vgsp: reject beef draw-synth windows whose last colour-target bind is unusable (eng25 correctness guard)

The direct-GL lane's draw-synth captures join the verbatim 3D replay lane by
numerical run-cover alone, so a non-method data blob whose INC run merely
spans the C597 RT block is replayed as state: its last A/B/W/H write per
colour target is an unmapped 40-bit VA (c344: RT1 -> 0xff000480a0) and the
engine retires with no stores (NOWRITE wrote=0). Gate the beef 'd' admission
(single-block and chunk-split) on svc_gl_window_rt_valid(): walk the window
with the run grammar, keep the last A/B/W/H write per colour target, and
require at least one usable bind (A[7:0]<=1, B<2^30 aligned, 1<=W,H<=0x4000).

Validated live (c346, mdev 53dc06b5, ENG26 instrument cycle): 23 bounded
'3D mark rejected (beef draw-synth: no valid last colour-target bind)' rows,
including the 14865-word 59580-B blob window @off=0x78 and the 542-word
0x4010ed0 twin; the one timing-variant window that does carry a usable RT
bind still passed and replayed (wrote=0), and the X lane is unregressed
(15x '3D stream marked h=0x1000013' + 'GUEST GR LAUNCH OK' ok=16/17).

Refs: CONT.486/487; eng25/eng26 evidence under /tmp/opencode/eng26-*.

0 files changed, 0 insertions, 0 deletions