swung0x48
aba329cc53
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.
1. P6's plan and contract draft (neither started; not one line of code)
docs/Disaggregated/P6-SPAWN-PLAN.md the package plan
docs/Disaggregated/P6-CONTRACT-DRAFT.md the contract draft (moves to
MG_Remote/CONTRACT-P6.md when c6 lands)
The three findings that mattered, all written into the documents:
a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
the tree and already tested: SocketDoorbell including hangup detection and the two
lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
assembly plus a control plane plus a process, not "write a socket transport".
b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
the tree again. So the first package, a6, is a read-only audit that writes no code, and
every contract row that depends on it is marked PENDING a6 rather than decided in
advance.
c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
and protocol.fbs:186-196's own comment says Android transfers the window out of band -
that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
gate measures. A real window reaching the server is a named refusal. This gets its own
section because "P6 is done" would otherwise read as "the game runs now".
The contract adds rule G: a role may not name a process-local handle. It extends P5c's
rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
a token this contract defines or they do not cross, and a descriptor crosses only through
SCM_RIGHTS, where the kernel renumbers it.
What P5e left for P6 gets its own section. The latch semantics are already designed
(ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
client no longer waits while the peer process can DIE: the client holds records that were
published and will never be applied, and Android's freezer suspends the child without
closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
That is P6's only new design; everything else is carriage. It shares a predicate with E1's
outstanding re-specification (ID-122), and the two should be designed together.
Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
match integration-split's name for name, because a differing set means the lane is quietly
running less; and the arm-proof gate requires every entry to record the child pid and
transport=spawn in its OWN private log - ID-124 established that this kind of false green
really happens, and a spawn lane that actually ran monolith would pass every other gate.
S2's shape must be settled before it is written, and the document says why: E1 is the
cautionary case.
2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)
ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
is under no version control. A record cited hundreds of times that lives only locally is not
a record, so it moves in whole, with its directory structure intact.
Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
stay where they are: they are evidence DATA rather than documents - large, regenerated per
run, and mostly carrying absolute paths and device serials that mean something only on the
machine that produced them. The mapping and this split are written in
docs/Disaggregated/notes/README.md.
Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
material salvaged from failed workflow runs, which may duplicate the like-named phase
directories and is kept because a few of those were the only complete version at the time.
CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
deliberately outside it: those notes' file:line citations were written against their own
code heads, and resolving them against today's HEAD would fail wholesale - which is not an
error, it is their correct state as a historical record. To check one, use the revision it
declares (--rev).
3. Inconsistencies fixed in passing
- README.md's status line still said P5e was in progress while the stage table already said
closed.
- CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
(a) and (b) were run in the previous commit; rewritten to closed plus the one item that
actually remains (E1).
- ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
package order, the scope boundary and the two new gates.
Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
16 KiB
P5e package id — identity: handle-keyed twins, the guard, the two scopes (v1)
Branch p5e/id, base 2fde7034, head 0117d157, worktree ~/w7/p5e-id. Five commits, no
attribution trailers. Lockstep behaviour is unchanged: MGPipeBarriered answers true for every
record until ra lands, so every site that must one day ask the question already asks it and every
answer is today's.
