M53 Card 1: GOWIN.ELF — a Go program owns a raw ADR 0007 window (Closes #1245)

[drawmeanelephant]

M53 Card 1 (umbrella #1244 is context only — it stays open).

Closes #1245

What this is

GOWIN.ELF — the first Go consumer of the raw ADR 0007 window seam, in the same family as tools/go/hello.go. One window, one filled rect, no chrome:

sys_win_open (12) -> id
sys_mmap (63)     -> a shared-anonymous back-buffer (MAP_ANONYMOUS|M33_MAP_SHARED)
sys_win_fill (13) -> a visible rect, drawn from that buffer
sys_win_present (14)
sys_poll_event (21) until CloseRequested / WIN_CLOSE (kind 8)
sys_win_close + sys_exit (15 + 3)

No LIBUI, no webrender, no browser, no HTTP, no tabs, no new syscall, kernel untouched, docs/status.md untouched, boot default unchanged. Each of the five markers is printed only after its syscall succeeded, so the marker chain is the syscall chain:

gowin: open id=2
gowin: fill
gowin: present
gowin: close
gowin OK

Files

Path	Change
tools/go/gowin.go	new — the program
tools/go/build-go.sh	gowin -> GOWIN name mapping; links user/go into GOPATH as virelai so a fixture can import the shared guest SDK (the build-web.sh pattern). The five existing fixtures still build.
tools/gate/specs/go-win.spec	new declarative class-B gate, cloned from go-hello.spec
docs/gate-fleet-inventory.md	re-rendered (the repo requires this; never hand-edited)

The gate

Stages .build/go/GOWIN.ELF, execs it, holds dui close 2 (script2) until the program's own gowin: present line arrives, then asserts the five markers plus serial-absent '[EXC] parking:' and serial-absent 'exited status=139'.

dui close <n> is the privileged release path (driving_award.user_close -> remove_user_at), which is what pushes WIN_CLOSE to the window's owner; the first user window of a boot is id 2 (the terminal and the clock are the fixed windows) and the run asserts the program's own gowin: open id= line, so drift shows up as a failed gate rather than a silent pass.

Evidence

just gate go-win   -> PASS 1/1, runner rc 0, 12 s
                      gowin: open id=2 / fill / present / close / OK, no [EXC]
bash tools/inventory-gates.sh --check   -> OK

Beyond the markers, the frame captured at gowin: present was checked against the colour the program painted into its own back-buffer: 46,299 scanout pixels exact 0x3050a0, 96% of the window rect exact. And the gate was deliberately falsified — one marker assert changed to a string the program never prints turned the run red (serial-contains [...]=0, 01: FAIL) before the spec was restored.

Two findings the code records

1. vi.MmapAnon cannot work from a Go program. It hard-codes addr = 0, and a hintless sys_mmap is refused with EINVAL: the GOOS=virelai runtime's sbrk heap reserves upward from the module end and covers the kernel's default mmap base (process.mmap_next_va = 0x1000_0000), which the issue-claim: GOOS=virelai 0b round 2: argv-flake root cause + ADR 0027 thread/futex slots 73/74 #1214 collision rule rejects. GOWIN passes an explicit page-aligned hint (12 GiB, clear of that heap and of the randomized EL0 stack band) through the same svc #0 gateway user/go/vi/vi_arm64.s implements, reached by //go:linkname — no new slot, no new file, no edit to user/go/vi.
2. The scanout must be armed before a window can exist at all. driving_award.user_open returns EINVAL while the manager is unarmed, so a run without the display never reaches a window id (observed as gowin: error open -1 on the first cut of the spec). The spec carries --screen/--via-virtio for that reason.

Rollback

Nothing here mutates kernel state, persisted data, or configuration. Close this PR without merging (the claim on #1245 reopens), or git revert 94beb03. Deleting tools/gate/specs/go-win.spec removes the gate from the discovered fleet with no other edit.

Handoff

Card 2's codec is not in this PR; it lives on agent/autocoder/m53-tabcodec (its own claim is #1246). The maintainer adds the M53 row to docs/status.md at landing, and merge closes #1245.