vgsp-gr: move win0 shadow pool clear of the data bounce window (matmul C rows 0..31)

m150 grew the GR data bounce window to 208 pages at main-PT slots
0x110..0x1df but left the win0 QMD shadow pool at VA 0x190000 (slots
0x190..0x197) - inside the new window. The win0 plant is unconditional on
every gsp_phys_rmcall_pdb_build() and runs after the one-shot bounce
plant, so it hijacked the PTEs for bounce pages 128..135, which hold the
first 8 pages of the third operand. victory_matmul's C rows 0..31
(8 pages x 256 floats = 8192 elements) were written into the shadow pages
and lost: MATMUL bad=8192, copy-out '56 changed by engine (first bi 136)'.

Move GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE to 0x1e0000 (slots 0x1e0..0x1e7),
directly above the last bounce/mail/marker page (0x1df000) and below the
0x200000 guest scratch window; both the plant and the launch-time shadow
VA derive from the macro. Add a static_assert so any future bounce growth
cannot silently re-introduce the overlap, and correct the stale slot-range
comments/logs (0x108..0x10f -> the current range).

Evidence: /tmp/opencode/dmesg-r143-mailmatmul.log (main PT[190..197] =
win0 chunk DMAs; 'window[160] reloc=0x1b0000 changed=1', 'window[128]
reloc=0x190000 changed=0'; MATMUL bad=8192). Live validation pending: a
fresh cycle's victory_matmul must print bad=0 STATUS OK.