1 What changed, per file (ranges at HEAD)
| file | ranges | what |
|---|---|---|
MG_Pipe/PipeApply.h |
747-763, 813-844 |
MGPipeApplierState::CurrentRecordBarriered (inside the existing #if MOBILEGL_BUILD_DISAGGREGATED block, so the push-monolith layout does not move); opaque enum class MGPWireOp : Uint16;; MGPipeBarriered(MGPWireOp, const void*, const MGPipeApplierState&); MGPipeApplierCurrentRecordIsBarriered(). |
MG_Pipe/PipeApply.cpp |
1215-1238 |
both bodies. MGPipeBarriered returns true (today's rule restated, not a stub); the reader answers the field under split, the constant otherwise. |
MG_Remote/Server/PipeApplier.cpp |
1058-1066 |
ApplyOne stamps the flag from MGPipeBarriered(...) before StampVerbBoundary/DecodeAndApply. |
MG_Impl/Pipe/SlotAllocator.h |
176-206, 222-272 |
MGPipeApplierIsUnbarrieredApply(), MGPipeRefuseFrontendKeyedRegistryFromUnbarrieredApply(); MGPipeReverseAnnouncementScope → MagmaP7AllocatorDebtScope; both scope comments re-derived for §4.4. |
MG_Impl/Pipe/SlotAllocator.cpp |
14-22, 26-86, 105-140 |
the guard (§2 below), the non-allocator refusal, the renamed depth. Adds #include <MG_Pipe/PipeApply.h> (declarations only). |
MG_Backend/DirectGLES/SlotTables.h |
61-103, 176-203, 218-260, 292-297, 336-342, 405-447, 464-508, 588-651, 665-724, 761-764 |
the composite band (m_band, kHasCompositeBand, EntryOrNull/IndexOfSlot/EntryAt, CompositeLiveCount + two capacity readers); ForEachLive re-typed fn(MGPipeHandle, const BackendPtr&); the frontend-keyed half kept as monolith glue, each surface a named Fatal. |
MG_Backend/DirectGLES/Managers.h |
469-489, 534-548, 1428-1445, 1840-1855, 2579-2595 |
NoteStateForHandle/StateForHandle move BUILD_DISAGGREGATED → PIPE_PUSH; ForEachLive handle-arm-only; the three resolver declarations. |
MG_Backend/DirectGLES/Managers.cpp |
226-264, 336-358, 2966-2978, 4919-4939, 9160-9181, 10842-10862 |
death path (§3), §4.2/§4.3 written down, HandleOfBuffer's scope, the three resolvers. |
MG_Backend/DirectGLES/DirectGLES.cpp |
8847-8915 |
the single ForEachLive caller adapted (ruling R2). |
MG_Backend/DirectVulkan/.../VulkanRenderer.cpp |
4554-4559, 4638-4640, 8983-8995 |
scope rename, Magma's three sites. |
MG_Impl/Pipe/ResourceTracker.h |
720-728 |
scope rename, Magma's fourth site. |
MG_Test/SanityTest.cpp |
3413-3418, 4941-5006, 5087-5090 |
FakeShaderCsoSlotTable; ACompositeHandleDoesNotGrowTheOrdinaryTable; its G2/G14 skip twin. |
MG_Test/Wire/RemoteClientTest.cpp |
1861-1872, 1887-1927 |
...IsAllowed deleted; new ...FromTheApplyThreadIsFatalEvenAtTheOldDebtSites. |
The three resolvers — ResolveVaoTwin / ResolveTextureTwin / ResolveProgramTwin, each taking
MGPipeHandle — are ResolveSamplerCsoTwin's shape exactly: record first (a handle with no record
is a loud null, never an adopted slot), then AdoptTwinByHandle, then a twin if the slot is empty.
No frontend touch, no allocator probe, and no sync — which serials gate a VAO/texture/program
sync belongs to vi/tx2/pg. ResolveProgramTwin resolves through the band-aware
PipeShaderCsoRecordForHandle and adopts into m_band: after the rekey a composite's bind is the
ordinary path through it, which is why the band had to land in this package.
2 The guard and the two scopes (§4.4, ruling 12)
MGPipeRefuseAllocatorFromApplyThread exempts a probe iff a named scope is open AND the record
being applied is barriered. A named exemption is a debt the CLIENT'S WAIT pays for — behind a
barriered record the client is parked in WaitForApplied and its free list and lifetimeId -> slot
map stand still; behind an unbarriered one the same probe reads memory the client is concurrently
mutating, so the value is wrong by construction and MOBILEGL_IPC_STRICT_ERRORS is not consulted
(rule F). Every record is barriered this phase, so the guard reads as it did at 2fde7034.
MagmaP7AllocatorDebtScope exempts only when ActiveBackendType == DirectVulkan; the depth itself
is not backend-keyed (the guard reads the kind once, at the decision — keying the counter would
make its meaning depend on a global a test can move between ctor and dtor, m_counted's bug one
level out). MGPipeRefuseFrontendKeyedRegistryFromUnbarrieredApply is the non-allocator half, for
NoteStateForHandle / StateForHandle, which answer from a frontend SharedPtr without ever
calling the allocator; same Fatal{RoleViolation, "MGPipeSlots"} name, because it is one surface.
