IOS LLE: optional Starlet write watch REV_WATCH (StarletOS phase 11 F1)

Logs Starlet CPU stores (instruction address, LR) and device DMA writes
in the given physical ranges. The ARM JIT keeps fastmem but sends accesses
overlapping a watched range to its bus slow path, recording the
instruction address there. Nothing changes without the variable.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/StarletOS_Handoff.md

@@ -172,3 +172,24 @@ and for IOCTLVs whose first input vector is 64 bytes (READ_DIR, GET_USAGE);
 rung, like the OPEN path; nothing else of the buffers. Checked headless under
 Revolution: `/shared2/test2`, `/title/00000001/00000002/data/cache.dat`, the
 GET_USAGE directories. 95 Starlet tests passed.
+
+## Write watch for Starlet memory — 2026-10-06
+
+Companion proposal F1 (approved): find what changes Revolution's RAM layer
+table between two filesystem requests (the companion's finding 11).
+
+- `REV_WATCH=start:size[,start:size...]` (hexadecimal, physical): every
+  Starlet CPU store (`StarletMemory::Write8/16/32`) and every device DMA
+  write (`WriteDMABuffer`, `WriteDMA8`) touching a range is logged as
+  `REVWATCH CPU addr/size value PC <instruction> LR <r14>` or
+  `REVWATCH DMA addr/size PC <instruction>`. Off without the variable.
+- The ARM JIT keeps fastmem; `ARMBus::GetWatchRanges` gives it the ranges,
+  `EmitFastmemAddress` sends any access overlapping one to the existing bus
+  slow path, and the ARM and Thumb slow paths store the instruction address
+  first (only while watching). Speed under watch is the JIT's (companion
+  smoke run: the Menu's main menu at 74 s, as without the watch).
+- `ARMCore.h` (`GetInstructionAddress`, `GetWatchRanges`), `ARMJitX64.cpp`,
+  `ARMJitX64.h` are now exact integration files (26 in the checkpoint).
+- The 95 selected Starlet tests passed (`.starlet_linux`); `.starlet_linux_x11`
+  rebuilt. Smoke run with the companion's Revolution P11-H06: 1519 watched
+  writes on its layer table during start-up, attributed by instruction.