mirror of
https://github.com/MobileGL-Dev/MobileGL
synced 2026-11-08 10:33:24 +09:00
swung0x48
aba329cc53
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.
1. P6's plan and contract draft (neither started; not one line of code)
docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)
The three findings that mattered, all written into the documents:
a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".
b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.
c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".
The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.
What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.
Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.
2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)
ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.
Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.
Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.
CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).
3. Inconsistencies fixed in passing
- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.
Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
71 lines
5.0 KiB
Markdown
71 lines
5.0 KiB
Markdown
# Package ra — the wait rule, present credit, server-owned `gPipeInputs` (P5e; parallel, lands last)
|
|
|
|
Read in this order, all of it: `PACKAGE-PREAMBLE-P5E.md`, `INTEGRATOR-DECISIONS-P5E.md` (ID-83,
|
|
ID-84, ID-91, ID-92, ID-93 are yours), `BRIEF-P5E.md` (§0, §1, §2 "ra", §3 the integration gate, §4
|
|
the device exit, §6 rulings 3, 4, 13, 14, 15, 17, 18), `CONTRACT-P5E.md` §2 and §3 (all of both),
|
|
your scout report `scout-S6.md` (all of it), and lists (b) and (c) of `kimi-audit.md`. Notes:
|
|
`//wsl.localhost/Arch/home/swung/w7/notes/p5e/`.
|
|
|
|
Your slug is `ra`; your tree is `~/w7/p5e-ra` (branch `p5e/ra`, based on the landed c0e head — NOT
|
|
on the family packages; you are parallel to them and rebase at landing). c0e landed the `WaitClass`
|
|
column, `MGPipeWaitClassFor(op)`, the `RunAhead` / `PresentCredit` knobs, `kCapRunAheadApply` (bit
|
|
10) and `kMGPipeP5eRunAheadReady = false`; id landed the `CurrentRecordBarriered` line in `ApplyOne`.
|
|
|
|
## What "done" means
|
|
|
|
The mechanism exists and is INERT until the integration commit: with `kMGPipeP5eRunAheadReady`
|
|
false the server never publishes bit 10, the client never arms run-ahead, and every gate is exactly
|
|
as green as today. Your last commit flips that constant — but only after the family packages have
|
|
landed and the integrator says so, so structure your branch that way (the flip is its own final
|
|
commit, trivially revertable).
|
|
|
|
1. **The predicate.** `MGPipeBarriered(op, payload, applierState)` (c0e declared it) computed
|
|
identically by both roles: the static `WaitClass` column, plus XFB-active from the context values
|
|
and the `kDrawClientArrays` flag (ruling 3 / ID-83). The server's `ApplyOne` already sets
|
|
`CurrentRecordBarriered` from it (id's line).
|
|
2. **The client wait rule.** `EmitAndWaitTails` after `PublishAndNotify`: reply rows wait; barriered
|
|
rows wait; unbarriered rows return. Present pacing through `WaitForPresentAck` with credit
|
|
(default 1, range 1..8; ID-92) — the plumbing exists end to end and has no production caller
|
|
today; `MGPPresent::FrameSerial` minted client-side; `OnPresent` returns the credit. Drains and
|
|
forced waits per contract §2.5 (MapBuffer / GetBufferSubData / glFinish / fence client-wait /
|
|
the EGL forwarders / the glGetError window — name the relaxation in the contract and in code).
|
|
3. **`resource_subdata`'s buffer half stops waiting** (ruling 15 / ID-93): the reply Bool is
|
|
discarded at the call site today, so every 64 KB persistent-map block push is a hidden round
|
|
trip. The row keeps its `kReplySlot` on the wire; the client neither waits nor reads. The texture
|
|
half keeps its reply (trailing).
|
|
4. **`gPipeInputs` becomes server-role memory for unbarriered records** (contract §3): the client's
|
|
residual fill and its stamp bookkeeping do not run for them (the tracker walk and the emitters
|
|
still run — they produce records); the stamp becomes server-private; `MGPipeInputUnfreshRead`
|
|
becomes an UNCONDITIONAL detector for unbarriered applies (a named Fatal, not a counter), which
|
|
is what turns the strict lane into a hard gate. Barriered records keep P5C's semantics exactly
|
|
(ID-84 / ruling 4).
|
|
5. **Event-ring flow control** (contract §2.6): the ring's overflow is a Fatal today on the premise
|
|
that the client drains at every verb — under run-ahead that premise is gone. Make the producer
|
|
block/flow-control instead, and keep a named refusal for the impossible case.
|
|
6. **Lifetime under run-ahead** (contract §2.7): slot reuse vs records in flight, `object_death`
|
|
ordering, the deferred-destroy queue (ID-91 / ruling 13: it stays; an unbarriered enqueue is a
|
|
finding — pin it), `Forget()` of a persistent map while its pushes are in SEG_STAGE.
|
|
7. **The strict lane** (`.github/workflows/test.yml`): rewritten as a hard green gate with the
|
|
contract §7 allowlist (`<field>@<verb>` for the barriered rows that keep pulling).
|
|
8. Docs: `docs/Disaggregated/ARCHITECTURE.md` §11, §14, §17 — the wait rule, the credit, the event
|
|
ring, `gPipeInputs` ownership.
|
|
|
|
## Red-once (execute, revert, quote)
|
|
|
|
1. Encode present without `WaitForPresentAck` → the credit-1 client behind a stalled apply thread
|
|
publishes a third present; `Waits()` unchanged → red by count.
|
|
2. Leave one `CopyField` in an unbarriered fill → `Fatal{RoleViolation, "gPipeInputs"}` by name.
|
|
3. Count instead of Fatal under an unbarriered record → the strict lane turns red on the first
|
|
pulled row (that is the gate's own red-once).
|
|
4. Keep the event-ring Fatal → a unit case publishing ~300 KiB of events behind an unwaited
|
|
sequence aborts; with flow control it completes.
|
|
5. Publish bit 10 for Magma → `MagmaPipeIdentityTest` red.
|
|
6. `MOBILEGL_IPC_RUN_AHEAD=0` renders identically; `MOBILEGL_IPC_VERB_BARRIER=0` under run-ahead is
|
|
the documented red.
|
|
|
|
## Gate (before the flip)
|
|
|
|
`build`, `unit`, `isplit`, `gens`, `strict` — all exactly as green as the base, because every branch
|
|
is inert with the bit unpublished. Your report must state, per numbered item above, what is wired
|
|
and what it does when the bit flips; the integrator runs the device exit.
|