vgsp-gl: decode the client fixed-CB upload runs and gate the assembled image

1 files changed, 27 insertions, 0 deletions

diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md
index 3119b75..ec1b75f 100644
--- a/docs/04-implementation/04-real-render-walls.md
+++ b/docs/04-implementation/04-real-render-walls.md
@@ -1154,3 +1154,30 @@ index-buffer bind, the vertex-shader position output and the viewport/clip
 transform must be checked against the client's own draw arguments (the
 active index page currently reads as vertex floats at its bound VA, so the
 index/vertex role or the index count is also a candidate).
+
+## Session 154 (r1515-r1517): the fixed-CB upload is decoded but its bulk is not in the method stream
+
+The client publishes the fixed-CB base once per context
+(`SET_MME_SHADOW_SCRATCH(0x18)`, method `0x3460`, value = VA >> 8) and then
+writes the constant store through the C597 methods
+`SET_CONSTANT_BUFFER_SELECTOR_A/B/C` (`0x2380/0x2384/0x2388`),
+`LOAD_CONSTANT_BUFFER_OFFSET` (`0x238c`) and `LOAD_CONSTANT_BUFFER(i)`
+(`0x2390`).  The emulator now scans every decoded push of the client's GL
+channel for those runs, assembles the first 4 KB of the constant buffer,
+validates it with the strict projection gate, and delivers a passing image
+to the forced MME seed page; a receipt reports the push, base, selector,
+run/word counts, the `c[0x0][0x80..0xbc]` block and whether the projection
+shape passed (`CB-UPLOAD`, `CB-UPLOAD-SCAN`, `cb-copy src=const-upload`).
+
+Measured on a validated boot (r1517, glxgears formed, draws submitted): the
+60216-byte setup push is read and the scratch-18 base is captured
+(VA `0x4460000`), but its `0x2390` content is only 10 state-patch words
+(selector/offset pairs, no matrix rows).  The base page resolves to the
+emulated vidmem offset `0xb10000` and reads zero; the neighbouring
+`0x43e0000` page is client vertex data, and the guest-RAM projection-shape
+scanner finds only transient copies.  The draw therefore still runs with the
+synthetic identity (r1517 `GL-COVER` clip space inside 50/64 sampled
+vertices) and the window capture is black (`xwd -id`, non-black 0).  The
+remaining work is to capture the constant-buffer *bulk* transfer itself
+(the staging buffer to the vidmem CB page), not the method-stream patches.
+