vgsp-gl: scope client inline writes to the authoring VAS and receipt surface ownership

The captured 1280x720 colour-target bind is the X server's screen
(VA 0x120400000, 900 contiguous FB pages from 0x200000 to 0x583000 in
the emitting VAS 0x10005). The GL client uses the same 0x1200xxxxx VAs
for its own allocations; its fixed-CB write (0x120700000) was resolved
through the X VAS by the global cross-VAS walk and overwrote screen
page 0x500000 with the CB matrix. Resolve client inline writes through
the authoring channel's own VAS (GR handle 0xbeef0100 inherits its CE
siblings' VAS 0xbeef0300) and refuse cross-VAS translation for a
channel-owned page whose own VAS does not map it (VA shadow instead).
Receipts: SURF-OWNER (emitting channel, VAS span coverage first/mid/last
PA, retarget) and GRCE owner-vas. Add viewport mode 7 (the client's
800x600 window viewport) and a VP-METHOD census of viewport-family runs
in trusted pushes; a bounded BAR1 screen-range write witness.

r1506: the CB no longer touches the screen (vidmem 0x500000 reads the
black clear), screen ownership proven. r1507/r1508: the active indexed
draw's vertex/index pages are all-zero in its own FB shadow in those
boots, so no fragments; the client never emits a real 0x0a00 viewport
block (the 0xa00 hits are misaligned vertex floats), so the viewport
stays synthesized.

0 files changed, 0 insertions, 0 deletions