MobileGL/docs/archive/notes/p3a/INTEGRATOR-DECISIONS.md

P3a integrator decisions (feat/disaggregated, 2026-09-08)

ID-1 The base ref is 44c2b5cf, not the brief's 55d2af9b

BRIEF-P3A.md was verified at 55d2af9b. P2 landed four more commits before P3a started: c73ae7d4 (pins MOBILEGL_PIPE_PUSH=0x7f in the itest Handles lanes: MG_IntegrationTest/CMakeLists.txt), a9778eaa + 738b289d (the ABA generation-coverage fix: MG_Backend/DirectVulkan/Renderer/{MagmaPipeArms.h, VertexInputStateFactory.cpp, VulkanRenderer.cpp}, MG_IntegrationTest/Scenarios/HandleRecycleScenario.cpp (comment), MG_Test/Pipe/CMakeLists.txt

• new MG_Test/Pipe/MagmaPipeIdentityTest.cpp), and 44c2b5cf (docs only). Every P3a tree branches from 44c2b5cf and $BASE = 44c2b5cf in every command the brief writes as 55d2af9b. Brief line numbers are still exact for every file except those seven; a package touching HandleRecycleScenario.cpp, MG_IntegrationTest/CMakeLists.txt or MG_Test/Pipe/CMakeLists.txt re-opens the file before editing. The ~/w7/p3a-before-* baselines were captured at 44c2b5cf (2482 ctest names; pull lib; RenderStateImpl sha d8fd1c48...).

ID-8 Landed so far (feat/disaggregated in ~/w7/pipe, pushed to origin)

• contract c0: 39722687 (tag p3a/contract, packages branch here) rebased onto the P2 docs commits as e01c0ccc — pull symbols 0/0/0/0, unit 1571 x 3, +5 test names. Package branches rebase onto refs/heads/feat/disaggregated (spell branch refs fully: the tag makes p3a/contract ambiguous); the duplicate c0 patch drops out of the rebase automatically.

• contract review v1: ACCEPT WITH MINORS; M1 (Coverage.def target split omits DispatchIndirect/Query) and item 9 (SetVertexBuffers Start+Count policing) go to wire's rework; M2 (GetOrCreate(MGPipeHandle) adopts a stale generation) goes to espryt's e1; item 11 (0x7f-pinned itest lanes need a 0x1ff arm) goes to gates.

• wire v1: db0c93bb / cede041d / e9b4a263 on p3a/wire; review v1 = REWORK (C1 records wiped on every make-current via Tracker.h:192-195's Reset; C2 serials zeroed on reset; M1; c2 zero test coverage; the PipeLiveHostWrites control; RecordAt bound; Blob rule). Rework in flight with a granted waiver to touch Tracker.h:192-195 minimally if the fix needs it (B rebases across it).

• espryt v1: 9ae4ec09 / de13c588 / 855272e5 / 469f78b8 / a9a1d0eb / 203120fa on p3a/espryt; legacy arms 461/461, default arm 202/461 red all attributed to the stub applier (expected until wire+client land); review v1 in flight. Accepted-in-principle deviations: g_pendingFetchBaseInstance/ScopedFetchBaseInstance stay under MOBILEGL_PIPE_LEGACY_MEMOS (deleting them is a G1 break, so C.2's "grep empty" line is not achievable in P3a - D.5 must say so); MGPipeSetResourceOps installed from RegisterBufferBackendOps; the fp64 stream's SyncGpuWrites stays frontend-side (D-N) - DoublePrecisionScenario is a post-rebase watch item. espryt review v1 = REWORK: C-1 the draw-clean test replaced IsMapped() with HasLiveHostWrites (pinned false => mapped non-adopted buffers never resync), C-2 a cached raw hostBytes base dangles after adoption/resize (fp64 narrowing UAF, undeclared pool gate), majors: contract M2 unaddressed, attribute walk bounded by AttributeCount drops the disable arm, bit 8 without bit 7 advertised but non-functional, PipeLegacyMemos ignored by the new arms, memo safety silently depends on wire's serial rule. Rework in flight (rebases onto 5cb826b0 first, ID-9/ID-10/ID-11 applied).

