPipelineStatisticsQueryTarget(target)) {
+                    const auto it = g_activePipelineStatisticsQueryIds.find(target);
+                    *params = it != g_activePipelineStatisticsQueryIds.end() ? static_cast<GLint>(it->second) : 0;
+                } else {
+                    *params = 0;
+                }
                 break;
             }
             return;
@@ -668,6 +772,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             // entry points / timestamp valid bits at call time, not at table
             // init), and the MOBILEGL_DISABLE_TIMERQUERY kill switch always
             // wins.
+            if (IsPipelineStatisticsQueryTarget(target)) {
+                // Zero: GL 4.6 core 4.2.1's way of saying the counter is not implemented and its
+                // results are indeterminate. The conformance suite reads exactly this and skips
+                // the functional half of each such target, which is the outcome an uninstrumented
+                // counter should produce.
+                *params = 0;
+                return;
+            }
             if (target == GL_SAMPLES_PASSED || target == GL_ANY_SAMPLES_PASSED ||
                 target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) {
                 const Bool occlusionSupported = MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery != nullptr;
@@ -676,6 +788,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             const Bool timerTarget = target == GL_TIME_ELAPSED || target == GL_TIMESTAMP;
             const auto isTimerQuerySupported = MG_Backend::gBackendFunctionsTable.GL.IsTimerQuerySupported;
+            MGP_FILL(IsTimerQuerySupported);
             const Bool supported =
                 timerTarget && !TimerQueryDisabled() && isTimerQuerySupported && isTimerQuerySupported();
             *params = supported ? 64 : 0;
@@ -741,14 +854,24 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     namespace {
+        Bool IsPerVertexStreamQueryTarget(GLenum target) {
+            return target == GL_PRIMITIVES_GENERATED || target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN;
+        }
+
         // The indexed query entry points differ from the plain ones only in the vertex
         // stream they address (GL 4.6 core 4.2.1): index must be below GL_MAX_VERTEX_STREAMS
-        // for the two transform feedback targets and zero for every other target. With a
+        // for the two transform feedback targets and zero for every other target. MobileGL
-        // single vertex stream both bounds are 1, so a valid call is always index 0 and
+        // implements ONE vertex stream, so both bounds are 1 and a valid call is always index 0 -
-        // forwards to the unindexed implementation.
+        // which is what makes the three forwards below equivalent to the unindexed entry points.
+        //
+        // THAT EQUIVALENCE IS THE WHOLE JUSTIFICATION, and it is read out of the getter rather
+        // than assumed: the moment GL_MAX_VERTEX_STREAMS answers more than one, index 1..3 starts
+        // reaching EndQueryIndexed and GetQueryIndexediv, which resolve the active query from
+        // per-TARGET globals and would end - or report - a query begun on a different stream.
+        // Raising that limit therefore means giving each active query a stream index and
+        // comparing it here, not just changing the number.
         Bool ValidateQueryStreamIndex(const char* function, GLenum target, GLuint index) {
-            const Bool perStreamTarget =
+            const Bool perStreamTarget = IsPerVertexStreamQueryTarget(target);
-                target == GL_PRIMITIVES_GENERATED || target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN;
             GLint maxVertexStreams = 1;
             if (perStreamTarget) {
                 GetIntegerv(GL_MAX_VERTEX_STREAMS, &maxVertexStreams);
@@ -761,6 +884,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              : "index must be zero for this query target.");
             return false;
         }
+
     } // namespace
 
     void BeginQueryIndexed(GLenum target, GLuint index, GLuint id) {
@@ -806,6 +930,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         const auto deleteBackendQuery = MG_Backend::gBackendFunctionsTable.GL.DeleteBackendQuery;
         for (const auto& [_, queryObject] : orphans) {
             if (deleteBackendQuery && queryObject->backendHandle) {
+                MGP_FILL(DeleteBackendQuery);
                 deleteBackendQuery(queryObject->backendHandle);
             }
             delete queryObject;

MobileGL/MG_Impl/GLImpl/RenderState/GL_RenderState.cpp

@@ -328,10 +328,50 @@ namespace MobileGL::MG_Impl::GLImpl {
         MG_State::pGLContext->SetSampleCoverage(std::clamp(static_cast<Float>(value), 0.0f, 1.0f), invert == GL_TRUE);
     }
 
+    // ARB_sample_shading / GL 4.6 core 14.3.1: "value is clamped to [0, 1] when specified", so
+    // there is no error to raise - a caller that asks for 2.0 gets 1.0 and GL_MIN_SAMPLE_SHADING_-
+    // VALUE reads back 1.0. Was a logging no-op while ARB_sample_shading was advertised, which
+    // let an application enable GL_SAMPLE_SHADING and then quietly get the driver's default rate.
+    void MinSampleShading_State(GLfloat value) {
+        MG_State::pGLContext->SetMinSampleShadingValue(std::clamp(static_cast<Float>(value), 0.0f, 1.0f));
+    }
+
     void PolygonOffset_State(GLfloat factor, GLfloat units) {
         MG_State::pGLContext->SetPolygonOffset(static_cast<Float>(factor), static_cast<Float>(units));
     }
 
+    void PolygonOffsetClamp_State(GLfloat factor, GLfloat units, GLfloat clamp) {
+        // GL 4.6 core 14.6.5 / GL_EXT_polygon_offset_clamp. No error cases: any three floats are
+        // legal, and clamp = 0 is exactly glPolygonOffset. Whether the backend can APPLY the clamp
+        // is a separate question (see the DirectGLES/DirectVulkan forwarding); the state is
+        // recorded either way, because GL_POLYGON_OFFSET_CLAMP has to read back what was written.
+        MG_State::pGLContext->SetPolygonOffsetClamped(static_cast<Float>(factor), static_cast<Float>(units),
+                                                      static_cast<Float>(clamp));
+    }
+
+    void ClipControl_State(GLenum origin, GLenum depth) {
+        // GL 4.5 core 13.5: both arguments are strict enums, and either being wrong is
+        // GL_INVALID_ENUM with the state left untouched.
+        if (origin != GL_LOWER_LEFT && origin != GL_UPPER_LEFT) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "glClipControl origin must be GL_LOWER_LEFT or GL_UPPER_LEFT; got " +
+                                                 MG_Util::ConvertGLEnumToString(origin) + "."));
+            return;
+        }
+        if (depth != GL_NEGATIVE_ONE_TO_ONE && depth != GL_ZERO_TO_ONE) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", __func__,
+                    "glClipControl depth must be GL_NEGATIVE_ONE_TO_ONE or GL_ZERO_TO_ONE; got " +
+                        MG_Util::ConvertGLEnumToString(depth) + "."));
+            return;
+        }
+        MG_State::pGLContext->SetClipControl(origin, depth);
+    }
+
     void PolygonMode_State(GLenum face, GLenum mode) {
         // GL 3.3 core: separate front/back polygon modes were removed in 3.1, so the only legal
         // face is GL_FRONT_AND_BACK. GL_FRONT / GL_BACK must be rejected (some desktop drivers
@@ -1013,10 +1053,22 @@ namespace MobileGL::MG_Impl::GLImpl {
         SampleCoverage_State(value, invert);
     }
 
+    void MinSampleShading(GLfloat value) {
+        MinSampleShading_State(value);
+    }
+
     void PolygonOffset(GLfloat factor, GLfloat units) {
         PolygonOffset_State(factor, units);
     }
 
+    void PolygonOffsetClamp(GLfloat factor, GLfloat units, GLfloat clamp) {
+        PolygonOffsetClamp_State(factor, units, clamp);
+    }
+
+    void ClipControl(GLenum origin, GLenum depth) {
+        ClipControl_State(origin, depth);
+    }
+
     void PolygonMode(GLenum face, GLenum mode) {
         PolygonMode_State(face, mode);
     }

MobileGL/MG_Impl/GLImpl/RenderState/GL_RenderState.h

@@ -38,7 +38,10 @@ namespace MobileGL::MG_Impl::GLImpl {
     void StencilFunc(GLenum func, GLint ref, GLuint mask);
     void Scissor(GLint x, GLint y, GLsizei width, GLsizei height);
     void SampleCoverage(GLfloat value, GLboolean invert);
+    void MinSampleShading(GLfloat value);
     void PolygonOffset(GLfloat factor, GLfloat units);
+    void PolygonOffsetClamp(GLfloat factor, GLfloat units, GLfloat clamp);
+    void ClipControl(GLenum origin, GLenum depth);
     void PolygonMode(GLenum face, GLenum mode);
     void PointSize(GLfloat size);
     void PointParameterf(GLenum pname, GLfloat param);

MobileGL/MG_Impl/GLImpl/Sampler/GL_Sampler.cpp

@@ -13,6 +13,7 @@
 #include <MG_State/GLState/Core.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
+#include <MG_Util/Math/FixedPointConversion.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -22,6 +23,50 @@ namespace MobileGL::MG_Impl::GLImpl {
             return static_cast<Float>(*(const GLint*)param);
         }
 
+        // GL_TEXTURE_BORDER_COLOR is the only sampler parameter with more than one component, and it
+        // is also the only one whose meaning depends on WHICH entry point wrote it. Everything else
+        // reads exactly one component and does not care.
+        Bool IsVectorOnlySamplerPname(GLenum pname) {
+            return pname == GL_TEXTURE_BORDER_COLOR;
+        }
+
+        // A state query returns the value CONVERTED to the type the caller asked for (GL 4.6 core
+        // 2.2.2 / 6.1), never the other type's bits. These two are the sampler side of the numeric
+        // casts GetTexParameterfv_State/GetTexParameteriv_State already do on the texture side; the
+        // sampler path funnels all three spellings through one void* function, which is precisely how
+        // it came to write a fixed type regardless of the caller.
+        //
+        // Truncation rather than rounding for the float -> integer direction, matching the texture
+        // twin (GetTexParameteriv_State's static_cast<GLint> on MIN_LOD/MAX_LOD/LOD_BIAS): the two
+        // spellings of the same state disagreeing is the bug being fixed here, and a texture and a
+        // sampler queried the same way must answer the same number.
+        void StoreSamplerScalar(void* params, Bool isFloat, Bool isUnsignedInteger, Float value) {
+            if (isFloat) {
+                *(GLfloat*)params = value;
+                return;
+            }
+            // Via GLint in both integer spellings: a direct float -> GLuint cast of a negative value
+            // (GL_TEXTURE_MIN_LOD defaults to -1000) is undefined behaviour, while the two-step
+            // conversion is the well-defined modular one, and it is what the texture-side
+            // GetTexParameterIuiv fallback does.
+            const GLint asInt = static_cast<GLint>(value);
+            if (isUnsignedInteger) {
+                *(GLuint*)params = static_cast<GLuint>(asInt);
+            } else {
+                *(GLint*)params = asInt;
+            }
+        }
+
+        void StoreSamplerEnum(void* params, Bool isFloat, Bool isUnsignedInteger, GLenum value) {
+            if (isFloat) {
+                *(GLfloat*)params = static_cast<GLfloat>(value);
+            } else if (isUnsignedInteger) {
+                *(GLuint*)params = value;
+            } else {
+                *(GLint*)params = static_cast<GLint>(value);
+            }
+        }
+
         Bool ValidateSamplerParameterValue(GLenum pname, const void* param, Bool isFloat, Bool isUnsignedInteger) {
             if (param == nullptr) return false;
 
@@ -56,8 +101,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     } // namespace
 
+    // `isIntegerCommand` distinguishes the "I" spellings (glSamplerParameterIiv / Iuiv) from the
+    // plain ones. It only matters for GL_TEXTURE_BORDER_COLOR, and there it decides everything:
+    // GL 4.6 core 8.10 says the I forms store the components unmodified with an integer internal
+    // type, while glSamplerParameteriv converts them to floating point with equation 2.2. Routing
+    // both to the same setter - which is what this file used to do - meant glSamplerParameteriv
+    // stored raw integers (so a border of 255 became float 255.0 instead of the spec's ~1.19e-7)
+    // and glSamplerParameterIiv lost the fact that it was ever an integer at all.
     void SetSamplerParam_State(GLuint sampler, GLenum pname, const void* param, bool isFloat,
-                               bool isUnsignedInteger) {
+                               bool isUnsignedInteger, bool isIntegerCommand) {
         if (param == nullptr) return;
         if (!SamplerImpl::ValidateSamplerName(sampler)) return;
 
@@ -112,6 +164,13 @@ namespace MobileGL::MG_Impl::GLImpl {
             if (isFloat) {
                 const auto* values = (const GLfloat*)param;
                 samplerObj->SetBorderColor(FloatVec4(values[0], values[1], values[2], values[3]));
+            } else if (!isIntegerCommand) {
+                // glSamplerParameteriv: GL 4.6 core equation 2.2 into the FLOAT border colour.
+                const auto* values = (const GLint*)param;
+                samplerObj->SetBorderColor(FloatVec4(MG_Util::SignedNormalizedInt32ToFloat(values[0]),
+                                                     MG_Util::SignedNormalizedInt32ToFloat(values[1]),
+                                                     MG_Util::SignedNormalizedInt32ToFloat(values[2]),
+                                                     MG_Util::SignedNormalizedInt32ToFloat(values[3])));
             } else if (isUnsignedInteger) {
                 const auto* values = (const GLuint*)param;
                 samplerObj->SetBorderColorUI(UintVec4(values[0], values[1], values[2], values[3]));
@@ -128,7 +187,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GetSamplerParam_State(GLuint sampler, GLenum pname, void* params, bool isFloat,
-                               bool isUnsignedInteger) {
+                               bool isUnsignedInteger, bool isIntegerCommand) {
         if (params == nullptr) return;
         if (!SamplerImpl::ValidateSamplerName(sampler)) return;
 
@@ -141,47 +200,56 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!SamplerImpl::ValidateSamplerObject(sampler)) return;
 
         using namespace MG_Util;
+        // Every scalar pname goes through StoreSamplerScalar/StoreSamplerEnum so the CALLER'S form
+        // decides the destination type. Writing a fixed type regardless - which is what these case
+        // labels used to do - hands back the other type's bit pattern rather than a converted value:
+        // glGetSamplerParameterfv(GL_TEXTURE_WRAP_S) deposited the integer 10497 into a GLfloat and
+        // the caller read 1.47e-41, and glGetSamplerParameteriv(GL_TEXTURE_MIN_LOD) deposited the
+        // IEEE bits of -1000.0f and the caller read -998637568. Sixteen (pname, entry-point) pairs
+        // were broken this way; only MAX_ANISOTROPY_EXT and BORDER_COLOR branched correctly, which is
+        // how the same bug class was already found and fixed once for a single pname.
         switch (pname) {
         case GL_TEXTURE_WRAP_S:
-            *(GLuint*)params = MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapS());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapS()));
             break;
         case GL_TEXTURE_WRAP_T:
-            *(GLuint*)params = MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapT());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapT()));
             break;
         case GL_TEXTURE_WRAP_R:
-            *(GLuint*)params = MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapR());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapR()));
             break;
         case GL_TEXTURE_MIN_FILTER:
-            *(GLuint*)params =
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
-                MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMinFilter(), samplerObj->GetMipmapMode());
+                             MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMinFilter(),
+                                                                       samplerObj->GetMipmapMode()));
             break;
         case GL_TEXTURE_MAG_FILTER:
-            *(GLuint*)params =
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
-                MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMagFilter(), SamplerMipmapMode::None);
+                             MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMagFilter(),
+                                                                       SamplerMipmapMode::None));
             break;
         case GL_TEXTURE_MIN_LOD:
-            *(GLfloat*)params = samplerObj->GetMinLod();
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetMinLod());
             break;
         case GL_TEXTURE_MAX_LOD:
-            *(GLfloat*)params = samplerObj->GetMaxLod();
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetMaxLod());
             break;
         case GL_TEXTURE_LOD_BIAS:
-            *(GLfloat*)params = samplerObj->GetLodBias();
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetLodBias());
             break;
         case GL_TEXTURE_MAX_ANISOTROPY_EXT:
-            if (isFloat) {
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetMaxAnisotropy());
-                *(GLfloat*)params = samplerObj->GetMaxAnisotropy();
-            } else if (isUnsignedInteger) {
-                *(GLuint*)params = static_cast<GLuint>(samplerObj->GetMaxAnisotropy());
-            } else {
-                *(GLint*)params = static_cast<GLint>(samplerObj->GetMaxAnisotropy());
-            }
             break;
         case GL_TEXTURE_COMPARE_MODE:
-            *(GLuint*)params = MG_Util::ConvertSamplerCompareModeToGLEnum(samplerObj->GetCompareMode());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerCompareModeToGLEnum(samplerObj->GetCompareMode()));
             break;
         case GL_TEXTURE_COMPARE_FUNC:
-            *(GLuint*)params = MG_Util::ConvertSamplerCompareFuncToGLEnum(samplerObj->GetSamplerCompareFunc());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerCompareFuncToGLEnum(samplerObj->GetSamplerCompareFunc()));
             break;
         case GL_TEXTURE_BORDER_COLOR: {
             if (isFloat) {
@@ -191,6 +259,16 @@ namespace MobileGL::MG_Impl::GLImpl {
                 out[1] = color.y();
                 out[2] = color.z();
                 out[3] = color.w();
+            } else if (!isIntegerCommand) {
+                // glGetSamplerParameteriv: the inverse of the write side, GL 4.6 core equation 2.3.
+                // Exactly inverse, so a {0,1,2,4} written with glSamplerParameteriv reads back as
+                // {0,1,2,4}; a bare truncating cast answered {0,0,0,0}.
+                const auto& color = samplerObj->GetBorderColor();
+                auto* out = (GLint*)params;
+                out[0] = MG_Util::FloatToSignedNormalizedInt32(color.x());
+                out[1] = MG_Util::FloatToSignedNormalizedInt32(color.y());
+                out[2] = MG_Util::FloatToSignedNormalizedInt32(color.z());
+                out[3] = MG_Util::FloatToSignedNormalizedInt32(color.w());
             } else if (isUnsignedInteger) {
                 const auto& color = samplerObj->GetBorderColorUI();
                 auto* out = (GLuint*)params;
@@ -293,16 +371,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (sampler == 0) {
             textureUnit.SetSamplerObject(nullptr);
         } else {
-            // GL 3.3 core 3.8.2: BindSampler on a name GenSamplers never returned - or one already
+            // GL 4.6 core 8.2: BindSampler on a name GenSamplers never returned - or one already
-            // deleted - is INVALID_OPERATION. SamplerParameter* raises INVALID_VALUE for the same
+            // deleted - is INVALID_OPERATION, and so is every other sampler entry point on such a
-            // name, which is why this cannot go through the shared SamplerImpl validator.
+            // name, so the shared validator answers for all of them.
-            if (!MG_State::pGLContext->ValidateSamplerName(sampler)) {
+            if (!SamplerImpl::ValidateSamplerName(sampler)) return;
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "BindSampler_State",
-                                                 std::format("Invalid sampler name {}", sampler)));
-                return;
-            }
             Bool doesSamplerObjectCreated = MG_State::pGLContext->ValidateSamplerObject(sampler);
             if (!doesSamplerObjectCreated) {
                 MG_State::pGLContext->CreateSamplerObject(sampler);
@@ -356,30 +428,50 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     /* @INSERTION_POINT:FUNCTION_IMPLEMENTATION@ */
     void GetSamplerParameteriv(GLuint sampler, GLenum pname, GLint* params) {
-        GetSamplerParam_State(sampler, pname, params, false, false);
+        GetSamplerParam_State(sampler, pname, params, false, false, false);
     }
 
     void SamplerParameterIuiv(GLuint sampler, GLenum pname, const GLuint* param) {
-        SetSamplerParam_State(sampler, pname, param, false, true);
+        SetSamplerParam_State(sampler, pname, param, false, true, true);
     }
 
     void SamplerParameterIiv(GLuint sampler, GLenum pname, const GLint* param) {
-        SetSamplerParam_State(sampler, pname, param, false, false);
+        SetSamplerParam_State(sampler, pname, param, false, false, true);
     }
 
     void SamplerParameteriv(GLuint sampler, GLenum pname, const GLint* param) {
-        SetSamplerParam_State(sampler, pname, param, false, false);
+        SetSamplerParam_State(sampler, pname, param, false, false, false);
     }
 
     void SamplerParameterfv(GLuint sampler, GLenum pname, const GLfloat* param) {
-        SetSamplerParam_State(sampler, pname, param, true, false);
+        SetSamplerParam_State(sampler, pname, param, true, false, false);
     }
 
+    // GL 4.6 core 8.10: the scalar spellings take "the value of pname", so a pname with more than one
+    // component is INVALID_ENUM here rather than something to read four components of. Guarding at
+    // the entry point rather than downstream is also what stops the vector path reading twelve bytes
+    // past the caller's single stack scalar - taking the address of a by-value argument and handing
+    // it to a four-component reader is what these used to do. The texture-side twins already answer
+    // INVALID_ENUM for GL_TEXTURE_BORDER_COLOR (TexParameteri/f name it as unsupported outright).
     void SamplerParameteri(GLuint sampler, GLenum pname, GLint param) {
+        if (IsVectorOnlySamplerPname(pname)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "SamplerParameteri",
+                                             "pname has more than one component and needs a vector form."));
+            return;
+        }
         SamplerParameteriv(sampler, pname, &param);
     }
 
     void SamplerParameterf(GLuint sampler, GLenum pname, GLfloat param) {
+        if (IsVectorOnlySamplerPname(pname)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "SamplerParameterf",
+                                             "pname has more than one component and needs a vector form."));
+            return;
+        }
         SamplerParameterfv(sampler, pname, &param);
     }
 
@@ -388,15 +480,15 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GetSamplerParameterIuiv(GLuint sampler, GLenum pname, GLuint* params) {
-        GetSamplerParam_State(sampler, pname, params, false, true);
+        GetSamplerParam_State(sampler, pname, params, false, true, true);
     }
 
     void GetSamplerParameterIiv(GLuint sampler, GLenum pname, GLint* params) {
-        GetSamplerParam_State(sampler, pname, params, false, false);
+        GetSamplerParam_State(sampler, pname, params, false, false, true);
     }
 
     void GetSamplerParameterfv(GLuint sampler, GLenum pname, GLfloat* params) {
-        GetSamplerParam_State(sampler, pname, params, true, false);
+        GetSamplerParam_State(sampler, pname, params, true, false, false);
     }
 
     void GenSamplers(GLsizei count, GLuint* samplers) {

MobileGL/MG_Impl/GLImpl/Sampler/Validators.cpp

@@ -12,11 +12,17 @@
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 
 namespace MobileGL::MG_Impl::GLImpl::SamplerImpl {
+    // GL 4.6 core 8.2: "An INVALID_OPERATION error is generated if sampler is not the name of a
+    // sampler object previously returned from a call to GenSamplers." That class is shared by every
+    // sampler entry point - BindSampler, SamplerParameter*, GetSamplerParameter* - so this one gate
+    // answers for all of them. It used to report INVALID_VALUE (the GL 3.3 wording), which forced
+    // BindSampler to carry a bespoke duplicate of the same check just to get the class right.
     Bool ValidateSamplerName(GLuint sampler) {
         if (!MG_State::pGLContext->ValidateSamplerName(sampler)) {
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "ValidateSamplerName",
+                ErrorCode::InvalidOperation,
-                                                                      std::format("Invalid sampler name {}", sampler)));
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "ValidateSamplerName",
+                                             std::format("Invalid sampler name {}", sampler)));
             return false;
         }
         return true;

MobileGL/MG_Impl/GLImpl/Sync/GL_Sync.cpp

@@ -9,6 +9,7 @@
 #include "GL_Sync.h"
 #include <MG_Backend/BackendObjects.h>
 #include <MG_State/GLState/Core.h>
+#include <MG_Impl/Pipe/PipeFill.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -56,6 +57,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         syncObject->condition = condition;
         syncObject->flags = flags;
         if (const auto backendFenceSync = MG_Backend::gBackendFunctionsTable.GL.FenceSync) {
+            MGP_FILL(FenceSync);
             syncObject->backendHandle = backendFenceSync();
         }
         const GLsync handle = reinterpret_cast<GLsync>(syncObject);
@@ -69,14 +71,32 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     GLenum ClientWaitSync(GLsync sync, GLbitfield flags, GLuint64 timeout) {
+        // GL 4.6 core 4.1.1: GL_SYNC_FLUSH_COMMANDS_BIT is the only bit this call accepts, and
+        // any other bit is INVALID_VALUE. Silently ignoring the stray bits used to make a caller
+        // that passed, say, GL_SYNC_GPU_COMMANDS_COMPLETE by mistake think it had asked for a
+        // flush it never got.
+        if ((flags & ~static_cast<GLbitfield>(GL_SYNC_FLUSH_COMMANDS_BIT)) != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "flags must be zero or GL_SYNC_FLUSH_COMMANDS_BIT."));
+            return GL_WAIT_FAILED;
+        }
         const auto* syncObject = FindSyncObject(sync);
         if (!syncObject) {
+            // The spec pairs the GL_WAIT_FAILED return with a recorded INVALID_VALUE; returning
+            // the enum alone left glGetError() clean and the failure indistinguishable from a
+            // genuine wait failure on a live sync.
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "sync is not the name of a sync object."));
             return GL_WAIT_FAILED;
         }
         const auto backendClientWaitSync = MG_Backend::gBackendFunctionsTable.GL.ClientWaitSync;
         if (!backendClientWaitSync || !syncObject->backendHandle) {
             return GL_ALREADY_SIGNALED; // legacy always-signaled fallback
         }
+        MGP_FILL(ClientWaitSync);
         return backendClientWaitSync(syncObject->backendHandle, flags, timeout);
     }
 
@@ -95,10 +115,14 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         const auto* syncObject = FindSyncObject(sync);
         if (!syncObject) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "sync is not the name of a sync object."));
             return;
         }
         const auto backendWaitSync = MG_Backend::gBackendFunctionsTable.GL.WaitSync;
         if (backendWaitSync && syncObject->backendHandle) {
+            MGP_FILL(WaitSync);
             backendWaitSync(syncObject->backendHandle, flags, timeout);
         }
     }
@@ -119,14 +143,29 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
         const auto backendDeleteSync = MG_Backend::gBackendFunctionsTable.GL.DeleteSync;
         if (backendDeleteSync && syncObject->backendHandle) {
+            MGP_FILL(DeleteSync);
             backendDeleteSync(syncObject->backendHandle);
         }
         delete syncObject;
     }
 
     void GetSynciv(GLsync sync, GLenum pname, GLsizei bufSize, GLsizei* length, GLint* values) {
+        // GL 4.6 core 4.1: a negative bufSize is INVALID_VALUE, an unnamed sync is INVALID_VALUE
+        // and an unrecognised pname is INVALID_ENUM. All three used to leave glGetError() clean
+        // and write a plausible-looking zero, which is the one failure mode a caller cannot tell
+        // apart from a real answer - GL_SYNC_STATUS legitimately answers GL_UNSIGNALED (0x9118),
+        // but a mistyped pname answered a bare 0 that no query ever returns.
+        if (bufSize < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "bufSize must not be negative."));
+            return;
+        }
         const auto* syncObject = FindSyncObject(sync);
         if (!syncObject) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "sync is not the name of a sync object."));
             if (length) {
                 *length = 0;
             }
@@ -140,6 +179,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             break;
         case GL_SYNC_STATUS: {
             const auto backendGetSyncStatus = MG_Backend::gBackendFunctionsTable.GL.GetSyncStatus;
+            MGP_FILL(GetSyncStatus);
             const Bool signaled = !backendGetSyncStatus || !syncObject->backendHandle ||
                                   backendGetSyncStatus(syncObject->backendHandle);
             value = signaled ? GL_SIGNALED : GL_UNSIGNALED;
@@ -152,7 +192,15 @@ namespace MobileGL::MG_Impl::GLImpl {
             value = static_cast<GLint>(syncObject->flags);
             break;
         default:
-            break;
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "pname must be GL_OBJECT_TYPE, GL_SYNC_STATUS, GL_SYNC_CONDITION or "
+                                             "GL_SYNC_FLAGS."));
+            if (length) {
+                *length = 0;
+            }
+            return;
         }
 
         if (length) {
@@ -185,6 +233,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         const auto backendDeleteSync = MG_Backend::gBackendFunctionsTable.GL.DeleteSync;
         for (const auto& [_, syncObject] : orphans) {
             if (backendDeleteSync && syncObject->backendHandle) {
+                MGP_FILL(DeleteSync);
                 backendDeleteSync(syncObject->backendHandle);
             }
             delete syncObject;

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.h

@@ -8,9 +8,24 @@
 
 #pragma once
 #include <Includes.h>
+#include <MG_State/GLState/TextureState/TextureObject.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     /* @INSERTION_POINT:FUNCTION_DECLARATION@ */
+    // Answers a texture-image query straight out of the CPU shadow, into client memory or a bound
+    // PIXEL_PACK_BUFFER. This is the whole of glGetTexImage on a build with no backend readback, and
+    // it is also the sound fallback for a backend that has no GPU image to read: with no image,
+    // nothing GPU-side can ever have written the texture, so the shadow IS its content.
+    //
+    // It answers a NARROWER contract than glGetTexImage's, and refuses what it cannot do rather than
+    // answering wrongly. The copy is verbatim: it performs no format or type conversion, and it packs
+    // rows tightly, honouring only GL_PACK_SWAP_BYTES and the bitmap GL_PACK_LSB_FIRST path. A
+    // request whose (format, type) texel size differs from the texture's own, or a pixel-store state
+    // that adds row padding / a row-length override / a skip offset, is rejected with
+    // GL_INVALID_OPERATION (see ValidateShadowReadbackLayout, which spells out why each is unsafe).
+    void CopyTextureImageToClientOrPBO_State(const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
+                                             TextureUploadTarget textureUploadTarget, GLint level, GLenum format,
+                                             GLenum type, GLsizei bufSize, void* pixels, const char* caller);
     // The sized internal formats a buffer texture accepts (GL 4.6 core table 8.16). The buffer
     // clears take the same list, so it is shared rather than written out twice.
     Bool IsBufferTextureInternalFormat(GLenum internalformat);
@@ -37,8 +52,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                            GLenum format, GLenum type, const void* pixels);
     void TextureSubImage3D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width,
                            GLsizei height, GLsizei depth, GLenum format, GLenum type, const void* pixels);
+    void CompressedTextureSubImage1D(GLuint texture, GLint level, GLint xoffset, GLsizei width, GLenum format,
+                                     GLsizei imageSize, const void* data);
     void CompressedTextureSubImage2D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width,
                                      GLsizei height, GLenum format, GLsizei imageSize, const void* data);
+    void CompressedTextureSubImage3D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
+                                     GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize,
+                                     const void* data);
     void TextureParameterf(GLuint texture, GLenum pname, GLfloat param);
     void TextureParameterfv(GLuint texture, GLenum pname, const GLfloat* params);
     void TextureParameteri(GLuint texture, GLenum pname, GLint param);
@@ -60,6 +80,8 @@ namespace MobileGL::MG_Impl::GLImpl {
     void GetTextureParameteriv(GLuint texture, GLenum pname, GLint* params);
     void GetTextureLevelParameterfv(GLuint texture, GLint level, GLenum pname, GLfloat* params);
     void GetTextureLevelParameteriv(GLuint texture, GLint level, GLenum pname, GLint* params);
+    void TextureView(GLuint texture, GLenum target, GLuint origtexture, GLenum internalformat, GLuint minlevel,
+                     GLuint numlevels, GLuint minlayer, GLuint numlayers);
     void TexStorage1D(GLenum target, GLsizei levels, GLenum internalformat, GLsizei width);
     void TexStorage2D(GLenum target, GLsizei levels, GLenum internalformat, GLsizei width, GLsizei height);
     void TexStorage3D(GLenum target, GLsizei levels, GLenum internalformat, GLsizei width, GLsizei height,

MobileGL/MG_Impl/GLImpl/Texture/Validators.cpp

@@ -103,6 +103,28 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
         return true;
     }
 
+    Bool ValidateCubeMapArrayShape(TextureUploadTarget target, GLsizei width, GLsizei height, GLsizei depth,
+                                   const char* caller) {
+        if (target != TextureUploadTarget::CubeMapArray && target != TextureUploadTarget::ProxyCubeMapArray) {
+            return true;
+        }
+        if (width != height) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                             "Cube map array levels must be square (width == height)"));
+            return false;
+        }
+        if (depth % 6 != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                             "Cube map array depth must be a multiple of six"));
+            return false;
+        }
+        return true;
+    }
+
     Bool ValidateTextureSizeWithTextureUploadTarget(TextureUploadTarget target, GLsizei width, GLsizei height) {
         if (target == TextureUploadTarget::CubeMapPositiveX || target == TextureUploadTarget::CubeMapNegativeX ||
             target == TextureUploadTarget::CubeMapPositiveY || target == TextureUploadTarget::CubeMapNegativeY ||
@@ -623,4 +645,144 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
         }
         return true;
     }
+
+    // GL 4.6 core table 8.21 ("Compatible internal formats for TextureView"), transcribed whole.
+    // Written against the raw GLenum rather than TextureInternalFormat on purpose: MobileGL's own
+    // enum collapses every compressed format onto uncompressed storage and drops formats it
+    // cannot carry, so classifying the converted value would silently widen the compatibility
+    // rule - GL_COMPRESSED_RG_RGTC2 and GL_RGBA8 would end up in the same class.
+    TextureViewClass GetTextureViewClass(GLenum internalformat) {
+        switch (internalformat) {
+        case GL_RGBA32F:
+        case GL_RGBA32UI:
+        case GL_RGBA32I:
+            return TextureViewClass::Bits128;
+        case GL_RGB32F:
+        case GL_RGB32UI:
+        case GL_RGB32I:
+            return TextureViewClass::Bits96;
+        case GL_RGBA16F:
+        case GL_RG32F:
+        case GL_RGBA16UI:
+        case GL_RG32UI:
+        case GL_RGBA16I:
+        case GL_RG32I:
+        case GL_RGBA16:
+        case GL_RGBA16_SNORM:
+            return TextureViewClass::Bits64;
+        case GL_RGB16:
+        case GL_RGB16_SNORM:
+        case GL_RGB16F:
+        case GL_RGB16UI:
+        case GL_RGB16I:
+            return TextureViewClass::Bits48;
+        case GL_RG16F:
+        case GL_R11F_G11F_B10F:
+        case GL_R32F:
+        case GL_RGB10_A2UI:
+        case GL_RGBA8UI:
+        case GL_RG16UI:
+        case GL_R32UI:
+        case GL_RGBA8I:
+        case GL_RG16I:
+        case GL_R32I:
+        case GL_RGB10_A2:
+        case GL_RGBA8:
+        case GL_RG16:
+        case GL_RGBA8_SNORM:
+        case GL_RG16_SNORM:
+        case GL_SRGB8_ALPHA8:
+        case GL_RGB9_E5:
+            return TextureViewClass::Bits32;
+        case GL_RGB8:
+        case GL_RGB8_SNORM:
+        case GL_SRGB8:
+        case GL_RGB8UI:
+        case GL_RGB8I:
+            return TextureViewClass::Bits24;
+        case GL_R16F:
+        case GL_RG8UI:
+        case GL_R16UI:
+        case GL_RG8I:
+        case GL_R16I:
+        case GL_RG8:
+        case GL_R16:
+        case GL_RG8_SNORM:
+        case GL_R16_SNORM:
+            return TextureViewClass::Bits16;
+        case GL_R8UI:
+        case GL_R8I:
+        case GL_R8:
+        case GL_R8_SNORM:
+            return TextureViewClass::Bits8;
+        case GL_COMPRESSED_RED_RGTC1:
+        case GL_COMPRESSED_SIGNED_RED_RGTC1:
+            return TextureViewClass::Rgtc1Red;
+        case GL_COMPRESSED_RG_RGTC2:
+        case GL_COMPRESSED_SIGNED_RG_RGTC2:
+            return TextureViewClass::Rgtc2Rg;
+        case GL_COMPRESSED_RGBA_BPTC_UNORM:
+        case GL_COMPRESSED_SRGB_ALPHA_BPTC_UNORM:
+            return TextureViewClass::BptcUnorm;
+        case GL_COMPRESSED_RGB_BPTC_SIGNED_FLOAT:
+        case GL_COMPRESSED_RGB_BPTC_UNSIGNED_FLOAT:
+            return TextureViewClass::BptcFloat;
+        default:
+            // Every depth/stencil format, every S3TC/ETC/ASTC format and every unsized format
+            // reaches here. The caller must then demand an EXACT format match.
+            return TextureViewClass::None;
+        }
+    }
+
+    // GL 4.6 core table 8.20 ("Legal texture targets for TextureView").
+    Bool IsLegalTextureViewTargetPair(TextureTarget origTarget, TextureTarget viewTarget) {
+        switch (origTarget) {
+        case TextureTarget::Texture1D:
+            return viewTarget == TextureTarget::Texture1D || viewTarget == TextureTarget::Texture1DArray;
+        case TextureTarget::Texture2D:
+            return viewTarget == TextureTarget::Texture2D || viewTarget == TextureTarget::Texture2DArray;
+        case TextureTarget::Texture3D:
+            return viewTarget == TextureTarget::Texture3D;
+        case TextureTarget::TextureCubeMap:
+            return viewTarget == TextureTarget::TextureCubeMap || viewTarget == TextureTarget::Texture2D ||
+                   viewTarget == TextureTarget::Texture2DArray || viewTarget == TextureTarget::TextureCubeMapArray;
+        case TextureTarget::TextureRectangle:
+            return viewTarget == TextureTarget::TextureRectangle;
+        case TextureTarget::Texture1DArray:
+            return viewTarget == TextureTarget::Texture1DArray || viewTarget == TextureTarget::Texture1D;
+        case TextureTarget::Texture2DArray:
+            return viewTarget == TextureTarget::Texture2DArray || viewTarget == TextureTarget::Texture2D ||
+                   viewTarget == TextureTarget::TextureCubeMap || viewTarget == TextureTarget::TextureCubeMapArray;
+        case TextureTarget::TextureCubeMapArray:
+            return viewTarget == TextureTarget::TextureCubeMapArray || viewTarget == TextureTarget::Texture2DArray ||
+                   viewTarget == TextureTarget::Texture2D || viewTarget == TextureTarget::TextureCubeMap;
+        case TextureTarget::Texture2DMultisample:
+        case TextureTarget::Texture2DMultisampleArray:
+            return viewTarget == TextureTarget::Texture2DMultisample ||
+                   viewTarget == TextureTarget::Texture2DMultisampleArray;
+        case TextureTarget::TextureBuffer:
+            // The table lists no legal target for a buffer texture: its storage is a buffer
+            // object, and there is nothing to make a view of.
+            return false;
+        default:
+            return false;
+        }
+    }
+
+    Uint RequiredTextureViewLayerCount(TextureTarget viewTarget) {
+        switch (viewTarget) {
+        case TextureTarget::TextureCubeMap:
+            return 6;
+        case TextureTarget::Texture1D:
+        case TextureTarget::Texture2D:
+        case TextureTarget::Texture3D:
+        case TextureTarget::TextureRectangle:
+        case TextureTarget::Texture2DMultisample:
+            return 1;
+        default:
+            // 1D/2D array, cube-map array, 2D multisample array: any count (the cube-map array's
+            // "multiple of 6" is checked by the caller).
+            return 0;
+        }
+    }
 } // namespace MobileGL::MG_Impl::GLImpl::TextureImpl

MobileGL/MG_Impl/GLImpl/Texture/Validators.h

@@ -20,6 +20,13 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
     Bool ValidateTexturePixelDataType(TexturePixelDataType texturePixelDataType);
     Bool ValidateTextureLevelNumber(Int level);
     Bool ValidateTextureSizeWithTextureUploadTarget(TextureUploadTarget target, GLsizei width, GLsizei height);
+    // The two shape rules a cube-map-array level owes (GL 4.6 core 8.5): its faces are square, and
+    // its depth counts whole cubes. Both are GL_INVALID_VALUE. This used to be spelled inline in
+    // glTexStorage3D only, which is why glTexImage3D let both violations through - every entry
+    // point that DEFINES a cube-array level calls this now, so the two cannot drift again. A
+    // non-cube-array upload target answers true untouched.
+    Bool ValidateCubeMapArrayShape(TextureUploadTarget target, GLsizei width, GLsizei height, GLsizei depth,
+                                   const char* caller);
     Bool ValidateTextureSizeRange(Int width, Int height, Int depth);
     Bool ValidateTextureInternalFormat(TextureInternalFormat format);
     Bool ValidateTextureBorderNumber(Int border);
@@ -79,4 +86,33 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
     // GL 4.6 SS 8.6 subset rule for glCopyTexImage*: the read buffer must supply every component
     // the requested internalformat asks for, but may supply more.
     Bool ValidateCopyTexImageBaseFormatSubset(TextureInternalFormat destFormat, TextureInternalFormat srcFormat);
+
+    // ---- glTextureView (ARB_texture_view / GL 4.6 core 8.18) ----
+    // Table 8.21's view classes. `None` is not a class - it means the format has NO entry in the
+    // table, which the spec turns into a much stricter rule than "same class": such a format can
+    // only ever be viewed as ITSELF. Every depth, stencil and depth/stencil format lands here,
+    // which is why the Better Clouds D24S8 view must name GL_DEPTH24_STENCIL8 exactly.
+    enum class TextureViewClass {
+        None = 0,
+        Bits128,
+        Bits96,
+        Bits64,
+        Bits48,
+        Bits32,
+        Bits24,
+        Bits16,
+        Bits8,
+        Rgtc1Red,
+        Rgtc2Rg,
+        BptcUnorm,
+        BptcFloat,
+    };
+    TextureViewClass GetTextureViewClass(GLenum internalformat);
+    // Table 8.20: which <target> values glTextureView accepts for a given origtexture target.
+    Bool IsLegalTextureViewTargetPair(TextureTarget origTarget, TextureTarget viewTarget);
+    // Table 8.20 again, read the other way: how many layers <target> requires. Returns 0 for the
+    // targets whose layer count is unconstrained (the array targets), 6 for GL_TEXTURE_CUBE_MAP,
+    // and 1 for every single-layer target. GL_TEXTURE_CUBE_MAP_ARRAY is special-cased by the
+    // caller because its constraint is "a multiple of 6", not an exact count.
+    Uint RequiredTextureViewLayerCount(TextureTarget viewTarget);
 } // namespace MobileGL::MG_Impl::GLImpl::TextureImpl

