r444 copy-snapshot ownership: key the fail4 held-copy staging snapshot by (channel, ring entry, push-content hash), not (dst,src,total) alone

The wedge_ab deterministic reproducer (bad = mutated-element count) root
cause: a held CE copy's source snapshot was captured for one ring entry,
left behind when that entry's copy executed through a path that never
consumed it (hardware-primary forwarded copy, or a post-execution
re-decode whose copy was re-held), and then consumed by a LATER entry's
copy that happens to share the (dst,src,total) triple - the client's
cudaMemcpy released early with the PREVIOUS step's bytes in the device
buffer, and the next GR launch computed on stale inputs (r441/r442/r443
evidence: step N read step N-1 content; sema-bigcopy src16 shows the fresh
live source at execution time while dst16_after shows the old snapshot's
bytes).

Owner identity is (ch->h_object, entry_idx, svc_pass_hash); the pass hash
separates a ring slot reused by a fresh push from the entry that captured
the snapshot. svc_opdef_clear() additionally frees any snapshot still
owned by a consumed entry, so no snapshot can outlive its entry.

0 files changed, 0 insertions, 0 deletions