MobileGL/docs/Disaggregated/notes/p7/magma-c.md

# P7 wave 2 package C — Magma object death, resident sub-data, the reflection archive, the vertex-layout split

## For the integrator, first

Nine things this package changes that live outside its own files or outside its own slices.
`CONTRACT-P7.md` is the integrator's file (§0 "怎么改"), so none of these edit it.

1. **§12's debt row is retired.** "Magma 两进程 client 在 `StateObjectDeathOps` 落地前
   `ObjectDeaths=0`；`CtWireScenario` 的死亡用例在 Magma 臂按名 skip" — the table landed, both
   skip guards are deleted, and the two cases are green on `DirectVulkan.{Split,Spawn,Tcp}`.
   §2.3's "Magma 自己的 `StateObjectDeathOps` 表（wave 2-C）落地前…按名 skip" can go with it.
2. **§3.1's pinned census moves: 15 sites / 4 files → 13 / 3.** `Renderer/WireDraw.inc` leaves
   the list entirely. `scripts/ci/fatal_census.py` is unchanged (79 / 43 / 3 / 0) — the funnels
   were already converted in wave 0, so retiring a `MagmaWireFatal` CALL moves no abort count.
3. **§3.2 says "the other six" for `vertex-layout`; there are seven.** `offset-overflow`
   post-dates the audit. It is masked with the rest; the reasoning is in slice 4 below.
4. **§5.4's white-box case (opcode 49 on the wire) is not achievable at this tree**, and the
   blocker is R-6, not this package. The full chain is in slice 2. The capability is wired
   ahead of its consumer on purpose; `rsd=` on the PipeStats line is what will show the records
   the day P11 lands an adoption tier.
5. **§5.3's `g_programResourceCaches` deletion is achieved in the disaggregated build only.**
   The archive member has to be `#if MOBILEGL_BUILD_DISAGGREGATED` for G1, so the pull build
   keeps the cache. One-line change the day that pin is retired. P13.
6. **A family-word question.** `buffer-window` is now a permanent protocol error going through
   `MagmaWireFatal`, whose family is `UnmigratedVerb`. The honest word is `ProtocolCorruption`;
   `MG_Pipe::MGPipeFatalFamily` carries only two words and its own comment says a third is
   where the choice gets argued. §3.3 keeps the funnels on `UnmigratedVerb` deliberately so the
   refusal census stays comparable to P5b. Flagged, not decided.
7. **Gating lane counts grow** (grow-only, G14-legal): `integration-magma-split` 73 → 75,
   `-spawn` 52 → 54, `-tcp` 54 → 56, `integration-split` 186 → 187, `integration-spawn`
   102 → 103, `ctest -L unit` 2402 → 2403.
8. **One ratchet symbol changes bucket** without changing the total (186, monotone green):
   `p3b-p4b-espryt` 14 → 13 and `both-backends` 60 → 61, because slice 3's monolith consumer
   makes `DirectVulkan.cpp` reference a frontend symbol only `DirectGLES` referenced before.
   `p7-magma` — P7's own target bucket — is unchanged at 101. Nothing in this package was
   aimed at gate 4; the §4.2 path to 101 → 0 is package B's `(B')`.
9. **The worktree tool leaves `MOBILEGL_ITEST_VK_ICD` empty** and CMake warns about it; every
   Magma entry then runs whatever ICD the loader finds first. This package reconfigured
   `build-split` with `/usr/share/vulkan/icd.d/lvp_icd.json`, the pin `~/w7/pipe/build-split`
   already carries. Worth adding to `p7_worktree.sh` so the next package does not have to
   notice it.


Base: `p7/magma-c` off `feat/disaggregated @ 4f2d4c4e` (pipe HEAD at branch time).
Build: `build-split` = `-DMOBILEGL_BUILD_DISAGGREGATED=ON -DMOBILEGL_BUILD_DISAGGREGATED_INPROC=ON
-DMOBILEGL_PIPE_PUSH=ON -DMOBILEGL_BUILD_INTEGRATION_TEST=ON`, ICD pinned to
`/usr/share/vulkan/icd.d/lvp_icd.json` (the same lavapipe ICD `~/w7/pipe/build-split` pins; the
worktree tool leaves `MOBILEGL_ITEST_VK_ICD` empty and CMake warns about it).

