Freeform→fullscreen cycle wedges the weave: page renders 60fps but woven output stays black until process restart (blocks next Android release)

[dfattal]

RELEASE BLOCKER for the next Android browser release. Found during on-device
verification of #185 (option 1b); 100% reproducible on NP02J.

Repro (100%)

1. Open hello-cube fullscreen → weaves correctly (origin (0,60) trusted, crisp).
2. Drag into the OEM freeform mini-window → correct 1b behaviour: submits refused,
   tile drawn mono, flat cube visible.
3. Return to fullscreen → the woven tile is blank except intermittent bursts of
   correct content. 100% of attempts.

Evidence chain (all collected live in the broken state)

• The page is healthy: DevTools probe of the visible tab measured
  raf=91/1.5s (60 fps), visibilityState=visible. The page renders the cube
  every frame.
• The pipeline "looks" healthy: 12 s samples show weave submits flowing,
  weave refused: 0, weave failed: 0, withheld: 0, recovery draw: 0, and the
  occlusion composite drawing every frame: drawn=1 skipped=0 (mailbox=ok size_ok=1)
  at the correct 2560x1540.
• The scaled flag transitions correctly: container SCALED … weave refused
  during freeform, container unscaled — weaving re-enabled + origin (0,60) 2560x1540 on return. No flapping.
• Scrolling the page does not recover (rect change → no band-change logs fire,
  still blank).
• A full page reload does NOT recover — a new document + new session on the
  same GPU process stays blank while submits continue.
• A browser force-stop DOES recover — fresh process weaves perfectly.

So: page renders at 60 fps → its pixels never reach the woven output; the wedge is
per-GPU-process state that survives page/session teardown, created by the
freeform (1080x1685, refused-submit) episode and the resize back to 2560x1540.

Hypotheses, ordered

1. Staging buffer bookkeeping off-by-one. The "intermittent bursts of correct
   content" is the tell: if the staging is multi-buffered and the refusal period +
   resize desynchronized write-index vs submit-index, the browser writes buffer A
   while submitting buffer B — aligning occasionally = bursts. Survives page
   reload (process-global), cleared by process restart. Check the staging
   alloc/realloc path in skia_output_surface_impl_on_gpu.cc and what
   WeaveRectAndroid returning false (→ handoff_failed) leaves behind in
   st.* / batch_last_copied_ across a resize.
2. Stale input import runtime-side: the runtime caching an imported
   AHardwareBuffer image keyed by handle across the freeform-size reallocation,
   weaving a stale/black input while output realloc (size_ok=1) succeeded.
3. Keep-previous machinery (web#12/0074) latching cleared-buffer copies across the
   refusal+resize sequence.

Why this blocks the release and nothing else

• The wedge requires the 1b refusal path (patches: 0123 option 1b — refuse the submit, not the arm; scaled tiles draw mono (#128) #185) + a container-scale cycle — no
  released browser has either.
• The shipped legs are unaffected and safe: runtime v2.14.12 + plug-in v2.6.6 with
  the released browser 0.1.22 takes the compat path bit-for-bit (origin 0 →
  old inverse), verified in #208's matrix.
• Fix this, re-verify the freeform→fullscreen cycle on device, THEN cut the
  browser release with patch 0123.

Diagnostics that exist for the next session

--inline-3d-bufdump and --inline-3d-lagprobe (diag patches on the box's
android-capture branch) render in-frame previews of both weave buffers — purpose-
built for exactly this class. The box tree also carries the tree commit
5eb469a1d6ea2 (branch fix/128-true-window-origin) this reproduces against.

Repro state achieved with: runtime v2.14.5-stamp (v2.14.10 content) + root-swapped
plug-in @ #208 + browser build of patch 0123 (option 1b), NP02J, Android 13.

[dfattal]

Mitigated for release (PR #187, merged): the scaled refusal is now behind --inline-3d-refuse-scaled, default off — the default weaves a scaled container (double image, identical to every shipped release), and David verified on NP02J that the freeform→fullscreen cycle recovers cleanly with the refusal off. This unblocks the release train; this issue stays open as the debugging track: re-arm the refusal via the device flags file and use --inline-3d-bufdump (box branch android-capture) to test the staging-index-desync hypothesis. The wedge itself is still unfixed — the switch just keeps it out of users' hands.