ID-8b wire integrated: feat/disaggregated = 12e6bfcf (pushed)

wire v2 (six commits: c1 45c8f1a8, c2 6eb0e675, c3 355c60b9, then the rework 56366331 / e6452ce9 / 12e6bfcf) rebased onto 5cb826b0 and fast-forwarded; pull symbols 0/0/0/0 against the 5cb826b0 baseline, unit 1599 x 3, G2 0, G14 0 removed / +17. Applier rule from here on: object records survive make-current; only MGPipeApplierReleaseObjectRecords (unwired in monolith) drops them; refusals are counted; serials only advance; one Blob rule (0 = not declared). Client's rework runs against this tree.

ID-8d client integrated: feat/disaggregated = 31e370be (pushed)

Between wire and client two version bumps landed on the branch (42d43af2 gradle 26.09, b9eaa474 CoreVersion 26.9), so the G1/G14 baseline was re-captured at b9eaa474 before the merge. client v2 (eight commits, rework d9bde131 / f11e78b0 / 0c555605 / 31e370be) fast-forwarded; pull symbols 0/0/0/0, unit 1617 x 3, G2 0, G14 0 removed / +18; client's own tree had integration-gpu 920 x 3 arms, integration-verify 832, retrace 79/79 verify-armed zero divergence. espryt v3 (verification round on this tree) in flight; gates integrates after espryt.

ID-8e all four packages integrated: feat/disaggregated = 3e298c9a (pushed)

espryt v3 (3c55e027 + the integrator's BufferTest fixture commit 83302ca2 — ID-14 below) then gates v2 rebased and fast-forwarded (3e298c9a). On the finished tree: pull symbols 0/0/0/0 vs the b9eaa474 baseline, G5 ten functions byte-identical vs 5cb826b0 AND vs 44c2b5cf, G5 self-test, unit 1619 x 3, G2 0, G14 0 removed / +58, HandleRecycle (verify) 60/60, mpr + ResourceSubsystemControl (push) 34/34, G7 tripped naming IsBgra. espryt v3's real-path round found and fixed three seam defects (vertex buffer resolved by GL binding point instead of attribute index; a stale descriptor consulted for the shadow on full re-upload; the shadow base not published for a lazily twinned store) - the verification round was load-bearing. In flight: the full five-part gate (three retrace sweeps) on ~/w7/pipe, the final whole-diff review (5cb826b0..3e298c9a), the pull/push trace APKs for the D.4.2 device A/B, and the P3a docs.

ID-14 Ownership waiver: MG_Test/Buffer/BufferTest.cpp's fixture

C.5 gives that file to nobody. Under a push build the backend installs both BufferBackendOps and MGPipeResourceOps at bring-up, so ScopedBackendOps (which scoped only the former) let 26 of the 86 BufferBackendOps dispatch cases route into the pipe. The integrator landed the one-scope fix espryt-v3 §7 measured (83302ca2): the fixture now saves/nulls/restores the pipe table exactly as ResourceEmitTest's ApplierGuard scopes the applier. It weakens nothing (the pipe-side dispatch has ResourceEmitTest's own coverage). Follow-up for a later phase: a pipe-shaped mock so the same 86 assertions run over the handle path.

ID-15 Final whole-diff review = REWORK; C-2 ruling supersedes ID-13's "outside any #if" sentence

Full five-part gate on 3e298c9a: all green (G1 0/0/0/0, G5 byte-identical vs 44c2b5cf and 5cb826b0 + self-test, HandleRecycle 60/60, unit 1619 x 3, G2 0, G14 0/+58, integration-gpu 958/958 x {0x1ff, 0, 0x7f} + the ESPRYT_DISABLE_INVALIDATE_FLUSH arm, buffer/VAO family 202/202, g7 + G7 tripped, CsoContentAddressing + ResourceSubsystemControl 10/10, controls 64/64, integration-verify 842/842 zero Fatal, retrace verify 79/79 armed zero Fatal, retrace push 79/79). The G3b named sub-sweep matched 0 cases because retrace_gate.py --only is a regex and the gate script passed a comma list (fixed in wsl_p3a_gate.sh; the five cases passed inside the full sweeps). final-review-v1: C-1 the client-minted VertexElementsCso slot has no backend-neutral death path (Magma installs no death ops: leak per VAO at 0x1ff, Fatal past 65536 slots); C-2 FlushPendingRangesNow sits inside the pull-only #else, so push builds compile only FlushPendingRangesFrom and G5's text hash does not cover the shipping ladder. Ruling for C-2: FlushPendingRangesFrom becomes the ELEVENTH G5 row with its own baseline sha (captured at 3e298c9a); FlushPendingRangesNow stays byte-identical where it is (G1 is what protects the pull build); the two-arm shape is stated at Managers.cpp:1127-1138. M-3 (the fp64 stream's dropped SyncGpuWrites site) is a RULED deviation for P3a. The rework runs on ~/w7/p3a-final (branch p3a/final from 3e298c9a); it lands as the last P3a commits. The device A/B and the bench are recorded against the 3e298c9a APKs (the rework is lifecycle/seam correction, not a cost change) - the docs say so.

