swung0x48
aba329cc53
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.
1. P6's plan and contract draft (neither started; not one line of code)
docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)
The three findings that mattered, all written into the documents:
a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".
b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.
c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".
The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.
What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.
Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.
2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)
ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.
Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.
Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.
CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).
3. Inconsistencies fixed in passing
- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.
Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
6.3 KiB
P1 verify-lane findings on the integrated tree (feat/disaggregated @ 97b997d5, WSL ~/w7/pipe)
All four P1 packages are merged. The pull build is clean: symbol_report --threshold 0 reports 0 added / 0 removed / 0 resized / 0 renamed, grep -rc pGLContext MobileGL/MG_Backend is empty everywhere, ctest -L unit 1482/1482, ctest -L integration-gpu 878 with one known -j flake that reruns green, ctest -N names 0 removed / 26 added, gen_pipe.py --check and --self-test clean.
The push and verify builds are not clean. Three distinct problems, in the order they must be fixed.
F1 — missing fill rows (mechanical, MobileGL/MG_Pipe/FillPoints.def)
The 79-case retrace under MOBILEGL_PIPE_VERIFY=1 (~/w7/retrace-out/p1-verify/) aborts four cases with:
Fatal{UnmigratedPipeInput, "IsCapabilityEnabled@GenerateMipmap"} x3 cases
Fatal{UnmigratedPipeInput, "IsCapabilityEnabled@DispatchCompute"} x1 case
IsCapabilityEnabled is listed for kDraw, kClear, kBlitOrCopy and kReadback but not for kTextureOp (which owns GenerateMipmap) or kDispatch. Adding a row is the whole fix, but do not stop at these two: audit every class against the verb paths in scratchpad/wf4/scout-pull-sites.md §3b and add every row the lane can still miss, then prove it by re-running the lane and the retrace (they are the only real oracle).
One row of the same kind was already fixed at 9087f133 (kReadback was missing IsTransformFeedbackActive / IsTransformFeedbackPaused, which the depth/stencil read emulation reads through ScopedEmulationDrawState, DirectGLES.cpp:5224).
F2 — the backend mutates frontend state inside a verb, so the pushed block goes stale mid-verb
Two retrace cases and eight integration-verify entries abort with:
Fatal{PipeVerifyDiffer, "GetSamplingResolutionGeneration@DrawArrays", verb=3, where=read}
Fatal{PipeVerifyDiffer, "GetSamplingResolutionGeneration@DrawElements", ..., where=read}
The failing entries are DirectVulkan.Verify.UnboundImageDescriptorScenario.* (6) and DirectVulkan.Verify.SampledSetStalenessScenario.* (2); the log line immediately before the divergence is ResolveSamplerDescriptor: using fallback texture for unbound sampler ....
Mechanism, verified in the tree: GetSamplingResolutionGeneration counts frontend mutations. It is bumped from exactly two places, both frontend objects: SamplerObject::BumpVersion() (MG_State/GLState/SamplerState/SamplerObject.cpp:34) and TextureObjectBase::BumpShapeVersion() (MG_State/GLState/TextureState/TextureObject.cpp:37). During a draw, Magma's own paths (fallback-texture resolution for an unbound sampler, materialising a queued clear) write into frontend texture/sampler objects, so the counter moves between the verb's fill and the backend's read. This is the known "backend writes into frontend objects" surface (about 40 call sites; see scout-pull-sites.md §2).
This is a real finding, not a harness artefact, and it must not be silenced. Decide and implement one of:
- (preferred) push on mutation. The frontend mutator that changes a pushed value refreshes that field in the pushed block (and restamps it for the current verb) when
MOBILEGL_PIPE_PUSHis on. This keeps the comparator's invariant ("the pushed block equals the live context at every read") literally true, and it is the shape P2's tracker needs anyway. Layering is fine:MG_Statealready includesMG_Pipe/MGPipeValueTypes.h. - (fallback) an explicit volatile-in-verb class. The field is compared at verb entry only, the compare-at-read is skipped for it, the reason is written next to the field list, and the exact backend call sites that mutate it are listed in
docs/Disaggregated/MEASUREMENTS.mdas P2/P7 work.
Whichever you choose: enumerate every PipeInputs field a backend can invalidate through its own frontend writes (do not assume this one field is the only one; the lane found it because the fixture happened to hit it), handle them all the same way, add a unit test that reproduces the mid-verb mutation and would fail without the fix, and write the enumeration into the result file.
F3 — unit tests that drive backend helpers with no verb
Eleven ctest -L unit entries fail in the push and verify builds and pass in the pull build:
DirectGLESSanity.BindsAMultisampleTextureDespiteTheDefaultMipmapFilter
DirectGLESSanity.BindingZeroClearsPreviousNativeTextureBinding
FramebufferTest.{DrawIntoAWidenedDrawBufferReachesTheDriverWithAlphaWritesMaskedOff,
ClearIntoAWidenedDrawBufferKeepsAlphaWritableAndSubstitutesOne,
ApplicationAlphaMaskOffIsStillHonouredOnANativeDrawBuffer,
DualSourceBlendFactorsReachTheDriverWhenTheExtensionIsThere,
DualSourceBlendIsDeclinedRatherThanThrownWhenTheExtensionIsMissing,
DualSourceFactorsAreDeclinedEvenWithBlendingDisabled,
DualSourceFactorsWithBlendingDisabledStillReachACapableDriver}
DirectGLESTextureSync.* (1)
TextureTest.* (1)
These construct a GLContext by hand and call a backend helper directly (for example DirectGLES::BindCurrentTextures() at MG_Test/SanityTest.cpp:366), so no GL entry point runs and no MGP_FILL ever fires; the first accessor read hits the poison. The tests are right and the poison is right: what is missing is that a test which drives a backend helper directly must state which verb it is standing in.
Fix in the test layer only (MobileGL/MG_Test/**): give those tests a small, explicit helper that fills the block for the verb class the helper under test belongs to (a scoped RAII "as if we were inside verb X" object is the natural shape), so the test declares the verb rather than the poison being weakened. Do not add a global escape hatch, do not make the poison tolerant in unit builds, and do not change any test name. The pull build must stay byte-identical.
F4 — corrections to the integrator's own commands (not code)
- The lane-level poison control is not
-R 'Mipmap': the four dedicated control entries areDirectGLES|DirectVulkan.VerifyCorrupted.PipeVerifyArmingScenario.CorruptedFieldIsReportedand...PoisonOmitted.PoisonOmissionScenario.OmittedFieldAbortsOnThatVerb(all four pass). - The retrace arming line is
MGPipe verify: <case> <backend> armed, zero divergences, zero unmigrated readsin the case log, notMGPipe: verify armed; 73 of 79 cases carry it, the other 6 are the F1/F2 aborts.