Contract rows: CONTRACT-P7 §5.5 (`StateObjectDeathOps`), §5.4 (OQ-10), §5.3 (OQ-8), §3.2
(`vertex-layout`, `vertex-format-conversion`). Discipline: rule I (no `std::abort()` on a Magma
wire arm), rule J / R-16 (every fix red once on a two-process arm first).

## Gates, on the four slices together

| gate | base (`4f2d4c4e`) | after | |
|---|---|---|---|
| `ctest -L unit` | 2402 | **2403 / 2403** | +1 = the OQ-8 order case |
| `integration-magma-split` | 73 (71 P + 2 S) | **75 / 75, 0 skipped** | +2 vertex-layout; the 2 skips were the death cases |
| `integration-magma-spawn` | 52 (50 + 2) | **54 / 54, 0 skipped** | |
| `integration-magma-tcp` | 54 (52 + 2) | **56 / 56, 0 skipped** | |
| `integration-split` | 186 | **187 / 187** | +1 = the OQ-10 capability case |
| `integration-spawn` | 102 | **103 / 103** | |
| `integration-magma-full-split` | 453 P / 57 S / 0 red | **513 entries, 0 red, 55 skipped → 458 P / 55 S** | better on both counts |
| `scripts/ci/fatal_census.py` | 79 / 43 / 3 / 0 | **79 / 43 / 3 / 0** | unchanged, as expected |
| `scripts/ci/spawn_lane_parity.py` | green | **green** | all tiers equal after normalisation |
| `grep -rn "@P7"` | 15 sites / 4 files | **13 / 3** | `WireDraw.inc` leaves the list |
| `link_ratchet.py --assert-monotone` | 186 | **186, "unchanged"** | green |
| **G1** (`build-linux`, pull) | `.text` `0xa52203` | **`.text` `0xa52203` (10822147, +0)** | `.data`/`.bss`/`.rodata`/total all +0; 27837 → 27837 defined symbols, **0 added / 0 removed / 0 resized / 0 renamed**; the `.so` is byte-identical on disk (19143824) |

**Ratchet buckets.** AFTER: `p7-magma` **101**, `p3b-p4b-espryt` **13**, `both-backends` **61**,
`p6-core` **11**, total **186**. CONTRACT-P7 §4.1 records the `8bb6309a` baseline as
101 / 14 / 60 / 11. So one symbol sits in `both-backends` that the baseline recorded under
`p3b-p4b-espryt`; the total, the monotone assertion and **P7's own target bucket (101)** are all
unchanged. HONESTY NOTE: I did not separately re-measure the buckets at `4f2d4c4e`, so I cannot
attribute that single move to this package rather than to the two commits between the baseline
and this branch point. Nothing here was aimed at gate 4 — §4.2's path from 101 to 0 is package
B's `(B')`. (An attempt to identify the mover by rebuilding one object at the base failed to
compile and was abandoned; the clean way is `--bucket --verbose-buckets` on a base build.)

---

## Slice 1 — Magma `StateObjectDeathOps` (§5.5)

**What landed.** `MG_Backend/DirectVulkan/DirectVulkan.cpp` gains
`g_magmaStateObjectDeathOps` and `InstallStateObjectDeathOps()`, installed from
`BackendObject_DirectVulkan::Initialize()` — i.e. from `ServerLoop::CreateBackend`, step 1 of
`InitServerRoleCommon`, which both Magma server roles (inproc and the spawn/TCP child) run and
which is before any client session exists. Guarded `#if MOBILEGL_BUILD_DISAGGREGATED &&
MOBILEGL_PIPE_PUSH`, so the pull build compiles nothing new (G1).

**The one arm, and why it is only one.** Espryt's `g_glesStateObjectDeathOps` has two jobs: emit
the wire `object_death` record off the apply thread, and otherwise destroy a backend twin keyed
by lifetime id. Magma has no lifetime-id-keyed twin at all — its two client-minted kinds
(`VertexElementsCso`, `Buffer`) are keyed on `{slot, gen}` by `MagmaPipeIdentityTables` and the
other six are still reached from their frontend objects — so the Magma table is exactly the EMIT
arm and nothing else.

