vgsp: host CUDA bridge + sema release recovery; greeneye simulator wave

- kernel: gsp_cuda_bridge (QMD launch capture, debugfs job/out/done, param+output resolution cached from inline writes), sema drain fixes (never hold/starve a channel), GR ring autopin + counter autoreg, per-page push reads, counter-derive gate; module builds clean
- tools/cuda-bridge: CUDA driver-API daemon executing mail/vadd kernels on the physical GPU, CUBB2/CBD2 v2 protocol, layout check + self-tests
- tools/guest-diag + tools/cuda-ab: scanner/pin fixes, victory push-only mode
- debug/risc-v-gsp-rm-vm: Phase S simulator wave (GSP device model, boot ladder, triage/re-demo harnesses, docs 30-41), GPGPU-sim scaffolding
- STATE-CURRENT/docs updates

2 files changed, 391 insertions, 0 deletions

diff --git a/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json
new file mode 100644
index 0000000..4df3593
--- /dev/null
+++ b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.json
@@ -0,0 +1,289 @@
+{
+  "above_qemu_line": true,
+  "features": {
+    "features": {
+      "analyze_compare": {
+        "detail": {
+          "analyze_chars": 444,
+          "analyze_session": "harness/qemu_line/sessions/native-1",
+          "compare_chars": 526,
+          "compare_headers": [
+            "Breakpoint profile delta (A vs B)",
+            "Watchpoint delta",
+            "Written pages delta"
+          ],
+          "compare_pair": [
+            "harness/qemu_line/sessions/native-1",
+            "harness/qemu_line/sessions/native-2"
+          ]
+        },
+        "status": "pass"
+      },
+      "breakpoints": {
+        "detail": {
+          "attached_then_removed": true,
+          "kind": "sw",
+          "run_until_hit": 2147483912
+        },
+        "status": "pass"
+      },
+      "hooks": {
+        "detail": {
+          "cmds": [
+            1,
+            2
+          ],
+          "rpc_dispatch_hits": 1
+        },
+        "status": "pass"
+      },
+      "injection": {
+        "detail": {
+          "blob": "sdk/build/injected_demo.elf",
+          "dir": "harness/qemu_line/sessions/features-inject",
+          "expected": 48814,
+          "hashes": {
+            "events.jsonl": "08ab0874cfad71e0e4565b569d9b0ea5251bf158eaab3cdf17798182e4c66a95",
+            "session.json": "f34b677be0b0b453cdade4487118e059c3dfb5a1010d4e6c2fc8b37a867fb25e",
+            "summary.md": "59a1aa4f2b616d5266d565c4df4b0257d11aab95b09cec80f380e9aca8bfc22f"
+          },
+          "ping_result": 48814,
+          "slot": 6
+        },
+        "status": "pass"
+      },
+      "mcp": {
+        "reason": "native MCP surface is S3's deliverable (plugins/mcp_server.py); S4 must not race that work. Re-run after S3 lands (docs/37).",
+        "status": "not_run"
+      },
+      "memory": {
+        "detail": {
+          "ctrl": 2147485760,
+          "magic": 1196642353
+        },
+        "status": "pass"
+      },
+      "sessions": {
+        "detail": {
+          "dir": "harness/qemu_line/sessions/features",
+          "event_counts": {
+            "bp_hit": 2,
+            "hook": 1,
+            "image_loaded": 1,
+            "mem_read": 2,
+            "mem_write": 4,
+            "session_end": 1,
+            "session_start": 1,
+            "stop": 2,
+            "watch": 1,
+            "watch_hit": 1
+          },
+          "hashes": {
+            "events.jsonl": "a6328cb00287bdf678d9b62d496929fc59190a08af3910b059c840c6bc98462e",
+            "session.json": "2372eea627f31d11f114019759d8d6dc665683bbc88e834f158f56b16fa5c0d4",
