docs: session-154b - run-bit red herring (completion latch), sema_gl_sph_bind lever (first slot-34 execution), DS SPH validation wall decode (a2040800/a2040a00, region=0/0) + variant results

1 files changed, 34 insertions, 0 deletions

diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index 74fca80..3cd370a 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -944,3 +944,37 @@ Three durable findings from the r1414-r1427 experiment series (host module
    unchanged (GATE-1 still black); the lane still poisons
    (`badf1201` -> WEDGE-RECOVER) after ~60 s, and the stores land on
    relocated-operand pages rather than the render target.
+
+## Session 154b (2026-11-03): the SPH wall - draw executes, DS rejects at SPH validation
+
+Follow-up state after the first store retirements, three further levers:
+
+1. **The macro "run bit" is a completion latch, not an arming gate.** The
+   engine's macro-status sampler reads back `0x4044b4`; a completed
+   slot-34 body latches `mac=0x22 mpc=637` with `run=0` (637 = the body's
+   last instruction). The earlier belief that the DRAW never ran was a
+   sampler artefact - the slot-34 body is a short straight-line program the
+   transition-gated logger never caught mid-flight.
+2. **`sema_gl_sph_bind` (pipeline-stage bind emission) was 0 on every boot
+   to r1433 and is the bind lever.** Enabling it emits the per-window
+   pipeline-stage binds (`SPH-BIND emitted ... win-binds=2 j1-type=0x11
+   initblk=17`), zeroes the previous SPH11 signature, and produces the first
+   observed slot-34 execution (`mac=0x22 run=1`) with live draw-surface
+   retirements (`retirement wait: 3/2/1 of 901`, OUT-PAGE-WIT on
+   0x120700000-0x120705000 = draw-surface rows 614-618, operand/uniform
+   values).
+3. **The residual wall is the DS stage validation.** DS-ESR decode:
+   bits 23:0 = SPH<n>_ERR, bits 29:24 = pipeline stage. `a2040800` =
+   SPH11|SPH18; with binds on, `a2040a00` = SPH9 (the vertex SPH fetched
+   from the window's own j=1 bind alias is rejected; the DS `region=`
+   readback is 0/0). Variants: `sema_sph_version_val=0x00040003` flips the
+   SPH9 attribution but not the wall; `sema_sph_region_legacy=1` emits the
+   legacy 0x1608/0x160c pair (base 0x121201000) but is refused at the method
+   level (`Cl 0000c597 Off 00001608`); `sema_sph_region_base=0x01500000`
+   propagates but the launch is refused by an MME class error
+   (`Cl 0000902d Off 0x2000`) before the DS stage is reached.
+
+Current best lineage: `golden=1 golden_force=1 hold_calls=1` +
+IRAM-gate break/build 0 + `sa_rearm=0` + `sph_bind=1` (binds + draw
+execution + draw-surface retirements; still no rasterized pixels - the
+region record for the synthesized stage slots remains the named gap).