vgsp: RM-record 3D attach + inside-run C597 openers for the direct-GL channel (eng23, mechanism validated)

The direct-GL (GZDoom/glx) channel family 0xbeef01xx never opened a C597
section because its class bind is channel-side: the client allocates
TURING_A (0xc597) with hParent = its own channel (measured: alloc 0xc597
h=0xbeef9097 parent=0xbeef0100 client=0xc1d00013) and never re-emits a
SET_OBJECT push, so the section recognizer's sticky-attachment gate
(svc_gl_att_accept_run) dropped every push. The X lane binds inline in
its init push and was unaffected.

- gsp_rm_emulation.c: report the 0xc597 allocation's hParent to the sema
  service (gsp_sema_service_gl_attach), which applies it as the sticky 3D
  attach on its own thread (pending-slot queue; no cross-thread writes to
  the attachment tables).
- gsp_sema_service.[ch]: the queue + drain (svc_thread pass), and accept
  the inside-run opener shapes on attached channels: the direct-GL client
  emits NVC597_BEGIN (0x1618) and the RT-setup family (0x840) as methods
  INSIDE multi-method INC runs (measured: run addr=0x80c count=256 covers
  0x840..0xc0c; census decoded method=0x1618 op=1 from a run payload),
  not as the one-word IMMD form the X lane emits.
- Also carries the eng22-rescue scan-cap widening (0x4000000 -> full 2 GiB
  shadow; observed live: "no content-gated window in 0x80000000 shadow").

Validated live (c335/c337/c338, receipts /tmp/opencode/eng23-receipts-c331.txt):
- RM-record attach fires and applies for 0xbeef0100 (c335 12:49:04, c338).
- sections now open (c337) and capture (c338) on 0xbeef0100 incl. the
  59556-B setup push and the 6400-B draw push (src=draw-synth).
- first GR LAUNCH submitted for 0xbeef0100 (c338 13:01:58) - fails at the
  physical QMD release (qmd_rel=0xc0ffee01 want=0x600df00d); new frontier.
- px0 still 00000000; mission not launched.

A/B control: the same X-lane lottery behaviour was reproduced with the
pre-change module (c333), so no X-lane regression is attributable here.

1 files changed, 12 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 36f9902..6f07209 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -107,6 +107,18 @@ struct sema_vaspace_desc {
 void gsp_sema_service_vaspace_add(const struct sema_vaspace_desc *desc);
 void gsp_sema_service_vaspace_del(u32 h_vaspace);
 /*
+ * eng23 (CONT.483): RM-record 3D-class attachment. The X lane carries its
+ * C597 SET_OBJECT inline in the init push, but the direct-GL client's
+ * channel binds the class channel-side: the client allocates TURING_A
+ * (0xc597) with hParent = its own channel and never re-emits a bind push
+ * (observed: alloc 0xc597 h=0xbeef9097 parent=0xbeef0100). The GSP-RM
+ * emulation reports that allocation here, and the service thread applies
+ * it as the sticky attachment the section recognizer gates on (same
+ * effect as the X lane's inline bind). Called from the RM thread, applied
+ * on the service thread - no shared-table writes cross threads.
+ */
+void gsp_sema_service_gl_attach(u32 h_object, u32 subch);
+/*
  * CONT.407: a client's DUP_OBJECT of a VAS gives the destination client a
  * NEW handle for the SAME page directory (measured: the GL client dups X's
  * VAS 0x10005 as 0xbfef0001, then allocates its GR channel with