mirror of
https://github.com/MobileGL-Dev/MobileGL
synced 2026-11-07 18:13:23 +09:00
swung0x48
aba329cc53
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.
1. P6's plan and contract draft (neither started; not one line of code)
docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)
The three findings that mattered, all written into the documents:
a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".
b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.
c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".
The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.
What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.
Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.
2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)
ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.
Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.
Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.
CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).
3. Inconsistencies fixed in passing
- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.
Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
60 lines
4.6 KiB
Markdown
60 lines
4.6 KiB
Markdown
# Package id — identity: handle-keyed twins, the guard, the scopes (P5e; lands second)
|
|
|
|
Read in this order, all of it: `PACKAGE-PREAMBLE-P5E.md`, `INTEGRATOR-DECISIONS-P5E.md` (ID-90 and
|
|
ID-96 are yours), `BRIEF-P5E.md` (§0, §1, §2 "id", §6 rulings 1, 4, 12, 13), `CONTRACT-P5E-draft.md`
|
|
§4 (all of it) and §9, your scout report `scout-S7.md` (all of it), and the rows of `kimi-audit.md`
|
|
lists (a) and (b) (the scope construction sites and the frontend pointers held across records).
|
|
All in `//wsl.localhost/Arch/home/swung/w7/notes/p5e/`. Your slug is `id`; your tree is `~/w7/p5e-id`
|
|
(built, on branch `p5e/id` at `2fde7034`).
|
|
|
|
Package c0e is being implemented IN PARALLEL on `p5e/c0e` by another agent; it declares
|
|
`MGPipeApplierCurrentRecordIsBarriered()` and `MGPipeBarriered(...)` in `MG_Pipe/PipeApply.h`. You do
|
|
not wait for it: declare exactly those two names yourself in the same header with the contract's
|
|
signatures (a minimal body: barriered = true for every record until ra lands - lockstep is unchanged
|
|
by your package), and note in the report that c0e owns the final declaration; the integrator resolves
|
|
the textual overlap at landing (one hunk).
|
|
|
|
## Deliverables (lockstep behaviour unchanged; the registries stop being frontend-keyed on the server)
|
|
|
|
1. `MG_Backend/DirectGLES/SlotTables.h`: the composite band `m_band`; `ForEachLive` re-typed as
|
|
`fn(MGPipeHandle, const BackendPtr&)`; the frontend-keyed members (`HandleOf(stateObj)`,
|
|
`Find(StateObject*)`, `GetOrCreate(const StatePtr&)`, `stateRef`, `NoteStateForHandle`, the mutable
|
|
memo) kept ONLY as monolith glue, each asserting `!MGPipeApplierIsUnbarrieredApply()` in split
|
|
builds (a named Fatal, not a silent path).
|
|
2. `Managers.h:309-640` and the resolvers: `ResolveVaoTwin(MGPipeHandle)`, `ResolveProgramTwin(MGPipeHandle)`,
|
|
`ResolveTextureTwin(MGPipeHandle)` in the shape of `SamplerImpl::ResolveSamplerCsoTwin`
|
|
(`Managers.cpp:13457-13486` at base): handle in, record first, `GetOrCreate(handle)`, no frontend
|
|
touch, no allocator probe; `AdoptTwinByHandle` as the shared body. The family packages will call
|
|
these; if c0e's seam declarations differ in spelling, yours win for these three (tell the report).
|
|
3. `Managers.cpp:188-372`: teardown; `OnFrontendStateObjectDestroyed` — delete the NoSession mailbox
|
|
hop (`:224-246`) and the scope at `:256`; `ReleaseTwinsForWireObjectDeath` by handle; the twin
|
|
death moment per CONTRACT-P5E §4.2, the ABA answer §4.3 (a recycled slot with a new gen re-mints;
|
|
an old-gen handle is refused by `FindByHandle`'s gen compare — pin it).
|
|
4. `MG_Impl/Pipe/SlotAllocator.{h,cpp}`: the guard `MGPipeRefuseAllocatorFromApplyThread` exempts
|
|
only "inside a scope AND the current record is barriered" (contract §4.4); `MGPipeFrontendKeyedRegistryScope`
|
|
stays as a class (the family packages delete their 20 sites); `MGPipeReverseAnnouncementScope` →
|
|
`MagmaP7AllocatorDebtScope`, backend-kind-keyed (ruling 12), with the four Magma sites renamed
|
|
(`VulkanRenderer.cpp:4554, 4634, 8986`, `ResourceTracker.h:723` at base — re-resolve) and Espryt's
|
|
`HandleOfBuffer` site (`Managers.cpp:2933` at base) kept under the old scope name until vi/sb retire
|
|
it (say so in the report). P5d round 3 already made the scope counters plain (apply-thread-only
|
|
writers) — keep that shape.
|
|
5. `MG_Remote/Server/PipeApplier.cpp` `ApplyOne`: set `CurrentRecordBarriered` from `MGPipeBarriered`
|
|
(one line; ra rebases on it).
|
|
6. Tests: `MG_Test/SanityTest.cpp` cases the brief lists (moved to the legacy arm or rewritten by
|
|
handle; new `ACompositeHandleDoesNotGrowTheOrdinaryTable`); `MG_Test/Wire/RemoteClientTest.cpp`
|
|
(`...IsAllowed` deleted; new `...FromTheApplyThreadIsFatalEvenAtTheOldDebtSites` posting `HandleOf`
|
|
through `RunOnApplyThread` with the barriered flag forced false by a test hook). ID-96: enumerate
|
|
every NoSession server-only fixture that loses death delivery when the hop is deleted
|
|
(`grep RunOnApplyThread MG_Test/Wire`), rewrite them to drive `object_death` by handle through
|
|
the applier, delete only what cannot be expressed that way, and list each in the report.
|
|
|
|
## Red-once (execute, revert, record)
|
|
With the test hook forcing "unbarriered", `HandleOf` from the apply thread → `Fatal{RoleViolation, "MGPipeSlots"}`;
|
|
put the exemption back → the case is green → red by expectation. Skip the Gen reset in the ABA
|
|
case → red.
|
|
|
|
## Gate
|
|
`build`, `unit`, `isplit`, `gens`, `strict` — unit and isplit must be exactly base-green (2203 /
|
|
111 at base; new names only add). G2/G14: skip twins for split-only cases. Commit in slices
|
|
(tables; resolvers; death path; guard + scopes; tests). Report per the preamble.
|