2 files changed, 59 insertions, 10 deletions

diff --git a/STATE-CURRENT.md b/STATE-CURRENT.md
index fc210fb..d62b16b 100644
--- a/STATE-CURRENT.md
+++ b/STATE-CURRENT.md
@@ -189,6 +189,33 @@ isolation, performance, portability).
      repeat-run plus concurrent/simultaneous validation. Active front:
      the multi-client battery on the physical backend plus launch-latency
      robustness.
+     **Update 2026-10-14 ~15:40 (afternoon wave, r140-r143):** the full fix
+     set is committed and pushed (HEAD `17393a74`: ring depth `074f493c`,
+     scrubber `624438bb`/`80af379d`, bounded fresh-entry launch retry
+     `6b090f70`, 208-page budgeted data window `fce5ab8d`/`4a23c196`). r142:
+     c1 `victory_mail` and c2 `smiley` GREEN; c3 `victory_matmul` FAIL
+     (all-wrong operands - the three 256 KB operands resolved only ~32 of the
+     needed 64+ pages each); launch counters `ok=86 failed=10 retries=4`
+     (the retry recovers a subset of the cold-context timeouts silently);
+     then `victory_saxpy`/`memcpy_roundtrip` stalled and the guest SSH wedged
+     - the intermittent stall/wedge class survives. r143 (live at this
+     check, same fix set): c1 green within ~2 min; c3 matmul launched and
+     improved to `bad=8192` of 65536 with a non-zero checksum (operand
+     resolution now 68/64/64 pages) - STATUS FAIL. **Root cause found
+     (sub-agent, evidence-grounded): the win0 QMD shadow pool base was still
+     `0x190000` (main-PT slots 0x190..0x197), which lies INSIDE the enlarged
+     208-page bounce window (`0x110000..0x1df000`); the win0 plant runs on
+     every `pdb_build()` while the bounce plant is one-shot, so win0 stole the
+     PTEs for bounce pages 128..135 = C rows 0..31 = exactly `bad=8192`. Fix
+     landed (unvalidated live at pause): `GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE`
+     moved to `0x1e0000` (slots 0x1e0..0x1e7, above the mail/marker pages,
+     below the 0x200000 guest window) plus a `static_assert` invariant and
+     comment/log corrections.** Ranked next blockers: (1) the 256 KB operand
+     data-path placement; (2) the intermittent client stall/wedge class
+     (the top reliability blocker; needs the stalled-client capture);
+     (3) the cold-context launch race (cold GR-sem pre-warm designed);
+     (4) then multi-mdev, two guests, VRAM sizes and the concurrent/full
+     soak. Host clean, GPU green, no reboots.
 - **Guest frontier: FIRST GREEN END-TO-END GUEST CUDA, NOW UNDER HARDENING
   (2026-10-04 ~16:20; hardening 2026-10-05 overnight).** The emulation-only
   ("no-claim") campaign runs an unmodified guest CUDA program to completion
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 110731d..f83899d 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -999,15 +999,23 @@ bool gsp_phys_boot_requested(void)
 #define GSP_PHYS_RMCALL_VA_DST		(GSP_PHYS_RMCALL_VA_BASE + 3 * GSP_PHYS_PAGE_SIZE)
 #define GSP_PHYS_RMCALL_VA_SEM		(GSP_PHYS_RMCALL_VA_BASE + 4 * GSP_PHYS_PAGE_SIZE)
 /*
- * m69: window-0 shadow pool - 8 module pages at VAs 0x108000..0x10f000
- * (small-PT slots 0x108..0x10f, the same 128 B PTE fetch line as the
- * GPFIFO/PB/QMDWIN slots, planted before the engine's first fetch). The
- * Tier-2 copies of the QMD's program/param pages are placed here so the GR
- * engine never has to read through the window-1 scratch VA range whose PT
- * chain (DMA_UPDATE_PDE_2 pdeIndex=1) has never been proven engine-readable.
+ * m69: window-0 shadow pool - 8 module pages holding the Tier-2 copies of
+ * the QMD's program/param pages, so the GR engine never has to read through
+ * the window-1 scratch VA range whose PT chain (DMA_UPDATE_PDE_2
+ * pdeIndex=1) has never been proven engine-readable.
+ *
+ * The base MUST stay clear of the m114/m150 GR data bounce window
+ * (GSP_PHYS_RMCALL_GR_BOUNCE_VA0 .. +PAGES, main-PT slots 0x110..0x1df):
+ * this pool is re-planted on every gsp_phys_rmcall_pdb_build() while the
+ * bounce PTEs are a one-shot plant, so any overlap lets the later win0
+ * plant steal the bounce slots and the engine writes results into the
+ * shadow pages, losing them. 0x1e0000 (slots 0x1e0..0x1e7) sits directly
+ * above the last bounce/mail/marker page (0x1df000) and below the guest
+ * scratch window (0x200000). Keep it that way (see the static_assert next
+ * to the bounce constants).
  */
 #define GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE \
-	(GSP_PHYS_RMCALL_VA_BASE + 0x90000ULL)
+	(GSP_PHYS_RMCALL_VA_BASE + 0xE0000ULL)
 #define GSP_PHYS_RMCALL_GR_SHADOW0_SLOTS	8u
 /*
  * m99: engine-tree branches for identity-mapping the forwarded kernel's
@@ -2169,7 +2177,7 @@ static struct gsp_phys_boot_stage {
 	/*
 	 * m69: window-0 shadow pool (gsp_phys_rmcall_gr_shadow_win0=1).
 	 * Eight module pages whose PTEs are planted in the proven window-0
-	 * PT line at slots 0x108..0x10f (VAs 0x108000..0x10f000) by
+	 * PT (slots derive from GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE) by
 	 * gsp_phys_rmcall_pdb_build, before the engine's first fetch (same
 	 * pattern as the qmdwin slot). The launch copies the QMD's
 	 * program/param page content into them and rewrites the QMD pointers
@@ -2209,6 +2217,20 @@ static struct gsp_phys_boot_stage {
 #define GSP_PHYS_RMCALL_GR_BOUNCE_SLOT0	0x110u
 #define GSP_PHYS_RMCALL_GR_BOUNCE_VA0	0x110000ULL
 #define GSP_PHYS_RMCALL_GR_MAIL_SLOT	206u
+/*
+ * m150b: the win0 QMD shadow pool must never overlap the bounce window.
+ * The win0 plant runs on every pdb_build() (unconditional) and the bounce
+ * plant is one-shot, so an overlap silently hijacks bounce PTEs and the
+ * engine's results land in the shadow pages (victory_matmul lost C rows
+ * 0..31 exactly this way before 0x1e0000 moved the pool clear).
+ */
+static_assert(GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE +
+	      (u64)GSP_PHYS_RMCALL_GR_SHADOW0_SLOTS * GSP_PHYS_PAGE_SIZE <=
+	      GSP_PHYS_RMCALL_GR_BOUNCE_VA0 ||
+	      GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE >=
+	      GSP_PHYS_RMCALL_GR_BOUNCE_VA0 +
+	      (u64)GSP_PHYS_RMCALL_GR_BOUNCE_PAGES * GSP_PHYS_PAGE_SIZE,
+	      "win0 shadow pool must not overlap the GR data bounce window");
 	/* m99: guest data identity-map table branches (see the PD*_MAX block). */
 	struct gsp_phys_boot_chunk
 		rmcall_gr_data_pd1[GSP_PHYS_RMCALL_GR_DATA_PD1_MAX];
@@ -9399,7 +9421,7 @@ static void gsp_phys_rmcall_pdb_build(void)
 		}
 	}
 	/*
-	 * m69: plant the window-0 shadow pool PTEs (slots 0x108..0x10f) in the
+	 * m69: plant the window-0 shadow pool PTEs (current win0 slot range) in the
 	 * same proven small-PT line, before the engine's first fetch. The
 	 * launch copies the QMD's program/param page content into these pages
 	 * and rewrites the QMD pointers to these VAs, so the GR engine never
@@ -9445,7 +9467,7 @@ static void gsp_phys_rmcall_pdb_build(void)
 					(size_t)idx * 8);
 			}
 			dma_wmb();
-			pr_info("vgsp-boot: rm-call: shadow-win0 pool planted %u pages at VA 0x%llx..0x%llx (small-PT slots 0x108..0x10f, before first fetch)\n",
+			pr_info("vgsp-boot: rm-call: shadow-win0 pool planted %u pages at VA 0x%llx..0x%llx (small-PT slots 0x1e0..0x1e7, before first fetch)\n",
 				GSP_PHYS_RMCALL_GR_SHADOW0_SLOTS,
 				GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE,
 				GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE +