swung0x48/MobileGL
1
0
Fork 0
mirror of https://github.com/MobileGL-Dev/MobileGL synced 2026-11-16 06:23:23 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
4fe2edb6fa3fac018089f980c514b61793ef5277
MobileGL/docs/Disaggregated/notes/p5e/reports/id-v1.md
T
swung0x48 aba329cc53 [Docs] (Disaggregated): P6's plan and contract draft; the working notes move from a local directory into the repository 
Two things land together: the plan and contract draft P6 needs before it starts, and the
working notes that until now existed on exactly one machine.

1. P6's plan and contract draft (neither started; not one line of code)

     docs/Disaggregated/P6-SPAWN-PLAN.md      the package plan
     docs/Disaggregated/P6-CONTRACT-DRAFT.md  the contract draft (moves to
                                              MG_Remote/CONTRACT-P6.md when c6 lands)

   The three findings that mattered, all written into the documents:

   a. P6 is SMALLER than its roadmap cell suggests. The transport primitives are already in
      the tree and already tested: SocketDoorbell including hangup detection and the two
      lost-wakeup fences (Doorbell.cpp:211-360, four cases in FdPassingTest), SCM_RIGHTS fd
      passing, ShmSegment::Adopt, and the SurfaceOp / WindowKind schema already defined in
      protocol.fbs. inproc uses a real second shm mapping rather than an alias, and
      SessionRings.h:22-28 says that was done so today is not the first time it runs. P6 is
      assembly plus a control plane plus a process, not "write a socket transport".

   b. The evidence for "P6 is only a transport swap" has EXPIRED. It was bought by P5c, whose
      audit found 59 direct memory accesses in a tree that already looked clean. P5e changed
      the tree again. So the first package, a6, is a read-only audit that writes no code, and
      every contract row that depends on it is marked PENDING a6 rather than decided in
      advance.

   c. P6 does not get a game running on the phone. ANativeWindow* is meaningless in the child,
      and protocol.fbs:186-196's own comment says Android transfers the window out of band -
      that band is P12. P6 lands pbuffer / surfaceless / offscreen, which is what HeadlessGL,
      the split-equivalent lane and trace replay need, and which is exactly what P6's own exit
      gate measures. A real window reaching the server is a named refusal. This gets its own
      section because "P6 is done" would otherwise read as "the game runs now".

   The contract adds rule G: a role may not name a process-local handle. It extends P5c's
   rule E (a role may not name the other role's memory) from memory to identity - EGLDisplay /
   EGLSurface / EGLContext / ANativeWindow* / fd number / pid / mapped address either cross as
   a token this contract defines or they do not cross, and a descriptor crosses only through
   SCM_RIGHTS, where the kernel renumbers it.

   What P5e left for P6 gets its own section. The latch semantics are already designed
   (ARCHITECTURE.md:504) and are copied unchanged. What is new is that after run-ahead the
   client no longer waits while the peer process can DIE: the client holds records that were
   published and will never be applied, and Android's freezer suspends the child without
   closing anything. So slow and dead must be distinguishable WITHOUT a timeout threshold.
   That is P6's only new design; everything else is carriage. It shares a predicate with E1's
   outstanding re-specification (ID-122), and the two should be designed together.

   Two gates carried over from P5e's lessons: G2 requires integration-spawn's test-name set to
   match integration-split's name for name, because a differing set means the lane is quietly
   running less; and the arm-proof gate requires every entry to record the child pid and
   transport=spawn in its OWN private log - ID-124 established that this kind of false green
   really happens, and a spawn lane that actually ran monolith would pass every other gate.
   S2's shape must be settled before it is written, and the document says why: E1 is the
   cautionary case.

2. The working notes move into the repository (docs/Disaggregated/notes/, 415 .md files)

   ROADMAP / CURRENT_STAGE_PROGRESS / MEASUREMENTS cite ruling numbers, audit line numbers and
   the provenance of gate figures from ~/w7/notes/, a directory that exists on one machine and
   is under no version control. A record cited hundreds of times that lives only locally is not
   a record, so it moves in whole, with its directory structure intact.

