vgsp: eng55 - VTG SPH authoring at family+0x900, DDX ring-head tracker decode, MME pack carrier, and the pump atomic-sleep hoist

- gsp_phys_booter.c: sema_gl_sph_vtg_auth (default 1) authors the client's
  live VTG SPH image at family+0x900 and binds VSA/VSB there; new
  SPH-AUTHOR / SPH-ALIAS-auth receipts and a DS-IMAGE stage census at the
  DS latch (stage-start w0 + code word through the pair cache).
- gsp_phys_booter.c: sema_gl_mme_pack_carry (default 0) + _ms (default 100)
  host-initiated windowless continuation carrier for a split MME pack;
  MME-CARRY-ARM/FIRE/COMPLETE/CANCEL/ABORT receipts, beef-only, bounded.
- gsp_sema_service.c: sema_ddx_tracker_auth (default 0) ring-head decode
  for the DDX channel when the USERD is missing/reset (guest-authored
  C36F release applied verbatim); sema_gr_scan_top default raised to
  0x300000000 for the 12 GiB campaign guest.
- gsp_sema_service.c: hoist the r707e VAS candidate verify out of
  svc.chan_lock (its vfio_dma_rw path can sleep) and add in_atomic guards
  to svc_read/svc_write; fixes the gsp-sema-svc "scheduling while atomic"
  pump stall that lost the marked draw-window launch.
- tools: enable sema_ddx_tracker_auth=1 in params-r1624; use timeout -k in
  the guest GL/GZDoom wrappers so a wedged GPU wait cannot hang a cycle.

Validation: c741/c743 boots (VTG author byte readback, cross-lane and beef
pack completion + REARM, DS-IMAGE census) and the c743 DS-FAST chain; A/B
for the carrier and the tracker decode is still open.

3 files changed, 5 insertions, 3 deletions

diff --git a/tools/guest-diag/gzdoom_pbuf_run.sh b/tools/guest-diag/gzdoom_pbuf_run.sh
index b152bdf..47817b7 100755
--- a/tools/guest-diag/gzdoom_pbuf_run.sh
+++ b/tools/guest-diag/gzdoom_pbuf_run.sh
@@ -81,13 +81,13 @@ printf ' %q' "${CMD[@]}"
 echo
 
 if [ "$GZ_DETACH" = "1" ]; then
-    setsid nohup timeout "$TIMEOUT" "${CMD[@]}" > "$GZLOG" 2>&1 < /dev/null &
+    setsid nohup timeout -k 5 "$TIMEOUT" "${CMD[@]}" > "$GZLOG" 2>&1 < /dev/null &
     echo "PID=$!"
     echo "LOG=$GZLOG"
     exit 0
 fi
 
-timeout "$TIMEOUT" "${CMD[@]}" > "$GZLOG" 2>&1
+timeout -k 5 "$TIMEOUT" "${CMD[@]}" > "$GZLOG" 2>&1
 rc=$?
 echo "RC=$rc"
 echo "LOG=$GZLOG"
diff --git a/tools/guest-diag/mission-gz.sh b/tools/guest-diag/mission-gz.sh
index 717a3d4..cf58f02 100644
--- a/tools/guest-diag/mission-gz.sh
+++ b/tools/guest-diag/mission-gz.sh
@@ -32,7 +32,7 @@ bash /tmp/guest_mode.sh 2>/dev/null || true
 # 2. GPU GL probe: direct pbuffer frames (non-black px0 = path live)
 GLF_FRAMES="${GLF_FRAMES:-5}"
 (
-    timeout 90 /tmp/gl_frames "$GLF_FRAMES" "${GLF_W:-320}" "${GLF_H:-240}" 5 \
+    timeout -k 5 90 /tmp/gl_frames "$GLF_FRAMES" "${GLF_W:-320}" "${GLF_H:-240}" 5 \
         > /tmp/mission-gl.log 2>&1
     echo "glf rc=$? $(date +%T)" >> /tmp/mission-gl.log
 ) &
diff --git a/tools/guest-diag/params-r1624.txt b/tools/guest-diag/params-r1624.txt
index 473a6f6..e071e18 100644
--- a/tools/guest-diag/params-r1624.txt
+++ b/tools/guest-diag/params-r1624.txt
@@ -3,3 +3,5 @@ sema_gr_grace_ms=500 sema_gl_mme_keep_done_across_recycle=1 sema_mme_prelude_cap
 sema_gl_rt0_bind=1
 sema_gl_mme_partial_keep_window=1 sema_gl_mme_pack_keep_gen=1 sema_gl_mme_cb_alias=1
  sema_gl_win_rt0_admit=1
+ sema_ddx_tracker_auth=1
+sema_gl_mme_pack_carry=0 sema_gl_mme_pack_carry_ms=100