vgsp-gl: receipt the draw's clip coverage and refuse non-MVP fixed-CB pages

r1512 adds one bounded GL-COVER receipt per replayed draw. It decodes the
window's index buffer (0x17c8/0x17d8 + size), the stream-0 stride (0x1c00)
and position offset (0x1160), resolves the CALL_MME_DATA (0x3810) stream
base, reads the referenced vertices and evaluates the clip-space position
in Q16.16 integer math with the exact c[0x0][0x80..0xbc] block the replay
delivers, printing per-vertex clip codes plus clip/NDC/screen bboxes and
the injected viewport scale/offset/clip. It also prints the fixed-CB
copy provenance and tries the client's own scratch18 page read-only.

Measured (r1512): real gear vertices (stride 24, position offset 0,
3.549 0.852 -0.5) but the delivered "matrix" was a rotation block
(row3 = 0.1268 0.9922 0 1), giving clip w ~= 1.1 instead of the camera
distance (~40) and 57/64 sampled vertices outside clip. The draw was
clipped by a non-projection constant block, not by zero/garbage VS output.

r1513/r1514 fix the source: the fixed-CB copy now prefers the client's
SET_MME_SHADOW_SCRATCH(0x18) page and the client-CB VAs its own writes
published (0x43e0000/0x4450000), requires a strict projection shape
(|row3.x|,|row3.y| < 0.02 and row3.z/w not both zero), and the resolver
no longer accepts an unresolved PA 0 page. Non-MVP pages (including the
old forced 0x0cd70000 page) can no longer become the seed; when no real
page is found the r1476 identity positive control is used.

r1513/r1514 receipts: the strict gate finds no readable client MVP page
on these boots (the client's fixed-CB content is not materialised in the
emulated memory), so the seed is the controlled identity and the identity
still clips gear radii > 1 (12 launches r1514, 20 poison, no fragments;
root xwd 2 nonblack pixels at (216,0)-(409,2) 0x77edc). Next wall: get
the client's fixed-CB contents into its own page (emulate the VPC/
LOAD_CONSTANT_BUFFER writes from the init push) so the VS receives a real
MVP.

Build: make -C kernel (green). Evidence: backups/evidence-20261002-victory/r1512..r1514.

1 files changed, 19 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 98bbc4a..0ea6076 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -19746,6 +19746,25 @@ MODULE_PARM_DESC(sema_gl_vp_prelude_pos,
 	"Insertion point of the synthesized viewport prelude in a replayed 3D window (0 = window head (legacy); 1 = before the first CALL run 0x3800..0x39fc, after the state binds (default); 2 = before the first 0x3910 run); pos 1/2 leave a window without the requested run unchanged (non-draw window), only 0 inserts without a CALL run)");
 
 /*
+ * r1512 diagnostic export: the sema service's draw-coverage receipt needs
+ * the viewport state the replay will inject for the current launch. Pure
+ * read of the module parameter + the literal table (no side effects).
+ */
+void gsp_phys_gr_vp_state_get(int *mode, u32 *words, u32 *n)
+{
+	int m = READ_ONCE(gsp_phys_rmcall_gr_vp_prelude);
+	u32 len = gsp_phys_gr_vp_pre_len(m);
+	const u32 *src = gsp_phys_gr_vp_pre_src(m);
+
+	if (mode)
+		*mode = m;
+	if (n)
+		*n = len;
+	if (words && len && src)
+		memcpy(words, src, (size_t)len * 4u);
+}
+
+/*
  * CONT-119 (r1450): the BINDING words of the synthesized stage-2/5
  * REGISTER_COUNT runs. CONT-90 emitted each as a 2-word
  * REGISTER_COUNT/BINDING run (`20020823 0000001a 00000000` for j=2, the