   Only .md moves. Scripts, run logs, census and gate result JSON, patches, APKs and nm dumps
   stay where they are: they are evidence DATA rather than documents - large, regenerated per
   run, and mostly carrying absolute paths and device serials that mean something only on the
   machine that produced them. The mapping and this split are written in
   docs/Disaggregated/notes/README.md.

   Two exceptions are recorded there too: P6's BRIEF has been promoted to a first-class
   document and keeps no copy under notes/, so the two cannot drift apart; and recovered/ holds
   material salvaged from failed workflow runs, which may duplicate the like-named phase
   directories and is kept because a few of those were the only complete version at the time.

   CI's citation lint takes docs/Disaggregated/*.md only (non-recursive), and notes/ is
   deliberately outside it: those notes' file:line citations were written against their own
   code heads, and resolving them against today's HEAD would fail wholesale - which is not an
   error, it is their correct state as a historical record. To check one, use the revision it
   declares (--rev).

3. Inconsistencies fixed in passing

   - README.md's status line still said P5e was in progress while the stage table already said
     closed.
   - CURRENT_STAGE_PROGRESS's next-step item 1 still listed the exit gate as pending, though
     (a) and (b) were run in the previous commit; rewritten to closed plus the one item that
     actually remains (E1).
   - ROADMAP's P6 row still had the pre-phase plan in three of its cells; it now carries the
     package order, the scope boundary and the two new gates.

Checked with check_doc_citations.py: 125 citations across docs/Disaggregated/*.md, 0 problems.
2026-09-18 23:31:39 -04:00

