mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-07 18:13:23 +09:00

Files

T

swung0x48 aba329cc53 [Docs] (Disaggregated): P6's plan and contract draft; the working notes move from a local directory into the repository

Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.

1. P6's plan and contract draft (neither started; not one line of code)

docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)

The three findings that mattered, all written into the documents:

a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".

b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.

c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".

The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.

What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.

Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.

2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)

ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.

Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.

Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.

CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).

3. Inconsistencies fixed in passing

- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.

Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.

2026-09-18 23:31:39 -04:00

4.6 KiB

Raw Blame History

Package pg — programs: the twin and every reflection answer come from records (P5e wave 2)

Read in this order, all of it: PACKAGE-PREAMBLE-P5E.md, INTEGRATOR-DECISIONS-P5E.md (ID-85, ID-87, ID-88 are yours), BRIEF-P5E.md (§0, §1, §2 "pg", §5, §6 rulings 5, 6, 8, 9), CONTRACT-P5E.md §5.5, your scout report scout-S4.md (all of it), and the program rows of kimi-audit.md (rows 91-110) — report per row: retired / left barriered / not found. Notes: //wsl.localhost/Arch/home/swung/w7/notes/p5e/.

Your slug is pg; your tree is ~/w7/p5e-pg (branch p5e/pg, based on the landed id head, built). c0e landed SetProgramBindings (opcode 80) with its codec/route/thunk, MGPProgramDesc::LinkStatus, the MGPipeShaderCsoRecord fields (BlockBindings, SamplerUnits, StorageOverrides, BindingsSerial, LinkStatus) and MGPipeApplySetProgramBindings's asserting declaration; id landed ResolveProgramTwin(MGPipeHandle).

What "done" means for this family

The program twin is keyed by the ShaderCso handle; SyncCurrentProgram, BindCurrentTextures' memo key, BindCurrentProgramWithResources and PrepareForCompute's program line answer every question — link status, SPIR-V status, UBO size and bytes, block bindings, sampler unit indices, storage-block overrides, backend state version — from the record and the archived reflection, never from the frontend ProgramObject. The five frontend-keyed scope sites of this family are gone.

Scope

MG_Impl/Pipe/ProgramEmit.h (the artefact archive encoded per link through ProgramArtifactsCodec into SEG_STAGE; EmitProgramBindings; LinkStatus; the failed-relink rule), MG_State/GLState/ProgramState/ProgramArtifactsCodec.{h,cpp} (completeness — name the member the codec skips at its libc++ caveat and either carry it or refuse by name), MG_Pipe/PipeApply.{h,cpp} (MGPipeApplyCreateShaderState adopts the blobs into record-owned artefacts under a transport; MGPipeApplySetProgramBindings), MG_Pipe/PipeRoute.* + MG_Remote/Client/WireTables.cpp (op 80 route), MG_Remote/Server/PipeApplier.cpp (OnSetProgramBindings), DirectGLES.cpp (the stash, ResolveGlobalConstantsRecord(handle), the MapUBO refusal, SyncCurrentProgram(handle) incl. the broadcast decline arm → Fatal under transport, PrepareForDraw's program line, BindCurrentProgramWithResources EXCEPT the binding-point half (sb's) and the sampler pass (tx2's), GetCurrentBackendProgram, PrepareForCompute's program line, ShaderStorageBlockBinding's monolith body kept), Managers.h + Managers.cpp (SyncToBackend(handle, record), CacheResourceLocations, ReseedShaderStorageBlockBindings), MG_Test/Pipe/ProgramEmitTest.cpp.

Rulings that bind you

ID-87 / ruling 8: ENCODE the archive per link (a SharedPtr pin is refused by rule B). Measure links/frame, bytes/link and GL-thread ms on Minecraft + a shader pack before you declare done; if the steady cost exceeds ~0.2 ms/frame, fall back to lazy encode at first bind and say so.
ID-88 / ruling 9: a failed relink of a bound program re-issues create_shader_state with LinkStatus = 0 iff the frontend reports it unlinked — verify the frontend's actual behaviour in ProgramObject::Link rather than assuming; never object_death.
ID-85 / ruling 5: set_storage_block_binding is kWaitApplied for now (c0e set the column); resolving it by ShaderCso is your TRAILING item, not this package.
Ruling 6: BindCurrentTextures' memo key is BOTH tx2's SamplerViewsSerial and your {DrawProgram slot/gen, ShaderCso.Serial, BindingsSerial}. tx2 owns the line; agree the shape through your reports (state exactly what you expect of it).

Red-once (execute, revert, quote)

Empty the applier's block-binding tail → UniformInitializerScenario / Glsl420DeclarationScenario wrong pixels (or a named refusal).
Leave the archive blob refs at Size 0 with the companion pointers removed → Fatal{ProtocolCorruption}.
Delete the five scopes without re-keying → the id guard's Fatal{RoleViolation, "MGPipeSlots"} (id's hook forces "unbarriered").
strict names GetProgramForDraw@draw_vbo before, and does not after.
Force the global-constants subsystem bit off under run-ahead → Fatal{UnmigratedVerb, "set_global_constants"}.

Gate

build, unit, isplit, gens; one on RelinkStageSetScenario|PostLinkAttachScenario|ProgramPipelineScenario|AsyncCompileScenario|CsoContentAddressingScenario|HandleRecycleScenario; strict (record which markers of this family disappeared). The archive cost measurement is part of the gate — report the numbers, not an argument.

4.6 KiB Raw Blame History