MobileGL/MG_Impl/GLImpl/VertexArray/Validators.cpp

@@ -12,15 +12,15 @@
 #include <MG_State/GLState/ErrorState/Error.h>
 #include <MG_Util/Converters/MGToGL/DataTypeConverter.h>
 #include <MG_Util/Converters/MGToStr/DataTypeConverter.h>
+#include <MG_Util/ShaderTranspiler/CompileEnv.h>
 
 namespace MobileGL::MG_Impl::GLImpl::VertexArrayImpl {
     Uint GetMaxVertexAttribs() {
-        constexpr Uint capacity = static_cast<Uint>(MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS);
+        // Shared with reflection's limit and with gl_MaxVertexAttribs; see ResolveMaxVertexAttribs.
-        if (!MG_Backend::pActiveBackendObject) return capacity;
+        const Bool hasBackend = MG_Backend::pActiveBackendObject != nullptr;
-
+        const Int backendLimit =
-        const Int backendLimit = MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxVertexAttribs;
+            hasBackend ? MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxVertexAttribs : 0;
-        if (backendLimit <= 0) return capacity;
+        return static_cast<Uint>(MG_Util::ShaderTranspiler::ResolveMaxVertexAttribs(hasBackend, backendLimit));
-        return std::min(static_cast<Uint>(backendLimit), capacity);
     }
 
     Uint GetMaxVertexAttribBindings() {

MobileGL/MG_Impl/Pipe/CompositeResolver.h

@@ -0,0 +1,270 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/CompositeResolver.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// P4a's PROGRAM-PIPELINE COMPOSITE, on the client side.
+//
+// GLContext::GetProgramForDraw() already flattens a bound pipeline into one hidden composite
+// ProgramObject entirely in the frontend - it joins every graphics stage, computes the
+// pipeline's draw-program signature, looks it up in the pipeline's own cache and, on a miss,
+// attaches each stage's LINKED SNAPSHOT into a fresh ProgramObject and links it. All of that
+// is frontend work and none of it moves. What this file adds is the one thing the wire needs:
+// the composite gets ONE handle, out of the ShaderCso reserved high band, and
+// create_shader_state goes out for it exactly as for an ordinary program. THE SERVER NEVER
+// LEARNS IT IS A COMPOSITE and needs no "resolved draw program" hook at all.
+//
+// WHY A BAND RATHER THAN A FLAG ON THE HANDLE: a flag would have to be carried, honoured and
+// masked off by every consumer of a ShaderCso handle, on both sides; a reserved slot range is
+// a property of the allocator instead, so "an ordinary program can never be handed a composite
+// slot" is true by construction. MGPipeSlotAllocator::Allocate refuses the band outright and
+// AllocateComposite is the only door in.
+//
+// WHAT THIS FILE IS ACTUALLY FOR: the composite's slot has TWO INDEPENDENT RELEASE PATHS and
+// either order has to free it exactly once.
+//   * the pipeline cache drops the composite when the draw-program signature moves. In the
+//     frontend that overwrite drops the last SharedPtr, so the composite's own destructor
+//     usually runs first; the resolver still speaks the release, because "usually" is not a
+//     contract and a client that only reacted to destructors would leak a slot the moment the
+//     frontend started holding a second reference.
+//   * the composite ProgramObject's own ~ProgramObject, which is an ordinary program's death
+//     path and takes the same helper.
+// Both go through MGPipeEmitShaderCsoDestroyAndFree, and whichever runs second is a PROVEN
+// no-op: MGPipeSlotAllocator::Free refuses a slot that is not live at that generation and
+// bumps no generation of its own, so a double release cannot skip a generation either.
+//
+// THE MEMO's KEY IS (CONTEXT ID, PIPELINE GL NAME) AND THE CONTEXT HALF IS NOT OPTIONAL.
+// This resolver is a PROCESS singleton while a pipeline's GL name is per context: GLContext
+// owns m_programPipelines AND its own name generator m_programPipelineNames (Core.h), so name
+// N names two different ProgramPipelineObjects in two contexts, each with its own composite
+// and its own handle. Keyed on the name alone, the first emission after a make-current found
+// the OTHER context's entry, matched nothing - two composites are two ProgramObjects with two
+// lifetime ids, so the handles differ even when the stage set and the signature are identical
+// - and released it: a delete_shader_state and a cleared publication latch for a composite
+// whose frontend ProgramObject is alive, its band slot handed back and re-issued at gen + 1,
+// and the server rebuilding that program (glslang + SPIR-V + spirv-opt, the very cost the
+// signature below exists to avoid) once per context switch.
+//
+// THE CONTEXT ID IS GLContext::GetTextureContextId() AND NOTHING ELSE - the tree's existing
+// never-reused per-context id (TextureState::AllocateContextId; PipeInputs carries it as
+// m_textureContextId at seven fill points and the backends' own per-context memos key on it).
+// Deliberately NOT the GLContext ADDRESS that MGB_CTX_IDENTITY and MGPipeTracker::m_context
+// compare, because Core.h states the reason that id exists at all: a context freed and remade
+// lands on the old heap address, which would put this same defect back one context recreation
+// later.
+//
+// WHAT RELEASES A DESTROYED CONTEXT's ENTRIES: nothing in this file, and that is the correct
+// answer rather than an omission. Destroying a context drops m_programPipelines, which drops
+// each ProgramPipelineObject, which drops the composite it cached; ~ProgramObject then runs
+// MGPipeEmitShaderCsoDestroyAndFree - the composite's OWN release path, the second of the two
+// above - and the slot goes back exactly once. The entries those composites leave behind can
+// never be found again (no future Observe can carry a dead context id) and could not release
+// anything if they were (the allocator erases the lifetime-id mapping on Free), so Reset()
+// DROPS them instead of releasing them. That is also what bounds the vector; see Reset().
+//
+// THE SIGNATURE IS ComputeDrawProgramSignature(), the per-graphics-stage {lifetimeId,
+// GetLinkVersion()} array - and DELIBERATELY NOT GetBackendStateVersion(), which is what made
+// the SSO conformance loop rebuild the composite (glslang + SPIR-V + spirv-opt) on every draw,
+// because a glUniform1i to a sampler moves it.
+//
+// HEADER-ONLY, for the ownership reason Tracker.h states: a new .cpp would need the root
+// CMakeLists.txt, which is the contract package's.
+//
+// IT IS INCLUDED BY ProgramEmit.h AND NOT THE OTHER WAY ROUND, deliberately: the composite is
+// a special case of the program family's own emission, so the family header depends on this
+// one and this one depends on nothing of the family's. The reverse arrangement would make the
+// resolver reachable only from a translation unit that had already decided to use it, i.e.
+// dead in the build that matters and live only in the tests.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/PipeMutation.h>
+#include <MG_State/GLState/ProgramState/ProgramObject.h>
+#include <MG_State/GLState/ProgramState/ProgramPipelineObject.h>
+
+namespace MobileGL::MG_Pipe {
+
+    // IS THIS PROGRAM A PIPELINE COMPOSITE? A composite is the one ProgramObject in the system
+    // constructed with external index 0 (Core.cpp's MakeShared<ProgramObject>(0u)), and that is
+    // not an accident of implementation: it is deliberately not a named program, so it must not
+    // answer glIsProgram and must not consume a GL name, and glCreateProgram never returns 0.
+    //
+    // ASKED THIS WAY RATHER THAN CARRIED ON THE OBJECT because a Bool member on ProgramObject
+    // would resize the pull build's object and break G1 outright - the phase's admitted-resize
+    // set is empty - and a hook in Core.cpp would have to be maintained on a path that already
+    // states the invariant in its own comment.
+    inline Bool MGPipeProgramIsPipelineComposite(const MG_State::GLState::ProgramObject& program) {
+        return program.GetExternalIndex() == 0;
+    }
+
+    class MGPipeCompositeResolver {
+    public:
+        using ProgramObject = MG_State::GLState::ProgramObject;
+        using ProgramPipelineObject = MG_State::GLState::ProgramPipelineObject;
+        using DrawProgramSignature = ProgramPipelineObject::DrawProgramSignature;
+
+        struct Counters {
+            Uint64 Mints = 0;    // signatures this resolver has seen minted
+            Uint64 Reuses = 0;   // a signature that had not moved
+            Uint64 Releases = 0; // signature-move releases, i.e. the pipeline-cache path
+            // Entries dropped by Reset() because the composite's slot was already gone - the
+            // shape every entry of a DESTROYED CONTEXT ends in. A dropped entry is not a
+            // release: nothing is emitted and nothing is freed, the obligation having been
+            // discharged by the composite's own ~ProgramObject.
+            Uint64 Sweeps = 0;
+        };
+
+        // Told, at every emission, which composite the frontend handed out for which pipeline.
+        // Returns the handle the emitter should use, which is always the one already minted off
+        // the composite's own lifetime id - the resolver never mints a second identity for an
+        // object that has one.
+        //
+        // WHEN THE SIGNATURE MOVES the previous composite's slot is released here, through the
+        // one death helper and in its fixed order. That is the pipeline-cache release path; the
+        // composite's own destructor is the other one and the second of the two is the proven
+        // no-op.
+        MGPipeHandle Observe(Uint64 contextId, const ProgramPipelineObject& pipeline,
+                             const ProgramObject& composite, MGPipeHandle handle) {
+            const DrawProgramSignature signature = pipeline.ComputeDrawProgramSignature();
+            const Uint pipelineName = pipeline.GetExternalIndex();
+            Entry* entry = Find(contextId, pipelineName);
+            if (entry != nullptr) {
+                if (entry->Signature == signature && entry->Handle == handle) {
+                    // THE SAME COMPOSITE. Not merely "the same signature": the handle is minted
+                    // off the composite ProgramObject's own lifetime id, so an identical handle
+                    // IS an identical object and there is nothing to release. Live is
+                    // deliberately NOT touched - it is the release obligation and it is still
+                    // owed for exactly this handle.
+                    ++m_counters.Reuses;
+                    return handle;
+                }
+                // A MOVED SIGNATURE ON THIS CONTEXT's OWN ENTRY, which is the only thing that
+                // can reach here now: another context's pipeline of the same name is not found
+                // above and therefore not released, its obligation staying owed to the context
+                // that took it.
+                ReleaseEntry(*entry);
+            } else {
+                m_entries.push_back(Entry{});
+                entry = &m_entries.back();
+                entry->ContextId = contextId;
+                entry->PipelineName = pipelineName;
+            }
+            entry->Signature = signature;
+            entry->Handle = handle;
+            entry->CompositeLifetimeId = composite.GetLifetimeId();
+            entry->Live = true;
+            ++m_counters.Mints;
+            return handle;
+        }
+
+        // A make-current, and it RELEASES NOTHING. The entries name composites that belong to
+        // the frontend objects of the context being left, those objects outlive the switch, and
+        // releasing them would emit a delete for a live program.
+        //
+        // NOR IS ANY MEMO INVALIDATED, and that is what the context key bought. This used to
+        // clear a per-entry `Fresh` flag beside `Live`, because with a name-only key an entry
+        // could not say whether it described "my own pipeline before the switch" or "another
+        // context's pipeline of the same name" - and exactly one of those two properties could
+        // hold at a time. The key answers the question directly now, so the freshness flag and
+        // its one reader (a HandleFor() accessor that had no caller anywhere in the tree) are
+        // both gone rather than left as scaffolding: `Live`, the release obligation, is the
+        // entry's only state and nothing but ReleaseEntry may clear it.
+        //
+        // WHAT IS LEFT TO DO HERE IS RECLAMATION, and this is the one moment the client is told
+        // that a context boundary was crossed. An entry whose composite slot is no longer live
+        // has had its obligation discharged elsewhere - by that composite's own ~ProgramObject,
+        // which is precisely what happened to EVERY entry of a context that has just been
+        // destroyed - so it is DROPPED rather than released: a release would resolve nothing
+        // anyway (the allocator erases the lifetime-id mapping on Free) and no reader is left.
+        // Without this the vector would grow by one per (context, pipeline name) pair the
+        // process ever used, where the name-only key bounded it by the highest pipeline name;
+        // with it, it is bounded by the pairs whose composite slot is actually live.
+        void Reset() {
+            SizeT kept = 0;
+            for (SizeT i = 0; i < m_entries.size(); ++i) {
+                if (!m_entries[i].Live || !MGPipeSlots().IsLive(MGPipeKind::ShaderCso, m_entries[i].Handle)) {
+                    ++m_counters.Sweeps;
+                    continue;
+                }
+                if (kept != i) m_entries[kept] = m_entries[i];
+                ++kept;
+            }
+            m_entries.resize(kept);
+        }
+
+        void ResetCounters() { m_counters = Counters{}; }
+
+        // Diagnostics and unit cases only; nothing on the emission path asks. There is no
+        // HandleFor(name) accessor and there must not be one: the emitter takes the handle from
+        // the composite ProgramObject it already holds, so a lookup by name would be a second
+        // authority on an identity the allocator already owns.
+        SizeT Size() const { return m_entries.size(); }
+        const Counters& GetCounters() const { return m_counters; }
+
+    private:
+        struct Entry {
+            // NO FRONTEND SharedPtr, and that is the exit-order rule rather than a style
+            // choice: a static that held one would put a frontend destructor on an exit
+            // handler's path into a torn-down pipe. A GL name, a signature of plain integers,
+            // a handle and a lifetime id are all this needs.
+            // KEYED ON (CONTEXT ID, GL NAME), and the name half is the GL name because a
+            // ProgramPipelineObject has no lifetime id - ComputeDrawProgramSignature reads the
+            // STAGE programs' ids and the pipeline itself carries none. The context half is
+            // GLContext::GetTextureContextId(); see the file header for why the name alone was
+            // wrong and why the context ADDRESS would be too.
+            //
+            // WITHIN ONE CONTEXT glGenProgramPipelines recycles names, so a deleted-and-
+            // recreated pipeline can still inherit its predecessor's entry; that is bounded and
+            // self-correcting rather than a hazard. The first Observe on the new object finds a
+            // signature and a handle that do not match and releases the old entry, and that
+            // release resolves NOTHING - the allocator erases the lifetime-id mapping on Free,
+            // so a stale CompositeLifetimeId emits no delete and frees no slot; all it costs is
+            // one redundant, idempotent death notice, which is the same shape the composite's
+            // own second release path already has.
+            Uint64 ContextId = 0;
+            Uint PipelineName = 0;
+            DrawProgramSignature Signature{};
+            MGPipeHandle Handle = kMGPipeNullHandle;
+            Uint64 CompositeLifetimeId = 0;
+            // THE RELEASE OBLIGATION. Set when this entry takes responsibility for a composite's
+            // slot, cleared ONLY by ReleaseEntry when that responsibility is discharged.
+            Bool Live = false;
+        };
+
+        // BOTH HALVES OF THE KEY, always. An entry of another context is not this pipeline's
+        // entry: not found, not matched, not released.
+        Entry* Find(Uint64 contextId, Uint pipelineName) {
+            for (Entry& entry : m_entries) {
+                if (entry.ContextId == contextId && entry.PipelineName == pipelineName) return &entry;
+            }
+            return nullptr;
+        }
+
+        void ReleaseEntry(Entry& entry) {
+            if (!entry.Live || entry.CompositeLifetimeId == 0) return;
+            entry.Live = false;
+            MGPipeEmitShaderCsoDestroyAndFree(entry.CompositeLifetimeId);
+            entry.Handle = kMGPipeNullHandle;
+            entry.CompositeLifetimeId = 0;
+            ++m_counters.Releases;
+        }
+
+        Vector<Entry> m_entries;
+        Counters m_counters;
+    };
+
+    inline MGPipeCompositeResolver& MGPipeCompositeResolverInstance() {
+        // NEVER DESTROYED, for MGPipeTrackerInstance()' reason, and named in the phase's risk
+        // list beside the other three new client singletons: heap-constructed and intentionally
+        // leaked at exit, holding no frontend SharedPtr.
+        static MGPipeCompositeResolver* resolver = new MGPipeCompositeResolver();
+        return *resolver;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/CsoCache.h

@@ -0,0 +1,205 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/CsoCache.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The render-state CSO cache (ARCHITECTURE.md 4.5.2 / 5.3, P2 brief D7).
+//
+// THE LOOKUP, and the first step is the whole point:
+//   1. m_pipelineStateVersion (widened) did not move -> reuse the last handle. ZERO hashing,
+//      zero probing, and nothing is emitted unless m_version also moved. That is the steady
+//      state of every frame, and it is why the tracker asks the cache at all only when the
+//      dirty walk says the pipeline version moved.
+//   2. moved -> hash the 396 pipeline bytes, probe, and on a hit CONFIRM WITH A MEMCMP
+//      before reusing the handle. ARCHITECTURE.md 4.1 says content addressing on an
+//      xxHash; a bare 64-bit equality would let a collision alias two different render
+//      states onto one CSO, which is silent wrong pixels with no gate that can see it.
+//      Mesa's cso_cache memcmps for the same reason. The memcmp only ever runs on a
+//      pipeline-version change, i.e. never in the steady state.
+//   3. miss -> mint a slot, emit create_render_state with every pipeline chunk, then bind.
+//
+// CAPACITY 64 (ROADMAP.md P2). 64 x (8 + 8 + 396 + 8) = about 26 KB per context. ROADMAP.md
+// open question 4 says 64 is provisional and the counters retune it at P13; this ships 64
+// and publishes the mint / bind / evict counters that retune reads.
+//
+// THE NEGATIVE CONTROL. kMGPipeBehaviourNoCsoContentAddressing (bit 63 of the runtime
+// MOBILEGL_PIPE_PUSH bitmask) turns off the PROBE and the handle reuse, not the records:
+// every pipeline-version change then mints a fresh CSO, binds it and evicts, which is
+// precisely "whole-block content addressing" and reproduces the regression
+// RenderState.h records. It is what separates "push is slower" from "the CSO design is
+// slower", and CsoContentAddressingScenario (package E) is the always-on ctest that stops
+// the switch from rotting.
+//
+// Header-only for the same ownership reason as Tracker.h: the root CMakeLists.txt that
+// would name a new .cpp is package A's and is frozen behind the p2/contract tag.
+#if MOBILEGL_PIPE_PUSH
+#include <Config.h>
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/MGPipeRenderStateSpans.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+#include <cstring>
+
+namespace MobileGL::MG_Pipe {
+
+    inline constexpr SizeT kMGPipeCsoCacheCapacity = 64;
+
+    class MGPipeCsoCache {
+    public:
+        struct Counters {
+            Uint64 Mints = 0;     // create_render_state emissions
+            // bind_render_state emissions, mint or reuse. Counted in Acquire because Acquire
+            // has exactly ONE caller (PipeFill.cpp's EmitRenderState) and that caller binds
+            // immediately after every call - so "acquisitions" and "binds" are the same
+            // number, and counting it here keeps the count from depending on an emitter
+            // remembering to tick it. mints/binds is the cache's hit rate and it is the
+            // number the CSO content-addressing negative control moves.
+            Uint64 Binds = 0;
+            Uint64 Hits = 0;      // a probe that found a live entry and passed the memcmp
+            Uint64 Collisions = 0; // a hash hit the memcmp REJECTED - the reason it exists
+            Uint64 Evictions = 0; // LRU evictions, each one a delete_render_state
+        };
+
+        // The handle for `params`' pipeline subset. Mints and emits create_render_state on a
+        // miss; emits delete_render_state for whatever it evicts to make room. `payloadBytes`
+        // accumulates what went on the wire, for PipeStats::RecordDrawPayloadBytes.
+        MGPipeHandle Acquire(const RenderStateParameters& params, Uint64& payloadBytes) {
+            Array<Uint8, kMGPipePipelineChunkBytes> bytes;
+            MGPipeGatherPipelineBytes(params, bytes.data());
+            ++m_counters.Binds;
+
+            const Bool contentAddressed =
+                (MG_Config::Features.PipePush & kMGPipeBehaviourNoCsoContentAddressing) == 0;
+            if (contentAddressed) {
+                const Uint64 hash = s_hashForTest != nullptr ? s_hashForTest(bytes.data())
+                                                             : MGPipeHashPipelineBytes(bytes.data());
+                for (SizeT i = 0; i < m_entries.size(); ++i) {
+                    if (m_entries[i].Hash != hash) continue;
+                    if (std::memcmp(m_entries[i].Bytes.data(), bytes.data(), bytes.size()) != 0) {
+                        // A 64-bit collision between two DIFFERENT render states. Reusing the
+                        // handle here would render one state with the other's pipeline, so the
+                        // entry is dropped and the caller mints - correctness first, and the
+                        // counter says how often it happened.
+                        ++m_counters.Collisions;
+                        Evict(i);
+                        break;
+                    }
+                    m_entries[i].LastUsed = ++m_clock;
+                    ++m_counters.Hits;
+                    return m_entries[i].Cso;
+                }
+                return Mint(hash, bytes, payloadBytes);
+            }
+            // Content addressing OFF: never probe, always mint. The records still exist, so
+            // the arm differs from the default one in exactly one thing - whether a handle is
+            // reused - which is what makes it a control rather than a different design.
+            return Mint(0, bytes, payloadBytes);
+        }
+
+        // Context teardown, a server reset, a unit test's fixture. Emits nothing: the applier
+        // is reset alongside, and a delete for a record that is about to be dropped anyway
+        // would be a wire message with no reader.
+        void Reset() {
+            for (auto& entry : m_entries) MGPipeSlots().Free(MGPipeKind::RenderStateCso, entry.Cso);
+            m_entries.clear();
+            m_clock = 0;
+        }
+
+        void ResetCounters() { m_counters = Counters{}; }
+
+        SizeT Size() const { return m_entries.size(); }
+        const Counters& GetCounters() const { return m_counters; }
+
+        // TEST SEAM, and it is here because the thing it tests cannot be reached any other
+        // way. A 64-bit collision between two DIFFERENT render states is silent wrong pixels
+        // and it is exactly what the memcmp confirm above exists to stop, so
+        // CsoCacheTest.HashCollisionDoesNotAliasTwoStates has to be able to make one happen.
+        // Null in every real build - one never-taken, perfectly-predicted branch on a path
+        // that runs only when the pipeline version moved, i.e. never in the steady state.
+        using HashForTestFn = Uint64 (*)(const void* pipelineBytes);
+        inline static HashForTestFn s_hashForTest = nullptr;
+
+    private:
+        struct Entry {
+            Uint64 Hash = 0;
+            Uint64 LastUsed = 0;
+            MGPipeHandle Cso = kMGPipeNullHandle;
+            Array<Uint8, kMGPipePipelineChunkBytes> Bytes{};
+        };
+
+        MGPipeHandle Mint(Uint64 hash, const Array<Uint8, kMGPipePipelineChunkBytes>& bytes,
+                          Uint64& payloadBytes) {
+            if (m_entries.size() >= kMGPipeCsoCacheCapacity) {
+                SizeT victim = 0;
+                for (SizeT i = 1; i < m_entries.size(); ++i) {
+                    if (m_entries[i].LastUsed < m_entries[victim].LastUsed) victim = i;
+                }
+                Evict(victim);
+            }
+
+            const MGPipeHandle cso = MGPipeSlots().Allocate(MGPipeKind::RenderStateCso);
+            MGPRenderStateDesc desc{};
+            desc.Cso = cso;
+            desc.BaseCso = kMGPipeNullHandle;
+            // A brand-new CSO names every pipeline chunk; the incremental form against a
+            // BaseCso is what the applier's assertion allows and P3 will use once a CSO is
+            // minted from a neighbour rather than from nothing.
+            desc.ChunkMask = kAllPipelineChunks;
+            desc.Blob.Size = kMGPipePipelineChunkBytes;
+            MGPipeApplyCreateRenderState(desc, bytes.data());
+            payloadBytes += sizeof(MGPRenderStateDesc) + kMGPipePipelineChunkBytes;
+
+            Entry entry;
+            entry.Hash = hash;
+            entry.LastUsed = ++m_clock;
+            entry.Cso = cso;
+            entry.Bytes = bytes;
+            m_entries.push_back(entry);
+
+            ++m_counters.Mints;
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::RenderStateCsoMints, 1);
+            }
+            return cso;
+        }
+
+        void Evict(SizeT index) {
+            MGPHandleOnly handle{};
+            handle.Handle = m_entries[index].Cso;
+            handle.Kind = static_cast<Uint32>(MGPipeKind::RenderStateCso);
+            MGPipeApplyDeleteRenderState(handle);
+            MGPipeSlots().Free(MGPipeKind::RenderStateCso, m_entries[index].Cso);
+            m_entries[index] = m_entries.back();
+            m_entries.pop_back();
+            ++m_counters.Evictions;
+        }
+
+        static constexpr Uint32 kAllPipelineChunks =
+            static_cast<Uint32>((Uint64{1} << kMGPipePipelineChunkCount) - 1);
+
+        Vector<Entry> m_entries;
+        Uint64 m_clock = 0;
+        Counters m_counters;
+    };
+
+    // The monolith's one cache, held beside the tracker. A Vector scan rather than a hash
+    // map on purpose: 64 entries of Uint64 is a handful of cache lines, it is probed only
+    // when the pipeline version moved, and it keeps the eviction order in the same array as
+    // the content - a map would need a second structure to answer "which is oldest".
+    inline MGPipeCsoCache& MGPipeCsoCacheInstance() {
+        // NEVER DESTROYED, for MGPipeTrackerInstance()' reason (MG_Impl/Pipe/Tracker.h): the
+        // rule covers every MGPipe process singleton, not only the ones on today's death
+        // paths.
+        static MGPipeCsoCache* cache = new MGPipeCsoCache();
+        return *cache;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/FramebufferEmit.h