216 lines
16 KiB
Markdown
Raw Blame History

# P5e package `id` — identity: handle-keyed twins, the guard, the two scopes (v1)
Branch `p5e/id`, base `2fde7034`, head **`0117d157`**, worktree `~/w7/p5e-id`. Five commits, no
attribution trailers. Lockstep behaviour is unchanged: `MGPipeBarriered` answers `true` for every
record until ra lands, so every site that must one day ask the question already asks it and every
answer is today's.
## 1 What changed, per file (ranges at HEAD)
| file | ranges | what |
|---|---|---|
| `MG_Pipe/PipeApply.h` | `747-763`, `813-844` | `MGPipeApplierState::CurrentRecordBarriered` (inside the existing `#if MOBILEGL_BUILD_DISAGGREGATED` block, so the push-monolith layout does not move); opaque `enum class MGPWireOp : Uint16;`; `MGPipeBarriered(MGPWireOp, const void*, const MGPipeApplierState&)`; `MGPipeApplierCurrentRecordIsBarriered()`. |
| `MG_Pipe/PipeApply.cpp` | `1215-1238` | both bodies. `MGPipeBarriered` returns `true` (today's rule restated, not a stub); the reader answers the field under split, the constant otherwise. |
| `MG_Remote/Server/PipeApplier.cpp` | `1058-1066` | `ApplyOne` stamps the flag from `MGPipeBarriered(...)` before `StampVerbBoundary`/`DecodeAndApply`. |
| `MG_Impl/Pipe/SlotAllocator.h` | `176-206`, `222-272` | `MGPipeApplierIsUnbarrieredApply()`, `MGPipeRefuseFrontendKeyedRegistryFromUnbarrieredApply()`; `MGPipeReverseAnnouncementScope` → `MagmaP7AllocatorDebtScope`; both scope comments re-derived for §4.4. |
| `MG_Impl/Pipe/SlotAllocator.cpp` | `14-22`, `26-86`, `105-140` | the guard (§2 below), the non-allocator refusal, the renamed depth. Adds `#include <MG_Pipe/PipeApply.h>` (declarations only). |
| `MG_Backend/DirectGLES/SlotTables.h` | `61-103`, `176-203`, `218-260`, `292-297`, `336-342`, `405-447`, `464-508`, `588-651`, `665-724`, `761-764` | the composite band (`m_band`, `kHasCompositeBand`, `EntryOrNull`/`IndexOfSlot`/`EntryAt`, `CompositeLiveCount` + two capacity readers); `ForEachLive` re-typed `fn(MGPipeHandle, const BackendPtr&)`; the frontend-keyed half kept as monolith glue, each surface a named Fatal. |
| `MG_Backend/DirectGLES/Managers.h` | `469-489`, `534-548`, `1428-1445`, `1840-1855`, `2579-2595` | `NoteStateForHandle`/`StateForHandle` move `BUILD_DISAGGREGATED` → `PIPE_PUSH`; `ForEachLive` handle-arm-only; the three resolver declarations. |
| `MG_Backend/DirectGLES/Managers.cpp` | `226-264`, `336-358`, `2966-2978`, `4919-4939`, `9160-9181`, `10842-10862` | death path (§3), §4.2/§4.3 written down, `HandleOfBuffer`'s scope, the three resolvers. |
| `MG_Backend/DirectGLES/DirectGLES.cpp` | `8847-8915` | the single `ForEachLive` caller adapted (ruling R2). |
| `MG_Backend/DirectVulkan/.../VulkanRenderer.cpp` | `4554-4559`, `4638-4640`, `8983-8995` | scope rename, Magma's three sites. |
| `MG_Impl/Pipe/ResourceTracker.h` | `720-728` | scope rename, Magma's fourth site. |
| `MG_Test/SanityTest.cpp` | `3413-3418`, `4941-5006`, `5087-5090` | `FakeShaderCsoSlotTable`; `ACompositeHandleDoesNotGrowTheOrdinaryTable`; its G2/G14 skip twin. |
| `MG_Test/Wire/RemoteClientTest.cpp` | `1861-1872`, `1887-1927` | `...IsAllowed` deleted; new `...FromTheApplyThreadIsFatalEvenAtTheOldDebtSites`. |
The three resolvers — `ResolveVaoTwin` / `ResolveTextureTwin` / `ResolveProgramTwin`, each taking
`MGPipeHandle` — are `ResolveSamplerCsoTwin`'s shape exactly: record first (a handle with no record
is a loud null, never an adopted slot), then `AdoptTwinByHandle`, then a twin if the slot is empty.
No frontend touch, no allocator probe, **and no sync** — which serials gate a VAO/texture/program
sync belongs to vi/tx2/pg. `ResolveProgramTwin` resolves through the band-aware
`PipeShaderCsoRecordForHandle` and adopts into `m_band`: after the rekey a composite's bind is the
ordinary path through it, which is why the band had to land in this package.
## 2 The guard and the two scopes (§4.4, ruling 12)
`MGPipeRefuseAllocatorFromApplyThread` exempts a probe **iff a named scope is open AND the record
being applied is barriered**. A named exemption is a debt the CLIENT'S WAIT pays for — behind a
