docs: record the real render walls found this session

DS HWW ESR SPH bitmap semantics (stage*4+check), the MME selector/RT0
third-dimension seeds, pair-safe synth binds and the remaining
VSB5/7+GS18 stage-state wall, with cycle evidence pointers.

1 files changed, 33 insertions, 0 deletions

diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index ec1b75f..cc16b04 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -1181,3 +1181,36 @@ vertices) and the window capture is black (`xwd -id`, non-black 0).  The
 remaining work is to capture the constant-buffer *bulk* transfer itself
 (the staging buffer to the vidmem CB page), not the method-stream patches.
 
+
+## Session 155 cont 8 (2026-11-06): DS SPH bitmap semantics and the BEGIN/END placement wall
+
+Two results worth keeping:
+
+1. **The DS SPH bitmap is `stage*4+check` over the six GF100 pipeline stages**
+   (VSA, VSB, TCS, TES, GS, PS). The six per-stage SPH start registers
+   (`DS_HWW_ESR_SPH_INFO_STAGE0..5`, 0x405c00..0x405c14) and the live
+   `DS-FAST` stage VAs plus the fetched SPH header types prove the stage
+   index: stage1 0x…900 is a V4T1 `SHADER_TYPE=1` VTG image, stage2 0x…200 a
+   V4T1 `TYPE=2` tess-init image, stage5 0x…0 a V4T2 `TYPE=5` pixel image.
+   The four checks per stage are the four SPH-V4 validation groups: header
+   type/version, mpipe/stage binding, attribute map (IMAP/OMAP + register
+   count + stream formats), and stream-out/topology. A clean boot with only
+   VSB/PS bound reported `a0040a06` = SPH1|2 (VSA checks 1/2), SPH9|11 (TCS
+   checks 1/3), SPH18 (GS check2) - i.e. the unbound stages are the failures.
+   Enabling the TCS bind added SPH10 inside the TCS group (r1554c), which is
+   the live proof of the `stage*4+check` split.
+
+2. **Synthesizing the missing VSA/GS stage records clears those bits but
+   their method run lands inside BEGIN/END.** Binding VSA/GS to the client's
+   own VTG image (`mask=0x35`) moved the bitmap from `a0040a06` to
+   `900400a0` (SPH1|2|9|11 gone; SPH5|7|18 remain), then the next window
+   raised `Class Error Offset 0x2018 Data 019a0900 EC 0x0d` -
+   `ILLEGAL_METHOD_IN_BEGIN_END`. The value is accepted; the placement is
+   the wall (the synth block is prepended to a window whose previous END was
+   dropped). Next: make the stage-record emission BEGIN/END-safe (emit after
+   an explicit END when the FE begin state is still open) and keep the
+   client's own TYPE/REGISTER_COUNT-before-address order.
+
+`SET_SPH_VERSION`/`CHECK_SPH_VERSION` (0x16a4/0x16a8) is not a lever for
+this bitmap: blob-derived, `0x10004` and `0x40004` all produce the same DS
+value on the same boot.