ID-9 dev merged mid-phase: feat/disaggregated = 5cb826b0 (pushed), baseline re-captured there

dev@9eae9858 (two commits past our P2 base: d7655247 rebinds VAOs when an adopted store is respecified - a 5-line fix in Managers.cpp's immediate retire path - and 9eae9858 adds the persistent-buffer ordering POST probe) was merged into ~/w7/pipe as 5cb826b0 right after the contract, so every remaining package rebases across it once. The ~/w7/p3a-before-* baseline is now the pull build of 5cb826b0 (2502 ctest names, 1582 unit); G1 for every later package is measured against that. Consequences: espryt's rebase conflicts in Managers.cpp and the d7655247 fix must be present in BOTH the legacy and the handle arm of the respecify/retire path (the handle arm duplicates that core); gates' rebase conflicts in LargeArenaAdoptionScenario.cpp (dev added cases there, gates added the mpr assertions and the second arena) - resolve by union, keep every test name from both sides. wire and client do not touch those files.

ID-10 Ownership grant: the three *BaseInstance draw entry points in MG_Impl/GLImpl/GL_Drawing.cpp

The brief's ownership table gives MG_Impl/GLImpl/** to nobody, yet D-H2 needs MGPipeSetPendingBaseInstance called from the three glDraw*BaseInstance entry points (client-v1 finding 1: no call sites, so the emitted BaseInstance is always 0). Package B's rework is GRANTED those three one-line call sites (and nothing else in GL_Drawing.cpp); the reset in MGPipeLeaveVerb stays B's. Until they land, espryt's handle arm reads a VertexFetchBaseInstance of 0 - the DrawParameters / VertexAttribBinding base-instance scenarios are the gate that must go red without the call sites and green with them, and the integrator checks both directions once on the finished tree. client v1: 73bab3d6 / 1ae6b4f4 / 71805d59 / a0ac79cc on p3a/client; review v1 in flight.

ID-11 G5's byte-identical set is ten functions

The brief's G5 row names nine (IsPoolable, EnrollIntoPool, AcquireFromPool, TrimBufferPool, ClearBufferPool, ProcessDeferredBufferReleases, CreateRingStorage, RingAvailable, RingAllocate) but its text (BRIEF-P3A.md:420, :1708) twice calls FlushPendingRangesNow G5-protected and names it as the only mitigation of the tier-drain p99 risk. Decision: FlushPendingRangesNow is the tenth. The handle arm must call the untouched function; a copy under #if MOBILEGL_PIPE_PUSH is a G5 break espryt's rework restores. gates v1: 1ef91dec / 588d25e9 / 80f6bf1b; review v1 = REWORK (four majors: three CSO stats lanes still pinned 0x7f, the ResourceSubsystemOn/Off entries unreachable from CI's -R, the G7 script not rebuilding on its "did not trip" exit, FlushPendingRangesNow missing from G5); rework in flight, rebasing onto 5cb826b0 first and undoing the second-arena workaround that d7655247 makes unnecessary.

ID-12 client review v1 = REWORK; cross-package items

B-C1: Tracker.h:373 zeroes m_pendingBaseInstance in Reset() (called on every make-current) - delete the line. B-C2: no re-publication path for resource records after MGPipeApplierReset - resolved together with wire's rework C1: the applier keeps resource/vertex-elements records across make-current and clears them only at context destruction; the client therefore needs no re-publication on FreshlyPrimed, but must state that as the rule (not "absence as policy") and cover context destruction (ResourceDestroy from ~BufferObject is the only path). The client rework starts after wire-v2.md exists and reads it first. Majors for the client rework: the three call sites at GL_Drawing.cpp:662/684/713 (ID-10); Acquire mutating the global slot allocator on Espryt's off-thread SubData path; the sampled BindMask's DSA hole; the absent UnmapPersistent producer (record it or add it). Cross-package: the hostBytes base-vs-base+offset mismatch - B is brief-conformant, espryt must change (goes into espryt's post-rebase verify round, ID-13 when opened).

