vgsp: once-only op execution per entry identity, per-op done bitmap

The pump's operand-targeted-scan hold decodes a push, runs every op that
translates, then leaves the entry pending for a retry. The retry
re-decoded the whole push and re-ran the operations that had already
completed. A CE copy reads a client staging buffer the client refills
per chunk, so the retry overwrote a finished chunk with the following
chunk's data (observed: the bridge's vadd input half replaced by the
next 1 MB chunk, first half of the device buffer byte-identical to the
source shifted by exactly 2 MB; the same 1 MB copy logged twice with
different staging contents).

The service now records, per GPFIFO slot, the entry identity plus a
bitmap of the decoded operation indexes whose work has executed for
that identity, and a complete flag for a pass that ended with no
operand pending. svc_run_ops skips already-executed ops on a retry and
marks the rest as they succeed; the pump stores the record
immediately after decode, before any hold path can break, so the
pending path can no longer lose it. A replay of a complete identity
suppresses all ops; a partial identity retries only what is owed.

Also carries the ops_once diagnostic counter in the service snapshot
line and documents the operation-granularity rule in the architecture
doc.

0 files changed, 0 insertions, 0 deletions