**Correction to the plan's wording (worth the integrator's attention).** Plan §1.3 and the task
brief describe the gap as a client SLOT leak provable with `PipeSlotPeek`. It is not, and has not
been since P4a: `MG_Impl/Pipe/PipeFill.cpp`'s `NotifyAndFree` frees the client slot
unconditionally and backend-neutrally, so `PipeSlotPeek` never saw a Magma leak and does not see
a change now. What leaked was the **server's twin**. A framebuffer has no wire delete opcode at
all (BRIEF-P4A D-I2), so `object_death` is its only death delivery; with no consumer installed
under Magma inproc, the server's record stayed `Live` for the life of the session. The
`CtWireScenario` framebuffer case now reads BOTH numbers — the server's `deaths` tally and the
client's `PipeSlotKind::Framebuffer` live count — so a future regression in either half is
attributable.

**Cleanup of the Magma special cases.** The two executable ones are the `CtWireScenario` skip
guards (`:153` / `:209`), both deleted. Everything else the audit counted is comment text, and it
is reworded rather than deleted because the underlying argument survives: `PipeSlotPeek.h`,
`MagmaPipeArms.h` (the age-sweep-instead-of-death-notice paragraph — still true, because the new
table never touches the per-renderer identity tables), `PipeMutation.h`, `PipeFill.cpp`,
`VertexArrayObject.cpp`, `DirectGLES/Managers.cpp`, `HandleRecycleScenario.cpp`,
`WireTables.cpp`.

**The install-order question, answered rather than assumed.** `SetStateObjectDeathOps` is a bare
last-writer-wins pointer with no stacking, so two installers could in principle race.
They cannot meet: Magma's runs only in a process that OWNS a DirectVulkan backend, and
`InstallClientWireTables`' arm runs only under `Transport == Spawn`, which is by construction the
process that owns no backend (`InitSplitRoles` builds a `BackendObject_Remote` there). The
red-once below measures exactly that split of responsibility.

**Proof (green).** `ctest -R "DirectVulkan\.(Split|Spawn|Tcp)\.Ct\..*Death"` — 6/6 pass
(`integration-magma-all-{split,spawn,tcp}`), plus the two `TcpServer` fixtures. DirectGLES
control `ctest -R "DirectGLES\.(Split|Spawn|Tcp)\.Ct\..*Death"` — 6/6 pass, unchanged.

**RED-ONCE (executed).** `BackendObject_DirectVulkan::Initialize()`'s call changed to
`if (false) InstallStateObjectDeathOps();`, rebuilt, lane re-run:

```
1/8 DirectVulkan.Split.Ct.CtWireScenario.TextureDeath...        ***Failed
2/8 DirectVulkan.Spawn.Ct.CtWireScenario.TextureDeath...            Passed
4/8 DirectVulkan.Tcp.Ct.CtWireScenario.TextureDeath...              Passed
5/8 DirectVulkan.Split.Ct.CtWireScenario.FramebufferDeath...    ***Failed
6/8 DirectVulkan.Spawn.Ct.CtWireScenario.FramebufferDeath...        Passed
7/8 DirectVulkan.Tcp.Ct.CtWireScenario.FramebufferDeath...          Passed
75% tests passed, 2 tests failed out of 8

CtWireScenario.cpp:264: Failure
Expected: (afterCounters.deaths) > (deathsBefore), actual: 0 vs 0
```

Restored and rebuilt: 8/8 green again. This is precisely the shape package L's temporary probe
predicted (`notes/p7/magma-two-process-first-run.md` §6): spawn and tcp were already carried by
`InstallClientWireTables`' emitter, and **inproc was the only hole** — which is the hole this
table closes.

---

## Slice 2 — OQ-10 `kCapResidentSubData` (§5.4)

**What landed.** `InitServerRoleCommon` ORs `kCapResidentSubData` when
`g_resourceOpsAtStep2->SubDataResident != nullptr` — the pointer that function already pinned at
step 2 and that step 5 already refuses to see swapped. Never from `ActiveBackendType` (ID-39).
`rsd=` joins the `emit[]` bracket on the PipeStats summary line, counted at
`MGPipeEmitBufferSubDataResident` once per record. `SplitRuntimePeek` gains
`residentSubDataCap`, read through the same `CapsMirrorInstance().HasCap()` accessor the
frontend's `MGPipeResourceOpsHaveSubDataResident` reads.

