mirror of
https://github.com/MobileGL-Dev/MobileGL
synced 2026-11-07 18:13:23 +09:00
swung0x48
aba329cc53
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.
1. P6's plan and contract draft (neither started; not one line of code)
docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)
The three findings that mattered, all written into the documents:
a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".
b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.
c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".
The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.
What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.
Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.
2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)
ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.
Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.
Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.
CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).
3. Inconsistencies fixed in passing
- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.
Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
75 lines
5.1 KiB
Markdown
75 lines
5.1 KiB
Markdown
# Package tx2 — textures and samplers by handle and window (P5e wave 2)
|
|
|
|
Read in this order, all of it: `PACKAGE-PREAMBLE-P5E.md`, `INTEGRATOR-DECISIONS-P5E.md` (ID-86,
|
|
ID-93, ID-95 are yours), `BRIEF-P5E.md` (§0, §1, §2 "tx2", §5, §6 rulings 6, 14, 19),
|
|
`CONTRACT-P5E.md` §5.2 and §5.3, your scout report `scout-S2.md` (all of it), and the texture /
|
|
sampler rows of `kimi-audit.md` (rows 35-67) — report per row: retired / left barriered / not found.
|
|
Notes: `//wsl.localhost/Arch/home/swung/w7/notes/p5e/`.
|
|
|
|
Your slug is `tx2`; your tree is `~/w7/p5e-tx2` (branch `p5e/tx2`, based on the landed id head,
|
|
built). id landed `ResolveTextureTwin(MGPipeHandle)`; c0e declared `SyncTextureToBackendByHandle`
|
|
and `SyncMipmapsToBackendByHandle` with asserting bodies — you write them, and fb calls them.
|
|
|
|
## What "done" means for this family
|
|
|
|
Your scout's headline: the SAMPLER half is already run-ahead clean on its record arm
|
|
(`BindCurrentUnitSamplers` + `ResolveSamplerCsoTwin`) — that is the shape you bring to the TEXTURE
|
|
half. After this package: the per-draw unit work list is built from `st.BoundSamplerViews[]`
|
|
(handles), not from borrowed pointers into the frontend texture units; `PairingsIntact` and
|
|
`IsDrawSyncClean(frontend)` are replaced by `IsDrawSyncCleanByRecord(handle, record)` reading the
|
|
twin's own serials; every `HandleOf(frontendTexture)` re-entry is `ResolveTextureTwin(handle)`;
|
|
`GetTarget` / `IsTextureView` / the texbuffer backing all come from the descriptor; `GenerateMipmap`
|
|
resolves `VerbMipRes` and can drop its wait (ruling 14 — flip the row's `WaitClass` to `kWaitNone`
|
|
only if your arm is complete, else leave it and list it as trailing); the identity sampler family
|
|
(the apply-thread mint for a unit not covered by `bind_sampler_states`) is deleted and becomes a
|
|
named refusal.
|
|
|
|
## Scope
|
|
|
|
`DirectGLES.cpp`: `SyncTextureToBackendByHandle` (new), the unit epoch/capture pair (monolith-only;
|
|
the decline arm becomes a refusal), `UnitTextureSyncEntry`'s re-shape (push-only) and the unit half
|
|
of `SyncNeccessaryTextures`, `ResolveAndBindUnitTextures`, `BindCurrentUnitSamplers`,
|
|
`BindCurrentTextures`' memo key (ruling 6: `SamplerViewsSerial` AND pg's program key — pg states
|
|
its half in its report), the sampler pass (the mint deleted), `GenerateMipmap` by `VerbMipRes`, the
|
|
mip-shape `HandleOf` sites; trailing and NOT yours now: the CopyTex endpoint and `GetTexImage`
|
|
(barriered, P8/P9). `Managers.cpp`: `RequireImageBindableStorage`'s entry refusal,
|
|
`SyncMipmapsToBackend(handle, record)`, the texture registry re-entries, the sampler identity family
|
|
under transport, `ResolveSamplerCsoTwin` (your model). `Managers.h`: `IsDrawSyncCleanByRecord` and
|
|
the twin's serial members. `MG_Backend/DirectGLES/MipmapStorage.cpp`: the guard accessor list widened.
|
|
`MG_Remote/Server/PipeApplier.cpp`: ONE function `CheckUnitWindows(st)` called from `OnDrawVbo` and
|
|
`OnLaunchGrid` (ruling 19 / ID-95). Tests: `MG_Test/Wire/RemoteClientTest.cpp`, `MG_Test/SanityTest.cpp`
|
|
(+ an ABA sibling), keep `SampledSetStalenessScenario` and `TextureParamsWithoutASamplerViewScenario`.
|
|
|
|
## Rulings that bind you
|
|
|
|
- ID-95 / ruling 19 (A8, blocking for your family): the `set_sampler_views` window MUST cover
|
|
`[0, MaxTouchedTextureUnit]`; the sink checks it at every draw/dispatch; narrower is
|
|
`Fatal{ProtocolCorruption, "SetSamplerViews.Count"}`. The emitter already emits
|
|
`Start=0/Count=maxTouched+1` — your job is to make the contract's promise checkable and checked.
|
|
- ID-86 / ruling 6: the memo key is both halves.
|
|
- Behaviour narrowing you must NAME in the report (G1 §): driving the work list off
|
|
`BoundSamplerViews` syncs only the program-resolved texture per unit, where today the walk syncs
|
|
every slot of every touched unit. Say what stops being synced and why that is correct (or refuse).
|
|
- Your scout's R4: the new clean gate reads both the wire's resync bits and the twin's own force
|
|
flags — make "neither side clears the other's" explicit in code and in the report.
|
|
- Your scout's R5 (S1 boundary): the buffer-texture arm still hands a frontend `BufferObject` to
|
|
`EnsureBufferResourceForHandle` for the emulated-persistent-map question — resolve it with
|
|
`Desc.BufferForTexBuffer` or state precisely why it must stay.
|
|
|
|
## Red-once (execute, revert, quote)
|
|
|
|
1. Revert any handle arm → the widened `MipmapStorage` / buffer-arm guard aborts by accessor name.
|
|
2. Revert the window arm of `ResolveAndBindUnitTextures` → `strict` names
|
|
`Fatal{UnmigratedPipeInput, "GetTextureUnitObject@DrawVbo"}`.
|
|
3. ABA: recycle a slot to `{s, g+1}` while the old entry is in the work list → the twin re-mints;
|
|
skip the Gen reset → red.
|
|
4. Narrow the emitter's `Count` by one → `Fatal{ProtocolCorruption, "SetSamplerViews.Count"}`.
|
|
5. `GenerateMipmap` with the row unwaited and the unit walk restored →
|
|
`Fatal{UnmigratedPipeInput, "GetActiveTextureUnit@..."}` (`F1WireScenario.GenerateMipmap*Pixels`).
|
|
|
|
## Gate
|
|
|
|
`build`, `unit`, `isplit`, `gens`; `strict` (record the markers that disappeared); `one` on the
|
|
texture/sampler scenarios you touch. If `PipeSlotPeek` (or an equivalent) can assert zero
|
|
registry-scope entries per frame for this family, add that assertion.
|