@@ -0,0 +1,659 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/FramebufferEmit.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The CLIENT side of P4a's framebuffer family: set_framebuffer_state, emitted at the validate
+// point once per bound TARGET that moved, or once with Target = Both when the two bindings
+// name the same object.
+//
+// THIS FILE IS CREATED BY THE CONTRACT COMMIT AND FILLED BY THE PACKAGE THAT OWNS IT, and the
+// split is the whole reason it exists this early. MG_Impl/Pipe/PipeFill.cpp is the contract
+// package's for the entire phase - it carries Coverage.def's enum-coupled block, the validate
+// point and the death helpers - so the emitter package must not edit it. What it edits instead
+// is this header: the emitter's BODY, and the value of kMGPipeWiredFramebufferSubsystem below.
+// That is what makes "no file is touched twice by two packages" structural rather than a
+// convention, and it is what the bb2a236d semantic-merge trap taught (two branches green
+// separately, the integrated tree not compiling).
+//
+// HEADER-ONLY, for the ownership reason Tracker.h and ResourceTracker.h both state: the root
+// CMakeLists.txt that would name a new .cpp is the contract package's and is frozen behind the
+// tag. MG_Impl/Pipe/PipeFill.cpp is the one translation unit that includes it in the library.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/SetHashSuppressor.h>
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Impl/Pipe/TextureEmit.h>
+#include <MG_Impl/Pipe/Tracker.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+#include <xxhash.h>
+
+#include <algorithm>
+
+namespace MobileGL::MG_Pipe {
+
+    // WHICH SUBSYSTEM BIT THIS BUILD ACTUALLY EMITS FOR. PipeFill.cpp ORs the four per-family
+    // constants into kMGPipeWiredSubsystems, so the bit is added by the commit that gives the
+    // emitters their bodies, with no file touched twice - and a Coverage.def row can never
+    // silently drop a field on the floor before the call that carries it exists.
+    //
+    // TURNING IT ON RETIRES NO PULL. GetFramebufferBindingSlot is the family's one
+    // Coverage.def emitted row and PipeFill.cpp's EmittedCallSuppliesTheWholeField answers
+    // FALSE for it, with the reason: the field's storage is a BindingSlot<FramebufferObject> -
+    // a frontend heap reference - and the call that supplies it carries eight-byte {slot, gen}
+    // handles and a fully resolved descriptor. So this bit switches the EMISSION on and the
+    // residual fill keeps writing the mirror, which is what keeps the verify lane at zero
+    // divergence.
+    inline constexpr Uint64 kMGPipeWiredFramebufferSubsystem = kMGPipeSubsystemFramebuffer;
+
+    inline Bool MGPipeFramebufferSubsystemEnabled() {
+        return (kMGPipeWiredFramebufferSubsystem & kMGPipeSubsystemFramebuffer) != 0 &&
+               (MG_Config::Features.PipePush & kMGPipeSubsystemFramebuffer) != 0;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // D-C1: the MGPSurface builder, one pure function, one statement per field
+    // ---------------------------------------------------------------------------------
+
+    // MGPSurface::Kind's three constants ARE THE CONTRACT'S (ID-12 DV-4, c0c):
+    // kMGPipeSurfaceKindNone / ...Texture / ...Renderbuffer live in MG_Pipe/MGPipeTypes.h under
+    // exactly these names with the same MGPipeKind derivation and the same static_assert. This
+    // package's copies were a redefinition in the same namespace and are deleted.
+
+    // The upload target an attachment names, RESOLVED: an attachment made through an entry
+    // point that carries no face token stores TextureUploadTarget::Unknown, and the record goes
+    // out fully resolved - nothing in it may require a lookup on the far side.
+    //
+    // THE FALLBACK IS ONLY LEGAL FOR A SINGLE-TARGET TEXTURE (m1), and v1's was not. The
+    // precedent it copied - FramebufferAttachmentObject::GetSize - needs an EXTENT, which is
+    // identical across a cube map's six faces; face IDENTITY is not, so
+    // `glFramebufferTexture(GL_COLOR_ATTACHMENT0, cube, 0)` resolved to targets[0] and the
+    // record ASSERTED CubeMapPositiveX for a layered attachment that names all six. A texture
+    // with exactly one upload target has a [0] that IS the truth; anything else keeps Unknown,
+    // which is the value the field already carries for "this attachment names no single face"
+    // and which Layered = 1 tells the reader to ignore.
+    inline MobileGL::TextureUploadTarget MGPipeResolveAttachmentUploadTarget(
+        const MG_State::GLState::FramebufferAttachmentObject& attachment) {
+        MobileGL::TextureUploadTarget resolved = attachment.GetTextureUploadTarget();
+        if (resolved != MobileGL::TextureUploadTarget::Unknown) return resolved;
+        const auto& texture = attachment.GetTexture();
+        if (!texture) return MobileGL::TextureUploadTarget::Unknown;
+        const auto& targets = texture->GetUploadTargets();
+        return targets.size() == 1 ? targets[0] : MobileGL::TextureUploadTarget::Unknown;
+    }
+
+    // ONE PURE FUNCTION, ONE STATEMENT PER FIELD, and that shape is a gate requirement rather
+    // than taste: G7's scripted control stops this conversion copying exactly one member
+    // (MGPSurface::Layered) and expects the framebuffer suite to go red NAMING that field. A
+    // loop or a memcpy would make the control unanswerable.
+    //
+    // `res` is handed in because resolving it needs the slot allocator and this function stays
+    // pure; `internalFormat` is INLINE in the record on purpose, so the four cross-object masks
+    // fall out at push time with no lookup on the far side.
+    // THE EMPTY POINT IS THE ZERO-INITIALISED RECORD EXCEPT FOR ITS TWO TARGET FIELDS. Both
+    // are Uint16 enumerations whose zero is a REAL value - TextureTarget::Texture1D and
+    // TextureUploadTarget::Texture1D - so a reader that forgot to gate on Kind would read a
+    // plausible wrong answer rather than a nonsense one. Unknown (0xFFFF) is what the contract
+    // spells for TextureTarget (kMGPipeSurfaceNoTextureTarget) and m6 applies the same rule to
+    // UploadTarget, which shares the collision ID-12 DV-3 ruled on for MGPSubData::Target.
+    inline MGPSurface MGPipeEmptySurface() {
+        MGPSurface surface{};
+        surface.UploadTarget = static_cast<Uint16>(MobileGL::TextureUploadTarget::Unknown);
+        surface.TextureTarget = kMGPipeSurfaceNoTextureTarget;
+        return surface;
+    }
+
+    inline MGPSurface MGPipeBuildSurface(const MG_State::GLState::FramebufferAttachmentObject& attachment,
+                                         MGPipeHandle res) {
+        MGPSurface surface = MGPipeEmptySurface();
+        if (attachment.IsEmpty()) return surface;
+        surface.Res = res;
+        if (attachment.IsTexture()) {
+            const auto& texture = attachment.GetTexture();
+            surface.Kind = kMGPipeSurfaceKindTexture;
+            surface.InternalFormat = static_cast<Uint32>(texture->GetFormat());
+            surface.Layered = attachment.IsLayered() ? 1 : 0;
+            surface.Level = static_cast<Uint16>(std::max<Int>(attachment.GetTextureLevel(), 0));
+            surface.Layer = static_cast<Uint32>(std::max<Int>(attachment.GetTextureLayer(), 0));
+            surface.UploadTarget = static_cast<Uint16>(MGPipeResolveAttachmentUploadTarget(attachment));
+            // ID-12 DV-5: the field that WAS Pad0, and the size did not move. The four
+            // cross-object masks all reduce to (format, TEXTURE TARGET) -
+            // ShouldUseCaveatTextureFormat / BackendTextureFormatAddsAlpha - and no
+            // TextureUploadTarget -> TextureTarget inverse exists anywhere in the tree, so
+            // without this the inline InternalFormat cannot make them fall out at push time and
+            // the backend keeps reading the frontend attachment objects.
+            surface.TextureTarget = static_cast<Uint16>(texture->GetTarget());
+            return surface;
+        }
+        const auto& renderbuffer = attachment.GetRenderbuffer();
+        surface.Kind = kMGPipeSurfaceKindRenderbuffer;
+        surface.InternalFormat = static_cast<Uint32>(renderbuffer->GetInternalFormat());
+        surface.Layered = 0;
+        surface.Level = 0;
+        surface.Layer = 0;
+        return surface;
+    }
+
+    // MGPFramebufferState::DrawBuffers[i]: an index INTO THIS RECORD'S OWN Color[] array, and
+    // -1 for NONE, which is the field's documented convention read literally.
+    //
+    // THE FOUR DEFAULT-FRAMEBUFFER TOKENS map to 0, and that is a deliberate narrowing rather
+    // than an oversight: a default framebuffer has one colour surface, this record carries it
+    // in Color[0] (see MGPipeBuildFramebufferState), and IsDefault is what tells the server
+    // which framebuffer it is looking at. The distinction the narrowing loses is FRONT versus
+    // BACK and LEFT versus RIGHT, which MobileGL's frontend never gives a default framebuffer
+    // in the first place - FramebufferObject's constructor seeds BackLeft and nothing writes
+    // another. A phase that needs stereo has to widen the field, not re-encode this one.
+    inline Int8 MGPipeDrawBufferIndex(MobileGL::FramebufferAttachmentType buffer) {
+        using MobileGL::FramebufferAttachmentType;
+        if (buffer == FramebufferAttachmentType::None) return -1;
+        if (buffer >= FramebufferAttachmentType::Color0 && buffer <= FramebufferAttachmentType::ColorMax) {
+            return static_cast<Int8>(static_cast<Int>(buffer) - static_cast<Int>(FramebufferAttachmentType::Color0));
+        }
+        return 0;
+    }
+
+    // m2: A DRAW-BUFFER TOKEN CAN NAME A COLOUR POINT THE RECORD CANNOT CARRY, and D-C3's
+    // refusal loop only ever scanned ATTACHMENTS. `glDrawBuffers(1, {GL_COLOR_ATTACHMENT10})`
+    // with nothing attached at 10 is legal state - draw-incomplete, but legal - and the index
+    // above would have written 10 into a record whose Color[] is 8 wide, so the server would
+    // index out of its own storage or invent a bound the record does not carry. Truncating
+    // silently is the bug class this phase is closing, so the record is refused exactly as an
+    // over-wide attachment is.
+    inline Bool MGPipeDrawBufferIsInsideTheWireWidth(MobileGL::FramebufferAttachmentType buffer) {
+        using MobileGL::FramebufferAttachmentType;
+        if (buffer < FramebufferAttachmentType::Color0 || buffer > FramebufferAttachmentType::ColorMax) {
+            return true; // None and the four default-framebuffer tokens; neither indexes Color[]
+        }
+        return static_cast<Int>(buffer) - static_cast<Int>(FramebufferAttachmentType::Color0) <
+               static_cast<Int>(kMGPipeMaxColorAttachments);
+    }
+
+    // ---------------------------------------------------------------------------------
+    // D-C4: ContentHash, and the one input it must not swallow
+    // ---------------------------------------------------------------------------------
+    //
+    // XXH64 over the WHOLE record with ContentHash itself zeroed, computed field-wise into a
+    // zero-initialised staging copy so that no padding byte can enter the hash. Two jobs: the
+    // server's render-pass memo key, and this client's emission suppressor.
+    //
+    // IT MUST COVER Fbo. A recycled framebuffer handle whose successor happens to carry an
+    // identical attachment set would otherwise be suppressed against its predecessor; Fbo
+    // carries Gen, so it cannot be.
+    //
+    // IT MUST COVER DrawBuffers[8], and this is the trap worth naming. The backend derives the
+    // fragColor BROADCAST COUNT from the draw-buffer array, and it does that at the verb, from
+    // the framebuffer state it then holds, precisely so a program can relink inside the same
+    // draw. A hash that did not cover the array would let a suppressed set_framebuffer_state
+    // mean "the draw buffers did not move" when they had, and the shader would be specialised
+    // for the previous output shape. With the array in the hash, a suppression provably means
+    // the array did not move, which provably means the broadcast count did not move.
+    inline void MGPipeCopySurfaceForHash(MGPSurface& dst, const MGPSurface& src) {
+        dst.Res = src.Res;
+        dst.InternalFormat = src.InternalFormat;
+        dst.Kind = src.Kind;
+        dst.Layered = src.Layered;
+        dst.Level = src.Level;
+        dst.Layer = src.Layer;
+        dst.UploadTarget = src.UploadTarget;
+        // MANDATORY, not optional: TextureTarget is a PipeFields.def row now, so a
+        // field-wise copy that skipped it would suppress a record whose only moved field is
+        // the attachment's texture target - and that field decides three of the four
+        // cross-object masks.
+        dst.TextureTarget = src.TextureTarget;
+    }
+
+    inline Uint64 MGPipeFramebufferStateContentHash(const MGPFramebufferState& state) {
+        MGPFramebufferState staging{};
+        staging.Fbo = state.Fbo;
+        for (SizeT i = 0; i < kMGPipeMaxColorAttachments; ++i) {
+            MGPipeCopySurfaceForHash(staging.Color[i], state.Color[i]);
+        }
+        MGPipeCopySurfaceForHash(staging.Depth, state.Depth);
+        MGPipeCopySurfaceForHash(staging.Stencil, state.Stencil);
+        MGPipeCopySurfaceForHash(staging.ReadSurface, state.ReadSurface);
+        for (SizeT i = 0; i < kMGPipeMaxColorAttachments; ++i) {
+            staging.DrawBuffers[i] = state.DrawBuffers[i];
+        }
+        staging.Width = state.Width;
+        staging.Height = state.Height;
+        staging.Layers = state.Layers;
+        staging.Samples = state.Samples;
+        staging.FixedSampleLocations = state.FixedSampleLocations;
+        staging.IsDefault = state.IsDefault;
+        staging.Complete = state.Complete;
+        staging.Target = state.Target;
+        // staging.ContentHash stays 0 - that is the whole point.
+        return XXH64(&staging, sizeof(staging), 0);
+    }
+
+    // ---------------------------------------------------------------------------------
+    // The emitter
+    // ---------------------------------------------------------------------------------
+
+    class MGPipeFramebufferEmitter {
+    public:
+        using GLContext = MG_State::GLState::GLContext;
+        using FramebufferObject = MG_State::GLState::FramebufferObject;
+        using FramebufferAttachmentType = MobileGL::FramebufferAttachmentType;
+
+        // The handle for `fbo`. kMGPipeDefaultFramebuffer ({0,1}) for the default framebuffer,
+        // which is what retires the four pDefaultFramebufferInfo->defaultFBO identity
+        // comparisons into an ordinary handle compare; a client-minted {slot, gen} otherwise.
+        //
+        // Minted, never gated: a framebuffer handle is CLIENT state and costs one free-list pop.
+        static MGPipeHandle HandleFor(const FramebufferObject& fbo) {
+            if (fbo.IsDefaultFramebuffer()) return kMGPipeDefaultFramebuffer;
+            return MGPipeSlots().Acquire(MGPipeKind::Framebuffer, fbo.GetLifetimeId());
+        }
+
+        // Returns the bytes that went on the wire, for the per-draw payload histogram.
+        Uint64 EmitFramebufferState(GLContext& ctx) {
+            if (!MGPipeFramebufferSubsystemEnabled()) return 0;
+            const auto& drawFbo = ctx.GetFramebufferBindingSlot(MobileGL::FramebufferTarget::Draw).GetBoundObject();
+            const auto& readFbo = ctx.GetFramebufferBindingSlot(MobileGL::FramebufferTarget::Read).GetBoundObject();
+            if (!drawFbo && !readFbo) return 0;
+
+            // ONE OBJECT BOUND TO BOTH TARGETS IS ONE RECORD WITH Target = Both, and that is
+            // not an optimisation: Espryt's "same FBO as draw" skip is the habitat of the
+            // read-buffer defect class, and a record that says which target it describes turns
+            // "apply the draw buffers only for the draw target" from call-site discipline into
+            // a one-line test on the far side.
+            const Bool shared = drawFbo && readFbo && drawFbo.get() == readFbo.get();
+
+            MGPFramebufferState drawState{};
+            MGPFramebufferState readState{};
+            Bool drawOk = false;
+            Bool readOk = false;
+            if (shared) {
+                drawOk = BuildFramebufferState(*drawFbo, MGPipeFramebufferTarget::Both, drawState);
+            } else {
+                if (drawFbo) {
+                    drawOk = BuildFramebufferState(*drawFbo, MGPipeFramebufferTarget::Draw, drawState);
+                }
+                if (readFbo) {
+                    readOk = BuildFramebufferState(*readFbo, MGPipeFramebufferTarget::Read, readState);
+                }
+            }
+            if (!drawOk && !readOk) return 0;
+
+            // THE SUPPRESSOR SLOT IS FED THE COMBINED ANSWER and the per-target latches decide
+            // which of the two records actually goes out. The slot exists so that
+            // InvalidateAll() on a fresh context reaches this family like every other, and so
+            // that "nothing moved" costs one compare rather than two.
+            const Uint64 drawHash = drawOk ? drawState.ContentHash : 0;
+            const Uint64 readHash = readOk ? readState.ContentHash : 0;
+            const Uint64 combined =
+                MGPipeMixShutter(MGPipeMixShutter(drawHash, readHash), shared ? 1u : 0u);
+            if (!MGPipeSetHashSuppressorInstance().ShouldEmit(MGPipeSuppressorSlot::SetFramebufferState,
+                                                             combined)) {
+                return 0;
+            }
+
+            Uint64 bytes = 0;
+            if (shared) {
+                if (drawOk && (drawHash != m_lastEmitted[kDraw] || drawHash != m_lastEmitted[kRead])) {
+                    bytes += Emit(drawState);
+                    m_lastEmitted[kDraw] = drawHash;
+                    m_lastEmitted[kRead] = drawHash;
+                }
+                return bytes;
+            }
+            if (drawOk && drawHash != m_lastEmitted[kDraw]) {
+                bytes += Emit(drawState);
+                m_lastEmitted[kDraw] = drawHash;
+            }
+            if (readOk && readHash != m_lastEmitted[kRead]) {
+                bytes += Emit(readState);
+                m_lastEmitted[kRead] = readHash;
+            }
+            return bytes;
+        }
+
+        // ID-19(c): EVERY DSA ENTRY POINT THAT HANDS A FRAMEBUFFER TO THE SERVER BY NAME IS
+        // PRECEDED BY A RECORD FOR IT, and that is the phase's main correction rather than a
+        // nicety. With only the two BOUND-target records, glClearNamedFramebufferfv(fbo) on an
+        // unbound fbo made the backend mint a fresh driver framebuffer with NO ATTACHMENTS,
+        // find no record for it, decline, and issue the clear against it anyway -
+        // GL_INVALID_FRAMEBUFFER_OPERATION and nothing cleared, where the legacy arm cleared
+        // correctly (esprytobj C-1).
+        //
+        // THE TARGET IS Named ONLY WHEN THE OBJECT IS BOUND TO NEITHER BINDING. A record always
+        // writes FramebufferRecords[Fbo.Slot]; Draw/Read/Both ADDITIONALLY set the bound
+        // handle(s). So handing a currently-bound framebuffer a Named record would overwrite
+        // the bound record's Target with one that says "no binding" while BoundFramebuffer
+        // still names it, and the server would read a record whose Target contradicts the
+        // binding it is resolved through. Re-asserting the binding the object already has is
+        // free (the content hash suppresses it) and keeps the two consistent.
+        //
+        // Returns the bytes that went on the wire.
+        Uint64 EmitFramebufferByName(const FramebufferObject& fbo) {
+            if (!MGPipeFramebufferSubsystemEnabled()) return 0;
+            MGPipeFramebufferTarget target = MGPipeFramebufferTarget::Named;
+            const Bool boundToDraw = IsBoundTo(fbo, MobileGL::FramebufferTarget::Draw);
+            const Bool boundToRead = IsBoundTo(fbo, MobileGL::FramebufferTarget::Read);
+            if (boundToDraw && boundToRead) {
+                target = MGPipeFramebufferTarget::Both;
+            } else if (boundToDraw) {
+                target = MGPipeFramebufferTarget::Draw;
+            } else if (boundToRead) {
+                target = MGPipeFramebufferTarget::Read;
+            }
+
+            MGPFramebufferState state{};
+            if (!BuildFramebufferState(fbo, target, state)) return 0;
+
+            // THE SUPPRESSOR IS KEYED BY THE FRAMEBUFFER THE RECORD NAMES, never by one global
+            // slot (MGPipeTypes.h states the rule): two different objects' Named records in a
+            // row must both go out, and a Named record must never be suppressed against the
+            // same object's bound record or the reverse. Target is a ContentHash input, so the
+            // second half holds by construction; the per-object table is what buys the first.
+            // The two BOUND latches stay what they are - "does the server's draw/read binding
+            // already hold this record" - and a bound-target emission from here consults them,
+            // because a rebind of an unchanged object must still move the binding.
+            if (target == MGPipeFramebufferTarget::Named) {
+                NamedEntry& entry = NamedEntryFor(state.Fbo);
+                if (entry.Has && entry.Gen == state.Fbo.Gen && entry.LastHash == state.ContentHash) {
+                    return 0;
+                }
+                const Uint64 bytes = Emit(state);
+                entry.Has = true;
+                entry.Gen = state.Fbo.Gen;
+                entry.LastHash = state.ContentHash;
+                return bytes;
+            }
+            if (target == MGPipeFramebufferTarget::Both) {
+                if (state.ContentHash == m_lastEmitted[kDraw] && state.ContentHash == m_lastEmitted[kRead]) {
+                    return 0;
+                }
+                const Uint64 bytes = Emit(state);
+                m_lastEmitted[kDraw] = state.ContentHash;
+                m_lastEmitted[kRead] = state.ContentHash;
+                return bytes;
+            }
+            const SizeT slot = target == MGPipeFramebufferTarget::Read ? kRead : kDraw;
+            if (state.ContentHash == m_lastEmitted[slot]) return 0;
+            const Uint64 bytes = Emit(state);
+            m_lastEmitted[slot] = state.ContentHash;
+            return bytes;
+        }
+
+        // ---- what a unit case reads. The emitter builds INTO these and hands the applier the
+        // same objects, so "what was emitted" costs no copy. ----
+        // ---- the death half (P4a final review C-2) ----
+        //
+        // Called by the contract's death helper before the slot is freed (there is no wire
+        // delete for this kind, D-I2, so this is the only client-side thing a framebuffer's
+        // death has to do). The per-object Named latch is the entry: a recycled handle's Gen
+        // already refuses the stale latch, so this is hygiene rather than a fix - the rule
+        // (ID-8) is that whatever mints a handle retires everything it keeps under it at the
+        // death, and every P4a kind takes the same shape. Gen-keyed for a late notice.
+        void NoteFramebufferDied(MGPipeHandle handle) {
+            const SizeT slot = handle.Slot;
+            if (MGPipeHandleIsNull(handle) || slot >= m_named.size()) return;
+            if (m_named[slot].Gen == handle.Gen) m_named[slot] = NamedEntry{};
+        }
+        // "Does this emitter hold a Named-record latch for this handle at its generation."
+        Bool NamedRecordIsLatched(MGPipeHandle handle) const {
+            const SizeT slot = handle.Slot;
+            if (MGPipeHandleIsNull(handle) || slot >= m_named.size()) return false;
+            return m_named[slot].Has && m_named[slot].Gen == handle.Gen;
+        }
+
+        const MGPFramebufferState& LastDraw() const { return m_lastDraw; }
+        const MGPFramebufferState& LastRead() const { return m_lastRead; }
+        const MGPFramebufferState& LastNamed() const { return m_lastNamed; }
+        Uint64 EmissionCount() const { return m_emissions; }
+        Uint64 RefusedCount() const { return m_refusals; }
+
+        // A fresh context: what the server has is no longer what this emitter last sent. Only
+        // LATCHES reset here - MGPipeApplierReset clears the applier's DrawFramebuffer and
+        // ReadFramebuffer working state, so these mirrors have to go with them or the first
+        // emission after a make-current would be suppressed as unchanged and the server would
+        // draw into the previous context's framebuffer. The suppressor slot is invalidated by
+        // the validate point's own InvalidateAll(), beside this call.
+        void Reset() {
+            m_lastEmitted[kDraw] = 0;
+            m_lastEmitted[kRead] = 0;
+            // The per-object latch goes too, and the safe direction is why: MGPipeApplierReset
+            // keeps FramebufferRecords standing (they are object state, ID-19(b)) but
+            // ReleaseObjectRecords clears the whole table, and this emitter cannot tell the two
+            // scopes apart from here. Keeping a latch across a table that may have been dropped
+            // would suppress the one record that had to go out; dropping it costs one extra
+            // 304-byte record per named framebuffer after a context switch.
+            m_named.clear();
+        }
+
+        void ResetCounters() { m_emissions = m_refusals = 0; }
+
+        void ResetForTest() {
+            Reset();
+            ResetCounters();
+            m_lastDraw = MGPFramebufferState{};
+            m_lastRead = MGPFramebufferState{};
+            m_lastNamed = MGPFramebufferState{};
+        }
+
+    private:
+        static constexpr SizeT kDraw = 0;
+        static constexpr SizeT kRead = 1;
+
+        Uint64 Emit(const MGPFramebufferState& state) {
+            if (state.Target == static_cast<Uint8>(MGPipeFramebufferTarget::Named)) {
+                m_lastNamed = state;
+            } else if (state.Target == static_cast<Uint8>(MGPipeFramebufferTarget::Read)) {
+                m_lastRead = state;
+            } else {
+                m_lastDraw = state;
+                if (state.Target == static_cast<Uint8>(MGPipeFramebufferTarget::Both)) m_lastRead = state;
+            }
+            MGPipeApplySetFramebufferState(state);
+            ++m_emissions;
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::FramebufferEmissions, 1);
+            }
+            return sizeof(MGPFramebufferState);
+        }
+
+        // ONE RECORD DESCRIBES ONE FRAMEBUFFER OBJECT - the one named by `fbo` - and every
+        // field in it is a property of THAT object. Target is the only binding-specific one.
+        //
+        // ReadSurface IS RESOLVED FROM THIS FRAMEBUFFER'S OWN READ BUFFER UNDER EVERY TARGET,
+        // Named included (c0e / MGPipeTypes.h). v1 resolved a Draw record's ReadSurface from
+        // the READ-bound object, which was D-C2's letter and muddled in substance: the record
+        // then described a surface that is not part of the framebuffer its own Fbo names, and a
+        // glReadBuffer on the read FBO moved the DRAW record's ContentHash and forced a
+        // redundant draw emission. Resolving it per object is what makes the
+        // read-buffer-shared-FBO defect class unrepresentable rather than merely fixed - the
+        // record carries a surface, not an index, and no field of it refers to "whatever is
+        // bound".
+        Bool BuildFramebufferState(const FramebufferObject& fbo, MGPipeFramebufferTarget target,
+                                   MGPFramebufferState& out) {
+            // D-C3, THE CLIENT HALF OF THE BRING-UP REFUSAL. The wire array is 8 wide and
+            // GetDynamicParameters().MaxColorAttachments is the driver's raw ES cap, not
+            // clamped to 8 on the GLES path. An attachment point at or above the wire width
+            // cannot be carried at all, so the record is REFUSED and the legacy arm runs -
+            // truncating it silently is exactly the bug class this phase is closing. The
+            // backend half of the same refusal (bit 9 declined at its first lookup, with one
+            // ERROR naming the cap) rides ResolveFramebufferSubsystemArm.
+            for (Int point = static_cast<Int>(FramebufferAttachmentType::Color0) +
+                             static_cast<Int>(kMGPipeMaxColorAttachments);
+                 point <= static_cast<Int>(FramebufferAttachmentType::ColorMax); ++point) {
+                if (fbo.GetAttachment(static_cast<FramebufferAttachmentType>(point)).IsEmpty()) continue;
+                MGLOG_E_ONCE("MGPipe: framebuffer %u has an attachment at colour point %d, which is at or "
+                             "above the wire width of %u - set_framebuffer_state is refused rather than "
+                             "truncated and the legacy arm runs",
+                             fbo.GetExternalIndex(),
+                             point - static_cast<Int>(FramebufferAttachmentType::Color0),
+                             static_cast<Uint>(kMGPipeMaxColorAttachments));
+                ++m_refusals;
+                return false;
+            }
+
+            // m2, THE SAME REFUSAL ONE FIELD OVER. A draw-buffer token may name a colour point
+            // at or above the wire width with nothing attached there, which the loop above
+            // cannot see; MGPipeDrawBufferIndex would then write 8..31 into an 8-wide array.
+            {
+                const auto& tokens = fbo.GetDrawBuffers();
+                for (SizeT i = 0; i < kMGPipeMaxColorAttachments; ++i) {
+                    if (MGPipeDrawBufferIsInsideTheWireWidth(tokens[i])) continue;
+                    MGLOG_E_ONCE("MGPipe: framebuffer %u names colour point %d in draw buffer %u, which is "
+                                 "at or above the wire width of %u - set_framebuffer_state is refused "
+                                 "rather than truncated and the legacy arm runs",
+                                 fbo.GetExternalIndex(),
+                                 static_cast<Int>(tokens[i]) -
+                                     static_cast<Int>(FramebufferAttachmentType::Color0),
+                                 static_cast<Uint>(i), static_cast<Uint>(kMGPipeMaxColorAttachments));
+                    ++m_refusals;
+                    return false;
+                }
+            }
+
+            out = MGPFramebufferState{};
+            out.Fbo = HandleFor(fbo);
+            out.Target = static_cast<Uint8>(target);
+            out.IsDefault = fbo.IsDefaultFramebuffer() ? 1 : 0;
+
+            // THE COLOUR POINTS. A default framebuffer keeps its one colour surface under
+            // BackLeft rather than under Color0, and the record has exactly one place to put
+            // it: Color[0], which is also the index MGPipeDrawBufferIndex maps that token to,
+            // so the array and the draw-buffer indices agree by construction.
+            if (out.IsDefault != 0) {
+                out.Color[0] = SurfaceOf(fbo, FramebufferAttachmentType::BackLeft);
+            } else {
+                for (SizeT i = 0; i < kMGPipeMaxColorAttachments; ++i) {
+                    out.Color[i] = SurfaceOf(fbo, static_cast<FramebufferAttachmentType>(
+                                                      static_cast<Int>(FramebufferAttachmentType::Color0) +
+                                                      static_cast<Int>(i)));
+                }
+            }
+            out.Depth = SurfaceOf(fbo, FramebufferAttachmentType::Depth);
+            out.Stencil = SurfaceOf(fbo, FramebufferAttachmentType::Stencil);
+            out.ReadSurface = SurfaceOf(fbo, fbo.GetReadBuffer());
+
+            const auto& drawBuffers = fbo.GetDrawBuffers();
+            for (SizeT i = 0; i < kMGPipeMaxColorAttachments; ++i) {
+                out.DrawBuffers[i] = MGPipeDrawBufferIndex(drawBuffers[i]);
+            }
+
+            FillGeometry(fbo, out);
+            // Complete is FramebufferObject::CheckCompleteness(), the FRONTEND-ONLY answer, and
+            // never glCheckFramebufferStatus's: that entry point additionally consults the
+            // backend's probed format-capability cache, and a client emitting it would be
+            // reading the backend from the client side - the exact coupling this boundary
+            // exists to remove. glCheckFramebufferStatus keeps answering from the frontend
+            // exactly as it does today.
+            out.Complete = fbo.CheckCompleteness() ? 1 : 0;
+            out.ContentHash = MGPipeFramebufferStateContentHash(out);
+            return true;
+        }
+
+        static Bool IsBoundTo(const FramebufferObject& fbo, MobileGL::FramebufferTarget target) {
+            if (MG_State::pGLContext == nullptr) return false;
+            const auto& bound = MG_State::pGLContext->GetFramebufferBindingSlot(target).GetBoundObject();
+            return bound && bound.get() == &fbo;
+        }
+
+        struct NamedEntry {
+            Uint32 Gen = 0;
+            Uint64 LastHash = 0;
+            Bool Has = false;
+        };
+
+        NamedEntry& NamedEntryFor(MGPipeHandle fbo) {
+            const SizeT slot = fbo.Slot;
+            if (slot >= m_named.size()) m_named.resize(slot + 1);
+            return m_named[slot];
+        }
+
+        MGPSurface SurfaceOf(const FramebufferObject& fbo, FramebufferAttachmentType type) {
+            if (type == FramebufferAttachmentType::None || type == FramebufferAttachmentType::Unknown) {
+                return MGPipeEmptySurface();
+            }
+            const auto& attachment = fbo.GetAttachment(type);
+            if (attachment.IsEmpty()) return MGPipeEmptySurface();
+            MGPipeTextureEmitter& textures = MGPipeTextureEmitterInstance();
+            // D-A4's two producers: an attachment point is what sets RENDER_TARGET and
+            // DEPTH_STENCIL, the two sticky bind bits nothing set before P4a. Sticky and ORed,
+            // so a texture that was ever a colour attachment keeps saying so, and the mask is
+            // republished on the resource's next respecify.
+            const Uint16 bit = (type == FramebufferAttachmentType::Depth ||
+                                type == FramebufferAttachmentType::Stencil)
+                                   ? static_cast<Uint16>(kMGPipeBindDepthStencil)
+                                   : static_cast<Uint16>(kMGPipeBindRenderTarget);
+            MGPipeHandle res = kMGPipeNullHandle;
+            if (attachment.IsTexture()) {
+                const auto& texture = attachment.GetTexture();
+                res = textures.AcquireTexture(texture->GetLifetimeId(), texture.get());
+                textures.NoteTextureBoundAs(res, bit);
+            } else if (attachment.IsRenderbuffer()) {
+                const auto& renderbuffer = attachment.GetRenderbuffer();
+                res = textures.AcquireRenderbuffer(renderbuffer->GetLifetimeId());
+                textures.NoteRenderbufferBoundAs(res, bit);
+            }
+            return MGPipeBuildSurface(attachment, res);
+        }
+
+        // The attachments' common extent, and the ARB_framebuffer_no_attachments defaults when
+        // there is no attachment at all (GL 4.6 core table 23.24 - the shape a framebuffer with
+        // no attachments rasterizes at).
+        static void FillGeometry(const FramebufferObject& fbo, MGPFramebufferState& out) {
+            Bool found = false;
+            for (const auto& attachment : fbo.GetAllAttachmentObjects()) {
+                if (attachment.IsEmpty()) continue;
+                const IntVec3 size = attachment.GetSize();
+                if (!found) {
+                    out.Width = static_cast<Uint16>(std::clamp<Int>(size.x(), 0, 0xFFFF));
+                    out.Height = static_cast<Uint16>(std::clamp<Int>(size.y(), 0, 0xFFFF));
+                    out.Layers = static_cast<Uint16>(
+                        attachment.IsLayered() ? std::clamp<Int>(size.z(), 1, 0xFFFF) : 1);
+                    if (attachment.IsTexture()) {
+                        const auto& texture = attachment.GetTexture();
+                        out.Samples = static_cast<Uint16>(std::max<Int>(texture->GetSamples(), 0));
+                        out.FixedSampleLocations = texture->HasFixedSampleLocations() ? 1 : 0;
+                    } else {
+                        out.Samples = static_cast<Uint16>(
+                            std::max<Int>(attachment.GetRenderbuffer()->GetSamples(), 0));
+                        out.FixedSampleLocations = 1;
+                    }
+                    found = true;
+                }
+            }
+            if (found) return;
+            out.Width = static_cast<Uint16>(std::clamp<Int>(fbo.GetDefaultWidth(), 0, 0xFFFF));
+            out.Height = static_cast<Uint16>(std::clamp<Int>(fbo.GetDefaultHeight(), 0, 0xFFFF));
+            out.Layers = static_cast<Uint16>(std::clamp<Int>(fbo.GetDefaultLayers(), 0, 0xFFFF));
+            out.Samples = static_cast<Uint16>(std::clamp<Int>(fbo.GetDefaultSamples(), 0, 0xFFFF));
+            out.FixedSampleLocations = fbo.GetDefaultFixedSampleLocations() ? 1 : 0;
+        }
+
+        Array<Uint64, 2> m_lastEmitted{};
+        // The per-FRAMEBUFFER suppressor for Named records, slot-indexed with the generation
+        // checked, exactly as the applier's own table is. A framebuffer has no wire lifetime
+        // (D-I2), so a successor simply overwrites its predecessor's entry.
+        Vector<NamedEntry> m_named;
+        MGPFramebufferState m_lastDraw{};
+        MGPFramebufferState m_lastRead{};
+        MGPFramebufferState m_lastNamed{};
+        Uint64 m_emissions = 0;
+        Uint64 m_refusals = 0;
+    };
+
+    inline MGPipeFramebufferEmitter& MGPipeFramebufferEmitterInstance() {
+        // NEVER DESTROYED, for MGPipeTrackerInstance()' reason (MG_Impl/Pipe/Tracker.h): the
+        // rule covers every MGPipe process singleton, not only the ones a frontend destructor
+        // reaches today, and it is what keeps exit() out of a torn-down pipe.
+        static MGPipeFramebufferEmitter* emitter = new MGPipeFramebufferEmitter();
+        return *emitter;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/ImageEmit.h

@@ -0,0 +1,182 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/ImageEmit.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The CLIENT side of set_shader_images, the third of P4a's kVarTail unit sets. It rides
+// SamplerEmit.h's subsystem bit (kMGPipeWiredSamplerSubsystem): one family, one A/B.
+//
+// TWO INVARIANTS THAT MUST SURVIVE INTO THE BODY, and they are the kind an optimisation
+// deletes:
+//   1. THE HIGH-WATER-ZERO EARLY-OUT. An image high-water mark of 0 emits nothing, BEFORE any
+//      hash - that is what makes every Minecraft draw pay one integer test for a feature it
+//      does not use.
+//   2. THE SWEEP'S GATE IS KEYED ON FRONTEND GENERATIONS AND DELIBERATELY NOT ON A BACKEND
+//      RE-MINT COUNTER. A texture bound ONLY to an image unit is re-minted INSIDE the sweep,
+//      so a server-side epoch would be bumped after the gate had already declined. The
+//      client's bit-14 shutter is Mix(Mix(textureContent, textureParams), programImageUnitVersion)
+//      - all three FRONTEND counters - so the property is preserved by construction, and it is
+//      written here because it is invisible from the shutter itself.
+//
+// The record carries the APPLICATION's format and access; the bind-format recast (a GL_RG32F
+// bind is INVALID_VALUE on 19 of 26 non-core formats on Adreno) and the buffer-texture split
+// view stay SERVER-side and unchanged. ContentHash therefore has to cover InternalFormat and
+// Access as well as the binding, because the format the shader was built against is live
+// glBindImageTexture state and the format-less image bake keys on it.
+//
+// THIS FILE IS CREATED BY THE CONTRACT COMMIT AND FILLED BY THE PACKAGE THAT OWNS IT - see
+// FramebufferEmit.h for why, in full.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/SamplerEmit.h>
+#include <MG_Impl/Pipe/SetHashSuppressor.h>
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_Pipe/PipeMutation.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_State/GLState/TextureState/TextureState.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+#include <xxhash.h>
+
+namespace MobileGL::MG_Pipe {
+
+    // D-G3. Over the tail with Start and Count mixed in, the same shape the two sampler sets
+    // use - and it covers InternalFormat and Access because those are live glBindImageTexture
+    // state that the format-less image bake keys on, not decoration.
+    inline Uint64 MGPipeShaderImageSetContentHash(const MGPImageView* entries, Uint32 start, Uint32 count) {
+        Uint64 hash = XXH64(entries, static_cast<SizeT>(count) * sizeof(MGPImageView), 0);
+        hash = MGPipeMixShutter(hash, start);
+        hash = MGPipeMixShutter(hash, count);
+        return hash;
+    }
+
+    class MGPipeImageEmitter {
+    public:
+        using GLContext = MG_State::GLState::GLContext;
+
+        // set_shader_images. Start is 0 and Count is the image-unit window described below.
+        //
+        // WHERE THE HIGH-WATER MARK COMES FROM, because the frontend has none and this is the
+        // one place a reader will look for it. DirectGLES keeps g_imageUnitHighWaterMark, but
+        // that is written from inside its own per-unit sync and lives on the far side of the
+        // boundary; TextureState::NoteUnitTouched is the TEXTURE-unit path and
+        // glBindImageTexture does not reach it. Adding a counter to TextureState would edit
+        // another package's file and resize the pull build's object, which G1 forbids outright.
+        //
+        // So the window is derived instead, from the one thing that decides whether an image
+        // unit can matter at all: the highest image unit the CURRENT PROGRAM names, memoised
+        // per program state in SamplerEmit.h's shared inversion, UNIONED with a sticky mark of
+        // every unit this emitter has already described. A program with no image uniforms
+        // gives MaxImageUnit == -1 and, with nothing sticky yet, a window of 0 - which is the
+        // zero early-out, taken BEFORE any hash and before any 192-entry walk, exactly as
+        // property 1 requires. The mark is sticky so that a program which stops naming a unit
+        // does not silently stop describing it: the window only grows, and shrinking it is how
+        // a stale binding would become invisible to the server.
+        Uint64 EmitShaderImages(GLContext& ctx) {
+            const auto& program = ctx.GetProgramForDraw();
+            const auto& resolution = MGPipeProgramOpaqueUnitsShared().For(program.get());
+            const Uint32 programWindow =
+                resolution.MaxImageUnit < 0 ? 0u : static_cast<Uint32>(resolution.MaxImageUnit) + 1u;
+            if (programWindow > m_window) m_window = programWindow;
+            const Uint32 count = m_window < kMGPipeMaxImageUnits ? m_window : kMGPipeMaxImageUnits;
+            // PROPERTY 1, and it is one integer test on every draw of every application that
+            // never binds an image.
+            if (count == 0) return 0;
+
+            for (Uint32 unit = 0; unit < count; ++unit) {
+                const auto& binding = ctx.GetImageTextureBinding(static_cast<Int>(unit));
+                MGPImageView& entry = m_entries[unit];
+                entry = MGPImageView{};
+                entry.Unit = unit;
+                entry.Res = binding.Texture ? MGPipeSlots().Acquire(MGPipeKind::Texture,
+                                                                    binding.Texture->GetLifetimeId())
+                                            : kMGPipeNullHandle;
+                // D-A4: a texture named in an emitted MGPImageView is SHADER-IMAGE-bound from
+                // then on - the bit ImageBindableHint is derived from. The bind itself noted it
+                // first (TextureState.h, so the hint precedes the first sync); this is the
+                // letter of the rule and a one-compare early-out once the bit is set.
+                if (!MGPipeHandleIsNull(entry.Res)) {
+                    MGPipeNoteTextureBoundAs(entry.Res, static_cast<Uint32>(kMGPipeBindShaderImage));
+                }
+                // THE APPLICATION's format and access, verbatim. The bind-format recast and the
+                // buffer-texture split view are server-side and stay there; so does
+                // SupportsLayeredImageBinding's rule, which asks the BACKEND target after
+                // MapToBackendTextureTarget and forces layer to 0 for a non-layerable one -
+                // Adreno took a stray layer index literally. A client that pre-applied any of
+                // that would be answering a driver question from the wrong side.
+                entry.InternalFormat = static_cast<Uint32>(binding.Format);
+                entry.Layer = static_cast<Uint32>(binding.Layer);
+                entry.Level = static_cast<Uint16>(binding.Level);
+                entry.Layered = binding.Layered != GL_FALSE ? 1 : 0;
+                entry.Access = static_cast<Uint8>(MGPipeEncodeImageAccess(binding.Access));
+            }
+
+            const Uint64 hash = MGPipeShaderImageSetContentHash(m_entries.data(), 0, count);
+            if (!MGPipeSetHashSuppressorInstance().ShouldEmit(MGPipeSuppressorSlot::SetShaderImages, hash)) {
+                return 0;
+            }
+            m_lastImages = MGPShaderImages{};
+            m_lastImages.Start = 0;
+            m_lastImages.Count = count;
+            m_lastImages.ContentHash = hash;
+            MGPipeApplySetShaderImages(m_lastImages, m_entries.data());
+            ++m_imageSets;
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddCalls(MG_Util::PipeStats::CallClass::ShaderImageEmissions, 1);
+            }
+            return sizeof(MGPShaderImages) + static_cast<Uint64>(count) * sizeof(MGPImageView);
+        }
+
+        // The validate point's FreshlyPrimed arm. A fresh context is a fresh set of image
+        // bindings, so the sticky window starts over; the suppressor slot this set latches is
+        // invalidated beside this call. There is no record half here at all - set_shader_images
+        // is pure working state and mints no object of its own.
+        void Reset() { m_window = 0; }
+
+        void ResetCounters() { m_imageSets = 0; }
+
+        const MGPShaderImages& LastShaderImages() const { return m_lastImages; }
+        const Array<MGPImageView, kMGPipeMaxImageUnits>& LastImageViews() const { return m_entries; }
+        Uint64 ImageSetCount() const { return m_imageSets; }
+        Uint32 Window() const { return m_window; }
+
+    private:
+        // GL_READ_ONLY / GL_WRITE_ONLY / GL_READ_WRITE folded into the one byte the wire
+        // carries. A value the enum does not name would otherwise truncate silently into a
+        // Uint8, which is the class of bug the descriptors exist to close.
+        static Uint32 MGPipeEncodeImageAccess(GLenum access) {
+            switch (access) {
+            case GL_READ_ONLY:
+                return 0;
+            case GL_WRITE_ONLY:
+                return 1;
+            case GL_READ_WRITE:
+                return 2;
+            default:
+                MOBILEGL_ASSERT(false, "glBindImageTexture access 0x%x is not one of the three GL names",
+                                static_cast<Uint>(access));
+                return 0;
+            }
+        }
+
+        Array<MGPImageView, kMGPipeMaxImageUnits> m_entries{};
+        MGPShaderImages m_lastImages{};
+        Uint32 m_window = 0;
+        Uint64 m_imageSets = 0;
+    };
+
+    inline MGPipeImageEmitter& MGPipeImageEmitterInstance() {
+        // NEVER DESTROYED, for MGPipeTrackerInstance()' reason; heap-constructed and
+        // intentionally leaked at exit, like every other MGPipe process singleton.
+        static MGPipeImageEmitter* emitter = new MGPipeImageEmitter();
+        return *emitter;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/PipeFill.h

@@ -0,0 +1,151 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/PipeFill.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+// The fill point (ARCHITECTURE.md 9.2, P1 brief D7). MG_Impl spells MGP_FILL(Verb); as the
+// statement immediately before every call through gBackendFunctionsTable.GL - after every
+// early return the call is behind, inside the loop body for a call made in a loop - so the
+// frontend fills the PipeInputs block for exactly the verbs that reach a backend. In the
+// pull build the macro is ((void)0) and the pull build is byte-identical to a tree without
+// it.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/MGPipe.h>
+namespace MobileGL::MG_Pipe {
+    struct PipeInputs;
+
+    // PipeFill.cpp. THE VALIDATE POINT (ARCHITECTURE.md 5.1, P2 brief D1). In order:
+    //   1. bump the per-verb serial, record the verb and the context identity;
+    //   2. run the tracker's DIRTY WALK for this verb's class (MG_Impl/Pipe/Tracker.h);
+    //   3. EMIT, for each set dirty bit whose subsystem bit is on in the runtime
+    //      MOBILEGL_PIPE_PUSH bitmask, the P2 call that carries it;
+    //   4. run the P1 residual fill for every field an emitted call did NOT supply,
+    //      stamping each with the new serial exactly as before;
+    //   5. in a verify build, the entry compare against a second snapshot (P1 brief D8) -
+    //      which stops being a tautology the moment step 3 supplies a field step 4 skips.
+    //
+    // It was MGPipeFillForVerb through P1, when steps 2 and 3 did not exist. The macro
+    // spelling, the 83 call sites and the verb enum are unchanged: the dispatch is
+    // kMGPipeVerbClass's nine classes, which is the same code as nine named ValidateFor*
+    // entry points with one call site per verb instead of nine.
+    void MGPipeValidateForVerb(MGPipeVerb verb);
+
+    // Ends the verb in flight without starting another: bumps the serial, so every field the
+    // verb stamped goes stale, and puts the current verb back to "none", so a read made after
+    // it aborts as Fatal{UnmigratedPipeInput, "<Field>@<none>"} - which is what such a read
+    // is - instead of naming whichever verb happened to be filled last. Nothing in the GL
+    // entry points calls this: a real verb is always followed by the next verb's fill. It
+    // exists for a caller that drives a backend helper directly and wants its declaration to
+    // stop where it says it stops (MG_Test/ScopedPipeVerb.h).
+    void MGPipeLeaveVerb();
+
+    // PipeFill.cpp. DOES THIS BUILD, ON THIS BACKEND, AT THIS MASK, EMIT FOR THIS P4a FAMILY?
+    // (ID-39, widened by S-3 / ID-41.) The four conjuncts are the operator's per-subsystem bit
+    // in MOBILEGL_PIPE_PUSH, the family's own kMGPipeWired*Subsystem constant (`wired`, which
+    // the caller passes because it lives in the family's emit header and this header may not
+    // include one), and - for the four families P4a migrates - a backend having registered
+    // MGPipeResourceOps (the same per-backend signal `MGPipeResourceSubsystemEnabled()` has
+    // applied to P3a's buffers since the phase began) and every D-K2 dependency bit of the
+    // family being set in the same mask.
+    //
+    // THE LAST TWO CONJUNCTS ARE THE ONES THIS DECLARATION EXISTS FOR, and they are the same
+    // defect twice. Magma (DirectVulkan) registers no table and has no P4a twins; at a mask like
+    // 0x7ff Espryt REFUSES the texture family server-side because D-K2's fourth row says bit 10
+    // requires bit 11. In both cases the client emitted anyway, the applier accepted, the
+    // emitters cleared their per-level dirty flags on that acceptance, and the legacy upload
+    // path that still owed those texels found nothing to upload (66 DirectVulkan cases at ID-39,
+    // 47 DirectGLES cases at ID-41). With them the four families emit NOTHING in that state and
+    // the legacy pull path runs exactly as it does on a pull build.
+    //
+    // D-K2's TABLE IS IN PipeFill.cpp, ONCE: bit 9 requires bit 10, bit 10 requires bits 7 and
+    // 11, bit 11 requires bit 10, bit 12 depends on nothing - the client mirror, bit for bit, of
+    // the four `Resolve<Family>SubsystemArm()` refusals in DirectGLES/Managers.cpp.
+    //
+    // It is exported for the unit gate and for no other caller: the gate itself is
+    // FamilyIsLive() inside PipeFill.cpp, every birth hook and every `wants()` row resolves
+    // through it, and this returns that same expression rather than a second copy of it.
+    Bool MGPipeP4aFamilyEmits(Uint64 subsystem, Uint64 wired);
+
+    // PipeFill.cpp. P3a D-H2.1: the DRAW's raw vertex-fetch base instance, which
+    // set_vertex_buffers now carries as an explicit field.
+    //
+    // It replaces an ambient process global the backend read at VAO sync time, which is a
+    // shape that cannot cross a pushed boundary. The client sends the raw value and never a
+    // pre-shifted offset: whether to emulate the fetch shift or let GL_EXT_base_instance do
+    // it is the SERVER's decision. It is also an input to set_vertex_buffers' content hash
+    // and to the tracker's bit-9 shutter, so a draw whose only change is its base instance
+    // still reaches the emitter and still goes out.
+    //
+    // DO NOT CALL IT DIRECTLY FROM A GL ENTRY POINT - use MGP_SET_BASE_INSTANCE below. This
+    // whole declaration block is inside #if MOBILEGL_PIPE_PUSH, so a bare call would not even
+    // compile in a pull build, and the three call sites are in a file that is compiled in
+    // both. The macro is the same shape MGP_FILL already has, for the same reason.
+    //
+    // The validate point consumes and clears it - on both of its exits - and MGPipeLeaveVerb
+    // clears it too, so a plain draw that follows a base-instanced one sees 0 again. The
+    // tracker's Reset() deliberately does NOT clear it (Tracker.h): a make-current happens
+    // BETWEEN the setter and the fill that reads it.
+    //
+    // The three GL entry points that make this call (ID-10's grant) are
+    // MG_Impl/GLImpl/Drawing/GL_Drawing.cpp's DrawElementsInstancedBaseVertexBaseInstance,
+    // DrawElementsInstancedBaseInstance and DrawArraysInstancedBaseInstance - one line each,
+    // immediately above the MGP_FILL, carrying the RAW baseinstance argument.
+    void MGPipeSetPendingBaseInstance(Uint32 baseInstance);
+    // What the next set_vertex_buffers will carry. The unit gate reads it to pin that a
+    // make-current between the setter and the fill does not eat it
+    // (TrackerWalk.ABaseInstanceSurvivesTheFirstWalkOnAFreshContext).
+    Uint32 MGPipePendingBaseInstance();
+
+    // PipeFill.cpp. Negative control B (P1 brief D6): the filler withholds the STAMP - never
+    // the value - of `field` at `verb`, so that verb's read of it is
+    // Fatal{UnmigratedPipeInput, "Field@Verb"} while every other verb is unaffected. The
+    // MOBILEGL_PIPE_POISON_OMIT knob ("<Verb>:<FieldName>") calls this once, on the first
+    // fill; tests call it directly. Both null clears the omission. An unknown name is
+    // Fatal{PipeVerifyBadKnob}.
+    void MGPipeSetPoisonOmission(const char* verb, const char* field);
+
+    // PipeFill.cpp. How many times set_vertex_attrib_defaults' applier failed to reproduce
+    // the value the call carried, so the client wrote the mirror itself
+    // (EmitVertexAttribDefaults). It is the ONE observable of that repair: the window it
+    // covers is a verb whose class does not read m_currentVertexAttribute, where reading the
+    // storage to check it would be the poison violation the fill table exists to forbid. So
+    // TrackerShippedEmitter asserts on this counter instead, and the day package A's applier
+    // switches on MGPAttribValue::ValueClass the counter stops moving.
+    //
+    // Not hot-path instrumentation: it is incremented only inside the repair branch, which
+    // runs only when the call actually went out, which is only when an attribute default
+    // moved.
+    Uint64 MGPipeVertexAttribDefaultRepairCount();
+
+    // PipeFill.cpp. The header of the last set_vertex_attrib_defaults that actually went out
+    // - Mask, and Count == 0 for "none ever did", since a call naming no attribute is not
+    // emitted. Two properties of this call have no other observable, because reading
+    // m_currentVertexAttribute back at a verb whose class does not carry it is the poison
+    // violation the fill table exists to forbid: that a FRESH CONTEXT republishes all 32
+    // (the server's mirror still holds the previous context's defaults), and that one moved
+    // attribute publishes exactly one. Eight bytes, written only when a call goes out.
+    MGPVertexAttribDefaults MGPipeVertexAttribDefaultsLastHeader();
+
+#if MOBILEGL_PIPE_VERIFY
+    // PipeFill.cpp. The second arm of the comparator (P1 brief D8, ARCHITECTURE.md 13.2-2):
+    // fills `snapshot` from the live GLContext the old way, for every field in `mask`. This
+    // is the branch that survives P13, which is why it is its own function rather than the
+    // filler's loop.
+    void SnapshotFromGLContext(PipeInputs& snapshot, const MGPipeFieldMask& mask);
+#endif
+} // namespace MobileGL::MG_Pipe
+#define MGP_FILL(Verb) ::MobileGL::MG_Pipe::MGPipeValidateForVerb(::MobileGL::MG_Pipe::MGPipeVerb::Verb)
+// P3a D-H2.1. One line immediately ABOVE the MGP_FILL of a draw entry point that takes a
+// baseinstance, carrying the argument RAW. It has to be a macro for MGP_FILL's reason: the
+// three call sites are compiled in the pull build too, where MGPipeSetPendingBaseInstance is
+// neither declared nor defined.
+#define MGP_SET_BASE_INSTANCE(BaseInstance)                                                        \
+    ::MobileGL::MG_Pipe::MGPipeSetPendingBaseInstance(static_cast<::MobileGL::Uint32>(BaseInstance))
+#else
+#define MGP_FILL(Verb) ((void)0)
+#define MGP_SET_BASE_INSTANCE(BaseInstance) ((void)0)
+#endif