### BLOCKER FOR THE INTEGRATOR: §5.4's white-box case is not achievable at this tree

§5.4 asks for a case in `integration-magma-buffers` and one in `integration-split` proving that
the emitted record is `BufferSubDataResident` (opcode 49). **Neither can exist today, and the
reason is R-6 rather than anything this package did or did not do.** The chain:

| step | site | verdict under split |
|---|---|---|
| the resident emitter runs only from a resident store | `BufferObject.cpp` `UploadSubData` → `if (m_resource.IsGpuResident())` | — |
| residency comes only from `AdoptPersistentMap` | `PipeResource.h:181`, the only writer of `m_gpuMapped` | — |
| adoption needs a non-null `map_persistent` answer | `BufferObject.cpp` `TryAdoptLargeStorage` / `EnsureGpuResidentStorage` / `AcquireMemoryRange` | — |
| the answer is a decline | `PipeApply.cpp:2331` "**A SPLIT BUILD RUNS AT TIER T2 AND DECLINES EVERY ACQUISITION, ALWAYS**" | always |
| the tier gate has no other implemented value | `PersistentMapTracker.cpp:1033` `AdoptTierIsEmulate` — T0/T1 are P11's and are a named `Fatal{UnimplementedAdoptTier}` | always |

So under any transport no buffer is ever GPU-resident, `LandBytesIntoResidentStore` is
unreachable, and opcode 49 cannot cross. The capability is therefore wired **ahead of its
consumer**, deliberately: when P11 lands a tier that adopts, the bit is already correct and
already derived from the table, and `rsd=` is the counter that will show the records. The
plan's phrasing ("both backends fall back to the in-place memcpy at `BufferObject.cpp:~711-716`")
is one step optimistic — under split the code does not reach that fallback either, it takes the
plain shadow `Memcpy` in `UploadSubData` above it.

**What is proved instead, and it is both halves of the bit.**

- *Server half* — `CapsMirrorTest.MagmaTransportPublishesRealBufferConsumersWithoutRunAhead`
  (`RemoteClientTest.cpp`) now asserts
  `(mask & kCapResidentSubData) != 0  ==  (ops->SubDataResident != nullptr)`. The two sides are
  compared to each other rather than both to `true`, so the case also covers a backend WITHOUT
  the arm on the day one exists.
- *Client half* — the new `CtWireScenario.TheServerPublishesTheResidentSubDataCapabilityFromIts
  OwnTable`, registered through the `ctCase` list so tier 2 replays it: green on
  `DirectGLES.{Split,Spawn,Tcp}` (`integration-{split,spawn,tcp}`) and
  `DirectVulkan.{Split,Spawn,Tcp}` (`integration-magma-all-*`), 6/6.
- *Negative half* — `CapsMirrorTest.APlaceholderMirrorConsumesNothing` keeps the
  no-snapshot-withholds-the-bit reading, which stopped being vacuous the moment anything set it.

**RED-ONCE (executed, both levels).** `capBits |= MG_Pipe::kCapResidentSubData;` → `capBits |= 0;`:

```
RemoteClientTest.cpp:692: Failure
Expected equality of these values:
  (server.CallMask() & static_cast<Uint64>(kCapResidentSubData)) != 0
    Which is: false
    Which is: true

25% tests passed, 6 tests failed out of 8
  DirectGLES.{Split,Spawn,Tcp}.Ct....ResidentSubDataCapability...   ***Failed
  DirectVulkan.{Split,Spawn,Tcp}.Ct....ResidentSubDataCapability... ***Failed
CtWireScenario.cpp:262: Failure
Value of: runtime.residentSubDataCap
  Actual: false
```

Restored: 11/11 unit and 6/6 integration green again.

**One incidental finding, recorded because it cost a cycle.** The first cut of the capability
case did no GL work and failed on `ScenarioFixture.h:90` — an armed split lane refuses a case
whose encoder ordinal did not move, because "emitted nothing" and "resolved the transport and
then put nothing on the wire" are the same observation. The case now clears and reads back
first. This is the same F1 arming rule package L hit on tier 3.

