vgsp-gr: deliver empty FB fetch pages from real FBMEM, discover the CB per boot, clear the DS latch after each window

The active indexed draw's vertex/index buffers resolve through the client's
page tables to vidmem pages whose emulated BAR1 shadow is empty (no emulated
upload path ever populated it), so the engine fetched zeros and the draw
stored nothing. Three delivery paths now cover the page: a real-FB VID leaf
for launch fetch pages (QMD pointers, never the data-fill surface) and for
vertex streams when every shadow byte is zero; a sysmem-backing copy when the
same VA also has a nonzero SYS mapping; otherwise the existing shadow page is
used untouched. Render-target pages keep their shadow identity so the copy-out
can still ship stores back to the guest.

The fixed constant buffer is discovered per boot: the captured
SET_MME_SHADOW_SCRATCH(0x18) value is authoritative, the historically observed
base is a gated fallback, and a resolved real page is remembered for later
misses. The DS HWW ESR latch is now also cleared (W1C) after each replayed
window, so a failed window cannot poison the next window's entry state.

Validated with three supervised cycles (r1497-r1499): the active streams read
the client's real vertex floats, the real MVP resolves, poison stays at 0-1
per run, and the engine clears the render target to opaque black
(dump_vidmem 0x200000 = ff000000) with the guest window still all black -
the remaining wall is geometry coverage, not data delivery.

1 files changed, 57 insertions, 0 deletions

diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index 0099306..3119b75 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -1097,3 +1097,60 @@ unresolved in r1496), so a single hard-coded source VA is not sufficient. The
 DS continues to latch SPH stage errors on some windows. The next work is to
 source the active vertex/index page from the sysmem backing (or to make the
 vidmem upload deterministic) and to make the CB source discoverable per boot.
+
+## Session 154e (r1497-r1499, 2026-11-05): real-FB fetch delivery, per-boot CB, DS post-clear
+
+Three changes closed the "engine fetches zeros for the active draw" wall and
+moved the measured state to "the engine clears the target but draws no
+geometry".
+
+1. **Empty-shadow FB fetch pages are delivered from the real frame buffer.**
+   The active indexed draw's vertex/index buffers are mapped by the client's
+   own page tables with the vidmem aperture, but no emulated path ever
+   populated the BAR1 shadow copy of those pages (the upload did not pass
+   through an inline write, a decoded CE copy or a CPU aperture write), so
+   the engine fetched zeros. Two delivery paths now cover the page:
+   * when every byte of the shadow page is zero, a launch fetch page (a QMD
+     pointer, not the data-fill surface) is mapped with a VID-aperture leaf
+     to the real frame-buffer offset the guest page table names
+     (`FETCH-VID-MAP va=... fb=... qmd=...`);
+   * a vertex-stream page uses the same rule inside the contiguous fetch
+     line (`MME-VSTREAM-LINE ... vid=N fb0=...`);
+   * if the same VA also has a sysmem mapping with nonzero bytes, those
+     bytes are copied into the shadow page (`FETCH-SYSBACK`), which covers
+     boots where the client keeps a CPU-visible staging copy.
+   A page whose shadow already has content is never touched, so the working
+   sysmem streams, the fixed-CB seed and every engine-written page keep
+   their identity. Render-target/surface pages (QMD word NONE) are
+   deliberately excluded: their stores must land in the emulated page so the
+   copy-out can ship them back to the guest.
+
+2. **The fixed CB is discovered per boot.** When the client's
+   `SET_MME_SHADOW_SCRATCH(0x18)` write reaches a decoded push it is used as
+   the fixed-CB base; when that capture is absent the historically observed
+   base is tried as a candidate and the matrix gate decides. In r1499 the
+   candidate resolved through the VAS walk to the client's real page
+   (`first8=3ff35a31 be800000 be9e377b 3f737870 ...`, the client's MVP), and
+   42 of 96 copies used the real page with the rest served from the
+   remembered validated page.
+
+3. **The DS HWW ESR latch is cleared after each replayed window as well as
+   before it.** The latch is W1C; the pre-clear made each window's validation
+   set readable, the post-clear keeps a failed window's pending report from
+   poisoning the next window's entry state. The poison count stayed at 0-1
+   per run with the mask knob enabled.
+
+**Measured state (r1499).** The active draw's streams now read the client's
+real vertex floats (`MME-VSTREAM-LINE base=0x44fea00 first8=3f800000 00000000
+bf000000 bf800000 ...` and `base=0x44ff000 first8=4069999a ...`), and the
+engine executes without a fetch fault. It writes an opaque-black clear
+(`0xff000000`) into the render-target shadow page at FB offset `0x200000`
+and into the forced RT seed page at `0x504000` (`dump_vidmem` readback), the
+bounce copy-out ships the changed seed pages, and the guest's window capture
+is uniformly black (`xwd -id`, 800x600, non-black pixels 0, bbox 0,0,0,0).
+The clear reaching the target proves the RT0 bind and the color-store path;
+no gear fragments are produced. The next wall is geometry coverage: the
+index-buffer bind, the vertex-shader position output and the viewport/clip
+transform must be checked against the client's own draw arguments (the
+active index page currently reads as vertex floats at its bound VA, so the
+index/vertex role or the index count is also a candidate).