barriered record the client is parked in `WaitForApplied` and its free list and `lifetimeId -> slot`
map stand still; behind an unbarriered one the same probe reads memory the client is concurrently
mutating, so the value is wrong by construction and `MOBILEGL_IPC_STRICT_ERRORS` is not consulted
(rule F). Every record is barriered this phase, so the guard reads as it did at `2fde7034`.
`MagmaP7AllocatorDebtScope` exempts only when `ActiveBackendType == DirectVulkan`; the depth itself
is **not** backend-keyed (the guard reads the kind once, at the decision — keying the counter would
make its meaning depend on a global a test can move between ctor and dtor, `m_counted`'s bug one
level out). `MGPipeRefuseFrontendKeyedRegistryFromUnbarrieredApply` is the non-allocator half, for
`NoteStateForHandle` / `StateForHandle`, which answer from a frontend `SharedPtr` without ever
calling the allocator; same `Fatal{RoleViolation, "MGPipeSlots"}` name, because it is one surface.
## 3 The death path, and ID-96 answered by measurement
The NoSession mailbox hop (`Managers.cpp:224-246` at base) and the scope at `:256` are deleted; that
arm ran `DestroyByLifetimeId`, i.e. a probe **and a `Free`** in the client's allocator from the apply
thread — not a read any barrier could make safe.
**ID-96: the set of fixtures that lose death delivery is EMPTY.** Method: a probe that aborted in
exactly the deleted branch (`EmitObjectDeathRecord` answered `NoSession` **and**
`ServerLoopInstance().Running()`) was run over the whole unit lane (2204 entries) and the whole
`integration-split` lane (111). It **never fired** (`grep -c P5E-ID-PROBE` = 0 and 0), both lanes
green. Analytically: the tree's only server role with no client session is `ServerLoopTest.cpp`'s
`ServerFixture` / `EglServerFixture`; its one case that lets a re-keyed frontend object die off the
apply thread, `ServerLoopEglTest.FrontendFramebufferDeathDeletesOnTheContextOwner`, is already
refused at its FIRST step by P5c's guard, so its `framebuffer.reset()` was unreachable at `2fde7034`
too. **Nothing rewritten, nothing deleted** — integrator to confirm at landing.
§4.2's death moment and §4.3's ABA answer are written into `ReleaseTwinsForWireObjectDeath`'s
comment: the ring ordering is the argument, the Gen compare is the proof (forward re-mints, a stale
handle resolves to null, a backward generation is refused), so even a skipped death is answered by
the forward-Gen reset alone and no wait is added at any delete. Pinned by
`AGenerationBehindTheLiveTwinIsRefusedRatherThanAdopted` and the band case's recycle clause.
## 4 Kimi audit rows
**List (a), scope construction sites.**
- *Retired*: `M:256` (deleted with the mailbox hop).
- *Re-homed*: `VulkanRenderer.cpp:4554, :4634, :8986` and `ResourceTracker.h:723` → the renamed
`MagmaP7AllocatorDebtScope`. `M:2938` (`BufferImpl::HandleOfBuffer`) →
`MGPipeFrontendKeyedRegistryScope` (see ruling R3).
- *Left barriered* (unchanged; now exempt only while the record is barriered), vi/sb/pg/tx2/fb's to
delete with the probes they wrap: `D:1609 :1734 :2588 :3303 :4236 :4329 :4585 :4926 :4993 :5328
:5689 :6166 :6729 :6775 :8837 :9161 :9216 :9695 :10029 :11884` (20) and `M:4544 :5882 :7087 :8481
:8717 :9256 :9310 :9709 :10382 :10403 :12949 :13273 :13570` (13).
- *Correction to the audit*: list (a) omits `VulkanRenderer.cpp:4554/:4634/:8986`, which construct
`MGPipeFrontendKeyedRegistryScope` at base; it attributes Magma's debt to
`MGPipeReverseAnnouncementScope` alone. All four sites exist; none was "not found". Test sites
`:1883`/`:1885` went with the deleted `...IsAllowed` case; `:1903` is untouched.
**List (b), frontend pointers held across records.** id owns two rows. `ST:156-167, ST:362-378`
(`Entry::stateRef`, `NoteStateForHandle`/`StateForHandle`) is **left, as named monolith glue** per
ruling 1 / §5.8, each surface now a named Fatal from an unbarriered apply; what *is* retired is the
row's worst form — `ForEachLive` no longer hands a frontend `SharedPtr` out of server memory on