MobileGL/MG_Impl/Pipe/ProgramEmit.h

@@ -0,0 +1,484 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/ProgramEmit.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The CLIENT side of P4a's program family: create/bind/delete_shader_state,
+// set_draw_program, set_dispatch_program and set_global_constants.
+//
+// WHERE create_shader_state IS EMITTED FROM, and why it is not the tracker's business: the
+// tracker's bit-6 shutter reads GetCurrentProgram() and DELIBERATELY NOT GetProgramForDraw(),
+// because the tracker must not force a compile just to answer "did the shader move". So the
+// tracker keeps its shutter and the EMITTER joins - from the same GetProgramForDraw() /
+// GetProgramForDispatch() call the verb is about to make anyway, so no join happens that would
+// not have happened. Emitting from the compile pool's terminal continuation is a real
+// asynchronous win and is a LATER phase's: in monolith the applier is one function call away,
+// so it is unmeasurable here.
+//
+// WHAT THE SERVER STILL SPECIALISES, so nobody reads create_shader_state as self-contained
+// and produces a per-draw rebuild: the draw-FBO clamp masks, the fragColor broadcast count,
+// the storage-block binding signature, the atomic-counter set, the live image formats and the
+// patch parameters are all inputs a backend program depends on BEYOND the artefacts. This call
+// publishes the ARTEFACTS; the server specialises at the verb from the state it holds. The
+// clause count does not shrink - its inputs move.
+//
+// THE ARTEFACTS DO NOT TRAVEL IN MONOLITH. All seven of MGPProgramDesc's blob refs are
+// declared with Size 0 and the LinkArtifacts / SpirvArtifacts ride beside the record through
+// MGPipeApplyCreateShaderState's companion pointers, so the codec is never called on the hot
+// path; the verify build is where it is exercised.
+//
+// THIS FILE IS CREATED BY THE CONTRACT COMMIT AND FILLED BY THE PACKAGE THAT OWNS IT - see
+// FramebufferEmit.h for why, in full.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/CompositeResolver.h>
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/MGPipeHostSpan.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_Pipe/PipeMutation.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_State/GLState/ProgramState/ProgramObject.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+namespace MobileGL::MG_Pipe {
+
+    // WIRED. create/bind/delete_shader_state, set_draw_program, set_dispatch_program and
+    // set_global_constants all have bodies, so this family contributes its bit to
+    // kMGPipeWiredSubsystems.
+    //
+    // AND SINCE c0b THAT CONSTANT REALLY IS PART OF THE EMISSION GATE, so the note that used to
+    // say otherwise here was true only against the contract commit: the validate point's
+    // `wants()` asks the subsystem mapping, the operator's MOBILEGL_PIPE_PUSH mask, THIS
+    // CONSTANT and the dirty bit, and the birth hooks' `FamilyIsLive` asks the same pair one
+    // level in. It is also a compile-time contract - while it is non-zero PipeFill.cpp's
+    // `if constexpr` seam instantiates the forward to EmitShaderCso below, so a missing entry
+    // point is a build error here rather than at the merge. The RUNTIME A/B that switches the
+    // family off is still the mask. See SamplerEmit.h's twin note.
+    inline constexpr Uint64 kMGPipeWiredProgramSubsystem = kMGPipeSubsystemPrograms;
+
+    // D-H6. ~0u is the BACKENDS' "never uploaded" sentinel for a global-constants version, and
+    // ProgramObject::MarkUBOContentDirty skips it on the wrap for exactly that reason. The
+    // client must never put it on the wire either: a server that received it would read its own
+    // record as "nothing has ever been uploaded here" and re-upload for ever.
+    inline constexpr Uint32 kMGPipeGlobalConstantsNeverUploaded = ~Uint32{0};
+
+    inline constexpr Bool MGPipeGlobalConstantsVersionIsEmittable(Uint32 version) {
+        return version != kMGPipeGlobalConstantsNeverUploaded;
+    }
+
+    // A program's identity for the wire, out of the SNAPSHOT the last link consumed and never
+    // out of the live attach list: glAttachShader and glCompileShader take effect only at the
+    // NEXT link and neither moves m_linkVersion, so a stage mask built from GetAttachedShaders
+    // would describe a program that does not exist yet. GetLinkedShaderStages() is also what
+    // indexes GetGeneratedSpirv(), so the two halves of this descriptor are guaranteed to agree
+    // by construction rather than by care.
+    inline Uint32 MGPipeStageMaskOf(const MG_State::GLState::ProgramObject& program) {
+        Uint32 mask = 0;
+        for (const ShaderStage stage : program.GetLinkedShaderStages()) {
+            if (stage == ShaderStage::Unknown) continue;
+            mask |= Uint32{1} << static_cast<Uint32>(stage);
+        }
+        return mask;
+    }
+
+    class MGPipeProgramEmitter {
+    public:
+        using GLContext = MG_State::GLState::GLContext;
+        using ProgramObject = MG_State::GLState::ProgramObject;
+
+        // create_shader_state (re-issued on the SAME handle whenever the link version moves -
+        // Gen moves only on slot reuse), then bind_shader_state and set_draw_program /
+        // set_dispatch_program. Two program calls because the frontend has two joins and two
+        // PipeInputs slots.
+        //
+        // BOTH JOINS HAPPEN HERE and both are the verb's own: GetProgramForDraw flattens a
+        // bound pipeline into its composite and GetProgramForDispatch answers the compute
+        // question, and with a plain glUseProgram they are the same object, so the ordinary
+        // frame pays one join it was going to pay anyway.
+        Uint64 EmitShaderState(GLContext& ctx) {
+            Uint64 bytes = 0;
+            const auto& drawProgram = ctx.GetProgramForDraw();
+            const auto& dispatchProgram = ctx.GetProgramForDispatch();
+
+            const MGPipeHandle drawCso =
+                drawProgram ? AcquireShaderCso(*drawProgram, bytes) : kMGPipeNullHandle;
+            // THE COMPOSITE'S SECOND RELEASE PATH is spoken here, not in a destructor: when the
+            // bound pipeline's draw-program signature moves, the resolver releases the slot the
+            // previous composite held. Whichever of the two paths runs second - this one or the
+            // composite ProgramObject's own ~ProgramObject - is a proven no-op, because the slot
+            // allocator refuses a slot that is not live at that generation.
+            if (drawProgram && MGPipeProgramIsPipelineComposite(*drawProgram)) {
+                if (const auto& pipeline = ctx.GetBoundProgramPipeline()) {
+                    // THE CONTEXT IS PART OF THE RESOLVER's KEY and this is the only place that
+                    // supplies it: the resolver is a process singleton and a pipeline's GL name
+                    // is per context, so without it a make-current between two contexts holding
+                    // one pipeline name released the other context's LIVE composite.
+                    // GetTextureContextId() is the tree's never-reused per-context id, the same
+                    // one PipeInputs carries and the backends' per-context memos key on.
+                    MGPipeCompositeResolverInstance().Observe(ctx.GetTextureContextId(), *pipeline,
+                                                             *drawProgram, drawCso);
+                }
+            }
+            const MGPipeHandle dispatchCso =
+                dispatchProgram ? (dispatchProgram == drawProgram ? drawCso
+                                                                  : AcquireShaderCso(*dispatchProgram, bytes))
+                                : kMGPipeNullHandle;
+
+            // THE BOUND CSO IS THE DRAW ONE WHEN THERE IS ONE. bind_shader_state names what
+            // glUseProgram selected, and when a program pipeline is bound instead that is the
+            // composite; a compute-only pipeline has no draw program at all, and then the
+            // dispatch program is the only thing bound. A null handle is legal here and means
+            // exactly "nothing bound".
+            const MGPipeHandle boundCso = !MGPipeHandleIsNull(drawCso) ? drawCso : dispatchCso;
+            if (boundCso != m_boundCso) {
+                MGPipeApplyBindShaderState(HandleOnly(boundCso));
+                m_boundCso = boundCso;
+                ++m_binds;
+                bytes += sizeof(MGPHandleOnly);
+            }
+            if (drawCso != m_drawCso) {
+                MGPipeApplySetDrawProgram(HandleOnly(drawCso));
+                m_drawCso = drawCso;
+                ++m_drawSets;
+                bytes += sizeof(MGPHandleOnly);
+            }
+            if (dispatchCso != m_dispatchCso) {
+                MGPipeApplySetDispatchProgram(HandleOnly(dispatchCso));
+                m_dispatchCso = dispatchCso;
+                ++m_dispatchSets;
+                bytes += sizeof(MGPHandleOnly);
+            }
+            return bytes;
+        }
+
+        // set_global_constants: the DEFAULT UNIFORM BLOCK only, keyed (ShaderCso, Version) and
+        // at most once per program per frame. Version is GetUBOContentVersion() and must never
+        // be ~0u, which is the backends' "never uploaded" sentinel - the wrap skips it.
+        //
+        // NAMED uniform blocks are NOT this call's: set_shader_buffers(Uniform) is a later
+        // phase's and BindCurrentProgramWithResources' named-UBO block is untouched. What
+        // travels here is globalUboScratch, the link phase's CPU array, which has no GL name
+        // and no BufferObject behind it.
+        Uint64 EmitGlobalConstants(GLContext& ctx) {
+            const auto& program = ctx.GetProgramForDraw();
+            if (!program) return 0;
+            const Uint32 version = program->GetUBOContentVersion();
+            // THE SENTINEL IS NEVER EMITTED. A server that received ~0u would read its own
+            // record as "never uploaded" and re-upload every frame for ever.
+            if (!MGPipeGlobalConstantsVersionIsEmittable(version)) return 0;
+            const Uint size = program->GetUBOSize();
+            if (size == 0) return 0;
+
+            Uint64 bytes = 0;
+            const MGPipeHandle cso = AcquireShaderCso(*program, bytes);
+            // (ShaderCso, Version) IS the key, so the latch is the key: an unchanged pair means
+            // the server already holds these bytes and re-sending them would move the record's
+            // serial for nothing.
+            if (cso == m_constantsCso && version == m_constantsVersion) return bytes;
+
+            m_lastConstants = MGPGlobalConstants{};
+            m_lastConstants.ShaderCso = cso;
+            m_lastConstants.Version = version;
+            // THE ONE BLOB RULE: Size 0 means "this record does not declare its blob" - which
+            // is what a monolith emission is - and the bytes ride beside it as a companion
+            // pointer. Offset carries the staging address for diagnostics only; nothing reads
+            // it as a length.
+            m_lastConstants.Blob.Seg = kMGHostSpanSegNone;
+            m_lastConstants.Blob.Offset = reinterpret_cast<Uint64>(program->GetUBOData());
+            m_lastConstants.Blob.Size = 0;
+            MGPipeApplySetGlobalConstants(m_lastConstants, program->GetUBOData());
+            m_constantsCso = cso;
+            m_constantsVersion = version;
+            ++m_constantSets;
+            if (MG_Util::PipeStats::Enabled()) {
+                MG_Util::PipeStats::AddBytes(MG_Util::PipeStats::ByteClass::CsoBlobBytes, size);
+            }
+            return bytes + sizeof(MGPGlobalConstants) + size;
+        }
+
+        // D-H4's re-issue rule, and it is the CreateVertexElements shape one for one: the
+        // record goes out again on the SAME handle whenever the link version moves, which is
+        // legal because MGPipeHandle::Gen increments only on slot reuse and never on a
+        // respecify. A program that relinks is the same GL object and the server's twin table
+        // must not be asked to mint a second one.
+        MGPipeHandle AcquireShaderCso(const ProgramObject& program, Uint64& payloadBytes) {
+            const MGPipeHandle handle = AcquireShaderCsoHandle(program);
+            if (MGPipeHandleIsNull(handle)) return handle;
+            Latch& latch = LatchFor(handle);
+
+            const Uint32 linkVersion = program.GetLinkVersion();
+            if (latch.RecordLive && latch.RecordGen == handle.Gen && latch.LinkVersion == linkVersion) {
+                return handle;
+            }
+
+            const auto& link = program.GetLinkReflection();
+            const auto& spirv = program.GetSpirvReflection();
+
+            m_lastDesc = MGPProgramDesc{};
+            m_lastDesc.Cso = handle;
+            m_lastDesc.StageMask = MGPipeStageMaskOf(program);
+            m_lastDesc.GlobalUboSize = static_cast<Uint32>(program.GetUBOSize());
+            m_lastDesc.ReservedNumSamplesOffset = static_cast<Uint32>(spirv.reservedNumSamplesOffset);
+            m_lastDesc.SpirvStatus = spirv.spirvStatus ? 1 : 0;
+            m_lastDesc.NativeFloat64 = spirv.nativeFloat64 ? 1 : 0;
+            m_lastDesc.PointSizeDemoted = spirv.pointSizeDemoted ? 1 : 0;
+            m_lastDesc.EnableSpirvValidation = spirv.enableSpirvValidation ? 1 : 0;
+
+            // ONE BLOB REF PER MODULE, IN THE LINKED-SHADER-SNAPSHOT'S ORDER, which is the
+            // order GetGeneratedSpirv() is indexed in - so Spirv[i] and StageMask agree because
+            // they came out of the same snapshot. Every one of them declares Size 0 (the one
+            // Blob rule); Offset carries the module's staging address so a reader can see which
+            // slots are occupied without the record pretending to declare a length it does not
+            // own.
+            //
+            // A COUNTED REFUSAL AND NOT AN ASSERTION (D-J3). MOBILEGL_ASSERT compiles out at
+            // INFO, which is all three gate builds and every shipped build, so an assert here
+            // would leave the truncation below completely silent in exactly the builds that
+            // run - which is the idiom D-J3 exists to forbid. generatedSpirv cannot exceed six
+            // stages today, so this is a guard against a seventh; truncation is the safe
+            // direction and the counter is what makes it visible.
+            const SizeT moduleCount = spirv.generatedSpirv.size();
+            if (moduleCount > 6) ++m_moduleTruncations;
+            for (SizeT i = 0; i < moduleCount && i < 6; ++i) {
+                m_lastDesc.Spirv[i].Seg = kMGHostSpanSegNone;
+                m_lastDesc.Spirv[i].Offset = reinterpret_cast<Uint64>(spirv.generatedSpirv[i].data());
+                m_lastDesc.Spirv[i].Size = 0;
+            }
+            m_lastDesc.Reflection.Seg = kMGHostSpanSegNone;
+            m_lastDesc.Reflection.Offset = reinterpret_cast<Uint64>(&link);
+            m_lastDesc.Reflection.Size = 0;
+
+            MGPipeApplyCreateShaderState(m_lastDesc, &link, &spirv);
+            // THE CREATE WENT OUT, so the publication latch is taken here and nowhere else
+            // (contract-v2 §3.1). MGPipeEmitShaderCsoDestroyAndFree reads it, and without it
+            // delete_shader_state can never go out - for an ordinary program or for a
+            // composite, both of which take that one helper.
+            MGPipeNoteHandlePublished(MGPipeKind::ShaderCso, handle);
+            ++m_creates;
+            payloadBytes += sizeof(MGPProgramDesc);
+
+            // A RE-ISSUED create_shader_state CLEARS THE APPLIER's DEFAULT UNIFORM BLOCK (wire
+            // W6), so the (Cso, Version) latch that suppresses set_global_constants has to go
+            // with it or the block is never re-sent. The case the design worries about is a
+            // FAILED relink of a bound program - GL keeps the previous executable and its
+            // uniforms running - and the general one is any future re-issue trigger that does
+            // not happen to move the content version, of which a recycled slot is one.
+            // Invalidated rather than re-emitted here, because this function has no business
+            // deciding when the constants go out: the next EmitGlobalConstants sees an
+            // unlatched key and sends them.
+            if (m_constantsCso == handle) {
+                m_constantsCso = kMGPipeNullHandle;
+                m_constantsVersion = kMGPipeGlobalConstantsNeverUploaded;
+            }
+
+            latch.RecordLive = true;
+            latch.RecordGen = handle.Gen;
+            latch.LinkVersion = linkVersion;
+            return handle;
+        }
+
+        // ---- THE CONTRACT ENTRY POINT THIS FAMILY OWES (contract-v2 §3.4) ----
+        //
+        // PipeFill.cpp's MGPipeEmitShaderCsoCreate forwards here through the `if constexpr`
+        // seam keyed on kMGPipeWiredProgramSubsystem, so while that constant is non-zero this
+        // must exist and be spelled exactly like this. A thin wrapper on purpose:
+        // AcquireShaderCso above IS this family's handle rule - identity-addressed per
+        // ProgramObject, the composite band entered through the one door, the re-issue on the
+        // same handle and the publication - and a second copy of any of it here would be a
+        // second authority.
+        //
+        // THE HOOK HAS ALREADY APPLIED BOTH GATES (the operator's mask and the wired constant),
+        // so this body applies none of its own. The byte count is discarded: a birth is not a
+        // validate-point emission and has no payload budget to report into.
+        void EmitShaderCso(ProgramObject& program) {
+            Uint64 bytes = 0;
+            AcquireShaderCso(program, bytes);
+        }
+
+        // The emitter's OWN record memo - "have I already published a create_shader_state at
+        // this slot, for this generation, at this link version".
+        //
+        // IT IS NOT WHAT THE DEATH PATH ASKS, and that changed at c0b (contract-v2 §3.1/D17):
+        // MGPipeEmitShaderCsoDestroyAndFree reads A's publication latch, which is one answer
+        // per {kind, slot, gen} that all six death helpers share. This stays because the
+        // VERSION-FIRST SKIP needs it - it is the same latch AcquireShaderCso consults before
+        // it builds a descriptor - and because a unit case reads it.
+        //
+        // THE COMPOSITE BAND IS INDEXED SEPARATELY, for the allocator's own reason: the band
+        // base is 983040, so a slot-indexed vector would allocate ~983k latches for one program
+        // pipeline. Both spaces stay dense against their own high-water mark.
+        Bool RecordIsPublished(MGPipeHandle handle) const {
+            if (MGPipeHandleIsNull(handle)) return false;
+            const Vector<Latch>& table = TableOf(handle);
+            const SizeT slot = SlotIndexOf(handle);
+            if (slot >= table.size()) return false;
+            const Latch& latch = table[slot];
+            return latch.RecordLive && latch.RecordGen == handle.Gen;
+        }
+
+        // The memo's other half, and the bound-mirror clearing beside it.
+        //
+        // THE CALLER IS THE CONTRACT's DEATH HELPER (P4a final review C-2): the death path
+        // reads the contract's latch for the wire delete and then forwards here, before the
+        // slot is freed, so a dead handle no longer reads as published in this memo between
+        // the death and the recycle and the three bound mirrors never name a dead program.
+        // Gen-keyed, so a late notice for a slot already handed out again clears nothing of
+        // the successor's.
+        void NoteRecordDestroyed(MGPipeHandle handle) {
+            if (MGPipeHandleIsNull(handle)) return;
+            Vector<Latch>& table = TableOf(handle);
+            const SizeT slot = SlotIndexOf(handle);
+            if (slot < table.size() && table[slot].RecordGen == handle.Gen) {
+                table[slot] = Latch{};
+            }
+            if (m_boundCso == handle) m_boundCso = kMGPipeNullHandle;
+            if (m_drawCso == handle) m_drawCso = kMGPipeNullHandle;
+            if (m_dispatchCso == handle) m_dispatchCso = kMGPipeNullHandle;
+            if (m_constantsCso == handle) {
+                m_constantsCso = kMGPipeNullHandle;
+                m_constantsVersion = kMGPipeGlobalConstantsNeverUploaded;
+            }
+        }
+
+        // The validate point's FreshlyPrimed arm. MGPipeApplierReset clears DrawProgram,
+        // DispatchProgram and BoundShaderCso - all three are per-context WORKING STATE - so
+        // the three mirrors here go with them, or the first emission after a make-current
+        // would be suppressed as unchanged and the server would draw with the previous
+        // context's program bound.
+        //
+        // The RECORD half stays, and that is the rule rather than an oversight: the applier
+        // keeps its shader-CSO records across a make-current because a program lives in a share
+        // group, and re-publishing one would move its Serial for nothing. The global-constants
+        // key goes with the working state because its record's bytes are per (Cso, Version) and
+        // a fresh server has not been told them.
+        void Reset() {
+            m_boundCso = kMGPipeNullHandle;
+            m_drawCso = kMGPipeNullHandle;
+            m_dispatchCso = kMGPipeNullHandle;
+            m_constantsCso = kMGPipeNullHandle;
+            m_constantsVersion = kMGPipeGlobalConstantsNeverUploaded;
+            // The composite memo's freshness goes with them - and only its freshness. Its
+            // ENTRIES name composites whose frontend objects outlive the context switch, so
+            // releasing them here would emit a delete for a live program.
+            MGPipeCompositeResolverInstance().Reset();
+        }
+
+        void ResetCounters() {
+            m_creates = m_binds = m_drawSets = m_dispatchSets = m_constantSets = 0;
+            m_moduleTruncations = 0;
+        }
+
+        // ---- what a unit case reads ----
+        const MGPProgramDesc& LastProgramDesc() const { return m_lastDesc; }
+        const MGPGlobalConstants& LastGlobalConstants() const { return m_lastConstants; }
+        // THE (Cso, Version) KEY set_global_constants is suppressed against. Exposed so a case
+        // can pin that a re-issued create_shader_state invalidates it - the applier clears the
+        // block on the re-issue (wire W6), so a latch that survived it would never re-send.
+        MGPipeHandle GlobalConstantsCso() const { return m_constantsCso; }
+        Uint32 GlobalConstantsVersion() const { return m_constantsVersion; }
+        // D-J3's counted refusal: programs whose linked snapshot carried more modules than
+        // MGPProgramDesc::Spirv[] can name, and whose tail was therefore dropped.
+        Uint64 TruncatedModuleCount() const { return m_moduleTruncations; }
+        MGPipeHandle BoundCso() const { return m_boundCso; }
+        MGPipeHandle DrawCso() const { return m_drawCso; }
+        MGPipeHandle DispatchCso() const { return m_dispatchCso; }
+        Uint64 CreateCount() const { return m_creates; }
+        Uint64 BindCount() const { return m_binds; }
+        Uint64 DrawProgramSetCount() const { return m_drawSets; }
+        Uint64 DispatchProgramSetCount() const { return m_dispatchSets; }
+        Uint64 GlobalConstantsSetCount() const { return m_constantSets; }
+
+    private:
+        // THE ONE PLACE THE BAND CAN ENTER. An ordinary program's slot comes from the ordinary
+        // allocator door keyed on its lifetime id. CompositeResolver.h widens this to send a
+        // pipeline composite through MGPipeSlotAllocator::AllocateComposite instead, and
+        // nothing else about the emission changes - the server never learns a composite is a
+        // composite.
+        MGPipeHandle AcquireShaderCsoHandle(const ProgramObject& program) {
+            const Uint64 lifetimeId = program.GetLifetimeId();
+            const MGPipeHandle existing = MGPipeSlots().FindByLifetimeId(MGPipeKind::ShaderCso, lifetimeId);
+            if (!MGPipeHandleIsNull(existing)) return existing;
+            // A composite is minted off ITS OWN lifetime id, out of the reserved band, and is
+            // an ordinary ShaderCso handle in every other respect - the same kind, the same
+            // {slot, gen} rules, the same Free, the same death helper. Keying it on its own
+            // lifetime id rather than on the pipeline's signature is what makes ~ProgramObject
+            // able to release it at all, and it is why two pipelines that happen to have the
+            // same signature keep their own composite: sharing one handle between two frontend
+            // objects would let the first one's death free a slot the second still names.
+            return MGPipeProgramIsPipelineComposite(program)
+                       ? MGPipeSlots().AllocateComposite(lifetimeId)
+                       : MGPipeSlots().AllocateFor(MGPipeKind::ShaderCso, lifetimeId);
+        }
+
+        struct Latch {
+            Bool RecordLive = false;
+            Uint32 RecordGen = 0;
+            Uint32 LinkVersion = 0;
+        };
+
+        // TWO TABLES, NOT A WIDER ONE, and it is the allocator's own reason repeated where it
+        // bites a second time: the composite band starts at slot 983040, so folding a composite
+        // into the ordinary slot-indexed vector would allocate ~983k latches - and grow them
+        // again on every future push_back - for a single program pipeline. Both spaces stay
+        // dense against their own high-water mark, which is exactly what the allocator does one
+        // level down.
+        Vector<Latch>& TableOf(MGPipeHandle handle) {
+            return MGPipeIsCompositeShaderSlot(handle.Slot) ? m_compositeLatch : m_latch;
+        }
+        const Vector<Latch>& TableOf(MGPipeHandle handle) const {
+            return MGPipeIsCompositeShaderSlot(handle.Slot) ? m_compositeLatch : m_latch;
+        }
+        static SizeT SlotIndexOf(MGPipeHandle handle) {
+            return MGPipeIsCompositeShaderSlot(handle.Slot)
+                       ? static_cast<SizeT>(handle.Slot - kMGPipeShaderCsoCompositeSlotBase)
+                       : static_cast<SizeT>(handle.Slot);
+        }
+        Latch& LatchFor(MGPipeHandle handle) {
+            Vector<Latch>& table = TableOf(handle);
+            const SizeT slot = SlotIndexOf(handle);
+            if (slot >= table.size()) table.resize(slot + 1);
+            return table[slot];
+        }
+
+        static MGPHandleOnly HandleOnly(MGPipeHandle handle) {
+            MGPHandleOnly only{};
+            only.Handle = handle;
+            only.Kind = static_cast<Uint32>(MGPipeKind::ShaderCso);
+            return only;
+        }
+
+        MGPProgramDesc m_lastDesc{};
+        MGPGlobalConstants m_lastConstants{};
+
+        Vector<Latch> m_latch;
+        Vector<Latch> m_compositeLatch;
+        MGPipeHandle m_boundCso = kMGPipeNullHandle;
+        MGPipeHandle m_drawCso = kMGPipeNullHandle;
+        MGPipeHandle m_dispatchCso = kMGPipeNullHandle;
+        MGPipeHandle m_constantsCso = kMGPipeNullHandle;
+        Uint32 m_constantsVersion = kMGPipeGlobalConstantsNeverUploaded;
+
+        Uint64 m_creates = 0;
+        Uint64 m_binds = 0;
+        Uint64 m_drawSets = 0;
+        Uint64 m_dispatchSets = 0;
+        Uint64 m_constantSets = 0;
+        Uint64 m_moduleTruncations = 0;
+    };
+
+    inline MGPipeProgramEmitter& MGPipeProgramEmitterInstance() {
+        // NEVER DESTROYED, for MGPipeTrackerInstance()' reason; heap-constructed and
+        // intentionally leaked at exit, and it MUST NOT hold a frontend SharedPtr - that is
+        // the exit-order rule, stated over every MGPipe process singleton rather than over the
+        // ones a destructor reaches today.
+        static MGPipeProgramEmitter* emitter = new MGPipeProgramEmitter();
+        return *emitter;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/ResourceTracker.h

