vgsp: rescue the direct-GL draw-state pushes from the LOW fb band, admit them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28)HEADmaster

The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead
90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are
intermittently unreadable while byte-identical copies park in the LOW
framebuffer; the copies do not share the VA's in-page offset, so the
page-stepped rescue scan could never land on them. Add a word-granular
LOW-band sweep gated on the two recognisable push images (state lead via the
method-stream window gate; 256-B VTG SPH upload by exact signature) and pin
hits exactly like the existing rescue.

The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80,
NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT
opener, so they never opened a C597 section and the state stream never
reached the replay lane; admit the 0x21C lead as an opener on beef channels
and exempt state-led windows from the eng25 colour-target guard (the guard's
data-blob rejects continue unchanged - only the invariant state lead passes).

Where the client's 0x114 IRAM upload is not captured (code words stay <= 4
on every boot observed), the forced golden overlay (sema_gl_mme_golden +
_force; golden-only, fail-closed) can serve every called macro slot; add
gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion
while it holds (see the golden-slot/pack machinery).

Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH
256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section,
captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the
bypass the lane submitted it to the engine for the first time (GR LAUNCH
submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN
slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0
clear runs (marked window 81), so pixel stores remain 0 and frames black;
receipts under /tmp/opencode/eng28-*.

Refs: CONT.490.

0 files changed, 0 insertions, 0 deletions