+            "summary.md": "6dfca9e61a4f23374b90dbef995d86771130fcf4c2b61dc40aac6d379d4b8706"
+          }
+        },
+        "status": "pass"
+      },
+      "struct": {
+        "detail": {
+          "fields": 14,
+          "schema": "gsp_ctrl.schema.json"
+        },
+        "status": "pass"
+      },
+      "trace": {
+        "detail": {
+          "blob": "harness/qemu_line/sessions/features-trace/blobs/trace.jsonl",
+          "dir": "harness/qemu_line/sessions/features-trace",
+          "events": 4001,
+          "hashes": {
+            "events.jsonl": "36b80ed88205daa8e1bd58536eb274ed4849c3d4b1a05daa0f2c44382c7b764a",
+            "session.json": "a09ec38202c291a5b7a3719434ea785725e291cba2dc877d94cd0caf7fcd1a4e",
+            "summary.md": "10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44"
+          },
+          "max_events": 4000
+        },
+        "status": "pass"
+      },
+      "watch": {
+        "detail": {
+          "pcs": [
+            2147484066
+          ],
+          "result_field_stores": 1
+        },
+        "status": "pass"
+      }
+    },
+    "ran": true,
+    "reason": "ok"
+  },
+  "firmware": {
+    "name": "gsp-570.144.fwimage.bin",
+    "sha256": "2d1bb5c60b208cfd115f015b17dd04a6fece05fd2c0dcba3625d9d48cce3ceea"
+  },
+  "harness": "harness/sim_qemu_line.py",
+  "line_definition": "docs/35-GREENEYE-SIMULATOR-DESIGN.md 1.1 + 3.3",
+  "native": {
+    "backend": "native",
+    "compare": {
+      "chars": 526,
+      "headers": [
+        "Breakpoint profile delta (A vs B)",
+        "Watchpoint delta",
+        "Written pages delta"
+      ],
+      "ran": true
+    },
+    "device_model_used": true,
+    "identical": true,
+    "instructions_budget": 200000,
+    "pair_wall_s": 0.3093,
+    "profile": "sim/profiles/tu104-570.144.json",
+    "ran": true,
+    "reason": "ok",
+    "repeat": 2,
+    "rung": "B2",
+    "rung_basis": "observed S1 boot-ladder rung from sim.gsp_boot (milestones=['bootargs_consumer', 'relocation_copy'], mmio_unknown=0, device_unhandled=0)",
+    "runs": [
+      {
+        "cycle_model": "rv64imac-modeled/1",
+        "cycles": 27294,
+        "device_accesses": 1,
+        "device_state_sha256": "3fa264b9f81081e8455a9cd26c0c2a721e3ac272e1079105a0eb191b1497f83d",
+        "device_unhandled": 0,
+        "first_unknown_mmio": null,
+        "instructions": 14682,
+        "milestones": [
+          "bootargs_consumer",
+          "relocation_copy"
+        ],
+        "mmio_unknown": 0,
+        "rung": "B2",
+        "rung_basis": "observed S1 boot-ladder rung from sim.gsp_boot (milestones=['bootargs_consumer', 'relocation_copy'], mmio_unknown=0, device_unhandled=0)",
+        "session": "harness/qemu_line/sessions/native-1",
+        "session_hashes": {
+          "events.jsonl": "f1f336af84b750b0c8bf8f8e9a7a3952161eb884418f5580f08cb3e26a070713",
+          "session.json": "c756f8078812aa1ed03628e097ee517320d7de3664089f1133861c96130d5b5b",
+          "summary.md": "c0aa5d5b2cb306fda703a7144af455c36fe72b9d1e2c73ddcdab905d36cdc8a7"
+        },
+        "stop": {
+          "pc": 67168780,
+          "pc_fw": 67168780,
+          "reason": "fault"
+        },
+        "wall_s": 0.1561
+      },
+      {
+        "cycle_model": "rv64imac-modeled/1",
+        "cycles": 27294,
+        "device_accesses": 1,
+        "device_state_sha256": "3fa264b9f81081e8455a9cd26c0c2a721e3ac272e1079105a0eb191b1497f83d",
+        "device_unhandled": 0,
+        "first_unknown_mmio": null,