3 The death path, and ID-96 answered by measurement
The NoSession mailbox hop (Managers.cpp:224-246 at base) and the scope at :256 are deleted; that
arm ran DestroyByLifetimeId, i.e. a probe and a Free in the client's allocator from the apply
thread — not a read any barrier could make safe.
ID-96: the set of fixtures that lose death delivery is EMPTY. Method: a probe that aborted in
exactly the deleted branch (EmitObjectDeathRecord answered NoSession and
ServerLoopInstance().Running()) was run over the whole unit lane (2204 entries) and the whole
integration-split lane (111). It never fired (grep -c P5E-ID-PROBE = 0 and 0), both lanes
green. Analytically: the tree's only server role with no client session is ServerLoopTest.cpp's
ServerFixture / EglServerFixture; its one case that lets a re-keyed frontend object die off the
apply thread, ServerLoopEglTest.FrontendFramebufferDeathDeletesOnTheContextOwner, is already
refused at its FIRST step by P5c's guard, so its framebuffer.reset() was unreachable at 2fde7034
too. Nothing rewritten, nothing deleted — integrator to confirm at landing.
§4.2's death moment and §4.3's ABA answer are written into ReleaseTwinsForWireObjectDeath's
comment: the ring ordering is the argument, the Gen compare is the proof (forward re-mints, a stale
handle resolves to null, a backward generation is refused), so even a skipped death is answered by
the forward-Gen reset alone and no wait is added at any delete. Pinned by
AGenerationBehindTheLiveTwinIsRefusedRatherThanAdopted and the band case's recycle clause.
4 Kimi audit rows
List (a), scope construction sites.
- Retired:
M:256(deleted with the mailbox hop). - Re-homed:
VulkanRenderer.cpp:4554, :4634, :8986andResourceTracker.h:723→ the renamedMagmaP7AllocatorDebtScope.M:2938(BufferImpl::HandleOfBuffer) →MGPipeFrontendKeyedRegistryScope(see ruling R3). - Left barriered (unchanged; now exempt only while the record is barriered), vi/sb/pg/tx2/fb's to
delete with the probes they wrap:
D:1609 :1734 :2588 :3303 :4236 :4329 :4585 :4926 :4993 :5328 :5689 :6166 :6729 :6775 :8837 :9161 :9216 :9695 :10029 :11884(20) andM:4544 :5882 :7087 :8481 :8717 :9256 :9310 :9709 :10382 :10403 :12949 :13273 :13570(13). - Correction to the audit: list (a) omits
VulkanRenderer.cpp:4554/:4634/:8986, which constructMGPipeFrontendKeyedRegistryScopeat base; it attributes Magma's debt toMGPipeReverseAnnouncementScopealone. All four sites exist; none was "not found". Test sites:1883/:1885went with the deleted...IsAllowedcase;:1903is untouched.
List (b), frontend pointers held across records. id owns two rows. ST:156-167, ST:362-378
(Entry::stateRef, NoteStateForHandle/StateForHandle) is left, as named monolith glue per
ruling 1 / §5.8, each surface now a named Fatal from an unbarriered apply; what is retired is the
row's worst form — ForEachLive no longer hands a frontend SharedPtr out of server memory on
every step (D:8904). Managers.h:320-324 + the six registry globals (legacy m_entries, raw
address key) is left: it is the MOBILEGL_PIPE_LEGACY_MEMOS arm, unreachable under a transport.
Every other row in list (b) belongs to vi/sb/pg/tx2/fb/ra and is untouched here.
5 Red-once evidence (executed, reverted, verbatim)
(1) §4.4 — the exemption stops exempting an unbarriered apply. Green first (1/1 passed).
