vgsp: rescue the direct-GL draw-state pushes from the LOW fb band, admit them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28)HEADmaster

The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead
90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are
intermittently unreadable while byte-identical copies park in the LOW
framebuffer; the copies do not share the VA's in-page offset, so the
page-stepped rescue scan could never land on them. Add a word-granular
LOW-band sweep gated on the two recognisable push images (state lead via the
method-stream window gate; 256-B VTG SPH upload by exact signature) and pin
hits exactly like the existing rescue.

The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80,
NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT
opener, so they never opened a C597 section and the state stream never
reached the replay lane; admit the 0x21C lead as an opener on beef channels
and exempt state-led windows from the eng25 colour-target guard (the guard's
data-blob rejects continue unchanged - only the invariant state lead passes).

Where the client's 0x114 IRAM upload is not captured (code words stay <= 4
on every boot observed), the forced golden overlay (sema_gl_mme_golden +
_force; golden-only, fail-closed) can serve every called macro slot; add
gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion
while it holds (see the golden-slot/pack machinery).

Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH
256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section,
captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the
bypass the lane submitted it to the engine for the first time (GR LAUNCH
submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN
slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0
clear runs (marked window 81), so pixel stores remain 0 and frames black;
receipts under /tmp/opencode/eng28-*.

Refs: CONT.490.

1 files changed, 20 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index e1563dd..8756d83 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18437,6 +18437,26 @@ static bool gsp_phys_gr_slot_golden_blank(u32 j)
 }
 
 /*
+ * eng28 (CONT.490): golden READY. With the golden overlay forced (mode 2,
+ * sema_gl_mme_golden + sema_gl_mme_golden_force), the pack fills every
+ * called slot from the driver-emitted golden program whether or not the
+ * client's 0x114 IRAM upload was captured, and golden-only blanks every
+ * body the library cannot serve (fail-closed). In that state the captured
+ * macro program is no longer a PREREQUISITE for a safe first launch, so
+ * the service's immature-skip gate (see svc_gr_request) must not
+ * software-complete beef 3D windows that the golden program can serve.
+ * The client's own state pushes (clear colour + CLEAR_SURFACE + MME macro
+ * calls) then reach the engine - without this the whole draw-state stream
+ * was consumed with zero engine contact on boots whose setup push never
+ * became readable.
+ */
+bool gsp_phys_gr_golden_ready(void)
+{
+	return READ_ONCE(gsp_phys_rmcall_gr_mme_golden) &&
+	       READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force);
+}
+
+/*
  * SESSION 153-CONTINUED-79: per-launch method-block word cap + prelude drain.
  * The r1172-r1175 A/B: every beef launch whose emitted block exceeded ~2000
  * words (3083-word full-SA prelude + window, 3315-3484 words) NEVER STARTED