v2.1.12-rc3（pre-release）——winload 描述符池诊断 + GOP 顺序默认开 + maker 一键安装

这是 pre-release；Latest 仍为 v2.1.11。 资产：BOOTX64.EFI.2.1.12-rc3（TX 构建事务版）、BOOTX64.EFI.readonly.2.1.12-rc3（只读负控版）、nv-uefi-unlocker-v2.1.12-rc3.zip（不含 ssdiag——杀软误报隔离政策，ssdiag 一律单独下载）、ssdiag-x86_64-windows-0.7.6.exe（独立资产）。校验和以 SHA256SUMS.2.1.12-rc3 为准。

本版首要用途是 #146（B550 winload 0xc000009a）的诊断载具。 根因已于 2026-11-12 定谳：winload 把交棒内存图的每一条描述符装进一个 1024 条静态池（winload.efi!BlpMmInitialize，48B/条，无动态扩容），池耗尽即 0xC000009A；现场分界 = 998 条能启动 / 1005 条失败，十个数据点零例外。rc3 在交棒前把整图按类型计数打行输出（见下），并对 >950 条打硬警告。事务链零改动（铁律：只加只读采样）。

自 v2.1.12-rc2 以来的变化

1. CHAIN-MEMMAP-TYPES 直方图（新，只读）：交棒摘要行之后按 EFI 内存类型输出全图描述符计数（reserved/loader_code/…/pmem/oem 16 桶）+ 小块碎片读数（tiny_conv(<=64KiB)）。判读：tiny-conv 多 = 可挤压碎片（disconnect 候选）；MMIO/RESERVED 重 = 固件布局问题（只能 BIOS 修）；LOADER/BSD 重 = 运行期驻留（驱动方压降）。
2. 描述符条数硬警告（新，只读）：(... N descriptors ...) 总数 >950 时打 CHAIN-MEMMAP: WARNING 行，点名 winload 1024 池与断电重试/BIOS 对照两条出路。950 线按现场最紧门校准（bootmgfw 同款池但 working set 仅几条，winload 倒欠 ~20–25 条）。
3. #228 GOP 顺序修复默认开启：多卡 + 无头 BMC 拓扑下 bootmgr/grub 取第一个 GOP 句柄，而 native-GOP 重建后控制台卡的新子句柄排在队尾 → 引导阶段黑屏。经验证的控制台重建后，把无 EDID 竞争卡的驱动停启一次使其子句柄重排到队尾、控制台子句柄排第一；四道门全过才动手（验证子句柄在场 + 带 EDID + 翻转就位 + 竞争者无 EDID 且非控制台卡），任一失败 = 大声日志 + 零写入，术后读回。健康机负控 = Noop（零写入）。范围 = 本次链内（解锁→交棒→OS）；热重启固件侧重排不在范围内。探针/翻转/隐藏旋钮可关闭（docs/csm-compat.md）。仅影响显示路径，不碰事务链。
4. 幻键防护三轮落地（#220/PR#222，J0s3f）：确认键下沉等待（INPUT-SETTLE）+ 确认后按键抑制表 + \tx-ignore-key.txt 免重建过滤；Esc 永远豁免（abort 通道不可抑制）。
5. maker 一键安装提议 + 资产瘦身（make-usbroot.ps1 / .sh 双语同步）：制盘完成后探测可用目标盘并提议免 U 盘 FAT32 安装（显式确认、可 -NoInstallPrompt / -InstallTo 跳过或指定）；产物树瘦身。
6. 工具与诊断（非 loader）：tools/disable-rtd3.sh（Linux RTD3 掉锁一键修复，FAQ#linux 流程自动化）；ssdiag 0.7.4→0.7.6（GA100VFIO 词典扫盲、镜像探测、GR topology 锚点全家桶、X99 双路 inventory 两处现场捕获修复）——zip 内已不含 ssdiag。

rc1/rc2 已含（跳版用户速览）

STAGING-FALLBACK 自动 LOW 带重试（rc1）+ rc2 的 FLR→FWSEC 重燃→LOW 重建载具修正（#156/#74/#191）；\tx-preload.txt opt-in 化（#198，默认无预载）。整表见 rc2 release notes。

#146 参与者：请用 rc3 回报

用 rc3 跑一次（老盘直接换 EFI\BOOT\BOOTX64.EFI，marker 照旧），把 loader.log 里两行发回来：

CHAIN-MEMMAP: ... (N descriptors, ...)
CHAIN-MEMMAP-TYPES: counted=N/N reserved=... | tiny_conv(<=64KiB): ...