Revert = if (MGPipeApplierCurrentRecordIsBarriered()) → if (true) in SlotAllocator.cpp:
0% tests passed, 1 tests failed out of 1
2139 - RemoteGuards.AnAllocatorProbeInsideAnExemptionScopeFromTheApplyThreadIsFatalEvenAtTheOldDebtSites (Failed)
../MobileGL/MG_Test/Wire/RemoteClientControls.inc:139: Failure
Value of: DiedOfAbort(child) Actual: false Expected: true (exited 0)
Restored → 1/1 passed.
A FALSE GREEN WAS FOUND AND FIXED HERE; other packages should expect the same trap. The first version built
TextureObject2D tex(46)on the apply thread. That constructor MINTS a resource handle, so the child aborted with the sameFatal{RoleViolation, "MGPipeSlots"}at the mint and passed with the guard reverted too. It now builds the texture and the table on the CLIENT thread and posts only the probe — theMGL_TEXTURE_GUARD_TESTshape.
(2) §4.3 — skip the Gen reset in the ABA case. Revert = delete
if (entry.Live && entry.Gen != handle.Gen) entry.backend.reset(); from GetOrCreate(handle):
../MobileGL/MG_Test/SanityTest.cpp:4932: Failure
next Which is: (ptr = 0x55884178bd80, value = 4-byte object <EE-FF C0-00>) vs nullptr
a successor at a recycled slot inherited its predecessor's twin
../MobileGL/MG_Test/SanityTest.cpp:5001: Failure
recycled Which is: (ptr = 0x57dcfaad5c50, value = 4-byte object <5A-00 00-00>) vs nullptr
a successor at a recycled composite slot inherited its predecessor's driver program
Restored → 2/2 passed.
(3) the composite band (extra, beyond the task's two). Revert = EntryAt indexes m_slots
unconditionally:
../MobileGL/MG_Test/SanityTest.cpp:4967: Failure
table.OrdinaryCapacityForTest() Which is: 983044 vs 0u
a composite slot grew the ORDINARY table - one program pipeline is ~40 MB of twin entries for a single live program
Restored → 1/1 passed. 983044 entries is the number the band exists to prevent.
6 Gate
build rc=0. unit 2204 / 2204 (base 2203; the one new name is
ACompositeHandleDoesNotGrowTheOrdinaryTable, real + skip twin). isplit 111 / 111 (exactly
base). gens: gen_pipe --check/--self-test, gen_pipe_field_ownership --check/--self-test,
check_include_closure (4 probes, 0 problems), gen_pipe_dirty_surface --check/--self-test all
rc=0; check_doc_citations prints CONTRACT-P5.md:524: 'Core.cpp:39' -> ambiguous, which is
pre-existing in a file this package does not touch. strict: 3% passed, 108 failed of 111 —
identical to base.
Strict-lane markers, before/after (first marker per entry; split-logs cleared before each
run; copies in ~/w7/p5e-logs/split-logs-{before,after}):
field@verb |
BEFORE | AFTER | owner |
|---|---|---|---|
GetFramebufferBindingSlot@Clear |
39 | 39 | fb |
GetBoundVertexArray@DrawArrays |
14 | 14 | vi |
GetImageTextureBinding@BindImageTexture |
13 | 13 | fb |
GetTextureUnitObject@Clear |
9 | 9 | tx2 |
GetTextureObject@CopyImageSubData |
6 | 6 | tx2 (barriered, §7 allowlist) |
GetProgramForDispatch@DispatchCompute |
3 | 3 | pg |
ValidateProgramName@ShaderStorageBlockBinding |
2 | 2 | pg (barriered, §7 allowlist) |
| (88 entries have a private log; 2 carry no marker) | 2 | 2 | — |
Unchanged is the expected result: id retires no BARRIER-PULLED field — it lands the spine the
per-family packages retire them with. The table is richer than STRICT-BASELINE-2fde7034.md's
22-entry slice (88 entries now carry a private log) and agrees with it on every shared field, so it
supersedes rather than contradicts it.
G1 / monolith. 0/0/0/0 by construction, not measured: every new symbol is inside
#if MOBILEGL_PIPE_PUSH or #if MOBILEGL_BUILD_DISAGGREGATED, CurrentRecordBarriered sits inside
the applier state's existing BUILD_DISAGGREGATED block, and the TwinRegistry alias is untouched.