@@ -0,0 +1,615 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/ResourceTracker.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The CLIENT side of P3a's resource family (brief D-A, D-B, D-C, D-D).
+//
+// WHERE IT RUNS, and it is the ONE exception to push-at-validate (ARCHITECTURE.md 5.1):
+// the seven BufferBackendOps hooks already dispatch at the GL call that causes them, so
+// their pipe calls are emitted from the same BufferObject dispatchers - not from
+// MGPipeValidateForVerb. Nothing about buffers moves to validate time in P3a.
+//
+// WHAT LIVES HERE
+//   * the sticky BindMask, one constexpr BufferTarget -> bit table with a static_assert
+//     that it covers every enumerator, so a new target cannot be silently unmapped;
+//   * the lifetimeId -> {slot, gen} mint (through MGPipeSlots(), the one allocator) and
+//     the slot -> BufferObject* INVERSE the reverse channel resolves a writeback through;
+//   * the nine MGPipeEmitResource* bodies, declared in MG_Pipe/PipeMutation.h so that
+//     MG_State sees a declaration and never this file (the same layering PipeMutation.h
+//     already has for MGP_NOTE_MUTATION: declare in MG_Pipe, define in MG_Impl);
+//   * the MGPSubData range splitter, because one record's box caps the destination at a
+//     2^31-1 offset and a 2^32-1 size;
+//   * the map-persistent-roundtrips counting site.
+//
+// HEADER-ONLY, for the ownership reason Tracker.h states in full: the root CMakeLists.txt
+// that would name a new .cpp belongs to the contract package and is frozen behind the tag.
+// MG_Impl/Pipe/PipeFill.cpp is the one translation unit that includes it in the library.
+//
+// NO TIMER, and no per-call record copy on a HOT path. The two observables a unit case
+// needs - the last emitted descriptor and the per-call counts - are written only by
+// resource_create and resource_respecify, which run once per glBufferData rather than per
+// upload; resource_subdata, the hot one, is observed through the pure builders below
+// instead (MGPipeBuildSubDataRecord / MGPipeForEachSubDataRecordRange), which is also what
+// lets a test drive the splitter at both of its bounds without a 4 GiB buffer.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_Pipe/PipeMutation.h>
+#include <MG_State/GLState/BufferState/BufferState.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+#include <Config.h>
+
+#include <cstdint>
+
+namespace MobileGL::MG_Pipe {
+
+    // ---------------------------------------------------------------------------------
+    // D-A3: BindMask
+    // ---------------------------------------------------------------------------------
+
+    // MGPResourceDesc::BindMask's twelve bits MOVED TO MG_Pipe/MGPipeTypes.h AT P4a, beside
+    // the field, exactly as the note that stood here said they would when a second producer
+    // appeared: P4a's texture family sets kMGPipeBindSampler / kMGPipeBindShaderImage /
+    // kMGPipeBindRenderTarget / kMGPipeBindDepthStencil, the four bits nothing set before.
+    // No alias is written for them because none is possible or needed - both files are
+    // namespace MobileGL::MG_Pipe and this one includes that header, so every spelling below
+    // and in package B's code is unchanged.
+    //
+    // What stays here is the BUFFER half of the mapping, which is this file's own: the
+    // BufferTarget table, its sentinel and its completeness assert.
+
+    // A sentinel the table below returns for an enumerator it does not name. It is NOT a
+    // legal mask value: every enumerator must be listed, including the ones that map to no
+    // bit at all, so that ADDING a BufferTarget is a build break here rather than a bit
+    // that silently stops being published.
+    inline constexpr Uint32 kMGPipeBindUnmapped = 0x10000u;
+
+    // The one table. No `default:` arm on purpose - that is what makes the static_assert
+    // below able to see an unnamed enumerator.
+    constexpr Uint32 MGPipeBindMaskForBufferTarget(BufferTarget target) {
+        switch (target) {
+        case BufferTarget::Vertex:
+            return kMGPipeBindVertex;
+        // GL_ELEMENT_ARRAY_BUFFER is the VAO's element slot: the same bind is both "this
+        // resource is an index buffer" and "the server may need its bytes on its own side".
+        case BufferTarget::Index:
+            return kMGPipeBindIndex | kMGPipeBindElementArray;
+        case BufferTarget::Uniform:
+            return kMGPipeBindConstant;
+        case BufferTarget::ShaderStorage:
+            return kMGPipeBindShaderBuffer;
+        case BufferTarget::DispatchIndirect:
+        case BufferTarget::DrawIndirect:
+        case BufferTarget::Parameter:
+            return kMGPipeBindIndirect;
+        // A texture buffer's backing store is SAMPLED through the texture that names it.
+        case BufferTarget::Texture:
+            return kMGPipeBindSampler;
+        case BufferTarget::TransformFeedback:
+            return kMGPipeBindStreamOutput;
+        case BufferTarget::AtomicCounter:
+            return kMGPipeBindAtomic;
+        // TRANSFER AND QUERY TARGETS, which the bind mask deliberately does not name: none
+        // of them is a pipeline binding, none of them makes the server keep anything, and
+        // a bit set for them would only widen what a split server mirrors. Listed rather
+        // than defaulted, so the completeness assert still sees them.
+        case BufferTarget::CopyRead:
+        case BufferTarget::CopyWrite:
+        case BufferTarget::PixelPack:
+        case BufferTarget::PixelUnpack:
+        case BufferTarget::Query:
+            return kMGPipeBindNone;
+        case BufferTarget::BufferTargetCount:
+        case BufferTarget::Unknown:
+            return kMGPipeBindNone;
+        }
+        return kMGPipeBindUnmapped;
+    }
+
+    constexpr Bool MGPipeEveryBufferTargetIsMapped() {
+        for (SizeT i = 0; i < static_cast<SizeT>(BufferTarget::BufferTargetCount); ++i) {
+            if (MGPipeBindMaskForBufferTarget(static_cast<BufferTarget>(i)) == kMGPipeBindUnmapped) {
+                return false;
+            }
+        }
+        return true;
+    }
+    static_assert(MGPipeEveryBufferTargetIsMapped(),
+                  "a BufferTarget enumerator has no MGPResourceDesc::BindMask row: add it to "
+                  "MGPipeBindMaskForBufferTarget, including a deliberate kMGPipeBindNone, or the "
+                  "resource it is bound to stops publishing that binding (D-A3, P8 expectation 1)");
+    static_assert(MGPipeBindMaskForBufferTarget(BufferTarget::Index) & kMGPipeBindElementArray,
+                  "the ELEMENT_ARRAY bit is the index host mirror's switch (ARCHITECTURE.md 10.3)");
+
+    // ---------------------------------------------------------------------------------
+    // The discriminators MGPResourceDesc / MGPSubData carry for a BUFFER
+    // ---------------------------------------------------------------------------------
+    //
+    // P4a MINTED THE FIRST LIST: MGPipeTypes.h now carries enum MGPipeResourceTarget beside
+    // the field, and kMGPipeResourceTargetBuffer moved there with it - the narrowed
+    // resource_respecify ack predicate lives in that header and has to name the buffer target
+    // explicitly, and it may not reach into MG_Impl to do so. The second discriminator is the
+    // frontend enum, named rather than open-coded, and stays here because only this file
+    // produces it.
+    inline constexpr Uint8 kMGPipeResourceStorageKindBuffer =
+        static_cast<Uint8>(MobileGL::TextureStorageType::Buffer);
+
+    // ---------------------------------------------------------------------------------
+    // D-A2: the payload builders. Pure, so a unit case can assert field by field.
+    // ---------------------------------------------------------------------------------
+
+    // The descriptor for `buffer`. `storageDefined` is false for the create that the
+    // constructor emits - storage is defined lazily by the first respecify and a backend
+    // tolerates a resource that has none - and true for every respecify.
+    inline MGPResourceDesc MGPipeBuildResourceDesc(const MG_State::GLState::BufferObject& buffer,
+                                                   MGPipeHandle handle, Uint16 bindMask,
+                                                   Bool storageDefined) {
+        MGPResourceDesc desc{};
+        desc.Resource = handle;
+        desc.Target = static_cast<Uint8>(kMGPipeResourceTargetBuffer);
+        desc.StorageKind = kMGPipeResourceStorageKindBuffer;
+        desc.BindMask = bindMask;
+        if (storageDefined) {
+            // MGPResourceDesc::Width is a Uint32 and that is the CONTRACT's shape, not this
+            // package's, so a store of 4 GiB or more cannot be declared at all. Truncating it
+            // silently is the one answer that must not happen: the applier's range gate would
+            // then refuse the first legal write past the truncated extent as
+            // Fatal{ProtocolCorruption} and name a corruption that is really a narrowing here.
+            // So it is said out loud, once, in every build - the assertion compiles out at
+            // INFO, which is what all three gate builds are.
+            if (buffer.GetSize() > static_cast<SizeT>(0xFFFFFFFFull)) {
+                MGLOG_E_ONCE("MGPipe: buffer %u declares a store of %llu bytes, which does not fit "
+                             "MGPResourceDesc::Width - the descriptor's extent is narrowed and every "
+                             "write past 4 GiB will be refused by the applier's range gate",
+                             buffer.GetExternalIndex(),
+                             static_cast<unsigned long long>(buffer.GetSize()));
+                MOBILEGL_ASSERT(false, "MGPResourceDesc::Width cannot carry this buffer's size");
+            }
+            desc.Width = static_cast<Uint32>(buffer.GetSize());
+            desc.Usage = static_cast<Uint32>(buffer.GetUsage());
+            desc.StorageFlags = static_cast<Uint32>(buffer.GetStorageFlags());
+            desc.Immutable = buffer.IsImmutableStorage() ? 1 : 0;
+            desc.HasDefinedContent = buffer.HasDefinedContent() ? 1 : 0;
+        }
+        // Diagnostics only: a GL name is never an identity, never a memo key and never part
+        // of a content hash (ARCHITECTURE.md 4.2.1).
+        desc.GlNameForDiag = static_cast<Uint32>(buffer.GetExternalIndex());
+        return desc;
+    }
+
+    // The buffer half of MGPSubData: the destination range rides in the box's first
+    // coordinate and first extent, and MGPipeSetSubDataBufferRange is the ONLY spelling of
+    // that convention. Returns false, with the record untouched, when the range does not fit
+    // one record - which is where MGPipeForEachSubDataRecordRange comes in.
+    //
+    // `sourceIsVerbatimLevelShadow` is the record's own question - "are these bytes an
+    // untransformed level shadow?" - and it is a PARAMETER because the answer differs by
+    // caller: resource_subdata hands over the client's own shadow at an offset into it and
+    // says yes; buffer_subdata_resident hands over the application's staging store, or the
+    // locally expanded pattern FillSubData built, and both say no. Nothing reads it on the
+    // buffer path today, which is exactly why it must not be a hard-coded 1 that becomes
+    // wrong the moment something does.
+    //
+    // Blob is FILLED, exactly: Seg is kMGHostSpanSegNone (monolith - the bytes travel beside
+    // the record through the entry point's companion pointer) and Size is the piece's own
+    // byte length, which is what the applier's ONE Blob rule holds a non-zero declaration to
+    // (PipeApply.cpp's SubDataBoxFault: != 0 && != MGPipeSubDataBufferSize is refused).
+    // Leaving it 0 would be legal too; declaring it correctly is the stronger of the two.
+    inline Bool MGPipeBuildSubDataRecord(MGPipeHandle res, Uint64 offset, Uint64 size, MGPSubData& out,
+                                         Bool sourceIsVerbatimLevelShadow) {
+        out = MGPSubData{};
+        out.Res = res;
+        out.Target = kMGPipeResourceTargetBuffer;
+        out.SourceIsVerbatimLevelShadow = sourceIsVerbatimLevelShadow ? 1 : 0;
+        if (!MGPipeSetSubDataBufferRange(out, offset, size)) return false;
+        out.Blob.Seg = kMGHostSpanSegNone;
+        out.Blob.Size = size;
+        return true;
+    }
+
+    // ONE record's destination box caps the offset at 2^31-1 and the size at 2^32-1
+    // (MGPipeTypes.h), so a range beyond either has to be split. The pieces are CONTIGUOUS
+    // and in ASCENDING order, and both properties are load-bearing rather than tidy:
+    // splitting a content write into overlapping or reordered pieces would change what the
+    // backend's queue-and-drain sees, and the Mali WAR-stall fix depends on that queue being
+    // exactly the writes the application made.
+    inline constexpr Uint64 kMGPipeSubDataMaxRecordOffset = 0x7FFFFFFFull;
+    inline constexpr Uint64 kMGPipeSubDataMaxRecordSize = 0xFFFFFFFFull;
+
+    // WITH THE RECORD'S OWN BOUND THE SPLIT IS NOT REACHABLE, and saying so is better than a
+    // loop that reads as if it were: a second piece starts at least 2^32-1 bytes past the
+    // first, which is already past the OFFSET cap, so a range too big for one record is
+    // REFUSED rather than split. The offset cap cannot be split away at all - every piece of
+    // a range that starts past 2^31-1 starts past it too - and a silent truncation is the one
+    // answer that must not happen, so the walk emits nothing and its caller says so once.
+    //
+    // `maxChunk` exists because the record's bound is not the tight one for long: a transport
+    // segment is far smaller (tens of MiB), and that is where this walk starts producing real
+    // splits. It is a parameter now, and exercised at a reachable value by the unit gate, so
+    // that lowering it is one argument rather than a new code path written under pressure.
+    template <class Fn>
+    inline Bool MGPipeForEachSubDataRecordRange(Uint64 offset, Uint64 size, Fn&& piece,
+                                                Uint64 maxChunk = kMGPipeSubDataMaxRecordSize) {
+        if (offset > kMGPipeSubDataMaxRecordOffset) return false;
+        if (size == 0) return true;
+        if (maxChunk == 0) return false;
+        // Every piece has to be encodable BEFORE any of them is emitted: a half-emitted range
+        // is a partial content write the backend would land as if it were the whole one.
+        const Uint64 chunkCap = maxChunk < kMGPipeSubDataMaxRecordSize ? maxChunk : kMGPipeSubDataMaxRecordSize;
+        for (Uint64 at = offset; at < offset + size; at += chunkCap) {
+            if (at > kMGPipeSubDataMaxRecordOffset) return false;
+        }
+        for (Uint64 at = offset, left = size; left > 0;) {
+            const Uint64 chunk = left > chunkCap ? chunkCap : left;
+            piece(at, chunk);
+            at += chunk;
+            left -= chunk;
+        }
+        return true;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // The tracker: handles, the inverse, the sticky mask, the reverse channel
+    // ---------------------------------------------------------------------------------
+
+    class MGPipeResourceTracker {
+    public:
+        using BufferObject = MG_State::GLState::BufferObject;
+        using GLContext = MG_State::GLState::GLContext;
+
+        // The handle for `buffer`, minted on first use. Minting is NOT gated on a backend
+        // having registered MGPipeResourceOps: the handle is CLIENT state and
+        // set_vertex_buffers names it whether or not the resource family is switched on, so
+        // gating it would make the vertex-input subsystem emit null handles whenever the
+        // resource subsystem is off. Only the CALLS are gated (D-A1).
+        MGPipeHandle Acquire(BufferObject& buffer) {
+            const MGPipeHandle handle = MGPipeSlots().Acquire(MGPipeKind::Buffer, buffer.GetLifetimeId());
+            const SizeT slot = handle.Slot;
+            if (slot >= m_bySlot.size()) m_bySlot.resize(slot + 1);
+            m_bySlot[slot].Object = &buffer;
+            m_bySlot[slot].Gen = handle.Gen;
+            return handle;
+        }
+
+        // The handle a buffer already has, or the null handle. Never mints - the emission
+        // path calls Acquire, the query paths call this.
+        MGPipeHandle Find(const BufferObject& buffer) const {
+            return MGPipeSlots().FindByLifetimeId(MGPipeKind::Buffer, buffer.GetLifetimeId());
+        }
+
+        // D-D's inverse, and a RAW pointer is exact here: the entry exists only between the
+        // create the constructor emits and the destroy the destructor emits, and a readback
+        // is only ever issued for a live, bound buffer. A WeakPtr would be wrong - the
+        // object does not own itself through a SharedPtr at those two moments. The Gen
+        // compare is what refuses a stale handle rather than resolving it to whatever now
+        // occupies the slot.
+        BufferObject* Resolve(MGPipeHandle handle) const {
+            const SizeT slot = handle.Slot;
+            if (MGPipeHandleIsNull(handle) || slot >= m_bySlot.size()) return nullptr;
+            const Entry& entry = m_bySlot[slot];
+            if (entry.Object == nullptr || entry.Gen != handle.Gen) return nullptr;
+            if (MGPipeSlots().GenOfSlot(MGPipeKind::Buffer, handle.Slot) != handle.Gen) return nullptr;
+            return entry.Object;
+        }
+
+        // Drops the inverse entry and the sticky mask. The CALLER frees the slot afterwards,
+        // in that order (D-L): MGPipeSlotAllocator::Free erases the lifetimeId -> slot
+        // mapping, so anything that has to resolve the handle must do it first.
+        void Retire(MGPipeHandle handle) {
+            const SizeT slot = handle.Slot;
+            if (slot >= m_bySlot.size()) return;
+            m_bySlot[slot] = Entry{};
+        }
+
+        // ---- D-L: was resource_create actually EMITTED for this slot? ----
+        //
+        // The create is gated at its call site (BufferObject's constructor) and the destroy
+        // is gated inside MGPipeEmitResourceDestroyAndFree, so the two ask the SAME question
+        // at two different moments. A buffer constructed while a backend's table was
+        // registered and destroyed after UnregisterBufferBackendOps() would take the second
+        // answer, free its slot, and leave the applier's record Live - on a slot the
+        // allocator is about to hand out again, with the backend's twin (a driver buffer id)
+        // still attached to it. So the answer is LATCHED at the create and the destroy uses
+        // the latched one; the two are then a pair by construction rather than by the
+        // registration outliving every buffer.
+        void NotePublished(MGPipeHandle handle) {
+            const SizeT slot = handle.Slot;
+            if (slot >= m_bySlot.size()) return;
+            m_bySlot[slot].Published = true;
+        }
+        Bool WasPublished(MGPipeHandle handle) const {
+            const SizeT slot = handle.Slot;
+            return slot < m_bySlot.size() && m_bySlot[slot].Published;
+        }
+
+        // The sticky everBoundAs mask. Sticky exactly as MGPResourceDesc::ImageBindableHint's
+        // everImageBound is: ORed, never cleared, so a buffer that was an element array once
+        // keeps saying so.
+        Uint16 BindMask(MGPipeHandle handle) const {
+            const SizeT slot = handle.Slot;
+            return slot < m_bySlot.size() ? m_bySlot[slot].BindMask : Uint16{0};
+        }
+
+        // OR one target's bit into a handle's sticky mask, without looking at the context at
+        // all. This is what closes the sampling window for the two bits anything keys on:
+        // the vertex-input emitters resolve, at EVERY draw, exactly the attribute buffers and
+        // the element-slot buffer, so any buffer ever DRAWN FROM carries its ARRAY_BUFFER /
+        // ELEMENT_ARRAY bit for the rest of its life whether or not it happened to be bound
+        // at a storage op. It grows the table rather than dropping the note: it is called
+        // from the validate point, which is GL-thread by construction, and a slot outside the
+        // table is a buffer whose mint this process has not seen (a unit fixture's
+        // ResetForTest, in practice).
+        void NoteBoundAs(MGPipeHandle handle, BufferTarget target) {
+            if (MGPipeHandleIsNull(handle)) return;
+            const SizeT slot = handle.Slot;
+            if (slot >= m_bySlot.size()) m_bySlot.resize(slot + 1);
+            m_bySlot[slot].BindMask |= static_cast<Uint16>(MGPipeBindMaskForBufferTarget(target));
+        }
+
+        // Accumulates into the sticky mask every target `buffer` is bound to RIGHT NOW, and
+        // returns the accumulated value.
+        //
+        // [DEVIATION, recorded in client-v2.md] D-A3 asks for the OR at every glBindBuffer /
+        // glBindBufferBase / glBindBufferRange / VAO element-slot bind, and C.1 points at
+        // MG_State/GLState/BufferState/BufferState.{h,cpp} for it - a file this package DOES
+        // own. The brief is wrong about where the entry points are: BufferState only VENDS
+        // BindingSlot<BufferObject>& / BindingSlotRange1D&, and the .Bind() calls are
+        // MG_Impl/GLImpl/Buffer/GL_Buffer.cpp's (BindBuffer_State, BindBufferBase_State,
+        // BindBufferRange_State), which C.5 assigns to no package. So the mask is accumulated
+        // by SAMPLING the frontend's live binding state instead - here, at every create and
+        // respecify, which is where the value is PUBLISHED - and ORed into a per-slot sticky
+        // field that is never cleared.
+        //
+        // WHAT SAMPLING ALONE CANNOT SEE is not "a bind after the last respecify" (which the
+        // specified design misses too) but a TRANSIENT bind: bind an EBO, draw, unbind, then
+        // define it through DSA - the respecify's sample sees no binding at all, and the DSA
+        // idiom makes that the common case rather than a corner (TryAdoptLargeStorage's own
+        // comment names glNamedBufferSubData as what MC 26.3 streams with). That hole is
+        // closed for the two bits anything keys on by NoteBoundAs above, called from
+        // EmitVertexBuffers / EmitIndexBuffer at every draw. What is left unpublished is a
+        // buffer that is bound, never drawn from, and never re-specified afterwards; the
+        // remaining fix is one line in each of GL_Buffer.cpp's three *_State binders, for the
+        // seven bits nothing keys on yet, and it stays handed to whoever owns that file.
+        //
+        // The scan is skipped unless a binding-slot version moved since the last one, which
+        // is one Uint16 load per global target and none per binding point. It is NOT called
+        // from the content emitters, deliberately: it walks the whole context's binding state
+        // and writes the tracker, and one of those emitters (resource_subdata) is on the path
+        // D-A2 preserves as reachable off the render thread. Extra sampling could only widen
+        // a sticky union, but not at the price of a context-wide read from the wrong thread.
+        Uint16 RefreshBindMask(GLContext& ctx, const BufferObject& buffer, MGPipeHandle handle) {
+            const SizeT slot = handle.Slot;
+            if (slot >= m_bySlot.size()) return 0;
+            Entry& entry = m_bySlot[slot];
+            const Uint64 epoch = BindEpoch(ctx);
+            if (epoch == m_bindEpoch && entry.BindMaskEpoch == epoch) return entry.BindMask;
+            m_bindEpoch = epoch;
+            entry.BindMaskEpoch = epoch;
+            Uint16 mask = entry.BindMask;
+            for (const auto target : MG_State::GLState::GlobalBufferTargets) {
+                if (ctx.GetBufferBindingSlot(target).GetBoundObject().get() == &buffer) {
+                    mask |= static_cast<Uint16>(MGPipeBindMaskForBufferTarget(target));
+                }
+            }
+            for (const auto target : MG_State::GLState::BufferBindPointTargets) {
+                const SizeT touched = ctx.GetTouchedBufferBindingPointCount(target);
+                for (SizeT i = 0; i < touched; ++i) {
+                    if (ctx.GetBufferBindingPoint(target, static_cast<Uint>(i)).GetBoundObject().get() == &buffer) {
+                        mask |= static_cast<Uint16>(MGPipeBindMaskForBufferTarget(target));
+                        break;
+                    }
+                }
+            }
+            // The index slot is the BOUND VAO's, not BufferState's, so it is not in
+            // GlobalBufferTargets and GetBufferBindingSlot(Index) asserts without a VAO.
+            if (const auto& vao = ctx.GetBoundVertexArray()) {
+                if (vao->GetIndexBufferBindingSlot().GetBoundObject().get() == &buffer) {
+                    mask |= static_cast<Uint16>(MGPipeBindMaskForBufferTarget(BufferTarget::Index));
+                }
+                for (int i = 0; i < MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS; ++i) {
+                    if (vao->GetAttribute(static_cast<Uint>(i)).Buffer.get() == &buffer) {
+                        mask |= static_cast<Uint16>(MGPipeBindMaskForBufferTarget(BufferTarget::Vertex));
+                        break;
+                    }
+                }
+            }
+            entry.BindMask = mask;
+            return mask;
+        }
+
+        // ---- the two observables a unit case reads (see the header comment) ----
+        const MGPResourceDesc& LastDesc() const { return m_lastDesc; }
+        Uint64 CreateCount() const { return m_creates; }
+        Uint64 RespecifyCount() const { return m_respecifies; }
+        Uint64 DestroyCount() const { return m_destroys; }
+        Uint64 MapPersistentCount() const { return m_mapPersistents; }
+
+        void NoteDesc(const MGPResourceDesc& desc, Bool isCreate) {
+            m_lastDesc = desc;
+            if (isCreate) {
+                ++m_creates;
+            } else {
+                ++m_respecifies;
+            }
+        }
+        void NoteDestroy() { ++m_destroys; }
+        void NoteMapPersistent() { ++m_mapPersistents; }
+
+        // A unit fixture's per-case reset, and the library never calls it. THE RULE, stated
+        // rather than left as an absence, because "nothing resets this" is not a reason:
+        //
+        //   A buffer handle and the applier record it names are SHARE-GROUP OBJECT STATE.
+        //   A GL object lives in a share group, not in a context, so a make-current changes
+        //   neither. The applier's MGPipeApplierReset() is a make-current and deliberately
+        //   keeps its Resources / VertexElementsCsos (PipeApply.h says so beside them); the
+        //   ONLY things that drop a record are the object's own death signal -
+        //   resource_destroy, which ~BufferObject raises through
+        //   MGPipeEmitResourceDestroyAndFree, and delete_vertex_elements - and
+        //   MGPipeApplierReleaseObjectRecords(), which is the SERVED CONTEXT's teardown and
+        //   is deliberately wired to nothing in the monolith (there is one applier behind
+        //   every context, so calling it on one context's destruction would drop every other
+        //   context's records).
+        //
+        // So this tracker needs no re-publication path on a fresh context and must not have
+        // one: re-emitting resource_create for a record the applier still holds would move
+        // its Serial for nothing. What the client owes instead is the destroy - which
+        // ~BufferObject already emits, in the fixed emit-then-free order (D-L) - and that is
+        // the whole of the client's side of the record lifecycle.
+        //
+        // The vertex-input emitter's latches are the OTHER half and are genuinely per
+        // context: MGPipeVertexInputEmitter::Reset() is called from the FreshlyPrimed arm
+        // because the applier's vertex-input WORKING state (the bound handle, the window, the
+        // fetch shift) IS cleared there. Its vertex-elements RECORDS are not, which is why
+        // the emitter's Reset drops the "already published" latches but no create is lost:
+        // the latch is what says "re-publish", and re-publishing an unchanged configuration
+        // is a bounded over-fire, not a dropped write.
+        void ResetForTest() {
+            m_bySlot.clear();
+            m_bindEpoch = 0;
+            m_lastDesc = MGPResourceDesc{};
+            m_creates = m_respecifies = m_destroys = m_mapPersistents = 0;
+        }
+
+    private:
+        struct Entry {
+            BufferObject* Object = nullptr;
+            Uint32 Gen = 0;
+            Uint16 BindMask = 0;
+            Bool Published = false;
+            Uint64 BindMaskEpoch = 0;
+        };
+
+        // "Has any buffer binding moved since the last scan": the sum of the binding-slot
+        // versions, which BindingSlot bumps only on a real change. A collision costs one
+        // skipped rescan of ONE buffer's mask, and the mask is re-scanned at the next
+        // emission whose epoch differs, so it can delay a bit by one storage op and never
+        // drop one - the same over-fire-is-free / under-fire-is-fatal direction every
+        // shutter in Tracker.h takes.
+        //
+        // IT DOES NOT SEE THE 84x4 INDEXED BINDING POINTS, and that is sound only because
+        // BindBufferBase_State / BindBufferRange_State also bind the GENERIC slot for the
+        // same target (GL_Buffer.cpp:1531 says why), so an indexed bind always moves one of
+        // the versions summed here. If that ever stops being true, the CONSTANT /
+        // SHADER_BUFFER / ATOMIC / STREAM_OUTPUT bits start being missed silently and the
+        // repair is to fold GetTouchedBufferBindingPointCount into the epoch.
+        static Uint64 BindEpoch(GLContext& ctx) {
+            Uint64 epoch = 1;
+            for (const auto target : MG_State::GLState::GlobalBufferTargets) {
+                epoch += ctx.GetBufferBindingSlot(target).GetVersion();
+                epoch *= 3;
+            }
+            if (const auto& vao = ctx.GetBoundVertexArray()) {
+                epoch += vao->GetIndexBufferBindingSlot().GetVersion();
+                epoch = MGPipeMixShutterValue(epoch, vao->GetLifetimeId());
+                epoch = MGPipeMixShutterValue(epoch, vao->GetConfigVersion());
+            }
+            return epoch;
+        }
+
+        // The same mix Tracker.h's composite shutters use. Spelled here rather than
+        // included so this header does not depend on the tracker.
+        static constexpr Uint64 MGPipeMixShutterValue(Uint64 accumulator, Uint64 value) {
+            accumulator ^= value + 0x9e3779b97f4a7c15ull + (accumulator << 6) + (accumulator >> 2);
+            return accumulator;
+        }
+
+        Vector<Entry> m_bySlot;
+        Uint64 m_bindEpoch = 0;
+        MGPResourceDesc m_lastDesc{};
+        Uint64 m_creates = 0;
+        Uint64 m_respecifies = 0;
+        Uint64 m_destroys = 0;
+        Uint64 m_mapPersistents = 0;
+    };
+
+    // The monolith's one resource tracker, beside the state tracker, the CSO cache and the
+    // set-hash suppressor.
+    inline MGPipeResourceTracker& MGPipeResourceTrackerInstance() {
+        // NEVER DESTROYED, for MGPipeSlots()' reason (SlotAllocator.cpp): ~BufferObject reads
+        // and writes this tracker, and the objects that own the last reference to a
+        // BufferObject outlive every function-local static.
+        static MGPipeResourceTracker* tracker = new MGPipeResourceTracker();
+        return *tracker;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // D-D: the client's half of the reverse channel
+    // ---------------------------------------------------------------------------------
+
+    // The backend produced the bytes of a readback and hands them back through the channel.
+    // The client resolves the handle to its own object and writes the shadow; the epoch bump
+    // stays SERVER-side and happens AFTER this returns, never before (ARCHITECTURE.md 7.4:
+    // the reverse channel needs the same ordering guarantee as the forward one).
+    inline void MGPipeClientOnBufferWriteback(MGPipeHandle res, Uint64 offset, MGPBlobRef bytes) {
+        auto* buffer = MGPipeResourceTrackerInstance().Resolve(res);
+        if (buffer == nullptr) {
+            MGLOG_E_ONCE("MGPipe: OnBufferWriteback for a handle {%u,%u} that resolves to no buffer",
+                         res.Slot, res.Gen);
+            return;
+        }
+        if (bytes.Seg != kMGHostSpanSegNone) {
+            MGLOG_E_ONCE("MGPipe: OnBufferWriteback carried a transport segment (%u); P3a is monolith only",
+                         bytes.Seg);
+            return;
+        }
+        // Monolith: Seg is kMGHostSpanSegNone and Offset IS the address of the backend's
+        // mapped bytes (MGPipeTypes.h says so in as many words). Under a transport the
+        // segment resolves first, and that is the phase's edit, not this one's.
+        buffer->WritebackFromBackend(
+            DataPtr{reinterpret_cast<void*>(static_cast<std::uintptr_t>(bytes.Offset)),
+                    static_cast<SizeT>(bytes.Size)},
+            static_cast<SizeT>(offset));
+    }
+
+    // A draw or dispatch wrote these ranges. ARCHITECTURE.md 7.1 calls this a NARROWING
+    // channel - the client builds a conservative pending set at its own emission points and
+    // the callback only ever removes from it - so P3a's implementation marks exactly what
+    // the three Espryt MarkGpuWritten sites mark today and the observable behaviour is
+    // unchanged. The narrowing itself is P8/P9's.
+    inline void MGPipeClientOnGpuWritten(MGPipeHandle res, Uint rangeCount, const MGPRange* ranges) {
+        // THE SHAPE IS A CONTRACT POINT, not a formality: the announcement is ONE range
+        // covering kMGPipeWholeBuffer, deliberately not ZERO ranges, because zero will mean
+        // "a fully narrowed set - nothing is dirty" at P8/P9. Marking the whole buffer
+        // written for a zero-range announcement would be the narrowing channel run backwards,
+        // so the shape is asserted here rather than assumed.
+        MOBILEGL_ASSERT(rangeCount == 1 && ranges != nullptr,
+                        "OnGpuWritten {slot=%u, gen=%u}: P3a announces exactly one whole-buffer range, "
+                        "not %u",
+                        res.Slot, res.Gen, static_cast<Uint>(rangeCount));
+        (void)ranges;
+        if (rangeCount == 0) return;
+        auto* buffer = MGPipeResourceTrackerInstance().Resolve(res);
+        if (buffer == nullptr) {
+            // Loud, like its sibling above: a backend announcing a write against a handle
+            // this client cannot resolve is a dropped MarkGpuWritten, and a dropped
+            // MarkGpuWritten is a stale shadow read back as if it were current.
+            MGLOG_E_ONCE("MGPipe: OnGpuWritten for a handle {%u,%u} that resolves to no buffer", res.Slot,
+                         res.Gen);
+            return;
+        }
+        buffer->MarkGpuWritten();
+    }
+
+    // Installed once, and never over an entry a backend already claimed: these two are the
+    // CLIENT's implementations of a backend -> frontend callback, so the backend installs
+    // the rest of the table and these two answer for it.
+    inline void MGPipeInstallClientResourceCallbacks() {
+        if (gMGPipeCallbacks.OnBufferWriteback == nullptr) {
+            gMGPipeCallbacks.OnBufferWriteback = &MGPipeClientOnBufferWriteback;
+        }
+        if (gMGPipeCallbacks.OnGpuWritten == nullptr) {
+            gMGPipeCallbacks.OnGpuWritten = &MGPipeClientOnGpuWritten;
+        }
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/SetHashSuppressor.h

@@ -0,0 +1,111 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/SetHashSuppressor.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// Coalescing rule 4 (ARCHITECTURE.md 5.4, P2 brief D11): every kVarTail set_* hashes the
+// RESOLVED set on the client and does not emit when the hash has not moved.
+//
+// This is the carrier for the ~175 lines of debounce that move off the backends in P3b and
+// P4b - Espryt's UnitBindingsSnapshot / CaptureUnitBindings / UnitBindingsUnchanged and
+// Magma's equivalents all answer "is this set the same set as last time", and every one of
+// them answers it against a shape the backend rediscovered. P2 lands the MECHANISM and ONE
+// real consumer (SetVertexAttribDefaults) so the shape is pinned by a test rather than by a
+// plan; the other six slots exist, are unit-tested, and are wired by the phase that moves
+// the set they name. P3a wires the second, SetVertexBuffers. P4a wires SetSamplerViews,
+// BindSamplerStates and SetShaderImages, and APPENDS an eighth slot, SetFramebufferState -
+// which leaves only SetShaderBuffers and SetStreamOutputTargets unwired, both P4b's.
+//
+// A WIRED SLOT PUTS A REQUIREMENT ON ITS HASH, and SetVertexBuffers is where that first
+// bites: the hash has to cover EVERY input the record carries, not only the set. Its
+// baseInstance is DRAW state and moves without the buffer set moving, so a hash over the
+// entries alone would suppress a record whose one changed field is the fetch shift and the
+// server would keep the previous one. MG_Impl/Pipe/VertexInputEmit.h's
+// MGPipeVertexBufferSetContentHash mixes Start, Count and BaseInstance in for exactly that
+// reason, and VertexInputEmit's base-instance pair is the test that says so.
+//
+// A hash of 0 is reserved for "never emitted", so the first emission always goes out; a
+// computed 0 is remapped to 1, which costs one collision in 2^64 an extra emission and
+// never a missed one.
+//
+// Header-only for the same ownership reason as Tracker.h and CsoCache.h: the root
+// CMakeLists.txt that would name a new .cpp belongs to package A and is frozen behind the
+// p2/contract tag.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/MGPipe.h>
+
+namespace MobileGL::MG_Pipe {
+
+    // One slot per kVarTail set_* (ARCHITECTURE.md 5.1's call list), PLUS
+    // SetFramebufferState, which is not kVarTail at all: MGPFramebufferState carries a
+    // ContentHash for TWO jobs - the server's render-pass memo key and the client's emission
+    // suppressor - and the second one needs a slot here like any other. The enum is
+    // CLIENT-ONLY and is not a wire opcode, so appending before Count is safe.
+    enum class MGPipeSuppressorSlot : Uint32 {
+        SetVertexBuffers = 0,     // P3a - wired, and its hash includes BaseInstance
+        // P4a - WIRED. The three unit sets' suppressors are not optional and were never a
+        // later phase's: MGPipeTypes.h makes the pattern mandatory for every kVarTail set_*,
+        // because GetTextureBindGeneration() bumps on a REDUNDANT rebind - MC 26.2 rebinds the
+        // same sampler at every texture-unit switch - so an unsuppressed set is a
+        // several-hundred-byte variable-length record per batch, which is the exact regression
+        // the design names. What P3b/P4b owns is the ~175-line BACKEND debounce these replace
+        // (UnitBindingsSnapshot / CaptureUnitBindings / UnitBindingsUnchanged and the two
+        // g_*SyncList tables); P4a wires the carrier, P3b/P4b deletes the backend copy.
+        SetSamplerViews,          // P4a - wired (backend debounce deletion: P3b/P4b)
+        BindSamplerStates,        // P4a - wired (backend debounce deletion: P3b/P4b)
+        SetShaderImages,          // P4a - wired (backend debounce deletion: P3b/P4b)
+        SetShaderBuffers,         // P4b
+        SetStreamOutputTargets,   // P4b
+        SetVertexAttribDefaults,  // P2 - the one consumer that is wired
+        SetFramebufferState,      // P4a - wired
+        Count,
+    };
+
+    inline constexpr SizeT kMGPipeSuppressorSlotCount = static_cast<SizeT>(MGPipeSuppressorSlot::Count);
+
+    class MGPipeSetHashSuppressor {
+    public:
+        // True when `contentHash` differs from what this slot last emitted, and LATCHES it.
+        // False means the resolved set has not moved and the call must not go out.
+        Bool ShouldEmit(MGPipeSuppressorSlot slot, Uint64 contentHash) {
+            const Uint64 latched = contentHash == 0 ? 1 : contentHash;
+            const SizeT index = static_cast<SizeT>(slot);
+            if (m_lastEmitted[index] == latched) return false;
+            m_lastEmitted[index] = latched;
+            return true;
+        }
+
+        // A context change or a server reset: what the server has is no longer what this
+        // slot last emitted, so the next resolved set must go out whatever it hashes to.
+        void Invalidate(MGPipeSuppressorSlot slot) { m_lastEmitted[static_cast<SizeT>(slot)] = 0; }
+
+        void InvalidateAll() {
+            for (SizeT i = 0; i < kMGPipeSuppressorSlotCount; ++i) m_lastEmitted[i] = 0;
+        }
+
+        // 0 == "never emitted". Exposed for the unit test, which is what pins that the
+        // reserved value really is reserved.
+        Uint64 LastEmitted(MGPipeSuppressorSlot slot) const {
+            return m_lastEmitted[static_cast<SizeT>(slot)];
+        }
+
+    private:
+        Array<Uint64, kMGPipeSuppressorSlotCount> m_lastEmitted{};
+    };
+
+    // The monolith's one suppressor, beside the tracker and the CSO cache.
+    inline MGPipeSetHashSuppressor& MGPipeSetHashSuppressorInstance() {
+        // NEVER DESTROYED, for MGPipeTrackerInstance()' reason (MG_Impl/Pipe/Tracker.h): the
+        // rule covers every MGPipe process singleton, not only the ones on today's death
+        // paths.
+        static MGPipeSetHashSuppressor* suppressor = new MGPipeSetHashSuppressor();
+        return *suppressor;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/SlotAllocator.cpp

@@ -0,0 +1,280 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/SlotAllocator.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+// SlotAllocator.h. Compiled only under MOBILEGL_PIPE_PUSH.
+#include <MG_Impl/Pipe/SlotAllocator.h>
+
+namespace MobileGL::MG_Pipe {
+    namespace {
+        // The ShaderCso band the ordinary allocator must never enter: the top 1/16 of the
+        // ShaderCso slot space is reserved for PROGRAM PIPELINE COMPOSITES, which are minted
+        // client-side out of the stage programs bound to a pipeline object. Reserving a band
+        // rather than a flag keeps the composite resolver's lifetime bookkeeping out of here
+        // (MGPipeHandles.h, ARCHITECTURE.md 5.6.3).
+        Bool SlotIsAllocatable(MGPipeKind kind, Uint32 slot) {
+            if (slot < kMGPipeFirstAllocatableSlot) return false;
+            if (kind != MGPipeKind::ShaderCso) return true;
+            return slot < kMGPipeShaderCsoCompositeSlotBase;
+        }
+    } // namespace
+
+    MGPipeSlotAllocator::KindState& MGPipeSlotAllocator::StateOf(MGPipeKind kind) {
+        const SizeT index = static_cast<SizeT>(kind);
+        MOBILEGL_ASSERT(index < kKindCount, "MGPipeKind %zu out of range", index);
+        return m_kinds[index < kKindCount ? index : 0];
+    }
+
+    const MGPipeSlotAllocator::KindState& MGPipeSlotAllocator::StateOf(MGPipeKind kind) const {
+        const SizeT index = static_cast<SizeT>(kind);
+        MOBILEGL_ASSERT(index < kKindCount, "MGPipeKind %zu out of range", index);
+        return m_kinds[index < kKindCount ? index : 0];
+    }
+
+    MGPipeSlotAllocator::SlotState* MGPipeSlotAllocator::EntryOf(KindState& state, MGPipeKind kind,
+                                                                 Uint32 slot) {
+        if (kind == MGPipeKind::ShaderCso && MGPipeIsCompositeShaderSlot(slot)) {
+            const SizeT index = slot - kMGPipeShaderCsoCompositeSlotBase;
+            if (index >= state.BandSlots.size()) return nullptr;
+            return &state.BandSlots[index];
+        }
+        if (slot >= state.Slots.size()) return nullptr;
+        return &state.Slots[slot];
+    }
+
+    const MGPipeSlotAllocator::SlotState*
+    MGPipeSlotAllocator::EntryOf(const KindState& state, MGPipeKind kind, Uint32 slot) {
+        return EntryOf(const_cast<KindState&>(state), kind, slot);
+    }
+
+    MGPipeHandle MGPipeSlotAllocator::Allocate(MGPipeKind kind) {
+        KindState& state = StateOf(kind);
+        if (state.Slots.empty()) {
+            // Slot 0 exists so the vector is slot-indexed, and is never handed out.
+            state.Slots.resize(kMGPipeFirstAllocatableSlot);
+        }
+
+        Uint32 slot = 0;
+        Bool reused = false;
+        while (!state.FreeList.empty()) {
+            const Uint32 candidate = state.FreeList.back();
+            state.FreeList.pop_back();
+            if (!SlotIsAllocatable(kind, candidate)) continue;
+            slot = candidate;
+            reused = true;
+            break;
+        }
+
+        if (!reused) {
+            slot = static_cast<Uint32>(state.Slots.size());
+            MOBILEGL_ASSERT(SlotIsAllocatable(kind, slot),
+                            "MGPipe slot space of kind %u is exhausted at slot %u",
+                            static_cast<Uint32>(kind), slot);
+            if (!SlotIsAllocatable(kind, slot)) return kMGPipeNullHandle;
+            state.Slots.emplace_back();
+        }
+
+        SlotState& entry = state.Slots[slot];
+        if (entry.EverHandedOut) {
+            // The one place Gen may move. 2^32 recycles of ONE slot is ~50 days of continuous
+            // churn at one recycle per frame at 1000 fps, which is why the bound is asserted
+            // in a debug allocator rather than defended in release.
+            MOBILEGL_ASSERT(entry.Gen != ~Uint32{0},
+                            "MGPipe handle generation wrapped on kind %u slot %u; {slot, gen} is "
+                            "no longer unique",
+                            static_cast<Uint32>(kind), slot);
+            ++entry.Gen;
+        }
+        entry.EverHandedOut = true;
+        entry.Live = true;
+        entry.LifetimeId = 0;
+        ++state.LiveCount;
+        return MGPipeHandle{slot, entry.Gen};
+    }
+
+    MGPipeHandle MGPipeSlotAllocator::AllocateFor(MGPipeKind kind, Uint64 lifetimeId) {
+        const MGPipeHandle handle = Allocate(kind);
+        if (MGPipeHandleIsNull(handle)) return handle;
+        KindState& state = StateOf(kind);
+        state.Slots[handle.Slot].LifetimeId = lifetimeId;
+        if (lifetimeId != 0) {
+            MOBILEGL_ASSERT(state.ByLifetimeId.find(lifetimeId) == state.ByLifetimeId.end(),
+                            "lifetime id %llu already owns a slot of kind %u",
+                            static_cast<unsigned long long>(lifetimeId), static_cast<Uint32>(kind));
+            state.ByLifetimeId[lifetimeId] = handle.Slot;
+        }
+        return handle;
+    }
+
+    MGPipeHandle MGPipeSlotAllocator::AllocateComposite(Uint64 lifetimeId) {
+        // P4a, D-H7. The mirror image of Allocate() above, restricted to the band that one
+        // refuses, and kept in a table of its own so both spaces stay DENSE: the band's base
+        // is 983040, and minting one composite into the slot-indexed vector would allocate
+        // ~23 MB of SlotState for a single program pipeline.
+        KindState& state = StateOf(MGPipeKind::ShaderCso);
+
+        Uint32 slot = 0;
+        Bool reused = false;
+        if (!state.BandFreeList.empty()) {
+            slot = state.BandFreeList.back();
+            state.BandFreeList.pop_back();
+            reused = true;
+        }
+
+        if (!reused) {
+            const SizeT next = kMGPipeShaderCsoCompositeSlotBase + state.BandSlots.size();
+            slot = static_cast<Uint32>(next);
+            // The band's own exhaustion assert, mirroring Allocate()'s: a composite that
+            // cannot be minted is a NAMED failure, not a silent fall-through into the ordinary
+            // program slots, which is exactly what reserving a band rather than setting a flag
+            // buys.
+            MOBILEGL_ASSERT(next < kMGPipeShaderCsoSlotLimit,
+                            "the MGPipe ShaderCso COMPOSITE band is exhausted at slot %zu; a "
+                            "program-pipeline composite cannot be minted and must not take an "
+                            "ordinary program's slot",
+                            next);
+            if (next >= kMGPipeShaderCsoSlotLimit) return kMGPipeNullHandle;
+            state.BandSlots.emplace_back();
+        }
+
+        SlotState* entry = EntryOf(state, MGPipeKind::ShaderCso, slot);
+        if (entry == nullptr) return kMGPipeNullHandle;
+        if (entry->EverHandedOut) {
+            MOBILEGL_ASSERT(entry->Gen != ~Uint32{0},
+                            "MGPipe handle generation wrapped on the ShaderCso composite band, "
+                            "slot %u; {slot, gen} is no longer unique",
+                            slot);
+            ++entry->Gen;
+        }
+        entry->EverHandedOut = true;
+        entry->Live = true;
+        entry->LifetimeId = lifetimeId;
+        ++state.LiveCount;
+        // The band's share of LiveCount, so CompositeLiveCount() can answer without a walk.
+        ++state.BandLiveCount;
+        if (lifetimeId != 0) {
+            MOBILEGL_ASSERT(state.ByLifetimeId.find(lifetimeId) == state.ByLifetimeId.end(),
+                            "lifetime id %llu already owns a ShaderCso slot",
+                            static_cast<unsigned long long>(lifetimeId));
+            state.ByLifetimeId[lifetimeId] = slot;
+        }
+        return MGPipeHandle{slot, entry->Gen};
+    }
+
+    MGPipeHandle MGPipeSlotAllocator::FindByLifetimeId(MGPipeKind kind, Uint64 lifetimeId) const {
+        if (lifetimeId == 0) return kMGPipeNullHandle;
+        const KindState& state = StateOf(kind);
+        const auto it = state.ByLifetimeId.find(lifetimeId);
+        if (it == state.ByLifetimeId.end()) return kMGPipeNullHandle;
+        const SlotState* entry = EntryOf(state, kind, it->second);
+        if (entry == nullptr || !entry->Live) return kMGPipeNullHandle;
+        return MGPipeHandle{it->second, entry->Gen};
+    }
+
+    MGPipeHandle MGPipeSlotAllocator::Acquire(MGPipeKind kind, Uint64 lifetimeId) {
+        const MGPipeHandle existing = FindByLifetimeId(kind, lifetimeId);
+        if (!MGPipeHandleIsNull(existing)) return existing;
+        return AllocateFor(kind, lifetimeId);
+    }
+
+    void MGPipeSlotAllocator::Free(MGPipeKind kind, MGPipeHandle handle) {
+        KindState& state = StateOf(kind);
+        SlotState* entry = EntryOf(state, kind, handle.Slot);
+        if (entry == nullptr) return;
+        // A stale handle must not free the slot its successor now owns - that is the whole
+        // reason the generation is in the key. It is also what makes the SECOND of a
+        // composite's two independent release paths a proven no-op.
+        if (!entry->Live || entry->Gen != handle.Gen) return;
+        if (entry->LifetimeId != 0) {
+            const auto it = state.ByLifetimeId.find(entry->LifetimeId);
+            if (it != state.ByLifetimeId.end() && it->second == handle.Slot) {
+                state.ByLifetimeId.erase(it);
+            }
+        }
+        entry->Live = false;
+        entry->LifetimeId = 0;
+        --state.LiveCount;
+        if (kind == MGPipeKind::ShaderCso && MGPipeIsCompositeShaderSlot(handle.Slot)) {
+            --state.BandLiveCount;
+            state.BandFreeList.push_back(handle.Slot);
+        } else {
+            state.FreeList.push_back(handle.Slot);
+        }
+    }
+
+    Bool MGPipeSlotAllocator::IsLive(MGPipeKind kind, MGPipeHandle handle) const {
+        const SlotState* entry = EntryOf(StateOf(kind), kind, handle.Slot);
+        return entry != nullptr && entry->Live && entry->Gen == handle.Gen;
+    }
+
+    Uint32 MGPipeSlotAllocator::GenOfSlot(MGPipeKind kind, Uint32 slot) const {
+        const SlotState* entry = EntryOf(StateOf(kind), kind, slot);
+        return entry != nullptr ? entry->Gen : 0;
+    }
+
+    Uint64 MGPipeSlotAllocator::LifetimeIdOfSlot(MGPipeKind kind, Uint32 slot) const {
+        const SlotState* entry = EntryOf(StateOf(kind), kind, slot);
+        return entry != nullptr ? entry->LifetimeId : 0;
+    }
+
+    Uint32 MGPipeSlotAllocator::HighWater(MGPipeKind kind) const {
+        // THE ORDINARY SPACE ONLY, and the band is reported by CompositeHighWater() below.
+        // Folding the two would pin this at ~983k from the first composite mint onward and
+        // take the ordinary space's "the high-water mark did not move" assertion away for the
+        // rest of the process - the assertion that catches a dense table that never shrinks,
+        // which is the leak shape this allocator exists to make visible. Two spaces, two
+        // numbers, two real assertions. See SlotAllocator.h.
+        return static_cast<Uint32>(StateOf(kind).Slots.size());
+    }
+
+    Uint32 MGPipeSlotAllocator::CompositeHighWater() const {
+        const KindState& state = StateOf(MGPipeKind::ShaderCso);
+        // One past the highest composite slot ever handed out; exactly the base when none ever
+        // was, so the number is monotone from the first mint and a LEAKED COMPOSITE MOVES IT.
+        return static_cast<Uint32>(kMGPipeShaderCsoCompositeSlotBase + state.BandSlots.size());
+    }
+
+    Uint32 MGPipeSlotAllocator::LiveCount(MGPipeKind kind) const { return StateOf(kind).LiveCount; }
+
+    Uint32 MGPipeSlotAllocator::CompositeLiveCount() const {
+        return StateOf(MGPipeKind::ShaderCso).BandLiveCount;
+    }
+
+    Uint32 MGPipeSlotAllocator::FreeCount(MGPipeKind kind) const {
+        const KindState& state = StateOf(kind);
+        return static_cast<Uint32>(state.FreeList.size() + state.BandFreeList.size());
+    }
+
+    Uint32 MGPipeSlotAllocator::CompositeFreeCount() const {
+        return static_cast<Uint32>(StateOf(MGPipeKind::ShaderCso).BandFreeList.size());
+    }
+
+    void MGPipeSlotAllocator::Reset() {
+        for (KindState& state : m_kinds) {
+            state.Slots.clear();
+            state.FreeList.clear();
+            state.BandSlots.clear();
+            state.BandFreeList.clear();
+            state.ByLifetimeId.clear();
+            state.LiveCount = 0;
+            state.BandLiveCount = 0;
+        }
+    }
+
+    MGPipeSlotAllocator& MGPipeSlots() {
+        // NEVER DESTROYED, deliberately (one allocation for the life of the process). A
+        // frontend object's destructor reaches this allocator - ~BufferObject through
+        // MGPipeEmitResourceDestroyAndFree, ~VertexArrayObject through the death notice - and
+        // MG_Backend/MGPipe/PipeInputs.h's gPipeInputs holds SharedPtrs to those objects at
+        // namespace scope, so they are destroyed by __run_exit_handlers AFTER this
+        // function-local static would have been. A destroyed allocator then answers
+        // FindByLifetimeId out of a freed hash table and Free() writes into freed vectors -
+        // an exit-time heap corruption whose fatality depends only on the allocator's layout.
+        static MGPipeSlotAllocator* allocator = new MGPipeSlotAllocator();
+        return *allocator;
+    }
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Impl/Pipe/SlotAllocator.h

@@ -0,0 +1,166 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/SlotAllocator.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+#include <MG_Pipe/MGPipeHandles.h>
+
+// The CLIENT's slot allocator: the thing that mints every MGPipeHandle in the system
+// (ARCHITECTURE.md 4.2 - no create_* call in the catalogue returns a server-cast handle,
+// which is what lets the whole catalogue be remoted with zero creation round trips).
+//
+// Per kind: a free list plus a high-water mark, so slots stay DENSE and the server's object
+// table is an array rather than a hash map. It has nothing to do with MG_State's
+// IndexGenerator - that container's LIFO GL-name reuse is the very problem {slot, gen}
+// exists to close, and the whole point of the identity is that an ABA on the GL name, on
+// the heap address or on the lifetime id cannot reproduce a handle.
+//
+// Gen increments ONLY when a slot is reused, never on a respecify: a glBufferData on a live
+// buffer keeps the same {slot, gen}, because the object is the same object. Two generations
+// exist in the design and they are strictly separate - this is the client's answer to "is
+// this still the same GL object"; MGGen is the server's epoch for "did I recast my driver
+// object", and no MGPipe call may require the client to know it.
+//
+// The lifetimeId -> slot map is what keeps a GL NAME out of every key (ARCHITECTURE.md 4.2):
+// the frontend object's lifetime id is the client's own identity for it, so the backend key
+// is the handle and the frontend key is the lifetime id, and neither is a recyclable name.
+//
+// Lives in MG_Impl (the client side, unrestricted) and is compiled only under
+// MOBILEGL_PIPE_PUSH. It is in the P2 CONTRACT commit rather than in a Track H package
+// because both Track H slices - Espryt 0b and Magma subsystem 4 - key off it.
+namespace MobileGL::MG_Pipe {
+
+    class MGPipeSlotAllocator {
+    public:
+        static constexpr SizeT kKindCount = static_cast<SizeT>(MGPipeKind::KindCount);
+
+        // A fresh {slot, gen} of this kind, from the free list if one is waiting and from the
+        // high-water mark otherwise. Never returns slot 0 (reserved: null, and the default
+        // framebuffer for kind Framebuffer), and never returns a ShaderCso slot inside the
+        // composite band, which the program-pipeline resolver mints out of separately.
+        MGPipeHandle Allocate(MGPipeKind kind);
+        // Allocate and remember `lifetimeId` as this handle's frontend identity.
+        MGPipeHandle AllocateFor(MGPipeKind kind, Uint64 lifetimeId);
+
+        // P4a, D-H7: THE ONE ENTRY POINT INTO THE ShaderCso COMPOSITE BAND, and the only one
+        // there will ever be. Allocate() above refuses that band on purpose, so a program
+        // pipeline's flattened composite - minted client-side from the stage programs bound to
+        // the pipeline object, and indistinguishable from an ordinary program to the server -
+        // needs a door of its own rather than a flag on the handle. The kind is implied: only
+        // ShaderCso has a band.
+        //
+        // It behaves exactly like AllocateFor in every other respect (free list first, then
+        // the band's own high-water mark; Gen moves only on reuse; the lifetimeId -> slot map
+        // is written) and it carries the band's own exhaustion assert, so exhausting the
+        // composite space is a NAMED Fatal rather than silent slot theft from ordinary
+        // programs. Returns kMGPipeNullHandle when the band is full.
+        //
+        // Freed through the ordinary Free(MGPipeKind::ShaderCso, handle): a composite's slot
+        // has two independent release paths - the pipeline cache's LRU eviction and the
+        // composite ProgramObject's own destructor - and Free refusing a slot that is not live
+        // at that generation is what makes the second one a proven no-op.
+        MGPipeHandle AllocateComposite(Uint64 lifetimeId);
+        // The handle a lifetime id was allocated for, or kMGPipeNullHandle. A recycled heap
+        // address does NOT reproduce a mapping: MG_State hands out a fresh lifetime id per
+        // object, so the map key is unique for the life of the process.
+        MGPipeHandle FindByLifetimeId(MGPipeKind kind, Uint64 lifetimeId) const;
+        // FindByLifetimeId, then AllocateFor when it misses. The ordinary client path.
+        MGPipeHandle Acquire(MGPipeKind kind, Uint64 lifetimeId);
+
+        // Returns the slot to the free list. The Gen bump happens on the NEXT handout of that
+        // slot, not here, so a handle that is freed twice cannot skip a generation and the
+        // "gen moves only on reuse" contract holds for an object that is never reused.
+        void Free(MGPipeKind kind, MGPipeHandle handle);
+
+        Bool IsLive(MGPipeKind kind, MGPipeHandle handle) const;
+        // 0 for a slot that was never handed out; the generation of the LAST handout
+        // otherwise, live or not.
+        Uint32 GenOfSlot(MGPipeKind kind, Uint32 slot) const;
+        Uint64 LifetimeIdOfSlot(MGPipeKind kind, Uint32 slot) const;
+        // One past the highest ORDINARY slot ever handed out of this kind. For every kind but
+        // ShaderCso that is the whole story; for ShaderCso the composite band is a second,
+        // separately dense space and CompositeHighWater() below answers it.
+        //
+        // THE TWO SPACES ARE REPORTED SEPARATELY, and that is the point rather than a detail.
+        // Folding the band into this number pins it at ~983k from the first composite mint
+        // onward, and every later assertion of the "the high-water mark did not move over N
+        // churn rounds" shape - the one that catches a dense table that never shrinks, which
+        // is the ~1.3 KB-per-record leak C-1 produced - becomes vacuously true for ordinary
+        // ShaderCso slots for the rest of the process. A leak case per space is two real
+        // assertions; one merged number is one real assertion and one that cannot go red.
+        //
+        // It is also NOT a table size for kind ShaderCso even now: the band is sparse against
+        // the ordinary space by design, so a consumer indexing by slot must test
+        // MGPipeIsCompositeShaderSlot(slot) first and keep the band in a table of its own,
+        // exactly as this allocator does.
+        Uint32 HighWater(MGPipeKind kind) const;
+        // One past the highest COMPOSITE slot ever handed out, i.e.
+        // kMGPipeShaderCsoCompositeSlotBase + (band slots ever handed out), and exactly the
+        // base when none ever was. Kind ShaderCso is the only kind with a band, so it is
+        // implied - as it is for AllocateComposite. A LEAKED COMPOSITE MOVES THIS and moves
+        // nothing else, which is what the composite's own leak case asserts on.
+        Uint32 CompositeHighWater() const;
+        // Live slots of this kind, ORDINARY AND COMPOSITE TOGETHER for ShaderCso: a live
+        // composite is a live ShaderCso, the applier's two record tables are one object class,
+        // and a caller asking "how many shader CSOs does this client hold" wants both. The
+        // band's own count is CompositeLiveCount(); the ordinary space's is the difference.
+        Uint32 LiveCount(MGPipeKind kind) const;
+        Uint32 CompositeLiveCount() const;
+        // Slots waiting on a free list. Also BOTH SPACES for ShaderCso, for LiveCount's
+        // reason and with the same caveat: a caller that needs to know WHICH space a slot went
+        // back to reads CompositeFreeCount() and subtracts.
+        Uint32 FreeCount(MGPipeKind kind) const;
+        Uint32 CompositeFreeCount() const;
+
+        // Context teardown / server reset / a unit test's fixture.
+        void Reset();
+
+    private:
+        struct SlotState {
+            Uint32 Gen = 0;
+            Bool Live = false;
+            Bool EverHandedOut = false;
+            Uint64 LifetimeId = 0;
+        };
+
+        struct KindState {
+            // Indexed by slot; [0] is the reserved slot and is never live.
+            Vector<SlotState> Slots;
+            Vector<Uint32> FreeList;
+            // P4a: the ShaderCso COMPOSITE band, indexed by (slot - the band's base) and
+            // EMPTY for every other kind. A SECOND VECTOR RATHER THAN MORE OF THE FIRST, and
+            // it is not a micro-optimisation: the band starts at 983040, so minting one
+            // composite into the slot-indexed vector above would allocate ~983k SlotStates -
+            // ~23 MB - for a single program pipeline, and a consumer that sized a table off
+            // HighWater would pay the same shape again with a far bigger record. Both spaces
+            // stay dense against their own high-water mark, which is the property this
+            // allocator exists to give the server.
+            Vector<SlotState> BandSlots;
+            Vector<Uint32> BandFreeList;
+            UnorderedMap<Uint64, Uint32> ByLifetimeId;
+            Uint32 LiveCount = 0;
+            // The band's share of LiveCount above, so the two spaces can be reported apart
+            // without walking either table. Always 0 for every kind but ShaderCso.
+            Uint32 BandLiveCount = 0;
+        };
+
+        KindState& StateOf(MGPipeKind kind);
+        const KindState& StateOf(MGPipeKind kind) const;
+        // The SlotState a (kind, slot) names, in whichever of the two vectors holds it, or
+        // null when the slot has never been handed out. One resolver, so a caller that forgets
+        // the band cannot exist.
+        static SlotState* EntryOf(KindState& state, MGPipeKind kind, Uint32 slot);
+        static const SlotState* EntryOf(const KindState& state, MGPipeKind kind, Uint32 slot);
+
+        Array<KindState, kKindCount> m_kinds{};
+    };
+
+    // The monolith's one client allocator. Under split there is one per client context.
+    MGPipeSlotAllocator& MGPipeSlots();
+} // namespace MobileGL::MG_Pipe

