gold 1ae7a8eaa4 [Feature] (disaggregated): WindowKind::HostFrame - the host-framed surface crosses the wire ...

The last thing between the host-framed surface and a run: the sub-byte on the wire that names it.
ServerOwned had one (7) and the host frame had none, so the encoder refused the op with
UnknownWindowKind - a correct refusal, and the reason the first run of MOBILEGL_IPC_SURFACE=host
failed in the codec rather than anywhere near the pixels.

 - protocol.fbs: WindowKind::HostFrame = 8, appended, legal on CreateWindowSurface only and always
   with nativeToken 0 - the same rules ServerOwned carries, for the same reason: no pointer of any
   process's window system crosses (Rule G/H).
 - SurfaceRefusal: HostFrameOnSetWindowHandle = 5, its own code rather than reusing the
   server-owned one: a refusal that names the wrong owner sends the next reader to the wrong place.
 - SurfaceOpCodec: the encode and decode arms, the two wire errors that go with them
   (HostFrameTokenNotZero latches as corruption, HostFrameOnSetWindowHandle is a named refusal), and
   the range bound that had ServerOwned as its upper limit now ends at HostFrame.
 - protocol_generated.h regenerated with the pinned submodule's flatc (scripts/gen_protocol.py),
   diff being exactly the two appended enumerators.

Both ends must be rebuilt together, as any protocol revision here: the container's client and the
device's server went out with this on either side.

2026-10-01 01:26:02 +08:00

..

Client

[Feature] (disaggregated): MOBILEGL_IPC_SURFACE=host - the display host owns the screen and the frames

2026-10-01 01:11:21 +08:00

Protocol

[Feature] (disaggregated): WindowKind::HostFrame - the host-framed surface crosses the wire

2026-10-01 01:26:02 +08:00

Server

[Feature] (disaggregated): WindowKind::HostFrame - the host-framed surface crosses the wire

2026-10-01 01:26:02 +08:00

Transport

[Feat] (MG_Remote, P11 B2): T0 is the default - an unset MOBILEGL_IPC_ADOPT_TIER asks T0 (ask 0x80) and falls back to T2 quietly (MGLOG_D, still counted: client T0Fallbacks, server T0Refusals), while an explicit 0 keeps every named line; revision 5's schema comment and pin fixed up

2026-09-29 20:15:29 -04:00

Wire

[Refactor] (P8-F): reclassify what our client cannot send - the multi-draw client-indices/instanced latches and Magma's client-vertex-array become ProtocolCorruption, Magma's mipmap-shader-format-or-shape becomes a named decline decided before the chain grows (with a knob-forced 3D case on split and spawn), and the three unpublished cap bits and the index-mirror sentinel are marked reserved

2026-09-29 22:15:29 -04:00

CapsCodec.cpp

[MG_Pipe, MG_Remote, MG_Backend] (P7): bind staged bytes to declared mip extents

2026-09-23 13:43:44 -04:00

CapsCodec.h

[Refactor] (P8-F): reclassify what our client cannot send - the multi-draw client-indices/instanced latches and Magma's client-vertex-array become ProtocolCorruption, Magma's mipmap-shader-format-or-shape becomes a named decline decided before the chain grows (with a knob-forced 3D case on split and spawn), and the three unpublished cap bits and the index-mirror sentinel are marked reserved

2026-09-29 22:15:29 -04:00

CONTRACT-MAGMA-RUNAHEAD.md

[Docs] close Magma RD32 cache regression with host and device evidence

2026-09-20 09:34:47 -04:00

CONTRACT-P5.md

[Docs] (Debts): the debt review - drop the closed E1, DualBlock and GetCaps-blobref rows (open question 24 closed, the blobref rule now a CONTRACT-P5 row-18 invariant), move the unmeasured M2 note to MEASUREMENTS, rewrite HyperOS / P11 RSS / named refusals, split the P12 row, merge the two CI rows, add three B2 rows, and mark each destination as needing a ruling or ready

2026-09-29 21:12:28 -04:00

CONTRACT-P5B.md

[Docs] (P8): wave 1 integrated - rulings ID-P8-5..13 (the survey, packages A-F, the integration gate, the wave 2 scope and the monolith defects left to P13), the survey note, open questions 9/11/15 answered, the debts and the P8 contract amendments, the P8 README table, PLAN-P8 wave 2 and the status page

2026-09-30 03:09:09 -04:00

CONTRACT-P5C.md

[Docs] (P9 W2): W2-REMINT - no pull protocol, the census, the coverage matrix and the red-once record; design/04 8.4, the P5c/P5e contract amendments, open question 2 and the P7 census attribution