+        "instructions": 14682,
+        "milestones": [
+          "bootargs_consumer",
+          "relocation_copy"
+        ],
+        "mmio_unknown": 0,
+        "rung": "B2",
+        "rung_basis": "observed S1 boot-ladder rung from sim.gsp_boot (milestones=['bootargs_consumer', 'relocation_copy'], mmio_unknown=0, device_unhandled=0)",
+        "session": "harness/qemu_line/sessions/native-2",
+        "session_hashes": {
+          "events.jsonl": "d0d15816dbde8c85c30ba2576f97c9d5e3f470e6c38d9b4762d266a612cafe12",
+          "session.json": "8c7f0ea958a930edb814690bc0b233be01fcab3f747332abff39989e66642c2e",
+          "summary.md": "d2d6154ec22f4ee0d942543a32c29699ccb8031188df955c415d836462d04fd3"
+        },
+        "stop": {
+          "pc": 67168780,
+          "pc_fw": 67168780,
+          "reason": "fault"
+        },
+        "wall_s": 0.1524
+      }
+    ]
+  },
+  "not_verified": [
+    "lenient MMIO (B0) is observation, not device semantics",
+    "B3/B4 are not reached: the S1 device model stops at the B2 DMEM-runspace unknown",
+    "the boot shim values (bootargs/WPR meta/DMEM mirror) are declared assumptions",
+    "MCP on native is S3-owned and not exercised here",
+    "L2 timing: cycles are modeled (docs/32), never silicon claims",
+    "no hardware/GPU/guest/module involvement by design"
+  ],
+  "qemu": {
+    "backend": "qemu",
+    "device_map_entries": 2,
+    "fault_count_window": 5269,
+    "first_fault": {
+      "access_addr": 2305843009213696512,
+      "cause": 5,
+      "desc": "fault_load",
+      "epc": 2214629396,
+      "epc_fw": 67145748,
+      "reason": "rejected",
+      "rw": "read",
+      "size": 4
+    },
+    "first_touch_match": true,
+    "log_window_capped": true,
+    "ran": true,
+    "reason": "ok",
+    "rung": "pre-B0",
+    "session": "harness/qemu_line/sessions/qemu-probe",
+    "session_hashes": {
+      "events.jsonl": "cdba69c63e306f4c3de220b171e2ea7c1de4bd4abf18cdba1fb51bc681d5d172",
+      "session.json": "7e3f0f8b24c0403d114e59f68ed1b923e44abbfbf19f4865bd566a1b631c64ac",
+      "summary.md": "d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b"
+    },
+    "stopped_pc": 0,
+    "wall_s": 0.9519
+  },
+  "rerun_when_s1_lands": [
+    "python3 harness/sim_qemu_line.py",
+    "S1 landed (2026-10-03): sim/profiles/*.json is discovered and the native side runs sim.gsp_boot",
+    "sim/devices/*.json with greeneye-device-map/1 (or a device_map key) is still picked up as an observational map"
+  ],
+  "rung_order": [
+    "pre-B0",
+    "B0",
+    "B1",
+    "B2",
+    "B3",
+    "B4",
+    "B5"
+  ],
+  "rung_progress": true,
+  "s1_integration": {
+    "declared_rung": null,
+    "notes": [
+      "using sim/profiles/tu104-570.144.json (greeneye-sim-profile/1, firmware_sha256 matched)"
+    ],
+    "profile": "sim/profiles/tu104-570.144.json",
+    "source": "sim/profiles/tu104-570.144.json"
+  },
+  "schema": "greeneye-sim-qemu-line/1",
+  "threshold_checks": {
+    "all": true,
+    "device_model_documented": true,
+    "identical_runs": true,
+    "native_above_qemu": true,
+    "native_pair_wall_s": true,
+    "qemu_first_fault_reproduced": true
+  },
+  "thresholds": {
+    "device_model_required": true,
+    "frozen_on": "2026-10-03",
+    "identical_runs": 2,
+    "native_pair_wall_s": 20.0,
+    "native_rungs_above_qemu": 1,
+    "qemu_first_fault_fw": 67145748,
+    "qemu_first_touch": 2305843009213696512
+  },
+  "verdict": "above",