MobileGL/MG_Impl/Pipe/Tracker.h

@@ -0,0 +1,864 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/Tracker.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The frontend state tracker (ARCHITECTURE.md 5.2, P2 brief D4).
+//
+// WHERE IT RUNS. Not above MGP_FILL and not in the GL setter: MGPipeValidateForVerb, the
+// one statement MGP_FILL already expands to before every gBackendFunctionsTable.GL call
+// (PipeFill.h). Blaze3D brackets every batch with glEnable/glDisable(GL_BLEND), so a
+// setter that pushed would push twice per batch for a state the batch may not even read;
+// the validate point coalesces the whole bracket into the two draws that observe it
+// (ARCHITECTURE.md 5.1).
+//
+// WHAT IT DOES. One Uint32 dirty mask per verb, one bit per row of ARCHITECTURE.md 5.2,
+// computed by comparing a shutter against what the tracker last pushed. P2 emitted for bits
+// 0..4 (the value-class ones); P3a adds bits 5, 9 and 10 - the vertex-input family - and P4a
+// adds SEVEN: 6, 7 and 8 (the program family), 11 (the framebuffer) and 12, 13 and 14 (the
+// three unit sets). Only bits 15, 16 and 17 - the const-buffer, shader-buffer and
+// stream-output sets - are still computed, latched and counted without an emitter, so the
+// per-bit fire rate is a measurement rather than a plan and their fields go through the
+// residual fill until P4b.
+//
+// P4a NARROWS NOTHING AND WIDENS THREE THINGS, and every one of them was an UNDER-FIRE that
+// only became reachable once the bit gained an emitter:
+//   (1) bit 11's shutter gains the READ framebuffer binding slot's version, because
+//       set_framebuffer_state is emitted per bound TARGET and a glBindFramebuffer(
+//       GL_READ_FRAMEBUFFER, ...) moved no shutter at all before;
+//   (2) bit 13's gains the TEXTURE BIND generation, because glBindSampler moves that one and
+//       not the sampling-resolution one, so bind_sampler_states could not see a sampler bind;
+//   (3) bits 6/7/8 - and with them bit 14's program half - read the EFFECTIVE program source
+//       instead of GetCurrentProgram() alone, which is null for the whole life of a bound
+//       separable program pipeline, so a re-composited pipeline reached no program emitter.
+// Over-firing is free; all three of those were the other direction.
+//
+// WHY EVERY SHUTTER OVER-FIRES. A bit that fires too often costs one extra push. A bit
+// that fires too rarely renders stale, and ARCHITECTURE.md 13.2 names that as the
+// dangerous direction precisely because the P1 verify comparator cannot see it for
+// object-class state (it compares those by identity only). So each shutter below is
+// deliberately coarser than the state it guards - five bits share one buffer aggregate,
+// the framebuffer bit fires on any attachment write anywhere - and the narrowing is P3's
+// work, paid for with the fire rates this file publishes.
+//
+// NO TIMER LIVES HERE. ROADMAP.md forbids committing hot-path instrumentation; the
+// absolute ns/draw comes from DriverBench, which times whole frames from outside the
+// library (P2 brief D17). The only counting is the per-bit fire tally, behind
+// PipeStats::Enabled() like every other counting site in the tree.
+//
+// HEADER-ONLY, and that is an ownership decision rather than a design one: the P2 brief
+// asks for Tracker.{h,cpp}, but the root CMakeLists.txt that would have to name a new .cpp
+// belongs to package A and is frozen behind the p2/contract tag. Everything here is
+// included by exactly one translation unit in the library (MG_Impl/Pipe/PipeFill.cpp) plus
+// the unit tests, so inline costs nothing. Splitting it back out is one list(APPEND) line.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/MGPipeValueTypes.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+#include <cstring>
+
+namespace MobileGL::MG_Pipe {
+
+    // One bit per row of the ARCHITECTURE.md 5.2 table, hand-written rather than generated:
+    // the list is design, not derived data, and the generator has nothing to derive it from.
+    enum class MGPipeDirty : Uint32 {
+        // ---- value class: P2 emits for these five ----
+        NewRenderState = 0,      // RenderState::m_version              -> set_dynamic_state
+        NewPipelineState,        // RenderState::m_pipelineStateVersion -> create/bind_render_state
+        NewPixelPack,            // PixelStoreParameters (pack)         -> set_pixel_pack_state
+        NewPatchState,           // the patch trio, NaN legal           -> set_patch_state
+        NewVertexAttribDefaults, // glVertexAttrib* defaults            -> set_vertex_attrib_defaults
+        // ---- value class: NEW_VERTEX_ELEMENTS is emitted from P3a and the other three from
+        // P4a - the program family, one subsystem, three bits because the frontend moves them
+        // as three separate events ----
+        NewVertexElements,       // the bound VAO's attribute configuration -> create/bind_vertex_elements
+        NewShader,               // the current program's link version -> create/bind_shader_state,
+                                 //    set_draw_program, set_dispatch_program (P4a)
+        NewShaderBindings,       // image units, block bindings, uniform write set (P4a)
+        NewGlobalConstants,      // the default-uniform-block image -> set_global_constants (P4a)
+        // ---- object class. THE FIRST TWO ARE P3a's, not P3b/P4b's: the roadmap puts
+        // set_vertex_buffers and set_index_buffer in the same phase as the vertex-elements
+        // trio, and this comment said otherwise until the commit that wired them. THE NEXT
+        // FOUR ARE P4a's. The last three are still computed and counted only, until P4b. ----
+        NewVertexBuffers,        // -> set_vertex_buffers (P3a)
+        NewIndexBuffer,          // -> set_index_buffer   (P3a)
+        NewFramebuffer,          // -> set_framebuffer_state, per bound target (P4a)
+        NewSamplerViews,         // -> set_sampler_views   (P4a)
+        NewSamplers,             // -> bind_sampler_states (P4a)
+        NewShaderImages,         // -> set_shader_images   (P4a)
+        NewConstBuffers,
+        NewShaderBuffers,
+        NewSoTargets,
+        Count,
+    };
+
+    inline constexpr SizeT kMGPipeDirtyCount = static_cast<SizeT>(MGPipeDirty::Count);
+    static_assert(kMGPipeDirtyCount <= 32, "the dirty mask is a Uint32");
+
+    inline constexpr Uint32 MGPipeDirtyBit(MGPipeDirty bit) {
+        return Uint32{1} << static_cast<Uint32>(bit);
+    }
+
+    // The five P2 emits for. Each phase's constant survives as the next phase's A/B control
+    // and as what a test compares the subsystem map against, so none of them is edited in
+    // place when a later phase takes more bits over.
+    inline constexpr Uint32 kMGPipeDirtyEmittedAtP2 =
+        MGPipeDirtyBit(MGPipeDirty::NewRenderState) | MGPipeDirtyBit(MGPipeDirty::NewPipelineState) |
+        MGPipeDirtyBit(MGPipeDirty::NewPixelPack) | MGPipeDirtyBit(MGPipeDirty::NewPatchState) |
+        MGPipeDirtyBit(MGPipeDirty::NewVertexAttribDefaults);
+
+    // The three P3a adds: the vertex-input family, all on one subsystem.
+    inline constexpr Uint32 kMGPipeDirtyEmittedAtP3a =
+        kMGPipeDirtyEmittedAtP2 | MGPipeDirtyBit(MGPipeDirty::NewVertexElements) |
+        MGPipeDirtyBit(MGPipeDirty::NewVertexBuffers) | MGPipeDirtyBit(MGPipeDirty::NewIndexBuffer);
+
+    // The SEVEN P4a adds, across FOUR subsystems: bits 6/7/8 are the program family, 11 the
+    // framebuffer, and 12/13/14 the sampler-view / sampler-state / image-unit sets. Added
+    // rather than edited into the two above, for the reason those two exist: each phase's
+    // constant survives as the next phase's A/B control and as what a test compares the
+    // subsystem map against.
+    //
+    // EVERY ONE OF THESE SHUTTERS WAS ALREADY COMPUTED, LATCHED AND COUNTED before P4a; what
+    // P4a adds is an emitter for them. That is why this is a one-line constant and not seven
+    // new shutters - and it is also why the two narrowings below are stated as requirements.
+    inline constexpr Uint32 kMGPipeDirtyEmittedAtP4a =
+        kMGPipeDirtyEmittedAtP3a | MGPipeDirtyBit(MGPipeDirty::NewShader) |
+        MGPipeDirtyBit(MGPipeDirty::NewShaderBindings) |
+        MGPipeDirtyBit(MGPipeDirty::NewGlobalConstants) |
+        MGPipeDirtyBit(MGPipeDirty::NewFramebuffer) | MGPipeDirtyBit(MGPipeDirty::NewSamplerViews) |
+        MGPipeDirtyBit(MGPipeDirty::NewSamplers) | MGPipeDirtyBit(MGPipeDirty::NewShaderImages);
+
+    inline constexpr const char* kMGPipeDirtyNames[kMGPipeDirtyCount] = {
+        "NEW_RENDER_STATE",
+        "NEW_PIPELINE_STATE",
+        "NEW_PIXEL_PACK",
+        "NEW_PATCH_STATE",
+        "NEW_VERTEX_ATTRIB_DEFAULTS",
+        "NEW_VERTEX_ELEMENTS",
+        "NEW_SHADER",
+        "NEW_SHADER_BINDINGS",
+        "NEW_GLOBAL_CONSTANTS",
+        "NEW_VERTEX_BUFFERS",
+        "NEW_INDEX_BUFFER",
+        "NEW_FRAMEBUFFER",
+        "NEW_SAMPLER_VIEWS",
+        "NEW_SAMPLERS",
+        "NEW_SHADER_IMAGES",
+        "NEW_CONST_BUFFERS",
+        "NEW_SHADER_BUFFERS",
+        "NEW_SO_TARGETS",
+    };
+
+    // Which runtime MOBILEGL_PIPE_PUSH subsystem bit gates a dirty bit's emission. Zero for
+    // a bit P2 does not emit, which is what makes "the bitmask is a true per-subsystem A/B"
+    // literally true rather than approximately.
+    inline constexpr Uint64 MGPipeSubsystemForDirty(MGPipeDirty bit) {
+        switch (bit) {
+        case MGPipeDirty::NewRenderState:
+        case MGPipeDirty::NewPipelineState:
+            return kMGPipeSubsystemRenderState;
+        case MGPipeDirty::NewPixelPack:
+            return kMGPipeSubsystemPixelPack;
+        case MGPipeDirty::NewPatchState:
+            return kMGPipeSubsystemPatchState;
+        case MGPipeDirty::NewVertexAttribDefaults:
+            return kMGPipeSubsystemVertexAttribDefaults;
+        // P3a's three, all one subsystem: create/bind_vertex_elements, set_vertex_buffers
+        // and set_index_buffer are the vertex-input family and an operator switching it off
+        // has to get the whole family's legacy arm, not two thirds of it.
+        // PipeFill.cpp's SubsystemForEmitter carries the pairing static_asserts.
+        case MGPipeDirty::NewVertexElements:
+        case MGPipeDirty::NewVertexBuffers:
+        case MGPipeDirty::NewIndexBuffer:
+            return kMGPipeSubsystemVertexInput;
+        // P4a's seven, across four subsystems. FOUR AND NOT ONE for P3a's reason one level
+        // out: a framebuffer path that regressed, a texture path that regressed, a sampler
+        // path that regressed and a program path that regressed are four different findings.
+        //
+        // The program family is three bits because the frontend moves them separately - a
+        // relink, a binding change and a uniform write are three events - but one subsystem,
+        // because an operator switching programs off has to get the whole family's legacy arm.
+        // Same for the three unit sets: create_sampler_state, create_sampler_view and the
+        // three kVarTail sets are one family, and half of it is not a control.
+        case MGPipeDirty::NewShader:
+        case MGPipeDirty::NewShaderBindings:
+        case MGPipeDirty::NewGlobalConstants:
+            return kMGPipeSubsystemPrograms;
+        case MGPipeDirty::NewFramebuffer:
+            return kMGPipeSubsystemFramebuffer;
+        case MGPipeDirty::NewSamplerViews:
+        case MGPipeDirty::NewSamplers:
+        case MGPipeDirty::NewShaderImages:
+            return kMGPipeSubsystemSamplers;
+        // NO BIT NAMES kMGPipeSubsystemTextureResources, and that is deliberate rather than an
+        // omission: the texture and renderbuffer resource_* calls and set_texture_params are
+        // dispatched from the GL entry points that cause them - a constructor, a storage
+        // definition, a glTexParameter - not from a dirty walk, exactly as P3a's buffer family
+        // is. Bit 10 gates those dispatch sites; there is no dirty bit to map onto it and
+        // there must not be one, or the emission would be gated twice and disagree with itself.
+        default:
+            // The remaining bits have no call of their own until P4b, so there is no
+            // subsystem to switch and the residual fill keeps supplying their fields.
+            return 0;
+        }
+    }
+
+    // A COMPOSITE shutter, for the bits whose "did anything move" is more than one counter.
+    // It is a hash, so two different states can in principle collide and cost a MISSED fire.
+    // The five bits P2 emits for are never composed - they are widened counters and byte
+    // compares, neither of which can collide.
+    //
+    // P3a's three ARE composed, so the risk is now real rather than academic, and it is
+    // accepted with its size stated: each mix takes a 64-bit input into a 64-bit
+    // accumulator, so two DIFFERENT vertex configurations collide with probability ~2^-64
+    // per pair, and the inputs are a monotone lifetime id, a monotone configuration version
+    // and a widened slot version - none of which an application can steer. The alternative,
+    // comparing the whole 32-attribute configuration byte for byte on every verb, is the
+    // per-draw cost the shutter exists to avoid. The narrowing that removes the composition
+    // for bit 10 - its own slot version plus the bound object's identity - is what this
+    // phase already did to the one shutter that was composed over an unrelated aggregate.
+    inline constexpr Uint64 MGPipeMixShutter(Uint64 accumulator, Uint64 value) {
+        accumulator ^= value + 0x9e3779b97f4a7c15ull + (accumulator << 6) + (accumulator >> 2);
+        return accumulator;
+    }
+
+    // A Uint16 counter widened at the TRACKER boundary, never in MG_State
+    // (ARCHITECTURE.md 5.2: MG_State is not changed for this). A decrease is a wrap and adds
+    // 65536. A wrap is harmless locally - one extra re-push, never a missed one - which is
+    // exactly what TrackerTest.WrapAroundRePushesButNeverMisses pins.
+    //
+    // THE ONE CASE IT CANNOT SEE, stated because "never a missed push" is otherwise stronger
+    // than what is true: the wrap test is `now < m_last`, so a counter that advances by
+    // EXACTLY 65536 (or a multiple) between two walks reads as unchanged. That needs 65536
+    // render-state mutations inside one verb boundary, and it is pre-existing in class -
+    // both backends already compare raw Uint16 versions the same way - so P2 records it
+    // rather than widening MG_State's counters, which ARCHITECTURE.md 5.2 rules out.
+    class MGPipeWidenedCounter {
+    public:
+        Uint64 Observe(Uint16 now) {
+            if (m_started && now < m_last) m_high += 0x10000ull;
+            m_started = true;
+            m_last = now;
+            return m_high + now;
+        }
+        void Reset() {
+            m_high = 0;
+            m_last = 0;
+            m_started = false;
+        }
+
+    private:
+        Uint64 m_high = 0;
+        Uint16 m_last = 0;
+        Bool m_started = false;
+    };
+
+    class MGPipeTracker {
+    public:
+        using GLContext = MG_State::GLState::GLContext;
+
+        // The dirty walk. Compares every shutter against what was last pushed, LATCHES the
+        // new values, counts the fires per verb class, and returns the mask. Latching here
+        // rather than after emission is deliberate: a bit whose subsystem is switched off is
+        // not emitted, but its fields are then still pulled by the residual fill, so the
+        // pushed block is correct either way and a bit can never fire twice for one change.
+        Uint32 Update(GLContext& ctx, MGPipeVerbClass verbClass) {
+            // A different context is a different server: nothing the tracker latched about
+            // the old one says anything about this one, and the first walk on a fresh
+            // context must publish a COMPLETE state rather than an increment.
+            if (m_context != &ctx) {
+                Reset();
+                m_context = &ctx;
+            }
+            const Bool wasPrimed = m_primed;
+
+            Uint64 now[kMGPipeDirtyCount];
+            const RenderStateParameters& render = ctx.GetRenderStateParameters();
+
+            // ---- bits 0..1: the two Uint16 render-state counters, widened HERE ----
+            now[Index(MGPipeDirty::NewRenderState)] =
+                m_renderStateVersion.Observe(static_cast<Uint16>(ctx.GetRenderStateParametersVersion()));
+            now[Index(MGPipeDirty::NewPipelineState)] =
+                m_pipelineStateVersion.Observe(static_cast<Uint16>(ctx.GetPipelineStateVersion()));
+
+            // ---- bit 4 and the value-class bits 5..8 ----
+            now[Index(MGPipeDirty::NewVertexAttribDefaults)] = ctx.GetAnyVertexAttribDefaultGeneration();
+
+            const auto& vao = ctx.GetBoundVertexArray();
+            const Uint64 vaoIdentity =
+                vao ? MGPipeMixShutter(vao->GetLifetimeId(), vao->GetConfigVersion()) : 0;
+            now[Index(MGPipeDirty::NewVertexElements)] = vaoIdentity;
+
+            // Deliberately NOT GetProgramForDraw: that joins a pending link, and the tracker
+            // must not force a compile just to answer "did the shader move". These version
+            // counters are plain members and are exactly what the backends already read
+            // without joining (Core.cpp, the glUseProgram half of join site J1).
+            //
+            // BUT GetCurrentProgram() ALONE IS NOT THE PROGRAM SOURCE, AND AT P4a THAT IS AN
+            // UNDER-FIRE. Under GL_ARB_separate_shader_objects an application drives
+            // `glUseProgram(0); glBindProgramPipeline(P)`, and m_currentProgram is then null
+            // for the whole life of that pipeline (Core.cpp, GetProgramForDraw's second half):
+            // all three of these shutters read 0 == 0 forever, so after the first walk on a
+            // fresh context - the one !m_primed fires unconditionally - bits 6, 7 and 8 never
+            // fire again however the pipeline is restaged.
+            //
+            // WHILE NOTHING WAS EMITTED FOR THEM THAT WAS INVISIBLE, which is how it survived
+            // to P4a: GetProgramForDraw is emitted-and-still-pulled, the residual fill copies
+            // it at every verb, and DirtySurface.def rules BindProgramPipelineObject
+            // kPulledEveryVerb for exactly that reason - the backend still receives the right
+            // SharedPtr and nothing renders wrong. The moment P4a emits off these bits it
+            // stops being invisible: glUseProgramStages rebuilds the composite, EmitShaderState
+            // is never called again, so the new composite gets no ShaderCso handle and no
+            // create_shader_state while set_draw_program keeps naming the previous one - a
+            // program the handle protocol never announced, which is exactly the seam-defect
+            // class P3a spent a phase closing. And bit 8 never firing means
+            // set_global_constants is never sent for a pipeline draw at all, where the pull
+            // rescues nothing.
+            //
+            // SO THE SHUTTER READS THE EFFECTIVE SOURCE: the program in use when there is one,
+            // and the bound pipeline when there is not. What it reads OF that pipeline is the
+            // pair ComputeDrawProgramSignature() is built from - each stage program's lifetime
+            // id and LINK version - so bit 6 fires exactly when GetProgramForDraw would hand
+            // back a different composite, which is exactly when a new ShaderCso handle has to
+            // be minted. Those are the same non-artefact fields the plain-program arm above
+            // reads, and the ones Core.cpp calls out as not passing through ProgramObject's
+            // join gate, so the "must not force a compile" rule survives intact: no join, no
+            // flatten, no Link().
+            //
+            // THE PIPELINE NAME IS MIXED IN because two pipelines can carry the same stage set
+            // and each caches its OWN composite object, so the signature alone would let a
+            // glBindProgramPipeline between two such pipelines pass without a fire. What that
+            // does NOT close is a name RECYCLED (glDeleteProgramPipelines +
+            // glGenProgramPipelines) back onto the same stage programs at the same link
+            // versions with no other program-family change in between: a ProgramPipelineObject
+            // has no lifetime id and no wire object at all - DirtySurface.def says so where it
+            // rules MarkProgramPipelineForDeletion kUnpublishedDestroy - so there is nothing
+            // else here to mix it with. Recorded rather than quietly left: closing it needs a
+            // generation counter on the frontend object, which is an MG_State change and not
+            // this file's to make.
+            const auto& program = ctx.GetCurrentProgram();
+            Uint64 shader = 0;
+            Uint64 bindings = 0;
+            Uint64 constants = 0;
+            Uint64 programImages = 0;
+            // THE PROGRAM INPUT OF THE PROGRAM-RESOLVED VIEW SET (P4a fable seam F-1).
+            // set_sampler_views is resolved for the program in use (SamplerEmit.h: the sampler
+            // uniform's TYPE picks which of a unit's targets is the view) and the emitter
+            // memoises that resolution on (lifetime id, link version, backend state version). A
+            // shutter that read only the texture generations therefore missed a glUseProgram:
+            // `glBindTexture x N; glUseProgram(P1); draw; glUseProgram(P2); draw` moved nothing
+            // bit 12 read, so the view set stayed P1's - and E's record epoch, keyed on the two
+            // set serials, then never rebuilt the texture sync list for P2 either. This value is
+            // that memo key, and bit 12 mixes it in below: over-firing costs one re-resolution
+            // the set-hash suppressor absorbs, under-firing left the record describing the
+            // previous program's units.
+            Uint64 opaqueUnits = 0;
+            if (program) {
+                shader = MGPipeMixShutter(program->GetLifetimeId(), program->GetLinkVersion());
+                bindings = MGPipeMixShutter(
+                    MGPipeMixShutter(MGPipeMixShutter(program->GetImageUnitVersion(),
+                                                      program->GetBackendStateVersion()),
+                                     program->GetBlockBindingVersion()),
+                    program->GetUniformWriteSetVersion());
+                constants = MGPipeMixShutter(program->GetLifetimeId(), program->GetUBOContentVersion());
+                // THE IDENTITY IS MIXED IN (P4a fable seam F-2), exactly as the pipeline arm
+                // below mixes stageLinks into its half: the counter alone is a per-program
+                // number two programs routinely share - 0 == 0 for any pair that never moved an
+                // image unit through glUniform1i, and 0 == 0 against no program at all - so a
+                // glUseProgram between them fired nothing, set_shader_images' window stayed the
+                // previous program's, and a program whose only image is a BUFFER image (E's
+                // SD-4: nothing else moves between the bind and the dispatch) never reached the
+                // record at all.
+                programImages = MGPipeMixShutter(shader, program->GetImageUnitVersion());
+                opaqueUnits = MGPipeMixShutter(shader, program->GetBackendStateVersion());
+            } else if (const auto& pipeline = ctx.GetBoundProgramPipeline(); pipeline) {
+                using Pipeline = MG_State::GLState::ProgramPipelineObject;
+                // THE FIELDS ARE READ DIRECTLY RATHER THAN THROUGH THE TWO FUNCTIONS THAT
+                // ALREADY PACK THEM, and that is a gate constraint, not a preference. Calling
+                // ComputeDrawProgramSignature() / ComputeUniformMirrorVersions() would say
+                // "the same pairs the composite cache and the uniform-mirror gate compare"
+                // far better than this loop does - but gen_pipe_dirty_surface.py derives a
+                // shutter by following each accessor to the member it returns, and both of
+                // those build a LOCAL array and return that, which it cannot place. A shutter
+                // naming them is UNRESOLVED, and then every DirtySurface.def row that names
+                // bits 6, 7, 8 or 14 loses its verdict - including the derivation that is the
+                // only mechanism able to catch the next under-fire here. So the pairs are
+                // spelled out, and the two static_asserts below are what say they must stay in
+                // step with the functions they mirror.
+                static_assert(sizeof(Pipeline::DrawProgramSignature) ==
+                                  2 * Pipeline::kGraphicsStageCount * sizeof(Uint64),
+                              "bit 6 reads the {lifetimeId, linkVersion} pair per graphics "
+                              "stage that ComputeDrawProgramSignature packs");
+                static_assert(sizeof(Pipeline::UniformMirrorVersions) ==
+                                  2 * Pipeline::kGraphicsStageCount * sizeof(Uint64),
+                              "bits 7 and 8 read the four counters per graphics stage that "
+                              "ComputeUniformMirrorVersions packs");
+
+                // Bit 6 is the pipeline's identity plus the composite cache key. Bits 7 and 8
+                // add the per-program state, which under a pipeline is written to the STAGE
+                // programs - glUniform* addresses the pipeline's active program,
+                // glProgramUniform* and the two block-binding calls address a named one - and
+                // only reaches the composite through RefreshCompositeUniforms. Bit 14's half
+                // takes the image-unit generation, which is its own counter for the reason
+                // ProgramObject gives (ES forbids glUniform1i on an image uniform, so Espryt
+                // BAKES the unit into the ESSL it generates and only a regeneration honours a
+                // change) and which D-G4 asks this shutter to keep reading as a FRONTEND
+                // counter rather than any server-side epoch.
+                //
+                // STAGELINKS IS MIXED INTO ALL THREE OF THE OTHERS, ON PURPOSE. A composite
+                // REBUILD hands back a brand-new ProgramObject with an empty default uniform
+                // block and no backend state at all - SetCachedDrawProgram clears the mirror
+                // versions with it - so a shutter watching only the per-stage state counters
+                // would let a rebuilt composite inherit the bindings, the constants and the
+                // image units of the one it replaced.
+                Uint64 stageLinks = static_cast<Uint64>(ctx.GetBoundProgramPipelineName());
+                Uint64 stageState = 0;
+                Uint64 stageImages = 0;
+                // The per-stage sampler/image unit assignments alone (glUniform1i on a stage
+                // program's sampler moves its backend state version and reaches the composite
+                // through the uniform mirror), for bit 12's program input below.
+                Uint64 stageOpaque = 0;
+                for (SizeT stage = 0; stage < Pipeline::kGraphicsStageCount; ++stage) {
+                    const auto& staged = pipeline->GetStageProgram(static_cast<ShaderStage>(stage));
+                    if (!staged) continue;
+                    stageLinks = MGPipeMixShutter(
+                        MGPipeMixShutter(stageLinks, staged->GetLifetimeId()), staged->GetLinkVersion());
+                    stageState = MGPipeMixShutter(
+                        MGPipeMixShutter(MGPipeMixShutter(stageState, staged->GetBackendStateVersion()),
+                                         MGPipeMixShutter(staged->GetUBOContentVersion(),
+                                                          staged->GetBlockBindingVersion())),
+                        staged->GetUniformWriteSetVersion());
+                    stageImages = MGPipeMixShutter(stageImages, staged->GetImageUnitVersion());
+                    stageOpaque = MGPipeMixShutter(stageOpaque, staged->GetBackendStateVersion());
+                }
+                shader = stageLinks;
+                stageState = MGPipeMixShutter(stageLinks, stageState);
+                bindings = MGPipeMixShutter(stageState, stageImages);
+                constants = stageState;
+                programImages = MGPipeMixShutter(stageLinks, stageImages);
+                opaqueUnits = MGPipeMixShutter(stageLinks, stageOpaque);
+            }
+            now[Index(MGPipeDirty::NewShader)] = shader;
+            now[Index(MGPipeDirty::NewShaderBindings)] = bindings;
+            now[Index(MGPipeDirty::NewGlobalConstants)] = constants;
+
+            // ===========================================================================
+            // THE RECORD-FIELD -> SETTER -> SHUTTER TABLE FOR THE SEVEN P4a BITS.
+            //
+            // THE RULE (P4a fable seam audit, section C.1): every field of every emitted
+            // record names the frontend setter that changes it, and that setter moves a
+            // counter the emitting bit's shutter reads - or the emission is unconditional at
+            // the setter (the resource_* family, set_texture_params). A record field whose
+            // setter moves no shutter input is a stale record with nothing to refuse: c0d
+            // (bit 13 without the bind generation), SD-0 (an image re-bind), F-1 (the
+            // program behind the view set), F-2 (the program behind the image window) and
+            // F-3 (an attached object's storage) were all this one class. DirtySurface.def
+            // cannot catch it - it maps MUTATORS to bits and cannot see that a DERIVED field
+            // depends on a mutator whose row is another family's - so the table lives here,
+            // beside the shutters, and a row is added whenever a record gains a field.
+            //
+            // bit 6  create/bind_shader_state, set_draw/dispatch_program (ProgramEmit.h)
+            //        fields: Cso, StageMask, GlobalUboSize, the artefact blob refs, the two
+            //                bound handles
+            //        setters: glUseProgram (m_currentProgram), glLinkProgram (link version),
+            //                glBindProgramPipeline / glUseProgramStages (pipeline name +
+            //                per-stage {lifetime id, link version})
+            //        shutter: lifetime id x link version, or stageLinks under a pipeline
+            // bit 7  the program's bindings (image units, block bindings, uniform write set)
+            //        setters: glUniform1i on an opaque uniform (backend state version, image
+            //                unit version), glUniformBlockBinding / glShaderStorageBlockBinding
+            //                (block binding version), any glUniform* (uniform write set)
+            //        shutter: the four per-program counters, x stageLinks under a pipeline
+            // bit 8  set_global_constants: ShaderCso, Version, the default-block image
+            //        setters: any glUniform* on the default block (UBO content version),
+            //                glUseProgram (lifetime id)
+            //        shutter: lifetime id x UBO content version, or stageState
+            // bit 11 set_framebuffer_state: Fbo, Color[8]/Depth/Stencil/ReadSurface
+            //        (Res, Kind, InternalFormat, TextureTarget, Layered, Level, Layer,
+            //        UploadTarget), DrawBuffers[8], Width/Height/Layers/Samples/
+            //        FixedSampleLocations, IsDefault, Complete, Target
+            //        setters: glFramebufferTexture*/glFramebufferRenderbuffer, glDrawBuffer(s),
+            //                glReadBuffer, glFramebufferParameteri (the attachment
+            //                aggregate); glBindFramebuffer (the two binding slot versions);
+            //                AND a storage redefinition of an ATTACHED texture or
+            //                renderbuffer - glTexImage*/glTexStorage*/glTexBuffer/
+            //                glTextureView/glRenderbufferStorage* - because InternalFormat,
+            //                TextureTarget, the extent, Samples and Complete are INLINED at
+            //                emission (D-C1): those bump the attachment aggregate from the
+            //                object's PipePublishDescriptor (F-3)
+            //        shutter: attachment aggregate x draw bind version x read bind version
+            // bit 12 set_sampler_views: per unit {View, Texture}
+            //        setters: glBindTexture / glActiveTexture (bind generation), a texture's
+            //                or a sampler object's parameters (SamplesAsIncompleteTexture -
+            //                the params aggregate), an upload that defines a level (content
+            //                aggregate), the default texture's image appearing (bind
+            //                generation, TextureObject.cpp); AND the program in use -
+            //                glUseProgram, a relink, glUniform1i on a sampler uniform (which
+            //                unit a uniform's TYPE resolves) - F-1
+            //        shutter: content x params x bind generation x opaqueUnits
+            // bit 13 bind_sampler_states: per unit the sampler CSO handle
+            //        setters: glBindSampler (bind generation, c0d), glSamplerParameter* /
+            //                glTexParameter* (params aggregate + sampling resolution),
+            //                glDeleteSamplers (bind generation)
+            //        shutter: params x sampling resolution x bind generation
+            // bit 14 set_shader_images: per unit {Res, InternalFormat, Layer, Level,
+            //        Layered, Access} over the program's image-unit window
+            //        setters: glBindImageTexture (bind generation, SD-0), a texture's
+            //                content/params, glUniform1i on an image uniform (image unit
+            //                version); AND the program in use - glUseProgram, a relink -
+            //                F-2
+            //        shutter: content x params x bind generation x programImages
+            //                (lifetime id x link version x image unit version)
+            // ===========================================================================
+
+            // ---- the object-class bits 9..17 ----
+            const Uint64 textureContent = ctx.GetAnyTextureContentGeneration();
+            const Uint64 textureParams = ctx.GetAnyTextureParamsGeneration();
+            const Uint64 buffers = ctx.GetAnyBufferChangeGeneration();
+
+            // Bit 9. The VAO attribute aggregate mixed with the bound VAO's identity is
+            // already exact for the SET - it is bumped by all three Bump*Version functions,
+            // which are the only writers of an attribute's format, buffer or enable state -
+            // and a driver-id re-mint that moves no client counter is caught server-side by
+            // the backend's own id generation.
+            //
+            // THE PENDING BASE INSTANCE IS MIXED IN, and this is a deviation from the design
+            // note that said "keep the shutter" (recorded in client-v1.md): the draw's
+            // baseInstance is now an EXPLICIT field of set_vertex_buffers and a
+            // ContentHash input, and it moves neither the attribute aggregate nor the VAO
+            // identity. Without it here, a draw whose only change is its base instance would
+            // never reach the emitter at all and the server would keep the previous fetch
+            // shift - which is the same silently-wrong-geometry the backend's
+            // baseInstanceDirty flag exists to prevent, one level further out. It fires
+            // extra only on the draws that actually carry one.
+            now[Index(MGPipeDirty::NewVertexBuffers)] = MGPipeMixShutter(
+                MGPipeMixShutter(ctx.GetAnyVaoAttributeGeneration(), vaoIdentity), m_pendingBaseInstance);
+            // Bit 10, NARROWED (P3a, D-I). It used to mix the whole buffer-CONTENT aggregate
+            // with the VAO identity and therefore fired on any buffer write anywhere; what
+            // it guards is one binding slot, so it now reads that slot's own version and the
+            // identity of what is bound to it. The version is a WRAPPING Uint16 bumped only
+            // on a real change, so it goes through the widened counter at this boundary; the
+            // bound object's lifetime id joins it because identity is what closes the wrap
+            // hole. The VAO identity stays in the mix because the element slot BELONGS to
+            // the bound VAO - switching VAOs switches slots.
+            Uint64 indexShutter = 0;
+            if (vao) {
+                const auto& indexSlot = vao->GetIndexBufferBindingSlot();
+                const auto& indexObject = indexSlot.GetBoundObject();
+                indexShutter = MGPipeMixShutter(m_indexSlotVersion.Observe(indexSlot.GetVersion()),
+                                                indexObject ? indexObject->GetLifetimeId() : 0);
+            }
+            now[Index(MGPipeDirty::NewIndexBuffer)] = MGPipeMixShutter(vaoIdentity, indexShutter);
+            // Bit 11, WIDENED AT P4a AND THIS IS A REQUIREMENT RATHER THAN AN OPTION. The
+            // shutter observed the DRAW binding slot only, so glBindFramebuffer(
+            // GL_READ_FRAMEBUFFER, ...) moved nothing at all - which was harmless while
+            // nothing was emitted for the bit and is an UNDER-FIRE the moment P4a emits
+            // set_framebuffer_state per bound target (D-C2): the read record would never be
+            // sent and the server's ReadSurface would stay the previous framebuffer's. Over-
+            // firing costs one extra push; under-firing renders stale, and this file's own
+            // rule is that under-firing is the dangerous direction.
+            //
+            // A STORAGE REDEFINITION OF AN ATTACHED OBJECT MOVES THIS SHUTTER (P4a fable seam
+            // F-3), and the sentence that stood here - "a renderbuffer respecify is still
+            // invisible here, and deliberately so ... closed by emitting resource_respecify
+            // straight from the storage entry point" - was true of the RESOURCE record only.
+            // set_framebuffer_state inlines each attachment's InternalFormat, TextureTarget,
+            // extent, Samples and Complete (D-C1: "so the four cross-object masks fall out at
+            // push time with no lookup"), so `glTexImage2D(tex, RGB8); attach; draw;
+            // glTexImage2D(tex, RGBA8); draw` left the FRAMEBUFFER record saying RGB8 while the
+            // resource record said RGBA8, and the handle arm answered its alpha-widening,
+            // snorm-clamp and integer masks from the stale copy where the legacy arm re-read
+            // the frontend at the same re-sync - a proven arm divergence on a public-GL
+            // sequence. The fix is at the SETTER, not here: TextureObjectBase::PipePublish
+            // Descriptor and RenderbufferObject::PipePublishDescriptor - the one funnel every
+            // storage-defining entry point of either object takes, push-only - bump the
+            // attachment aggregate this shutter already reads. No counter is added to either
+            // object (G1), nothing widens this shutter onto the texture-content aggregate (which
+            // would fire the 304-byte record build on every glTexSubImage2D), and a storage
+            // definition of an UNATTACHED object over-fires it exactly once at load time.
+            //
+            // AND A TRAP THE NEXT NARROWING WOULD WALK INTO, recorded here because it is
+            // invisible from the shutter: FramebufferObject::SetDrawBuffer versions the VALUE
+            // being written rather than the index being written TO - it calls
+            // BumpAttachmentVersion(buffer). The object version and the aggregate still move,
+            // so THIS shutter is safe; a narrower one built on m_attachmentVersions would not
+            // be, and P4a must not build one.
+            now[Index(MGPipeDirty::NewFramebuffer)] = MGPipeMixShutter(
+                MGPipeMixShutter(
+                    ctx.GetAnyFramebufferAttachmentGeneration(),
+                    m_framebufferBind.Observe(
+                        ctx.GetFramebufferBindingSlot(FramebufferTarget::Draw).GetVersion())),
+                m_readFramebufferBind.Observe(
+                    ctx.GetFramebufferBindingSlot(FramebufferTarget::Read).GetVersion()));
+            // Bit 12 reads FOUR things (F-1): the two texture aggregates, the bind generation
+            // and the program input computed above. The params aggregate is here because
+            // SamplerEmit.h drops a unit's view to null when SamplesAsIncompleteTexture says so,
+            // and that predicate reads the effective sampler's filters - a glTexParameteri(
+            // MIN_FILTER) that completes a texture fired bit 13 and not this one, so the entry
+            // stayed null. The program input is here because the set is resolved FOR THE
+            // PROGRAM IN USE, and a glUseProgram alone moved nothing this shutter read.
+            now[Index(MGPipeDirty::NewSamplerViews)] = MGPipeMixShutter(
+                MGPipeMixShutter(MGPipeMixShutter(textureContent, textureParams), ctx.GetTextureBindGeneration()),
+                opaqueUnits);
+            // Bit 13, WIDENED AT P4a FOR BIT 11's REASON and found the same way. glBindSampler
+            // moves NEITHER half of what this used to read: GL_Sampler.cpp's BindSampler_State
+            // goes through NoteTextureUnitTouched and TextureUnit::SetSamplerObject, and both
+            // of those bump the TEXTURE BIND generation - bit 12's. The only two writers of
+            // BumpSamplingResolutionGeneration are PARAMETER changes (SamplerObject.cpp,
+            // TextureObject.cpp). So `glBindSampler(3, a); draw; glBindSampler(3, b); draw`
+            // fired bit 12 twice and bit 13 not once, and the server's BoundSamplerStates[3]
+            // went on naming a's CSO: wrong filtering, with nothing able to see it, because
+            // bind_sampler_states has no pulled twin to fall back on the way the view set does.
+            //
+            // MIXING THE GENERATION IN IS THE FIX RATHER THAN A SECOND GATE ON THE EMITTER,
+            // because that generation is what the unit SET is derived from: a sampler bind
+            // changes which sampler state applies at a unit, and a texture bind changes it too
+            // whenever the unit carries no sampler object and the texture's BUILT-IN sampler is
+            // what applies. Keeping it one shutter per bit is also what keeps the per-subsystem
+            // A/B and the per-bit fire tallies meaning what they say - a bit gated on another
+            // bit's shutter measures neither. The extra fires a plain texture bind now costs
+            // are swallowed by the emitter's own set-hash suppressor, which MGPipeTypes.h makes
+            // mandatory for every kVarTail set for this exact traffic.
+            now[Index(MGPipeDirty::NewSamplers)] = MGPipeMixShutter(
+                MGPipeMixShutter(textureParams, ctx.GetSamplingResolutionGeneration()),
+                ctx.GetTextureBindGeneration());
+            now[Index(MGPipeDirty::NewShaderImages)] = MGPipeMixShutter(
+            MGPipeMixShutter(MGPipeMixShutter(textureContent, textureParams), programImages),
+            ctx.GetTextureBindGeneration());
+            now[Index(MGPipeDirty::NewConstBuffers)] = buffers;
+            now[Index(MGPipeDirty::NewShaderBuffers)] = buffers;
+            now[Index(MGPipeDirty::NewSoTargets)] =
+                MGPipeMixShutter(buffers, ctx.GetTransformFeedbackGeneration());
+
+            Uint32 dirty = 0;
+            for (SizeT i = 0; i < kMGPipeDirtyCount; ++i) {
+                // Bits 2 and 3 are handled below: they are BitwiseEqual shutters, not
+                // counters, so they have no entry in `now`.
+                if (i == Index(MGPipeDirty::NewPixelPack) || i == Index(MGPipeDirty::NewPatchState)) {
+                    continue;
+                }
+                if (!m_primed || now[i] != m_lastPushed[i]) dirty |= Uint32{1} << static_cast<Uint32>(i);
+                m_lastPushed[i] = now[i];
+            }
+
+            // ---- bit 2: the PACK half of the pixel store, BitwiseEqual ----
+            const PixelStoreParameters pack = ctx.GetPixelStoreParameters(false);
+            if (!m_primed || std::memcmp(&pack, &m_pack, sizeof(pack)) != 0) {
+                dirty |= MGPipeDirtyBit(MGPipeDirty::NewPixelPack);
+                m_pack = pack;
+            }
+
+            // ---- bit 3: the patch trio, BitwiseEqual, and NaN IS LEGAL ----
+            // A NaN outer level is a legal glPatchParameterfv value and must compare equal to
+            // itself (ARCHITECTURE.md 5.2). Float equality says it is not; memcmp says it is,
+            // which is the whole reason this is a byte compare.
+            PatchTrio patch{};
+            patch.PatchVertices = render.PatchVertices;
+            for (SizeT i = 0; i < 4; ++i) patch.Outer[i] = render.PatchDefaultOuterLevel[i];
+            for (SizeT i = 0; i < 2; ++i) patch.Inner[i] = render.PatchDefaultInnerLevel[i];
+            if (!m_primed || std::memcmp(&patch, &m_patch, sizeof(patch)) != 0) {
+                dirty |= MGPipeDirtyBit(MGPipeDirty::NewPatchState);
+                m_patch = patch;
+            }
+
+            m_primed = true;
+            m_freshlyPrimed = !wasPrimed;
+            m_lastDirty = dirty;
+
+            if (MG_Util::PipeStats::Enabled()) {
+                const SizeT cls = static_cast<SizeT>(verbClass);
+                ++m_walks[cls];
+                for (SizeT i = 0; i < kMGPipeDirtyCount; ++i) {
+                    if (dirty & (Uint32{1} << static_cast<Uint32>(i))) ++m_fires[i][cls];
+                }
+            }
+            return dirty;
+        }
+
+        // Context teardown, server reset, a unit test's fixture. The next Update returns
+        // every bit set, which is what makes the first verb on a fresh context publish a
+        // complete state rather than an increment. Deliberately does NOT clear the fire
+        // tallies: they are a per-run measurement, not per-context state.
+        //
+        // AND IT DELIBERATELY DOES NOT CLEAR m_pendingBaseInstance. Everything else this
+        // function clears is a LATCH describing what the server was last told; the pending
+        // base instance is THIS CALL'S ARGUMENT, written by the draw entry point one
+        // statement before MGP_FILL and not yet read by anybody. Update() calls Reset() from
+        // inside itself whenever the current GLContext pointer moves, so clearing it here
+        // meant that `eglMakeCurrent(ctxB); glDrawArraysInstancedBaseInstance(..., 7)` put a
+        // BaseInstance of 0 on the wire - one silently mis-shifted instanced draw per context
+        // switch, on the emulation path, with nothing to catch it. The value is cleared by the
+        // verb that consumes it (PipeFill.cpp's step 3, and its no-context early return) and
+        // by MGPipeLeaveVerb, which is where a per-call argument belongs.
+        void Reset() {
+            std::memset(m_lastPushed, 0, sizeof(m_lastPushed));
+            m_renderStateVersion.Reset();
+            m_pipelineStateVersion.Reset();
+            m_framebufferBind.Reset();
+            m_readFramebufferBind.Reset();
+            m_indexSlotVersion.Reset();
+            m_pack = PixelStoreParameters{};
+            m_patch = PatchTrio{};
+            m_staged = RenderStateParameters{};
+            m_stagedAttribs = AttribDefaults{};
+            m_context = nullptr;
+            m_lastDirty = 0;
+            m_primed = false;
+            m_freshlyPrimed = false;
+        }
+
+        void ResetCounters() {
+            std::memset(m_fires, 0, sizeof(m_fires));
+            std::memset(m_walks, 0, sizeof(m_walks));
+        }
+
+        Uint64 FireCount(MGPipeDirty bit, MGPipeVerbClass verbClass) const {
+            return m_fires[Index(bit)][static_cast<SizeT>(verbClass)];
+        }
+        Uint64 FireCount(MGPipeDirty bit) const {
+            Uint64 total = 0;
+            for (SizeT i = 0; i < kMGPipeVerbClassCount; ++i) total += m_fires[Index(bit)][i];
+            return total;
+        }
+        Uint64 WalkCount(MGPipeVerbClass verbClass) const {
+            return m_walks[static_cast<SizeT>(verbClass)];
+        }
+        Uint64 WalkCount() const {
+            Uint64 total = 0;
+            for (SizeT i = 0; i < kMGPipeVerbClassCount; ++i) total += m_walks[i];
+            return total;
+        }
+
+        Uint32 LastDirty() const { return m_lastDirty; }
+        Bool Primed() const { return m_primed; }
+        // True when the LAST Update was the first one after a Reset - a fresh context, or a
+        // server reset. The emission step reads it to send a COMPLETE state rather than an
+        // increment against a staging mirror that describes a context that is gone.
+        Bool FreshlyPrimed() const { return m_freshlyPrimed; }
+
+        // "What the server has" (P2 brief D8). set_dynamic_state sends the dynamic chunks
+        // that differ from this, which is the chunk-level suppressor; a chunk that
+        // memcmp-matches is not sent at all.
+        RenderStateParameters& Staged() { return m_staged; }
+        const RenderStateParameters& Staged() const { return m_staged; }
+
+        // The same mirror for the 32 glVertexAttrib* defaults: set_vertex_attrib_defaults
+        // names only the attributes that differ from it, which is the var-tail's own
+        // suppressor underneath D11's set-hash one.
+        using AttribDefaults = Array<MG_State::GLState::CurrentVertexAttributeValue,
+                                     MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS>;
+        AttribDefaults& StagedAttribDefaults() { return m_stagedAttribs; }
+        const AttribDefaults& StagedAttribDefaults() const { return m_stagedAttribs; }
+
+        // ---- P3a D-H2: the draw's vertex-FETCH base instance ----
+        //
+        // It lives HERE rather than in a file static because bit 9's shutter has to see it:
+        // an ambient process global cannot cross a pushed boundary, and the value is now an
+        // explicit field of set_vertex_buffers and an input to its content hash, so a draw
+        // whose only change is its base instance has to reach the emitter. Set immediately
+        // before the fill at the three *BaseInstance draw entry points; CONSUMED and cleared
+        // by the validate point once it has been emitted, so a plain draw that follows one
+        // sees 0 again.
+        //
+        // THE CLEAR THAT ACTUALLY RUNS IN PRODUCTION IS THE VALIDATE POINT'S. MGPipeLeaveVerb
+        // clears it too, but no GL entry point calls MGPipeLeaveVerb - only MG_Test's
+        // ScopedPipeVerb and TrackerTest do - so the production guarantee is entirely
+        // PipeFill.cpp's, on BOTH of its exits: the end of step 3, and the no-live-context
+        // early return that skips step 3 altogether. Reset() deliberately does not clear it
+        // (see there): it is this call's argument, not a latch.
+        void SetPendingBaseInstance(Uint32 baseInstance) { m_pendingBaseInstance = baseInstance; }
+        Uint32 PendingBaseInstance() const { return m_pendingBaseInstance; }
+        void ClearPendingBaseInstance() { m_pendingBaseInstance = 0; }
+
+    private:
+        static constexpr SizeT Index(MGPipeDirty bit) { return static_cast<SizeT>(bit); }
+
+        struct PatchTrio {
+            Uint PatchVertices;
+            Float Outer[4];
+            Float Inner[2];
+        };
+
+        Uint64 m_lastPushed[kMGPipeDirtyCount]{};
+        MGPipeWidenedCounter m_renderStateVersion;
+        MGPipeWidenedCounter m_pipelineStateVersion;
+        // The draw framebuffer BINDING slot version, widened for the same reason: a Uint16
+        // that wrapped would let a composite shutter repeat and cost a missed fire.
+        MGPipeWidenedCounter m_framebufferBind;
+        // P4a: the READ framebuffer binding slot's version, its own counter for the same
+        // reason the draw one exists. Two counters rather than one over both slots: a single
+        // widened counter fed two independent Uint16s reads a decrease as a wrap on every
+        // alternation and would add 65536 per switch, which costs nothing in correctness
+        // (over-firing) but makes the high word meaningless.
+        MGPipeWidenedCounter m_readFramebufferBind;
+        // The BOUND VAO's element-array slot version, widened for the same reason. One
+        // counter over a slot that changes with the bound VAO: a stale high word can only
+        // ADD a fire, never drop one, and the VAO identity in the same mix is what makes a
+        // switch between two VAOs differ whatever their slot versions read.
+        MGPipeWidenedCounter m_indexSlotVersion;
+        Uint32 m_pendingBaseInstance = 0;
+        // Bits 2 and 3 are BitwiseEqual shutters, not counters.
+        PixelStoreParameters m_pack{};
+        PatchTrio m_patch{};
+
+        RenderStateParameters m_staged{};
+        AttribDefaults m_stagedAttribs{};
+
+        const void* m_context = nullptr;
+        Uint32 m_lastDirty = 0;
+        Bool m_primed = false;
+        Bool m_freshlyPrimed = false;
+
+        Uint64 m_fires[kMGPipeDirtyCount][kMGPipeVerbClassCount]{};
+        Uint64 m_walks[kMGPipeVerbClassCount]{};
+    };
+
+    // ONE attribute default, flattened onto the wire (P2 brief D10). A named function rather
+    // than four lines inside the emitter because this flattening is the whole correctness
+    // question of set_vertex_attrib_defaults: a CurrentVertexAttributeValue is one value in
+    // three views and GLContext converts NUMERICALLY between them, so four words alone are
+    // not the value - glVertexAttrib4f(loc, 1.5f, ...) leaves 1 in intValue and 0x3FC00000 in
+    // floatValue. MGPAttribValue::ValueClass is what makes the four words readable again, and
+    // TrackerAttribPayload pins that here instead of leaving it to the emitter's shape.
+    inline void MGPipeFillAttribValue(Uint32 location,
+                                      const MG_State::GLState::CurrentVertexAttributeValue& value,
+                                      Uint32 writtenClass, MGPAttribValue& out) {
+        out = MGPAttribValue{};
+        out.Location = location;
+        out.ValueClass = static_cast<Uint8>(writtenClass);
+        static_assert(sizeof(out.Data) == sizeof(value.floatValue), "MGPAttribValue::Data is four words");
+        switch (writtenClass) {
+        case MG_State::GLState::kVertexAttribValueClassInt:
+            std::memcpy(out.Data, value.intValue.data(), sizeof(out.Data));
+            break;
+        case MG_State::GLState::kVertexAttribValueClassUint:
+            std::memcpy(out.Data, value.uintValue.data(), sizeof(out.Data));
+            break;
+        default:
+            std::memcpy(out.Data, value.floatValue.data(), sizeof(out.Data));
+            break;
+        }
+    }
+
+    // The monolith's one tracker. Under split there is one per client context; the context
+    // identity check inside Update is what makes the single instance safe today.
+    inline MGPipeTracker& MGPipeTrackerInstance() {
+        // NEVER DESTROYED, for MGPipeSlots()' reason (MG_Impl/Pipe/SlotAllocator.cpp). The
+        // rule is stated over the SET of MGPipe process singletons rather than over the two
+        // that a frontend destructor reaches today: which of them a destructor reaches is a
+        // property of the emitters, and the emitters change (C-1 added a second reaching
+        // path in one commit). One allocation per process, no destructor to lose - this type
+        // has none - and nothing can then answer a late call out of freed storage.
+        static MGPipeTracker* tracker = new MGPipeTracker();
+        return *tracker;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_Impl/Pipe/VertexInputEmit.h

