vgsp: rescue the direct-GL draw-state pushes from the LOW fb band, admit them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28)HEADmaster

The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead
90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are
intermittently unreadable while byte-identical copies park in the LOW
framebuffer; the copies do not share the VA's in-page offset, so the
page-stepped rescue scan could never land on them. Add a word-granular
LOW-band sweep gated on the two recognisable push images (state lead via the
method-stream window gate; 256-B VTG SPH upload by exact signature) and pin
hits exactly like the existing rescue.

The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80,
NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT
opener, so they never opened a C597 section and the state stream never
reached the replay lane; admit the 0x21C lead as an opener on beef channels
and exempt state-led windows from the eng25 colour-target guard (the guard's
data-blob rejects continue unchanged - only the invariant state lead passes).

Where the client's 0x114 IRAM upload is not captured (code words stay <= 4
on every boot observed), the forced golden overlay (sema_gl_mme_golden +
_force; golden-only, fail-closed) can serve every called macro slot; add
gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion
while it holds (see the golden-slot/pack machinery).

Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH
256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section,
captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the
bypass the lane submitted it to the engine for the first time (GR LAUNCH
submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN
slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0
clear runs (marked window 81), so pixel stores remain 0 and frames black;
receipts under /tmp/opencode/eng28-*.

Refs: CONT.490.

1 files changed, 10 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index d84b080..d2faa1e 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -350,6 +350,16 @@ bool gsp_phys_rmcall_gr_sph_bind_value(void);
 u32 gsp_phys_rmcall_gr_sph_bind_mask_value(void);
 
 /*
+ * eng28 (CONT.490): the golden MME overlay is forced (sema_gl_mme_golden +
+ * sema_gl_mme_golden_force), so every called macro slot is served from the
+ * driver-emitted golden program (golden-only, fail-closed) and the client's
+ * captured 0x114 upload is not a prerequisite for a safe launch. The
+ * service's immature-skip gate consults this so beef draw-state windows are
+ * not software-completed while the golden program can serve them.
+ */
+bool gsp_phys_gr_golden_ready(void);
+
+/*
  * SESSION 155 CONT 11: bind a synthesized header-only GEOMETRY SPH to
  * stage 4 with ENABLE=0 (sema_gl_sph_gs_img, default 0). The sema service
  * uses this value to author the 128-byte image at family+0x780.