N 就是判决数（>1000 = 条数顶板，断电重试/BIOS 对照；≤1000 且 largest block 腰斩 = 尺寸顶板）。BIOS 版本对照协议（Q-Flash 三轮、每版 2–3 boot 只报 N）见 上一条评论。

v2.1.12-rc3 (pre-release) — winload descriptor-pool diagnostics + GOP ordering default-ON + maker one-click install

Pre-release; Latest remains v2.1.11. Assets: BOOTX64.EFI.2.1.12-rc3 (TX transaction build), BOOTX64.EFI.readonly.2.1.12-rc3 (read-only control), nv-uefi-unlocker-v2.1.12-rc3.zip (no ssdiag inside — AV-false-positive isolation policy; ssdiag is always a separate download), ssdiag-x86_64-windows-0.7.6.exe (standalone). Verify against SHA256SUMS.2.1.12-rc3.

Primary purpose: the diagnostic vehicle for #146 (B550 winload 0xc000009a). Root cause pinned 2026-11-12: winload ingests every descriptor of the handoff memory map into a static pool of exactly 1024 entries (winload.efi!BlpMmInitialize, 48-byte stride, no dynamic overflow); pool exhaustion = 0xC000009A. Field line: 998 descriptors boot, 1005 fail — zero exceptions in ten data points. rc3 prints a per-type histogram of the whole map before handoff (below) and a hard warning above 950 entries. Zero transaction-chain changes (iron rule: read-only sampling only).

Changes since v2.1.12-rc2

1. CHAIN-MEMMAP-TYPES histogram (new, read-only): after the handoff summary line, counts the whole map by EFI memory type (reserved/loader_code/…/pmem/oem, 16 buckets) plus a small-fragment readout (tiny_conv(<=64KiB)). Reading it: tiny-conv-heavy = reclaimable fragmentation (disconnect candidates); MMIO/RESERVED-heavy = firmware layout (BIOS-only fix); LOADER/BSD-heavy = runtime residency (ours to drive down).
2. Descriptor-count hard warning (new, read-only): a CHAIN-MEMMAP: WARNING line fires when the (... N descriptors ...) total exceeds 950, naming the winload 1024 pool and the two outs (power-off retry / BIOS round trip). The 950 line is calibrated to the tightest gate in the field (bootmgfw shares the pool but its working set is a few entries; winload starts ~20–25 in the hole).
3. #228 GOP handle-order fix default-ON: on multi-GPU + headless-BMC topologies, bootmgr/grub take the first GOP handle while a native-GOP rebuild appends the console card's new child at the tail → black screen during boot. After a verified console rebuild, the EDID-less competitor's controller drivers are stopped and restarted once so its child re-sorts to the tail and the console child sorts first; all four gates must pass before any write (verified child present + carries EDID + flip in place + competitors EDID-less and not the console card), any failure = loud log + zero writes, with a post-surgery readback. Healthy-machine negative control = Noop (zero writes). Scope = the in-session chain (unlock → handoff → OS); warm-reboot firmware-side reordering is out of scope. Probe/reorder/hide knobs can disable it (docs/csm-compat.md). Display path only; the transaction chain is untouched.
4. Ghost-key hardening landed (#220/PR#222, J0s3f): confirm-key settle wait (INPUT-SETTLE) + post-confirm key suppression table + \tx-ignore-key.txt rebuild-free filtering; Esc is always exempt (the abort channel is never suppressible).
5. Maker one-click install offer + slimmer asset output (make-usbroot.ps1 / .sh, both synced): after building the stick, probes usable targets and offers a persistent no-USB FAT32 install (explicit confirm; -NoInstallPrompt / -InstallTo to skip or pin); slimmer output tree.
6. Tools & diagnostics (not the loader): tools/disable-rtd3.sh (one-shot Linux RTD3 relock fix, automates FAQ#linux); ssdiag 0.7.4→0.7.6 (GA100VFIO dictionary sweep, mirror probe, GR topology anchor across families, two X99 dual-socket inventory fixes field-caught) — the zip no longer contains ssdiag.

Already in rc1/rc2 (for version-skippers)

STAGING-FALLBACK automatic LOW-band retry (rc1) + the rc2 FLR → FWSEC re-ignition → LOW rebuild vehicle fix (#156/#74/#191); \tx-preload.txt opt-in flip (#198, preload off by default). Full table in the rc2 release notes.

#146 participants: please run rc3 and report

Swap EFI\BOOT\BOOTX64.EFI on your existing stick (markers unchanged) and send two lines from loader.log:

CHAIN-MEMMAP: ... (N descriptors, ...)
CHAIN-MEMMAP-TYPES: counted=N/N reserved=... | tiny_conv(<=64KiB): ...

N is the verdict (> ~1000 = count ceiling: power-off retry / BIOS round; ≤ ~1000 with a halved largest block = size ceiling). The BIOS-version test protocol (Q-Flash, three rounds, 2–3 boots each, report N only) is in the previous comment.