vgsp-gr: capture the full 4K-word GL draw window, emit SET_SHADER_EXCEPTIONS as immd13, and base the SPH region on the bound program's shadow page

- SVC_GR_PUSH_WORDS / GSP_PHYS_GR_RAW_WORDS raised 2048 -> 4096: the beef
  full-frame push is 12288 B / 3072 words, so the 2048-word capture tail
  failed the 3D mark (raw_ok=0 fit_ok=0) and the launch fell back to a
  239-word stub, losing the real 2115-word draw. Now '3D stream chunked
  window=1429 words -> 4 chunk(s)'.
- SET_SHADER_EXCEPTIONS (0x1528) is emitted as the client's immd13
  (0x8000054a) and skipped when the window already carries it; the
  remaining 0x1528 in the log is the client's own benign write.
- sema_gl_sph_region_bind (default 1): the SPH region base is the first
  bound program's relocated shadow page, not the forced 0x1500000 pool
  base; r1484 latched the fetched SPHs (0,019a0f00,019a0200,0,0,019a0000)
  with ds=86040646 (region mismatch), r1485 uses base 0x19b0000 bind
  0x19b0900 and the DS accepts (ds=80000000).
- r1484/r1485: the screen now shows gear-class pixels (xwd bbox spanning
  the 800x600 window, multicolor); GUEST-WIT shows RT0 page 0 written. The
  remaining wall is the MME draw macro 0xf1 / pc 513 poison on the first
  calls+window launch after the arming hold is released.

1 files changed, 7 insertions, 3 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 5ae5ae6..6689771 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -390,10 +390,14 @@ void gsp_phys_backend_relay_counters(u64 *requested, u64 *ok, u64 *verify_fail,
  * tail; the raw window is the source of the 3D method-stream replay.
  * SESSION 153-CONTINUED-45: 512 -> 2048 dwords (8 KB) for the DIRECT GL
  * client's 5016-7144 B render pushes (glcore); the raw window must carry
- * the whole push for the section capture's `len == push_n*4` gate. Must
- * equal SVC_GR_PUSH_WORDS (static_assert in gsp_sema_service.c).
+ * the whole push for the section capture's `len == push_n*4` gate.
+ * SESSION 154-1: 2048 -> 4096 dwords (16 KB) for the client's full-frame
+ * 12288-B pushes (r1483 `3D mark failed ... raw_ok=0 fit_ok=0
+ * rawlen=3072 pushn=2048`), so the chunked window replay
+ * (svc_gl_stream_chunks) can run instead of falling back. Must equal
+ * SVC_GR_PUSH_WORDS (static_assert in gsp_sema_service.c).
  */
-#define GSP_PHYS_GR_RAW_WORDS		2048u
+#define GSP_PHYS_GR_RAW_WORDS		4096u
 
 /*
  * B-2 (large-operand data path): the grown, boot-fixed GR data-bounce region.