ID-13 G1 vs G5 on FlushPendingRangesNow: one untouched definition, a separate handle-arm ladder

gates v2 (2bafb316, 8 commits on 5cb826b0; rebased clean, D6 undone, M1-M4 closed, G5 = ten functions) reports G5 rc 2 against espryt (cdbd5535): espryt's push arm redefines FlushPendingRangesNow as a 3-line forwarder onto a new FlushPendingRangesFrom ladder (Managers.cpp:1051-1127), the original body living only in the #else copy. Decision: FlushPendingRangesNow is defined exactly once, outside any #if, byte-identical to 5cb826b0 (that satisfies G1 for the pull build and G5 for the text). The handle arm gets its own FlushPendingRangesFrom(...) under #if MOBILEGL_PIPE_PUSH that takes the record/twin instead of the frontend object; duplicating the tier ladder there is accepted for P3a (the same shape espryt already used for the respecify core; the legacy copy retires at P13 - ARCHITECTURE.md:367). The pull arm never calls the new one. A shared template over an accessor interface is NOT acceptable: it resizes the pull symbol (G1). espryt's post-rebase round applies this; gates' G5 must then be rc 0 against espryt's tree.

ID-8c espryt v2 = 6a1a9bc7 (16 commits on 5cb826b0), gates v2 = 2bafb316 (8 on 5cb826b0)

espryt v2: rebased onto 5cb826b0 (trap: the three-way merge put d7655247's ++g_bufferBackendIdGeneration into the legacy arm only; fixed, both arms symmetric), C-1/C-2/M-1..M-5 closed, ID-11/ID-13 satisfied (one definition of FlushPendingRangesNow, ten byte-identical), legacy arms 463/463, default arm 204/463 red with the identical failing set before and after (stub-applier attribution still expected until client lands). Next for espryt: after client integrates, a verify round on the rebased tree (default arm, buffer/VAO family, DoublePrecision, base-instance scenarios both directions per ID-10, retrace), then a focused re-review.

ID-2 Integration order: contract -> wire -> client -> espryt -> gates

The brief's D.1 order with wire inserted after contract: client's emissions land in the applier's records only once wire's apply bodies exist, and espryt reads those records. wire is behaviour-neutral on its own (nothing registers MGPipeResourceOps until espryt).

ID-3 Tool ownership

~/w7/notes/tools/wsl_p3a_gate.sh and p3a_ab.sh are written by the integrator, not by package D; package D's deliverables are the two scripts/p3a_*.sh in the repo, the scenarios, the itest CMake rows and test.yml. Tree creation is wsl_tree.sh p3a <slug> <base> [verify], integration wsl_integrate.sh p3a <slug>... (generalised P2 helpers; the phase is a parameter, not a copy of the script).

ID-4 Models and rounds

Package agents and reviewers run on opus (user rule 2026-09-08: fable only for genuinely hard single items). One adversarial review per package, at most two rework rounds; declared minors do not block integration.

ID-5 Durable locations

Brief ~/w7/notes/p3a/BRIEF-P3A.md; scouts ~/w7/notes/p3a/scout-*.md; package results and reviews ~/w7/notes/p3a/p3a-results/<package>-v<N>.md and <package>-review-v<N>.md; A/B artefacts ~/w7/notes/p3a/ab/. Package logs under ~/w7/p3a-<slug>-*.log are deleted by their owner when the round ends.

ID-6 Performance is recorded, not gated (user, 2026-09-08)

Part 4 of the five-part gate and ROADMAP.md:19's "MC 26.3 在 Adreno 上 p99 不变" are measure-and-publish items against P2's pull baseline (MEASUREMENTS.md §10-§12). Parts 1, 2, 3, 5 stay hard gates.

ID-7 Working over UNC and WSL

Package agents edit their worktree through //wsl.localhost/Arch/home/swung/w7/p3a-<slug>/... with the Read/Edit/Write tools (file writes work; mkdir does not - create directories from a WSL script). Builds and tests run through a script file: write <scratchpad>/wsl/<name>.sh (LF endings) and run MSYS_NO_PATHCONV=1 wsl.exe -d Arch -- bash /mnt/c/<scratchpad path>/wsl/<name>.sh; never pass ~ or $vars inline to wsl.exe. A build or test run longer than ~8 minutes is launched with setsid nohup ... & inside the script and polled through its log.