+  "verdict_explanation": "all frozen checks passed: QEMU fault reproduced, native >= QEMU + 1 rung, identical runs, wall bound, documented device model",
+  "x86_vms_running": 0
+}
diff --git a/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md
new file mode 100644
index 0000000..4e546b3
--- /dev/null
+++ b/debug/risc-v-gsp-rm-vm/harness/qemu_line/sim-qemu-line.md
@@ -0,0 +1,102 @@
+# Simulator vs the QEMU line - measured report
+
+* schema: `greeneye-sim-qemu-line/1`
+* harness: `harness/sim_qemu_line.py`
+* line: docs/35-GREENEYE-SIMULATOR-DESIGN.md 1.1 + 3.3
+* firmware: `gsp-570.144.fwimage.bin` sha256 `2d1bb5c60b208cfd...`
+* verdict: **above** (above_qemu_line=True)
+* verdict meaning: all frozen checks passed: QEMU fault reproduced, native >= QEMU + 1 rung, identical runs, wall bound, documented device model
+
+## Rung table
+
+| side | ran | rung | instructions | cycles (modeled) | stop | wall s | evidence |
+|---|---|---|---:|---:|---|---:|---|
+| QEMU probe | True | pre-B0 | - | - | fault | 0.9519 | `harness/qemu_line/sessions/qemu-probe` |
+| native run 1 | True | B2 | 14682 | 27294 | fault@0x400ea0c | 0.1561 | `harness/qemu_line/sessions/native-1` |
+| native run 2 | True | B2 | 14682 | 27294 | fault@0x400ea0c | 0.1524 | `harness/qemu_line/sessions/native-2` |
+
+### QEMU first fault
+
+* fault_load at fw vaddr `0x4009014` accessing `0x2000000000000a00` (4 bytes, read)
+* first-touch matches the documented reference: True
+* fault records in the capped log window: 5269
+
+## Frozen thresholds
+
+| check | pass |
+|---|---|
+| qemu_first_fault_reproduced | True |
+| native_above_qemu | True |
+| identical_runs | True |
+| native_pair_wall_s | True |
+| device_model_documented | True |
+| all | True |
+
+Thresholds (frozen 2026-10-03): native >= QEMU + 1 rung(s); 2 identical runs; pair wall <= 20.0 s.
+
+## Determinism
+
+* identical across 2 native runs: True
+* session compare ran: True (['Breakpoint profile delta (A vs B)', 'Watchpoint delta', 'Written pages delta'])
+
+## Session hashes (sha256)
+
+| session | file | sha256 |
+|---|---|---|
+| qemu-probe | events.jsonl | `cdba69c63e306f4c3de220b171e2ea7c1de4bd4abf18cdba1fb51bc681d5d172` |
+| qemu-probe | session.json | `7e3f0f8b24c0403d114e59f68ed1b923e44abbfbf19f4865bd566a1b631c64ac` |
+| qemu-probe | summary.md | `d141fa06d3e2d0603f3b99ad7603758e1fc14627aed74c6fe8a6ad22c56eb14b` |
+| native-1 | events.jsonl | `f1f336af84b750b0c8bf8f8e9a7a3952161eb884418f5580f08cb3e26a070713` |
+| native-1 | session.json | `c756f8078812aa1ed03628e097ee517320d7de3664089f1133861c96130d5b5b` |
+| native-1 | summary.md | `c0aa5d5b2cb306fda703a7144af455c36fe72b9d1e2c73ddcdab905d36cdc8a7` |
+| native-2 | events.jsonl | `d0d15816dbde8c85c30ba2576f97c9d5e3f470e6c38d9b4762d266a612cafe12` |
+| native-2 | session.json | `8c7f0ea958a930edb814690bc0b233be01fcab3f747332abff39989e66642c2e` |
+| native-2 | summary.md | `d2d6154ec22f4ee0d942543a32c29699ccb8031188df955c415d836462d04fd3` |
+| sessions | events.jsonl | `a6328cb00287bdf678d9b62d496929fc59190a08af3910b059c840c6bc98462e` |
+| sessions | session.json | `2372eea627f31d11f114019759d8d6dc665683bbc88e834f158f56b16fa5c0d4` |
+| sessions | summary.md | `6dfca9e61a4f23374b90dbef995d86771130fcf4c2b61dc40aac6d379d4b8706` |
+| trace | events.jsonl | `36b80ed88205daa8e1bd58536eb274ed4849c3d4b1a05daa0f2c44382c7b764a` |
+| trace | session.json | `a09ec38202c291a5b7a3719434ea785725e291cba2dc877d94cd0caf7fcd1a4e` |
+| trace | summary.md | `10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44` |
