vgsp: never run work for a slot consumed without it (epoch mark + content-hash once gate)

The grace-expiry fake path consumed a held CE entry without marking its
GPFIFO slot as consumed for the put epoch, and the replay guard only ran
while the channel was not deferring. A later pin-batch rewind then
re-read the slot, found no recorded identity, and executed the push's
copies against a staging buffer the client had refilled after the faked
release - a deterministic vadd input shift (a[k] == h_a[k + 2 MB]).

- grace-fake consume path now calls svc_replay_note() before advancing;
- the svc_replay_seen() replay skip is evaluated unconditionally: a slot
  consumed in the current epoch is skipped on every replay, deferral or
  not, until a put wrap clears the mark;
- the once-only identity gate gains a content witness (FNV-1a hash of the
  recorded push bytes): the same entry words with different push content
  is a new push (clients rewrite push buffers in place) and runs its ops
  with a cleared done bitmap; suppression requires identical content;
- snapshot write-back persists the hash array; new drain counter
  reident= counts content-mismatch cancellations;
- the grace window stays at 8 s: a faked entry's work is never run, so
  the hold is that work's only chance (a 2.5 s experiment made red-class
  runs complete with corrupt data instead of timing out).

Verified: module 8e90fc7e..., three consecutive end-to-end acceptance
runs (MAIL + VADD bad=0 checksum=392344090.500000 + STATUS OK).

1 files changed, 15 insertions, 0 deletions

diff --git a/docs/03-architecture/06-host-module-and-hybrid-model.md b/docs/03-architecture/06-host-module-and-hybrid-model.md
index cfe1c8e..98b3523 100644
--- a/docs/03-architecture/06-host-module-and-hybrid-model.md
+++ b/docs/03-architecture/06-host-module-and-hybrid-model.md
@@ -256,6 +256,21 @@ pipeline:
 The same page-granular discipline already applies to the host-side bridge
 read/write helpers and to semaphore I/O.
 
+3. **A slot consumed without running its work never runs it later.** When a
+   CE push cannot be resolved within its bounded hold, the fallback
+   acknowledges its release and consumes the entry so the client's tracker
+   keeps moving. That acknowledgement leaves the push's data work unrun; if
+   a later pin-batch rewind re-reads the consumed slot, executing the work
+   then would read a staging buffer the client has since refilled and write
+   the next chunk's data over a finished one (observed as a deterministic
+   input shift). The per-put-epoch consumed mark is therefore authoritative:
+   a slot consumed in the current epoch is skipped on every replay,
+   independently of the channel's deferral state, and only a put wrap (which
+   recycles slots for genuinely new pushes) clears the mark. Entry-word
+   identity is additionally checked against a hash of the recorded push
+   bytes, so a rewritten push that reuses the same entry words is treated as
+   new work rather than suppressed as a replay.
+
 Rule 1 holds at *operation* granularity as well as per entry. A push whose
 decode finds one operand still under targeted translation is left pending and
 decoded again on the next pass; the operations that already ran before the