vgsp: once-only op execution per entry identity, per-op done bitmap

The pump's operand-targeted-scan hold decodes a push, runs every op that
translates, then leaves the entry pending for a retry. The retry
re-decoded the whole push and re-ran the operations that had already
completed. A CE copy reads a client staging buffer the client refills
per chunk, so the retry overwrote a finished chunk with the following
chunk's data (observed: the bridge's vadd input half replaced by the
next 1 MB chunk, first half of the device buffer byte-identical to the
source shifted by exactly 2 MB; the same 1 MB copy logged twice with
different staging contents).

The service now records, per GPFIFO slot, the entry identity plus a
bitmap of the decoded operation indexes whose work has executed for
that identity, and a complete flag for a pass that ended with no
operand pending. svc_run_ops skips already-executed ops on a retry and
marks the rest as they succeed; the pump stores the record
immediately after decode, before any hold path can break, so the
pending path can no longer lose it. A replay of a complete identity
suppresses all ops; a partial identity retries only what is owed.

Also carries the ops_once diagnostic counter in the service snapshot
line and documents the operation-granularity rule in the architecture
doc.

1 files changed, 13 insertions, 0 deletions

diff --git a/docs/03-architecture/06-host-module-and-hybrid-model.md b/docs/03-architecture/06-host-module-and-hybrid-model.md
index dbf0c00..73349e8 100644
--- a/docs/03-architecture/06-host-module-and-hybrid-model.md
+++ b/docs/03-architecture/06-host-module-and-hybrid-model.md
@@ -256,6 +256,19 @@ pipeline:
 The same page-granular discipline already applies to the host-side bridge
 read/write helpers and to semaphore I/O.
 
+Rule 1 holds at *operation* granularity as well as per entry. A push whose
+decode finds one operand still under targeted translation is left pending and
+decoded again on the next pass; the operations that already ran before the
+hold must not run again. The service therefore records, per slot, the
+identity of the entry plus a bitmap of the decoded operation indexes whose
+work has executed for that identity. A retry skips those operations and only
+re-attempts the ones that did not run; once a pass completes with no operand
+left pending, a replay of the identity suppresses all operations. This
+closes the hole where a held-and-retried entry re-ran a completed 1 MB
+staging copy after the client refilled the staging buffer, overwriting a
+finished chunk with the following chunk's data (observed once in fourteen
+live cycles before the fix).
+
 ## 5. The forwarding path (design)
 
 ```