docs/04-real-render-walls: SESSION 140 section 19 - the n_data wiring (QMD-page note + qmd-ptr seed + pin-aware reads) reaches the launch's data set; the empty-set forward reaches the backend and oopses at gsp_phys_backend_guest_gr_submit+0x4394 - guard first

1 files changed, 39 insertions, 0 deletions

diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index 12f4179..6f39803 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -722,3 +722,42 @@ n_data gate refuses first). This is now a pure content-source problem:
 either find/queue the i2m that fills the QMD window, or break the
 chicken-and-egg by forwarding a launch with the window zero (letting the
 real engine read it) behind an explicit parameter.
+
+## 19. UPDATE 2026-10-26 (SESSION 140): THE n_data WIRING - the QMD's own pointer values ARE the launch's data set; the fill now reaches them (candidates appear, the page is correctly launch-internal), and the degenerate-set guard's bypass reaches the backend only to oops in the empty-set walk
+
+**Three wiring corrections (commit `5c0fcc21`).** (1) The QMD page itself
+is noted into the request page list (word 34) - the pointer values live
+inside the QMD (r790: word 34 = `0xdff0febc00`) and no scan ever covered
+it. (2) The fill seeds candidates directly from the launch's own QMD
+pointer pairs (`gr_qmd` words 34..47, decoded from the push's inline-QMD
+run): r793 `sema-gr: qmd-ptr seed va=0xdff0feb000 (word 34)` - the values
+need no page scan (the page shadows read empty; the
+invisible-vidmem-write class). (3) The scans read pin-aware
+(`svc_read_va` first) - the staging copy the decode reads is a pinned
+page; a raw mapping of the vidmem pa sees zeros.
+
+**Result.** `fill cand n=1` with the QMD window page seeded;
+`sema_probe 0xdff0feb000 -> pa=0x56b000 aperture=vidmem` resolves - but
+the R3 hygiene filter classifies the page launch-internal, so `n_data`
+stays 0: **this launch's QMD declares exactly one pointer pair and it
+names its own QMD window - a launch with no external data, which the
+"degenerate set" refusal class wrongly covers.**
+
+**The egg-break test + the oops.** With the r564 guard bypassed
+(`gsp_phys_gr_min_data=0` - and the value clamp removed for the test -)
+the refusal disappears and the forward ENTERS the backend:
+`Oops: 0000 [#2] PREEMPT SMP NOPTI`, `Workqueue: gsp-phys-work
+svc_fwd_work_fn [vgsp]`, `RIP: gsp_phys_backend_guest_gr_submit+0x4394`
+(NULL-base table walk: CR2=0x1e93c, R14=0, RAX=0x1e000, RSI=0xdff0feb900
+- the program VA). The empty-data walk needs that guard before
+`min_data=0` can be used; the clamp revert was withdrawn (crash
+enabler). The copy pipeline is unaffected: `sema-gr: copy done
+h=0xbeec0100 push=0x4f4580c dst=0x50b0000 bytes=0x12c000 rows=480 rc=0`
+runs cleanly in the same runs.
+
+**Next.** Guard the empty-set walk at `gsp_phys_backend_guest_gr_submit`
+(the struct walk reading 0x04/0x10/0x38/0x3c off a NULL base with the
+program VA in RSI), then re-test `min_data=0` for the no-external-data
+launch class: the forward should reach the real engine, and the copy-out
+(and the frame copy that already executes) can carry rendered pixels
+back.