@@ -0,0 +1,444 @@
+// MobileGL - MobileGL/MG_Impl/Pipe/VertexInputEmit.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+#include <Includes.h>
+
+// The CLIENT side of P3a's vertex-input family (brief D-G, D-H, D-I): the bound VAO's
+// format as create/bind_vertex_elements, its buffers as set_vertex_buffers with an explicit
+// baseInstance, and its element binding as set_index_buffer.
+//
+// UNLIKE THE RESOURCE FAMILY, these three emit at the VALIDATE POINT, from
+// MGPipeValidateForVerb's step 3 in the fixed order elements -> buffers -> index. That is
+// the ordinary rule (ARCHITECTURE.md 5.1); the resource family is the one exception to it.
+//
+// THE CSO IS IDENTITY-ADDRESSED, NOT CONTENT-ADDRESSED (D-G1, a recorded deviation from
+// ARCHITECTURE.md's 1024-entry content-addressed scheme). One handle per frontend
+// VertexArrayObject, minted off its lifetime id, and create_vertex_elements is RE-ISSUED on
+// the same handle whenever the configuration moves - legal, because MGPipeHandle::Gen
+// increments only on slot reuse and never on a respecify. Espryt has no vertex-elements CSO
+// to share: its twin owns one driver VAO name plus 64 scratch buffer ids, which two frontend
+// VAOs cannot share, so content addressing would be strictly slower on the only backend this
+// phase touches. P7 adds the hash-probe-memcmp layer above these same three calls when
+// Magma's VertexInputStateFactory takes the CSO over.
+//
+// WHAT THE UNIT GATE READS. G6 is "the emitted blob + set + index record reproduce exactly
+// what the backend's VAO twin reads from the frontend today, field by field, for all 32
+// slots", and G7 is a scripted control that stops the conversion copying ONE field and
+// expects the suite to go red NAMING it. So the conversion is a pure function per field
+// (MGPipeBuildVertexAttribWire / MGPipeBuildVertexBindingPointWire) and the staging buffers
+// the emitter builds into are readable afterwards - the emitter passes m_blob and m_entries
+// straight to the applier, so "what was emitted" costs no copy at all.
+//
+// HEADER-ONLY, for the ownership reason Tracker.h states in full.
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/ResourceTracker.h>
+#include <MG_Impl/Pipe/SetHashSuppressor.h>
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#include <MG_Impl/Pipe/Tracker.h>
+#include <MG_Pipe/MGPipe.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_Util/Metrics/PipeStats.h>
+
+#include <xxhash.h>
+
+#include <cstring>
+
+namespace MobileGL::MG_Pipe {
+
+    // ---------------------------------------------------------------------------------
+    // D-G2: the wire conversion, one pure function per view
+    // ---------------------------------------------------------------------------------
+
+    // EVERY FIELD OF VertexAttribute THE WIRE FORM CARRIES, and nothing else:
+    //
+    //   Divisor is deliberately absent - it is resolved per binding point and travels in
+    //     MGPVertexBuffer::Divisor, which is where the backend's glVertexAttribDivisor reads
+    //     it. Carrying it twice would let a malformed record disagree with itself.
+    //   LegacyStride / LegacyPointer are deliberately absent - they are the
+    //     glGetVertexAttrib* query answers and nothing but the query path reads them, so
+    //     they stay client-side.
+    //   Buffer is deliberately absent - identity travels in set_vertex_buffers, which is
+    //     what keeps this record stable while the buffers under it change.
+    //   Stride is the RESOLVED distance and a surviving 0 is MEANINGFUL: a pointer call's 0
+    //     was already resolved to the element size by the frontend, so a 0 here can only
+    //     have come from the binding model, where it means every vertex reads the SAME
+    //     element. Collapsing it back into the element size is what made
+    //     KHR-GL43.vertex_attrib_binding.basic-input-case7/8 read past the buffer.
+    //   IsLong travels SEPARATELY from Type == Float64: VertexAttribFormat(GL_DOUBLE) reads
+    //     doubles and asks for them converted to float, VertexAttribLFormat keeps all 64
+    //     bits, and the backend's fp64 narrowing and its Adreno disabled-attribute
+    //     workaround both key on telling the two apart.
+    inline MGPVertexAttribWire MGPipeBuildVertexAttribWire(const MG_State::GLState::VertexAttribute& attrib,
+                                                           Uint32 bindingIndex) {
+        // ASSERT RATHER THAN ASSUME, in both directions, because the three narrowing casts
+        // below cross a package boundary: VertexArrayObject is another package's file and its
+        // 32-slot bound is its invariant, not this one's, so a BindingIndex of 256 would wrap
+        // to 0 and silently point every attribute at binding 0, and a negative Stride (the
+        // frontend field is a signed int) would arrive as a ~4 GiB unsigned distance.
+        MOBILEGL_ASSERT(bindingIndex < 256u,
+                        "MGPVertexAttribWire::BindingIndex is a Uint8 and cannot carry %u",
+                        static_cast<Uint>(bindingIndex));
+        MOBILEGL_ASSERT(attrib.Size >= 0 && attrib.Size <= 255,
+                        "MGPVertexAttribWire::Size is a Uint8 and cannot carry %d", attrib.Size);
+        MGPVertexAttribWire wire{};
+        wire.Offset = static_cast<Uint64>(attrib.Offset);
+        wire.Stride = static_cast<Int32>(attrib.Stride);
+        wire.Type = static_cast<Uint32>(attrib.Type);
+        wire.Size = static_cast<Uint8>(attrib.Size);
+        wire.Enabled = attrib.Enabled ? 1 : 0;
+        wire.Normalized = attrib.Normalized ? 1 : 0;
+        wire.IsInteger = attrib.IsInteger ? 1 : 0;
+        wire.IsLong = attrib.IsLong ? 1 : 0;
+        wire.IsBgra = attrib.IsBgra ? 1 : 0;
+        wire.BindingIndex = static_cast<Uint8>(bindingIndex);
+        return wire;
+    }
+
+    // The ARB_vertex_attrib_binding view. Its initial Stride is 16, not 0 (GL 4.6 core table
+    // 23.4), which is why the wire form keeps it signed and copies it verbatim.
+    inline MGPVertexBindingPointWire
+    MGPipeBuildVertexBindingPointWire(const MG_State::GLState::VertexBufferBindingPoint& point) {
+        MGPVertexBindingPointWire wire{};
+        wire.Offset = static_cast<Uint64>(point.Offset);
+        wire.Stride = static_cast<Int32>(point.Stride);
+        wire.Divisor = static_cast<Uint32>(point.Divisor);
+        return wire;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // D-H2.3: the content hash, WITH BaseInstance in it
+    // ---------------------------------------------------------------------------------
+    //
+    // A HARD REQUIREMENT, not a nicety. set_vertex_buffers is suppressed on an unchanged
+    // hash (SetHashSuppressor.h's SetVertexBuffers slot), so a baseInstance that moved while
+    // the buffer set did not would be suppressed and the server would keep the previous
+    // fetch shift - exactly the bug the backend's baseInstanceDirty flag exists to prevent.
+    inline Uint64 MGPipeVertexBufferSetContentHash(const MGPVertexBuffer* entries, Uint32 start, Uint32 count,
+                                                   Uint32 baseInstance) {
+        Uint64 hash = XXH64(entries, static_cast<SizeT>(count) * sizeof(MGPVertexBuffer), 0);
+        hash = MGPipeMixShutter(hash, start);
+        hash = MGPipeMixShutter(hash, count);
+        hash = MGPipeMixShutter(hash, baseInstance);
+        return hash;
+    }
+
+    // ---------------------------------------------------------------------------------
+    // The emitter
+    // ---------------------------------------------------------------------------------
+
+    class MGPipeVertexInputEmitter {
+    public:
+        using GLContext = MG_State::GLState::GLContext;
+        using VertexArrayObject = MG_State::GLState::VertexArrayObject;
+        static constexpr SizeT kAttribs = static_cast<SizeT>(VertexArrayObject::MAX_VERTEX_ATTRIBS);
+        static constexpr SizeT kBindings = static_cast<SizeT>(VertexArrayObject::MAX_VERTEX_ATTRIB_BINDINGS);
+        static_assert(kAttribs <= kMGPipeMaxVertexAttribs && kBindings <= kMGPipeMaxVertexAttribs,
+                      "both declared counts are bounded by kMGPipeMaxVertexAttribs");
+
+        // create/bind_vertex_elements. D-G3's three arms, verbatim:
+        //
+        //   no VAO bound                     -> bind the null handle (legal, and it means
+        //                                       exactly "no VAO bound")
+        //   the bound VAO CHANGED            -> (re)create if its configuration moved since
+        //                                       this handle last published one, then bind
+        //   the same VAO, configuration MOVED-> create on the SAME handle, and do NOT rebind
+        //
+        // The latch is PER HANDLE, in a slot-indexed table, so ping-ponging between two VAOs
+        // re-binds but never re-creates either. A Uint32 configuration version does not wrap
+        // in any realistic run and is compared directly; the tracker's widened counter is
+        // for the Uint16s and is not needed here.
+        Uint64 EmitVertexElements(GLContext& ctx) {
+            const auto& vao = ctx.GetBoundVertexArray();
+            if (!vao) {
+                if (!MGPipeHandleIsNull(m_boundHandle)) {
+                    MGPipeApplyBindVertexElements(HandleOnly(kMGPipeNullHandle));
+                    ++m_binds;
+                    m_boundHandle = kMGPipeNullHandle;
+                    m_boundLifetimeId = 0;
+                }
+                return 0;
+            }
+
+            const Uint64 lifetimeId = vao->GetLifetimeId();
+            const Uint32 configVersion = vao->GetConfigVersion();
+            const MGPipeHandle handle = MGPipeSlots().Acquire(MGPipeKind::VertexElementsCso, lifetimeId);
+            const SizeT slot = handle.Slot;
+            if (slot >= m_latch.size()) m_latch.resize(slot + 1);
+            Latch& latch = m_latch[slot];
+
+            Uint64 bytes = 0;
+            const Bool configMoved = !latch.Published || latch.ConfigVersion != configVersion ||
+                                     latch.Gen != handle.Gen;
+            if (configMoved) bytes += EmitCreate(*vao, handle, latch, configVersion);
+            if (lifetimeId != m_boundLifetimeId || m_boundHandle != handle) {
+                MGPipeApplyBindVertexElements(HandleOnly(handle));
+                ++m_binds;
+                bytes += sizeof(MGPHandleOnly);
+                m_boundHandle = handle;
+                m_boundLifetimeId = lifetimeId;
+            }
+            return bytes;
+        }
+
+        // set_vertex_buffers. Espryt consumes RESOLVED attributes, so the set is one entry
+        // per attribute slot with BindingIndex == the attribute index; Start is 0 and Count
+        // is the highest ENABLED attribute plus one, which is the 32-slot prefix walk the
+        // dirty bit is specified over.
+        //
+        // A client-memory array is Res == kMGPipeNullHandle, and that is not a hole: it is
+        // exactly how the server learns "this attribute is client-sourced, upload it
+        // yourself". Its store genuinely does not exist at this moment - the client-array
+        // uploader runs after PrepareForDraw, at the draw entry point - and moving that
+        // resolution to the client is P8's.
+        Uint64 EmitVertexBuffers(GLContext& ctx, Uint32 baseInstance) {
+            const auto& vao = ctx.GetBoundVertexArray();
+            Uint32 count = 0;
+            if (vao) {
+                for (SizeT i = 0; i < kAttribs; ++i) {
+                    if (vao->GetAttribute(static_cast<Uint>(i)).Enabled) count = static_cast<Uint32>(i) + 1;
+                }
+                for (SizeT i = 0; i < count; ++i) {
+                    const auto& attrib = vao->GetAttribute(static_cast<Uint>(i));
+                    MGPVertexBuffer& entry = m_entries[i];
+                    entry = MGPVertexBuffer{};
+                    entry.Res = attrib.Buffer ? MGPipeSlots().Acquire(MGPipeKind::Buffer,
+                                                                     attrib.Buffer->GetLifetimeId())
+                                              : kMGPipeNullHandle;
+                    // D-A3's sticky mask, ORed HERE rather than only sampled at a storage op.
+                    // This is the bit that survives the DSA idiom: a buffer defined through
+                    // glNamedBuffer* may never be bound at any resource emission, but a draw
+                    // that fetches from it resolves it right here, on the GL thread, at every
+                    // draw. Sticky, so one draw is enough for the rest of its life.
+                    MGPipeResourceTrackerInstance().NoteBoundAs(entry.Res, BufferTarget::Vertex);
+                    // The attribute's own byte offset lives in MGPVertexAttribWire::Offset,
+                    // so the entry's is the BINDING's, which the frontend already folded in.
+                    entry.Offset = 0;
+                    // Signed on the frontend, unsigned on the wire, and a negative one would
+                    // arrive as a ~4 GiB fetch distance rather than as an error.
+                    MOBILEGL_ASSERT(attrib.Stride >= 0, "a resolved vertex stride is never negative (%d)",
+                                    attrib.Stride);
+                    entry.Stride = static_cast<Uint32>(attrib.Stride);
+                    entry.Divisor = static_cast<Uint32>(attrib.Divisor);
+                    entry.BindingIndex = static_cast<Uint32>(i);
+                }
+            }
+
+            const Uint64 hash = MGPipeVertexBufferSetContentHash(m_entries.data(), 0, count, baseInstance);
+            if (!MGPipeSetHashSuppressorInstance().ShouldEmit(MGPipeSuppressorSlot::SetVertexBuffers, hash)) {
+                return 0;
+            }
+            m_lastBuffers = MGPVertexBuffers{};
+            m_lastBuffers.Start = 0;
+            m_lastBuffers.Count = count;
+            // THE DRAW'S RAW value. The client never pre-shifts an offset and never learns
+            // whether the server emulated the shift or let GL_EXT_base_instance do it -
+            // emulation is server-owned.
+            m_lastBuffers.BaseInstance = baseInstance;
+            m_lastBuffers.ContentHash = hash;
+            MGPipeApplySetVertexBuffers(m_lastBuffers, m_entries.data());
+            ++m_bufferSets;
+            return sizeof(MGPVertexBuffers) + static_cast<Uint64>(count) * sizeof(MGPVertexBuffer);
+        }
+
+        // set_index_buffer. An INDEPENDENT call, not a subset of the vertex-elements
+        // configuration version (D5) - the index slot is explicitly outside the VAO's
+        // m_configVersion, and the shutter for it is bit 10's, narrowed in Tracker.h.
+        //
+        // Offset and IndexSize are 0 here and the draw verb overrides them: at the validate
+        // point there is no draw to read them from, and the applier stores what it is given.
+        Uint64 EmitIndexBuffer(GLContext& ctx) {
+            const auto& vao = ctx.GetBoundVertexArray();
+            m_lastIndex = MGPIndexBuffer{};
+            if (vao) {
+                if (const auto& bound = vao->GetIndexBufferBindingSlot().GetBoundObject()) {
+                    m_lastIndex.Res = MGPipeSlots().Acquire(MGPipeKind::Buffer, bound->GetLifetimeId());
+                    // The ELEMENT_ARRAY bit, and it is the one the split path keys on
+                    // (kCapNeedsHostIndexBytes -> restart rewriting, multi-draw flattening).
+                    // Noted at every draw for RefreshBindMask's reason: an EBO defined through
+                    // DSA and unbound before its last respecify would otherwise never publish
+                    // it, and getting that bit wrong is invisible in monolith.
+                    MGPipeResourceTrackerInstance().NoteBoundAs(m_lastIndex.Res, BufferTarget::Index);
+                }
+            }
+            MGPipeApplySetIndexBuffer(m_lastIndex);
+            ++m_indexSets;
+            return sizeof(MGPIndexBuffer);
+        }
+
+        // ---- what a unit case reads. None of it costs a copy: the emitter builds INTO
+        // these and hands the applier the same pointers. ----
+        const Array<MGPVertexAttribWire, kMGPipeMaxVertexAttribs>& LastAttributes() const { return m_attributes; }
+        const Array<MGPVertexBindingPointWire, kMGPipeMaxVertexAttribs>& LastBindingPoints() const {
+            return m_bindingPoints;
+        }
+        const MGPVertexElements& LastElements() const { return m_lastElements; }
+        const MGPVertexBuffers& LastVertexBuffers() const { return m_lastBuffers; }
+        const Array<MGPVertexBuffer, kMGPipeMaxVertexAttribs>& LastEntries() const { return m_entries; }
+        const MGPIndexBuffer& LastIndexBuffer() const { return m_lastIndex; }
+        MGPipeHandle BoundHandle() const { return m_boundHandle; }
+        Uint64 CreateCount() const { return m_creates; }
+        Uint64 BindCount() const { return m_binds; }
+        Uint64 VertexBufferSetCount() const { return m_bufferSets; }
+        Uint64 IndexBufferSetCount() const { return m_indexSets; }
+
+        // ---- C-1: "does the applier hold a record for exactly this handle?" ----
+        //
+        // The CSO's death path (MGPipeEmitVertexElementsDestroyAndFree) needs that answer and
+        // MUST NOT GUESS IT FROM THE SLOT. A VertexElementsCso slot can exist with no record
+        // behind it, because a backend that keys its twins on the handle mints the slot itself
+        // (DirectGLES' BackendSlotTable::GetOrCreate -> MGPipeSlots().Acquire) whether or not
+        // bit 8 ever asked this client to emit anything - which is exactly what a
+        // MOBILEGL_PIPE_PUSH=0x7f lane runs. delete_vertex_elements on such a handle is a
+        // REFUSED call, and the applier's resolver asserts on a refusal
+        // (PipeApply.cpp's ResolveVertexElements), i.e. a stop in a verify build.
+        //
+        // Kept OUT of Reset(), unlike the create/bind latch beside it, and for the mirror
+        // image of Reset()'s own reason: "a fresh context is a fresh server" is true of the
+        // per-context half of this table, and object RECORDS are precisely what
+        // MGPipeApplierReset does not clear (PipeApply.h's two halves). This half tracks those
+        // records, so it lives exactly as long as they do.
+        Bool RecordIsPublished(MGPipeHandle handle) const {
+            if (MGPipeHandleIsNull(handle)) return false;
+            const SizeT slot = handle.Slot;
+            if (slot >= m_latch.size()) return false;
+            const Latch& latch = m_latch[slot];
+            return latch.RecordLive && latch.RecordGen == handle.Gen;
+        }
+
+        // The record named by `handle` is gone from the applier. Also drops the bound-handle
+        // memo when it named it, so the client's idea of BoundVertexElements and the applier's
+        // (which MGPipeApplyDeleteVertexElements just cleared for the same handle) stay in
+        // step rather than diverging until the next bind happens to correct it.
+        void NoteRecordDestroyed(MGPipeHandle handle) {
+            if (MGPipeHandleIsNull(handle)) return;
+            const SizeT slot = handle.Slot;
+            if (slot < m_latch.size() && m_latch[slot].RecordGen == handle.Gen) {
+                m_latch[slot] = Latch{};
+            }
+            if (m_boundHandle == handle) {
+                m_boundHandle = kMGPipeNullHandle;
+                m_boundLifetimeId = 0;
+            }
+        }
+
+        // A fresh context is a fresh server: the applier's records are gone, so every latch
+        // this emitter holds describes objects the server no longer has. Called from the
+        // validate point's FreshlyPrimed arm beside MGPipeApplierReset and the suppressor's
+        // InvalidateAll, for the same reason they are.
+        //
+        // The PER-CONTEXT half only - see RecordIsPublished above for why RecordLive/RecordGen
+        // survive. Re-creating a configuration the applier already holds is a bounded
+        // over-fire (MGPipeApplyCreateVertexElements starts the record over); forgetting that
+        // it holds one at all would leak the record and its slot at the object's death.
+        void Reset() {
+            for (Latch& latch : m_latch) {
+                latch.Published = false;
+                latch.Gen = 0;
+                latch.ConfigVersion = 0;
+            }
+            m_boundHandle = kMGPipeNullHandle;
+            m_boundLifetimeId = 0;
+        }
+
+        void ResetCounters() { m_creates = m_binds = m_bufferSets = m_indexSets = 0; }
+
+    private:
+        struct Latch {
+            // The PER-CONTEXT half: "has this emitter told THIS server about this handle's
+            // configuration". Cleared by Reset() at every make-current.
+            Bool Published = false;
+            Uint32 Gen = 0;
+            Uint32 ConfigVersion = 0;
+            // The RECORD half: "does the applier hold a create_vertex_elements record at this
+            // slot, for this generation". Lives as long as the record does - see
+            // RecordIsPublished.
+            Bool RecordLive = false;
+            Uint32 RecordGen = 0;
+        };
+
+        static MGPHandleOnly HandleOnly(MGPipeHandle handle) {
+            MGPHandleOnly only{};
+            only.Handle = handle;
+            only.Kind = static_cast<Uint32>(MGPipeKind::VertexElementsCso);
+            return only;
+        }
+
+        Uint64 EmitCreate(const VertexArrayObject& vao, MGPipeHandle handle, Latch& latch, Uint32 configVersion) {
+            // ALL 32 OF EACH, deliberately. The record DECLARES both counts and the applier
+            // refuses one whose counts do not describe its own blob, so a self-describing
+            // record is the cheap shape - and G6 is stated over all 32 slots, which a
+            // truncated set could not answer. It rides create_vertex_elements only, i.e.
+            // once per configuration change, never per draw.
+            for (SizeT i = 0; i < kAttribs; ++i) {
+                m_attributes[i] = MGPipeBuildVertexAttribWire(vao.GetAttribute(static_cast<Uint>(i)),
+                                                              vao.GetAttributeBindingIndex(static_cast<Uint>(i)));
+            }
+            for (SizeT i = 0; i < kBindings; ++i) {
+                m_bindingPoints[i] = MGPipeBuildVertexBindingPointWire(vao.GetBindingPoint(static_cast<Uint>(i)));
+            }
+            // Attributes first, then binding points, both ascending and contiguous.
+            constexpr SizeT kAttribBytes = kAttribs * sizeof(MGPVertexAttribWire);
+            constexpr SizeT kBindingBytes = kBindings * sizeof(MGPVertexBindingPointWire);
+            std::memcpy(m_blob.data(), m_attributes.data(), kAttribBytes);
+            std::memcpy(m_blob.data() + kAttribBytes, m_bindingPoints.data(), kBindingBytes);
+
+            m_lastElements = MGPVertexElements{};
+            m_lastElements.Cso = handle;
+            m_lastElements.AttributeCount = static_cast<Uint32>(kAttribs);
+            m_lastElements.BindingPointCount = static_cast<Uint32>(kBindings);
+            m_lastElements.Blob.Seg = kMGHostSpanSegNone;
+            m_lastElements.Blob.Offset = 0;
+            m_lastElements.Blob.Size = kAttribBytes + kBindingBytes;
+            MGPipeApplyCreateVertexElements(m_lastElements, m_blob.data());
+            ++m_creates;
+            latch.Published = true;
+            latch.Gen = handle.Gen;
+            latch.ConfigVersion = configVersion;
+            // THE ONE PRODUCER of the record half: a create that reached the applier is the
+            // only thing that makes delete_vertex_elements a legal call for this handle.
+            latch.RecordLive = true;
+            latch.RecordGen = handle.Gen;
+            return sizeof(MGPVertexElements) + kAttribBytes + kBindingBytes;
+        }
+
+        Array<MGPVertexAttribWire, kMGPipeMaxVertexAttribs> m_attributes{};
+        Array<MGPVertexBindingPointWire, kMGPipeMaxVertexAttribs> m_bindingPoints{};
+        Array<Uint8, kMGPipeMaxVertexAttribs *(sizeof(MGPVertexAttribWire) + sizeof(MGPVertexBindingPointWire))>
+            m_blob{};
+        Array<MGPVertexBuffer, kMGPipeMaxVertexAttribs> m_entries{};
+
+        MGPVertexElements m_lastElements{};
+        MGPVertexBuffers m_lastBuffers{};
+        MGPIndexBuffer m_lastIndex{};
+
+        Vector<Latch> m_latch;
+        MGPipeHandle m_boundHandle = kMGPipeNullHandle;
+        Uint64 m_boundLifetimeId = 0;
+
+        Uint64 m_creates = 0;
+        Uint64 m_binds = 0;
+        Uint64 m_bufferSets = 0;
+        Uint64 m_indexSets = 0;
+    };
+
+    // The monolith's one vertex-input emitter, beside the tracker, the CSO cache, the
+    // set-hash suppressor and the resource tracker.
+    inline MGPipeVertexInputEmitter& MGPipeVertexInputEmitterInstance() {
+        // NEVER DESTROYED, for MGPipeSlots()' reason (MG_Impl/Pipe/SlotAllocator.cpp), and
+        // this one is not hypothetical: C-1 put this emitter DIRECTLY on ~VertexArrayObject's
+        // path - MGPipeEmitVertexElementsDestroyAndFree asks RecordIsPublished(handle) and
+        // then NoteRecordDestroyed(handle), which read and WRITE m_latch. A destroyed
+        // emitter answers out of a freed Vector and the write grows it, i.e. an operator
+        // new + memcpy + operator delete on an already-freed block.
+        static MGPipeVertexInputEmitter* emitter = new MGPipeVertexInputEmitter();
+        return *emitter;
+    }
+} // namespace MobileGL::MG_Pipe
+#endif // MOBILEGL_PIPE_PUSH

MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.cpp

@@ -0,0 +1,42 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "BackendCapsPeek.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Backend/BackendObject.h>
+
+namespace MobileGL::MG_Backend {
+    // Declared in MG_Backend/BackendObjects.h, which also pulls in both backends' headers
+    // and, through them, their loaders; the reference alone is all that is needed here.
+    extern UniquePtr<BackendObject>& pActiveBackendObject;
+} // namespace MobileGL::MG_Backend
+#endif
+
+namespace MGITest {
+
+    bool PeekComputeWorkGroupCaps(int outCount[3], int outSize[3]) {
+#if defined(__ANDROID__)
+        (void)outCount;
+        (void)outSize;
+        return false;
+#else
+        const auto& backend = MobileGL::MG_Backend::pActiveBackendObject;
+        if (!backend) {
+            return false;
+        }
+        const MobileGL::MG_Backend::DynamicBackendParameters& caps = backend->GetDynamicParameters();
+        for (int axis = 0; axis < 3; ++axis) {
+            outCount[axis] = caps.MaxComputeWorkGroupCount[axis];
+            outSize[axis] = caps.MaxComputeWorkGroupSize[axis];
+        }
+        return true;
+#endif
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.h

