vgsp: eng59b - do not let the arming launch consume the release carrier; re-arm in the pump

The saved-window release carrier was armed inside the pack-completing
launch's own build, and the client-first cancel treated that same launch
(and its retries) as the next client launch, silently dropping the claim.
c762: MME-CARRY-SAVE (win=240 held=68) -> MME-CARRY-ARM mode=release ->
the arming launch ran mac=0 (LOAD-ONLY, window dropped, held CALLs still
owed) -> no FIRE, no synthetic push, no mac=0x22.

Track the arming launch identity (h + push) and keep the claim armed across
it; only the MME-PACK-REARM edge (calls actually released), a real consumer,
context/handle changes, or a launch error cancels/consumes. Add a pump-side
re-arm once pack_done_gen is set, and bounded MME-CARRY-HOLD receipts for
every skip. One fire per pack completion, no retries.

Build rc 0; validation pending (c762-class boot with
sema_gl_mme_pack_release=1).

1 files changed, 2 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index a27225b..21eb1fc 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -597,6 +597,8 @@ void gsp_phys_gr_mme_carry_failed(int rc);
  */
 bool gsp_phys_gr_mme_release_peek(u32 *h_object);
 bool gsp_phys_gr_mme_release_take(u32 h_object, u32 *held, u32 *win);
+void gsp_phys_gr_mme_release_rearm(void);
+bool gsp_phys_gr_mme_release_is_arming(u32 h, u64 push);
 void gsp_phys_gr_mme_release_cancel(const char *reason);
 void gsp_phys_gr_mme_release_failed(int rc);
 void gsp_phys_gr_mme_release_complete(void);