every step (`D:8904`). `Managers.h:320-324` + the six registry globals (legacy `m_entries`, raw
address key) is left: it is the `MOBILEGL_PIPE_LEGACY_MEMOS` arm, unreachable under a transport.
Every other row in list (b) belongs to vi/sb/pg/tx2/fb/ra and is untouched here.
## 5 Red-once evidence (executed, reverted, verbatim)
**(1) §4.4 — the exemption stops exempting an unbarriered apply.** Green first (1/1 passed).
Revert = `if (MGPipeApplierCurrentRecordIsBarriered())` → `if (true)` in `SlotAllocator.cpp`:
```
0% tests passed, 1 tests failed out of 1
2139 - RemoteGuards.AnAllocatorProbeInsideAnExemptionScopeFromTheApplyThreadIsFatalEvenAtTheOldDebtSites (Failed)
../MobileGL/MG_Test/Wire/RemoteClientControls.inc:139: Failure
Value of: DiedOfAbort(child) Actual: false Expected: true (exited 0)
```
Restored → 1/1 passed.
> **A FALSE GREEN WAS FOUND AND FIXED HERE; other packages should expect the same trap.** The first
> version built `TextureObject2D tex(46)` *on the apply thread*. That constructor MINTS a resource
> handle, so the child aborted with the same `Fatal{RoleViolation, "MGPipeSlots"}` at the mint and
> passed with the guard reverted too. It now builds the texture and the table on the CLIENT thread
> and posts only the probe — the `MGL_TEXTURE_GUARD_TEST` shape.
**(2) §4.3 — skip the Gen reset in the ABA case.** Revert = delete
`if (entry.Live && entry.Gen != handle.Gen) entry.backend.reset();` from `GetOrCreate(handle)`:
```
../MobileGL/MG_Test/SanityTest.cpp:4932: Failure
next Which is: (ptr = 0x55884178bd80, value = 4-byte object <EE-FF C0-00>) vs nullptr
a successor at a recycled slot inherited its predecessor's twin
../MobileGL/MG_Test/SanityTest.cpp:5001: Failure
recycled Which is: (ptr = 0x57dcfaad5c50, value = 4-byte object <5A-00 00-00>) vs nullptr
a successor at a recycled composite slot inherited its predecessor's driver program
```
Restored → 2/2 passed.
**(3) the composite band (extra, beyond the task's two).** Revert = `EntryAt` indexes `m_slots`
unconditionally:
```
../MobileGL/MG_Test/SanityTest.cpp:4967: Failure
table.OrdinaryCapacityForTest() Which is: 983044 vs 0u
a composite slot grew the ORDINARY table - one program pipeline is ~40 MB of twin entries for a single live program
```
Restored → 1/1 passed. 983044 entries is the number the band exists to prevent.
## 6 Gate
`build` rc=0. **`unit` 2204 / 2204** (base 2203; the one new name is
`ACompositeHandleDoesNotGrowTheOrdinaryTable`, real + skip twin). **`isplit` 111 / 111** (exactly
base). `gens`: `gen_pipe --check/--self-test`, `gen_pipe_field_ownership --check/--self-test`,
`check_include_closure` (4 probes, 0 problems), `gen_pipe_dirty_surface --check/--self-test` all
rc=0; `check_doc_citations` prints `CONTRACT-P5.md:524: 'Core.cpp:39' -> ambiguous`, which is
**pre-existing** in a file this package does not touch. `strict`: 3% passed, 108 failed of 111 —
identical to base.
**Strict-lane markers, before/after** (first marker per entry; `split-logs` cleared before each
run; copies in `~/w7/p5e-logs/split-logs-{before,after}`):
| `field@verb` | BEFORE | AFTER | owner |
|---|---|---|---|
| `GetFramebufferBindingSlot@Clear` | 39 | 39 | fb |
| `GetBoundVertexArray@DrawArrays` | 14 | 14 | vi |
| `GetImageTextureBinding@BindImageTexture` | 13 | 13 | fb |
| `GetTextureUnitObject@Clear` | 9 | 9 | tx2 |
| `GetTextureObject@CopyImageSubData` | 6 | 6 | tx2 (barriered, §7 allowlist) |
| `GetProgramForDispatch@DispatchCompute` | 3 | 3 | pg |
| `ValidateProgramName@ShaderStorageBlockBinding` | 2 | 2 | pg (barriered, §7 allowlist) |
| *(88 entries have a private log; 2 carry no marker)* | 2 | 2 | — |
Unchanged is the expected result: id retires no BARRIER-PULLED field — it lands the spine the
per-family packages retire them with. The table is richer than `STRICT-BASELINE-2fde7034.md`'s
22-entry slice (88 entries now carry a private log) and agrees with it on every shared field, so it
supersedes rather than contradicts it.
**G1 / monolith.** 0/0/0/0 **by construction, not measured**: every new symbol is inside
`#if MOBILEGL_PIPE_PUSH` or `#if MOBILEGL_BUILD_DISAGGREGATED`, `CurrentRecordBarriered` sits inside