2026-09-29 03:24:03 -04:00

CONTRACT-P5E.md

[Docs] (P8): wave 1 integrated - rulings ID-P8-5..13 (the survey, packages A-F, the integration gate, the wave 2 scope and the monolith defects left to P13), the survey note, open questions 9/11/15 answered, the debts and the P8 contract amendments, the P8 README table, PLAN-P8 wave 2 and the status page

2026-09-30 03:09:09 -04:00

CONTRACT-P6.md

[Docs] (Debts): the debt review - drop the closed E1, DualBlock and GetCaps-blobref rows (open question 24 closed, the blobref rule now a CONTRACT-P5 row-18 invariant), move the unmeasured M2 note to MEASUREMENTS, rewrite HyperOS / P11 RSS / named refusals, split the P12 row, merge the two CI rows, add three B2 rows, and mark each destination as needing a ruling or ready

2026-09-29 21:12:28 -04:00

CONTRACT-P7.md

[Docs] (P8): wave 1 integrated - rulings ID-P8-5..13 (the survey, packages A-F, the integration gate, the wave 2 scope and the monolith defects left to P13), the survey note, open questions 9/11/15 answered, the debts and the P8 contract amendments, the P8 README table, PLAN-P8 wave 2 and the status page

2026-09-30 03:09:09 -04:00

CONTRACT-P8.md

[Docs] (P8): CONTRACT-P8 (the rules P8 landed, each with its code anchor and its test), rulings ID-P8-14..18 (MD + MF and the create-indirect fixture's alignment, SE, SV, the dev merge, the wave 2 integration gate) and the debts wave 2 hands on

2026-09-30 07:55:50 -04:00

CONTRACT-P9.md

[Docs] (P9): close the phase - the contract's remint section and invariants, rulings ID-P9-11..12 with the integration gate, the roadmap row, the debts P9 hands on, the phase README and the status page

2026-09-29 03:36:45 -04:00

CONTRACT-P10.md

[Docs] (P10): close the phase - CONTRACT-P10 sections 2-3, rulings ID-P10-1..14 with the integration gate, C-MEASUREMENTS (device fence bench, loopback credit 1/2/3, the retrace round-trip census), the roadmap row, the debts P10 hands on, design/09, the phase README and the status page

2026-09-29 05:29:00 -04:00

CONTRACT-P11.md

[Docs] (P11 B2): T0 is the default (the user, 2026-09-29) - CONTRACT-P11 B2's tier table, unset versus 0, the revision-5 fix-up; the knob rows in design/09

2026-09-29 20:15:29 -04:00

CONTRACT-P12.md

[Docs] (P12): close the phase - the contract, the disposition of every leftover item, a G1 line that only compares same-machine builds, and the doc citation the docs reshuffle broke

2026-09-29 01:05:45 -04:00

CONTRACT-P65.md

[docs] (P7): record the f2-auth pre-auth knobs, the closed exposures and the debts left

2026-09-23 13:45:23 -04:00

FatalFamilies.def

[MG_Remote, MG_Test, scripts] (P12): the server's own window - ServerDisplay (an opaque window with hooks, a lease, a bounded Detach), the ServerOwned arm with the one-mode-per-session latch and the named no-display refusal, the lost-window release on the apply thread and the ServerWindowLost family

2026-09-23 23:55:23 -04:00

FatalFamily.h

[MG_Remote] (P6/dl): the Fatal-family vocabulary as a table, projected onto the wire's seven codes

2026-09-21 21:33:05 -04:00

FatalFunnel.cpp

[MG_Remote] (P12): the in-process display server - RunSession returns its exit code, TcpSupervisor hands authenticated sessions to threads (Busy, ResetSessionLatch between sessions, the backend pinned for the process, a non-blocking stop), and forked session children die with their supervisor (PR_SET_PDEATHSIG)

2026-09-23 23:55:23 -04:00

FatalFunnel.h

[MG_Remote] (P12): the in-process display server - RunSession returns its exit code, TcpSupervisor hands authenticated sessions to threads (Busy, ResetSessionLatch between sessions, the backend pinned for the process, a non-blocking stop), and forked session children die with their supervisor (PR_SET_PDEATHSIG)

2026-09-23 23:55:23 -04:00

Handshake.h

[MG_Remote, MG_Test, ci] (P7): a TCP session's data connection is bound to its authenticated control connection by a 128-bit Welcome.dataNonce instead of by arrival order, so a reordered or stale data connection is refused by name and the wire fingerprint moves with the control schema

2026-09-22 21:00:57 -04:00