The p5e gate configures the split flavour only, so neither the pull build nor the PIPE_PUSH=ON, BUILD_DISAGGREGATED=OFF push-monolith build was compiled here. The one deliberate widening in that
direction is NoteStateForHandle/StateForHandle moving from BUILD_DISAGGREGATED to PIPE_PUSH
— availability added, never removed — because the re-typed ForEachLive's caller needs them there.
7 Seams assumed from c0e
MGPipeBarriered(MGPWireOp op, const void* payload, const MGPipeApplierState& st)andMGPipeApplierCurrentRecordIsBarriered(), both declared inMG_Pipe/PipeApply.h. c0e owns the final declaration; the integrator resolves the textual overlap at landing (one hunk).- Two things c0e may spell differently: (a)
Bool CurrentRecordBarriered = true;onMGPipeApplierStateis the storage the predicate reads andApplyOne's "one line" writes; (b)MGPWireOpis opaquely forward-declared (enum class MGPWireOp : Uint16;) rather than pulled in by includingMGPipe.h, which would have moved that header's include closure. - My three resolver spellings win per the task. Nothing else is assumed:
MGPipeWaitClassFor,kCapRunAheadApply,kDrawClientArraysand c0e's other rows are unreferenced here.
8 Rulings I need
- Range widening. BRIEF-P5E gives id
Managers.h:309-640andManagers.cpp:188-372. The three resolvers are declared beside each family's registryextern(Managers.h:1428, 1840, 2579) and defined beside each registry global (Managers.cpp:4919, 9160, 10842), so they read exactly likeSamplerImpl::ResolveSamplerCsoTwininstead of needing three forward declarations at:640. DirectGLES.cpp:8847-8915is outside id's scope (fb's:8837-8935). Re-typingForEachLiveis deliverable 1 and its one caller had to move in the same commit or the build breaks; the lambda takes(MGPipeHandle, twin)and callsStateForHandle(fbo)inside the scope already open at:8837, which fb replaces with its reverse index. Confirm or re-land in c0e.- "kept under the old scope name" (TASK-id deliverable 4,
Managers.cpp:2933): I read "the old scope" as the surviving one,MGPipeFrontendKeyedRegistryScope. The other reading — leaveHandleOfBufferunder the renamed Magma scope — would abort Espryt on every indexed draw, since that exemption is now DirectVulkan-keyed. Confirm. - Names beyond BRIEF-P5E's G2/G14 list for id (all
PIPE_PUSH/BUILD_DISAGGREGATED):MGPipeApplierIsUnbarrieredApply,MGPipeRefuseFrontendKeyedRegistryFromUnbarrieredApply,MGPipeApplierState::CurrentRecordBarriered,BackendSlotTable::CompositeLiveCount/OrdinaryCapacityForTest/CompositeCapacityForTest(last two test-only). Extend the list? StateBackendObjectRegistry::ForEachLiveis handle-arm-only now — the legacy map fallback is deleted (a frontend-address key has no handle to hand over, and its one caller has always had its own#if MOBILEGL_PIPE_LEGACY_MEMOSwalk beside the call). A narrowing, not a lost walk.- ID-96's empty answer (§3) — confirm at landing.
9 What I did not do
SanityTest.cpp:3499-3960, :4061, :4241, :4378were NOT moved onto the legacy arm or rewritten by handle. Deliverable 6 inherits that from scout-S7 §6.4, which assumed S7's design (the frontend-keyed members deleted). Ruling 1 / §5.8 keeps them as monolith glue, so those cases still compile, still exercise the surface they name, and run on the test's own thread where no guard can fire; moving them would be churn against a base-green count with no gate behind it. Flagged rather than done — a mechanical follow-up on request.- No device work; no strict-lane allowlist edit (
test.ymlis ra's); nodocs/or ROADMAP row (c0e ownsCONTRACT-P5E.md). The pull and push-monolith builds were not compiled here (§6).