---

## Slice 4 — the `vertex-layout` split and `vertex-format-conversion` (§3.2)

**What landed.** `BuildWireVertexInput` answered eight conditions with one `false`, and the
caller answered that with a P7-marked `MagmaWireFatal` — a session kill where the monolith arm
masks the attribute out and declines the draw. Split by what the reason is ABOUT:

| reason | before | after |
|---|---|---|
| `buffer-window` | `false` → P7-marked Fatal | `false` → named Fatal `Magma:vertex-layout-buffer-window` (no P7 marker: it is a permanent protocol error, not an unmigrated shape) |
| `attribute-shape`, `native-fp64-format`, `format-map`, `native-format-feature`, `converted-format-feature`, `element-size`, `offset-overflow` | `false` → Fatal | `MGLOG_E_ONCE` + `unsupportedAttribMask \|= 1<<loc` + `continue`, then the monolith arm's own pre-flight in `WireDraw.inc` declines the draw when a masked bit is one the program reads |
| `vertex-format-conversion` | P7-marked Fatal | `MGLOG_E_ONCE` + `return false` (decline, rule I (a)) |

`unsupportedAttribMask` now enters the wire layout hash, for the reason the monolith entry's
hash already carries it: two VAOs can otherwise produce identical bindings/attributes/divisors
and differ only in which enabled attribute was masked, and a blind hash would serve one the
other's pipeline. It was safe to omit only while the mask was always zero.

**Count correction.** CONTRACT-P7 §3.2 says "the other six". There are SEVEN non-`buffer-window`
return sites in the tree: `offset-overflow` post-dates the audit's count and is an arithmetic
guard rather than a shape one. It is masked with the rest — an attribute whose base offsets
cannot be added is one Vulkan cannot fetch, the monolith arm never computes that sum at all,
and masking is strictly safer than a Fatal for a number no application can reach on purpose.

**Family-word question for the integrator.** `buffer-window` now goes through `MagmaWireFatal`,
whose family is `UnmigratedVerb`. The honest word for "the record's own numbers are impossible"
is `ProtocolCorruption`. `MG_Pipe::MGPipeFatalFamily` carries only `UnmigratedVerb` and
`RoleViolation` and its own comment says a third "costs a row here and an arm in the adapter -
which is the point, because that arm is where the choice gets argued". Not taken here: it is a
cross-package edit (`MG_Pipe/PipeSessionFail.h` + the `MG_Remote` adapter) and §3.3 records that
the three Magma funnels keep `UnmigratedVerb` deliberately, because renaming invalidates the
refusal census kept since P5b. Flagged rather than decided.

**Census.** `grep -rn "@P7" MobileGL/ --include=*.cpp --include=*.inc --include=*.h`:
**15 sites / 4 files → 13 sites / 3 files.** `Renderer/WireDraw.inc` leaves the list entirely
(both of its marked refusals are retired). `scripts/ci/fatal_census.py` is unchanged at
`79 abort sites over 20 files, 43 distinct family words, 3 refusal words, 0 unmarked` — the
funnels were already converted in wave 0, so retiring a `MagmaWireFatal` call moves no
`std::abort()` count. (Note for anyone editing near this row: the census counts the marker
literally, so a COMMENT that spells it raises the number. The first cut of this slice pushed
15 → 16 that way.)

**New scenario.** `Scenarios/MagmaVertexLayoutScenario.cpp`, DirectVulkan only — Espryt hands
`GL_FIXED` to a driver that supports it, so the same case under the same name would assert a
different fact there. `DataType::Fixed32` has no arm in `ToVkVertexFormat` at all, which is
what makes it the one unmappable shape reachable on host lavapipe; CONTRACT-P7 §2.5 records
that no other P7-marked refusal is (they need real hardware), so without this shape the
retirement would have had no host gate.

- `AnUnmappableVertexFormatDeclinesTheDrawInsteadOfEndingTheSession` — the program READS the
  `GL_FIXED` array, so the draw declines and the framebuffer keeps the clear colour.
- `AnUnreadUnmappableArrayDoesNotStopTheRestOfTheDraw` — the array is enabled and unmappable
  but unread, so the draw lands. This is what stops the first case being satisfied by
  "decline every draw that mentions GL_FIXED".

Registered on `DirectVulkan.{Split,Spawn,Tcp}.VertexLayout.` AND picked up by the ambient
monolith `DirectVulkan.` discovery, so the A/B is direct: the same two assertions on the wire
arm and on the monolith arm.