the applier state's existing `BUILD_DISAGGREGATED` block, and the `TwinRegistry` alias is untouched.
The p5e gate configures the split flavour only, so neither the pull build nor the `PIPE_PUSH=ON,
BUILD_DISAGGREGATED=OFF` push-monolith build was compiled here. The one deliberate widening in that
direction is `NoteStateForHandle`/`StateForHandle` moving from `BUILD_DISAGGREGATED` to `PIPE_PUSH`
— availability added, never removed — because the re-typed `ForEachLive`'s caller needs them there.
## 7 Seams assumed from c0e
- `MGPipeBarriered(MGPWireOp op, const void* payload, const MGPipeApplierState& st)` and
`MGPipeApplierCurrentRecordIsBarriered()`, both declared in `MG_Pipe/PipeApply.h`. **c0e owns the
final declaration**; the integrator resolves the textual overlap at landing (one hunk).
- Two things c0e may spell differently: (a) `Bool CurrentRecordBarriered = true;` on
`MGPipeApplierState` is the storage the predicate reads and `ApplyOne`'s "one line" writes;
(b) `MGPWireOp` is **opaquely forward-declared** (`enum class MGPWireOp : Uint16;`) rather than
pulled in by including `MGPipe.h`, which would have moved that header's include closure.
- My three resolver spellings win per the task. Nothing else is assumed: `MGPipeWaitClassFor`,
`kCapRunAheadApply`, `kDrawClientArrays` and c0e's other rows are unreferenced here.
## 8 Rulings I need
1. **Range widening.** BRIEF-P5E gives id `Managers.h:309-640` and `Managers.cpp:188-372`. The three
resolvers are declared beside each family's registry `extern` (`Managers.h:1428, 1840, 2579`) and
defined beside each registry global (`Managers.cpp:4919, 9160, 10842`), so they read exactly like
`SamplerImpl::ResolveSamplerCsoTwin` instead of needing three forward declarations at `:640`.
2. **`DirectGLES.cpp:8847-8915` is outside id's scope** (fb's `:8837-8935`). Re-typing `ForEachLive`
is deliverable 1 and its one caller had to move in the same commit or the build breaks; the
lambda takes `(MGPipeHandle, twin)` and calls `StateForHandle(fbo)` inside the scope already open
at `:8837`, which fb replaces with its reverse index. Confirm or re-land in c0e.
3. **"kept under the old scope name"** (TASK-id deliverable 4, `Managers.cpp:2933`): I read "the old
scope" as the *surviving* one, `MGPipeFrontendKeyedRegistryScope`. The other reading — leave
`HandleOfBuffer` under the renamed Magma scope — would abort Espryt on every indexed draw, since
that exemption is now DirectVulkan-keyed. Confirm.
4. **Names beyond BRIEF-P5E's G2/G14 list for id** (all `PIPE_PUSH` / `BUILD_DISAGGREGATED`):
`MGPipeApplierIsUnbarrieredApply`, `MGPipeRefuseFrontendKeyedRegistryFromUnbarrieredApply`,
`MGPipeApplierState::CurrentRecordBarriered`, `BackendSlotTable::CompositeLiveCount` /
`OrdinaryCapacityForTest` / `CompositeCapacityForTest` (last two test-only). Extend the list?
5. **`StateBackendObjectRegistry::ForEachLive` is handle-arm-only now** — the legacy map fallback is
deleted (a frontend-address key has no handle to hand over, and its one caller has always had its
own `#if MOBILEGL_PIPE_LEGACY_MEMOS` walk beside the call). A narrowing, not a lost walk.
6. **ID-96's empty answer** (§3) — confirm at landing.
## 9 What I did not do
- **`SanityTest.cpp:3499-3960, :4061, :4241, :4378` were NOT moved onto the legacy arm or rewritten
by handle.** Deliverable 6 inherits that from scout-S7 §6.4, which assumed S7's design (the
frontend-keyed members *deleted*). Ruling 1 / §5.8 keeps them as monolith glue, so those cases
still compile, still exercise the surface they name, and run on the test's own thread where no
guard can fire; moving them would be churn against a base-green count with no gate behind it.
Flagged rather than done — a mechanical follow-up on request.
- No device work; no strict-lane allowlist edit (`test.yml` is ra's); no `docs/` or ROADMAP row (c0e
owns `CONTRACT-P5E.md`). The pull and push-monolith builds were not compiled here (§6).
Reference in New Issue View Git Blame Copy Permalink