ID-16 CI reds on 42d43af2 / b9eaa474 / 31e370be are GitHub artifact-download flakes

Every failing job is a retrace/retrace verify matrix entry whose "Download Linux runtime" / "Download trace fixture" step died with digest-mismatch and Artifact download failed after 5 retries; no build or test step ran red. 12e6bfcf (wire) was green on the same tree family. The failed jobs of the 31e370be run were re-run; 83302ca2 and 3e298c9a are queued behind them. A red of this shape is not a code signal (the user's rule: only real retrace reds after a successful download matter).

ID-17 P2's device A/B APKs were unoptimised; the Release baseline of record is P3a's pull arm

The P3a pull APK's libMobileGL.so (Release, arm64) is 15.5 MB with a 9.4 MB .text; the P2 A/B's pull APK (~/w7/notes/p2/apk/trace-pull.apk) is 43.2 MB with a 21.8 MB .text, same clang 18.0.4, no .debug_info in either - a 2.3x larger .text is an unoptimised (Debug-flavour, -O0) build, and it replays 26.3 on the Oppo at 42 ms/frame CPU where the Release build takes 9.7 ms. So MEASUREMENTS.md §10's absolute numbers and its +8-18% deltas are -O0 readings (the tracker's inline-heavy code pays most at -O0). Decision: the P3a A/B on the 3e298c9a Release APKs is the two-device baseline of record; its pull arm is symbol-identical to the P2-era pull path (G1 across P3a; only d7655247's 5 lines differ from 44c2b5cf). To re-derive P2's own cost at Release, a supplementary arm runs the SAME push APK with --env MOBILEGL_PIPE_PUSH=0x7f (P2 subsystems on, P3a off) = the device-side T2 (p3a_ab_7f.sh, nofinish only, its own reboot-clean session). The docs get an erratum on §10 and the corrected table; the user is told that the "~10% is acceptable" call was made on -O0 numbers. wsl_build_trace_apks.sh prints the lib size so an -O0 APK can never pass unnoticed again (Release .text ~9.4 MB).

ID-8f final rework integrated: feat/disaggregated = c20e2f2b (pushed) = the P3a landing hash

p3a/final (12 commits on 3e298c9a, final-v2.md) fast-forwarded: pull symbols 0/0/0/0 vs b9eaa474, G5 eleven functions byte-identical vs 3e298c9a AND the ten vs 5cb826b0, unit 1622 x 3, G2 0, G14 0 removed / +69, HandleRecycle+VertexElements+Leak (verify) 76/76, Magma CrossFrameBuffer verify 13/13 locally. Open: the CI-only teardown double free or corruption on DirectVulkan.Verify.CrossFrameBufferScenario.{Vertex,Index} CopyBufferSubData (3e298c9a run and its re-run; ASan reproduction in flight on a private worktree) - whether c20e2f2b's lifecycle fixes change it is answered by c20e2f2b's own CI run. Docs: P3ALANDHASH -> c20e2f2b; the device A/B and the bench remain recorded against the 3e298c9a APKs (ID-15/ID-17).

ID-18 The CI-only teardown abort is a static-destruction-order UAF at exit; fix = never-destroyed singletons

asan-doublefree-v1: exit -> PipeInputs::~PipeInputs (namespace-scope gPipeInputs holds a SharedPtr) -> ~VertexArrayObject -> ~BufferObject -> MGPipeEmitResourceDestroyAndFree -> MGPipeSlotAllocator::FindByLifetimeId on a hash table already freed by ~MGPipeSlotAllocator (MGPipeSlots() is a Meyers singleton constructed at the first buffer, so it dies first). Every case executes the chain; only when the freed table still resolves does Free() write freed vectors and glibc reports double free or corruption - CI's allocator layout did, ours did not (native repro: GLIBC_TUNABLES= glibc.malloc.tcache_count=0 makes exactly the two CI cases fail on c20e2f2b and none on the fix). Fix (p3a/asan, rebased onto c20e2f2b as d54ec57a): MGPipeSlots(), MGPipeResourceTrackerInstance() and g_applier become never-destroyed (heap-constructed, intentionally leaked at exit); the C-1 rework's second reaching path (MGPipeEmitVertexElementsDestroyAndFree from ~VertexArrayObject) is covered by the same change. Integrated after the P3a bench finishes reading pipe's libraries.