**Proof (green).** 8/8 — monolith `DirectVulkan.` ×2, `Split` ×2, `Spawn` ×2, `Tcp` ×2.

**RED-ONCE (executed).** `format-map` put back on the protocol verdict
(`return reject("format-map")`):

```
70% tests passed, 3 tests failed out of 10
#4238 DirectVulkan.Split.VertexLayout...Unmappable...  Subprocess aborted***Exception
  MGPipe: Fatal{UnmigratedVerb, "Magma:vertex-layout-buffer-window"}
#4240 DirectVulkan.Spawn.VertexLayout...Unmappable...  Subprocess aborted
#4242 DirectVulkan.Tcp.VertexLayout...Unmappable...    Subprocess aborted
#3408 DirectVulkan.MagmaVertexLayoutScenario...Unmappable...   Passed   <- monolith control
```

The three split arms KILL THE PROCESS and the monolith arm stays green, which is exactly the
divergence this slice closes. Restored: 10/10.

**Lane arithmetic.** The three new `Split` entries carry `integration-magma-split`, so that
gating lane grows 73 → 75 (and `-spawn` 52 → 54, `-tcp` 54 → 56). Growth only; G14's name
sets are grow-only by rule.

---

## Slice 3 — OQ-8: one reflection archive serves the storage-block consumers (§5.3)

**What landed.**

- `LinkArtifacts` gains `Vector<StorageBlockReflection> storageBlocks` (`{name, binding,
  dataSize}`), **`#if MOBILEGL_BUILD_DISAGGREGATED` only** — see G1 below.
- `ProgramLinkTask::SnapshotStorageBlockIndexSpace()` fills it in phase A, right after
  `SnapshotGlslangReflection`.
- Its `VisitFields` row and its own three-field table join the codec;
  `kProgramArtifactsCodecVersion` 2 → 3; `ProgramArtifactsSchemaFingerprint()` and therefore
  `wireFingerprint` move with them, which is expected and is what makes a mixed-version pair
  refuse at the handshake rather than at the first program.
- `MagmaProgramSource::EnsureStorageBlocks` is **deleted**, with `m_storageBlocks`,
  `m_storageBlocksReady`, the local `StorageBlock` struct and `#include <spirv_reflect.h>`.
- `DirectVulkan.cpp`'s monolith consumer reads the archive too, under `#if` symmetry.

**Why phase A and not phase B.** The obvious home is where the SPIR-V exists, and there is
exactly one function that sees both finished halves — `ProgramSpirvTask::RunBody`'s L1 cache
insert — but its writes reach only the TRANSLATION CACHE. Phase A's `artifacts` has already
been moved into the `ProgramObject` by then (`ProgramObject.cpp`'s `JoinPendingLink`), and
phase B is structurally forbidden from touching it. A field filled there would therefore be
present on a cache HIT and absent on every cold link — the worst of both, and invisible until
a second identical program linked. So the fill is glslang-derived, in phase A, and the
equivalence below is what makes that safe.

**The equivalence is measured, not asserted.** The consumers speak the index space
SPIRV-Reflect produces, and the archive now produces it from glslang's reflection instead.
`ProgramTest.TheArchivesStorageBlockOrderIsTheOneSpirvReflectProduces` runs the OLD algorithm —
SPIRV-Reflect over the real modules, sorted by (normalised name, binding), deduplicated across
stages — over a multi-stage program with an arrayed SSBO and an atomic-counter block, and
compares element for element. Measured reference on this tree:

```
{ "Blocks", "VertexOnly", "gl_AtomicCounterBlock_0", "FragmentOnly" }
```

which exercises all three of the cases that could have diverged: the instance array collapses
to one entry (glslang reflects per element, SPIR-V carries one descriptor with a count), the
synthesized atomic-counter block IS in the backend's space although GL's own
`GL_SHADER_STORAGE_BLOCK` enumeration excludes it, and `FragmentOnly` lands last because the
cross-stage dedupe walks stages in linked order.

**MEASUREMENT — `spvReflectCreateShaderModule` on the Magma wire draw path, per frame.**
Same binary, same workload, same window (`frames=1 window=1 draws=1 acc=18`, identical bytes),
`DirectVulkan` × inproc, `StorageBufferRegrowScenario` + the pipeline storage-block case, with
a temporary `MGLOG_I("OQ8_REFLECT_CALL")` at the call site:

| | reflect calls | frames | draws |
|---|---|---|---|
| BEFORE (`HEAD`'s per-draw `EnsureStorageBlocks`) | **4** | 1 | 1 |
| AFTER (reads the archive) | **0** | 1 | 1 |

The AFTER number is 0 structurally, not incidentally: the call site is gone and
`MagmaProgramSource.h` no longer includes `spirv_reflect.h` at all, which is the gate a future
edit would have to break on purpose. (A `MagmaProgramSource` is a borrowed view constructed
once per wire draw, so its `mutable` memo was cold every time it was read — that is why the
per-draw cost existed at all.)