+| injection | events.jsonl | `08ab0874cfad71e0e4565b569d9b0ea5251bf158eaab3cdf17798182e4c66a95` |
+| injection | session.json | `f34b677be0b0b453cdade4487118e059c3dfb5a1010d4e6c2fc8b37a867fb25e` |
+| injection | summary.md | `59a1aa4f2b616d5266d565c4df4b0257d11aab95b09cec80f380e9aca8bfc22f` |
+
+## Native feature matrix (demo firmware)
+
+| feature | status | detail |
+|---|---|---|
+| analyze_compare | pass | {'analyze_session': 'harness/qemu_line/sessions/native-1', 'analyze_chars': 444, 'compare_pair': ['harness/qemu_line/sessions/native-1', 'harness/qemu_line/sessions/native-2'], 'compare_chars': 526, 'compare_headers': ['Breakpoint profile delta (A vs B)', 'Watchpoint delta', 'Written pages delta']} |
+| breakpoints | pass | {'run_until_hit': 2147483912, 'attached_then_removed': True, 'kind': 'sw'} |
+| hooks | pass | {'rpc_dispatch_hits': 1, 'cmds': [1, 2]} |
+| injection | pass | {'dir': 'harness/qemu_line/sessions/features-inject', 'blob': 'sdk/build/injected_demo.elf', 'slot': 6, 'ping_result': 48814, 'expected': 48814, 'hashes': {'session.json': 'f34b677be0b0b453cdade4487118e059c3dfb5a1010d4e6c2fc8b37a867fb25e', 'events.jsonl': '08ab0874cfad71e0e4565b569d9b0ea5251bf158eaab3cdf17798182e4c66a95', 'summary.md': '59a1aa4f2b616d5266d565c4df4b0257d11aab95b09cec80f380e9aca8bfc22f'}} |
+| mcp | not_run | native MCP surface is S3's deliverable (plugins/mcp_server.py); S4 must not race that work. Re-run after S3 lands (docs/37). |
+| memory | pass | {'ctrl': 2147485760, 'magic': 1196642353} |
+| sessions | pass | {'dir': 'harness/qemu_line/sessions/features', 'event_counts': {'bp_hit': 2, 'hook': 1, 'image_loaded': 1, 'mem_read': 2, 'mem_write': 4, 'session_end': 1, 'session_start': 1, 'stop': 2, 'watch': 1, 'watch_hit': 1}, 'hashes': {'session.json': '2372eea627f31d11f114019759d8d6dc665683bbc88e834f158f56b16fa5c0d4', 'events.jsonl': 'a6328cb00287bdf678d9b62d496929fc59190a08af3910b059c840c6bc98462e', 'summary.md': '6dfca9e61a4f23374b90dbef995d86771130fcf4c2b61dc40aac6d379d4b8706'}} |
+| struct | pass | {'schema': 'gsp_ctrl.schema.json', 'fields': 14} |
+| trace | pass | {'dir': 'harness/qemu_line/sessions/features-trace', 'blob': 'harness/qemu_line/sessions/features-trace/blobs/trace.jsonl', 'events': 4001, 'max_events': 4000, 'hashes': {'session.json': 'a09ec38202c291a5b7a3719434ea785725e291cba2dc877d94cd0caf7fcd1a4e', 'events.jsonl': '36b80ed88205daa8e1bd58536eb274ed4849c3d4b1a05daa0f2c44382c7b764a', 'summary.md': '10686e9f247862f4b0f2c68a2353821f4039befdd76846f8daefa72ae79f4b44'}} |
+| watch | pass | {'result_field_stores': 1, 'pcs': [2147484066]} |
+
+## S1 integration
+
+* device source: sim/profiles/tu104-570.144.json
+* profile: sim/profiles/tu104-570.144.json
+* declared rung: None
+* note: using sim/profiles/tu104-570.144.json (greeneye-sim-profile/1, firmware_sha256 matched)
+
+## Not verified
+
+* lenient MMIO (B0) is observation, not device semantics
+* B3/B4 are not reached: the S1 device model stops at the B2 DMEM-runspace unknown
+* the boot shim values (bootargs/WPR meta/DMEM mirror) are declared assumptions
+* MCP on native is S3-owned and not exercised here
+* L2 timing: cycles are modeled (docs/32), never silicon claims
+* no hardware/GPU/guest/module involvement by design
+
+## S1 integration notes
+
+* `python3 harness/sim_qemu_line.py`
+* S1 landed (2026-10-03): sim/profiles/*.json is discovered and the native side runs sim.gsp_boot
+* sim/devices/*.json with greeneye-device-map/1 (or a device_map key) is still picked up as an observational map
+
+* other agents' x86 QEMU VMs observed (never touched): 0