@@ -0,0 +1,29 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/BackendCapsPeek.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// The one place this module looks past the GL API into the active backend's caps block.
+//
+// It exists for exactly one assertion: that the six per-axis compute limits the MGPipe
+// caps block carries (DynamicBackendParameters::MaxComputeWorkGroupCount/Size, plan B
+// section 4.4.1) are the same numbers glGetIntegeri_v answers today, since P0.5 retires
+// the getter in favour of the caps. A separate translation unit, because the scenario
+// sources include the GL headers with prototypes and MobileGL's umbrella header is not
+// meant to meet them in one file.
+
+#pragma once
+
+namespace MGITest {
+
+    // Copies the active backend's MaxComputeWorkGroupCount / MaxComputeWorkGroupSize into the
+    // two arrays and returns true. Returns false, touching nothing, where the caps block is
+    // out of reach: on Android this module links the SHIPPING libMobileGL.so, built
+    // -fvisibility=hidden, so no internal symbol resolves; on desktop it links MobileGL_s and
+    // the read is direct.
+    bool PeekComputeWorkGroupCaps(int outCount[3], int outSize[3]);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/HeadlessGL.cpp

@@ -552,7 +552,15 @@ namespace MGITest {
         // before the pre-flight forks - the child must measure the same platform
         // the parent will use.
         EnsureHeadlessPlatform();
-        m_backendName = EnvOr("MOBILEGL_BACKEND_TYPE", "<unset>");
+        // The backend that is actually about to come up, which is what every
+        // `BackendName() == "DirectGLES"` gate in the scenarios means by the question.
+        // MG_ConfigLoader::InitBackendType defaults an unset MOBILEGL_BACKEND_TYPE to
+        // DirectGLES, so the same default belongs here; this used to report the literal
+        // "<unset>" instead. Under ctest the variable is always set by the ENVIRONMENT
+        // property, which is why that never showed - but run straight from a device
+        // shell, where nothing sets it, DirectGLES came up and every case gated on the
+        // NAME DirectGLES skipped as though it had not.
+        m_backendName = EnvOr("MOBILEGL_BACKEND_TYPE", "DirectGLES");
         m_usable = BringUp();
     }
 

MobileGL/MG_IntegrationTest/Harness/P4aFinalFixPeek.cpp

@@ -0,0 +1,71 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/P4aFinalFixPeek.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "P4aFinalFixPeek.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Pipe/MGPipe.h>
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/MGPipeTypes.h>
+#include <MG_Pipe/PipeApply.h>
+#include <MG_Util/Metrics/PipeStats.h>
+#define MGITEST_P4A_FINALFIX_PEEK_LIVE 1
+#endif
+#endif
+
+namespace MGITest {
+
+#if defined(MGITEST_P4A_FINALFIX_PEEK_LIVE)
+    namespace {
+        namespace MGP = MobileGL::MG_Pipe;
+    } // namespace
+
+    bool PeekPipeTextureResourceRecord(unsigned glTextureName, PipeTextureResourceRecordPeek* out) {
+        if (out == nullptr) return false;
+        const MGP::MGPipeApplierState& applier = MGP::MGPipeApplier();
+        // Slot 0 is the reserved null slot; the walk is the same shape PipeApplyPeek.cpp's
+        // params reading takes. A GL name is never an identity on the wire, which is exactly
+        // why it is the right key for a harness that starts from the application's view.
+        for (MobileGL::SizeT slot = 1; slot < applier.TextureResources.size(); ++slot) {
+            const MGP::MGPipeResourceRecord& record = applier.TextureResources[slot];
+            if (!record.Live) continue;
+            if (record.Desc.GlNameForDiag != static_cast<MobileGL::Uint32>(glTextureName)) continue;
+            out->Slot = static_cast<unsigned>(slot);
+            out->Gen = static_cast<unsigned>(record.Gen);
+            out->Serial = static_cast<unsigned long long>(record.Serial);
+            out->BindMask = static_cast<unsigned>(record.Desc.BindMask);
+            out->ImageBindableHint = static_cast<unsigned>(record.Desc.ImageBindableHint);
+            out->Levels = static_cast<unsigned>(record.Desc.Levels);
+            out->PendingUploads = static_cast<unsigned>(record.PendingUploads.size());
+            return true;
+        }
+        return false;
+    }
+
+    bool PeekPipeStatsTextureRemintPulls(unsigned long long* out) {
+        if (out == nullptr) return false;
+        namespace Stats = MobileGL::MG_Util::PipeStats;
+        if (!Stats::Enabled()) Stats::SetEnabledForTesting(true);
+        *out = static_cast<unsigned long long>(Stats::TotalCalls(Stats::CallClass::TextureRemintPulls));
+        return true;
+    }
+
+    bool PeekPipeStatsTextureUploadEmissions(unsigned long long* out) {
+        if (out == nullptr) return false;
+        namespace Stats = MobileGL::MG_Util::PipeStats;
+        if (!Stats::Enabled()) Stats::SetEnabledForTesting(true);
+        *out = static_cast<unsigned long long>(Stats::TotalCalls(Stats::CallClass::TextureUploadEmissions));
+        return true;
+    }
+#else
+    bool PeekPipeTextureResourceRecord(unsigned, PipeTextureResourceRecordPeek*) { return false; }
+    bool PeekPipeStatsTextureRemintPulls(unsigned long long*) { return false; }
+    bool PeekPipeStatsTextureUploadEmissions(unsigned long long*) { return false; }
+#endif
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/P4aFinalFixPeek.h

@@ -0,0 +1,41 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/P4aFinalFixPeek.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// The white-box readings P4aFinalFixScenario.cpp takes, in a translation unit of their own for
+// P4aSeamPeek.h's reason: a scenario TU includes the GL prototype headers and cannot include
+// MG_Pipe/PipeApply.h or the Espryt managers beside them, and PipeApplyPeek.cpp is the gates
+// package's file. Every entry point answers false where the reading cannot be taken (a pull
+// build, Android, or an applier that holds no record for the name), and a false teaches the
+// caller nothing - the case declines that half by name and keeps its public-GL verdict.
+#pragma once
+
+namespace MGITest {
+
+    // The applier's resource record for a texture, found by its GL name (GlNameForDiag - a
+    // diagnostics-only field, which is exactly what a test harness is).
+    struct PipeTextureResourceRecordPeek {
+        unsigned Slot;
+        unsigned Gen;
+        unsigned long long Serial;
+        unsigned BindMask;
+        unsigned ImageBindableHint;
+        unsigned Levels;
+        unsigned PendingUploads;
+    };
+    bool PeekPipeTextureResourceRecord(unsigned glTextureName, PipeTextureResourceRecordPeek* out);
+
+    // The process-wide texture-remint pull count (PipeStats "tex-remint-pulls", `trp=` on the
+    // summary line; ROADMAP open question 2). Arms the PipeStats counters for this process on
+    // the first call, which is what lets a case read the number without a stats-enabled lane.
+    bool PeekPipeStatsTextureRemintPulls(unsigned long long* out);
+    // Espryt's count of texture uploads it actually issued (PipeStats "tex-upload-emissions"):
+    // what tells a CONSUMED pending upload apart from a DROPPED one, since the record's set is
+    // empty either way. Arms the counters the same way.
+    bool PeekPipeStatsTextureUploadEmissions(unsigned long long* out);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/P4aSeamPeek.cpp

@@ -0,0 +1,107 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/P4aSeamPeek.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "P4aSeamPeek.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Pipe/MGPipe.h>
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/PipeApply.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_Backend/DirectGLES/Managers.h>
+#include <MG_Backend/DirectGLES/DirectGLES.h>
+#define MGITEST_P4A_SEAM_PEEK_LIVE 1
+#endif
+#endif
+
+namespace MGITest {
+
+#if defined(MGITEST_P4A_SEAM_PEEK_LIVE)
+    namespace {
+        namespace MGP = MobileGL::MG_Pipe;
+        namespace MGB = MobileGL::MG_Backend::DirectGLES;
+
+        // "Is Espryt the backend running" - the same test PipeApplyPeek.cpp makes through a twin:
+        // on Magma no ES entry point was ever resolved and every member of g_GLESFuncs is null.
+        // It is asked BEFORE SamplerSubsystemEnabled(), which is Espryt's own latch and must not
+        // be resolved on a process whose backend is not Espryt.
+        bool EsprytIsRunning() { return MGB::g_GLESFuncs.glBindSampler != nullptr; }
+    } // namespace
+
+    bool PeekEsprytSamplerHandleArmIsLive(bool* outLive) {
+        if (outLive == nullptr) return false;
+        if (!EsprytIsRunning()) return false;
+        *outLive = MGB::SamplerSubsystemEnabled();
+        return true;
+    }
+
+    bool PeekEsprytFramebufferHandleArmIsLive(bool* outLive) {
+        if (outLive == nullptr) return false;
+        if (!EsprytIsRunning()) return false;
+        *outLive = MGB::FramebufferSubsystemEnabled();
+        return true;
+    }
+
+    bool PeekPipeShaderImageWindow(PipeShaderImageWindowPeek* out) {
+        if (out == nullptr) return false;
+        const MGP::MGPipeApplierState& applier = MGP::MGPipeApplier();
+        out->Start = static_cast<unsigned>(applier.ShaderImageStart);
+        out->Count = static_cast<unsigned>(applier.ShaderImageCount);
+        out->Serial = static_cast<unsigned long long>(applier.ShaderImagesSerial);
+        return true;
+    }
+
+    bool PeekEsprytUnitSampler(unsigned unit, unsigned glSamplerName, EsprytUnitSamplerPeek* out) {
+        if (out == nullptr) return false;
+        if (!EsprytIsRunning()) return false;
+        if (!MobileGL::MG_State::pGLContext) return false;
+        const MGP::MGPipeApplierState& applier = MGP::MGPipeApplier();
+        if (unit >= applier.BoundSamplerStates.size() || unit >= MGB::SamplerImpl::g_boundSamplersCache.size()) {
+            return false;
+        }
+        *out = EsprytUnitSamplerPeek{};
+
+        // Espryt's own binding shadow: every glBindSampler this backend issues routes through it
+        // (BackendSamplerObject::Bind / UnbindSampler), so it IS what the driver holds.
+        if (MGB::SamplerImpl::BackendSamplerObject* const bound = MGB::SamplerImpl::g_boundSamplersCache[unit]) {
+            out->BoundSamplerId = static_cast<unsigned>(bound->GetBackendSamplerId());
+        }
+
+        const MGP::MGPipeHandle cso = applier.BoundSamplerStates[unit];
+        out->CsoHandleSlot = static_cast<unsigned>(cso.Slot);
+        out->CsoHandleGen = static_cast<unsigned>(cso.Gen);
+        out->UnitInsideWindow = unit >= applier.SamplerStateStart &&
+                                unit - applier.SamplerStateStart < applier.SamplerStateCount;
+        // The twin AT THE CSO HANDLE, asked of the same table Espryt asks (FindByHandle): a null
+        // here with a live handle is the F-4 shape - a content-addressed handle looked up in a
+        // table that only ever held identity-minted slots.
+        if (!MGP::MGPipeHandleIsNull(cso)) {
+            if (auto* const slot = MGB::SamplerImpl::g_backendSamplerObjects.FindByHandle(cso); slot && *slot) {
+                out->CsoTwinSamplerId = static_cast<unsigned>((*slot)->GetBackendSamplerId());
+            }
+        }
+
+        // And the twin keyed on the frontend OBJECT, which is what the pre-handle program pass
+        // used to mint and bind, so a scenario can say which of the two the driver holds.
+        const auto& object = MobileGL::MG_State::pGLContext->GetSamplerObject(
+            static_cast<MobileGL::Uint>(glSamplerName));
+        if (object) {
+            if (auto* const slot = MGB::SamplerImpl::g_backendSamplerObjects.Find(object.get()); slot && *slot) {
+                out->IdentityTwinSamplerId = static_cast<unsigned>((*slot)->GetBackendSamplerId());
+            }
+        }
+        return true;
+    }
+#else
+    bool PeekEsprytSamplerHandleArmIsLive(bool*) { return false; }
+    bool PeekEsprytFramebufferHandleArmIsLive(bool*) { return false; }
+    bool PeekPipeShaderImageWindow(PipeShaderImageWindowPeek*) { return false; }
+    bool PeekEsprytUnitSampler(unsigned, unsigned, EsprytUnitSamplerPeek*) { return false; }
+#endif
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/P4aSeamPeek.h

@@ -0,0 +1,78 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/P4aSeamPeek.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// The three readings P4aSeamAuditScenario.cpp takes from the inside, for the two seams the fable
+// seam audit proved that PUBLIC GL CANNOT SEE: F-4 (the record arm's sampler bind is a permanent
+// no-op, hidden by the pre-handle program pass binding the same values) and F-2 / SD-4 (the
+// shader-image window does not follow a program switch, hidden by the server's window/high-water
+// union taking the pre-handle bind for the units outside it). Both are correct pictures over a
+// permanent silent fallback, which is precisely the class ROADMAP.md:20 says a gate has to be
+// able to make red - and the only place the difference exists is inside.
+//
+// A SEPARATE TRANSLATION UNIT for PipeApplyPeek.h's reason, verbatim: this file includes
+// Espryt's own Managers.h, which may not meet a scenario's GL headers in one file. It is NOT
+// PipeApplyPeek.cpp because that file is package F's (gates v3) and this round may not edit it.
+//
+// EVERY ENTRY POINT RETURNS false, TOUCHING NOTHING, WHERE IT CANNOT LOOK - a pull build, Android,
+// a backend that is not Espryt - and a caller that gets false has learned NOTHING: "could not
+// look" is not "was bound". The scenario declines the reading BY NAME and keeps its public-GL
+// half, which is the shape TextureParamsWithoutASamplerViewScenario.cpp argues for.
+
+#pragma once
+
+namespace MGITest {
+
+    // ---- is Espryt's sampler family on its HANDLE arm in this process? -------------------
+    //
+    // The gate for every other reading here. True only on DirectGLES, in a push build, with
+    // Espryt's own resolver answering "handle" for kMGPipeSubsystemSamplers (bit 11 set and its
+    // dependency satisfied) - i.e. exactly when bind_sampler_states / set_shader_images are
+    // consumed, so a white-box assertion about them can be red for its own reason and for no
+    // other. Written only on true.
+    bool PeekEsprytSamplerHandleArmIsLive(bool* outLive);
+
+    // The same question for the FRAMEBUFFER family (bit 9): true when Espryt consumes
+    // set_framebuffer_state in this process. The renderbuffer half of the F-3 case asserts only
+    // there - on the pre-handle arm a renderbuffer re-storaged while attached moves nothing the
+    // FBO memo reads (D-D2's documented hole, pre-P4a code), and the record is what closes it.
+    bool PeekEsprytFramebufferHandleArmIsLive(bool* outLive);
+
+    // ---- the applier's shader-image window, as last received ------------------------------
+    //
+    // MGPipeApplierState::ShaderImageStart / ShaderImageCount / ShaderImagesSerial. Count is
+    // "how many units set_shader_images last described" - 0 means the set has NEVER arrived
+    // (MGPipeApplierReset advances the serial whether or not anything was emitted, so the serial
+    // is not that test). Push build only.
+    struct PipeShaderImageWindowPeek {
+        unsigned Start;
+        unsigned Count;
+        unsigned long long Serial;
+    };
+
+    bool PeekPipeShaderImageWindow(PipeShaderImageWindowPeek* out);
+
+    // ---- which driver sampler a texture unit is bound to, and whose twin it is -------------
+    //
+    // For F-4. `BoundSamplerId` is the ES sampler name Espryt's own binding shadow says unit
+    // `unit` carries (0 = none). `CsoHandleSlot/Gen` is bind_sampler_states' handle for the unit,
+    // `CsoTwinSamplerId` the ES name of the twin Espryt holds AT THAT HANDLE (0 = no twin at the
+    // content-addressed slot - the F-4 shape), and `IdentityTwinSamplerId` the ES name of a twin
+    // keyed on the frontend SamplerObject named `glSamplerName` (0 = none). On a correct handle
+    // arm the unit's driver sampler IS the CSO twin. Push build, DirectGLES only.
+    struct EsprytUnitSamplerPeek {
+        unsigned BoundSamplerId;
+        unsigned CsoHandleSlot;
+        unsigned CsoHandleGen;
+        bool UnitInsideWindow;
+        unsigned CsoTwinSamplerId;
+        unsigned IdentityTwinSamplerId;
+    };
+
+    bool PeekEsprytUnitSampler(unsigned unit, unsigned glSamplerName, EsprytUnitSamplerPeek* out);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PipeApplyPeek.cpp

@@ -0,0 +1,188 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/PipeApplyPeek.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "PipeApplyPeek.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Pipe/MGPipe.h>
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Pipe/PipeApply.h>
+#include <MG_Pipe/MGPipeTypes.h>
+#include <MG_State/GLState/Core.h>
+#include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
+#include <MG_Backend/DirectGLES/Managers.h>
+#include <MG_Backend/DirectGLES/DirectGLES.h>
+#define MGITEST_PIPE_APPLY_PEEK_LIVE 1
+#endif
+#endif
+
+namespace MGITest {
+
+#if defined(MGITEST_PIPE_APPLY_PEEK_LIVE)
+    namespace {
+        namespace MGP = MobileGL::MG_Pipe;
+        namespace MGB = MobileGL::MG_Backend::DirectGLES;
+
+        // The frontend texture object a GL name denotes in the CURRENT context, or null. This is
+        // a LOOKUP KEY and nothing else: every value this file reports comes from the applier or
+        // from Espryt, never from the object found here. (Reading the frontend's own parameter
+        // state would answer the question the scenario is asking with the input to it.)
+        MobileGL::MG_State::GLState::ITextureObject* FrontendTexture(unsigned glTextureName) {
+            if (!MobileGL::MG_State::pGLContext) return nullptr;
+            const auto& object = MobileGL::MG_State::pGLContext->GetTextureObject(
+                static_cast<MobileGL::Uint>(glTextureName));
+            return object ? object.get() : nullptr;
+        }
+
+        // Espryt's twin for that texture, or null - which is also this file's "is Espryt even the
+        // backend running" answer. On Magma no Espryt twin was ever built, so every entry point
+        // below stops here rather than reaching for g_GLESFuncs, whose members are null there.
+        MGB::TextureImpl::BackendTextureObject* EsprytTwin(unsigned glTextureName) {
+            MobileGL::MG_State::GLState::ITextureObject* const object = FrontendTexture(glTextureName);
+            if (object == nullptr) return nullptr;
+            auto* const found = MGB::TextureImpl::g_backendTextureObjects.Find(object);
+            if (found == nullptr || !*found) return nullptr;
+            return found->get();
+        }
+
+        int SwizzleToGLEnum(MobileGL::Uint8 encoded) {
+            return static_cast<int>(MobileGL::MG_Util::ConvertTextureSwizzleParamToGLEnum(
+                static_cast<MobileGL::TextureSwizzleParam>(encoded)));
+        }
+
+        // MGPipeTypes.h owns the two numbers and says why depth is 0 (a zeroed record must decode
+        // to what an untouched texture already has). This is that decode, and nothing else in
+        // this module may open-code it.
+        int DepthStencilModeToGLEnum(MobileGL::Uint8 encoded) {
+            return encoded == MGP::kMGPipeDepthStencilModeStencil ? GL_STENCIL_INDEX
+                                                                  : GL_DEPTH_COMPONENT;
+        }
+
+        // The GL_TEXTURE_BINDING_* query for a target, or 0 where this file has no answer. A
+        // guess would be worse than a refusal: the binding is what gets RESTORED, so a wrong
+        // pname would leave the driver bound to this test's texture.
+        int BindingQueryFor(unsigned glTarget) {
+            switch (glTarget) {
+                case GL_TEXTURE_2D: return GL_TEXTURE_BINDING_2D;
+                default: return 0;
+            }
+        }
+    } // namespace
+
+    bool PeekPipeTextureParamsRecord(unsigned glTextureName, PipeTextureParamsRecordPeek* out) {
+        if (out == nullptr) return false;
+        const MGP::MGPipeApplierState& applier = MGP::MGPipeApplier();
+        // Slot 0 is the reserved null handle and is never live (MGPipeHandles.h), so the scan
+        // starts at 1 and a match at 0 is impossible rather than merely unlikely.
+        for (MobileGL::SizeT slot = 1; slot < applier.TextureResources.size(); ++slot) {
+            const MGP::MGPipeResourceRecord& record = applier.TextureResources[slot];
+            if (!record.Live) continue;
+            if (record.Desc.GlNameForDiag != static_cast<MobileGL::Uint32>(glTextureName)) continue;
+            out->Slot = static_cast<unsigned>(slot);
+            out->Gen = static_cast<unsigned>(record.Gen);
+            out->ParamsSerial = static_cast<unsigned long long>(record.ParamsSerial);
+            for (int channel = 0; channel < 4; ++channel) {
+                out->Swizzle[channel] = SwizzleToGLEnum(record.Params.Swizzle[channel]);
+            }
+            out->DepthStencilMode = DepthStencilModeToGLEnum(record.Params.DepthStencilMode);
+            return true;
+        }
+        return false;
+    }
+
+    bool PeekEsprytAppliedTextureParams(unsigned glTextureName, unsigned glTarget,
+                                        EsprytAppliedTextureParamsPeek* out) {
+        if (out == nullptr) return false;
+        const int bindingQuery = BindingQueryFor(glTarget);
+        if (bindingQuery == 0) return false;
+        MGB::TextureImpl::BackendTextureObject* const twin = EsprytTwin(glTextureName);
+        if (twin == nullptr) return false;
+        const MobileGL::Uint backendId = twin->GetBackendTextureId();
+        if (backendId == 0) return false;
+        if (MGB::g_GLESFuncs.glGetTexParameteriv == nullptr ||
+            MGB::g_GLESFuncs.glBindTexture == nullptr || MGB::g_GLESFuncs.glGetIntegerv == nullptr ||
+            MGB::g_GLESFuncs.glGetError == nullptr) {
+            return false;
+        }
+
+        // SAVE / QUERY / RESTORE ON THE UNIT THAT IS ALREADY ACTIVE. No glActiveTexture, so the
+        // only driver state this touches is one unit's binding, and it is put back byte for byte
+        // - which is what keeps Espryt's own g_boundTexturesCache true rather than merely
+        // consistent. (Binding through the twin's own Bind() would update that shadow and would
+        // therefore CHANGE what the scenario measures next; this does not.)
+        GLint previousBinding = 0;
+        MGB::g_GLESFuncs.glGetIntegerv(static_cast<GLenum>(bindingQuery), &previousBinding);
+        MGB::g_GLESFuncs.glBindTexture(static_cast<GLenum>(glTarget), backendId);
+
+        out->BackendTextureId = static_cast<unsigned>(backendId);
+        static const GLenum kSwizzlePnames[4] = {GL_TEXTURE_SWIZZLE_R, GL_TEXTURE_SWIZZLE_G,
+                                                 GL_TEXTURE_SWIZZLE_B, GL_TEXTURE_SWIZZLE_A};
+        for (int channel = 0; channel < 4; ++channel) {
+            GLint value = 0;
+            MGB::g_GLESFuncs.glGetTexParameteriv(static_cast<GLenum>(glTarget),
+                                                 kSwizzlePnames[channel], &value);
+            out->Swizzle[channel] = static_cast<int>(value);
+        }
+
+        // The depth/stencil aspect mode is ES 3.1 and is INVALID_ENUM on a driver without it, so
+        // it is asked for last and its own error decides whether the answer is usable. The queue
+        // is drained first because a stale error from anywhere else would be indistinguishable
+        // from this call's - Espryt drains it the same way at every one of its own sync sites
+        // (DebugImpl::ErrorLopper), and this module's own GL errors are read from the FRONTEND
+        // state (ScenarioTest::FirstGLError), which none of this touches.
+        while (MGB::g_GLESFuncs.glGetError() != GL_NO_ERROR) {
+        }
+        GLint mode = 0;
+        MGB::g_GLESFuncs.glGetTexParameteriv(static_cast<GLenum>(glTarget),
+                                             GL_DEPTH_STENCIL_TEXTURE_MODE, &mode);
+        out->DepthStencilModeIsReadable = MGB::g_GLESFuncs.glGetError() == GL_NO_ERROR;
+        out->DepthStencilMode = static_cast<int>(mode);
+
+        MGB::g_GLESFuncs.glBindTexture(static_cast<GLenum>(glTarget),
+                                       static_cast<GLuint>(previousBinding));
+        while (MGB::g_GLESFuncs.glGetError() != GL_NO_ERROR) {
+        }
+        return true;
+    }
+
+    bool PeekEsprytHasSamplerViewForTexture(unsigned glTextureName, bool* outExists) {
+        if (outExists == nullptr) return false;
+        MobileGL::MG_State::GLState::ITextureObject* const object = FrontendTexture(glTextureName);
+        if (object == nullptr) return false;
+        // Espryt must be the backend running, or "no view" would be true of every texture on
+        // every other backend and the assertion would be vacuous where it is loudest.
+        if (EsprytTwin(glTextureName) == nullptr) return false;
+        // HandleOfSamplerViewForTexture is the monolith glue that derives the view's handle from
+        // the TEXTURE's lifetime id (D-F2: one view per ITextureObject), so this asks Espryt's
+        // own table the same way Espryt asks it - it does not consult the applier record's
+        // ViewCso, which is the client's statement about the same fact and would make one side
+        // of the seam vouch for the other.
+        const MGP::MGPipeHandle view = MGB::SamplerViewImpl::HandleOfSamplerViewForTexture(object);
+        if (MGP::MGPipeHandleIsNull(view)) {
+            *outExists = false;
+            return true;
+        }
+        *outExists = MGB::SamplerViewImpl::FindSamplerViewForHandle(view) != nullptr;
+        return true;
+    }
+
+    bool PeekPipeApplierRefusedNoConsumer(unsigned long long* outCount) {
+        if (outCount == nullptr) return false;
+        *outCount = static_cast<unsigned long long>(MGP::MGPipeApplier().RefusedNoConsumer);
+        return true;
+    }
+#else
+    bool PeekPipeTextureParamsRecord(unsigned, PipeTextureParamsRecordPeek*) { return false; }
+    bool PeekEsprytAppliedTextureParams(unsigned, unsigned, EsprytAppliedTextureParamsPeek*) {
+        return false;
+    }
+    bool PeekEsprytHasSamplerViewForTexture(unsigned, bool*) { return false; }
+    bool PeekPipeApplierRefusedNoConsumer(unsigned long long*) { return false; }
+#endif
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PipeApplyPeek.h

@@ -0,0 +1,110 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/PipeApplyPeek.h
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// The APPLIER's texture-parameter record, ESPRYT's applied value for the same texture, and
+// whether that texture has a sampler view yet. Three readings taken from a scenario, for gate
+// G9's WHITE-BOX half.
+//
+// WHY A WHITE-BOX HALF EXISTS AT ALL (ID-19, brief section F, gates review R1). G9's public-GL
+// cases in TextureParamsWithoutASamplerViewScenario.cpp catch "the parameter never reached the
+// driver". They CANNOT catch "the parameter reached the driver LATE", because a texture
+// parameter's only public-GL observable is a SAMPLE and the sample is itself what repairs an
+// unsynced parameter: it puts the texture on the unit list, and that walk pushes the parameters
+// for anything whose params serial moved. A backend that deferred every attachment-only
+// texture's parameters to the first sampler view would be green on all four of those cases,
+// forever, on every tree. The distinction only exists on the inside, so the reading has to be
+// taken there - while the texture is still attachment-only, before any sample.
+//
+// A SEPARATE TRANSLATION UNIT for PipeSlotPeek.h's reason, verbatim: the scenario sources
+// include the GL headers with prototypes and MobileGL's umbrella header is not meant to meet
+// them in one file. This one goes further than PipeSlotPeek and includes Espryt's own
+// Managers.h, which is exactly why it may not be anywhere near a scenario's GL headers.
+//
+// EVERY ENTRY POINT RETURNS false, TOUCHING NOTHING, WHERE IT CANNOT LOOK, and a caller that
+// gets false has learned NOTHING - "could not look" is not "was applied". Out of reach means:
+// a PULL build (there is no applier: it is `#if MOBILEGL_PIPE_PUSH`); Android, where this module
+// links the shipping libMobileGL.so built -fvisibility=hidden and no internal symbol resolves;
+// a backend that is not DirectGLES (Espryt is the subject; Magma answers the same GL question
+// through P7's own paths); and, for the record peek, a mask whose texture-resource bit is off,
+// where no record exists to find because nothing was ever emitted.
+
+#pragma once
+
+namespace MGITest {
+
+    // ---- the applier's set_texture_params record for one GL texture name ------------------
+    //
+    // ADDRESSED BY GL NAME, and the search key is MGPResourceDesc::GlNameForDiag. That field is
+    // diagnostics-only by contract - never an identity, never a memo key (MGPipeTypes.h) - and
+    // this is a diagnostic: a test harness looking for the record a named GL object produced.
+    // The alternative would be to ask the CLIENT emitter for the texture's handle, and the
+    // review is explicit that this probe must arm on package D's applier/backend state and not
+    // on the emitter markers B and C set: they are different questions, and a shared marker
+    // would re-create the shape review F-M5 was raised about.
+    struct PipeTextureParamsRecordPeek {
+        // The handle the record sits at, so a caller can print it.
+        unsigned Slot;
+        unsigned Gen;
+        // set_texture_params' own serial. 0 means the record exists (the resource was created)
+        // but NO set_texture_params has ever been applied to it - which is a different finding
+        // from "no record", and the two must not be merged.
+        unsigned long long ParamsSerial;
+        // MGPTextureParams::Swizzle[4], translated to the GL enums the application passed to
+        // glTextureParameteri (GL_ZERO / GL_ONE / GL_RED / GL_GREEN / GL_BLUE / GL_ALPHA), so
+        // the scenario compares what it set against what the record carries in ONE vocabulary
+        // and neither side has to know the other's encoding.
+        int Swizzle[4];
+        // MGPTextureParams::DepthStencilMode, translated the same way: GL_DEPTH_COMPONENT or
+        // GL_STENCIL_INDEX.
+        int DepthStencilMode;
+    };
+
+    bool PeekPipeTextureParamsRecord(unsigned glTextureName, PipeTextureParamsRecordPeek* out);
+
+    // ---- Espryt's APPLIED value for the same texture --------------------------------------
+    //
+    // Read from the DRIVER, through the twin's own ES name, because "applied" means the driver
+    // was told - the same thing package D's white-box unit probe asserts against its mocked
+    // driver (esprytobj-v2 (9)). The current binding on the ACTIVE unit is saved and restored
+    // around the query and no unit is switched, so Espryt's binding shadow still describes
+    // reality afterwards: nothing is perturbed for it to be stale about.
+    //
+    // `glTarget` is the texture's GL target (only GL_TEXTURE_2D is supported today; any other
+    // target returns false rather than guessing a binding query).
+    struct EsprytAppliedTextureParamsPeek {
+        // The driver name Espryt minted for this texture, for the caller's message.
+        unsigned BackendTextureId;
+        int Swizzle[4];
+        int DepthStencilMode;
+        // False when the driver rejected the depth/stencil query - a non-depth texture, or an ES
+        // level without GL_DEPTH_STENCIL_TEXTURE_MODE. The swizzle half is still valid.
+        bool DepthStencilModeIsReadable;
+    };
+
+    bool PeekEsprytAppliedTextureParams(unsigned glTextureName, unsigned glTarget,
+                                        EsprytAppliedTextureParamsPeek* out);
+
+    // ---- and the claim that makes the two above mean anything ------------------------------
+    //
+    // Whether Espryt holds a SAMPLER VIEW twin for this texture. This is the assertion the
+    // public-GL cases cannot make, because making it there would create the view. `*outExists`
+    // is written only on true.
+    bool PeekEsprytHasSamplerViewForTexture(unsigned glTextureName, bool* outExists);
+
+    // ---- c0f's belt, for the ObjectSubsystemControl arms -----------------------------------
+    //
+    // MGPipeApplierState::RefusedNoConsumer: the number of P4a-family entry points that were
+    // refused because no backend had registered MGPipeResourceOps. On a backend WITH a consumer
+    // it must never move; on one without (Magma, ID-39/ID-40) the client's own gate is supposed
+    // to stop the emission before the belt is reached, so it must never move there either. A
+    // non-zero delta says the gate and the belt disagreed, which is the whole point of having
+    // both. Reset by MGPipeApplierReset, so a caller reads it as a DELTA and treats a value that
+    // went DOWN as "the applier was reset, count everything since as `after`".
+    bool PeekPipeApplierRefusedNoConsumer(unsigned long long* outCount);
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PipeSlotPeek.cpp

@@ -0,0 +1,82 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/PipeSlotPeek.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "PipeSlotPeek.h"
+
+#if !defined(__ANDROID__)
+#include <MG_Pipe/MGPipe.h>
+#if MOBILEGL_PIPE_PUSH
+#include <MG_Impl/Pipe/SlotAllocator.h>
+#define MGITEST_PIPE_SLOT_PEEK_LIVE 1
+#endif
+#endif
+
+namespace MGITest {
+
+#if defined(MGITEST_PIPE_SLOT_PEEK_LIVE)
+    namespace {
+        // One arm per member, and NO `default:` on purpose: adding a PipeSlotKind without
+        // deciding which MGPipeKind it names is a compiler warning here (-Wswitch) rather than
+        // a row that silently counts VertexElementsCso and reports "did not leak" about a kind
+        // it never looked at. The trailing return is the unreachable one the compiler needs.
+        MobileGL::MG_Pipe::MGPipeKind Translate(PipeSlotKind kind) {
+            switch (kind) {
+                case PipeSlotKind::Buffer: return MobileGL::MG_Pipe::MGPipeKind::Buffer;
+                case PipeSlotKind::VertexElementsCso:
+                    return MobileGL::MG_Pipe::MGPipeKind::VertexElementsCso;
+                case PipeSlotKind::Texture: return MobileGL::MG_Pipe::MGPipeKind::Texture;
+                case PipeSlotKind::Renderbuffer: return MobileGL::MG_Pipe::MGPipeKind::Renderbuffer;
+                case PipeSlotKind::Framebuffer: return MobileGL::MG_Pipe::MGPipeKind::Framebuffer;
+                case PipeSlotKind::SamplerCso: return MobileGL::MG_Pipe::MGPipeKind::SamplerCso;
+                case PipeSlotKind::SamplerViewCso:
+                    return MobileGL::MG_Pipe::MGPipeKind::SamplerViewCso;
+                case PipeSlotKind::ShaderCso: return MobileGL::MG_Pipe::MGPipeKind::ShaderCso;
+            }
+            return MobileGL::MG_Pipe::MGPipeKind::None;
+        }
+    } // namespace
+
+    bool PeekPipeSlotLiveCount(PipeSlotKind kind, unsigned* outLive) {
+        if (outLive == nullptr) return false;
+        *outLive = static_cast<unsigned>(MobileGL::MG_Pipe::MGPipeSlots().LiveCount(Translate(kind)));
+        return true;
+    }
+
+    bool PeekPipeSlotHighWater(PipeSlotKind kind, unsigned* outHighWater) {
+        if (outHighWater == nullptr) return false;
+        // The ORDINARY space only, for every kind including ShaderCso (contract-v2.md 4.3).
+        *outHighWater = static_cast<unsigned>(MobileGL::MG_Pipe::MGPipeSlots().HighWater(Translate(kind)));
+        return true;
+    }
+
+    bool PeekPipeCompositeSlotLiveCount(unsigned* outLive) {
+        if (outLive == nullptr) return false;
+        *outLive = static_cast<unsigned>(MobileGL::MG_Pipe::MGPipeSlots().CompositeLiveCount());
+        return true;
+    }
+
+    bool PeekPipeCompositeSlotHighWater(unsigned* outHighWater) {
+        if (outHighWater == nullptr) return false;
+        *outHighWater = static_cast<unsigned>(MobileGL::MG_Pipe::MGPipeSlots().CompositeHighWater());
+        return true;
+    }
+
+    bool PeekPipeCompositeSlotBandBase(unsigned* outBandBase) {
+        if (outBandBase == nullptr) return false;
+        *outBandBase = static_cast<unsigned>(MobileGL::MG_Pipe::kMGPipeShaderCsoCompositeSlotBase);
+        return true;
+    }
+#else
+    bool PeekPipeSlotLiveCount(PipeSlotKind, unsigned*) { return false; }
+    bool PeekPipeSlotHighWater(PipeSlotKind, unsigned*) { return false; }
+    bool PeekPipeCompositeSlotLiveCount(unsigned*) { return false; }
+    bool PeekPipeCompositeSlotHighWater(unsigned*) { return false; }
+    bool PeekPipeCompositeSlotBandBase(unsigned*) { return false; }
+#endif
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Harness/PipeSlotPeek.h

@@ -0,0 +1,101 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Harness/PipeSlotPeek.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// The CLIENT slot allocator's occupancy, read from a scenario.
+//
+// It exists for one assertion, P3a's C-1: a frontend object that dies must return its
+// MGPipeHandle slot WHATEVER BACKEND IS RUNNING. That question has no answer in the GL API -
+// the leak it rules out is entirely inside the library, and it is invisible in pixels, in GL
+// names and in `glGetError` - so the only honest observable is the allocator's own live count
+// and high-water mark. Reading them is what makes the case fail on the backend it actually
+// failed on (DirectVulkan, which installs no StateObjectDeathOps) rather than only on the one
+// where a backend-owned free happened to exist.
+//
+// A separate translation unit for BackendCapsPeek.h's reason, verbatim: the scenario sources
+// include the GL headers with prototypes and MobileGL's umbrella header is not meant to meet
+// them in one file.
+
+#pragma once
+
+namespace MGITest {
+
+    // Which client-side object kind to ask about. Mirrors MG_Pipe::MGPipeKind for exactly the
+    // kinds a scenario has a reason to count, so that the enum does not travel through this
+    // header and the GL headers together.
+    enum class PipeSlotKind {
+        Buffer,
+        VertexElementsCso,
+        // P4a's six (G8b). Every one of them is a kind the CLIENT mints and the client alone
+        // frees (BRIEF-P4A.md D-I1: one death helper per kind, called from the frontend
+        // object's own destructor, whatever backend is running), so every one of them can leak
+        // the P3a C-1 way - and the leak is invisible in pixels, in GL names and in
+        // glGetError, exactly as the VertexElementsCso one was.
+        Texture,
+        Renderbuffer,
+        // Framebuffer has a HANDLE but no wire lifetime (D-I2): no create_*, no destroy row in
+        // the catalogue, and its death helper does the notice and the free and emits nothing.
+        // That makes the allocator the ONLY observable of its lifetime, so this row matters
+        // more here than the others rather than less.
+        Framebuffer,
+        SamplerCso,
+        SamplerViewCso,
+        // ShaderCso covers BOTH the ordinary program slots and the program-pipeline COMPOSITES
+        // minted out of the reserved high band (MGPipeHandles.h:86-107, D-H7). One kind, because
+        // that is what the allocator has: the band is a second dense table inside the same kind
+        // and LiveCount counts both.
+        //
+        // THE TWO SPACES' HIGH-WATER MARKS ARE NOT ONE NUMBER, and the correction matters here
+        // more than anywhere else. c0b split them (contract-v2.md 4.3): HighWater(ShaderCso) is
+        // now the ORDINARY space only and the band's own mark is CompositeHighWater(), because
+        // a merged mark is pinned at ~983k from the first composite mint onward and every "the
+        // high-water mark did not move over N churn rounds" assertion about ordinary programs
+        // would be vacuously true for the rest of the process. The composite's leak case is a
+        // separate CASE and reads the BAND'S OWN counters below (PeekPipeCompositeSlot*) - a
+        // composite's slot has TWO independent release paths (the pipeline cache's LRU eviction
+        // and the composite ProgramObject's destructor), and a slot that never comes back to
+        // the band moves neither of the ordinary numbers.
+        ShaderCso,
+    };
+
+    // Live slots of this kind right now, and one past the highest slot ever handed out.
+    // Both return false, touching nothing, where the allocator is out of reach: in a PULL
+    // build there is no allocator at all (it is `#if MOBILEGL_PIPE_PUSH`), and on Android this
+    // module links the shipping libMobileGL.so built -fvisibility=hidden, so no internal symbol
+    // resolves. A caller that gets false must SKIP rather than pass - "could not look" is not
+    // "did not leak".
+    bool PeekPipeSlotLiveCount(PipeSlotKind kind, unsigned* outLive);
+    bool PeekPipeSlotHighWater(PipeSlotKind kind, unsigned* outHighWater);
+
+    // The ShaderCso COMPOSITE BAND's own three numbers, the seventh..ninth members
+    // contract-v2.md 4.3 asks this header for. There is no `kind` argument because the band is
+    // ShaderCso's alone - AllocateComposite is the one door into it and no other kind has one.
+    // All three return false on the same terms as the two above, and a caller that gets false
+    // must SKIP.
+    //
+    //   PeekPipeCompositeSlotLiveCount   = MGPipeSlotAllocator::CompositeLiveCount(), the band's
+    //                                      share of LiveCount(ShaderCso).
+    //   PeekPipeCompositeSlotHighWater   = CompositeHighWater() VERBATIM, i.e. one past the
+    //                                      highest band slot ever handed out. It is an ABSOLUTE
+    //                                      slot number and therefore starts at the band's base,
+    //                                      not at zero - "no composite was ever minted" reads as
+    //                                      `high water == band base`, which is what the third
+    //                                      member is for. It is not returned base-relative
+    //                                      because a peek whose name says HighWater and whose
+    //                                      value is a delta is exactly the kind of quietly
+    //                                      redefined counter this member exists to correct.
+    //   PeekPipeCompositeSlotBandBase    = kMGPipeShaderCsoCompositeSlotBase, the floor the
+    //                                      other two are read against. A constant, but it
+    //                                      reaches a scenario only through this header: the
+    //                                      MG_Pipe headers and the GL headers are not meant to
+    //                                      meet in one translation unit, which is why this
+    //                                      harness exists at all.
+    bool PeekPipeCompositeSlotLiveCount(unsigned* outLive);
+    bool PeekPipeCompositeSlotHighWater(unsigned* outHighWater);
+    bool PeekPipeCompositeSlotBandBase(unsigned* outBandBase);
+
+} // namespace MGITest