**The monolith half: DONE, under `#if` symmetry — with one caveat the integrator should see.**
The task allowed deferring this if it could not be done without moving pull `.text`. It can,
and it is: `GetShaderStorageBlockIndex` / `GetShaderStorageBlockBinding` /
`ClearProgramResourceCaches` and the block-binding setter each have a disaggregated arm that
reads the archive and a `#else` arm that is the previous code verbatim. In the disaggregated
build that retires `g_programResourceCaches`, `ProgramResourceCache`, `StorageBlockResource`,
`BufferVariableResource`, `AddBufferVariablesRecursive`, `NormalizeDescriptorName`,
`GetProgramResourceCache` **and the rehash hazard** — the open-addressed-map dangling reference
that was a reproducible segfault in `ProgramPipelineScenario`'s two storage-block cases.

Two things are worth stating plainly:

1. **The pull build keeps all of it.** The archive member is disaggregated-only because one
   more `Vector` in `LinkArtifacts` changes its size, its implicit destructor and its move
   constructor, and G1 pins the pull build's `.text` byte for byte. So §5.3's "`g_programResource
   Caches` 随之删" is achieved in the disaggregated build and NOT in the pull one. Retiring the
   pull half is a one-line change (drop the guard on the member) the day that pin is retired or
   the member is moved — a P13 / integrator call, not a wave-2 one.
2. **Nothing outside `DirectVulkan.cpp` read any of the retired machinery.** Measured:
   `BufferVariableResource`, `bufferVariables`, `activeVariables` and `StorageBlockResource`
   have no reference anywhere else in the tree, and `dataSize` was written and never read —
   `GL_BUFFER_VARIABLE` and `GL_ACTIVE_VARIABLES` are answered by
   `MG_Impl/GLImpl/Program/ProgramInterface.cpp` out of glslang's own reflection, which is a
   different index space. So the two arms differ in exactly the two functions their callers
   use and in nothing else.

One genuine behaviour improvement rides along: the monolith `GetShaderStorageBlockBinding` now
asks `GetShaderStorageBlockBindingOverride` on every read, over an immutable list, where it
used to read a binding patched into a mutable cache. Same answer by a shorter route, and a
rebind can no longer be lost to a cache rebuild that raced a state-version bump.

**Proof (green).** `ctest -L unit` 2403/2403 (2402 before this slice; +1 is the new case).
`DirectVulkan.*(ProgramPipeline|StorageBufferRegrow)` 60/60 — the **monolith** `DirectVulkan.`
arm and the `Split` / `Spawn` / `Tcp` arms together, which is what says both consumers were
switched.

**G1 after the archive change:** `.text` `0xa52203` = 10822147 → 10822147 (+0), 27837 → 27837
defined symbols, **0 added / 0 removed / 0 resized / 0 renamed**, and the file is byte-identical
on disk (19143824 bytes both sides). The `#if` guards did their job; an unguarded call site
caught it once mid-slice (the pull build failed to compile, which is the loud version).

**RED-ONCE (executed).** `SnapshotStorageBlockIndexSpace` made to publish nothing:

```
ProgramTest.cpp:525: Failure
    Which is: {}
    Which is: { "Blocks", "VertexOnly", "gl_AtomicCounterBlock_0", "FragmentOnly" }
...
58% tests passed, 25 tests failed out of 60
  3091 DirectVulkan.ProgramPipelineScenario.ComputeAndGraphicsStagesShareOnePipeline  (SEGFAULT)
  3092 DirectVulkan.ProgramPipelineScenario.AStageProgramsStorageBlockBindingReaches... (Failed)
  3282 DirectVulkan.StorageBufferRegrowScenario...                                      (Failed)
  4179 DirectVulkan.Split.Buffers.StorageBufferRegrowScenario...                        (Failed)
  4198 DirectVulkan.Spawn.Buffers.StorageBufferRegrowScenario...                        (Failed)
  4217 DirectVulkan.Tcp.Buffers.StorageBufferRegrowScenario...                          (Failed)
  4469 DirectVulkan.Split.ProgramPipelineScenario...                                    (Failed)
```

The monolith arm reds beside the three transports, which is the evidence that the monolith
consumer really was switched and not merely edited. Restored: 61/61.