ID-19 P3a DriverBench (desktop, c20e2f2b libs) - recorded, not gated

mc_vanilla_draw ns/draw: Espryt pull 5115 / push(0x1ff) 6162 / push(0x7f) 5463 / push(0) 5693; Magma pull 17099 / push 17709 / push(0x7f) 17287 / push(0) 17739. T1 = +1048 (+20.5%) / +611 (+3.6%); T2 (0x7f = P2's boundary) = +349 / +189; P3a itself = +699 / +422 ns/draw - the largest boundary cost so far (per-draw vertex-input emission + applier record + Espryt's record walk; Magma's share is pure client emission until P7). blend-toggle +5.2% / +2.8%; pass switch ~0; CSO content addressing ~0. Goes into the optimisation-phase list (per-draw suppression of unchanged vertex-input sets; in-place applier record updates). Device side (Release APKs, 3e298c9a): Oppo 26.3 Espryt +8% / Magma +10%, rd12 +30% / +27%, sodium ~0 (sub-ms frames), create-instancing is a 2-frame fixture (not a benchmark). 0x7f arms and the Xiaomi pass in flight.

ID-20 CI Test lane green at c20e2f2b

The lifecycle changes of the final rework moved the allocator layout enough that CI's two teardown aborts (3e298c9a) no longer surface at c20e2f2b - not a fix, a layout change; the systematic exit-order closure (ID-18 + the 21 knob-only cases) lands as the last P3a commits on p3a/exit and is proven with GLIBC_TUNABLES=glibc.malloc.tcache_count=0 on both lanes before the docs push.

ID-21 exit-order closure integrated: feat/disaggregated = fde5fda3 (pushed) = the P3a landing hash

p3a/exit (6515c8e6 leak-at-exit storage for the four static PipeInputs holders; fde5fda3 the four remaining MGPipe singletons never-destroyed) on d54ec57a, fast-forwarded. On pipe: pull symbols 0/0/0/0, G5 eleven byte-identical, unit 1622 x 3, G2 0, G14 0/+69, and with GLIBC_TUNABLES=glibc.malloc.tcache_count=0 integration-verify 844/844 and push integration-gpu 966/966. Follow-up outside P3a: IntegerBorderColorScenario's stack-buffer-overflow (pre-existing test bug, ASan). Docs: landing hash -> fde5fda3.

ID-22 CI at fde5fda3: every build/test job green; the run is red only in "remove artifact clutter"

Its "Delete intermediate Linux retrace artifacts" step died on a GitHub HTTP 504 from gh api --method DELETE (housekeeping after all tests passed). Not a code signal. The Test lane's authoritative jobs (pipe-gates, include-graph-check, test, integration, build-linux-verify, integration-verify, retrace, retrace-verify, monolith-symbol-report) all succeeded on the P3a landing hash.

ID-23 rd12 on Magma on the Xiaomi aborts on every arm (pull included): pre-existing, excluded from the table

scudo map error inside a calloc from libMobileGL (frames 0x818b14 / 0x7e2c44, stripped) seconds after start, with 6 GB available - a giant/negative allocation on the Adreno 830 + Magma path for this fixture, not P3a's (the pull build is symbol-identical to the pre-P3a path). The same fixture runs on the Oppo/Magma and on the Xiaomi/Espryt. Task chip opened (symbolize + fix). Side effect: the GPU pwrlevel pin on the Xiaomi resets after the crash (pin_device reports "range 2..5"), so the Xiaomi's sodium and create-instancing rows after rd12 carry a DRIFT verdict on both arms (still paired). The P2 -O0 Xiaomi table did not include rd12, so nothing is lost against P2.

ID-24 P3a closed: docs at 37da3c3a (pushed); device A/B complete on both devices, three arms

Release APKs from 3e298c9a; pull / P2-only (0x7f) / P3a (0x1ff), nofinish primary. P2's boundary at Release = +6-12% p50 on both devices and backends; P3a adds ~0 on 26.3 and sodium but +17-19 points on rd12 (Espryt +30%, Magma +27% total) - per-draw vertex-input emission on VAO/buffer-heavy frames; MC 26.3 p99 on Adreno pull 25.46 -> P3a 26.32 ms (+3.4%). mpr on device: 26.3 = 8 per run, sodium 1. Excluded: Xiaomi rd12/Magma (pre-existing abort, ID-23), create-instancing (2-frame fixture), sub-ms sodium rows (noise). Artefacts: ~/w7/notes/p3a/ab (60 benchmark.json) and ab7f (15), ab3-final.md; bench ~/w7/notes/p3a/bench/driverbench.md. Next: P4a (handle wave 2: FBO / texture / sampler / program). Optimisation-phase list carries: the per-draw vertex-input emission cost, IntegerBorderColorScenario's ASan finding, rd12/Magma/Adreno abort, the harness pidof single-sample kill, create-indirect on dev.