IOS LLE: shadow comparison for REV_WATCH (StarletOS phase 11 H1)

Reads and IPC-reply audits compare each watched range with what the
Starlet and the devices wrote, revealing other writers; register-list
transfers in a watched virtual range log their translation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/StarletOS_Handoff.md

@@ -193,3 +193,22 @@ table between two filesystem requests (the companion's finding 11).
 - The 95 selected Starlet tests passed (`.starlet_linux`); `.starlet_linux_x11`
   rebuilt. Smoke run with the companion's Revolution P11-H06: 1519 watched
   writes on its layer table during start-up, attributed by instruction.
+
+## Shadow comparison for the write watch — 2026-10-06
+
+Companion proposal H1 (approved). The companion's diagnostic image showed
+its kernel reading back, from its RAM layer table, an entry different from
+the one it had just written, with no other Starlet store or device DMA seen.
+
+- With `REV_WATCH`, `StarletMemory` keeps a shadow of each range, updated by
+  the Starlet stores and device DMA it logs. A Starlet read whose bytes differ
+  from the shadow logs `REVWATCH DIFF addr/size read … expected … PC … LR …`
+  (another writer changed them: Broadway, its GPU, the DSP…); each IPC reply
+  (ARMCTRL Y1) audits the ranges (`REVWATCH AUDIT addr+len now …`, at most 16
+  runs per reply). The shadow then adopts the new bytes.
+- Register-list transfers whose virtual range overlaps a watched range now
+  take the JIT's architectural helper, and the interpreter logs
+  `REVWATCH LDM|STM virtual->physical/size PC …` (its own translation).
+- `ARMCore.cpp` keeps its CRLF bytes. 95 Starlet tests passed. Companion
+  smoke run (P11-H06D, 150 s): no DIFF, no AUDIT, 9 LDM with identical
+  virtual and physical addresses.